Function at 0x101c5f3
Capabilities:
Persist via run registry key
Read .ini file

Disassembly:
mov eax, 0x108c509
call fcn.01026ef8
sub esp, 0x668
mov eax, dword [0x10a1e18]
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x660], ebx
mov dword [ebp - 0x65c], ebx
mov dword [ebp - 0x658], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x670], ebx
mov dword [ebp - 0x66c], ebx
mov dword [ebp - 0x668], ebx
push ebx
lea eax, [ebp - 0x664]
push eax
push 0x9c6
mov byte [ebp - 4], 1
mov dword [ebp - 0x5b8], 0x1f
call fcn.0101d495
test eax, eax
jl 0x101c67e
push ebx
lea eax, [ebp - 0x674]
push eax
push 0x9c7
call fcn.0101d495
test eax, eax
jl 0x101c67e
mov dword [ebp - 0x5b8], 0x1e
lea eax, [ebp - 0x5b9]
push eax
push 0x10022c8
lea ecx, [ebp - 0x5cc]
call fcn.0101a57c
lea eax, [ebp - 0x5cc]
push eax
mov byte [ebp - 4], 2
call fcn.010218ef
lea ecx, [ebp - 0x62c]
call fcn.01022ea6
mov word [ebp - 0x5f0], bx
push ebx
push 0xf003f
push 0x80000002
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 4
call fcn.010229dd
test eax, eax
jl 0x101c76b
push 0x1002328
lea ecx, [ebp - 0x62c]
call fcn.01023363
test eax, eax
jl 0x101c76b
lea ecx, [ebp - 0x62c]
call fcn.010235a3
test eax, eax
jl 0x101c76b
mov eax, dword [ebp - 0x5c8]
cmp eax, ebx
jne 0x101c70b
mov eax, 0x1001ea8
push eax
lea ecx, [ebp - 0x5f0]
call fcn.0101b784
push ebx
push 0x10023a8
sub esp, 0x10
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x62c]
movsd dword es:[edi], dword [esi]
call fcn.01022f08
test eax, eax
jl 0x101c76b
push 0x1f
lea ecx, [ebp - 0x5f0]
call fcn.0105c5a0
push ebx
push 0x10023cc
sub esp, 0x10
mov esi, eax
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x62c]
movsd dword es:[edi], dword [esi]
call fcn.01022f08
test eax, eax
jl 0x101c76b
and dword [ebp - 0x5b8], 0xfffffffd
lea eax, [ebp - 0x5f0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 2
call fcn.01022ed7
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0x5cc]
mov byte [ebp - 4], 1
call fcn.0101930d
lea ecx, [ebp - 0x62c]
call fcn.01022ea6
push ebx
push esi
push ebx
push 0x1002a40
mov byte [ebp - 4], 5
call fcn.010332fd
push ebx
push 0xf003f
push 0x80000002
lea ecx, [ebp - 0x62c]
call fcn.010229dd
test eax, eax
jl 0x101c7f0
push 0x10029d0
lea ecx, [ebp - 0x62c]
call fcn.01023363
test eax, eax
jl 0x101c7f0
push esi
lea ecx, [ebp - 0x62c]
call fcn.01023652
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 1
call fcn.01022ed7
mov dword [ebp - 0x5b4], ebx
push ebx
lea eax, [ebp - 0x5b4]
push eax
push 0x9ce
mov byte [ebp - 4], 6
call fcn.0101d2ae
test eax, eax
jl 0x101c86c
mov dword [ebp - 0x5d0], ebx
lea eax, [ebp - 0x5d0]
push eax
push 0x10025d8
push esi
push ebx
push 0x10025c8
mov byte [ebp - 4], 7
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x101c858
mov eax, dword [ebp - 0x5d0]
push dword [ebp - 0x5b4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x5d0]
cmp eax, ebx
mov byte [ebp - 4], 6
je 0x101c86c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x5b4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 8
call fcn.0102f3ac
xor edi, edi
inc edi
lea ecx, [ebp - 0x5b4]
xor ebx, ebx
mov esi, 0x1001ea8
mov dword [ebp - 4], edi
call fcn.0104ffe2
mov ecx, dword [ebp - 0x670]
cmp ecx, ebx
mov byte [ebp - 4], 0xa
jne 0x101c8a9
mov ecx, esi
mov eax, dword [ebp - 0x660]
cmp eax, ebx
jne 0x101c8b5
mov eax, esi
push ecx
push eax
lea ecx, [ebp - 0x5b4]
call fcn.0104ffea
test eax, eax
jl 0x101c8cd
and dword [ebp - 0x5b8], 0xfffffffb
lea ecx, [ebp - 0x5b4]
mov byte [ebp - 4], 1
call fcn.010501e9
lea ecx, [ebp - 0x62c]
