Function at 0x1027dba
Capabilities:
Delete registry key
Delete registry value
Persist via netsh registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 4
pop edi
xor eax, eax
inc eax
push 0x10027d0
mov ebx, 0x80000001
xor esi, esi
push ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push esi
lea eax, [ebp - 0x28]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1002778
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1027e5b
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
push 0x1002758
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1027e33
cmp dword [ebp - 0x30], edi
je 0x1027e52
push edi
lea eax, [ebp - 0x34]
push eax
push edi
push esi
push 0x1002758
push dword [ebp - 0x28]
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x28]
push eax
push 3
push esi
push 0x10026d8
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1027e9a
push edi
lea eax, [ebp - 0x34]
push eax
push edi
push esi
push 0x1002270
push dword [ebp - 0x28]
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x28]
push eax
push 3
push esi
push 0x1002670
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10280a7
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
push 0x100265c
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ebx, dword [sym.imp.msvcrt.dll__wcsicmp]
jne 0x1027f21
cmp dword [ebp - 0x30], 1
jne 0x1027f21
lea eax, [ebp - 0x24]
push 0x10024b0
push eax
call ebx
pop ecx
mov edi, eax
pop ecx
neg edi
sbb edi, edi
push esi
inc edi
push edi
push 0x1002648
call fcn.01035c9a
push esi
push edi
push 0x1002634
call fcn.01035c9a
push 0x100265c
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
push 0x1002620
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1027f93
cmp dword [ebp - 0x30], 1
jne 0x1027f93
lea eax, [ebp - 0x24]
push 0x10024b0
push eax
call ebx
pop ecx
mov edi, eax
pop ecx
neg edi
sbb edi, edi
push esi
inc edi
push edi
push 0x1002648
call fcn.01035c9a
push esi
push edi
push 0x100260c
call fcn.01035c9a
push esi
push edi
push 0x1002634
call fcn.01035c9a
push 0x1002620
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
mov edi, 0x10025f8
push edi
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1027fe8
cmp dword [ebp - 0x30], 1
jne 0x1027fe8
lea eax, [ebp - 0x24]
push 0x10024b0
push eax
call ebx
pop ecx
neg eax
pop ecx
sbb eax, eax
push esi
inc eax
push eax
push 0x10025e4
call fcn.01035c9a
push edi
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
push 0x10025d0
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102809e
cmp dword [ebp - 0x30], 1
jne 0x102809e
lea eax, [ebp - 0x24]
push 0x10024b0
push eax
call ebx
pop ecx
mov edi, eax
pop ecx
neg edi
sbb edi, edi
push esi
inc edi
push edi
push 0x10025b8
call fcn.01035c9a
push esi
push edi
push 0x10025a4
call fcn.01035c9a
push esi
push edi
push 0x100258c
call fcn.01035c9a
push esi
push edi
push 0x1002578
call fcn.01035c9a
push esi
push edi
push 0x1002564
call fcn.01035c9a
push esi
push edi
push 0x1002550
call fcn.01035c9a
push esi
push edi
push 0x100253c
call fcn.01035c9a
push esi
push edi
push 0x1002524
call fcn.01035c9a
push 0x10025d0
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.01027b48
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret