Function at 0x1030509
Capabilities:
Delete registry value
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x107342c]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x88]
push eax
push 0x2001f
xor ebx, ebx
push ebx
push 0x1013e98
push 0x80000002
mov dword [ebp - 0x88], ebx
lea edi, [ebp - 0x84]
mov dword [ebp - 0x8c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jne 0x103067f
lea eax, [ebp - 0x8c]
push eax
mov eax, edi
push eax
lea eax, [ebp - 0x90]
push eax
push ebx
push 0x1013e7c
push dword [ebp - 0x88]
call esi
cmp eax, 0x7a
je 0x103058d
cmp eax, 0xea
jne 0x10305c1
push dword [ebp - 0x8c]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x1030752
lea eax, [ebp - 0x8c]
push eax
push edi
lea eax, [ebp - 0x90]
push eax
push ebx
push 0x1013e7c
push dword [ebp - 0x88]
call esi
cmp eax, ebx
jne 0x10305e0
push dword [ebp - 0x8c]
push edi
push 1
push ebx
push 0x1013e68
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x8c]
push eax
push edi
lea eax, [ebp - 0x90]
push eax
push ebx
push 0x1013e54
push dword [ebp - 0x88]
call esi
cmp eax, 0x7a
je 0x1030609
cmp eax, 0xea
jne 0x103064e
lea eax, [ebp - 0x84]
cmp edi, eax
je 0x103061a
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x8c]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x1030752
lea eax, [ebp - 0x8c]
push eax
push edi
lea eax, [ebp - 0x90]
push eax
push ebx
push 0x1013e54
push dword [ebp - 0x88]
call esi
cmp eax, ebx
jne 0x103066d
push dword [ebp - 0x8c]
push edi
push 1
push ebx
push 0x1013e44
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x88], ebx
lea eax, [ebp - 0x88]
push eax
push 0x2001f
push ebx
push 0x1013de8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1030752
lea eax, [ebp - 0x8c]
push eax
push edi
lea eax, [ebp - 0x90]
push eax
push ebx
push 0x1013dc0
push dword [ebp - 0x88]
call esi
cmp eax, 0x7a
je 0x10306cd
cmp eax, 0xea
jne 0x103070e
lea eax, [ebp - 0x84]
cmp edi, eax
je 0x10306de
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x8c]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x1030752
lea eax, [ebp - 0x8c]
push eax
push edi
lea eax, [ebp - 0x90]
push eax
push ebx
push 0x1013dc0
push dword [ebp - 0x88]
call esi
cmp eax, ebx
jne 0x103072f
push dword [ebp - 0x8c]
push edi
push 1
push ebx
push 0x1013d9c
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1030740
push 0x1013d9c
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x88], ebx
cmp dword [ebp - 0x88], ebx
je 0x1030766
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x84]
cmp edi, eax
je 0x1030777
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0103e4d8
leave
ret