Function at 0x1001ae40
Capabilities:
Delete registry key
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012b40b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov al, byte [0x101a59cc]
test al, al
jne 0x1001b064
call fcn.1001a0f0
cmp dword [ebp + 8], 1
jne 0x1001ae93
call fcn.1001a6c0
xor esi, esi
push esi
push str.CPM_installing...
call fcn.10010990
add esp, 8
jmp 0x1001ae95
xor esi, esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x70]
call fcn.1006cb70
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x90]
call fcn.1006cb70
mov byte [ebp - 4], 2
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], esi
mov bl, 3
mov byte [ebp - 4], bl
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov byte [ebp - 4], 4
push esi
push 1
lea eax, [ebp - 0x50]
push eax
push connect
lea ecx, [ebp - 0x70]
call fcn.1006cf60
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x50]
call fcn.10008420
push str.CpmTray.exe
lea ecx, [ebp - 0x18]
call fcn.100019d0
mov byte [ebp - 4], 5
push str.__auto
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.100082c0
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 6
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
push eax
push 0x1013677c
lea ecx, [ebp - 0x70]
call fcn.1006ca90
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x14]
call fcn.10001c80
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.10001c80
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], str.softwareHuaweiSPES5.0CompositesCPM
mov byte [ebp - 4], 7
push esi
push 1
lea edx, [ebp - 0x58]
push edx
push connect
lea ecx, [ebp - 0x70]
call fcn.1006cf60
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x58]
call fcn.10008420
push 0x1013677c
push str.ConsoleMenuText
lea ecx, [ebp - 0x70]
call fcn.1006ca90
push str.CpmUi
push str.ConsolePipeName
lea ecx, [ebp - 0x70]
call fcn.1006ca90
push str.CpmTray.exe
push str.DelegateStartup
lea ecx, [ebp - 0x70]
call fcn.1006ca90
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], str.SYSTEMCurrentControlSetHardware_Profiles
mov byte [ebp - 4], 8
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x60]
push ecx
push connect
lea ecx, [ebp - 0x70]
call fcn.1006d720
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x60]
call fcn.10008420
mov dword [ebp - 0x24], esi
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
lea ebx, [ebx]
lea ecx, [ebp - 0x80]
call fcn.1001bcf0
cmp esi, eax
jae 0x1001b036
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], eax
lea ecx, [eax + esi*4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x38], ecx
push str.SystemCurrentControlSetEnumROOTLEGACY_LOGSANDALERTS
lea edx, [ebp - 0x20]
push edx
call fcn.100082c0
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 9
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x44], ecx
push eax
push ecx
call edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x20]
call fcn.10001c80
inc esi
mov dword [ebp - 0x24], esi
jmp 0x1001afe0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x80]
call fcn.1000fcd0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x90]
call fcn.1006ce30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.1006ce30
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret