Function at 0x102fe86
Capabilities:
Delete registry value
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x10723e4]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x88]
push eax
push 0x2001f
xor ebx, ebx
push ebx
push 0x1013bb0
push 0x80000002
mov dword [ebp - 0x88], ebx
lea edi, [ebp - 0x84]
mov dword [ebp - 0x8c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jne 0x102fffc
lea eax, [ebp - 0x8c]
push eax
mov eax, edi
push eax
lea eax, [ebp - 0x90]
push eax
push ebx
push 0x1013b94
push dword [ebp - 0x88]
call esi
cmp eax, 0x7a
je 0x102ff0a
cmp eax, 0xea
jne 0x102ff3e
push dword [ebp - 0x8c]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x10300cf
lea eax, [ebp - 0x8c]
push eax
push edi
lea eax, [ebp - 0x90]
push eax
push ebx
push 0x1013b94
push dword [ebp - 0x88]
call esi
cmp eax, ebx
jne 0x102ff5d
push dword [ebp - 0x8c]
push edi
push 1
push ebx
push 0x1013b80
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x8c]
push eax
push edi
lea eax, [ebp - 0x90]
push eax
push ebx
push 0x1013b6c
push dword [ebp - 0x88]
call esi
cmp eax, 0x7a
je 0x102ff86
cmp eax, 0xea
jne 0x102ffcb
lea eax, [ebp - 0x84]
cmp edi, eax
je 0x102ff97
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x8c]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x10300cf
lea eax, [ebp - 0x8c]
push eax
push edi
lea eax, [ebp - 0x90]
push eax
push ebx
push 0x1013b6c
push dword [ebp - 0x88]
call esi
cmp eax, ebx
jne 0x102ffea
push dword [ebp - 0x8c]
push edi
push 1
push ebx
push 0x1013b5c
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x88], ebx
lea eax, [ebp - 0x88]
push eax
push 0x2001f
push ebx
push 0x1013b00
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10300cf
lea eax, [ebp - 0x8c]
push eax
push edi
lea eax, [ebp - 0x90]
push eax
push ebx
push 0x1013ad8
push dword [ebp - 0x88]
call esi
cmp eax, 0x7a
je 0x103004a
cmp eax, 0xea
jne 0x103008b
lea eax, [ebp - 0x84]
cmp edi, eax
je 0x103005b
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x8c]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x10300cf
lea eax, [ebp - 0x8c]
push eax
push edi
lea eax, [ebp - 0x90]
push eax
push ebx
push 0x1013ad8
push dword [ebp - 0x88]
call esi
cmp eax, ebx
jne 0x10300ac
push dword [ebp - 0x8c]
push edi
push 1
push ebx
push 0x1013ab4
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10300bd
push 0x1013ab4
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x88], ebx
cmp dword [ebp - 0x88], ebx
je 0x10300e3
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x84]
cmp edi, eax
je 0x10300f4
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0103d24a
leave
ret