Function at 0x1103840
Capabilities:
Persist via appinit_dlls registry key
Persist via winlogon helper dll registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.010bf330
push esi
call fcn.010bf2b0
push esi
call fcn.010ecb60
push 0x1017044
push connect
push esi
call fcn.010bf3c0
push 0x1017028
push connect
push esi
call fcn.010bf3c0
push 0x1016fe0
push connect
push esi
call fcn.010bf3c0
mov eax, dword [esi + 0x3550]
xor ebx, ebx
test dword [eax + 0x138], 0x200
jne 0x1103c82
mov ecx, dword [esi]
cmp dword [ecx + 0xa60], ebx
jne 0x1103c82
push ebx
push 0x101d464
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d454
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d448
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d438
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d420
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d404
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d3ec
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d3d0
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d3bc
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d3a8
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d394
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d38c
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d384
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d37c
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d370
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d35c
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d348
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d338
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d328
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d318
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d310
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d300
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d318
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d2f0
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d318
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d2e4
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d2d0
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d2c4
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d2b4
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d318
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d2a4
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d28c
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d27c
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d26c
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d25c
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d250
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d240
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101c4f4
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d250
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d228
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d250
push 0x101c540
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d21c
push 0x101c450
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d204
push 0x101c450
push 0x101c50c
push esi
call fcn.010ecac0
push ebx
push 0x101d1f4
push 0x101c450
push 0x101c50c
push esi
call fcn.010ecac0
push esi
call fcn.01103730
push esi
call fcn.010bf1d0
mov edi, 1
push edi
push 0x101d1e4
push 0x101d1bc
push 0x1005fe4
push esi
call fcn.010ecac0
push ebx
push 0x101d1ac
push 0x101d184
push 0x101d168
push esi
call fcn.010ecac0
push ebx
push 0x101d158
push 0x101d140
push 0x101d168
push esi
call fcn.010ecac0
push ebx
push 0x101d120
push 0x101d11c
push 0x101d168
push esi
call fcn.010ecac0
push 3
push 0x101d114
push 0x101d10c
push 0x1005f50
push esi
call fcn.010ecac0
push 0x1005bbc
push 0x1005bc8
push 0x1005f14
push connect
push esi
call fcn.010eca40
push 8
push 0x101d104
push edi
push 0x1002536
push 0x101d0ec
push connect
push esi
call fcn.010b3130
push 8
push 0x101d0e4
push edi
push 0x1002536
push 0x101d0b8
push connect
push esi
call fcn.010b3130
push 0x101d08c
push connect
push esi
call fcn.010b3980
push 4
push 0x101d088
push edi
push 0x101d070
push 0x101d044
push connect
push esi
call fcn.010b3130
push 0xd
push 0x101d034
push edi
push 0x101d02c
push 0x101cff4
push connect
push esi
call fcn.010b3130
cmp dword [esi + 0x81a4], 0x2710
jae 0x1103dc6
push 0x1c2
push 0x101ce30
push edi
push 0x101ce20
push 0x101cdf8
push connect
push esi
call fcn.010b3130
push edi
push 0x1002536
push edi
push 0x101cde8
push 0x101cdb0
push connect
push esi
