Function at 0x1002633
Capabilities:
Persist via run registry key
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2d24
call fcn.01008280
mov eax, dword [0x1009020]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x2d0c], eax
mov eax, dword [ebp + 0x10]
push edi
push eax
push 0x1001538
mov dword [ebp - 0x2d08], ebx
mov dword [ebp - 0x2d10], eax
call fcn.01006cf9
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
pop ecx
pop ecx
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0xd3
push dword [0x1009264]
call esi
test byte [ebp + 0x19], 4
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jne 0x10026a5
lea eax, [ebp - 0x44]
push eax
push ebx
call edi
test eax, eax
jne 0x10026a9
or dword [ebp + 0x18], 8
push 0xa000
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebp - 0x2d24], eax
je 0x1002d9f
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0x20
mov dword [ebp - 0x2d18], eax
lea eax, [ebp - 0x44]
push eax
push 0xd7
push dword [0x1009264]
call esi
and word [ebp - 0x25c], 0
test byte [ebp + 0x19], 1
mov ebx, 0x208
jne 0x1002707
push dword [ebp - 0x2d10]
lea eax, [ebp - 0x44]
push eax
call edi
test eax, eax
jne 0x1002727
push ebx
lea eax, [ebp - 0x25c]
push eax
push 0x10013b8
push 0x10013f0
push 0x80000001
call fcn.01006926
and dword [ebp + 0x18], 0xfffffffe
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0xd8
push dword [0x1009264]
call esi
test byte [ebp + 0x19], 2
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
jne 0x100275c
push dword [ebp - 0x2d10]
call sub.SHELL32.dll_Ordinal_34
push eax
lea eax, [ebp - 0x44]
push eax
call edi
test eax, eax
jne 0x1002760
and dword [ebp + 0x18], 0xfffffffe
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0xdd
push dword [0x1009264]
call esi
push dword [ebp - 0x2d10]
lea eax, [ebp - 0x44]
push eax
call edi
test eax, eax
jne 0x100278f
mov eax, dword [ebp + 0x18]
and eax, 0xfffffffe
or eax, 0x20
mov dword [ebp + 0x18], eax
lea eax, [ebp - 0x2d14]
push eax
push 0x1002150
push 0x1002170
call fcn.010068b1
test eax, eax
jl 0x1002d93
mov eax, dword [ebp - 0x2d14]
mov ecx, dword [eax]
lea edx, [ebp - 0x2d1c]
push edx
push 0x100175c
push eax
call dword [ecx]
push dword [ebp - 0x2d0c]
mov esi, dword [ebp - 0x2d18]
push 0x5000
push esi
push dword [ebp - 0x2d08]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x2d20], eax
jle 0x1002d47
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x2d08], esi
call fcn.01006ac8
cmp word [ebp - 0x25c], di
jne 0x1002899
push dword [ebp - 0x2d10]
call sub.SHELL32.dll_Ordinal_57
cmp eax, 0xffffffff
jne 0x1002861
push dword [ebp - 0x2d10]
call sub.SHELL32.dll_Ordinal_39
test eax, eax
jne 0x1002861
push 1
push 2
lea eax, [ebp - 0x25c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_Ordinal_175]
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [ebp - 0x2d10]
mov edi, eax
lea eax, [ebp - 0x25c]
push eax
call sub.SHELL32.dll_Ordinal_36
jmp 0x100287b
push dword [ebp - 0x2d10]
lea eax, [ebp - 0x25c]
push 0x104
push eax
call fcn.0100252f
push 2
pop edi
push 1
push edi
lea eax, [ebp - 0x25c]
push eax
call fcn.010030ac
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHELL32.dll_PathQualify]
xor edi, edi
