Function at 0x101e78f
Capabilities:
Delete registry value
Link many functions at runtime
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 8]
push eax
push 0x2001f
push ebx
push 0x1011308
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x101e7c7
xor eax, eax
jmp 0x101eaf2
push esi
push 0x1011964
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
mov esi, dword [ebp + 8]
pop ecx
pop ecx
je 0x101e804
cmp dword [esi + 0x30], ebx
jne 0x101e804
push 4
lea eax, [ebp - 0xc]
push eax
push 3
push ebx
push 0x1011b18
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x1073398
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x101e812
push 0x1011b18
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esi + 0x3a4], eax
je 0x101eabf
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1011b08
push eax
call edi
cmp eax, ebx
mov dword [esi + 0x3b0], eax
je 0x101eabf
push 0x1011af8
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3b4], eax
je 0x101eabf
push 0x1011ae4
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3b8], eax
je 0x101eabf
push 0x1011ad4
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3bc], eax
je 0x101eabf
push 0x1011abc
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3c0], eax
je 0x101eabf
push 0x1011aac
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3c4], eax
je 0x101eabf
push 0x1011a94
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3c8], eax
je 0x101eabf
push 0x1011a80
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3cc], eax
je 0x101eabf
push 0x1011a74
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3d0], eax
je 0x101eabf
push 0x1011a64
mov dword [0x1076e60], eax
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3d4], eax
je 0x101eabf
push 0x1011a58
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3d8], eax
je 0x101eabf
push 0x1011a4c
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
mov dword [esi + 0x3dc], eax
je 0x101eabf
push 0x1011a38
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
lea ecx, [esi + 0x3e0]
mov dword [ecx], eax
jne 0x101e993
mov dword [ecx], 0x1028eff
push 0x1011a20
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
lea ecx, [esi + 0x3e4]
mov dword [ecx], eax
jne 0x101e9b2
mov dword [ecx], 0x101e549
push 0x1011a08
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
lea ecx, [esi + 0x3e8]
mov dword [ecx], eax
jne 0x101e9d1
mov dword [ecx], 0x101e5aa
push 0x10119f0
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
lea ecx, [esi + 0x3ec]
mov dword [ecx], eax
jne 0x101e9f0
mov dword [ecx], 0x101e56f
push 0x10119dc
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
lea ecx, [esi + 0x3f0]
mov dword [ecx], eax
jne 0x101ea0f
mov dword [ecx], 0x101e575
push 0x10119c4
push dword [esi + 0x3a4]
call edi
cmp eax, ebx
lea ecx, [esi + 0x3f4]
mov dword [ecx], eax
jne 0x101ea2e
mov dword [ecx], fcn.0103a69f
push 0x10119a4
push dword [esi + 0x3a4]
call edi
test eax, eax
mov dword [esi + 0x3f8], eax
mov ebx, 0x101e5aa
jne 0x101ea50
mov dword [esi + 0x3f8], ebx
push 0x1011990
push dword [esi + 0x3a4]
call edi
test eax, eax
lea ecx, [esi + 0x3fc]
mov dword [ecx], eax
jne 0x101ea6f
mov dword [ecx], 0x101e57b
push 0x101197c
push dword [esi + 0x3a4]
call edi
test eax, eax
lea ecx, [esi + 0x400]
mov dword [ecx], eax
jne 0x101ea8e
mov dword [ecx], 0x101e57b
lea eax, [ebp - 4]
push eax
mov edi, 0x10004
push edi
call dword [esi + 0x3b0]
test eax, eax
je 0x101eabd
cmp dword [ebp - 4], edi
ja 0x101eabd
cmp dword [0x1074a18], 0
jne 0x101eaed
cmp dword [ebp - 4], edi
jne 0x101eaed
cmp dword [esi + 0x3f8], ebx
jne 0x101eaed
xor ebx, ebx
mov eax, dword [esi + 0x3a4]
cmp eax, ebx
je 0x101ead0
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x19
pop ecx
xor eax, eax
lea edi, [esi + 0x3a0]
push esi
rep stosd dword es:[edi], eax
call fcn.0101e725
mov ecx, dword [ebp + 0x10]
xor eax, eax
inc eax
mov dword [ecx], eax
jmp 0x101eaf0
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc