Function at 0x1106ce0
Capabilities:
Persist via appinit_dlls registry key
Persist via winlogon helper dll registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.010c1ee0
push esi
call fcn.010c1e60
push esi
call fcn.010efc70
push 0x1017194
push connect
push esi
call fcn.010c1f90
push 0x1017178
push connect
push esi
call fcn.010c1f90
push 0x1017130
push connect
push esi
call fcn.010c1f90
mov eax, dword [esi + 0x3550]
xor ebx, ebx
test dword [eax + 0x138], 0x200
jne 0x1107122
mov ecx, dword [esi]
cmp dword [ecx + 0xa60], ebx
jne 0x1107122
push ebx
push 0x101d684
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d674
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d668
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d658
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d640
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d624
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d60c
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d5f0
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d5dc
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d5c8
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d5b4
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d5ac
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d5a4
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d59c
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d590
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d57c
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d568
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d558
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d548
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d538
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d530
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d520
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d538
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d510
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d538
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d504
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d4f0
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d4e4
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d4d4
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d538
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d4c4
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d4ac
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d49c
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d48c
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d47c
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d470
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d460
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101c718
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d470
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d448
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d470
push 0x101c764
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d43c
push 0x101c674
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d424
push 0x101c674
push 0x101c730
push esi
call fcn.010efbd0
push ebx
push 0x101d414
push 0x101c674
push 0x101c730
push esi
call fcn.010efbd0
push esi
call fcn.01106bd0
push esi
call fcn.010c1d80
mov edi, 1
push edi
push 0x101d404
push 0x101d3dc
push 0x1005ebc
push esi
call fcn.010efbd0
push ebx
push 0x101d3cc
push 0x101d3a4
push 0x101d388
push esi
call fcn.010efbd0
push ebx
push 0x101d378
push 0x101d360
push 0x101d388
push esi
call fcn.010efbd0
push ebx
push 0x101d340
push 0x101d33c
push 0x101d388
push esi
call fcn.010efbd0
push 3
push 0x101d334
push 0x101d32c
push 0x1005e28
push esi
call fcn.010efbd0
push 0x1005a94
push 0x1005aa0
push 0x1005dec
push connect
push esi
call fcn.010efb50
push 8
push 0x101d324
push edi
push 0x1002406
push 0x101d30c
push connect
push esi
call fcn.010b5420
push 8
push 0x101d304
push edi
push 0x1002406
push 0x101d2d8
push connect
push esi
call fcn.010b5420
push 0x101d2ac
push connect
push esi
call fcn.010b5cf0
push 4
push 0x101d2a8
push edi
push 0x101d290
push 0x101d264
push connect
push esi
call fcn.010b5420
push 0xd
push 0x101d254
push edi
push 0x101d24c
push 0x101d214
push connect
push esi
call fcn.010b5420
cmp dword [esi + 0x81a4], 0x2710
jae 0x1107266
push 0x1c2
push 0x101d050
push edi
push 0x101d040
push 0x101d018
push connect
push esi
call fcn.010b5420
push edi
push 0x1002406
push edi
push 0x101d008
push 0x101cfd0
push connect
push esi
call fcn.010b5420
push 0x2a
push 0x101cfa4
push 7
push 0x101cf8c
push 0x101cf28
push connect
push esi
call fcn.010b52d0
push 0x20
push 0x101cf04
push 2
push 0x1005af8
push 0x101d018
push connect
push esi
call fcn.010b5420
push 0x41
push 0x101cec0
push 2
push 0x1005aec
push 0x101d018
push connect
push esi
call fcn.010b5420
push esi
call fcn.010c2200
push 0x101ceb0
push 0x101ce78
push connect
push esi
call fcn.010b6110
push 0x101ce54
push 0x1014d48
push connect
push esi
call fcn.010b6090
push 0x101ce3c
push 0x1014d48
push connect
push esi
call fcn.010b6090
push 0x101ce18
push 0x1014d48
push connect
push esi
call fcn.010b6090
push ebx
push ebx
push ebx
push 0x101cda0
push connect
push esi
call fcn.010b5bc0
push 0x101ceb0
push 0x101cd60
push connect
push esi
call fcn.010b6110
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101cd54
push 0x101cd60
push connect
push esi
mov dword [ebp + 8], ebx
call fcn.010b5420
push 0x101cd54
push 0x101ce78
push connect
push esi
call fcn.010b6110
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0x101d334
push 0x101cd2c
push connect
push esi
mov dword [ebp + 8], ebx
call fcn.010b5420
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0x101cd20
push 0x101ccf0
push connect
push esi
mov dword [ebp + 8], ebx
call fcn.010b5420
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101d334
push 0x101ccc4
push connect
push esi
mov dword [ebp + 8], 2
call fcn.010b5420
push 0x101ccac
push 0x101cc70
push connect
push esi
call fcn.010b6110
push 0x101cc54
push 0x101cc70
push connect
push esi
call fcn.010b6110
push 0x101cc38
push 0x101cc70
push connect
push esi
call fcn.010b6110
push 0x101cc20
push 0x101cc70
push connect
push esi
call fcn.010b6110
push 0x101cc08
push 0x101cc70
push connect
push esi
call fcn.010b6110
push 0x101cbec
push 0x101cc70
push connect
push esi
call fcn.010b6110
push 0x101cbd0
push 0x101cc70
push connect
push esi
call fcn.010b6110
push 0x101cbb4
push 0x101cc70
push connect
push esi
call fcn.010b6110
push 0x101cba8
push 0x101cb78
push connect
push esi
call fcn.010b6110
push 0x101cb58
push 0x101cb78
push connect
push esi
call fcn.010b6110
mov dword [ebp + 8], 0xffffffff
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0x101cb4c
push 0x101d214
push connect
push esi
call fcn.010b5420
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0x101cb34
push 0x101caf8
push connect
push esi
mov dword [ebp + 8], edi
call fcn.010b5420
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101caec
push 0x101d214
push connect
push esi
mov dword [ebp + 8], ebx
call fcn.010b5420
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0x101cae0
push 0x101cab4
push connect
push esi
mov dword [ebp + 8], edi
call fcn.010b5420
push 0x101ca74
push connect
push esi
call fcn.010b5cf0
push 0x3c
push 0x101ca34
call fcn.0102ab00
mov edi, eax
cmp edi, ebx
je 0x11075df
push ebx
push ebx
call fcn.0102ab00
push 0x25
push 0x101ca0c
mov dword [ebp + 8], eax
call fcn.0102ab00
mov ecx, dword [ebp + 8]
push 0x4c
push eax
push 2
push ecx
push edi
push connect
push esi
mov dword [ebp - 4], eax
call fcn.010b52d0
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x11075b3
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 4]
cmp eax, 0x101ca0c
je 0x11075d0
cmp eax, ebx
je 0x11075d0
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 0x22
push 0x101c9e8
push 2
push 0x100580c
push 0x101c998
push connect
push esi
call fcn.010b5420
push 0x1f
push 0x101c978
push 2
push 0x101c96c
push 0x101c938
push connect
push esi
call fcn.010b5420
push 0x2d
push 0x101c908
push 2
push 0x101c8fc
push 0x101c8d0
push connect
push esi
call fcn.010b5420
push ebx
push ebx
push ebx
push 0x101c878
push connect
push esi
call fcn.010b5bc0
push 0x10120c4
push 0x1016738
push connect
push esi
call fcn.010b6090
push 0x100598c
push 0x1017018
push connect
push esi
call fcn.010b5890
cmp eax, ebx
je 0x1107689
push 0x1017010
push eax
call fcn.0102af60
test eax, eax
jne 0x1107708
cmp dword [esi + 0x81a4], 0x1fa4
jb 0x11076a4
push esi
call fcn.010c21a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x819c], 6
jb 0x11076d0
push 0x101c840
push 0x100598c
push 0x1017018
push connect
push esi
call fcn.010b5590
push 0x5c
push 0x101c7e0
jmp 0x11076f1
push 0x101c7d0
push 0x100598c
push 0x1017018
push connect
push esi
call fcn.010b5590
push 0x44
push 0x101c788
push 7
push 0x101709c
push 0x1017050
push connect
push esi
call fcn.010b52d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4