cmp dword [ebp + 0x14], edi
je 0x10028c2
test byte [ebp + 0x18], 0x20
jne 0x10028c2
lea eax, [ebp - 0x25c]
push eax
call sub.SHELL32.dll_Ordinal_45
test eax, eax
jne 0x10028c2
lea eax, [ebp - 0x25c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHELL32.dll_IsLFNDrive]
test eax, eax
je 0x10028d7
or dword [ebp + 0x18], 0x10
cmp word [esi], di
je 0x1002d47
mov esi, dword [sym.imp.SHELL32.dll_Ordinal_58]
mov edi, 0x30c
mov eax, dword [ebp - 0x2d08]
sub eax, dword [ebp - 0x2d18]
sar eax, 1
push eax
call fcn.01006771
and word [ebp - 0x464], 0
test byte [ebp + 0x18], 0x10
jne 0x100292d
push 0x104
lea eax, [ebp - 0x464]
push eax
push 7
push dword [ebp - 0x2d08]
call esi
cmp word [ebp - 0x464], 0
jne 0x1002943
push 0x104
lea eax, [ebp - 0x464]
push eax
push 1
push dword [ebp - 0x2d08]
call esi
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x2d0c], eax
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x25c]
push eax
call sub.SHELL32.dll_Ordinal_36
mov eax, dword [ebp - 0x2d0c]
push 0
inc eax
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.010030ac
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHELL32.dll_PathQualify]
push edi
lea eax, [ebp - 0x16ac]
push eax
push 2
push dword [ebp - 0x2d08]
call esi
test eax, eax
je 0x1002ca3
cmp word [ebp - 0x16ac], 0
je 0x1002ca3
lea eax, [ebp - 0x16ac]
push eax
push edi
lea eax, [ebp - 0x1094]
push eax
call fcn.0100252f
lea eax, [ebp - 0x16ac]
push eax
push edi
lea eax, [ebp - 0xa7c]
push eax
call fcn.0100252f
test byte [ebp + 0x18], 0x40
jne 0x10029f7
push dword [ebp - 0x2d20]
or dword [ebp + 0x18], 0x40
push dword [ebp - 0x2d10]
call fcn.01006ac8
cmp word [ebp - 0xa7c], 0x22
jne 0x1002a92
cmp word [ebp - 0xa7a], 0x3a
jne 0x1002ad8
cmp word [ebp - 0xa78], 0x3a
jne 0x1002ad8
lea eax, [ebp - 0xa7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
add eax, eax
push eax
lea eax, [ebp - 0xa7a]
push eax
lea eax, [ebp - 0xa7c]
push eax
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
lea eax, [ebp - 0xa7c]
push eax
call fcn.0100232c
cmp word [eax], 0
mov dword [ebp - 0x2d0c], eax
je 0x1002a88
push 0x1001534
push edi
lea eax, [ebp - 0x1094]
push eax
call fcn.0100252f
push dword [ebp - 0x2d0c]
lea eax, [ebp - 0x1094]
push edi
push eax
call fcn.010025d8
jmp 0x1002acc
and word [ebp - 0x1094], 0
jmp 0x1002ae0
cmp word [ebp - 0xa7c], 0x3a
jne 0x1002ad8
cmp word [ebp - 0xa7a], 0x3a
jne 0x1002ad8
lea eax, [ebp - 0xa7c]
push eax
call fcn.0100232c
cmp word [eax], 0
mov dword [ebp - 0x2d0c], eax
je 0x1002a88
push eax
push edi
lea eax, [ebp - 0x1094]
push eax
call fcn.0100252f
mov eax, dword [ebp - 0x2d0c]
and word [eax], 0
jmp 0x1002ae0
and word [ebp - 0xa7c], 0
cmp word [ebp - 0x1094], 0
je 0x1002b70
and word [ebp - 0x1abc], 0
lea eax, [ebp - 0x1094]
push eax
call sub.SHELL32.dll_Ordinal_52
cmp word [eax], 0
je 0x1002b1c
and word [eax - 2], 0
push ebx
push eax
lea eax, [ebp - 0x1abc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp - 0x2d14]
mov ecx, dword [eax]
lea edx, [ebp - 0x1abc]
push edx
push eax
call dword [ecx + 0x2c]
lea eax, [ebp - 0x1094]
push eax
call sub.SHELL32.dll_Ordinal_56
push 0
push 0
lea eax, [ebp - 0x1094]
push eax
call dword [sym.imp.SHELL32.dll_PathResolve]
