Function at 0x1057198
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x11dc
call fcn.0105f070
mov eax, dword [0x111121c]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov ebx, ecx
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
and dword [ebp - 0x11c0], 0
lea eax, [ebp - 0x11c0]
push eax
push 0
call fcn.01046916
test eax, eax
jne 0x10571ea
mov ecx, dword [ebp - 0x11c0]
call fcn.01046bbd
mov eax, dword [ebp - 0x11c0]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor esi, esi
inc esi
push esi
call fcn.0104c7a3
push 0x1007c9c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1057264
push 0x1007c5c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1057264
lea ecx, [ebp - 0x11d4]
push ecx
mov dword [ebp - 0x11d4], 0x14
call eax
test eax, eax
jl 0x1057264
cmp dword [ebp - 0x11cc], 0x46
jne 0x105723d
cmp dword [ebp - 0x11d0], 4
jne 0x1057244
jmp 0x105725e
cmp dword [ebp - 0x11d0], 4
ja 0x1057258
cmp dword [ebp - 0x11d0], 4
jne 0x1057264
cmp dword [ebp - 0x11cc], 0x46
jbe 0x1057264
mov dword [0x111352c], esi
mov dword [0x1113530], esi
mov eax, dword [0x1113518]
cmp al, 0xd
je 0x1057271
cmp al, 1
jne 0x105727c
mov dword [0x1113538], esi
call fcn.010cc43c
push 0x45
pop ecx
mov esi, 0x1112e28
lea edi, [ebp - 0x11bc]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
inc edi
cmp dword [ebp - 0x11ac], edi
jne 0x10572d3
push 0xd
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
je 0x1057348
lea ecx, [ebp - 0x10a8]
push ecx
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x1057348
cmp byte [ebp - 0x1091], 0xb2
je 0x1057342
cmp byte [ebp - 0x1091], 0xb1
jne 0x1057348
jmp 0x1057342
cmp dword [ebp - 0x11ac], 2
jne 0x1057348
cmp dword [ebp - 0x11b8], 4
jne 0x105731b
lea eax, [ebp - 0x11c0]
push eax
push 0x20019
push 0
push 0x1008880
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1057348
push dword [ebp - 0x11c0]
mov dword [0x1113534], edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1057348
cmp dword [ebp - 0x11b8], 5
jb 0x1057348
mov esi, dword [sym.imp.KERNEL32.dll_IsValidLocale]
push edi
push 0x401
call esi
test eax, eax
jne 0x1057342
push edi
push 0x40d
call esi
test eax, eax
je 0x1057348
mov dword [0x1113534], edi
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0x105736b
push 0xc
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
mov dword [ebx + 0x68], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, ebx
call fcn.01056fe1
mov esi, eax
test esi, esi
jl 0x105756f
mov ecx, ebx
call fcn.01069fca
mov esi, eax
test esi, esi
jl 0x105756f
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
lea edx, [ebx + 0x38]
push edx
push eax
call dword [ecx + 0x38]
mov esi, eax
test esi, esi
jl 0x105756f
push 0x80000302
push 0x10075e0
lea ecx, [ebx + 0x40]
call fcn.01063f5e
mov ecx, 0x80000000
test ecx, eax
mov dword [0x1113524], eax
mov esi, 0x200
jne 0x10573d7
test ah, 1
je 0x10573d0
or eax, esi
or eax, ecx
mov dword [0x1113524], eax
push 0xf003f
push edi
mov edi, 0x80000001
push edi
push 0x1007380
lea ecx, [ebp - 0x11dc]
call fcn.01064103
push 0x10075a4
lea ecx, [ebp - 0x11dc]
call fcn.01064159
xor eax, eax
cmp dword [ebp - 0x11d8], eax
sete al
test dword [0x1113524], esi
je 0x1057439
test eax, eax
jne 0x1057443
call fcn.010663e2
test eax, eax
jne 0x1057443
push dword [0x1113524]
lea eax, [ebp - 0x11dc]
push eax
mov ecx, ebx
call fcn.0104a0f1
jmp 0x1057443
test eax, eax
je 0x1057443
or dword [0x1113524], esi
lea ecx, [ebp - 0x11dc]
call fcn.0106413d
call fcn.010a27ce
mov esi, eax
test esi, esi
jl 0x105756f
call fcn.01076956
mov esi, eax
test esi, esi
jl 0x105756f
call fcn.010b1f0a
mov esi, eax
test esi, esi
jl 0x105756f
push 0x24
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x1057492
push 0
mov ecx, eax
call fcn.010b1f57
jmp 0x1057494
xor eax, eax
test eax, eax
mov dword [ebx + 0xac], eax
je 0x10574a9
mov ecx, eax
call fcn.010b1d63
mov esi, eax
jmp 0x10574ae
mov esi, 0x8007000e
test esi, esi
jl 0x105756f
push 0xf003f
push 1
push edi
push 0x10073e0
lea ecx, [ebx + 0x74]
call fcn.01063ccf
mov esi, dword [ebx + 0x78]
neg esi
sbb esi, esi
and esi, 0x80004005
jl 0x105756f
mov ecx, dword [0x1112f40]
push 0x824
lea eax, [ebp - 0x104c]
push eax
call fcn.0103f482
push dword [0x1112f5c]
mov ecx, ebx
call fcn.0104a21d
mov esi, eax
test esi, esi
jl 0x105756f
push 0x64
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x1057521
lea ecx, [ebx + 0x1c]
push ecx
mov ecx, eax
call fcn.01084d5a
jmp 0x1057523
xor eax, eax
test eax, eax
mov dword [ebx + 0x28], eax
je 0x1057544
mov ecx, eax
call fcn.010850e7
test eax, eax
jge 0x1057549
mov eax, dword [ebx + 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebx + 0x28], 0
jmp 0x1057549
mov esi, 0x8007000e
test esi, esi
jl 0x105756f
push 0
call fcn.010c2b3c
test eax, eax
mov dword [ebx + 0x5e4], eax
je 0x105756a
mov edx, dword [eax]
push ebx
mov ecx, eax
call dword [edx + 0xc]
mov esi, eax
jmp 0x105756f
mov esi, 0x8007000e
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.0105eca9
leave
ret