Function at 0x11459c0
Capabilities:
Delete file
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
push 0x100f448
push esi
call fcn.01135b90
mov eax, dword [esi]
push 0
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 8]
push edx
push 0x1021954
push 0x1014d6c
push connect
push eax
call fcn.010b33d0
mov ebx, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov edi, eax
test edi, edi
je 0x1145a1b
push edi
call ebx
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [esi]
push eax
call fcn.010cac40
test eax, eax
jne 0x1145ab4
mov ecx, dword [esi]
push ecx
call fcn.01122f10
cmp dword [esi + 0xa18], 0
je 0x1145a49
push 4
push 0x1021f84
push esi
call fcn.0113f5a0
push 1
push esi
call fcn.0105e170
cmp dword [esi + 0xa40], 0
je 0x1145aa2
mov eax, dword [esi]
push 0
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 8]
push ecx
push 0x1021f74
push 0x1014d6c
push connect
push eax
call fcn.010b33d0
test eax, eax
je 0x1145aa2
mov edi, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
test edi, edi
je 0x1145aa2
push 0
push 0x1021f58
push esi
call fcn.0113f5a0
mov edx, dword [esi]
push 1
push 0
push edx
call fcn.010d2d90
push esi
call fcn.01124290
mov eax, dword [esi]
push esi
mov dword [eax + 0x129c8], 1
call fcn.01051960
mov eax, dword [esi]
push 0x101dbe0
add eax, 0x3c22
push 0x100b744
push eax
call fcn.0107e5b0
mov edi, eax
test edi, edi
je 0x1145af6
push edi
call ebx
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ecx, dword [esi]
push ecx
call fcn.010ee330
cmp dword [esi + 0x9dc], 0
jne 0x1145c50
mov eax, dword [esi]
lea edx, [ebp + 8]
push edx
push 0
push 0
push 0
push 0
push 0x22e078
push eax
call fcn.0108fe70
push 1
lea ecx, [esi + 0x1d6c]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov edx, dword [esi]
push edx
call fcn.010435a0
mov ecx, dword [esi]
lea eax, [ebp + 8]
push eax
push 0
push 0
push 0
push 0
push 0x22e038
push ecx
call fcn.0108fe70
mov eax, dword [esi]
lea edx, [esi + 0x8a6]
push edx
push eax
call fcn.010b4660
mov dword [ebp - 4], 2
lea ebx, [ebx]
mov eax, dword [esi]
push 0x100cc1c
add eax, 0x766c
push 0x100b744
push eax
call fcn.0107e5b0
mov edi, eax
mov dword [ebp + 8], edi
test edi, edi
je 0x1145c1c
mov eax, dword [esi]
push 0x100cc1c
add eax, 0x766c
push 0x100b744
push eax
call fcn.0107e5b0
mov dword [ebp - 8], eax
test eax, eax
je 0x1145c0c
mov edi, dword [esi]
push 0x40
call fcn.010284a0
lea ebx, [edi + eax*4 + 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x40
push edi
call fcn.010b1980
push 0
push edi
call fcn.0104bf40
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
mov ecx, dword [ebp + 8]
push 0
push 0
push ecx
push edi
mov dword [ebp - 0xc], 0
call fcn.0108e280
mov edx, dword [ebp - 8]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov edi, dword [ebp + 8]
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [esi]
cmp dword [eax + 0x8238], 0
je 0x1145c38
push 1
push 0x100cc1c
push 0
push 0
push esi
call fcn.011049e0
sub dword [ebp - 4], 1
jne 0x1145b70
mov ecx, dword [esi]
push ecx
call fcn.010c2990
push esi
call fcn.01122fc0
push 1
push esi
call fcn.01115510
mov edx, dword [esi]
push edx
call fcn.010cac40
test eax, eax
jne 0x1145cb7
mov eax, dword [esi]
mov ecx, dword [eax + 0x3550]
cmp dword [ecx + 0xe48], 0
je 0x1145c97
push 1
push 0
push eax
call fcn.010d2d90
mov edx, dword [esi]
mov eax, dword [edx + 0x3550]
push esi
mov dword [eax + 0xe48], 0
call fcn.01116520
mov edi, dword [esi]
push 0x101352c
lea ebx, [edi + 0x3c22]
push ebx
push edi
call fcn.01097860
push 0x1013520
push ebx
push edi
call fcn.01097860
push esi
call fcn.010cda30
mov edx, dword [esi]
lea ecx, [edx + 0x3c22]
test ecx, ecx
jne 0x1145ccd
xor eax, eax
jmp 0x1145ce2
cmp word [ecx], 0
mov eax, ecx
je 0x1145cde
add eax, 2
cmp word [eax], 0
jne 0x1145cd5
sub eax, ecx
sar eax, 1
push 0
push 0x104c200
push eax
push ecx
push edx
call fcn.0102bdc0
mov ecx, dword [esi]
push 0x100222c
push 0x1018168
push connect
push ecx
call fcn.010b3d20
mov edx, dword [esi]
push 0
push 0
push 0
push 0x1014d6c
push connect
push edx
call fcn.010b3850
mov edi, dword [esi]
lea ebx, [edi + 0x20]
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x40
push edi
call fcn.010b1980
mov ecx, dword [edi + 0x1e8]
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push 0
push reloc.WS2_32.dll_closesocket
mov dword [ebp + 8], 0
call ecx
test eax, eax
jne 0x1145d81
mov edx, dword [ebp + 8]
push 1
push eax
push eax
push edx
push 0x1014d6c
push 0x10b41b0
push edi
call fcn.010b3e50
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 0x1fc]
push eax
call ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
cmp dword [esi + 0x9dc], 0
jne 0x1145e38
cmp dword [ebp + 0xc], 0
je 0x1145e38
mov ebx, dword [esi]
push 0
push 1
lea edi, [esi + 0x272]
push edi
push ebx
call fcn.0108e280
test eax, eax
jne 0x1145dbd
push edi
push ebx
call fcn.01104cb0
test edi, edi
jne 0x1145dc5
xor eax, eax
jmp 0x1145ddd
cmp word [edi], 0
mov eax, edi
je 0x1145dd9
lea ecx, [ecx]
add eax, 2
cmp word [eax], 0
jne 0x1145dd0
sub eax, edi
sar eax, 1
push eax
push edi
call fcn.0102ab30
mov edi, eax
test edi, edi
je 0x1145e16
push 0x5c
push edi
call fcn.0102aa00
test eax, eax
je 0x1145e06
xor edx, edx
mov word [eax], dx
mov eax, dword [esi]
mov ecx, dword [eax + 0x110]
push edi
call ecx
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [esi]
mov edx, dword [eax + 0x12a10]
mov eax, dword [eax + 0x314]
push edx
call eax
mov eax, dword [esi]
mov edx, dword [eax + 0x110]
lea ecx, [eax + 0x3c22]
push ecx
call edx
mov esi, dword [esi]
lea eax, [esi + 0x3c22]
push eax
push esi
call fcn.01048720
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8