cmp word [ebp - 0x1094], 0
je 0x1002b70
test byte [ebp + 0x18], 0x20
je 0x1002b7e
lea eax, [ebp - 0x1094]
push eax
push 3
call dword [sym.imp.SHELL32.dll_SHAddToRecentDocs]
jmp 0x1002d13
cmp word [ebp - 0xa7c], 0
je 0x1002d13
lea eax, [ebp - 0xa7c]
push eax
push edi
lea eax, [ebp - 0x16ac]
push eax
call fcn.0100252f
lea eax, [ebp - 0x1094]
push eax
push edi
lea eax, [ebp - 0x16ac]
push eax
call fcn.010025d8
mov eax, dword [ebp - 0x2d14]
mov ecx, dword [eax]
lea edx, [ebp - 0x16ac]
push edx
push eax
call dword [ecx + 0x50]
push ebx
lea eax, [ebp - 0x22dc]
push eax
push 3
push dword [ebp - 0x2d08]
call esi
push 8
lea eax, [ebp - 0x54]
push eax
push 4
push dword [ebp - 0x2d08]
call esi
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.COMCTL32.dll_Ordinal_365]
mov ecx, dword [ebp - 0x2d14]
mov edx, dword [ecx]
push eax
lea eax, [ebp - 0x22dc]
push eax
push ecx
call dword [edx + 0x44]
push 0x1001528
push 0x104
lea eax, [ebp - 0x25c]
push eax
call fcn.010025d8
push 0x10014fc
push ebx
lea eax, [ebp - 0x1ecc]
push eax
call fcn.0100252f
push ebx
lea eax, [ebp - 0x1ecc]
push eax
push 6
push dword [ebp - 0x2d08]
call esi
mov eax, dword [ebp - 0x2d14]
mov ecx, dword [eax]
lea edx, [ebp - 0x1ecc]
push edx
push eax
call dword [ecx + 0x24]
push edi
lea eax, [ebp - 0x2d04]
push eax
push 8
push dword [ebp - 0x2d08]
call esi
mov eax, dword [ebp - 0x2d14]
mov ecx, dword [eax]
lea edx, [ebp - 0x2d04]
push edx
push eax
call dword [ecx + 0x1c]
push 0xffffffffffffffff
lea eax, [ebp - 0x25c]
push eax
push ebx
lea eax, [ebp - 0x26ec]
push eax
call dword [sym.imp.SHELL32.dll_Ordinal_79]
cmp dword [ebp + 0x14], 0
je 0x1002c9d
mov eax, dword [ebp - 0x2d1c]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x26ec]
push edx
push eax
call dword [ecx + 0x18]
and dword [ebp + 0x18], 0xfffffffe
jmp 0x1002d13
cmp dword [ebp + 0x14], 0
je 0x1002d13
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x25c]
push 0x1001528
mov dword [ebp - 0x2d0c], eax
push 0x104
lea eax, [ebp - 0x25c]
push eax
call fcn.010025d8
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHELL32.dll_Win32DeleteFile]
mov eax, dword [ebp - 0x2d0c]
and word [eax], 0
push 0x10014f0
push 0x104
lea eax, [ebp - 0x25c]
push eax
call fcn.010025d8
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHELL32.dll_Win32DeleteFile]
lea eax, [ebp - 0x25c]
push eax
call sub.SHELL32.dll_Ordinal_35
push dword [ebp - 0x2d08]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x2d08]
lea eax, [ecx + eax*2 + 2]
cmp word [eax], 0
mov dword [ebp - 0x2d08], eax
jne 0x10028eb
xor edi, edi
cmp dword [ebp + 0x14], edi
je 0x1002d7b
test byte [ebp + 0x18], 1
je 0x1002d7b
cmp word [ebp - 0x25c], di
je 0x1002d7b
lea eax, [ebp - 0x25c]
push eax
call fcn.010022c7
test eax, eax
je 0x1002d7b
lea eax, [ebp - 0x25c]
push eax
call sub.SHELL32.dll_Ordinal_35
test eax, eax
jne 0x1002d5b
mov eax, dword [ebp - 0x2d1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2d14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x2d24]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x2d10]
push 0x10014c8
call fcn.01006cf9
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100815d
leave
ret 0x14