Function at 0x105b1d8
Capabilities:
Check if file exists
Compare security identifiers
Get file attributes
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1076530]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 1
push 0x11a
push 0x100f91c
lea ecx, [ebp - 0x268]
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x298], edi
call fcn.01055826
xor ebx, ebx
cmp edi, ebx
je 0x105b224
mov dword [edi], ebx
push 0xa
xor eax, eax
pop ecx
mov word [ebp - 0x30], ax
lea edi, [ebp - 0x2e]
push 0x206
rep stosd dword es:[edi], eax
mov word [ebp - 0x238], ax
lea eax, [ebp - 0x236]
push ebx
push eax
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x294], ebx
mov dword [ebp - 0x284], 7
call sub.msvcrt.dll_memset
mov eax, 0x1010420
push 0x40
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2a4], eax
lea eax, [ebp - 0x308]
push ebx
push eax
mov dword [ebp - 0x2c0], 0x15
mov dword [ebp - 0x2c8], 0x104
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x28c], ebx
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x2b8], ebx
mov dword [ebp - 0x2b4], ebx
mov dword [ebp - 0x2ac], ebx
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x2a0], ebx
mov dword [ebp - 0x29c], ebx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x310], ebx
mov dword [ebp - 0x30c], ebx
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - 0x2c4], 0x44
mov eax, 0x138
cmp esi, ebx
jne 0x105b333
mov dword [ebp - 0x268], 0x80070057
mov word [ebp - 0x262], ax
jmp 0x105bc56
mov edi, dword [ebp - 0x270]
mov word [ebp - 0x264], ax
mov eax, 0x139
cmp edi, ebx
je 0x105b31d
mov word [ebp - 0x264], ax
inc eax
cmp dword [ebp - 0x298], ebx
je 0x105b31d
mov word [ebp - 0x264], ax
lea eax, [ebp - 0x26c]
push eax
push edi
push esi
mov dword [ebp - 0x268], ebx
call fcn.0105b0e1
test eax, eax
jge 0x105b3bb
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x105b3a0
test dword [eax + 0x1c], 0x10000000
je 0x105b3a0
push edi
push 0x100f850
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01016f01
mov eax, 0x146
mov dword [ebp - 0x268], 1
mov word [ebp - 0x264], ax
jmp 0x105bc56
cmp dword [ebp - 0x26c], ebx
jne 0x105b3f2
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x105b3eb
test dword [eax + 0x1c], 0x10000000
je 0x105b3eb
push edi
push 0x100f850
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01016f01
mov eax, 0x14c
jmp 0x105b3a5
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x26c]
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
cmp dword [ebp - 0x284], 1
je 0x105b45a
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x105b450
test dword [eax + 0x1c], 0x10000000
je 0x105b450
push edi
push 0x100f850
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01016f01
mov eax, 0x15a
jmp 0x105b3a5
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x310]
push eax
push ebx
push 0x16
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x105b48a
call fcn.0105d3b8
mov dword [ebp - 0x268], eax
mov eax, 0x15f
jmp 0x105b327
push dword [ebp - 0x26c]
mov eax, 0x15f
mov word [ebp - 0x264], ax
lea eax, [ebp - 0x310]
push eax
mov dword [ebp - 0x268], ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x105b4e5
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x105b4db
test dword [eax + 0x1c], 0x10000000
je 0x105b4db
push edi
push 0x100f850
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01016f01
mov eax, 0x165
jmp 0x105b3a5
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x238]
push eax
push edi
call fcn.0105aaf2
mov dword [ebp - 0x268], eax
cmp eax, ebx
mov eax, 0x168
jl 0x105b327
mov word [ebp - 0x264], ax
lea eax, [ebp - 0x244]
push eax
push edi
push esi
call fcn.0105af9d
cmp eax, ebx
mov dword [ebp - 0x268], eax
jge 0x105b539
mov eax, 0x16a
jmp 0x105b327
xor esi, esi
inc esi
mov ecx, 0x16a
mov word [ebp - 0x264], cx
cmp eax, esi
jne 0x105b584
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x105b574
test dword [eax + 0x1c], 0x10000000
je 0x105b574
push edi
push 0x100f850
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01016f01
mov dword [ebp - 0x268], esi
mov eax, 0x16e
jmp 0x105b3af
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x105b5df
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x105b5cf
test dword [eax + 0x1c], 0x10000000
je 0x105b5cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x244]
mov eax, dword [0x1075318]
push edi
push 0x100f850
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0105aa25
mov dword [ebp - 0x268], esi
mov eax, 0x176
jmp 0x105b3af
cmp dword [ebp - 0x23c], ebx
