Function at 0x1029022
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1048628]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x208], esi
jne 0x102905e
mov eax, 0x80004003
jmp 0x10292dc
push 0x28
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0x20c], eax
jne 0x102907a
mov eax, 0x8007000e
jmp 0x10292dc
push ebx
push edi
lea eax, [ebp - 0x208]
push eax
push 2
push esi
push 0x1001bf8
mov ebx, 0x80000001
push ebx
call fcn.0101c02d
test eax, eax
jne 0x1029113
push 0x208
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0x214], eax
je 0x1029107
mov edi, 0x104
push edi
push eax
call fcn.0101d3e2
test eax, eax
je 0x10290fb
push 0x1005c54
push edi
push dword [ebp - 0x214]
call fcn.0100f5a7
push dword [ebp - 0x214]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x214]
push 1
push esi
push 0x1005c34
push dword [ebp - 0x208]
call fcn.0101c11a
push dword [ebp - 0x214]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1005c24
push 0x1005bb8
lea eax, [ebp - 0x204]
push 0xff
push eax
call fcn.0100f541
add esp, 0x10
push esi
lea eax, [ebp - 0x208]
push eax
push esi
push 3
push esi
push esi
push esi
lea eax, [ebp - 0x204]
push eax
push ebx
call fcn.0101bbbd
mov edi, eax
cmp edi, esi
jne 0x1029274
mov edi, 0x1004a14
jmp 0x102916f
cmp dword [0x104a2f0], 0x3e8
jge 0x102919f
inc dword [0x104a2f0]
push dword [0x104a2f0]
push edi
push 0x14
push dword [ebp - 0x20c]
call fcn.0100f541
add esp, 0x10
push esi
push esi
push esi
push esi
push dword [ebp - 0x20c]
push dword [ebp - 0x208]
call fcn.0101c24b
test eax, eax
je 0x102915d
push dword [ebp - 0x210]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x210]
push 2
push esi
push dword [ebp - 0x20c]
push dword [ebp - 0x208]
call fcn.0101c11a
mov edi, eax
cmp edi, esi
jne 0x10291d7
inc dword [0x104a2f0]
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x1029274
cmp dword [ebp - 0x218], esi
je 0x102929a
push 0x1005ba0
push 0x1005bb8
lea eax, [ebp - 0x204]
push 0xff
push eax
call fcn.0100f541
add esp, 0x10
push esi
lea eax, [ebp - 0x208]
push eax
push esi
push 3
push esi
push esi
push esi
lea eax, [ebp - 0x204]
push eax
push ebx
call fcn.0101bbbd
mov edi, eax
cmp edi, esi
jne 0x1029274
push dword [ebp - 0x218]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x218]
push 2
push esi
push dword [ebp - 0x20c]
push dword [ebp - 0x208]
call fcn.0101c11a
push dword [ebp - 0x208]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x102929a
jle 0x1029282
and edi, 0xffff
or edi, 0x80070000
push edi
push dword [ebp - 0x210]
push 0x1005b60
push 2
call fcn.0102ae85
add esp, 0x10
jmp 0x10292cc
push dword [ebp - 0x210]
push 0x1005b24
push 5
call fcn.0102ae85
add esp, 0xc
cmp dword [ebp + 0x14], esi
je 0x10292c7
push esi
push dword [ebp - 0x210]
mov ecx, 0x104a2f8
push 8
call fcn.01027843
mov edi, 0xd2af9
push dword [ebp - 0x20c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.01018732
leave
ret 0x10