Function at 0x10083af
Capabilities:
Persist via run registry key
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x101200c]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov dword [ebp - 0x220], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x224], eax
push 0x41
xor eax, eax
xor edx, edx
pop ecx
lea edi, [ebp - 0x208]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
sub eax, edx
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x20c], edx
mov dword [esi], edx
je 0x1008835
dec eax
je 0x10086c1
dec eax
je 0x10084b9
dec eax
je 0x1008434
dec eax
je 0x10084b9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100d528
leave
ret 0x18
push ebx
push 9
call fcn.0100835a
test eax, eax
je 0x1008974
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.01008309
test eax, eax
je 0x1008974
push ebx
call fcn.01008278
test eax, eax
jl 0x1008974
mov eax, 0xfa
sub eax, dword [ebp - 0x20c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x3f8
push dword [0x1016c8c]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x20c]
mov ecx, 0x104
push 0x100593c
sub ecx, eax
push ecx
add ebx, eax
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x10
or dword [esi], 1
jmp 0x1008974
push ebx
push 0x1a
call fcn.0100835a
test eax, eax
mov esi, 0x104
jne 0x10085e7
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
xor eax, eax
push eax
push 0x2001f
push eax
push eax
push eax
push 0x1002380
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1008974
lea eax, [ebp - 0x20c]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
push 0
mov edi, 0x10023c4
push edi
push dword [ebp - 0x214]
mov dword [ebp - 0x20c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100857d
cmp dword [ebp - 0x21c], 2
jne 0x1008575
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebp - 0x20c], eax
mov edi, ecx
test edi, edi
je 0x10085d3
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x20c], eax
jmp 0x10085d3
dec dword [ebp - 0x20c]
jmp 0x10085d0
push esi
push 0x10166ac
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, esi
sub ecx, eax
push ecx
mov dword [ebp - 0x20c], eax
add eax, ebx
push eax
push 0x3eb
push dword [0x1016c8c]
call dword [sym.imp.USER32.dll_LoadStringA]
add dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
inc eax
push eax
push ebx
push 1
push 0
push edi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor edi, edi
inc edi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x1008974
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.01008309
test eax, eax
je 0x1008974
mov eax, dword [ebp - 0x20c]
mov ecx, esi
sub ecx, eax
push ecx
push 0x1005380
add eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
add dword [ebp - 0x20c], 0x29
push ebx
call fcn.01008278
test eax, eax
jl 0x1008974
mov eax, 0xff
sub eax, dword [ebp - 0x20c]
push eax
lea eax, [ebp - 0x104]
push eax
xor eax, eax
cmp dword [ebp + 8], 2
setne al
add eax, 0x3f0
push eax
push dword [0x1016c8c]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x20c]
mov ecx, esi
push 0x1005928
sub ecx, eax
push ecx
add ebx, eax
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov eax, dword [ebp - 0x218]
or dword [eax], 1
add esp, 0x10
cmp dword [ebp + 8], 2
jne 0x1008974
cmp dword [ebp + 0xc], 0
je 0x1008974
push 0
push esi
push dword [ebp - 0x220]
push 0x10022fc
call fcn.01006f8a
test eax, eax
je 0x1008974
mov eax, dword [ebp - 0x218]
or dword [eax], 2
jmp 0x1008974
push ebx
push edx
call fcn.0100835a
test eax, eax
mov esi, 0x104
jne 0x1008790
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
push 0x1002380
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1008974
lea eax, [ebp - 0x20c]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
xor edi, edi
push edi
push 0x10053fc
push dword [ebp - 0x214]
mov dword [ebp - 0x20c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1008778
cmp dword [ebp - 0x21c], 2
jne 0x1008768
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor ecx, ecx
cmp eax, edi
setne cl
mov dword [ebp - 0x20c], eax
cmp ecx, edi
mov dword [ebp - 0x210], ecx
je 0x1008778
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x100876e
dec dword [ebp - 0x20c]
mov dword [ebp - 0x210], 1
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x210], edi
je 0x1008974
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.01008309
test eax, eax
je 0x1008974
push ebx
call fcn.01008278
test eax, eax
jl 0x1008974
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
mov eax, 0xff
sub eax, dword [ebp - 0x20c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x3ef
push dword [0x1016c8c]
call edi
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x20c]
mov ecx, esi
push 0x1005928
sub ecx, eax
push ecx
add ebx, eax
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov eax, dword [ebp - 0x218]
or dword [eax], 1
add esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x1008974
push 0xff
push dword [ebp - 0x224]
push 0x40e
push dword [0x1016c8c]
call edi
mov eax, dword [ebp - 0x218]
or dword [eax], 4
jmp 0x1008698
push ebx
push 0x19
call fcn.0100835a
test eax, eax
mov esi, 0x104
jne 0x100890b
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0x1002380
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1008974
lea eax, [ebp - 0x20c]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
xor edi, edi
push edi
push 0x1005404
push dword [ebp - 0x214]
mov dword [ebp - 0x20c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10088f7
cmp dword [ebp - 0x21c], 2
jne 0x10088e7
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor ecx, ecx
cmp eax, edi
setne cl
mov dword [ebp - 0x20c], eax
cmp ecx, edi
mov dword [ebp - 0x210], ecx
je 0x10088f7
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x20c], eax
jmp 0x10088f7
dec dword [ebp - 0x20c]
mov dword [ebp - 0x210], 1
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x210], edi
je 0x1008974
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.01008309
test eax, eax
je 0x1008974
push ebx
call fcn.01008278
test eax, eax
jl 0x1008974
mov eax, 0xff
sub eax, dword [ebp - 0x20c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x3ef
push dword [0x1016c8c]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x20c]
push 0x1005928
sub esi, eax
add ebx, eax
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov eax, dword [ebp - 0x218]
add esp, 0x10
or dword [eax], 1
mov eax, dword [ebp - 0x218]
cmp dword [eax], 0
je 0x1008423
xor eax, eax
inc eax
jmp 0x1008425