Function at 0x1002e5bf
Capabilities:
Persist via ginadll registry key

Disassembly:
push ebp
sub esp, 0x200
lea ebp, [esp - 4]
mov eax, dword [0x10113a30]
xor eax, ebp
mov dword [ebp + 0x200], eax
push 0x1c
mov eax, 0x100be74f
call fcn.10092efa
mov ebx, dword [ebp + 0x20c]
call fcn.1006f7ae
push eax
lea ecx, [ebp - 0x24]
call fcn.10004d63
and dword [ebp - 4], 0
call fcn.1006f7ae
push eax
lea ecx, [ebp - 0x18]
call fcn.10004d63
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], 0xf003f
call fcn.10009e6a
mov edi, pe_nt_image_headers32
push edi
lea eax, [ebp + 0x100]
push 0
push eax
call fcn.1008ef90
add esp, 0x10
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogonRalink
lea eax, [ebp + 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x20], 0x18
jne 0x1002e653
mov dword [ebp - 0x1c], 0xf013f
push dword [ebp - 0x1c]
lea eax, [ebp + 0x100]
push eax
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call fcn.10008ce6
add esp, 0xc
test eax, eax
je 0x1002e6ae
mov esi, eax
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.10001210
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.10001210
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.1008e5e8
add ebp, 0x204
leave
ret 4
push edi
lea eax, [ebp]
push 0
push eax
mov dword [ebp - 0x10], edi
call fcn.1008ef90
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x14]
push eax
push str.SSOInstall
lea eax, [ebp + 0x100]
push eax
push esi
call fcn.1000b244
add esp, 0x24
cmp eax, 1
jne 0x1002e6ef
lea eax, [ebp]
push eax
call fcn.10091cb3
pop ecx
mov dword [ebx], eax
push edi
lea eax, [ebp]
push 0
push eax
mov dword [ebp - 0x10], edi
call fcn.1008ef90
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x14]
push eax
mov edi, str.SSOEnable
push edi
lea eax, [ebp + 0x100]
push eax
push esi
call fcn.1000b244
add esp, 0x24
cmp eax, 1
jne 0x1002e734
lea eax, [ebp]
push eax
call fcn.10091cb3
pop ecx
mov dword [ebx + 4], eax
jmp 0x1002e771
and dword [ebx + 4], 0
push 0x100ce2b8
lea ecx, [ebp - 0x18]
call fcn.10005cd8
mov eax, dword [ebp - 0x18]
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x28], eax
call fcn.10005348
push dword [ebp - 0x1c]
push dword [ebp - 0x28]
push 1
push eax
push edi
lea eax, [ebp + 0x100]
push eax
push esi
call fcn.1000a248
add esp, 0x1c
mov edi, 0x80
push edi
lea eax, [ebx + 0xc]
push 0
push eax
mov dword [ebp - 0x10], edi
call fcn.1008ef90
lea eax, [ebp - 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push str.SavedPassword
lea eax, [ebp + 0x100]
push eax
push esi
call fcn.1000b244
push edi
lea eax, [ebx + 0x8c]
push 0
push eax
mov dword [ebp - 0x10], edi
call fcn.1008ef90
lea eax, [ebp - 0x10]
push eax
lea eax, [ebx + 0x8c]
push eax
lea eax, [ebp - 0x14]
push eax
push str.GinaDLL
lea eax, [ebp + 0x100]
push eax
push esi
call fcn.1000b244
add esp, 0x48
mov eax, pe_nt_image_headers32
push eax
lea ecx, [ebx + 0x10c]
push 0
push ecx
mov dword [ebp - 0x10], eax
call fcn.1008ef90
lea eax, [ebp - 0x10]
push eax
lea eax, [ebx + 0x10c]
push eax
lea eax, [ebp - 0x14]
push eax
push str.CardName
lea eax, [ebp + 0x100]
push eax
push esi
call fcn.1000b244
push edi
lea eax, [ebx + 0x20c]
push 0
push eax
mov dword [ebp - 0x10], edi
call fcn.1008ef90
lea eax, [ebp - 0x10]
push eax
lea eax, [ebx + 0x20c]
push eax
lea eax, [ebp - 0x14]
push eax
push str.ProfileName
lea eax, [ebp + 0x100]
push eax
push esi
call fcn.1000b244
add esp, 0x48
mov eax, pe_nt_image_headers32
push eax
lea ecx, [ebx + 0x28c]
push 0
push ecx
mov dword [ebp - 0x10], eax
call fcn.1008ef90
lea eax, [ebp - 0x10]
push eax
lea eax, [ebx + 0x28c]
push eax
lea eax, [ebp - 0x14]
push eax
push str.SSOProfilePath
lea eax, [ebp + 0x100]
push eax
push esi
call fcn.1000b244
push edi
add ebx, 0x38c
push 0
push ebx
mov dword [ebp - 0x10], edi
call fcn.1008ef90
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push str.SSOEnablePersistentConnection
lea eax, [ebp + 0x100]
push eax
push esi
call fcn.1000b244
add esp, 0x48
xor esi, esi
jmp 0x1002e671
cmp byte [0x1011c700], 0
jne 0x10057824
push 0xfffffffffffffffe
pop eax
jmp 0x10057848
push esi
mov esi, 0x1011c88c
push esi
call fcn.10001272
test eax, eax
pop ecx
jne 0x10057839
push 0xfffffffffffffff7
jmp 0x10057846
push esi
call fcn.10001b5e
test eax, eax
pop ecx
jne 0x1005784b
push 0xfffffffffffffff5
pop eax
pop esi
ret 4
mov ecx, dword [0x1011cc1c]
pop esi
jmp 0x1002e5bf