call fcn.01022ea6
push ebx
push 0xf003f
push 0x80000002
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 0xb
call fcn.010229dd
test eax, eax
jl 0x101cb61
push 0x1002978
lea ecx, [ebp - 0x62c]
call fcn.01023363
test eax, eax
jl 0x101cb61
push edi
lea ecx, [ebp - 0x62c]
call fcn.01023652
test eax, eax
jl 0x101cb61
lea ecx, [ebp - 0x62c]
call fcn.010235a3
test eax, eax
jl 0x101cb61
lea eax, [ebp - 0x5b9]
push eax
push 0x1002938
lea ecx, [ebp - 0x5f0]
call fcn.0101a57c
lea eax, [ebp - 0x5f0]
push eax
mov byte [ebp - 4], 0xc
call fcn.010218ef
mov dword [ebp - 0x5dc], ebx
mov dword [ebp - 0x5d8], ebx
mov dword [ebp - 0x5d4], ebx
mov word [ebp - 0x5cc], bx
mov eax, dword [ebp - 0x5ec]
cmp eax, ebx
mov byte [ebp - 4], 0xe
jne 0x101c998
mov eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push eax
push 0x1ff
lea eax, [ebp - 0x494]
push eax
push 0x1001ea8
mov edi, 0x100291c
push edi
push 0x100290c
call ebx
test eax, eax
jbe 0x101c9f5
lea eax, [ebp - 0x494]
push eax
lea ecx, [ebp - 0x5cc]
call fcn.0101b784
push 0
push edi
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x5cc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x62c]
movsd dword es:[edi], dword [esi]
call fcn.01022f08
mov esi, 0x1001ea8
mov eax, dword [ebp - 0x5ec]
test eax, eax
jne 0x101ca01
mov eax, esi
push eax
push 0x1ff
lea eax, [ebp - 0x494]
push eax
push 0x1001ea8
mov edi, 0x1002900
push edi
push 0x100290c
call ebx
test eax, eax
jbe 0x101ca53
lea eax, [ebp - 0x494]
push eax
lea ecx, [ebp - 0x5cc]
call fcn.0101b784
push 0
push edi
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x5cc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x62c]
movsd dword es:[edi], dword [esi]
call fcn.01022f08
xor esi, esi
inc esi
mov edi, 0x10028f4
push esi
lea eax, [ebp - 0x94]
push 0x10028e4
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
mov eax, dword [ebp - 0x5ec]
add esp, 0xc
test eax, eax
jne 0x101ca80
mov eax, 0x1001ea8
push eax
push 0x1ff
lea eax, [ebp - 0x494]
push eax
push edi
lea eax, [ebp - 0x94]
push eax
push 0x10028bc
call ebx
lea eax, [ebp - 0x494]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x101cae7
cmp dword [ebp - 0x5d8], 0
je 0x101cac9
push 0x10028b0
lea ecx, [ebp - 0x5e0]
call fcn.0101a325
lea eax, [ebp - 0x494]
push eax
lea ecx, [ebp - 0x5e0]
call fcn.0101a325
inc esi
jmp 0x101ca5b
cmp dword [ebp - 0x5d8], 0
je 0x101cb2c
mov eax, dword [ebp - 0x5dc]
test eax, eax
jne 0x101caff
mov eax, 0x1001ea8
push eax
lea ecx, [ebp - 0x5cc]
call fcn.0101b784
push 0
push 0x10028a4
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x5cc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x62c]
movsd dword es:[edi], dword [esi]
call fcn.01022f08
and dword [ebp - 0x5b8], 0xfffffff7
lea eax, [ebp - 0x5cc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 1
lea ecx, [ebp - 0x5e0]
call fcn.0101930d
push 1
lea ecx, [ebp - 0x5f0]
call fcn.0101930d
mov esi, 0x1001ea8
xor ebx, ebx
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 1
call fcn.01022ed7
call fcn.0101b434
mov dword [ebp - 0x5c8], ebx
mov dword [ebp - 0x5c4], ebx
mov dword [ebp - 0x5c0], ebx
lea eax, [ebp - 0x5b9]
push eax
lea ecx, [ebp - 0x5dc]
mov byte [ebp - 4], 0xf
call fcn.01019776
push 0x47
pop ecx
xor eax, eax
lea edi, [ebp - 0x5b0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5b0]
push eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x5b0], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x5dc]
push eax
push 0x1002028
call fcn.010335d3
test eax, eax
jl 0x101cbe2
cmp dword [ebp - 0x5d4], ebx
jne 0x101cbf4
