Function at 0x1019ab2
Capabilities:
Create thread
Get common file path
Initialize winsock library
Print debug messages
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3cc
mov eax, dword [0x1020128]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3c8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x1006248
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1019b68
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop edi
lea eax, [ebp - 0x3c0]
push eax
push 0x10201e8
push ebx
push ebx
push 0x1006234
push dword [ebp - 0x3c8]
mov dword [ebp - 0x3c0], edi
call esi
lea eax, [ebp - 0x3c0]
push eax
push 0x1020138
push ebx
push ebx
push 0x1006218
push dword [ebp - 0x3c8]
mov dword [0x1020138], ebx
mov dword [ebp - 0x3c0], edi
call esi
mov eax, dword [0x1020138]
cmp eax, ebx
je 0x1019b52
imul eax, eax, 0x3e8
mov dword [0x1020138], eax
jmp 0x1019b5c
mov dword [0x1020138], 0x1d4c0
push dword [ebp - 0x3c8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [0x10201e8], 0x20
je 0x1019c24
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x10061f0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
lea eax, [ebp - 0x20c]
push 0x800a
push eax
call sub.msvcrt.dll__wopen
add esp, 0xc
cmp eax, 0xffffffff
mov dword [0x1020bc0], eax
je 0x1019bc5
push 0x10061d8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1019c24
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x10061bc
mov byte [ebp - 0x3be], 0xff
mov byte [ebp - 0x3bd], 0xfe
call esi
push 0x180
lea eax, [ebp - 0x20c]
push 0x8102
push eax
call sub.msvcrt.dll__wopen
add esp, 0xc
cmp eax, 0xffffffff
mov dword [0x1020bc0], eax
je 0x1019c17
push 2
lea ecx, [ebp - 0x3be]
push ecx
push eax
call sub.msvcrt.dll__write
add esp, 0xc
jmp 0x1019c24
push 0x1006194
call esi
mov dword [0x1020bc0], ebx
call fcn.01019a35
push 0x1006178
mov dword [0x1020b94], eax
call fcn.01019fa3
pop ecx
xor eax, eax
cmp dword [0x1020b04], ebx
mov ecx, 0x100
mov edi, 0x1020be0
rep stosd dword es:[edi], eax
je 0x1019c62
push 0x1006138
call fcn.01019ff1
pop ecx
push 0x57
pop eax
jmp 0x1019eee
xor edi, edi
inc edi
push 0x1020b60
mov dword [0x1020b04], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, ebx
jne 0x1019c97
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push 0x10060c0
jmp 0x1019ed1
mov esi, dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x1020b14], eax
lea eax, [ebp - 0x3bc]
push eax
push 0x202
call esi
test eax, eax
je 0x1019cd6
lea eax, [ebp - 0x3bc]
push eax
push 2
call esi
mov esi, eax
cmp esi, ebx
je 0x1019cd6
push 0x1006098
call fcn.01019fd7
mov eax, esi
jmp 0x1019eed
call fcn.01018f74
test eax, eax
jne 0x1019cf2
lea eax, [ebp - 0x3cc]
push eax
push ebx
push ebx
push 0x10188bc
jmp 0x1019eb7
push 0x1020ba0
mov byte [0x1020fe0], bl
call fcn.0101b275
test eax, eax
je 0x1019d56
movzx eax, byte [0x1020ba7]
push eax
movzx eax, byte [0x1020ba6]
push eax
movzx eax, byte [0x1020ba5]
push eax
movzx eax, byte [0x1020ba4]
push eax
push 0x10053a8
mov esi, 0x1020fe0
push esi
mov dword [0x1020af4], edi
mov dword [0x1020af0], edi
call dword [sym.imp.USER32.dll_wsprintfA]
push esi
push 0x1006040
call fcn.01019fbd
add esp, 0x20
jmp 0x1019e9f
xor eax, eax
lea edi, [ebp - 0x22c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x3c0]
push eax
push ebx
mov dword [ebp - 0x3c0], ebx
mov word [ebp - 0x22c], 2
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x1019e14
cmp dword [ebp - 0x3c0], ebx
je 0x1019e14
push dword [ebp - 0x3c0]
call sub.msvcrt.dll_malloc
mov esi, eax
cmp esi, ebx
pop ecx
je 0x1019e9f
lea eax, [ebp - 0x3c0]
push eax
push esi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x1019e14
mov ecx, esi
mov dword [ebp - 0x3c4], ecx
lea eax, [ecx + 0x1ac]
cmp eax, ebx
je 0x1019de9
push 8
mov edi, 0x1004438
lea esi, [eax + 4]
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1019df7
mov eax, dword [eax]
cmp eax, ebx
jne 0x1019dcc
mov ecx, dword [ebp - 0x3c4]
mov ecx, dword [ecx]
cmp ecx, ebx
mov dword [ebp - 0x3c4], ecx
jne 0x1019dc2
jmp 0x1019e14
lea esi, [eax + 4]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
push esi
push 0x1005490
mov dword [ebp - 0x228], eax
call fcn.01019fa3
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x22c]
push eax
call fcn.0101b099
cmp eax, ebx
mov dword [0x1020af0], eax
je 0x1019e9f
lea eax, [ebp - 0x3c4]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x1b39
push ebx
mov dword [ebp - 0x3c4], ebx
call fcn.0101abca
test eax, eax
jne 0x1019e94
push dword [ebp - 0x3c4]
call fcn.0101af1f
movzx eax, byte [ebp - 0x215]
push eax
movzx eax, byte [ebp - 0x216]
push eax
movzx eax, byte [ebp - 0x217]
push eax
movzx eax, byte [ebp - 0x218]
push eax
push 0x10053a8
mov esi, 0x1020fe0
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
push esi
push 0x1005fe0
jmp 0x1019d49
push 0x1005f48
call fcn.01019fd7
pop ecx
lea eax, [ebp - 0x3cc]
push eax
push ebx
push ebx
mov dword [0x102013c], 0x1020140
push 0x1018bd1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
jne 0x1019edc
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push 0x1005ee8
call fcn.01019fd7
pop ecx
pop ecx
call esi
jmp 0x1019eee
push 0x1005e98
mov dword [0x1020b08], eax
call fcn.01019fa3
xor eax, eax
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01017bb1
leave
ret