Function at 0x110b500
Capabilities:
Persist via appinit_dlls registry key
Persist via winlogon helper dll registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.010c5e90
push esi
call fcn.010c5e10
push esi
call fcn.010f3cb0
push 0x1017c14
push connect
push esi
call fcn.010c5f20
push 0x1017bf8
push connect
push esi
call fcn.010c5f20
push 0x1017bb0
push connect
push esi
call fcn.010c5f20
mov eax, dword [esi + 0x35a8]
xor ebx, ebx
test dword [eax + 0x138], 0x200
jne 0x110b942
mov ecx, dword [esi]
cmp dword [ecx + 0xa64], ebx
jne 0x110b942
push ebx
push 0x101e4c4
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e4b4
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e4a8
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e498
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e480
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e464
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e44c
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e430
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e41c
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e408
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e3f4
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e3ec
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e3e4
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e3dc
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e3d0
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e3bc
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e3a8
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e398
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e388
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e378
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e370
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e360
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e378
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e350
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e378
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e344
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e330
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e324
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e314
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e378
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e304
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e2ec
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e2dc
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e2cc
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e2bc
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e2b0
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e2a0
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101d554
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e2b0
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e288
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e2b0
push 0x101d5a0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e27c
push 0x101d4b0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e264
push 0x101d4b0
push 0x101d56c
push esi
call fcn.010f3c10
push ebx
push 0x101e254
push 0x101d4b0
push 0x101d56c
push esi
call fcn.010f3c10
push esi
call fcn.0110b3f0
push esi
call fcn.010c5d30
mov edi, 1
push edi
push 0x101e244
push 0x101e21c
push 0x1004f34
push esi
call fcn.010f3c10
push ebx
push 0x101e20c
push 0x101e1e4
push 0x101e1c8
push esi
call fcn.010f3c10
push ebx
push 0x101e1b8
push 0x101e1a0
push 0x101e1c8
push esi
call fcn.010f3c10
push ebx
push 0x101e180
push 0x101e17c
push 0x101e1c8
push esi
call fcn.010f3c10
push 3
push 0x101e174
push 0x101e16c
push 0x1004ea0
push esi
call fcn.010f3c10
push 0x1004b0c
push 0x1004b18
push 0x1004e64
push connect
push esi
call fcn.010f3b90
push 8
push 0x101e164
push edi
push 0x10023f2
push 0x101e14c
push connect
push esi
call fcn.010b9f00
push 8
push 0x101e144
push edi
push 0x10023f2
push 0x101e118
push connect
push esi
call fcn.010b9f00
push 0x101e0ec
push connect
push esi
call fcn.010ba750
push 4
push 0x101e0e8
push edi
push 0x101e0d0
push 0x101e0a4
push connect
push esi
call fcn.010b9f00
push 0xd
push 0x101e094
push edi
push 0x101e08c
push 0x101e054
push connect
push esi
call fcn.010b9f00
cmp dword [esi + 0x8aec], 0x2710
jae 0x110ba86
push 0x1c2
push 0x101de90
push edi
push 0x101de80
push 0x101de58
push connect
push esi
call fcn.010b9f00
push edi
push 0x10023f2
push edi
push 0x101de48
push 0x101de10
push connect
push esi
