Function at 0x100ad07
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x10431dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
or dword [ebp - 0x234], 0xffffffff
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp + 0x14]
xor ebx, ebx
push ebx
mov dword [ebp - 0x248], eax
call fcn.0100e0c1
or dword [ebp - 0x22c], 0xffffffff
mov dword [esp], 0x10019c0
push 0x1001920
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x224], ebx
call fcn.0101d18e
or dword [edi], 0xffffffff
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
call fcn.0101cb70
push ebx
mov esi, eax
push esi
push 0x353
push 0x10016c4
call fcn.0101c3d2
cmp esi, ebx
jl 0x100ae00
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x224]
push eax
push 0x10497d8
lea eax, [ebp - 0x234]
push eax
push edi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x220]
push eax
call fcn.0101c516
mov esi, eax
cmp esi, ebx
jl 0x100ae00
lea eax, [ebp - 0x230]
push eax
call fcn.0101b28f
mov esi, eax
cmp esi, ebx
jl 0x100ae00
push 1
call fcn.0101aee1
test eax, eax
jne 0x100ae00
mov dword [ebp - 0x228], 1
cmp byte [ebp + 0xc], bl
jne 0x100ae19
cmp dword [ebp - 0x228], ebx
je 0x100ae19
cmp dword [ebp - 0x230], ebx
je 0x100af3a
cmp dword [edi], ebx
jl 0x100ae4c
mov eax, dword [ebp - 0x244]
cmp eax, dword [ebp - 0x234]
jl 0x100ae4c
sub eax, dword [ebp - 0x234]
cmp eax, 0x3c
jg 0x100ae4c
cmp dword [ebp - 0x22c], 0xffffffff
je 0x100ae4c
cmp byte [ebp + 0xc], bl
jne 0x100ae4c
xor esi, esi
inc esi
jmp 0x100af42
push dword [ebp - 0x224]
or dword [ebp - 0x240], 0xffffffff
call fcn.0100dd74
pop ecx
lea eax, [ebp - 0x228]
push eax
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x228], ebx
call fcn.0100ab10
test eax, eax
jl 0x100aece
cmp dword [ebp - 0x228], ebx
je 0x100aece
lea ecx, [ebp - 0x24c]
call fcn.0101d78d
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.010097c0
push ebx
mov esi, eax
push esi
push 0x38a
push 0x10016c4
call fcn.0101c3d2
lea ecx, [ebp - 0x24c]
call fcn.0101d80c
mov ecx, dword [ebp - 0x240]
jmp 0x100aed3
push 5
pop ecx
xor esi, esi
cmp esi, ebx
jl 0x100af34
cmp ecx, 0xc
jne 0x100aeef
cmp dword [ebp - 0x230], ebx
jne 0x100aeef
push dword [edi]
call fcn.01009797
test al, al
jne 0x100af34
cmp dword [ebp - 0x228], ebx
jne 0x100af02
push dword [edi]
call fcn.01009797
test al, al
jne 0x100af34
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x224]
push eax
push ebx
lea eax, [ebp - 0x244]
push eax
push edi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x220]
push eax
mov dword [edi], ecx
call fcn.0101c735
mov esi, eax
call dword [sym.imp.ole32.dll_CoFreeUnusedLibraries]
cmp esi, ebx
jl 0x100b022
cmp dword [ebp - 0x248], ebx
je 0x100af65
cmp dword [ebp - 0x224], ebx
je 0x100af65
push dword [ebp - 0x224]
push dword [ebp - 0x248]
call fcn.0101ac61
mov esi, eax
cmp esi, ebx
jl 0x100b022
mov eax, dword [ebp - 0x238]
cmp eax, ebx
je 0x100af7f
mov ecx, dword [ebp - 0x22c]
mov dword [eax], ecx
or dword [ebp - 0x23c], 0xffffffff
or dword [ebp - 0x238], 0xffffffff
lea eax, [ebp - 0x23c]
push eax
mov esi, 0x10018f4
push esi
lea ecx, [ebp - 0x220]
call fcn.0101ceaa
cmp eax, ebx
mov ecx, dword [ebp - 0x23c]
mov dword [0x10497d8], ecx
mov ecx, dword [ebp - 0x238]
mov dword [0x10497dc], ecx
jl 0x100afd3
cmp dword [edi], ebx
jne 0x100affe
push esi
lea ecx, [ebp - 0x220]
call fcn.0101cae8
jmp 0x100affa
cmp dword [edi], ebx
je 0x100affe
push 0x10497d8
call fcn.0100e0c1
pop ecx
push dword [0x10497dc]
lea ecx, [ebp - 0x220]
push dword [0x10497d8]
push esi
call fcn.0101d0ff
mov esi, eax
jmp 0x100b000
xor esi, esi
cmp esi, ebx
jl 0x100b022
lea ecx, [ebp - 0x220]
call fcn.0101c911
push ebx
mov esi, eax
push esi
push 0x3e0
push 0x10016c4
call fcn.0101c3d2
push dword [ebp - 0x224]
call fcn.0100dd74
pop ecx
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x224], ebx
call fcn.0101cf88
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100d61a
leave
ret 0x10