call fcn.010b3130
push 0x2a
push 0x101cd84
push 7
push 0x101cd6c
push 0x101cd08
push connect
push esi
call fcn.010b2fe0
push 0x20
push 0x101cce4
push 2
push 0x1005c20
push 0x101cdf8
push connect
push esi
call fcn.010b3130
push 0x41
push 0x101cca0
push 2
push 0x1005c14
push 0x101cdf8
push connect
push esi
call fcn.010b3130
push esi
call fcn.010bf630
push 0x101cc90
push 0x101cc58
push connect
push esi
call fcn.010b3da0
push 0x101cc34
push 0x1014ce8
push connect
push esi
call fcn.010b3d20
push 0x101cc1c
push 0x1014ce8
push connect
push esi
call fcn.010b3d20
push 0x101cbf8
push 0x1014ce8
push connect
push esi
call fcn.010b3d20
push ebx
push ebx
push ebx
push 0x101cb80
push connect
push esi
call fcn.010b3850
push 0x101cc90
push 0x101cb40
push connect
push esi
call fcn.010b3da0
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101cb34
push 0x101cb40
push connect
push esi
mov dword [ebp + 8], ebx
call fcn.010b3130
push 0x101cb34
push 0x101cc58
push connect
push esi
call fcn.010b3da0
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0x101d114
push 0x101cb0c
push connect
push esi
mov dword [ebp + 8], ebx
call fcn.010b3130
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0x101cb00
push 0x101cad0
push connect
push esi
mov dword [ebp + 8], ebx
call fcn.010b3130
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101d114
push 0x101caa4
push connect
push esi
mov dword [ebp + 8], 2
call fcn.010b3130
push 0x101ca8c
push 0x101ca50
push connect
push esi
call fcn.010b3da0
push 0x101ca34
push 0x101ca50
push connect
push esi
call fcn.010b3da0
push 0x101ca18
push 0x101ca50
push connect
push esi
call fcn.010b3da0
push 0x101ca00
push 0x101ca50
push connect
push esi
call fcn.010b3da0
push 0x101c9e8
push 0x101ca50
push connect
push esi
call fcn.010b3da0
push 0x101c9cc
push 0x101ca50
push connect
push esi
call fcn.010b3da0
push 0x101c9b0
push 0x101ca50
push connect
push esi
call fcn.010b3da0
push 0x101c994
push 0x101ca50
push connect
push esi
call fcn.010b3da0
push 0x101c988
push 0x101c958
push connect
push esi
call fcn.010b3da0
push 0x101c938
push 0x101c958
push connect
push esi
call fcn.010b3da0
mov dword [ebp + 8], 0xffffffff
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0x101c92c
push 0x101cff4
push connect
push esi
call fcn.010b3130
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0x101c914
push 0x101c8d8
push connect
push esi
mov dword [ebp + 8], edi
call fcn.010b3130
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101c8cc
push 0x101cff4
push connect
push esi
mov dword [ebp + 8], ebx
call fcn.010b3130
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0x101c8c0
push 0x101c894
push connect
push esi
mov dword [ebp + 8], edi
call fcn.010b3130
push 0x101c854
push connect
push esi
call fcn.010b3980
push 0x3c
push 0x101c814
call fcn.01029520
mov edi, eax
cmp edi, ebx
je 0x110413f
push ebx
push ebx
call fcn.01029520
push 0x25
push 0x101c7ec
mov dword [ebp + 8], eax
call fcn.01029520
mov ecx, dword [ebp + 8]
push 0x4c
push eax
push 2
push ecx
push edi
push connect
push esi
mov dword [ebp - 4], eax
call fcn.010b2fe0
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x1104113
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 4]
cmp eax, 0x101c7ec
je 0x1104130
cmp eax, ebx
je 0x1104130
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 0x22
push 0x101c7c8
push 2
push 0x1005934
push 0x101c778
push connect
push esi
call fcn.010b3130
push 0x1f
push 0x101c758
push 2
push 0x101c74c
push 0x101c718
push connect
push esi
call fcn.010b3130
push 0x2d
push 0x101c6e8
push 2
push 0x101c6dc
push 0x101c6b0
push connect
push esi
call fcn.010b3130
push ebx
push ebx
push ebx
push 0x101c658
push connect
push esi
call fcn.010b3850
push 0x10121ec
push 0x10165e8
push connect
push esi
call fcn.010b3d20
push 0x1005ab4
push 0x1016ec8
push connect
push esi
call fcn.010b3520
cmp eax, ebx
je 0x11041e9
push 0x1016ec0
push eax
call fcn.01029980
test eax, eax
jne 0x1104268
cmp dword [esi + 0x81a4], 0x1fa4
jb 0x1104204
push esi
call fcn.010bf5d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x819c], 6
jb 0x1104230
push 0x101c620
push 0x1005ab4
push 0x1016ec8
push connect
push esi
call fcn.010b32a0
push 0x5c
push 0x101c5c0
jmp 0x1104251
push 0x101c5b0
push 0x1005ab4
push 0x1016ec8
push connect
push esi
call fcn.010b32a0
push 0x44
push 0x101c568
push 7
push 0x1016f4c
push 0x1016f00
push connect
push esi
call fcn.010b2fe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4