Function at 0x563008
Capabilities:
Persist via run registry key

Disassembly:
push ebp
sub esp, 0xdd0
lea ebp, [esp - 4]
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0xdd0], eax
push 0x3c
mov eax, 0x5ed5cf
call fcn.0059ca57
mov dword [ebp - 0x34], ecx
xor edi, edi
lea ecx, [ebp + 0x40c]
mov dword [ebp - 4], edi
call fcn.00427139
lea ecx, [ebp + 0x844]
mov byte [ebp - 4], 1
call fcn.00427139
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.005756ee
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 3
call fcn.005756ee
push 1
lea ecx, [ebp + 0xc7c]
mov byte [ebp - 4], 4
call fcn.004b06db
mov byte [ebp - 4], 5
call fcn.00567d0d
push eax
lea ecx, [ebp - 0x30]
call fcn.00402440
lea eax, [ebp + 0x40c]
push eax
push 0x23
lea ecx, [ebp + 0x844]
mov byte [ebp - 4], 6
call fcn.00499062
cmp eax, edi
jne 0x563114
lea ecx, [ebp]
call fcn.004aafa5
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp]
mov byte [ebp - 4], 7
call fcn.004aafcd
push str.SOFTWAREMicrosoftWindowsCurrentVersionexplorerShell_Folders
lea ecx, [ebp]
call fcn.004ab3d4
cmp eax, edi
je 0x5630f8
push edi
push str.Common_AppData
lea ecx, [ebp]
call fcn.004ab5bd
mov esi, eax
cmp esi, edi
je 0x5630f8
push esi
lea ecx, [ebp + 0x40c]
call fcn.00498be1
push esi
call fcn.00564e3f
pop ecx
jmp 0x563108
push str.C:ProgramData
lea ecx, [ebp + 0x40c]
call fcn.00498be1
lea ecx, [ebp]
mov byte [ebp - 4], 6
call fcn.004ac1a5
lea eax, [ebp + 0x40c]
push eax
lea ecx, [ebp + 0x844]
call fcn.00498be1
push str.MicrosoftWLANSvcProfilesInterfaces
push edi
lea ecx, [ebp + 0x40c]
call fcn.00499340
push edi
mov esi, 0x5f7710
push esi
lea ecx, [ebp + 0x40c]
call fcn.0049a237
cmp eax, edi
je 0x563166
push eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2c]
call fcn.00575c79
lea ecx, [ebp + 0x40c]
call fcn.0049980d
jmp 0x563149
push str.MicrosoftWLANSvcMigrationDataProfilesInterfaces
push edi
lea ecx, [ebp + 0x844]
call fcn.00499340
push edi
push esi
lea ecx, [ebp + 0x844]
call fcn.0049a237
cmp eax, edi
je 0x5631a1
push eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2c]
call fcn.00575c79
lea ecx, [ebp + 0x844]
call fcn.0049980d
jmp 0x563184
mov dword [ebp - 0x14], edi
mov ebx, 0x66eab8
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x24]
jge 0x56333c
push eax
lea ecx, [ebp - 0x2c]
call fcn.004026b0
push dword [eax]
lea eax, [ebp + 0x40c]
push eax
lea ecx, [ebp + 0x844]
call fcn.00499340
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x48]
call fcn.005757d6
push edi
push str..xml
lea ecx, [ebp + 0x844]
call fcn.0049a36d
cmp eax, edi
je 0x56320b
push eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0x48]
call fcn.00575c79
lea ecx, [ebp + 0x844]
call fcn.0049984c
jmp 0x5631ee
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x40]
jge 0x563334
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2c]
call fcn.004026b0
push dword [eax]
lea eax, [ebp + 0x40c]
push eax
lea ecx, [ebp + 0x844]
call fcn.00499340
push dword [ebp - 0x18]
lea ecx, [ebp - 0x48]
call fcn.004026b0
push dword [eax]
lea ecx, [ebp + 0x844]
push edi
call fcn.00499340
push 0x5f6264
lea eax, [ebp + 0x844]
push eax
lea ecx, [ebp + 0xc7c]
call fcn.004b0baa
cmp eax, edi
jne 0x56328d
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2c]
call fcn.004026b0
push dword [eax]
push str.Cant_open__s
push ebx
call fcn.0047f1a3
add esp, 0xc
jmp 0x56332c
lea ecx, [ebp + 0xc7c]
call fcn.004b0903
mov edi, eax
lea eax, [edi + 1]
push eax
call fcn.00564e4a
mov esi, eax
pop ecx
test esi, esi
jne 0x5632b8
push str.Out_of_memory
push ebx
call fcn.0047f1a3
pop ecx
jmp 0x563329
push edi
push esi
lea ecx, [ebp + 0xc7c]
call fcn.004b082a
cmp eax, edi
je 0x5632ed
push esi
call fcn.00564e3f
pop ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2c]
call fcn.004026b0
push dword [eax]
push str.Cant_read__s
push ebx
call fcn.0047f1a3
add esp, 0xc
jmp 0x56332a
lea ecx, [ebp + 0xc7c]
mov byte [edi + esi], 0
call fcn.004b0acc
mov ecx, dword [ebp - 0x34]
push esi
call fcn.00562c82
push esi
test eax, eax
jne 0x563324
call fcn.00564e3f
pop ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2c]
call fcn.004026b0
push dword [eax]
push str.The__s_profile_was_not_parsed
jmp 0x5632e2
call fcn.00564e3f
pop ecx
xor edi, edi
inc dword [ebp - 0x18]
jmp 0x56320e
inc dword [ebp - 0x14]
jmp 0x5631a9
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.00402490
lea ecx, [ebp + 0xc7c]
mov byte [ebp - 4], 4
call fcn.004b0b8e
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 3
call fcn.00575a31
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00575a31
lea ecx, [ebp + 0x844]
mov byte [ebp - 4], 1
call fcn.0042719c
lea ecx, [ebp + 0x40c]
mov byte [ebp - 4], 0
call fcn.0042719c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xdd0]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0xdd4
leave
ret