lea ecx, [ebp - 0x5dc]
call fcn.0101a85b
xor edi, edi
jmp 0x101cdf7
mov ecx, dword [ebp - 0x5d8]
mov eax, dword [ecx]
cmp eax, ecx
mov ebx, eax
mov dword [ebp - 0x5b4], ebx
je 0x101cd1b
lea ecx, [ebp - 0x654]
call fcn.01033db5
mov eax, dword [ebx + 0xc]
test eax, eax
mov byte [ebp - 4], 0x11
jne 0x101cc24
mov eax, esi
push eax
lea ecx, [ebp - 0x654]
call fcn.01033e01
test eax, eax
jl 0x101ccdd
lea ecx, [ebp - 0x654]
call fcn.01034271
test eax, eax
jl 0x101ccdd
lea ecx, [ebp - 0x654]
call fcn.0103372c
mov eax, dword [eax + 4]
test eax, eax
mov edi, esi
je 0x101cc61
mov edi, eax
cmp byte [ebp - 0x496], 1
jne 0x101cc90
test byte [ebp - 0x497], 2
je 0x101cc7a
push 0x1002450
jmp 0x101ccd3
push 0x1002468
push edi
call fcn.01018b12
test eax, eax
je 0x101cd02
push 0x10024dc
jmp 0x101ccd3
test byte [ebp - 0x498], 0x80
je 0x101ccaf
push 0x10024c0
push edi
call fcn.01018b12
test eax, eax
je 0x101cd02
push 0x1002520
jmp 0x101ccd3
test byte [ebp - 0x498], 2
je 0x101ccce
push 0x100249c
push edi
call fcn.01018b12
test eax, eax
je 0x101cd02
push 0x10024fc
jmp 0x101ccd3
push 0x1002488
push edi
call fcn.01018b12
test eax, eax
je 0x101cd02
lea ecx, [ebp - 0x654]
mov byte [ebp - 4], 0x10
call fcn.0101a91e
mov ebx, dword [ebx]
cmp ebx, dword [ebp - 0x5d8]
mov dword [ebp - 0x5b4], ebx
jne 0x101cc0c
jmp 0x101cd11
lea ecx, [ebp - 0x654]
mov byte [ebp - 4], 0x10
call fcn.0101a91e
mov ecx, dword [ebp - 0x5d8]
cmp ebx, ecx
jne 0x101cd2b
mov eax, dword [ecx]
mov dword [ebp - 0x5d0], eax
lea eax, [ebp - 0x5d0]
jmp 0x101cd31
lea eax, [ebp - 0x5b4]
mov eax, dword [eax]
push 0xffffffffffffffff
xor edi, edi
add eax, 8
push edi
push eax
lea ecx, [ebp - 0x5cc]
call fcn.0101a4e4
lea ecx, [ebp - 0x5dc]
mov byte [ebp - 4], 0xf
call fcn.0101a85b
cmp dword [ebp - 0x5c4], edi
je 0x101cdf7
lea ecx, [ebp - 0x654]
call fcn.01033db5
mov eax, dword [ebp - 0x5c8]
cmp eax, edi
mov byte [ebp - 4], 0x12
jne 0x101cd7d
mov eax, esi
push eax
lea ecx, [ebp - 0x654]
call fcn.01033e01
test eax, eax
jl 0x101cdec
lea ecx, [ebp - 0x654]
call fcn.01034271
test eax, eax
jl 0x101cdec
mov dword [ebp - 0x5b4], edi
lea eax, [ebp - 0x5b4]
push eax
mov byte [ebp - 4], 0x13
call fcn.0101b8e5
test eax, eax
jl 0x101cdd8
mov ecx, dword [ebp - 0x5b4]
push edi
push 1
push 1
lea eax, [ebp - 0x654]
push eax
call fcn.0105fdd3
test eax, eax
jl 0x101cdd8
and dword [ebp - 0x5b8], 0xffffffef
mov eax, dword [ebp - 0x5b4]
cmp eax, edi
mov byte [ebp - 4], 0x12
je 0x101cdec
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x654]
call fcn.0101a91e
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x5cc]
call fcn.0101930d
mov dword [ebp - 0x5ec], edi
mov dword [ebp - 0x5e8], edi
mov dword [ebp - 0x5e4], edi
mov word [ebp - 0x5cc], di
cmp dword [ebp - 0x5b8], edi
mov byte [ebp - 4], 0x15
je 0x101ce71
push 0x10023f0
lea eax, [ebp - 0x5f0]
push eax
push dword [ebp - 0x5b8]
call fcn.01021b75
test eax, eax
jl 0x101ce60
mov eax, dword [ebp - 0x5ec]
cmp eax, edi
jne 0x101ce52
mov eax, esi
push eax
lea ecx, [ebp - 0x5cc]
call fcn.0101b784
jmp 0x101ce71
push dword [ebp - 0x5b8]
lea ecx, [ebp - 0x5cc]
call fcn.0105c5a0
push edi
push 0x80000002
push 0x1002888
push 0x1002840
lea eax, [ebp - 0x5cc]
push eax
call fcn.0102372a
lea eax, [ebp - 0x5cc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push ebx
lea ecx, [ebp - 0x5f0]
call fcn.0101930d
push ebx
lea ecx, [ebp - 0x674]
call fcn.0101930d
push ebx
lea ecx, [ebp - 0x664]
call fcn.0101930d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
xor eax, eax
call fcn.0101cf4f
pop edi
pop esi
pop ebx
leave
ret