Function at 0x10009a20
Capabilities:
Check if file exists
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bebd
mov eax, dword fs:[0]
push eax
sub esp, 0x468
mov eax, dword [0x10051114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x420]
mov dword [ebp - 0x46c], 1
push 0
push eax
mov dword [ebp - 0x468], 0x104
call fcn.100214a0
add esp, 0xc
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x46c]
push eax
push 0x1003f010
push str.SoftwareHaloWallpaper
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x464]
push eax
call fcn.1000c4f0
add esp, 4
push dword [ebp - 0x464]
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
or esi, 0xffffffff
test eax, eax
jne 0x10009ad7
xor edi, edi
jmp 0x10009dd2
push 7
xor eax, eax
mov dword [ebp - 0x428], 0
push str.wpsedrv
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
call fcn.100039c0
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 1
push eax
call fcn.1000ca00
add esp, 4
test eax, eax
jne 0x10009b34
lea eax, [ebp - 0x438]
push eax
call fcn.1000c600
add esp, 4
test eax, eax
je 0x10009dc5
test bl, bl
je 0x10009d55
push str.SYSTEMCurrentControlSetServiceswpsedrv
lea ecx, [ebp - 0x454]
call fcn.10002350
push str.d.halopaper.cn
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 2
call fcn.10002350
mov eax, dword [ebp - 0x460]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov byte [ebp - 4], 3
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push str.Host
push dword [ebp - 0x454]
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str.halowp
lea ecx, [ebp - 0x458]
call fcn.10002350
mov eax, dword [ebp - 0x458]
mov byte [ebp - 4], 4
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push str.AppName
push dword [ebp - 0x454]
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100214a0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.Halowp.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ecx
lea eax, [ebp - 0x218]
mov ecx, esp
push eax
call fcn.10002350
lea eax, [ebp - 0x45c]
push eax
call fcn.10002fe0
add esp, 8
mov eax, dword [ebp - 0x45c]
mov byte [ebp - 4], 5
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push str.AppVersion
push dword [ebp - 0x454]
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push str._url3_
lea ecx, [ebp - 0x470]
call fcn.10002350
mov eax, dword [ebp - 0x458]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push 0x1003f24c
push dword [ebp - 0x454]
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10009c86
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
push 0x1003f254
push dword [ebp - 0x454]
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov edx, dword [ebp - 0x470]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10009cd1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x45c]
mov eax, esi
mov byte [ebp - 4], 4
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10009cf2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x458]
mov eax, esi
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10009d13
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x460]
mov eax, esi
mov byte [ebp - 4], 2
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10009d34
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x454]
mov eax, esi
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10009d55
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x438]
push eax
call fcn.1000c9c0
add esp, 4
test eax, eax
jne 0x10009d80
lea eax, [ebp - 0x438]
push eax
call fcn.1000c4c0
add esp, 4
test eax, eax
jne 0x10009d80
lea edi, [eax + 1]
jmp 0x10009dc7
lea eax, [ebp - 0x438]
push eax
call fcn.1000ca40
add esp, 4
test eax, eax
jne 0x10009dc5
push str.wpsedrv
lea ecx, [ebp - 0x450]
call fcn.10008c90
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 6
push eax
call fcn.1000cbd0
add esp, 4
lea ecx, [ebp - 0x450]
mov edi, eax
call fcn.10002490
jmp 0x10009dc7
xor edi, edi
lea ecx, [ebp - 0x438]
call fcn.10002490
mov eax, dword [ebp - 0x464]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x10009df4
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100178b1
mov esp, ebp
pop ebp
ret