Function at 0x101ac96
Capabilities:
Accept command line arguments
Persist via run registry key

Disassembly:
mov eax, 0x108c2b4
call fcn.01026ef8
sub esp, 0x9c
mov eax, dword [0x10a1e18]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x36], bl
mov byte [ebp - 0x30], bl
inc esi
mov byte [ebp - 0x34], 1
mov byte [ebp - 0x25], 1
mov byte [ebp - 0x2f], bl
mov byte [ebp - 0x2e], bl
mov byte [ebp - 0x35], bl
mov byte [ebp - 0x2d], bl
mov dword [ebp - 0x54], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x58], ebx
push ebx
mov byte [ebp - 4], 1
call fcn.0101d1a5
cmp eax, ebx
jl 0x101ad57
call fcn.010566ed
cmp eax, ebx
jl 0x101ad57
call fcn.0103b8d9
cmp eax, ebx
jl 0x101ad57
call fcn.0103a085
cmp eax, ebx
jl 0x101ad57
push esi
call fcn.01035055
cmp eax, ebx
jl 0x101ad57
push esi
call fcn.01067600
cmp eax, ebx
jl 0x101ad57
call fcn.0104fb92
cmp eax, ebx
jl 0x101ad57
call fcn.0104cc69
cmp eax, ebx
jl 0x101ad57
call fcn.0105b52b
cmp eax, ebx
jl 0x101ad57
call fcn.0106be6f
cmp eax, ebx
jl 0x101ad57
xor eax, eax
cmp eax, ebx
mov edi, eax
jl 0x101b2e5
cmp dword [ebp + 8], esi
jle 0x101af48
mov ebx, dword [sym.imp.msvcrt.dll__wcsicmp]
mov eax, dword [ebp - 0x3c]
mov edi, dword [eax + esi*4]
mov ax, word [edi]
cmp ax, 0x2d
je 0x101ad89
cmp ax, 0x2f
jne 0x101af8a
inc edi
inc edi
push 0x1002298
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101adb0
mov eax, dword [ebp + 8]
dec eax
cmp esi, eax
jge 0x101adb0
mov eax, dword [ebp - 0x3c]
inc esi
mov eax, dword [eax + esi*4]
mov dword [ebp - 0x2c], eax
jmp 0x101aedd
push 0x1002280
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101adc7
mov byte [ebp - 0x32], 1
jmp 0x101aed9
push 0x100226c
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101ade2
mov byte [ebp - 0x32], 1
mov byte [ebp - 0x31], 1
jmp 0x101aed9
push 0x1002258
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101adf8
mov byte [ebp - 0x34], al
jmp 0x101aedd
push 0x1002248
push edi
call ebx
test eax, eax
pop ecx
pop ecx
je 0x101ae21
push 0x1002234
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101ae2a
call fcn.0101a943
test al, al
jne 0x101aedd
mov byte [ebp - 0x33], 1
jmp 0x101aed9
push 0x1002220
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101ae41
mov byte [ebp - 0x36], 1
jmp 0x101aed9
push 0x1002208
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101ae75
mov eax, dword [ebp + 8]
add eax, 0xfffffffe
cmp esi, eax
jge 0x101ae75
mov eax, dword [ebp - 0x3c]
inc esi
mov ecx, dword [eax + esi*4]
inc esi
push dword [eax + esi*4]
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x58]
call fcn.01017edc
mov byte [ebp - 0x2f], 1
jmp 0x101aed9
push 0x10021ec
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101ae9b
mov eax, dword [ebp + 8]
dec eax
cmp esi, eax
jge 0x101ae9b
mov eax, dword [ebp - 0x3c]
inc esi
mov eax, dword [eax + esi*4]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x2e], 1
jmp 0x101aed9
push 0x10021dc
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101aeaf
mov byte [ebp - 0x30], 1
jmp 0x101aed9
push 0x10021c8
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101aec3
mov byte [ebp - 0x35], 1
jmp 0x101aed9
push 0x10021b0
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101af8a
mov byte [ebp - 0x2d], 1
mov byte [ebp - 0x25], 0
inc esi
cmp esi, dword [ebp + 8]
jl 0x101ad70
cmp byte [ebp - 0x30], 0
jne 0x101b0d9
cmp byte [ebp - 0x2f], 0
jne 0x101b0d9
cmp byte [ebp - 0x2e], 0
jne 0x101b0d9
cmp byte [ebp - 0x32], 0
je 0x101af18
push dword [ebp - 0x2c]
mov ecx, 0x10a6a88
call fcn.0103267d
cmp byte [ebp - 0x31], 0
je 0x101af36
push dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
mov ecx, 0x10a6a88
setne al
push eax
push 1
call fcn.01032bb3
cmp byte [ebp - 0x33], 0
je 0x101af45
mov byte [ebp - 4], 8
call fcn.0101c5f3
xor esi, esi
inc esi
xor ebx, ebx
cmp byte [ebp - 0x31], bl
mov dword [ebp - 4], esi
je 0x101afdf
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
push ebx
lea eax, [ebp - 0x50]
push eax
push 0x9c6
mov byte [ebp - 4], 0xa
call fcn.0101d495
mov edi, eax
cmp edi, ebx
jge 0x101afa1
push esi
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.0101930d
jmp 0x101b2e5
mov edi, 0x80004005
jmp 0x101b2e5
mov eax, dword [ebp - 0x4c]
cmp eax, ebx
jne 0x101afad
mov eax, 0x1001ea8
push eax
push 0x100218c
mov edi, 0x1002130
push edi
call fcn.01020bd9
mov eax, dword [ebp - 0x4c]
cmp eax, ebx
jne 0x101afca
mov eax, 0x1001ea8
push eax
push 0x1002108
push edi