je 0x105b602
cmp dword [ebp - 0x23c], 0xffffffff
je 0x105b602
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x23c], ebx
lea eax, [ebp - 0x23c]
push eax
push 0x20019
push ebx
push edi
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, 0x100f850
cmp eax, 2
je 0x105b66b
cmp eax, 3
je 0x105b66b
mov ecx, dword [0x1075318]
cmp ecx, 0x1075318
je 0x105b906
test dword [ecx + 0x1c], 0x10000000
je 0x105b906
cmp eax, ebx
jle 0x105b657
and eax, 0xffff
or eax, 0x80070000
push eax
push edi
push 0x100f850
push 0x12
push dword [ecx + 0x14]
push dword [ecx + 0x10]
jmp 0x105b901
mov eax, dword [0x1075318]
mov edi, 0x1075318
cmp eax, edi
je 0x105b6bc
test dword [eax + 0x1c], 0x10000000
je 0x105b69b
push dword [ebp - 0x270]
push esi
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01016f01
mov eax, dword [0x1075318]
cmp eax, edi
je 0x105b6bc
test dword [eax + 0x1c], 0x10000000
je 0x105b6bc
push dword [ebp - 0x244]
push esi
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01016f01
mov edx, dword [ebp - 0x244]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1001ee8
lea ecx, [ebp - 0x290]
call fcn.01064650
mov dword [ebp - 0x268], eax
cmp eax, ebx
mov eax, 0x18e
jl 0x105b327
push dword [ebp - 0x290]
mov word [ebp - 0x264], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xffffffff
jne 0x105b729
call edi
cmp eax, 2
je 0x105b729
call fcn.0105d3b8
mov dword [ebp - 0x268], eax
mov eax, 0x191
jmp 0x105b327
mov eax, 0x191
mov dword [ebp - 0x268], ebx
mov word [ebp - 0x264], ax
cmp esi, 0xffffffff
jne 0x105b826
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x105b771
test dword [eax + 0x1c], 0x10000000
je 0x105b771
push dword [ebp - 0x290]
push 0x100f850
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01016f01
mov edx, dword [ebp - 0x244]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1001ed0
lea ecx, [ebp - 0x290]
call fcn.01064650
mov dword [ebp - 0x268], eax
cmp eax, ebx
mov eax, 0x195
jl 0x105b327
push dword [ebp - 0x290]
mov word [ebp - 0x264], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x105b7d8
call edi
cmp eax, 2
je 0x105b7d8
call fcn.0105d3b8
mov dword [ebp - 0x268], eax
mov eax, 0x198
jmp 0x105b327
mov eax, 0x198
mov dword [ebp - 0x268], ebx
mov word [ebp - 0x264], ax
cmp esi, 0xffffffff
jne 0x105b826
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x105b81c
test dword [eax + 0x1c], 0x10000000
je 0x105b81c
push dword [ebp - 0x290]
push 0x100f850
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01016f01
mov eax, 0x19c
jmp 0x105b3a5
mov edi, 0x1001f00
push edi
mov esi, 0x80000002
push esi
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push dword [ebp - 0x290]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
cmp eax, ebx
jle 0x105b854
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
cmp ecx, ebx
jge 0x105b887
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x105b906
test dword [eax + 0x1c], 0x10000000
je 0x105b906
push ecx
push dword [ebp - 0x270]
push 0x100f850
push 0x16
jmp 0x105b8fb
mov dword [ebp - 0x294], 1
cmp dword [ebp - 0x23c], ebx
je 0x105b8b4
cmp dword [ebp - 0x23c], 0xffffffff
je 0x105b8b4
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x23c], ebx
lea eax, [ebp - 0x23c]
push eax
push 0x20019
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jle 0x105b8d7
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
cmp ecx, ebx
jge 0x105b906
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x105b906
test dword [eax + 0x1c], 0x10000000
je 0x105b906
push ecx
push edi
push 0x100f850
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01016f6e
cmp dword [ebp - 0x23c], ebx
je 0x105b997
cmp dword [ebp - 0x240], ebx
je 0x105b935
cmp dword [ebp - 0x240], 0xffffffff
je 0x105b935
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x240], ebx
lea eax, [ebp - 0x240]
push eax
push 0x20019
push ebx
mov edi, 0x1001f38
push edi
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jle 0x105b962
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
cmp ecx, ebx
jge 0x105b997
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x105b997
test dword [eax + 0x1c], 0x10000000
je 0x105b997
push ecx
push edi
push dword [ebp - 0x270]
push 0x100f850
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0105aa25
mov edx, 0x100a348
lea ecx, [ebp - 0x2b0]
call fcn.01063fb4
mov dword [ebp - 0x268], eax
cmp eax, ebx
mov eax, 0x1c5
jl 0x105b327
mov word [ebp - 0x264], ax
push ebx
cmp dword [ebp - 0x240], ebx
je 0x105baf0
