Function at 0x110d0b0
Capabilities:
Persist via appinit_dlls registry key
Persist via winlogon helper dll registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.010c7330
push esi
call fcn.010c72b0
push esi
call fcn.010f5450
push 0x1017e94
push connect
push esi
call fcn.010c73c0
push 0x1017e78
push connect
push esi
call fcn.010c73c0
push 0x1017e30
push connect
push esi
call fcn.010c73c0
mov eax, dword [esi + 0x35b0]
xor ebx, ebx
test dword [eax + 0x138], 0x200
jne 0x110d4f2
mov ecx, dword [esi]
cmp dword [ecx + 0xa64], ebx
jne 0x110d4f2
push ebx
push 0x101e75c
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e74c
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e740
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e730
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e718
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e6fc
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e6e4
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e6c8
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e6b4
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e6a0
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e68c
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e684
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e67c
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e674
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e668
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e654
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e640
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e630
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e620
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e610
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e608
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e5f8
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e610
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e5e8
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e610
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e5dc
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e5c8
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e5bc
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e5ac
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e610
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e59c
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e584
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e574
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e564
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e554
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e548
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e538
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101d7ec
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e548
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e520
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e548
push 0x101d838
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e514
push 0x101d748
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e4fc
push 0x101d748
push 0x101d804
push esi
call fcn.010f53b0
push ebx
push 0x101e4ec
push 0x101d748
push 0x101d804
push esi
call fcn.010f53b0
push esi
call fcn.0110cfa0
push esi
call fcn.010c71d0
mov edi, 1
push edi
push 0x101e4dc
push 0x101e4b4
push 0x1005fdc
push esi
call fcn.010f53b0
push ebx
push 0x101e4a4
push 0x101e47c
push 0x101e460
push esi
call fcn.010f53b0
push ebx
push 0x101e450
push 0x101e438
push 0x101e460
push esi
call fcn.010f53b0
push ebx
push 0x101e418
push 0x101e414
push 0x101e460
push esi
call fcn.010f53b0
push 3
push 0x101e40c
push 0x101e404
push 0x1005f48
push esi
call fcn.010f53b0
push 0x1005bb4
push 0x1005bc0
push 0x1005f0c
push connect
push esi
call fcn.010f5330
push 8
push 0x101e3fc
push edi
push 0x1002402
push 0x101e3e4
push connect
push esi
call fcn.010baf70
push 8
push 0x101e3dc
push edi
push 0x1002402
push 0x101e3b0
push connect
push esi
call fcn.010baf70
push 0x101e384
push connect
push esi
call fcn.010bb7c0
push 4
push 0x101e380
push edi
push 0x101e368
push 0x101e33c
push connect
push esi
call fcn.010baf70
push 0xd
push 0x101e32c
push edi
push 0x101e324
push 0x101e2ec
push connect
push esi
call fcn.010baf70
cmp dword [esi + 0x8af4], 0x2710
jae 0x110d636
push 0x1c2
push 0x101e128
push edi
push 0x101e118
push 0x101e0f0
push connect
push esi
call fcn.010baf70
push edi
push 0x1002402
push edi
push 0x101e0e0
push 0x101e0a8
push connect
push esi
