Function at 0x100ef4f
Capabilities:
Copy file
Persist via run registry key

Disassembly:
mov eax, 0x1080540
call fcn.0105c800
sub esp, 0x848
and byte [ebp - 0x64c], 0
push ebx
push esi
mov dword [ebp - 0x14], ecx
mov esi, 0x81
push edi
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x64b]
and byte [ebp - 0xd], 0
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x10]
push 0x10a40b8
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.01008a50
mov ebx, 0x208
lea eax, [ebp - 0x64c]
push ebx
push eax
mov eax, dword [ebp - 0x14]
push dword [eax + 0x38]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x100f249
lea eax, [ebp - 0x64c]
push 0x5c
push eax
call fcn.0105cf50
and byte [ebp - 0x854], 0
mov edx, eax
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x853]
and byte [ebp - 0x444], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x443]
inc edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor edi, edi
lea eax, [ebp - 0x854]
push edi
push eax
push edi
push edi
push edx
mov dword [ebp - 0x18], edx
call fcn.0105d2c9
add esp, 0x1c
lea ecx, [ebp - 0x34]
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocStringLen
call fcn.01016e3e
lea eax, [ebp - 0x444]
push ebx
push eax
push str.Desktop
push 0x10a40b8
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], edi
call fcn.01016edf
test al, al
je 0x100f23d
lea eax, [ebp - 0x444]
push 0x10989d8
push eax
call fcn.0105d020
and byte [ebp - 0x23c], 0
pop ecx
pop ecx
xor eax, eax
mov ecx, esi
lea edi, [ebp - 0x23b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor bl, bl
xor edi, edi
xor esi, esi
inc esi
cmp esi, 1
jle 0x100f099
lea eax, [ebp - 0x854]
push esi
push eax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x23c]
push str._s_s__d_.exe
push eax
call fcn.0105c81f
add esp, 0x14
jmp 0x100f0b7
push dword [ebp - 0x18]
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x23c]
push 0x1098bdc
push eax
call fcn.0105c81f
add esp, 0x10
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.0105d920
pop ecx
test eax, eax
pop ecx
je 0x100f108
lea ecx, [ebp - 0x24]
call fcn.01016902
lea eax, [ebp - 0x23c]
push edi
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.01016be3
test eax, eax
jne 0x100f0fa
lea ecx, [ebp - 0x24]
call fcn.01016ae8
jmp 0x100f0fc
mov bl, 1
and byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.01016958
test bl, bl
je 0x100f06e
lea eax, [ebp - 0x23c]
push edi
push eax
lea eax, [ebp - 0x64c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
setne al
test al, al
je 0x100f1ea
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x23c]
push eax
call fcn.01008a50
cmp byte [ebp + 8], 0
mov byte [ebp - 0xd], 1
jne 0x100f23d
mov eax, dword [0x1098824]
mov dword [ebp + 8], eax
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 8]
push eax
push 3
mov byte [ebp - 4], 3
call fcn.0100df38
test al, al
je 0x100f1dd
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 0x10]
push eax
push 4
call fcn.0100df38
test al, al
je 0x100f1dd
mov esi, 0x10987d0
mov eax, esi
test eax, eax
je 0x100f196
push esi
call fcn.0105c0e0
pop ecx
jmp 0x100f198
xor eax, eax
push esi
push eax
lea ecx, [ebp + 8]
call fcn.01008a89
lea eax, [ebp - 0x23c]
test eax, eax
je 0x100f1bb
lea eax, [ebp - 0x23c]
push eax
call fcn.0105c0e0
pop ecx
jmp 0x100f1bd
xor eax, eax
lea ecx, [ebp - 0x23c]
push ecx
push eax
lea ecx, [ebp + 8]
call fcn.01008a89
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp + 0x10]
call fcn.01001190
lea ecx, [ebp + 8]
jmp 0x100f238
mov eax, dword [0x1098824]
mov dword [ebp + 0x10], eax
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 0x10]
push eax
push 5
mov byte [ebp - 4], 5
call fcn.0100df38
test al, al
je 0x100f22d
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 8]
push eax
push 4
call fcn.0100df38
test al, al
je 0x100f22d
push edi
push dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp + 8]
call fcn.01001190
lea ecx, [ebp + 0x10]
call fcn.01001190
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.01016e63
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc