Function at 0x1004120
Capabilities:
Delete registry value
Link many functions at runtime
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
push esi
lea eax, [ebp - 4]
push edi
push eax
push 0x2001f
push 0
push 0x1008dc0
push 0x80000002
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
jne 0x1010ea3
push 0x1008b1c
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.DLL__wcsicmp]
mov esi, dword [ebp + 8]
pop ecx
test eax, eax
pop ecx
jne 0x1010eaa
push 0x10097e8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegDeleteValueW]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
test eax, eax
mov dword [esi + 0x388], eax
je 0x1010f1a
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x10097d8
push eax
call edi
test eax, eax
mov dword [esi + 0x394], eax
je 0x1010f1a
push 0x10097c8
push dword [esi + 0x388]
call edi
test eax, eax
mov dword [esi + 0x398], eax
je 0x1010f1a
push 0x10097b4
push dword [esi + 0x388]
call edi
test eax, eax
mov dword [esi + 0x39c], eax
je 0x1010f1a
push 0x10097a4
push dword [esi + 0x388]
call edi
test eax, eax
mov dword [esi + 0x3a0], eax
je 0x1010f1a
push 0x100978c
push dword [esi + 0x388]
call edi
test eax, eax
mov dword [esi + 0x3a4], eax
je 0x1010f1a
push 0x100977c
push dword [esi + 0x388]
call edi
test eax, eax
mov dword [esi + 0x3a8], eax
je 0x1010f1a
push 0x1009764
push dword [esi + 0x388]
call edi
test eax, eax
mov dword [esi + 0x3ac], eax
je 0x1010f1a
push 0x1009750
push dword [esi + 0x388]
call edi
test eax, eax
mov dword [esi + 0x3b0], eax
je 0x1010f1a
push 0x1009744
push dword [esi + 0x388]
call edi
test eax, eax
mov dword [esi + 0x3b4], eax
je 0x1010f1a
push 0x1009734
mov dword [0x10213a8], eax
push dword [esi + 0x388]
call edi
test eax, eax
mov dword [esi + 0x3b8], eax
je 0x1010f1a
push 0x1009728
push dword [esi + 0x388]
call edi
test eax, eax
mov dword [esi + 0x3bc], eax
je 0x1010f1a
push 0x100971c
push dword [esi + 0x388]
call edi
test eax, eax
mov dword [esi + 0x3c0], eax
je 0x1010f1a
push 0x1009708
push dword [esi + 0x388]
call edi
lea ecx, [esi + 0x3c4]
test eax, eax
mov dword [ecx], eax
je 0x1010ed8
push 0x10096f0
push dword [esi + 0x388]
call edi
lea ecx, [esi + 0x3c8]
test eax, eax
mov dword [ecx], eax
je 0x1010ee3
push 0x10096d8
push dword [esi + 0x388]
call edi
lea ecx, [esi + 0x3cc]
test eax, eax
mov dword [ecx], eax
je 0x1010eee
push 0x10096c0
push dword [esi + 0x388]
call edi
lea ecx, [esi + 0x3d0]
test eax, eax
mov dword [ecx], eax
je 0x1010ef9
push 0x10096ac
push dword [esi + 0x388]
call edi
lea ecx, [esi + 0x3d4]
test eax, eax
mov dword [ecx], eax
je 0x1010f04
push 0x1009694
push dword [esi + 0x388]
call edi
lea ecx, [esi + 0x3d8]
test eax, eax
mov dword [ecx], eax
je 0x1010f0f
lea eax, [ebp - 8]
mov edi, 0x10003
push eax
push edi
call dword [esi + 0x394]
test eax, eax
je 0x1010f1a
cmp dword [ebp - 8], edi
ja 0x1010f1a
push 1
pop eax
pop edi
pop esi
leave
ret 8
xor eax, eax
jmp 0x10043ab
cmp dword [esi + 0x30], 0
jne 0x100416a
lea eax, [ebp - 0xc]
push 4
push eax
push 3
push 0
push 0x10097e8
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x1021690
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExW]
jmp 0x1004178
mov dword [ecx], 0x1014509
jmp 0x10042f6
mov dword [ecx], 0x1010e6a
jmp 0x1004313
mov dword [ecx], fcn.01010e8c
jmp 0x1004330
mov dword [ecx], 0x1010e91
jmp 0x100434d
mov dword [ecx], 0x1010e97
jmp 0x100436a
mov dword [ecx], 0x1010e9d
jmp 0x1004387
mov eax, dword [esi + 0x388]
test eax, eax
je 0x1010f2b
push eax
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push 0x16
xor eax, eax
pop ecx
lea edi, [esi + 0x384]
rep stosd dword es:[edi], eax
push esi
call fcn.0101108e
jmp 0x10043a8