Function at 0x1002c643
Capabilities:
Delete file
Delete registry key
Delete registry value
Move file
Persist via run registry key
Query or enumerate registry value
Read file via mapping

Disassembly:
sub esp, 0x95c
mov eax, dword [0x10084500]
push ebx
push ebp
push esi
push edi
mov esi, 0x420
push esi
mov dword [esp + 0x96c], eax
xor ebx, ebx
lea eax, [esp + 0x54c]
push ebx
push eax
call fcn.10056960
lea eax, [esp + 0x34c]
push eax
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
call fcn.10023308
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
add esp, 0x10
lea eax, [esp + 0x340]
push eax
push esi
push ebx
push 4
push ebx
push 0xffffffffffffffff
call edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1002c706
push ebx
push ebx
push ebx
push 0xf001f
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebx
mov dword [esp + 0x1c], eax
je 0x1002c6f7
push esi
push eax
lea eax, [esp + 0x550]
push eax
call fcn.10056df0
add esp, 0xc
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea eax, [esp + 0x650]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x1002c6f7
mov byte [esp + 0x13], 1
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
cmp byte [esp + 0x13], bl
je 0x1002c763
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x340]
push eax
call fcn.10004425
pop ecx
lea eax, [esp + 0x340]
push eax
push esi
push ebx
push 4
push ebx
push 0xffffffffffffffff
call edi
push ebx
push ebx
push ebx
mov ebp, eax
push 0xf001f
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, ebx
je 0x1002c75c
push esi
lea eax, [esp + 0x54c]
push edi
push eax
call fcn.10056df0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x650]
push 0x1006f9a8
push eax
call fcn.1002bc0c
test al, al
pop ecx
pop ecx
je 0x1002cad8
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x54c]
push eax
mov ebp, 0x10085c88
push ebp
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
call esi
test eax, eax
je 0x1002c7b5
push ebp
call esi
dec eax
cmp byte [eax + 0x10085c88], 0x2e
jne 0x1002c7a5
mov byte [eax + 0x10085c88], bl
push 0x1006e4f4
mov esi, 0x10085c9c
push esi
call edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebp
push esi
call edi
lea eax, [esp + 0x340]
push eax
call fcn.1002c1c2
lea eax, [esp + 0x344]
push eax
call fcn.1002b588
pop ecx
pop ecx
call fcn.1002c582
call fcn.1002c26e
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], 0x80000002
mov dword [esp + 0x30], 0x80000001
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], 0x1006f648
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
push 0x2001f
push ebx
push dword [esp + 0x30]
push dword [esp + eax*4 + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002c9e8
mov dword [esp + 0x18], ebp
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x240]
push eax
push ebx
push ebx
push dword [esp + 0x28]
mov dword [esp + 0x3c], 0x104
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002c9cb
lea eax, [esp + 0x23c]
push eax
call fcn.1002c613
pop ecx
jmp 0x1002c8ac
cmp byte [esp + 0x970], bl
je 0x1002ca44
lea eax, [esp + 0x23c]
push eax
call esi
test eax, eax
jne 0x1002ca44
inc dword [esp + 0x20]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x20], 5
jl 0x1002c87e
lea eax, [esp + 0x23c]
push eax
lea eax, [esp + 0x448]
push eax
call fcn.10057da0
lea eax, [esp + 0x44c]
push eax
call fcn.10056d60
add esp, 0xc
dec eax
cmp byte [esp + eax + 0x444], 0x5c
jne 0x1002c8d8
lea eax, [esp + eax + 0x445]
push str.data.tmp
push eax
call fcn.10057da0
cmp byte [esp + 0x978], bl
pop ecx
pop ecx
je 0x1002c916
lea eax, [esp + 0x444]
push eax
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x240]
push eax
call fcn.100234ed
pop ecx
pop ecx
lea eax, [esp + 0x138]
push eax
call esi
push 0x2e
push ebx
lea eax, [esp + 0x140]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
mov ebp, eax
cmp ebp, ebx
je 0x1002c9b8
inc ebp
push str.bak1
push ebp
mov byte [ebp], bl
call edi
lea eax, [esp + 0x138]
push eax
call esi
push str.bak2
push ebp
mov byte [ebp], bl
call edi
lea eax, [esp + 0x138]
push eax
call esi
push 0x1006fa5c
push ebp
mov byte [ebp], bl
call edi
lea eax, [esp + 0x138]
push eax
call esi
push 0x1006fa58
push ebp
mov byte [ebp], bl
call edi
lea eax, [esp + 0x138]
push eax
call esi
push str.ini2
push ebp
mov byte [ebp], bl
call edi
lea eax, [esp + 0x138]
push eax
call esi
push dword [esp + 0x18]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ebp, 0x10085c88
add dword [esp + 0x18], 0x14
cmp dword [esp + 0x18], 0x10085cb0
jl 0x1002c841
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add dword [esp + 0x24], 0x104
cmp dword [esp + 0x24], 0x1006f850
jl 0x1002c818
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jb 0x1002c810
lea eax, [esp + 0x14]
push eax
push 0x2001f
push ebx
push 0x1006f5b0
push 0x80000002
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002cb13
push ebp
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1002cb13
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x240]
push eax
call fcn.100234ed
pop ecx
pop ecx
lea eax, [esp + 0x34]
push eax
call esi
push 0x2e
push ebx
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
mov ebp, eax
cmp ebp, ebx
je 0x1002cace
inc ebp
push str.bak1
push ebp
mov byte [ebp], bl
call edi
lea eax, [esp + 0x34]
push eax
call esi
push str.bak2
push ebp
mov byte [ebp], bl
call edi
lea eax, [esp + 0x34]
push eax
call esi
push 0x1006fa5c
push ebp
mov byte [ebp], bl
call edi
lea eax, [esp + 0x34]
push eax
call esi
push 0x1006fa58
push ebp
mov byte [ebp], bl
call edi
lea eax, [esp + 0x34]
push eax
call esi
push str.ini2
push ebp
mov byte [ebp], bl
call edi
lea eax, [esp + 0x34]
push eax
call esi
mov byte [esp + 0x12], 1
jmp 0x1002c9b8
mov esi, dword [esp + 0x974]
lea eax, [esp + 0x650]
push eax
call fcn.10056d60
test eax, eax
pop ecx
jne 0x1002caf6
mov esi, 0x3e8
push esi
push dword [esp + 0x974]
lea eax, [esp + 0x658]
push eax
call fcn.1002be4a
add esp, 0xc
mov byte [esp + 0x12], 1
mov ecx, dword [esp + 0x968]
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
call fcn.100568ae
add esp, 0x95c
ret