Function at 0x101ad0f
Capabilities:
Accept command line arguments
Persist via run registry key

Disassembly:
mov eax, 0x108c41f
call fcn.01027038
sub esp, 0x9c
mov eax, dword [0x10a1e18]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x36], bl
mov byte [ebp - 0x30], bl
inc esi
mov byte [ebp - 0x34], 1
mov byte [ebp - 0x25], 1
mov byte [ebp - 0x2f], bl
mov byte [ebp - 0x2e], bl
mov byte [ebp - 0x35], bl
mov byte [ebp - 0x2d], bl
mov dword [ebp - 0x54], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x58], ebx
push ebx
mov byte [ebp - 4], 1
call fcn.0101d238
cmp eax, ebx
jl 0x101add0
call fcn.0105673e
cmp eax, ebx
jl 0x101add0
call fcn.0103baa0
cmp eax, ebx
jl 0x101add0
call fcn.0103a244
cmp eax, ebx
jl 0x101add0
push esi
call fcn.0103523d
cmp eax, ebx
jl 0x101add0
push esi
call fcn.01067684
cmp eax, ebx
jl 0x101add0
call fcn.0104fc14
cmp eax, ebx
jl 0x101add0
call fcn.0104cc6e
cmp eax, ebx
jl 0x101add0
call fcn.0105b459
cmp eax, ebx
jl 0x101add0
call fcn.0106be4f
cmp eax, ebx
jl 0x101add0
xor eax, eax
cmp eax, ebx
mov edi, eax
jl 0x101b358
cmp dword [ebp + 8], esi
jle 0x101afc1
mov ebx, dword [sym.imp.msvcrt.dll__wcsicmp]
mov eax, dword [ebp - 0x3c]
mov edi, dword [eax + esi*4]
mov ax, word [edi]
cmp ax, 0x2d
je 0x101ae02
cmp ax, 0x2f
jne 0x101affd
inc edi
inc edi
push 0x10022a0
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101ae29
mov eax, dword [ebp + 8]
dec eax
cmp esi, eax
jge 0x101ae29
mov eax, dword [ebp - 0x3c]
inc esi
mov eax, dword [eax + esi*4]
mov dword [ebp - 0x2c], eax
jmp 0x101af56
push 0x1002288
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101ae40
mov byte [ebp - 0x32], 1
jmp 0x101af52
push 0x1002274
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101ae5b
mov byte [ebp - 0x32], 1
mov byte [ebp - 0x31], 1
jmp 0x101af52
push 0x1002260
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101ae71
mov byte [ebp - 0x34], al
jmp 0x101af56
push 0x1002250
push edi
call ebx
test eax, eax
pop ecx
pop ecx
je 0x101ae9a
push 0x100223c
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101aea3
call fcn.0101a9bc
test al, al
jne 0x101af56
mov byte [ebp - 0x33], 1
jmp 0x101af52
push 0x1002228
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101aeba
mov byte [ebp - 0x36], 1
jmp 0x101af52
push 0x1002210
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101aeee
mov eax, dword [ebp + 8]
add eax, 0xfffffffe
cmp esi, eax
jge 0x101aeee
mov eax, dword [ebp - 0x3c]
inc esi
mov ecx, dword [eax + esi*4]
inc esi
push dword [eax + esi*4]
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x58]
call fcn.01017f4c
mov byte [ebp - 0x2f], 1
jmp 0x101af52
push 0x10021f4
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101af14
mov eax, dword [ebp + 8]
dec eax
cmp esi, eax
jge 0x101af14
mov eax, dword [ebp - 0x3c]
inc esi
mov eax, dword [eax + esi*4]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x2e], 1
jmp 0x101af52
push 0x10021e4
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101af28
mov byte [ebp - 0x30], 1
jmp 0x101af52
push 0x10021d0
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101af3c
mov byte [ebp - 0x35], 1
jmp 0x101af52
push 0x10021b8
push edi
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101affd
mov byte [ebp - 0x2d], 1
mov byte [ebp - 0x25], 0
inc esi
cmp esi, dword [ebp + 8]
jl 0x101ade9
cmp byte [ebp - 0x30], 0
jne 0x101b14c
cmp byte [ebp - 0x2f], 0
jne 0x101b14c
cmp byte [ebp - 0x2e], 0
jne 0x101b14c
cmp byte [ebp - 0x32], 0
je 0x101af91
push dword [ebp - 0x2c]
mov ecx, 0x10a6a90
call fcn.0103287b
cmp byte [ebp - 0x31], 0
je 0x101afaf
push dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
mov ecx, 0x10a6a90
setne al
push eax
push 1
call fcn.01032db1
cmp byte [ebp - 0x33], 0
je 0x101afbe
mov byte [ebp - 4], 8
call fcn.0101c67b
xor esi, esi
inc esi
xor ebx, ebx
cmp byte [ebp - 0x31], bl
mov dword [ebp - 4], esi
je 0x101b052
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0xa
call fcn.01033784
mov edi, eax
cmp edi, ebx
jge 0x101b014
push esi
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.0101937d
jmp 0x101b358
mov edi, 0x80004005
jmp 0x101b358
mov eax, dword [ebp - 0x4c]
cmp eax, ebx
jne 0x101b020
mov eax, 0x1001eb0
push eax
push 0x1002194
mov edi, 0x1002138
push edi
call fcn.01020cbb
mov eax, dword [ebp - 0x4c]
cmp eax, ebx
jne 0x101b03d
mov eax, 0x1001eb0
push eax
push 0x1002110
push edi
call fcn.01020cbb
push esi
