Function at 0x101c67b
Capabilities:
Persist via run registry key
Read .ini file

Disassembly:
mov eax, 0x108c674
call fcn.01027038
sub esp, 0x668
mov eax, dword [0x10a1e18]
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x660], ebx
mov dword [ebp - 0x65c], ebx
mov dword [ebp - 0x658], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x670], ebx
mov dword [ebp - 0x66c], ebx
mov dword [ebp - 0x668], ebx
lea eax, [ebp - 0x664]
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x5b8], 0x1f
call fcn.01033784
test eax, eax
jl 0x101c700
push ebx
lea eax, [ebp - 0x674]
push eax
push 0x9c7
call fcn.0101d528
test eax, eax
jl 0x101c700
mov dword [ebp - 0x5b8], 0x1e
lea eax, [ebp - 0x5b9]
push eax
push 0x10022d0
lea ecx, [ebp - 0x5cc]
call fcn.0101a5f5
lea eax, [ebp - 0x5cc]
push eax
mov byte [ebp - 4], 2
call fcn.010219e1
lea ecx, [ebp - 0x62c]
call fcn.01022f98
mov word [ebp - 0x5f0], bx
push ebx
push 0xf003f
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 4
call fcn.01022acf
test eax, eax
jl 0x101c7ed
push 0x1002330
lea ecx, [ebp - 0x62c]
call fcn.01023455
test eax, eax
jl 0x101c7ed
lea ecx, [ebp - 0x62c]
call fcn.01023695
test eax, eax
jl 0x101c7ed
mov eax, dword [ebp - 0x5c8]
cmp eax, ebx
jne 0x101c78d
mov eax, 0x1001eb0
push eax
lea ecx, [ebp - 0x5f0]
call fcn.0101b7e5
push ebx
push 0x10023b0
sub esp, 0x10
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x62c]
movsd dword es:[edi], dword [esi]
call fcn.01022ffa
test eax, eax
jl 0x101c7ed
push 0x1f
lea ecx, [ebp - 0x5f0]
call fcn.0105c42a
push ebx
push 0x10023d4
sub esp, 0x10
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x62c]
movsd dword es:[edi], dword [esi]
call fcn.01022ffa
test eax, eax
jl 0x101c7ed
and dword [ebp - 0x5b8], 0xfffffffd
lea eax, [ebp - 0x5f0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 2
call fcn.01022fc9
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0x5cc]
mov byte [ebp - 4], 1
call fcn.0101937d
lea ecx, [ebp - 0x62c]
call fcn.01022f98
push ebx
push esi
push ebx
push 0x1002a48
mov byte [ebp - 4], 5
call fcn.010334da
push ebx
push 0xf003f
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x62c]
call fcn.01022acf
test eax, eax
jl 0x101c872
push 0x10029d8
lea ecx, [ebp - 0x62c]
call fcn.01023455
test eax, eax
jl 0x101c872
push esi
lea ecx, [ebp - 0x62c]
call fcn.01023744
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 1
call fcn.01022fc9
mov dword [ebp - 0x5b4], ebx
push ebx
lea eax, [ebp - 0x5b4]
push eax
push 0x9ce
mov byte [ebp - 4], 6
call fcn.0101d341
test eax, eax
jl 0x101c8ee
mov dword [ebp - 0x5d0], ebx
lea eax, [ebp - 0x5d0]
push eax
push 0x10025e0
push esi
push ebx
push 0x10025d0
mov byte [ebp - 4], 7
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x101c8da
mov eax, dword [ebp - 0x5d0]
push dword [ebp - 0x5b4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x5d0]
cmp eax, ebx
mov byte [ebp - 4], 6
je 0x101c8ee
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x5b4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 8
call fcn.0102f5c6
xor edi, edi
inc edi
lea ecx, [ebp - 0x5b4]
xor ebx, ebx
mov esi, 0x1001eb0
mov dword [ebp - 4], edi
call fcn.01050064
mov ecx, dword [ebp - 0x670]
cmp ecx, ebx
mov byte [ebp - 4], 0xa
jne 0x101c92b
mov ecx, esi
mov eax, dword [ebp - 0x660]
cmp eax, ebx
jne 0x101c937
mov eax, esi
push ecx
push eax
lea ecx, [ebp - 0x5b4]
call fcn.0105006c
test eax, eax
jl 0x101c94f
and dword [ebp - 0x5b8], 0xfffffffb
lea ecx, [ebp - 0x5b4]
mov byte [ebp - 4], 1
call fcn.0101d806
lea ecx, [ebp - 0x62c]
call fcn.01022f98
push ebx
