Function at 0x1008a0f
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb24
mov eax, dword [0x100bffc]
push ebx
push esi
push edi
mov esi, 0xf003f
push esi
xor ebx, ebx
inc ebx
push ebx
mov edi, 0x80000002
push edi
push 0x10039b8
lea ecx, [ebp - 0xaec]
mov dword [ebp - 4], eax
call fcn.01008062
push esi
push ebx
push edi
push 0x1003920
lea ecx, [ebp - 0xa98]
call fcn.01008062
push esi
push ebx
push edi
push 0x1003610
lea ecx, [ebp - 0xab4]
call fcn.01008062
push esi
push ebx
push edi
push 0x1003520
lea ecx, [ebp - 0xb24]
call fcn.01008062
push esi
push ebx
push edi
push 0x10034d8
lea ecx, [ebp - 0xb08]
call fcn.01008062
push esi
push ebx
push edi
push 0x1003580
lea ecx, [ebp - 0xa7c]
call fcn.01008062
push esi
push ebx
push 0x80000003
mov ebx, 0x10013ac
push ebx
lea ecx, [ebp - 0xad0]
call fcn.01008062
push esi
push 0
push edi
push 0x1003870
lea ecx, [ebp - 0xa60]
call fcn.01008062
push ebx
lea ecx, [ebp - 0xab4]
call fcn.010080b8
test eax, eax
mov dword [ebp - 0xa40], eax
je 0x1008af6
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
je 0x1008e36
push 0x18
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x1008b18
lea ecx, [ebp - 0xad0]
push ecx
mov ecx, eax
call fcn.01007f9f
mov dword [ebp - 0xa38], eax
jmp 0x1008b1f
and dword [ebp - 0xa38], 0
mov eax, dword [ebp - 0xa38]
test eax, eax
mov edi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov ebx, 0x208
je 0x1008cda
and dword [ebp - 0xa34], 0
cmp dword [eax + 8], 0
jbe 0x1008ccd
mov eax, dword [ebp - 0xa38]
mov eax, dword [eax + 0xc]
test eax, eax
mov dword [ebp - 0xa30], eax
je 0x1008ca7
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
push eax
push 0x100385c
push dword [ebp - 0xa30]
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0x10
test eax, eax
je 0x1008ca7
push 0x1003520
push dword [ebp - 0xa30]
lea eax, [ebp - 0x414]
push 0x1003850
push ebx
push eax
call edi
push 0x1c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0x18
test eax, eax
je 0x1008bca
push esi
push 1
push 0x80000003
lea ecx, [ebp - 0x414]
push ecx
mov ecx, eax
call fcn.01008062
mov dword [ebp - 0xa3c], eax
jmp 0x1008bd1
and dword [ebp - 0xa3c], 0
push 0x10034d8
push dword [ebp - 0xa30]
lea eax, [ebp - 0x414]
push 0x1003850
push ebx
push eax
call edi
push 0x1c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0x18
test eax, eax
je 0x1008c17
push esi
push 1
push 0x80000003
lea ecx, [ebp - 0x414]
push ecx
mov ecx, eax
call fcn.01008062
mov dword [ebp - 0xa30], eax
jmp 0x1008c1e
and dword [ebp - 0xa30], 0
cmp dword [ebp - 0xa3c], 0
je 0x1008c96
mov ecx, dword [ebp - 0xa30]
test ecx, ecx
je 0x1008c89
push 0x1003834
call fcn.010080b8
test eax, eax
mov dword [ebp - 0xa44], eax
je 0x1008c79
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
je 0x1008c79
mov ecx, dword [ebp - 0xa30]
push 0x1003834
call fcn.01007f1e
push dword [ebp - 0xa44]
mov ecx, dword [ebp - 0xa3c]
push 0x1003824
call fcn.01007e9e
jmp 0x1008c89
mov ecx, dword [ebp - 0xa30]
push 0x1003834
call fcn.01007f1e
mov ecx, dword [ebp - 0xa3c]
push 1
call fcn.0100886c
mov ecx, dword [ebp - 0xa30]
test ecx, ecx
je 0x1008ca7
push 1
call fcn.0100886c
mov ecx, dword [ebp - 0xa38]
call fcn.0100815a
inc dword [ebp - 0xa34]
mov eax, dword [ebp - 0xa38]
mov ecx, dword [ebp - 0xa34]
cmp ecx, dword [eax + 8]
jb 0x1008b49
mov ecx, dword [ebp - 0xa38]
push 1
call fcn.01008892
push dword [ebp - 0xa40]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push dword [ebp - 0xa40]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 4
push 1
push 0x1003808
lea ecx, [ebp - 0xa7c]
call fcn.01007ee3
push 4
push 1
push 0x10037f4
lea ecx, [ebp - 0xa98]
call fcn.01007ee3
push 0x10037d4
lea ecx, [ebp - 0xaec]
call fcn.010080b8
test eax, eax
mov dword [ebp - 0xa44], eax
je 0x1008e36
push 0x10037a8
lea ecx, [ebp - 0xb08]
call fcn.010080b8
push 0x10034a0
push eax
push 0x1003850
mov dword [ebp - 0xa40], eax
lea eax, [ebp - 0x414]
push ebx
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 0x14
push 0x10034bc
call esi
cmp eax, 0xffffffff
mov dword [ebp - 0xa34], eax
je 0x1008e0b
lea eax, [ebp - 0x414]
push eax
call esi
push 0x104
lea eax, [ebp - 0x61c]
push eax
push 0xa26e
push dword [ebp - 0xa34]
call dword [sym.imp.USER32.dll_LoadStringW]
push dword [ebp - 0xa40]
lea eax, [ebp - 0x414]
push 0x100378c
push ebx
push eax
call edi
push dword [ebp - 0xa44]
lea eax, [ebp - 0xa2c]
push 0x1003758
push ebx
push eax
call edi
add esp, 0x20
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.010088b8
call dword [sym.imp.ole32.dll_CoUninitialize]
push dword [ebp - 0xa34]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, 0x100374c
push esi
lea ecx, [ebp - 0xa60]
call fcn.010080b8
test eax, eax
je 0x1008e36
cmp word [eax], 0x21
jne 0x1008e36
add eax, 2
push eax
push esi
lea ecx, [ebp - 0xa60]
call fcn.01007e9e
lea ecx, [ebp - 0xa60]
call fcn.0100809c
lea ecx, [ebp - 0xad0]
call fcn.0100809c
lea ecx, [ebp - 0xa7c]
call fcn.0100809c
lea ecx, [ebp - 0xb08]
call fcn.0100809c
lea ecx, [ebp - 0xb24]
call fcn.0100809c
lea ecx, [ebp - 0xab4]
call fcn.0100809c
lea ecx, [ebp - 0xa98]
call fcn.0100809c
lea ecx, [ebp - 0xaec]
call fcn.0100809c
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01009336
leave
ret