call fcn.01020bd9
push esi
lea ecx, [ebp - 0x50]
call fcn.0101930d
cmp byte [ebp - 0x36], 0
je 0x101afee
mov byte [ebp - 4], 0xb
call fcn.0101b972
cmp byte [ebp - 0x25], 0
mov dword [ebp - 4], esi
je 0x101b03f
mov byte [ebp - 4], 0xd
call fcn.0101a659
mov edi, eax
cmp edi, ebx
jl 0x101b078
push ebx
push esi
push 0x10020e0
call fcn.01023b92
mov edi, eax
cmp edi, ebx
jl 0x101b078
mov ecx, dword [0x10a6cb8]
call fcn.0105c2df
mov edi, eax
cmp edi, ebx
jl 0x101b078
xor eax, eax
cmp byte [ebp - 0x34], al
mov ecx, 0x10a6a88
setne al
push eax
call fcn.0103225b
mov dword [ebp - 4], esi
cmp byte [ebp - 0x35], 0
je 0x101b0a5
lea eax, [ebp - 0x54]
push eax
push 0x1001ce8
push esi
push ebx
push 0x100a268
mov byte [ebp - 4], 0xf
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
cmp edi, ebx
jl 0x101b078
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
lea edx, [ebp - 0x5c]
push edx
push eax
call dword [ecx + 0x24]
mov edi, eax
cmp edi, ebx
jge 0x101b09b
mov byte [ebp - 4], 1
jmp 0x101b2e5
cmp dword [ebp - 0x5c], ebx
je 0x101b0a5
call fcn.01020dea
cmp byte [ebp - 0x2d], 0
mov dword [ebp - 4], esi
je 0x101b0b7
mov byte [ebp - 4], 0x11
call fcn.0102032d
mov dword [ebp - 4], esi
jmp 0x101b2d1
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x40], eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x3c], eax
je 0x101b0ff
lea eax, [ebp - 0x3c]
push eax
push 0x10020d8
push dword [ebp - 0x40]
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
push 0x10016a0
push 0x17
xor esi, esi
push esi
push 0x1001910
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, esi
jge 0x101b26f
lea ecx, [ebp - 0xa8]
call fcn.01022ea6
lea eax, [ebp - 0x2d]
push eax
push 0x10020b8
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 4
call fcn.0101a57c
cmp byte [ebp - 0x30], 0
mov byte [ebp - 4], 5
je 0x101b157
push 0x10021dc
lea ecx, [ebp - 0x50]
call fcn.0101a325
cmp byte [ebp - 0x2f], 0
je 0x101b18b
push dword [ebp - 0x3c]
lea eax, [ebp - 0x24]
push 0x10020ac
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
push 0x1002090
lea ecx, [ebp - 0x50]
call fcn.0101a325
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x50]
call fcn.0101a325
cmp byte [ebp - 0x2e], 0
je 0x101b1bf
push dword [ebp - 0x3c]
lea eax, [ebp - 0x24]
push 0x10020ac
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
push 0x1002070
lea ecx, [ebp - 0x50]
call fcn.0101a325
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x50]
call fcn.0101a325
push esi
push 0xf003f
push 0x80000002
lea ecx, [ebp - 0xa8]
call fcn.010229dd
cmp eax, esi
jl 0x101b23a
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
lea ecx, [ebp - 0xa8]
call fcn.01023363
cmp eax, esi
jl 0x101b23a
lea ecx, [ebp - 0xa8]
call fcn.010235a3
cmp eax, esi
jl 0x101b23a
lea eax, [ebp - 0x2d]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x6c]
call fcn.0101a57c
mov eax, dword [ebp - 0x4c]
cmp eax, esi
mov byte [ebp - 4], 6
jne 0x101b21f
mov eax, 0x1001ea8
push esi
push eax
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0xa8]
call fcn.01023148
push 1
lea ecx, [ebp - 0x6c]
call fcn.0101930d
push 1
lea ecx, [ebp - 0x50]
xor edi, edi
call fcn.0101930d
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 3
call fcn.01022ed7
mov eax, dword [ebp - 0x2c]
cmp eax, esi
mov byte [ebp - 4], 2
je 0x101b078
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x101b078
cmp byte [ebp - 0x30], 0
je 0x101b286
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x34]
mov edi, eax
cmp edi, esi
jl 0x101b255
cmp byte [ebp - 0x2f], 0
je 0x101b2a1
push dword [ebp - 0x58]
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov edi, eax
cmp edi, esi
jl 0x101b255
cmp byte [ebp - 0x2e], 0
je 0x101b2b9
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x48]
mov edi, eax
cmp edi, esi
jl 0x101b255
mov eax, dword [ebp - 0x2c]
cmp eax, esi
mov byte [ebp - 4], 2
je 0x101b2ca
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 1
xor edi, edi
jmp 0x101b2e5
mov ecx, dword [0x10a6bcc]
test ecx, ecx
je 0x101b2f4
call fcn.0103c234
call fcn.0106cb82
call fcn.0105ac9f
call fcn.0104a6d5
call fcn.0104fbe8
call fcn.01066f0d
call fcn.010351ad
call fcn.0103a101
call fcn.0103c455
call fcn.01056769
push dword [ebp - 0x58]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x54]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x101b33b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, edi
call fcn.0101cf4f
pop edi
pop esi
pop ebx
leave
ret 8