Function at 0x30012a37
Capabilities:
Check if file exists
Copy file
Get file attributes
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor edi, edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.3000cc94
lea ecx, [ebp - 0x10]
call fcn.3000cc94
lea ecx, [ebp - 0x20]
call fcn.3000cc94
call fcn.300113bc
push 0x105
lea ecx, [ebp - 0x18]
call fcn.3000cd95
mov esi, eax
cmp esi, edi
jne 0x30012d66
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x30012dd0
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
call fcn.3000e502
test eax, eax
jne 0x30012b19
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x30012aeb
push 0x30004dd0
call fcn.3000fe20
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0x30004d94
call fcn.3000ff32
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x30004d64
call fcn.3000ff32
add esp, 0x18
jmp 0x30012b19
push dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
call fcn.3000ce85
mov esi, eax
cmp esi, edi
je 0x30012b06
push 0x30004d34
jmp 0x30012c9b
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0x30004cd8
call fcn.3000ff32
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.3000cee2
mov esi, eax
cmp esi, edi
je 0x30012b31
push 0x30004c9c
jmp 0x30012c9b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
call fcn.3000ce85
mov esi, eax
cmp esi, edi
je 0x30012b4c
push 0x30004c68
jmp 0x30012c9b
cmp dword [0x30077208], edi
je 0x30012ba1
push 0x30004c54
push dword [ebp - 0x10]
call fcn.30015b03
cmp eax, edi
push 0x30004c44
je 0x30012b85
mov word [eax], di
lea ecx, [ebp - 0x10]
call fcn.3000cf63
mov esi, eax
cmp esi, edi
je 0x30012b98
push 0x30004c10
jmp 0x30012c9b
push dword [ebp - 0x10]
call fcn.30015b03
test eax, eax
jne 0x30012b98
push 0x30004bfc
jmp 0x30012b6d
mov dword [ebp - 8], SysReAllocString
jmp 0x30012bc5
push 0x30004be8
lea ecx, [ebp - 0x10]
call fcn.3000cf63
mov esi, eax
cmp esi, edi
je 0x30012bbe
push 0x30004bb4
jmp 0x30012c9b
mov dword [ebp - 8], reloc.OLEAUT32.dll_SysReAllocString
cmp word [0x30036048], di
mov ebx, 0x30003ba8
je 0x30012c6e
push 0x30036048
lea ecx, [ebp - 0x18]
call fcn.3000ce85
mov esi, eax
cmp esi, edi
jne 0x30012d66
lea ecx, [ebp - 0x18]
call fcn.3000cee2
mov esi, eax
cmp esi, edi
je 0x30012c06
push 0x30004b8c
jmp 0x30012c9b
push 0x30004b84
lea ecx, [ebp - 0x10]
call fcn.3000cf63
mov esi, eax
cmp esi, edi
je 0x30012c20
push 0x30004b58
jmp 0x30012c9b
cmp word [0x30024108], di
je 0x30012c40
push 0x30024108
lea ecx, [ebp - 0x10]
call fcn.3000cf63
mov esi, eax
cmp esi, edi
jne 0x30012d66
push ebx
lea ecx, [ebp - 0x10]
call fcn.3000cf63
mov esi, eax
cmp esi, edi
je 0x30012c56
push 0x30004b20
jmp 0x30012c9b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
call fcn.3000cf63
mov esi, eax
cmp esi, edi
je 0x30012c6e
push 0x30004ae8
jmp 0x30012c9b
mov eax, dword [ebp + 8]
cmp word [eax], di
je 0x30012ca6
push ebx
lea ecx, [ebp - 0x10]
call fcn.3000cf63
mov esi, eax
cmp esi, edi
jne 0x30012c4f
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.3000cf63
mov esi, eax
cmp esi, edi
je 0x30012ca6
push 0x30004ab0
call fcn.3000fdf9
pop ecx
jmp 0x30012d66
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0x2001b
push edi
push edi
push edi
push 0x30002938
push dword [ebp - 8]
call ebx
mov esi, eax
cmp esi, edi
je 0x30012cd5
push esi
push 0x300032a4
call fcn.3000fea4
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
cmp eax, 0x104
mov dword [ebp + 8], eax
jbe 0x30012d00
push 0x30004a10
call fcn.3000fe20
push 0x30004970
call fcn.3000fe20
cmp esi, edi
jne 0x30012d31
push dword [ebp + 8]
push dword [ebp - 0x10]
push 1
push edi
call fcn.30010fef
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, edi
je 0x30012dc7
push esi
push 0x30004954
call fcn.3000fea4
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0x2001b
push edi
push edi
push edi
push 0x30002938
push SysReAllocString
call ebx
mov esi, eax
cmp esi, edi
je 0x30012da1
push esi
push 0x30004924
call fcn.3000fea4
push 0x300048a0
call fcn.3000fe20
cmp dword [ebp - 4], edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x30012d76
push dword [ebp - 4]
call ebx
cmp dword [ebp - 8], edi
je 0x30012d80
push dword [ebp - 8]
call ebx
lea ecx, [ebp - 0x20]
call fcn.3000cc9e
lea ecx, [ebp - 0x10]
call fcn.3000cc9e
lea ecx, [ebp - 0x18]
call fcn.3000cc9e
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
push dword [ebp + 8]
push dword [ebp - 0x10]
push 1
push edi
call fcn.30010fef
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, edi
je 0x30012dc7
push esi
push 0x30004870
jmp 0x30012d57
cmp dword [ebp + 8], 0x104
ja 0x30012d5c
push 0x30004800
call fcn.3000fe20
push dword [ebp - 0x10]
jmp 0x30012d61