Function at 0x1004924
Capabilities:
Persist via com hijack
Set registry value

Disassembly:
mov eax, 0x1005316
call fcn.01003a58
sub esp, 0x538
mov eax, dword [0x1007044]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push 0x80
lea eax, [ebp - 0x110]
push eax
push dword [esi + 0xc]
mov dword [ebp - 0x52c], esi
call dword [sym.imp.ole32.dll_StringFromGUID2]
push 0x10022d4
lea eax, [ebp - 0x110]
push eax
push 0x100
lea eax, [ebp - 0x51c]
push eax
call fcn.01004704
xor ebx, ebx
cmp eax, ebx
jge 0x1004997
lea eax, [ebp - 0x110]
push eax
push 0x10022ac
push ebx
call dword [sym.imp.wbemcomn.dll_int___cdecl_ErrorTrace_char__char_const__]
add esp, 0xc
jmp 0x10049cb
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x51c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
cmp eax, ebx
je 0x10049d5
lea ecx, [ebp - 0x51c]
push ecx
push eax
push 0x1002274
push ebx
call dword [sym.imp.wbemcomn.dll_int___cdecl_ErrorTrace_char__char_const__]
add esp, 0x10
mov eax, 0x80004005
jmp 0x1004bf5
push edi
push dword [ebp - 0x528]
lea eax, [ebp - 0x544]
push dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call fcn.010048fe
push dword [esi + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 4], ebx
call esi
mov edi, eax
add edi, 0x64
lea eax, [edi + edi]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [ebp - 0x520], eax
jne 0x1004a35
lea eax, [ebp - 0x51c]
push eax
push 0x1002250
push ebx
call dword [sym.imp.wbemcomn.dll_int___cdecl_ErrorTrace_char__char_const__]
add esp, 0xc
mov esi, 0x80004005
jmp 0x1004be2
mov ecx, dword [ebp - 0x52c]
push dword [ecx + 0x14]
push 0x100222c
push edi
push eax
call fcn.010043e3
add esp, 0x10
cmp eax, ebx
jge 0x1004a61
push 0x100220c
push ebx
call dword [sym.imp.wbemcomn.dll_int___cdecl_ErrorTrace_char__char_const__]
pop ecx
pop ecx
jmp 0x1004a2b
push dword [ebp - 0x520]
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x520]
push 1
push ebx
push ebx
push dword [ebp - 0x528]
call edi
cmp eax, ebx
je 0x1004aa2
push dword [ebp - 0x520]
push eax
push 0x10021e0
push ebx
call dword [sym.imp.wbemcomn.dll_int___cdecl_ErrorTrace_char__char_const__]
add esp, 0x10
jmp 0x1004a2b
cmp dword [ebp + 0xc], ebx
mov eax, 0x10021c4
jne 0x1004ab1
mov eax, 0x10021a4
lea ecx, [ebp - 0x524]
push ecx
push eax
push dword [ebp - 0x528]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
cmp eax, ebx
je 0x1004ad4
push eax
push 0x1002174
jmp 0x1004a21
push dword [ebp - 0x524]
lea eax, [ebp - 0x538]
push dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call fcn.010048fe
push 0x104
lea eax, [ebp - 0x31c]
push eax
push dword [0x10073a4]
mov byte [ebp - 4], 1
mov word [ebp - 0x114], 0x30
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, ebx
jne 0x1004b2f
push ebx
push 0x1002144
push ebx
call dword [sym.imp.wbemcomn.dll_int___cdecl_ErrorTrace_char__char_const__]
add esp, 0xc
mov esi, 0x80004005
jmp 0x1004bd3
lea eax, [ebp - 0x31c]
push eax
call esi
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x31c]
push eax
push 1
push ebx
push ebx
push dword [ebp - 0x524]
call edi
cmp eax, ebx
je 0x1004b6d
lea ecx, [ebp - 0x31c]
push ecx
push eax
push 0x1002108
push ebx
call dword [sym.imp.wbemcomn.dll_int___cdecl_ErrorTrace_char__char_const__]
add esp, 0x10
jmp 0x1004b25
mov eax, dword [ebp - 0x52c]
cmp dword [eax + 0x18], ebx
je 0x1004b95
cmp dword [eax + 0x1c], ebx
jne 0x1004b89
mov dword [ebp - 0x520], 0x10020fc
jmp 0x1004b9f
mov dword [ebp - 0x520], 0x10020f0
jmp 0x1004b9f
mov dword [ebp - 0x520], 0x10020dc
push dword [ebp - 0x520]
call esi
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x520]
push 1
push ebx
push 0x10020bc
push dword [ebp - 0x524]
call edi
cmp eax, ebx
je 0x1004bd1
push eax
push 0x1002088
jmp 0x1004b1b
xor esi, esi
lea eax, [ebp - 0x538]
push eax
mov byte [ebp - 4], bl
call fcn.010046b7
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x544]
push eax
call fcn.010046b7
mov eax, esi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.01003792
leave
ret 8