push 0xf003f
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 0xb
call fcn.01022acf
test eax, eax
jl 0x101cbe3
push 0x1002980
lea ecx, [ebp - 0x62c]
call fcn.01023455
test eax, eax
jl 0x101cbe3
push edi
lea ecx, [ebp - 0x62c]
call fcn.01023744
test eax, eax
jl 0x101cbe3
lea ecx, [ebp - 0x62c]
call fcn.01023695
test eax, eax
jl 0x101cbe3
lea eax, [ebp - 0x5b9]
push eax
push 0x1002940
lea ecx, [ebp - 0x5f0]
call fcn.0101a5f5
lea eax, [ebp - 0x5f0]
push eax
mov byte [ebp - 4], 0xc
call fcn.010219e1
mov dword [ebp - 0x5dc], ebx
mov dword [ebp - 0x5d8], ebx
mov dword [ebp - 0x5d4], ebx
mov word [ebp - 0x5cc], bx
mov eax, dword [ebp - 0x5ec]
cmp eax, ebx
mov byte [ebp - 4], 0xe
jne 0x101ca1a
mov eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push eax
push 0x1ff
lea eax, [ebp - 0x494]
push eax
push 0x1001eb0
mov edi, 0x1002924
push edi
push 0x1002914
call ebx
test eax, eax
jbe 0x101ca77
lea eax, [ebp - 0x494]
push eax
lea ecx, [ebp - 0x5cc]
call fcn.0101b7e5
push 0
push edi
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x5cc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x62c]
movsd dword es:[edi], dword [esi]
call fcn.01022ffa
mov esi, 0x1001eb0
mov eax, dword [ebp - 0x5ec]
test eax, eax
jne 0x101ca83
mov eax, esi
push eax
push 0x1ff
lea eax, [ebp - 0x494]
push eax
push 0x1001eb0
mov edi, 0x1002908
push edi
push 0x1002914
call ebx
test eax, eax
jbe 0x101cad5
lea eax, [ebp - 0x494]
push eax
lea ecx, [ebp - 0x5cc]
call fcn.0101b7e5
push 0
push edi
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x5cc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x62c]
movsd dword es:[edi], dword [esi]
call fcn.01022ffa
xor esi, esi
inc esi
mov edi, 0x10028fc
push esi
lea eax, [ebp - 0x94]
push 0x10028ec
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
mov eax, dword [ebp - 0x5ec]
add esp, 0xc
test eax, eax
jne 0x101cb02
mov eax, 0x1001eb0
push eax
push 0x1ff
lea eax, [ebp - 0x494]
push eax
push edi
lea eax, [ebp - 0x94]
push eax
push 0x10028c4
call ebx
lea eax, [ebp - 0x494]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x101cb69
cmp dword [ebp - 0x5d8], 0
je 0x101cb4b
push 0x10028b8
lea ecx, [ebp - 0x5e0]
call fcn.0101a383
lea eax, [ebp - 0x494]
push eax
lea ecx, [ebp - 0x5e0]
call fcn.0101a383
inc esi
jmp 0x101cadd
cmp dword [ebp - 0x5d8], 0
je 0x101cbae
mov eax, dword [ebp - 0x5dc]
test eax, eax
jne 0x101cb81
mov eax, 0x1001eb0
push eax
lea ecx, [ebp - 0x5cc]
call fcn.0101b7e5
push 0
push 0x10028ac
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x5cc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x62c]
movsd dword es:[edi], dword [esi]
call fcn.01022ffa
and dword [ebp - 0x5b8], 0xfffffff7
lea eax, [ebp - 0x5cc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 1
lea ecx, [ebp - 0x5e0]
call fcn.0101937d
push 1
lea ecx, [ebp - 0x5f0]
call fcn.0101937d
mov esi, 0x1001eb0
xor ebx, ebx
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 1
call fcn.01022fc9
call fcn.0101b4a7
mov dword [ebp - 0x5c8], ebx
mov dword [ebp - 0x5c4], ebx
mov dword [ebp - 0x5c0], ebx
lea eax, [ebp - 0x5b9]
push eax
lea ecx, [ebp - 0x5dc]
mov byte [ebp - 4], 0xf
call fcn.01029f2a
push 0x47
pop ecx
xor eax, eax
lea edi, [ebp - 0x5b0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5b0]
push eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x5b0], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x5dc]
push eax
push 0x1002030
call fcn.010337eb
test eax, eax
jl 0x101cc64
cmp dword [ebp - 0x5d4], ebx
jne 0x101cc76
lea ecx, [ebp - 0x5dc]
call fcn.0101a8d4
xor edi, edi