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x2b0]
push dword [ebp - 0x240]
call fcn.01057f3b
cmp eax, ebx
jge 0x105ba85
mov ecx, dword [0x1075318]
cmp ecx, 0x1075318
je 0x105ba21
test byte [ecx + 0x1c], 0x40
je 0x105ba21
push eax
push dword [ebp - 0x2b0]
push dword [ebp - 0x270]
push 0x100f850
push 0x19
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0105aa25
mov edx, dword [ebp - 0x244]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x100f860
lea ecx, [ebp - 0x2a4]
call fcn.01064650
mov dword [ebp - 0x268], eax
cmp eax, ebx
mov eax, 0x1d2
jl 0x105b327
push dword [ebp - 0x2a4]
mov word [ebp - 0x264], ax
lea eax, [ebp - 0x278]
push eax
call fcn.01055bde
mov dword [ebp - 0x268], eax
cmp eax, ebx
mov eax, 0x1d3
jl 0x105b327
mov word [ebp - 0x264], ax
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x27c]
push eax
push dword [ebp - 0x240]
push dword [ebp - 0x244]
push dword [ebp - 0x270]
call fcn.0105ad2c
mov dword [ebp - 0x268], eax
cmp eax, ebx
mov eax, 0x1d6
jl 0x105b327
push 0x20
mov word [ebp - 0x264], ax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov esi, eax
mov dword [ebp - 0x280], esi
mov eax, 0x1e5
cmp esi, ebx
jne 0x105bb85
mov dword [ebp - 0x268], 0x8007000e
jmp 0x105b327
mov edx, dword [ebp - 0x244]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x100f860
lea ecx, [ebp - 0x2a4]
call fcn.01064650
mov dword [ebp - 0x268], eax
cmp eax, ebx
mov eax, 0x1da
jl 0x105b327
push dword [ebp - 0x2a4]
mov word [ebp - 0x264], ax
lea eax, [ebp - 0x278]
push eax
call fcn.01055bde
mov dword [ebp - 0x268], eax
cmp eax, ebx
mov eax, 0x1db
jl 0x105b327
mov word [ebp - 0x264], ax
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x27c]
push eax
push ebx
push dword [ebp - 0x244]
push dword [ebp - 0x270]
call fcn.0105ad2c
mov dword [ebp - 0x268], eax
cmp eax, ebx
mov eax, 0x1dc
jmp 0x105bab7
push 0x20
mov word [ebp - 0x264], ax
mov dword [ebp - 0x268], ebx
pop ecx
mov eax, esi
mov byte [eax], bl
inc eax
dec ecx
jne 0x105bb97
mov eax, dword [ebp - 0x26c]
push dword [ebp - 0x270]
mov dword [esi], eax
xor eax, eax
cmp dword [ebp - 0x284], 1
mov dword [ebp - 0x26c], ebx
sete al
mov dword [esi + 4], eax
lea eax, [esi + 8]
push eax
call fcn.01055bde
mov dword [ebp - 0x268], eax
cmp eax, ebx
mov eax, 0x1ed
jl 0x105b327
mov word [ebp - 0x264], ax
mov eax, dword [ebp - 0x278]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x278], ebx
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x244], ebx
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x27c]
mov dword [esi + 0x1c], eax
push dword [ebp - 0x2bc]
lea eax, [esi + 0x10]
push eax
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x27c], ebx
call fcn.01055bde
mov dword [ebp - 0x268], eax
cmp eax, ebx
mov eax, 0x1fb
jl 0x105b327
mov word [ebp - 0x264], ax
mov eax, dword [ebp - 0x298]
mov dword [eax], esi
mov dword [ebp - 0x280], ebx
lea eax, [ebp - 0x244]
push eax
call fcn.01013001
push dword [ebp - 0x26c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x26c], ebx
cmp dword [ebp - 0x294], ebx
je 0x105bcd2
cmp dword [ebp - 0x23c], ebx
je 0x105bc9f
cmp dword [ebp - 0x23c], 0xffffffff
je 0x105bc9f
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x23c], ebx
cmp dword [ebp - 0x240], ebx
je 0x105bcc2
cmp dword [ebp - 0x240], 0xffffffff
je 0x105bcc2
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x240], ebx
push 0x1001f00
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
cmp dword [ebp - 0x274], ebx
je 0x105bd0b
mov edi, dword [ebp - 0x27c]
cmp edi, ebx
jbe 0x105bcff
mov esi, dword [ebp - 0x274]
push esi
call fcn.01013001
lea eax, [esi + 4]
push eax
call fcn.01013001
add esi, 8
dec edi
jne 0x105bcea
push dword [ebp - 0x274]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 0x280], ebx
je 0x105bd2a
push dword [ebp - 0x280]
call fcn.0105aca0
push dword [ebp - 0x280]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, dword [ebp - 0x268]
lea ecx, [ebp - 0x2a4]
call fcn.010635b3
lea ecx, [ebp - 0x2b0]
call fcn.010635b3
lea ecx, [ebp - 0x2bc]
call fcn.010635b3
lea ecx, [ebp - 0x290]
call fcn.010635b3
cmp dword [ebp - 0x240], ebx
je 0x105bd7f
cmp dword [ebp - 0x240], 0xffffffff
je 0x105bd7f
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x240], ebx
cmp dword [ebp - 0x23c], ebx
je 0x105bda2
cmp dword [ebp - 0x23c], 0xffffffff
je 0x105bda2
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x23c], ebx
lea ecx, [ebp - 0x268]
call fcn.01055a3c
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01054fa7
leave
ret 0xc