Function at 0x1011cdd
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4b4
mov eax, dword [0x102a0ec]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
push esi
push 4
mov dword [ebp - 4], eax
call fcn.01017179
mov dword [ebp - 0x4b4], eax
call fcn.0100d07d
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [0x102aec0], eax
mov dword [0x102c6b0], 2
call fcn.0100cd2e
call fcn.01010528
cmp edi, esi
je 0x1012225
push 0x153
lea eax, [ebp - 0x2ac]
push edi
push eax
call dword [sym.imp.msvcrt.dll_mbstowcs]
mov edi, dword [sym.imp.msvcrt.dll_wcsstr]
lea eax, [ebp - 0x2ac]
push 0x10053f8
push eax
call edi
add esp, 0x14
test eax, eax
je 0x1011dde
mov dword [ebp - 0x4b4], esi
mov dword [ebp - 0x4b0], esi
call fcn.0100db7e
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x4b0]
push eax
push 0x20019
push esi
push 0x1005398
mov ebx, 0x80000002
push ebx
call edi
test eax, eax
je 0x1011dcd
lea eax, [ebp - 0x4b4]
push eax
push 3
push esi
push 0x1005338
push ebx
call edi
test eax, eax
jne 0x1012225
push 0x100530c
push dword [ebp - 0x4b4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x4b4]
jmp 0x1011dd3
push dword [ebp - 0x4b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1012225
call fcn.01011aac
call fcn.01011bf4
call fcn.01019dd2
lea eax, [ebp - 0x2ac]
push 0x10052f0
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x1011e0b
call fcn.01012b07
jmp 0x1012225
lea eax, [ebp - 0x2ac]
push 0x10052d0
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x1011e2a
push esi
call fcn.0100e9f8
jmp 0x1012225
lea eax, [ebp - 0x2ac]
push 0x10052c0
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x1011e4a
push 1
call fcn.0100d118
jmp 0x1012225
push esi
call fcn.0100d118
lea eax, [ebp - 0x2ac]
push 0x10052ac
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x1011e6e
call fcn.010253d5
jmp 0x1012225
lea eax, [ebp - 0x2ac]
push 0x1005294
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x1011e8d
push esi
call fcn.01023967
jmp 0x1012225
lea eax, [ebp - 0x2ac]
push 0x1005280
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x1011efd
call fcn.01015dc8
test eax, eax
jne 0x1012225
cmp dword [ebp - 0x4b4], esi
jne 0x1012225
lea eax, [ebp - 0x2ac]
push 0x1005264
push eax
call edi
test eax, eax
pop ecx
pop ecx
push esi
je 0x1011ed6
call fcn.010117dd
jmp 0x1011edb
call fcn.0101168e
push esi
call fcn.0101563f
call fcn.01021e16
push esi
push esi
push 0x2000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x1012225
lea eax, [ebp - 0x2ac]
push 0x1005250
push eax
call edi
pop ecx
test eax, eax
pop ecx
lea eax, [ebp - 0x2ac]
je 0x1011f46
push 0x1005264
push eax
call edi
test eax, eax
pop ecx
pop ecx
push 1
je 0x1011f2e
call fcn.010117dd
jmp 0x1011f33
call fcn.0101168e
push esi
push dword [ebp - 0x4b4]
call fcn.01014c24
call fcn.010224b0
jmp 0x1011ee6
push 0x100522c
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x1011f79
call fcn.010253aa
push esi
push esi
push esi
push esi
call fcn.01024a55
push esi
push esi
push 0x2000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x1012240
lea eax, [ebp - 0x2ac]
push 0x1005220
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x1011f91
push 4
jmp 0x1011fa7
lea eax, [ebp - 0x2ac]
push 0x1005214
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x1011fb2
push 5
mov dword [ebp - 0x4b0], 1
pop ebx
lea eax, [ebp - 0x2ac]
push 0x10051fc
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x1011fd5
call fcn.0100f251
call fcn.01017f6c
jmp 0x1012225
call fcn.0100f487
push 1
call fcn.0101001a
call fcn.01012b07
call fcn.0100db7e
lea eax, [ebp - 0x2ac]
push 0x10051e8
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x1012004
call fcn.0100cf4f
lea eax, [ebp - 0x2ac]
push 0x10051d0
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x1012073
push 1
call fcn.0100c787
test eax, eax
je 0x101204a
lea eax, [ebp - 0x2ac]
push 0x10051b8
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x101204a
push esi
call fcn.010140c8
push dword [ebp - 0x4b0]
call fcn.010144c1
jmp 0x1012064
push ebx
push dword [ebp - 0x4b4]
call fcn.01014c24
push esi
push 1
push dword [ebp - 0x4b4]
call fcn.01015af4
call fcn.0100efff
call fcn.0100c895
call fcn.0100cc00
push esi
call fcn.0100c787
test eax, eax
je 0x1012093
push 1
push 1
push esi
push esi
call fcn.01024a55
mov ebx, dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x1012129
lea eax, [ebp - 0x2ac]
push 0x10051a4
push eax
call edi
test eax, eax
mov ebx, dword [sym.imp.SHELL32.dll_SHChangeNotify]
pop ecx
pop ecx
je 0x10120b8
push esi
push esi
push esi
push esi
call fcn.01024a55
jmp 0x10120e9
lea eax, [ebp - 0x2ac]
push 0x1005188
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x10120f7
push esi
push esi
push 1
push esi
call fcn.01024a55
push esi
push esi
push esi
push 5
call fcn.01018dae
test eax, eax
je 0x10120e9
call fcn.0100db61
push esi
push esi
push 0x2000
push 0x8000000
call ebx
lea eax, [ebp - 0x2ac]
push 0x1005164
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x1012137
push 0x1005158
call fcn.0101e485
push 0x1005150
call fcn.0101e485
push esi
push esi
push esi
push 1
call fcn.01024a55
push esi
push esi
push 0x2000
push 0x8000000
call ebx
push 0x44c
push 0xa28
push 1
push 5
call fcn.01018dae
test eax, eax
je 0x1012225
call fcn.01015dc8
test eax, eax
jne 0x1012225
cmp dword [ebp - 0x4b4], esi
jne 0x1012225
call fcn.0100d436
test eax, eax
jne 0x1012225
push esi
mov dword [ebp - 0x4b0], esi
call fcn.0101168e
push esi
call fcn.0101563f
call fcn.01021e16
push esi
lea eax, [ebp - 0x4b0]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1004ef0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1012217
push 0xff
lea eax, [ebp - 0x4ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x101220b
push 0x1004e58
push 0x100
lea eax, [ebp - 0x4ac]
push eax
call fcn.0100d4ff
lea eax, [ebp - 0x4ac]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x4ac]
push eax
push 1
push esi
push 0x1004e44
push dword [ebp - 0x4b0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x4b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push esi
push 0x2000
push 0x8000000
call ebx
lea eax, [ebp - 0x2ac]
push eax
push 0x1005130
push 2
call fcn.01028201
add esp, 0xc
call fcn.01027c93
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor eax, eax
pop ebx
call fcn.0101672d
leave
ret 0x10