Function at 0x100029c0
Capabilities:
Delete registry value
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
sub esp, 0x110
mov eax, dword [0x1001f170]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
mov ebx, dword [esp + 0x120]
test ebx, ebx
jne 0x100029f9
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1000bd45
add esp, 0x110
ret
mov eax, dword [esp + 0x11c]
dec eax
push esi
push edi
cmp eax, 0xd
ja case.default.0x10002a0c
jmp dword [eax*4 + 0x10002fc4]
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.1000b580
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1000bd45
add esp, 0x110
ret
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.1000b580
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1000bd45
add esp, 0x110
ret
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
push 0x80000001
call fcn.1000b580
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1000bd45
add esp, 0x110
ret
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
push 0x80000002
call fcn.1000b580
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1000bd45
add esp, 0x110
ret
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
push 0x80000002
call fcn.1000b580
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1000bd45
add esp, 0x110
ret
mov ecx, 8
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, ebx
movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002b10
sub eax, edx
cmp eax, 0xa0
jae 0x10002f8f
mov eax, ebx
mov edx, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002b28
lea edi, [esp + 0x14]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10002b36
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0xc]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10002f8f
mov edx, dword [esp + 0xc]
push str.ImagePath
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1000bd45
add esp, 0x110
ret
mov ecx, 0xf
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify_
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002bb7
sub eax, edx
cmp eax, 0xa0
jae 0x10002f8f
mov eax, ebx
mov edx, ebx
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002bd0
lea edi, [esp + 0x14]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10002be0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10002f8f
mov eax, dword [esp + 0xc]
push str.DllName
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1000bd45
add esp, 0x110
ret
mov ecx, 0x12
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, ebx
movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002c62
sub eax, edx
cmp eax, 0xa0
jae 0x10002f8f
mov eax, ebx
mov edx, ebx
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002c80
lea edi, [esp + 0x14]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10002c90
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
and ecx, 3
push 0x80000002
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10002f8f
mov ecx, dword [esp + 0xc]
push str.Debugger
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1000bd45
add esp, 0x110
ret
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
call fcn.1000b580
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1000bd45
add esp, 0x110
ret
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call fcn.1000b580
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1000bd45
add esp, 0x110
ret
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push 0x80000001
call fcn.1000b580
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1000bd45
add esp, 0x110
ret
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
call fcn.1000b580
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1000bd45
add esp, 0x110
ret
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push 0x80000002
call fcn.1000b580
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1000bd45
add esp, 0x110
ret
mov eax, dword [str.CLSID_]
mov dl, byte [0x1001ab4e]
mov cx, word [0x1001ab4c]
mov dword [esp + 0x14], eax
mov eax, ebx
mov byte [esp + 0x1a], dl
mov word [esp + 0x18], cx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002e00
sub eax, edx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, 0xa0
jae 0x10002eab
mov eax, ebx
mov edx, ebx
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002e20
lea edi, [esp + 0x18]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10002e30
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x18]
rep movsb byte es:[edi], byte [esi]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10002e50
mov ecx, dword [str.InprocServer32]
mov edx, dword [0x1001ab54]
mov dword [eax], ecx
mov ecx, dword [0x1001ab58]
mov dword [eax + 4], edx
mov edx, dword [0x1001ab5c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10002eab
mov edx, dword [esp + 0x10]
push 0x10019e5c
push edx
call ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1001ab68]
mov edx, dword [0x1001ab64]
mov ecx, dword [str.SOFTWAREClassesCLSID_]
mov dword [esp + 0x20], eax
mov eax, dword [0x1001ab74]
mov dword [esp + 0x1c], edx
mov edx, dword [0x1001ab70]
mov dword [esp + 0x18], ecx
mov ecx, dword [0x1001ab6c]
mov dword [esp + 0x2c], eax
mov eax, ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], ecx
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002ef0
sub eax, edx
cmp eax, 0xa0
jae 0x10002f8e
mov eax, ebx
mov edx, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002f08
lea edi, [esp + 0x18]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10002f16
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x18]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10002f33
mov ecx, dword [str.InprocServer32]
mov edx, dword [0x1001ab54]
mov dword [eax], ecx
mov ecx, dword [0x1001ab58]
mov dword [eax + 4], edx
mov edx, dword [0x1001ab5c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10002f8e
mov edx, dword [esp + 0x14]
push 0x10019e5c
push edx
call ebp
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.1000bd45
add esp, 0x110
ret
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebx
xor ecx, esp
or eax, 0xffffffff
call fcn.1000bd45
add esp, 0x110
ret