Function at 0x1001a4f
Capabilities:
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x320
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
xor esi, esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20019
push esi
push esi
push esi
push 0x10011b0
push 0x80000001
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
call edi
test eax, eax
jne 0x1001ac9
cmp dword [ebp - 8], 2
jne 0x1001ac9
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0x10011c8
push dword [ebp - 4]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001ac9
cmp dword [ebp - 0x10], 1
je 0x1001d5a
cmp dword [ebp - 4], esi
je 0x1001ad7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x10012a4
push 0x80000000
call edi
test eax, eax
jne 0x1001d5a
cmp dword [ebp - 8], 2
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, 0x10012ac
jne 0x1001b87
push 0x1001150
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001b87
lea eax, [ebp - 0x21c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1001d5a
lea eax, [ebp - 0x21c]
push eax
call ebx
test eax, eax
je 0x1001b87
push esi
push 0x10019a0
push dword [ebp + 8]
push 0x898
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
je 0x1001d5a
push edi
call ebx
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push esi
push esi
push dword [ebp - 4]
call edi
test eax, eax
jne 0x1001d5a
push 0x10012d0
call ebx
push eax
push 0x10012d0
push 1
push esi
push 0x10012c0
push dword [ebp - 4]
call edi
test eax, eax
jne 0x1001d5a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x1001314
push 0x80000000
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1001d5a
push 0x1001328
call ebx
push eax
push 0x1001328
push 1
push esi
push esi
push dword [ebp - 4]
call edi
test eax, eax
jne 0x1001d5a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x1001334
push 0x80000000
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1001d5a
push 0x104
lea eax, [ebp - 0x320]
push eax
jmp section..htext
cmp dword [ebp - 4], esi
je 0x1001d68
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 8