lea ecx, [ebp - 0x50]
call fcn.0101937d
cmp byte [ebp - 0x36], 0
je 0x101b061
mov byte [ebp - 4], 0xb
call fcn.0101ba00
cmp byte [ebp - 0x25], 0
mov dword [ebp - 4], esi
je 0x101b0b2
mov byte [ebp - 4], 0xd
call fcn.0101a6d2
mov edi, eax
cmp edi, ebx
jl 0x101b0eb
push ebx
push esi
push 0x10020e8
call fcn.01023c84
mov edi, eax
cmp edi, ebx
jl 0x101b0eb
mov ecx, dword [0x10a6cc0]
call fcn.0105c14d
mov edi, eax
cmp edi, ebx
jl 0x101b0eb
xor eax, eax
cmp byte [ebp - 0x34], al
mov ecx, 0x10a6a90
setne al
push eax
call fcn.01032459
mov dword [ebp - 4], esi
cmp byte [ebp - 0x35], 0
je 0x101b118
lea eax, [ebp - 0x54]
push eax
push 0x1001ce8
push esi
push ebx
push 0x100a2a8
mov byte [ebp - 4], 0xf
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
cmp edi, ebx
jl 0x101b0eb
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
lea edx, [ebp - 0x5c]
push edx
push eax
call dword [ecx + 0x24]
mov edi, eax
cmp edi, ebx
jge 0x101b10e
mov byte [ebp - 4], 1
jmp 0x101b358
cmp dword [ebp - 0x5c], ebx
je 0x101b118
call fcn.01020ecc
cmp byte [ebp - 0x2d], 0
mov dword [ebp - 4], esi
je 0x101b12a
mov byte [ebp - 4], 0x11
call fcn.010203eb
mov dword [ebp - 4], esi
jmp 0x101b344
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x40], eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x3c], eax
je 0x101b172
lea eax, [ebp - 0x3c]
push eax
push 0x10020e0
push dword [ebp - 0x40]
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
push 0x10016a0
push 0x17
xor esi, esi
push esi
push 0x1001910
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, esi
jge 0x101b2e2
lea ecx, [ebp - 0xa8]
call fcn.01022f98
lea eax, [ebp - 0x2d]
push eax
push 0x10020c0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 4
call fcn.0101a5f5
cmp byte [ebp - 0x30], 0
mov byte [ebp - 4], 5
je 0x101b1ca
push 0x10021e4
lea ecx, [ebp - 0x50]
call fcn.0101a383
cmp byte [ebp - 0x2f], 0
je 0x101b1fe
push dword [ebp - 0x3c]
lea eax, [ebp - 0x24]
push 0x10020b4
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
push 0x1002098
lea ecx, [ebp - 0x50]
call fcn.0101a383
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x50]
call fcn.0101a383
cmp byte [ebp - 0x2e], 0
je 0x101b232
push dword [ebp - 0x3c]
lea eax, [ebp - 0x24]
push 0x10020b4
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
push 0x1002078
lea ecx, [ebp - 0x50]
call fcn.0101a383
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x50]
call fcn.0101a383
push esi
push 0xf003f
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0xa8]
call fcn.01022acf
cmp eax, esi
jl 0x101b2ad
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
lea ecx, [ebp - 0xa8]
call fcn.01023455
cmp eax, esi
jl 0x101b2ad
lea ecx, [ebp - 0xa8]
call fcn.01023695
cmp eax, esi
jl 0x101b2ad
lea eax, [ebp - 0x2d]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x6c]
call fcn.0101a5f5
mov eax, dword [ebp - 0x4c]
cmp eax, esi
mov byte [ebp - 4], 6
jne 0x101b292
mov eax, 0x1001eb0
push esi
push eax
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0102323a
push 1
lea ecx, [ebp - 0x6c]
call fcn.0101937d
push 1
lea ecx, [ebp - 0x50]
xor edi, edi
call fcn.0101937d
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 3
call fcn.01022fc9
mov eax, dword [ebp - 0x2c]
cmp eax, esi
mov byte [ebp - 4], 2
je 0x101b0eb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x101b0eb
cmp byte [ebp - 0x30], 0
je 0x101b2f9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x34]
mov edi, eax
cmp edi, esi
jl 0x101b2c8
cmp byte [ebp - 0x2f], 0
je 0x101b314
push dword [ebp - 0x58]
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov edi, eax
cmp edi, esi
jl 0x101b2c8
cmp byte [ebp - 0x2e], 0
je 0x101b32c
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x48]
mov edi, eax
cmp edi, esi
jl 0x101b2c8
mov eax, dword [ebp - 0x2c]
cmp eax, esi
mov byte [ebp - 4], 2
je 0x101b33d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 1
xor edi, edi
jmp 0x101b358
mov ecx, dword [0x10a6bd4]
test ecx, ecx
je 0x101b367
call fcn.0103c3fb
call fcn.0106cb62
call fcn.0105ad14
call fcn.0104a898
call fcn.0104fc6a
call fcn.01066f91
call fcn.01035395
call fcn.0103a2c0
call fcn.0103c61c
call fcn.010567ba
push dword [ebp - 0x58]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x54]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x101b3ae
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, edi
call fcn.0101cfd1
pop edi
pop esi
pop ebx
leave
ret 8