Function at 0x1005f960
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x101819a0
push 0x10132540
mov eax, dword fs:[0]
push eax
sub esp, 0xc58
mov eax, dword [0x10189710]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov dword [ebp - 0xc5c], esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc58], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc54], eax
mov dword [ebp - 0xc50], ecx
xor ebx, ebx
mov dword [ebp - 0xc4c], ebx
mov dword [ebp - 4], ebx
call fcn.1006bbf0
test eax, eax
je 0x1005fc7c
mov dword [ebp - 0xc4c], 1
cmp dword [0x101c82c4], ebx
jne 0x1005fbfa
cmp dword [ebp + 0x14], ebx
jne 0x1005fbfa
cmp dword [0x101b59a0], ebx
jne 0x1005fbfa
mov byte [ebp - 0x848], bl
mov byte [ebp - 0x340], bl
push 0x103
push ebx
lea edx, [ebp - 0x33f]
push edx
call fcn.1012e060
add esp, 0xc
mov dword [ebp - 0xc60], 0x104
mov byte [ebp - 0x238], bl
push 0x103
push ebx
lea eax, [ebp - 0x237]
push eax
call fcn.1012e060
add esp, 0xc
mov dword [ebp - 0xc4c], 2
mov dword [ebp - 0xc4c], 4
push 0x104
lea ecx, [ebp - 0x238]
push ecx
call fcn.1005f830
add esp, 8
cmp byte [ebp - 0x238], bl
je 0x1005fa7d
lea ecx, [ebp - 0x238]
call fcn.10065200
mov dword [ebp - 0xc4c], 5
mov dword [0x101c82c4], 1
cmp byte [ebp - 0x238], bl
je 0x1005fbfa
lea ecx, [ebp - 0xc60]
lea edx, [ebp - 0x340]
call fcn.1005cb90
test eax, eax
je 0x1005fbfa
mov byte [ebp - 0xc48], bl
mov byte [ebp - 0x740], bl
push 0x3ff
push ebx
lea edx, [ebp - 0x73f]
push edx
call fcn.1012e060
add esp, 0xc
mov dword [ebp - 0xc64], 0x400
mov dword [ebp - 0xc4c], 6
push str.Local_AppData
lea eax, [ebp - 0xc64]
lea edi, [ebp - 0x740]
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov edx, reloc.WS2_32.dll_accept
call fcn.10059d80
mov dword [ebp - 0xc4c], 7
cmp byte [ebp - 0x740], bl
jne 0x1005fbc0
mov byte [ebp - 0x130], bl
push 0x103
push ebx
lea eax, [ebp - 0x12f]
push eax
call fcn.1012e060
add esp, 0xc
push 2
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.101287f0
add esp, 0xc
cmp byte [ebp - 0x27], bl
je 0x1005fb59
mov byte [ebp - 0x26], bl
mov byte [ebp - 0x26], bl
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x130]
call fcn.10065200
push str.Users_
lea edx, [ebp - 0x130]
push edx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call edi
lea eax, [ebp - 0x340]
push eax
lea ecx, [ebp - 0x130]
push ecx
call edi
push str.AppDataLocal
lea edx, [ebp - 0x130]
push edx
call edi
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x740]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1005fbc6
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0xc4c], 8
lea ecx, [ebp - 0x740]
call fcn.10065200
push str.VirtualStoreWindowsWin.INI
lea edx, [ebp - 0x740]
push edx
call edi
lea eax, [ebp - 0x740]
call fcn.1005ad10
mov edi, dword [ebp - 0xc58]
mov dword [ebp - 0xc4c], 9
mov eax, dword [0x101c82c8]
cmp eax, ebx
jne 0x1005fc29
push 0x10169c70
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x101c82c8], eax
mov dword [ebp - 0xc4c], 0xa
cmp eax, ebx
je 0x1005fc5c
mov dword [ebp - 0xc4c], 0xb
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc50]
push edx
mov ecx, dword [ebp - 0xc54]
push ecx
push edi
push esi
call eax
jmp 0x1005fce1
mov dword [ebp - 0xc4c], 0xd
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc50]
push eax
mov ecx, dword [ebp - 0xc54]
push ecx
push edi
push esi
jmp 0x1005fcdb
mov dword [ebp - 0xc4c], 0xe
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc50]
push eax
mov ecx, dword [ebp - 0xc54]
push ecx
push edi
push esi
jmp 0x1005fcdb
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10127db1
mov esp, ebp
pop ebp
ret