Function at 0x1019842
Capabilities:
Create thread
Get common file path
Initialize winsock library
Print debug messages
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3cc
mov eax, dword [0x101f128]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3c8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x1006210
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10198f8
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop edi
lea eax, [ebp - 0x3c0]
push eax
push 0x101f1e8
push ebx
push ebx
push 0x10061fc
push dword [ebp - 0x3c8]
mov dword [ebp - 0x3c0], edi
call esi
lea eax, [ebp - 0x3c0]
push eax
push 0x101f138
push ebx
push ebx
push 0x10061e0
push dword [ebp - 0x3c8]
mov dword [0x101f138], ebx
mov dword [ebp - 0x3c0], edi
call esi
mov eax, dword [0x101f138]
cmp eax, ebx
je 0x10198e2
imul eax, eax, 0x3e8
mov dword [0x101f138], eax
jmp 0x10198ec
mov dword [0x101f138], 0x1d4c0
push dword [ebp - 0x3c8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test byte [0x101f1e8], 0x20
je 0x10199b4
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x10061b8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
lea eax, [ebp - 0x20c]
push 0x800a
push eax
call sub.msvcrt.dll__wopen
add esp, 0xc
cmp eax, 0xffffffff
mov dword [0x101fba0], eax
je 0x1019955
push 0x10061a0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x10199b4
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1006184
mov byte [ebp - 0x3be], 0xff
mov byte [ebp - 0x3bd], 0xfe
call esi
push 0x180
lea eax, [ebp - 0x20c]
push 0x8102
push eax
call sub.msvcrt.dll__wopen
add esp, 0xc
cmp eax, 0xffffffff
mov dword [0x101fba0], eax
je 0x10199a7
push 2
lea ecx, [ebp - 0x3be]
push ecx
push eax
call sub.msvcrt.dll__write
add esp, 0xc
jmp 0x10199b4
push 0x100615c
call esi
mov dword [0x101fba0], ebx
call fcn.010197c5
push 0x1006140
mov dword [0x101fb74], eax
call fcn.01019d33
pop ecx
xor eax, eax
cmp dword [0x101fafc], ebx
mov ecx, 0x100
mov edi, 0x101fbc0
rep stosd dword es:[edi], eax
je 0x10199f2
push 0x1006100
call fcn.01019d81
pop ecx
push 0x57
pop eax
jmp 0x1019c7e
xor edi, edi
inc edi
push 0x101fb40
mov dword [0x101fafc], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, ebx
jne 0x1019a27
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push 0x1006088
jmp 0x1019c61
mov esi, dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x101fb0c], eax
lea eax, [ebp - 0x3bc]
push eax
push 0x202
call esi
test eax, eax
je 0x1019a66
lea eax, [ebp - 0x3bc]
push eax
push 2
call esi
mov esi, eax
cmp esi, ebx
je 0x1019a66
push 0x1006060
call fcn.01019d67
mov eax, esi
jmp 0x1019c7d
call fcn.01018d04
test eax, eax
jne 0x1019a82
lea eax, [ebp - 0x3cc]
push eax
push ebx
push ebx
push 0x101864c
jmp 0x1019c47
push 0x101fb80
mov byte [0x101ffc0], bl
call fcn.0101b005
test eax, eax
je 0x1019ae6
movzx eax, byte [0x101fb87]
push eax
movzx eax, byte [0x101fb86]
push eax
movzx eax, byte [0x101fb85]
push eax
movzx eax, byte [0x101fb84]
push eax
push 0x1005370
mov esi, 0x101ffc0
push esi
mov dword [0x101faec], edi
mov dword [0x101fae8], edi
call dword [sym.imp.USER32.dll_wsprintfA]
push esi
push 0x1006008
call fcn.01019d4d
add esp, 0x20
jmp 0x1019c2f
xor eax, eax
lea edi, [ebp - 0x22c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x3c0]
push eax
push ebx
mov dword [ebp - 0x3c0], ebx
mov word [ebp - 0x22c], 2
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x1019ba4
cmp dword [ebp - 0x3c0], ebx
je 0x1019ba4
push dword [ebp - 0x3c0]
call sub.msvcrt.dll_malloc
mov esi, eax
cmp esi, ebx
pop ecx
je 0x1019c2f
lea eax, [ebp - 0x3c0]
push eax
push esi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x1019ba4
mov ecx, esi
mov dword [ebp - 0x3c4], ecx
lea eax, [ecx + 0x1ac]
cmp eax, ebx
je 0x1019b79
push 8
mov edi, 0x1004400
lea esi, [eax + 4]
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1019b87
mov eax, dword [eax]
cmp eax, ebx
jne 0x1019b5c
mov ecx, dword [ebp - 0x3c4]
mov ecx, dword [ecx]
cmp ecx, ebx
mov dword [ebp - 0x3c4], ecx
jne 0x1019b52
jmp 0x1019ba4
lea esi, [eax + 4]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
push esi
push 0x1005458
mov dword [ebp - 0x228], eax
call fcn.01019d33
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x22c]
push eax
call fcn.0101ae29
cmp eax, ebx
mov dword [0x101fae8], eax
je 0x1019c2f
lea eax, [ebp - 0x3c4]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x1b39
push ebx
mov dword [ebp - 0x3c4], ebx
call fcn.0101a95a
test eax, eax
jne 0x1019c24
push dword [ebp - 0x3c4]
call fcn.0101acaf
movzx eax, byte [ebp - 0x215]
push eax
movzx eax, byte [ebp - 0x216]
push eax
movzx eax, byte [ebp - 0x217]
push eax
movzx eax, byte [ebp - 0x218]
push eax
push 0x1005370
mov esi, 0x101ffc0
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
push esi
push 0x1005fa8
jmp 0x1019ad9
push 0x1005f10
call fcn.01019d67
pop ecx
lea eax, [ebp - 0x3cc]
push eax
push ebx
push ebx
mov dword [0x101f13c], 0x101f140
push 0x1018961
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
jne 0x1019c6c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push 0x1005eb0
call fcn.01019d67
pop ecx
pop ecx
call esi
jmp 0x1019c7e
push 0x1005e60
mov dword [0x101fb00], eax
call fcn.01019d33
xor eax, eax
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101793c
leave
ret