call fcn.010baf70
push 0x2a
push 0x101e07c
push 7
push 0x101e064
push 0x101e000
push connect
push esi
call fcn.010bae20
push 0x20
push 0x101dfdc
push 2
push 0x1005c18
push 0x101e0f0
push connect
push esi
call fcn.010baf70
push 0x41
push 0x101df98
push 2
push 0x1005c0c
push 0x101e0f0
push connect
push esi
call fcn.010baf70
push esi
call fcn.010c7630
push 0x101df88
push 0x101df50
push connect
push esi
call fcn.010bbbe0
push 0x101df2c
push 0x1015ab8
push connect
push esi
call fcn.010bbb60
push 0x101df14
push 0x1015ab8
push connect
push esi
call fcn.010bbb60
push 0x101def0
push 0x1015ab8
push connect
push esi
call fcn.010bbb60
push ebx
push ebx
push ebx
push 0x101de78
push connect
push esi
call fcn.010bb690
push 0x101df88
push 0x101de38
push connect
push esi
call fcn.010bbbe0
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101de2c
push 0x101de38
push connect
push esi
mov dword [ebp + 8], ebx
call fcn.010baf70
push 0x101de2c
push 0x101df50
push connect
push esi
call fcn.010bbbe0
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0x101e40c
push 0x101de04
push connect
push esi
mov dword [ebp + 8], ebx
call fcn.010baf70
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0x101ddf8
push 0x101ddc8
push connect
push esi
mov dword [ebp + 8], ebx
call fcn.010baf70
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101e40c
push 0x101dd9c
push connect
push esi
mov dword [ebp + 8], 2
call fcn.010baf70
push 0x101dd84
push 0x101dd48
push connect
push esi
call fcn.010bbbe0
push 0x101dd2c
push 0x101dd48
push connect
push esi
call fcn.010bbbe0
push 0x101dd10
push 0x101dd48
push connect
push esi
call fcn.010bbbe0
push 0x101dcf8
push 0x101dd48
push connect
push esi
call fcn.010bbbe0
push 0x101dce0
push 0x101dd48
push connect
push esi
call fcn.010bbbe0
push 0x101dcc4
push 0x101dd48
push connect
push esi
call fcn.010bbbe0
push 0x101dca8
push 0x101dd48
push connect
push esi
call fcn.010bbbe0
push 0x101dc8c
push 0x101dd48
push connect
push esi
call fcn.010bbbe0
push 0x101dc80
push 0x101dc50
push connect
push esi
call fcn.010bbbe0
push 0x101dc30
push 0x101dc50
push connect
push esi
call fcn.010bbbe0
mov dword [ebp + 8], 0xffffffff
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0x101dc24
push 0x101e2ec
push connect
push esi
call fcn.010baf70
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0x101dc0c
push 0x101dbd0
push connect
push esi
mov dword [ebp + 8], edi
call fcn.010baf70
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101dbc4
push 0x101e2ec
push connect
push esi
mov dword [ebp + 8], ebx
call fcn.010baf70
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0x101dbb8
push 0x101db8c
push connect
push esi
mov dword [ebp + 8], edi
call fcn.010baf70
push 0x101db4c
push connect
push esi
call fcn.010bb7c0
push 0x3c
push 0x101db0c
call fcn.0102c3a0
mov edi, eax
cmp edi, ebx
je 0x110d9af
push ebx
push ebx
call fcn.0102c3a0
push 0x25
push 0x101dae4
mov dword [ebp + 8], eax
call fcn.0102c3a0
mov ecx, dword [ebp + 8]
push 0x4c
push eax
push 2
push ecx
push edi
push connect
push esi
mov dword [ebp - 4], eax
call fcn.010bae20
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x110d983
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 4]
cmp eax, 0x101dae4
je 0x110d9a0
cmp eax, ebx
je 0x110d9a0
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 0x22
push 0x101dac0
push 2
push 0x100592c
push 0x101da70
push connect
push esi
call fcn.010baf70
push 0x1f
push 0x101da50
push 2
push 0x101da44
push 0x101da10
push connect
push esi
call fcn.010baf70
push 0x2d
push 0x101d9e0
push 2
push 0x101d9d4
push 0x101d9a8
push connect
push esi
call fcn.010baf70
push ebx
push ebx
push ebx
push 0x101d950
push connect
push esi
call fcn.010bb690
push 0x1012e0c
push 0x1017438
push connect
push esi
call fcn.010bbb60
push 0x1005aac
push 0x1017d18
push connect
push esi
call fcn.010bb360
cmp eax, ebx
je 0x110da59
push 0x1017d10
push eax
call fcn.0102c870
test eax, eax
jne 0x110dad8
cmp dword [esi + 0x8af4], 0x1fa4
jb 0x110da74
push esi
call fcn.010c75d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x8aec], 6
jb 0x110daa0
push 0x101d918
push 0x1005aac
push 0x1017d18
push connect
push esi
call fcn.010bb0e0
push 0x5c
push 0x101d8b8
jmp 0x110dac1
push 0x101d8a8
push 0x1005aac
push 0x1017d18
push connect
push esi
call fcn.010bb0e0
push 0x44
push 0x101d860
push 7
push 0x1017d9c
push 0x1017d50
push connect
push esi
call fcn.010bae20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4