call fcn.010b9f00
push 0x2a
push 0x101dde4
push 7
push 0x101ddcc
push 0x101dd68
push connect
push esi
call fcn.010b9db0
push 0x20
push 0x101dd44
push 2
push 0x1004b70
push 0x101de58
push connect
push esi
call fcn.010b9f00
push 0x41
push 0x101dd00
push 2
push 0x1004b64
push 0x101de58
push connect
push esi
call fcn.010b9f00
push esi
call fcn.010c6190
push 0x101dcf0
push 0x101dcb8
push connect
push esi
call fcn.010bab70
push 0x101dc94
push 0x10158b0
push connect
push esi
call fcn.010baaf0
push 0x101dc7c
push 0x10158b0
push connect
push esi
call fcn.010baaf0
push 0x101dc58
push 0x10158b0
push connect
push esi
call fcn.010baaf0
push ebx
push ebx
push ebx
push 0x101dbe0
push connect
push esi
call fcn.010ba620
push 0x101dcf0
push 0x101dba0
push connect
push esi
call fcn.010bab70
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101db94
push 0x101dba0
push connect
push esi
mov dword [ebp + 8], ebx
call fcn.010b9f00
push 0x101db94
push 0x101dcb8
push connect
push esi
call fcn.010bab70
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0x101e174
push 0x101db6c
push connect
push esi
mov dword [ebp + 8], ebx
call fcn.010b9f00
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0x101db60
push 0x101db30
push connect
push esi
mov dword [ebp + 8], ebx
call fcn.010b9f00
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101e174
push 0x101db04
push connect
push esi
mov dword [ebp + 8], 2
call fcn.010b9f00
push 0x101daec
push 0x101dab0
push connect
push esi
call fcn.010bab70
push 0x101da94
push 0x101dab0
push connect
push esi
call fcn.010bab70
push 0x101da78
push 0x101dab0
push connect
push esi
call fcn.010bab70
push 0x101da60
push 0x101dab0
push connect
push esi
call fcn.010bab70
push 0x101da48
push 0x101dab0
push connect
push esi
call fcn.010bab70
push 0x101da2c
push 0x101dab0
push connect
push esi
call fcn.010bab70
push 0x101da10
push 0x101dab0
push connect
push esi
call fcn.010bab70
push 0x101d9f4
push 0x101dab0
push connect
push esi
call fcn.010bab70
push 0x101d9e8
push 0x101d9b8
push connect
push esi
call fcn.010bab70
push 0x101d998
push 0x101d9b8
push connect
push esi
call fcn.010bab70
mov dword [ebp + 8], 0xffffffff
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0x101d98c
push 0x101e054
push connect
push esi
call fcn.010b9f00
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push 0x101d974
push 0x101d938
push connect
push esi
mov dword [ebp + 8], edi
call fcn.010b9f00
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0x101d92c
push 0x101e054
push connect
push esi
mov dword [ebp + 8], ebx
call fcn.010b9f00
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0x101d920
push 0x101d8f4
push connect
push esi
mov dword [ebp + 8], edi
call fcn.010b9f00
push 0x101d8b4
push connect
push esi
call fcn.010ba750
push 0x3c
push 0x101d874
call fcn.0102bc40
mov edi, eax
cmp edi, ebx
je 0x110bdff
push ebx
push ebx
call fcn.0102bc40
push 0x25
push 0x101d84c
mov dword [ebp + 8], eax
call fcn.0102bc40
mov ecx, dword [ebp + 8]
push 0x4c
push eax
push 2
push ecx
push edi
push connect
push esi
mov dword [ebp - 4], eax
call fcn.010b9db0
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x110bdd3
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 4]
cmp eax, 0x101d84c
je 0x110bdf0
cmp eax, ebx
je 0x110bdf0
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 0x22
push 0x101d828
push 2
push 0x1004884
push 0x101d7d8
push connect
push esi
call fcn.010b9f00
push 0x1f
push 0x101d7b8
push 2
push 0x101d7ac
push 0x101d778
push connect
push esi
call fcn.010b9f00
push 0x2d
push 0x101d748
push 2
push 0x101d73c
push 0x101d710
push connect
push esi
call fcn.010b9f00
push ebx
push ebx
push ebx
push 0x101d6b8
push connect
push esi
call fcn.010ba620
push 0x1012c54
push 0x10171b8
push connect
push esi
call fcn.010baaf0
push 0x1004a04
push 0x1017a98
push connect
push esi
call fcn.010ba2f0
cmp eax, ebx
je 0x110bea9
push 0x1017a90
push eax
call fcn.0102c110
test eax, eax
jne 0x110bf28
cmp dword [esi + 0x8aec], 0x1fa4
jb 0x110bec4
push esi
call fcn.010c6130
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x8ae4], 6
jb 0x110bef0
push 0x101d680
push 0x1004a04
push 0x1017a98
push connect
push esi
call fcn.010ba070
push 0x5c
push 0x101d620
jmp 0x110bf11
push 0x101d610
push 0x1004a04
push 0x1017a98
push connect
push esi
call fcn.010ba070
push 0x44
push 0x101d5c8
push 7
push 0x1017b1c
push 0x1017ad0
push connect
push esi
call fcn.010b9db0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4