Function at 0x1151e30
Capabilities:
Delete file
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push eax
call fcn.010ece00
test eax, eax
je 0x11521ec
push ebx
push edi
push 1
push 0x100fd18
push esi
call fcn.011474c0
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 0x128]
push 0x7d0
call edx
mov eax, dword [esi]
push 0
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0x10214d0
push 0x1015934
push connect
push eax
call fcn.010ba1a0
mov ebx, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov edi, eax
test edi, edi
je 0x1151ea9
push edi
call ebx
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [esi]
push eax
call fcn.010d1d70
test eax, eax
jne 0x1151f1e
mov ecx, dword [esi]
push ecx
call fcn.01126510
cmp dword [esi + 0xa1c], 0
je 0x1151ed3
push 4
push 0x1023310
push esi
call fcn.0114f6c0
push 1
push esi
call fcn.010615e0
cmp dword [esi + 0xa44], 0
je 0x1151f0c
mov edx, dword [esi]
push 0x1023300
push 0x1015934
push connect
push edx
call fcn.010ba400
test eax, eax
je 0x1151f0c
push 0
push 0x10232e4
push esi
call fcn.0114f6c0
mov eax, dword [esi]
push 1
push 0
push eax
call fcn.010d93e0
push esi
call fcn.01127ca0
mov ecx, dword [esi]
lea edx, [esi + 0x960]
mov dword [ecx + 0x13310], 1
mov eax, dword [esi]
push edx
push eax
call fcn.010543c0
mov edx, dword [esi]
lea ecx, [esi + 0x990]
push ecx
push edx
call fcn.010543c0
mov eax, dword [esi]
push 0x101ec40
add eax, 0x3c7e
push 0x100bfcc
push eax
call fcn.010842c0
mov edi, eax
test edi, edi
je 0x1151f78
push edi
call ebx
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [esi]
push eax
call fcn.010f57c0
cmp dword [esi + 0x954], 0
jne 0x1152017
push esi
call fcn.01099ba0
mov edx, dword [esi]
lea ecx, [esi + 0x9c0]
push ecx
push edx
call fcn.010543c0
mov eax, dword [esi]
push eax
call fcn.01045ff0
mov edx, dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0
push 0
push 0
push 0
push 0x22e038
push edx
call fcn.01096090
mov ecx, dword [esi]
lea eax, [esi + 0x8a6]
push eax
push ecx
call fcn.010bb430
mov edi, 2
push 0
push 0x100d4e4
push 0
push 0
push esi
call fcn.0110c650
mov edx, dword [esi]
cmp dword [edx + 0x8b80], 0
je 0x1152004
push 1
push 0x100d4e4
push 0
push 0
push esi
call fcn.0110c650
sub edi, 1
jne 0x1151fd7
mov eax, dword [esi]
push eax
call fcn.010c95b0
push esi
call fcn.011265c0
push 1
push esi
call fcn.01119610
mov ecx, dword [esi]
push ecx
call fcn.010d1d70
test eax, eax
jne 0x115207e
mov eax, dword [esi]
mov edx, dword [eax + 0x35a8]
cmp dword [edx + 0xe48], 0
je 0x115205e
push 1
push 0
push eax
call fcn.010d93e0
mov eax, dword [esi]
mov ecx, dword [eax + 0x35a8]
push esi
mov dword [ecx + 0xe48], 0
call fcn.0111a520
mov edi, dword [esi]
push 0x1013fc4
lea ebx, [edi + 0x3c7e]
push ebx
push edi
call fcn.0109dee0
push 0x1013fb8
push ebx
push edi
call fcn.0109dee0
push esi
call fcn.010d4b50
mov edx, dword [esi]
push edx
call fcn.01096be0
mov eax, dword [esi]
push 0x1018d94
push 0x1018d38
push connect
push eax
call fcn.010baaf0
mov ecx, dword [esi]
push 0
push 0
push 0
push 0x1015934
push connect
push ecx
call fcn.010ba620
mov edi, dword [esi]
lea edx, [edi + 0x20]
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x40
push edi
call fcn.010b8740
mov ecx, dword [edi + 0x1e8]
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push 0
push reloc.WS2_32.dll_closesocket
mov dword [ebp + 8], 0
call ecx
test eax, eax
jne 0x115211c
mov edx, dword [ebp + 8]
push 1
push eax
push eax
push edx
push 0x1015934
push 0x10baf80
push edi
call fcn.010bac20
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 0x1fc]
push eax
call ecx
push 0x40
call fcn.0102ab20
lea edx, [edi + eax*4 + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
cmp dword [esi + 0x954], 0
jne 0x11521db
cmp dword [ebp + 0xc], 0
je 0x11521db
mov ebx, dword [esi]
push 0
push 1
lea edi, [esi + 0x272]
push edi
push ebx
call fcn.01093ff0
test eax, eax
jne 0x1152163
push edi
push ebx
call fcn.0110c840
test edi, edi
jne 0x115216b
xor eax, eax
jmp 0x1152180
cmp word [edi], 0
mov eax, edi
je 0x115217c
add eax, 2
cmp word [eax], 0
jne 0x1152173
sub eax, edi
sar eax, 1
push eax
push edi
call fcn.0102d280
mov edi, eax
test edi, edi
je 0x11521b9
push 0x5c
push edi
call fcn.0102d150
test eax, eax
je 0x11521a9
xor ecx, ecx
mov word [eax], cx
mov edx, dword [esi]
mov eax, dword [edx + 0x110]
push edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [esi]
mov ecx, dword [eax + 0x13358]
mov edx, dword [eax + 0x314]
push ecx
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x110]
lea ecx, [eax + 0x3c7e]
push ecx
call edx
mov esi, dword [esi]
lea eax, [esi + 0x3c7e]
push eax
push esi
call fcn.0104b060
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8