Function at 0x1153eb0
Capabilities:
Delete file
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push eax
call fcn.010ee3e0
test eax, eax
je 0x115426c
push ebx
push edi
push 1
push 0x100feb8
push esi
call fcn.01149520
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 0x130]
push 0x7d0
call edx
mov eax, dword [esi]
push 0
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0x1021770
push 0x1015b3c
push connect
push eax
call fcn.010bb210
mov ebx, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov edi, eax
test edi, edi
je 0x1153f29
push edi
call ebx
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [esi]
push eax
call fcn.010d3220
test eax, eax
jne 0x1153f9e
mov ecx, dword [esi]
push ecx
call fcn.011285b0
cmp dword [esi + 0xa1c], 0
je 0x1153f53
push 4
push 0x10235b0
push esi
call fcn.01151720
push 1
push esi
call fcn.01061fc0
cmp dword [esi + 0xa44], 0
je 0x1153f8c
mov edx, dword [esi]
push 0x10235a0
push 0x1015b3c
push connect
push edx
call fcn.010bb470
test eax, eax
je 0x1153f8c
push 0
push 0x1023584
push esi
call fcn.01151720
mov eax, dword [esi]
push 1
push 0
push eax
call fcn.010da9a0
push esi
call fcn.01129d40
mov ecx, dword [esi]
lea edx, [esi + 0x960]
mov dword [ecx + 0x13318], 1
mov eax, dword [esi]
push edx
push eax
call fcn.01054b90
mov edx, dword [esi]
lea ecx, [esi + 0x990]
push ecx
push edx
call fcn.01054b90
mov eax, dword [esi]
push 0x101eed8
add eax, 0x3c86
push 0x100c124
push eax
call fcn.01085230
mov edi, eax
test edi, edi
je 0x1153ff8
push edi
call ebx
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [esi]
push eax
call fcn.010f7170
cmp dword [esi + 0x954], 0
jne 0x1154097
push esi
call fcn.0109ab00
mov edx, dword [esi]
lea ecx, [esi + 0x9c0]
push ecx
push edx
call fcn.01054b90
mov eax, dword [esi]
push eax
call fcn.010467b0
mov edx, dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0
push 0
push 0
push 0
push 0x22e038
push edx
call fcn.01096ff0
mov ecx, dword [esi]
lea eax, [esi + 0x8a6]
push eax
push ecx
call fcn.010bc4a0
mov edi, 2
push 0
push 0x100d63c
push 0
push 0
push esi
call fcn.0110e210
mov edx, dword [esi]
cmp dword [edx + 0x8b88], 0
je 0x1154084
push 1
push 0x100d63c
push 0
push 0
push esi
call fcn.0110e210
sub edi, 1
jne 0x1154057
mov eax, dword [esi]
push eax
call fcn.010caa50
push esi
call fcn.01128660
push 1
push esi
call fcn.0111b3a0
mov ecx, dword [esi]
push ecx
call fcn.010d3220
test eax, eax
jne 0x11540fe
mov eax, dword [esi]
mov edx, dword [eax + 0x35b0]
cmp dword [edx + 0xe48], 0
je 0x11540de
push 1
push 0
push eax
call fcn.010da9a0
mov eax, dword [esi]
mov ecx, dword [eax + 0x35b0]
push esi
mov dword [ecx + 0xe48], 0
call fcn.0111c2b0
mov edi, dword [esi]
push 0x101417c
lea ebx, [edi + 0x3c86]
push ebx
push edi
call fcn.0109ee20
push 0x1014170
push ebx
push edi
call fcn.0109ee20
push esi
call fcn.010d6120
mov edx, dword [esi]
push edx
call fcn.01097b40
mov eax, dword [esi]
push 0x1019014
push 0x1018fb8
push connect
push eax
call fcn.010bbb60
mov ecx, dword [esi]
push 0
push 0
push 0
push 0x1015b3c
push connect
push ecx
call fcn.010bb690
mov edi, dword [esi]
lea edx, [edi + 0x20]
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x40
push edi
call fcn.010b96d0
mov ecx, dword [edi + 0x1f0]
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push 0
push reloc.WS2_32.dll_closesocket
mov dword [ebp + 8], 0
call ecx
test eax, eax
jne 0x115419c
mov edx, dword [ebp + 8]
push 1
push eax
push eax
push edx
push 0x1015b3c
push 0x10bbff0
push edi
call fcn.010bbc90
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 0x204]
push eax
call ecx
push 0x40
call fcn.0102b240
lea edx, [edi + eax*4 + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
cmp dword [esi + 0x954], 0
jne 0x115425b
cmp dword [ebp + 0xc], 0
je 0x115425b
mov ebx, dword [esi]
push 0
push 1
lea edi, [esi + 0x272]
push edi
push ebx
call fcn.01094f70
test eax, eax
jne 0x11541e3
push edi
push ebx
call fcn.0110e400
test edi, edi
jne 0x11541eb
xor eax, eax
jmp 0x1154200
cmp word [edi], 0
mov eax, edi
je 0x11541fc
add eax, 2
cmp word [eax], 0
jne 0x11541f3
sub eax, edi
sar eax, 1
push eax
push edi
call fcn.0102da20
mov edi, eax
test edi, edi
je 0x1154239
push 0x5c
push edi
call fcn.0102d8b0
test eax, eax
je 0x1154229
xor ecx, ecx
mov word [eax], cx
mov edx, dword [esi]
mov eax, dword [edx + 0x110]
push edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [esi]
mov ecx, dword [eax + 0x13360]
mov edx, dword [eax + 0x320]
push ecx
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x110]
lea ecx, [eax + 0x3c86]
push ecx
call edx
mov esi, dword [esi]
lea eax, [esi + 0x3c86]
push eax
push esi
call fcn.0104b820
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8