jmp 0x101ce79
mov ecx, dword [ebp - 0x5d8]
mov eax, dword [ecx]
cmp eax, ecx
mov ebx, eax
mov dword [ebp - 0x5b4], ebx
je 0x101cd9d
lea ecx, [ebp - 0x654]
call fcn.01033fcd
mov eax, dword [ebx + 0xc]
test eax, eax
mov byte [ebp - 4], 0x11
jne 0x101cca6
mov eax, esi
push eax
lea ecx, [ebp - 0x654]
call fcn.01034019
test eax, eax
jl 0x101cd5f
lea ecx, [ebp - 0x654]
call fcn.01034489
test eax, eax
jl 0x101cd5f
lea ecx, [ebp - 0x654]
call fcn.01033944
mov eax, dword [eax + 4]
test eax, eax
mov edi, esi
je 0x101cce3
mov edi, eax
cmp byte [ebp - 0x496], 1
jne 0x101cd12
test byte [ebp - 0x497], 2
je 0x101ccfc
push 0x1002458
jmp 0x101cd55
push 0x1002470
push edi
call fcn.01018b82
test eax, eax
je 0x101cd84
push 0x10024e4
jmp 0x101cd55
test byte [ebp - 0x498], 0x80
je 0x101cd31
push 0x10024c8
push edi
call fcn.01018b82
test eax, eax
je 0x101cd84
push 0x1002528
jmp 0x101cd55
test byte [ebp - 0x498], 2
je 0x101cd50
push 0x10024a4
push edi
call fcn.01018b82
test eax, eax
je 0x101cd84
push 0x1002504
jmp 0x101cd55
push 0x1002490
push edi
call fcn.01018b82
test eax, eax
je 0x101cd84
lea ecx, [ebp - 0x654]
mov byte [ebp - 4], 0x10
call fcn.0101a997
mov ebx, dword [ebx]
cmp ebx, dword [ebp - 0x5d8]
mov dword [ebp - 0x5b4], ebx
jne 0x101cc8e
jmp 0x101cd93
lea ecx, [ebp - 0x654]
mov byte [ebp - 4], 0x10
call fcn.0101a997
mov ecx, dword [ebp - 0x5d8]
cmp ebx, ecx
jne 0x101cdad
mov eax, dword [ecx]
mov dword [ebp - 0x5d0], eax
lea eax, [ebp - 0x5d0]
jmp 0x101cdb3
lea eax, [ebp - 0x5b4]
mov eax, dword [eax]
push 0xffffffffffffffff
xor edi, edi
add eax, 8
push edi
push eax
lea ecx, [ebp - 0x5cc]
call fcn.0101a55d
lea ecx, [ebp - 0x5dc]
mov byte [ebp - 4], 0xf
call fcn.0101a8d4
cmp dword [ebp - 0x5c4], edi
je 0x101ce79
lea ecx, [ebp - 0x654]
call fcn.01033fcd
mov eax, dword [ebp - 0x5c8]
cmp eax, edi
mov byte [ebp - 4], 0x12
jne 0x101cdff
mov eax, esi
push eax
lea ecx, [ebp - 0x654]
call fcn.01034019
test eax, eax
jl 0x101ce6e
lea ecx, [ebp - 0x654]
call fcn.01034489
test eax, eax
jl 0x101ce6e
mov dword [ebp - 0x5b4], edi
lea eax, [ebp - 0x5b4]
push eax
mov byte [ebp - 4], 0x13
call fcn.0101b973
test eax, eax
jl 0x101ce5a
mov ecx, dword [ebp - 0x5b4]
push edi
push 1
push 1
lea eax, [ebp - 0x654]
push eax
call fcn.0105fc69
test eax, eax
jl 0x101ce5a
and dword [ebp - 0x5b8], 0xffffffef
mov eax, dword [ebp - 0x5b4]
cmp eax, edi
mov byte [ebp - 4], 0x12
je 0x101ce6e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x654]
call fcn.0101a997
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x5cc]
call fcn.0101937d
mov dword [ebp - 0x5ec], edi
mov dword [ebp - 0x5e8], edi
mov dword [ebp - 0x5e4], edi
mov word [ebp - 0x5cc], di
cmp dword [ebp - 0x5b8], edi
mov byte [ebp - 4], 0x15
je 0x101cef3
push 0x10023f8
lea eax, [ebp - 0x5f0]
push eax
push dword [ebp - 0x5b8]
call fcn.01021c67
test eax, eax
jl 0x101cee2
mov eax, dword [ebp - 0x5ec]
cmp eax, edi
jne 0x101ced4
mov eax, esi
push eax
lea ecx, [ebp - 0x5cc]
lea esi, [edx + edi*8]
invalid
invalid
call fcn.0101b7e5
jmp 0x101cef3
push dword [ebp - 0x5b8]
lea ecx, [ebp - 0x5cc]
call fcn.0105c42a
push edi
push reloc.OLEAUT32.dll_SysReAllocString
push 0x1002890
push 0x1002848
lea eax, [ebp - 0x5cc]
push eax
call fcn.0102381c
lea eax, [ebp - 0x5cc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push ebx
lea ecx, [ebp - 0x5f0]
call fcn.0101937d
push ebx
lea ecx, [ebp - 0x674]
call fcn.0101937d
push ebx
lea ecx, [ebp - 0x664]
call fcn.0101937d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
xor eax, eax
call fcn.0101cfd1
pop edi
pop esi
pop ebx
leave
ret