Function at 0x101e60f
Capabilities:
Delete registry value
Link many functions at runtime
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 8]
push eax
push 0x2001f
push ebx
push 0x1011048
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x101e647
xor eax, eax
jmp 0x101e972
push esi
push 0x10116a4
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
mov esi, dword [ebp + 8]
pop ecx
pop ecx
je 0x101e684
cmp dword [esi + 0x30], ebx
jne 0x101e684
push 4
lea eax, [ebp - 0xc]
push eax
push 3
push ebx
push 0x1011858
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x1072350
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x101e692
push 0x1011858
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esi + 0x3a4], eax
je 0x101e93f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1011848
push eax
call edi
cmp eax, ebx
mov dword [esi + 0x3b0], eax
je 0x101e93f
push 0x1011838
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3b4], eax
je 0x101e93f
push 0x1011824
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3b8], eax
je 0x101e93f
push 0x1011814
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3bc], eax
je 0x101e93f
push 0x10117fc
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3c0], eax
je 0x101e93f
push 0x10117ec
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3c4], eax
je 0x101e93f
push 0x10117d4
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3c8], eax
je 0x101e93f
push 0x10117c0
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3cc], eax
je 0x101e93f
push 0x10117b4
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3d0], eax
je 0x101e93f
push 0x10117a4
mov dword [0x1075d80], eax
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3d4], eax
je 0x101e93f
push 0x1011798
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3d8], eax
je 0x101e93f
push 0x101178c
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3dc], eax
je 0x101e93f
push 0x1011778
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
lea ecx, [esi + 0x3e0]
mov dword [ecx], eax
jne 0x101e813
mov dword [ecx], 0x1028949
push 0x1011760
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
lea ecx, [esi + 0x3e4]
mov dword [ecx], eax
jne 0x101e832
mov dword [ecx], 0x101e3c9
push 0x1011748
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
lea ecx, [esi + 0x3e8]
mov dword [ecx], eax
jne 0x101e851
mov dword [ecx], 0x101e3ef
push 0x1011730
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
lea ecx, [esi + 0x3ec]
mov dword [ecx], eax
jne 0x101e870
mov dword [ecx], 0x101e3f4
push 0x101171c
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
lea ecx, [esi + 0x3f0]
mov dword [ecx], eax
jne 0x101e88f
mov dword [ecx], 0x101e3fa
push 0x1011704
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
lea ecx, [esi + 0x3f4]
mov dword [ecx], eax
jne 0x101e8ae
mov dword [ecx], fcn.01039972
push 0x10116e4
push dword [esi + 0x3a4]
call edi
test eax, eax
mov dword [esi + 0x3f8], eax
mov ebx, 0x101e3ef
jne 0x101e8d0
mov dword [esi + 0x3f8], ebx
push 0x10116d0
push dword [esi + 0x3a4]
call edi
test eax, eax
lea ecx, [esi + 0x3fc]
mov dword [ecx], eax
jne 0x101e8ef
mov dword [ecx], 0x101e400
push 0x10116bc
push dword [esi + 0x3a4]
call edi
test eax, eax
lea ecx, [esi + 0x400]
mov dword [ecx], eax
jne 0x101e90e
mov dword [ecx], 0x101e400
lea eax, [ebp - 4]
push eax
mov edi, 0x10004
push edi
call dword [esi + 0x3b0]
test eax, eax
je 0x101e93d
cmp dword [ebp - 4], edi
ja 0x101e93d
cmp dword [0x1073938], 0
jne 0x101e96d
cmp dword [ebp - 4], edi
jne 0x101e96d
cmp dword [esi + 0x3f8], ebx
jne 0x101e96d
xor ebx, ebx
mov eax, dword [esi + 0x3a4]
cmp eax, ebx
je 0x101e950
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x19
pop ecx
xor eax, eax
lea edi, [esi + 0x3a0]
push esi
rep stosd dword es:[edi], eax
call fcn.0101e5a5
mov ecx, dword [ebp + 0x10]
xor eax, eax
inc eax
mov dword [ecx], eax
jmp 0x101e970
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc