Function at 0x10043070
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1016c0a8
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 0xc58
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov dword [ebp - 0xc5c], esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc58], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc54], eax
mov dword [ebp - 0xc50], ecx
xor ebx, ebx
mov dword [ebp - 0xc4c], ebx
mov dword [ebp - 4], ebx
call fcn.1004fe90
test eax, eax
je 0x1004338c
mov dword [ebp - 0xc4c], 1
cmp dword [0x1019e388], ebx
jne 0x1004330a
cmp dword [ebp + 0x14], ebx
jne 0x1004330a
cmp dword [0x101936e0], ebx
jne 0x1004330a
mov byte [ebp - 0x848], bl
mov byte [ebp - 0x340], bl
push 0x103
push ebx
lea edx, [ebp - 0x33f]
push edx
call fcn.10116880
add esp, 0xc
mov dword [ebp - 0xc60], 0x104
mov byte [ebp - 0x238], bl
push 0x103
push ebx
lea eax, [ebp - 0x237]
push eax
call fcn.10116880
add esp, 0xc
mov dword [ebp - 0xc4c], 2
mov dword [ebp - 0xc4c], 4
push 0x104
lea ecx, [ebp - 0x238]
push ecx
call fcn.10042f40
add esp, 8
cmp byte [ebp - 0x238], bl
je 0x1004318d
lea ecx, [ebp - 0x238]
call fcn.10049c40
mov dword [ebp - 0xc4c], 5
mov dword [0x1019e388], 1
cmp byte [ebp - 0x238], bl
je 0x1004330a
lea ecx, [ebp - 0xc60]
lea edx, [ebp - 0x340]
call fcn.10037780
test eax, eax
je 0x1004330a
mov byte [ebp - 0xc48], bl
mov byte [ebp - 0x740], bl
push 0x3ff
push ebx
lea edx, [ebp - 0x73f]
push edx
call fcn.10116880
add esp, 0xc
mov dword [ebp - 0xc64], 0x400
mov dword [ebp - 0xc4c], 6
push str.Local_AppData
lea eax, [ebp - 0xc64]
lea edi, [ebp - 0x740]
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov edx, closesocket
call fcn.100315c0
mov dword [ebp - 0xc4c], 7
cmp byte [ebp - 0x740], bl
jne 0x100432d0
mov byte [ebp - 0x130], bl
push 0x103
push ebx
lea eax, [ebp - 0x12f]
push eax
call fcn.10116880
add esp, 0xc
push 2
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.1010e100
add esp, 0xc
cmp byte [ebp - 0x27], bl
je 0x10043269
mov byte [ebp - 0x26], bl
mov byte [ebp - 0x26], bl
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x130]
call fcn.10049c40
push str.Users_
lea edx, [ebp - 0x130]
push edx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call edi
lea eax, [ebp - 0x340]
push eax
lea ecx, [ebp - 0x130]
push ecx
call edi
push str.AppDataLocal
lea edx, [ebp - 0x130]
push edx
call edi
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x740]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x100432d6
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0xc4c], 8
lea ecx, [ebp - 0x740]
call fcn.10049c40
push str.VirtualStoreWindowsWin.INI
lea edx, [ebp - 0x740]
push edx
call edi
lea eax, [ebp - 0x740]
call fcn.10033960
mov edi, dword [ebp - 0xc58]
mov dword [ebp - 0xc4c], 9
mov eax, dword [0x1019e38c]
cmp eax, ebx
jne 0x10043339
push 0x101524c0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1019e38c], eax
mov dword [ebp - 0xc4c], 0xa
cmp eax, ebx
je 0x1004336c
mov dword [ebp - 0xc4c], 0xb
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc50]
push edx
mov ecx, dword [ebp - 0xc54]
push ecx
push edi
push esi
call eax
jmp 0x100433f1
mov dword [ebp - 0xc4c], 0xd
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc50]
push eax
mov ecx, dword [ebp - 0xc54]
push ecx
push edi
push esi
jmp 0x100433eb
mov dword [ebp - 0xc4c], 0xe
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc50]
push eax
mov ecx, dword [ebp - 0xc54]
push ecx
push edi
push esi
jmp 0x100433eb
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1010d699
mov esp, ebp
pop ebp
ret