Function at 0x1000d62d
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 0x100d681c
push 0x101436f0
call fcn.1001bc30
add esp, 8
push 0x100d6840
push 0x101436f0
call fcn.1001bc40
add esp, 8
push 0x100d6848
push 0x101430d0
call fcn.1001bc30
add esp, 8
push 0x100d6888
push 0x10142710
call fcn.1001bc30
add esp, 8
push 0x101436e8
push 0xf003f
push 0
push 0x101436f0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d6be
push 0x10001
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000da3d
push 0x100d689c
push 0x10143080
call fcn.1001bc30
add esp, 8
push 5
push 0x100d68a4
push 1
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d710
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000da3d
push 0x100d68ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x101430c4], eax
cmp dword [0x101430c4], 0
jne 0x1000d741
push 1
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000da3d
push 0x100d68bc
mov eax, dword [0x101430c4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10141e10], eax
cmp dword [0x10141e10], 0
jne 0x1000d778
push 2
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000da3d
push 0x50
lea eax, [ebp - 0x58]
push eax
push 0x100d68cc
push 0
push 0
push 0x409
call dword [0x10141e10]
mov dword [ebp - 4], eax
mov eax, dword [0x101430c4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x1000d7ca
push 0x2001000
call fcn.1000427e
add esp, 4
push 3
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000da3d
cmp dword [ebp - 4], 0
jne 0x1000d7e8
push 6
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000da3d
push 0x100d68dc
push 0x10143080
call fcn.1001bc30
add esp, 8
lea eax, [ebp - 0x58]
push eax
call fcn.1001bd20
add esp, 4
push eax
lea eax, [ebp - 0x58]
push eax
push 1
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d844
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000da3d
push str.Type
push 0x10143080
call fcn.1001bc30
add esp, 8
mov dword [0x101438f0], 1
push 4
push 0x101438f0
push 4
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d8a0
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000da3d
push 0x100d68ec
push 0x10143080
call fcn.1001bc30
add esp, 8
mov dword [0x101438f0], 2
push 4
push 0x101438f0
push 4
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d8fc
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000da3d
push 0x100d68f4
push 0x10143080
call fcn.1001bc30
add esp, 8
mov dword [0x101438f0], 1
push 4
push 0x101438f0
push 4
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d958
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000da3d
push str.Group
push 0x10143080
call fcn.1001bc30
add esp, 8
push 0x14
push 0x100d6900
push 1
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000d9aa
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000da3d
push str.ErrorControl
push 0x10143080
call fcn.1001bc30
add esp, 8
mov dword [0x101438f0], 1
push 4
push 0x101438f0
push 4
push 0
push 0x10143080
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000da06
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000da3d
mov eax, dword [0x101436e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000da36
push 0x10002
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x1000da3d
xor eax, eax
jmp 0x1000da3d
pop edi
pop esi
pop ebx
leave
ret