Function at 0x8fc7b0
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x53c
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor ebx, ebx
push 0x207
lea ecx, [ebp - 0x317]
push ebx
push ecx
mov dword [ebp - 0x534], eax
mov byte [ebp - 0x318], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea edx, [ebp - 0x51f]
push ebx
push edx
mov byte [ebp - 0x520], bl
call fcn.00a7ffb0
mov ecx, 0xb
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea edi, [ebp - 0x110]
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
push 0xd6
lea eax, [ebp - 0xe2]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.00a7ffb0
add esp, 0xc
cmp dword [ebp + 8], ebx
jne 0x8fc856
lea ecx, [ebp - 0x524]
push ecx
push 0xf003f
push ebx
lea edx, [ebp - 0x110]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x8fc89d
call fcn.00968110
test eax, eax
jne 0x8fc880
lea eax, [ebp - 0x524]
push eax
push 0xf003f
push ebx
lea ecx, [ebp - 0x110]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x8fc89d
lea edx, [ebp - 0x524]
push edx
push 0xf013f
lea eax, [ebp - 0x110]
push eax
push 0x80000002
call fcn.0097eda0
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x8fcaa1
mov eax, 0x208
lea ecx, [ebp - 0x530]
push ecx
mov dword [ebp - 0x52c], eax
mov dword [ebp - 0x530], eax
lea edx, [ebp - 0x520]
push edx
lea eax, [ebp - 0x538]
push eax
mov eax, dword [ebp - 0x524]
push ebx
lea ecx, [ebp - 0x52c]
push ecx
lea edx, [ebp - 0x318]
push edx
push ebx
push eax
mov dword [ebp - 0x528], ebx
xor edi, edi
mov byte [ebp - 0x520], bl
mov byte [ebp - 0x318], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x8fca94
lea ecx, [ecx]
cmp byte [ebp - 0x520], bl
je 0x8fca2f
test byte [0xc0ea6c], 1
jne 0x8fc940
or dword [0xc0ea6c], 1
mov eax, str.F119BFAB_D0C9_4E62_9DCF_7923777499B1
inc eax
cmp byte [eax], bl
jne 0x8fc931
sub eax, str.F119BFAB_D0C9_4E62_9DCF_7923777499B1
mov dword [0xc0ea68], eax
push ebx
lea ecx, [ebp - 0x520]
push str.powershell
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp byte [ebp - 0x318], 0x7b
mov esi, eax
jne 0x8fc97b
lea eax, [ebp - 0x318]
inc eax
cmp byte [eax], bl
jne 0x8fc966
lea edx, [ebp - 0x318]
sub eax, edx
cmp eax, dword [0xc0ea68]
je 0x8fc99a
cmp esi, 0xffffffff
je 0x8fc99f
push ebx
lea eax, [ebp - 0x520]
push str.bypass
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8fc99f
mov edi, 1
mov eax, dword [ebp - 0x534]
cmp eax, ebx
je 0x8fc9b4
cmp esi, 0xffffffff
je 0x8fc9b4
mov dword [eax], 1
cmp edi, ebx
je 0x8fca2f
mov edx, dword [ebp - 0x524]
lea ecx, [ebp - 0x318]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x8fca06
inc dword [ebp - 0x528]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x520]
push eax
lea ecx, [ebp - 0x318]
push ecx
lea edx, [ebp - 0x110]
push edx
push str._Locky__Failed_to_Delete_in__s:___s___s_._Error:_u
push 0xb54ce8
call fcn.0096a780
add esp, 0x18
jmp 0x8fca35
lea eax, [ebp - 0x520]
push eax
lea ecx, [ebp - 0x318]
push ecx
lea edx, [ebp - 0x110]
push edx
push str._Locky__Deleted_in__s:___s___s_
push 0xb54ce8
call fcn.0096a780
add esp, 0x14
jmp 0x8fca35
inc dword [ebp - 0x528]
mov eax, 0x208
mov dword [ebp - 0x52c], eax
mov dword [ebp - 0x530], eax
lea eax, [ebp - 0x530]
push eax
lea ecx, [ebp - 0x520]
push ecx
lea edx, [ebp - 0x538]
push edx
mov edx, dword [ebp - 0x528]
push ebx
lea eax, [ebp - 0x52c]
push eax
mov eax, dword [ebp - 0x524]
lea ecx, [ebp - 0x318]
push ecx
push edx
push eax
xor edi, edi
mov byte [ebp - 0x520], bl
mov byte [ebp - 0x318], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x8fc910
mov ecx, dword [ebp - 0x524]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00a78f21
mov esp, ebp
pop ebp
ret