Function at 0x1001aa26
Capabilities:
Delete registry value
Get common file path
Persist via appinit_dlls registry key
Persist via default file association registry key
Persist via run registry key
Persist via winlogon helper dll registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
mov esi, 0x104
push edi
push esi
lea eax, [ebp - 0x10c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
mov edi, 0x10078b14
mov ebx, SysReAllocString
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push edi
push str..exe
push ebx
mov dword [ebp - 8], 1
mov dword [ebp - 4], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [ebp - 0x10c]
push str.exefile
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x1001aab1
push str.exefile
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push str.exefile
push 1
push edi
push str..exe
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push esi
lea eax, [ebp - 0x10c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 8], 1
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push edi
push str.exefile_shellopencommand
push ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [ebp - 0x10c]
push str.__1___
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x1001ab21
push str.__1___
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push str.__1___
push 1
push edi
push str.exefile_shellopencommand
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov dl, byte [0x10078b14]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x20f]
mov byte [ebp - 0x210], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x313]
mov byte [ebp - 0x314], dl
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x314]
push eax
call fcn.10016eff
pop ecx
lea eax, [ebp - 0x314]
pop ecx
push eax
push str.__sInternet_ExplorerIEXPLORE.EXE____1
lea eax, [ebp - 0x210]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
push esi
lea eax, [ebp - 0x10c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x1c
lea eax, [ebp - 4]
mov edi, str.Applicationsiexplore.exe_shellopencommand
mov dword [ebp - 8], 1
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push 0x10078b14
push edi
push ebx
mov dword [ebp - 4], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x1001abfb
lea eax, [ebp - 0x210]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push 0x10078b14
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
call fcn.10016b76
test eax, eax
jne 0x1001ae99
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push str.load
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push ebx
call edi
push 0x100733c0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push ebx
call edi
push str.load
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push SysReAllocString
call edi
push 0x100733c0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push SysReAllocString
call edi
push str.AppInit_DLLs
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push SysReAllocString
call edi
push str.AppInit_DLLs
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push ebx
call edi
push 0x100733c0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push ebx
call edi
push 0x100733c0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push SysReAllocString
call edi
push str.DelayRun
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push ebx
call edi
push esi
lea eax, [ebp - 0x10c]
push 0
push eax
call sub.MSVCRT.dll_memset
push 1
lea eax, [ebp - 0x210]
pop edi
mov dword [ebp - 4], esi
push str.Explorer.exe
push eax
mov dword [ebp - 8], edi
call sub.MSVCRT.dll_strcpy
add esp, 0x14
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push str.Shell
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x1001ad24
lea eax, [ebp - 0x210]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push str.Shell
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push esi
lea eax, [ebp - 0x314]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x314]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x314]
push eax
push str._suserinit.exe_
lea eax, [ebp - 0x210]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
push esi
lea eax, [ebp - 0x10c]
push 0
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x10c]
push 0
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
call sub.MSVCRT.dll_memset
add esp, 0x28
lea eax, [ebp - 4]
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push 0x10078b14
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
cmp byte [ebp - 0x10c], 0
je 0x1001ade4
push esi
lea eax, [ebp - 0x10c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10c]
push edi
push eax
push edi
push 0x10078b14
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push esi
lea eax, [ebp - 0x10c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push 0x10078b14
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
cmp byte [ebp - 0x10c], 0
je 0x1001ae59
push esi
lea eax, [ebp - 0x10c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10c]
push edi
push eax
push edi
push 0x10078b14
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov esi, str.http:__ie.search.msn.com_SUB_RFC1766_srchasst_srchcust.htm
push esi
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push esi
push edi
push str.CustomizeSearch
push str.SoftwareMicrosoftInternet_ExplorerSearch
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov esi, str.http:__ie.search.msn.com_SUB_RFC1766_srchasst_srchasst.htm
push esi
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push esi
push edi
push str.SearchAssistant
push str.SoftwareMicrosoftInternet_ExplorerSearch
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
pop edi
pop esi
pop ebx
leave
ret