Function at 0x10570f8
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x11dc
call fcn.0105efd0
mov eax, dword [0x111121c]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov ebx, ecx
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
and dword [ebp - 0x11c0], 0
lea eax, [ebp - 0x11c0]
push eax
push 0
call fcn.01046876
test eax, eax
jne 0x105714a
mov ecx, dword [ebp - 0x11c0]
call fcn.01046b1d
mov eax, dword [ebp - 0x11c0]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor esi, esi
inc esi
push esi
call fcn.0104c703
push 0x1007ca4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10571c4
push 0x1007c64
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10571c4
lea ecx, [ebp - 0x11d4]
push ecx
mov dword [ebp - 0x11d4], 0x14
call eax
test eax, eax
jl 0x10571c4
cmp dword [ebp - 0x11cc], 0x46
jne 0x105719d
cmp dword [ebp - 0x11d0], 4
jne 0x10571a4
jmp 0x10571be
cmp dword [ebp - 0x11d0], 4
ja 0x10571b8
cmp dword [ebp - 0x11d0], 4
jne 0x10571c4
cmp dword [ebp - 0x11cc], 0x46
jbe 0x10571c4
mov dword [0x111352c], esi
mov dword [0x1113530], esi
mov eax, dword [0x1113518]
cmp al, 0xd
je 0x10571d1
cmp al, 1
jne 0x10571dc
mov dword [0x1113538], esi
call fcn.010cc393
push 0x45
pop ecx
mov esi, 0x1112e28
lea edi, [ebp - 0x11bc]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
inc edi
cmp dword [ebp - 0x11ac], edi
jne 0x1057233
push 0xd
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
je 0x10572a8
lea ecx, [ebp - 0x10a8]
push ecx
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x10572a8
cmp byte [ebp - 0x1091], 0xb2
je 0x10572a2
cmp byte [ebp - 0x1091], 0xb1
jne 0x10572a8
jmp 0x10572a2
cmp dword [ebp - 0x11ac], 2
jne 0x10572a8
cmp dword [ebp - 0x11b8], 4
jne 0x105727b
lea eax, [ebp - 0x11c0]
push eax
push 0x20019
push 0
push 0x1008870
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10572a8
push dword [ebp - 0x11c0]
mov dword [0x1113534], edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10572a8
cmp dword [ebp - 0x11b8], 5
jb 0x10572a8
mov esi, dword [sym.imp.KERNEL32.dll_IsValidLocale]
push edi
push 0x401
call esi
test eax, eax
jne 0x10572a2
push edi
push 0x40d
call esi
test eax, eax
je 0x10572a8
mov dword [0x1113534], edi
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0x10572cb
push 0xc
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
mov dword [ebx + 0x68], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, ebx
call fcn.01056f41
mov esi, eax
test esi, esi
jl 0x10574cf
mov ecx, ebx
call fcn.01069f2a
mov esi, eax
test esi, esi
jl 0x10574cf
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
lea edx, [ebx + 0x38]
push edx
push eax
call dword [ecx + 0x38]
mov esi, eax
test esi, esi
jl 0x10574cf
push 0x80000302
push 0x10075e8
lea ecx, [ebx + 0x40]
call fcn.01063ebe
mov ecx, accept
test ecx, eax
mov dword [0x1113524], eax
mov esi, 0x200
jne 0x1057337
test ah, 1
je 0x1057330
or eax, esi
or eax, ecx
mov dword [0x1113524], eax
push 0xf003f
push edi
mov edi, reloc.WSOCK32.dll_accept
push edi
push 0x1007388
lea ecx, [ebp - 0x11dc]
call fcn.01064063
push 0x10075ac
lea ecx, [ebp - 0x11dc]
call fcn.010640b9
xor eax, eax
cmp dword [ebp - 0x11d8], eax
sete al
test dword [0x1113524], esi
je 0x1057399
test eax, eax
jne 0x10573a3
call fcn.01066342
test eax, eax
jne 0x10573a3
push dword [0x1113524]
lea eax, [ebp - 0x11dc]
push eax
mov ecx, ebx
call fcn.0104a051
jmp 0x10573a3
test eax, eax
je 0x10573a3
or dword [0x1113524], esi
lea ecx, [ebp - 0x11dc]
call fcn.0106409d
call fcn.010a272e
mov esi, eax
test esi, esi
jl 0x10574cf
call fcn.010768b6
mov esi, eax
test esi, esi
jl 0x10574cf
call fcn.010b1e61
mov esi, eax
test esi, esi
jl 0x10574cf
push 0x24
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x10573f2
push 0
mov ecx, eax
call fcn.010b1eae
jmp 0x10573f4
xor eax, eax
test eax, eax
mov dword [ebx + 0xac], eax
je 0x1057409
mov ecx, eax
call fcn.010b1cba
mov esi, eax
jmp 0x105740e
mov esi, 0x8007000e
test esi, esi
jl 0x10574cf
push 0xf003f
push 1
push edi
push 0x10073e8
lea ecx, [ebx + 0x74]
call fcn.01063c2f
mov esi, dword [ebx + 0x78]
neg esi
sbb esi, esi
and esi, 0x80004005
jl 0x10574cf
mov ecx, dword [0x1112f40]
push 0x824
lea eax, [ebp - 0x104c]
push eax
call fcn.0103f3e2
push dword [0x1112f5c]
mov ecx, ebx
call fcn.0104a17d
mov esi, eax
test esi, esi
jl 0x10574cf
push 0x64
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x1057481
lea ecx, [ebx + 0x1c]
push ecx
mov ecx, eax
call fcn.01084cba
jmp 0x1057483
xor eax, eax
test eax, eax
mov dword [ebx + 0x28], eax
je 0x10574a4
mov ecx, eax
call fcn.01085047
test eax, eax
jge 0x10574a9
mov eax, dword [ebx + 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebx + 0x28], 0
jmp 0x10574a9
mov esi, 0x8007000e
test esi, esi
jl 0x10574cf
push 0
call fcn.010c2a93
test eax, eax
mov dword [ebx + 0x5e4], eax
je 0x10574ca
mov edx, dword [eax]
push ebx
mov ecx, eax
call dword [edx + 0xc]
mov esi, eax
jmp 0x10574cf
mov esi, 0x8007000e
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.0105ec09
leave
ret