Function at 0x1002458a
Capabilities:
Create process on windows
Delete file
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
mov dword [ebp - 0x20], 0xa66fe7d8
mov dword [ebp - 0x50], 0
jmp 0x100245aa
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x100245c0
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xe4], 6
jmp 0x100245a3
mov dword [ebp - 0x20], 1
jmp 0x100245d0
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x10024700
mov dword [ebp - 0x24], 0xfffffffd
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xe4], 0
je 0x100245f3
jmp 0x10024700
mov dword [ebp - 0x24], 1
jmp 0x10024603
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x100246fb
mov dword [ebp - 0x2c], 0
jmp 0x1002461d
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x10024633
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x114], 0xfffffff8
jmp 0x10024616
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x114], 1
jmp 0x10024661
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x114]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x114], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x114], 0
jl 0x100246f6
mov dword [ebp - 0x38], 0xd2ab60e7
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe4], 3
mov dword [ebp - 0x38], 0xffffffe2
jmp 0x1002469a
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffe5
jl 0x100246f1
mov dword [ebp - 0x60], 0x84217059
mov dword [ebp - 0x60], 1
jmp 0x100246b7
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x100246d1
mov byte [ebp - 0x19], 0
movzx eax, byte [ebp - 0x19]
test eax, eax
je 0x100246cf
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x100246b0
mov byte [ebp - 0x15], 0
movzx eax, byte [ebp - 0x15]
test eax, eax
je 0x100246ef
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x10024693
jmp 0x10024646
jmp 0x100245fc
jmp 0x100245c9
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10024717
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x10024edd
mov dword [ebp - 0x40], 0
jmp 0x10024727
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1002473d
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xb8], 0xac204e2d
jmp 0x10024720
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb8], 0
jmp 0x1002476b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb8], 0x13
jle 0x100247d6
mov dword [ebp - 0x58], 0
jmp 0x1002478b
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x100247a1
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x170], 0x97f0a290
jmp 0x10024784
mov byte [ebp - 0x18], 0
movzx eax, byte [ebp - 0x18]
test eax, eax
je 0x100247b7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0xb8]
mov dword [ebp + ecx - 0x170], eax
jmp 0x10024750
mov byte [ebp - 0x1a], 0
movzx eax, byte [ebp - 0x1a]
test eax, eax
je 0x100247ea
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x28], 0x33a4
mov dword [ebp - 0x130], 0xffffffff
mov dword [ebp - 0x14c], 0xeda58528
mov dword [ebp - 0x120], 0x52aa0a5d
mov dword [ebp - 0x124], 0x7e813a3d
mov dword [ebp - 0x11c], 0x63782845
mov dword [ebp - 0x48], 0
jmp 0x1002483c
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x10024852
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x148], 0x2e65251c
jmp 0x10024835
cmp dword [ebp - 0x28], 0
je 0x1002493d
mov dword [ebp - 0x64], 0
jmp 0x1002486c
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x10024882
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x198], 0xffffffff
jmp 0x10024865
mov dword [ebp - 0x28], 7
jmp 0x10024892
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffff5
jge 0x1002493b
mov dword [ebp - 0x30], 0x8c9f3690
mov dword [ebp - 0x150], 3
mov dword [ebp - 0x12c], 0xfffffff6
mov dword [ebp - 0x164], 1
mov dword [ebp - 0x160], 1
mov dword [ebp - 0x15c], 1
mov dword [ebp - 0x158], 1
mov dword [ebp - 0x30], 0
jmp 0x100248ef
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x10024936
mov dword [ebp - 0x144], 0xfffffffe
mov dword [ebp - 0x140], 0xfffffffe
mov dword [ebp - 0x13c], 0xfffffffe
mov dword [ebp - 0x138], 0xfffffffe
mov dword [ebp - 0xc0], 0xf1fc
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
jmp 0x100248e8
jmp 0x1002488b
jmp 0x10024953
mov byte [ebp - 0x16], 0
movzx eax, byte [ebp - 0x16]
test eax, eax
je 0x10024953
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov dword [ebp - 0x34], 1
mov dword [ebp - 4], 0
jmp 0x1002496a
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x10024980
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x180], 0xffffffff
jmp 0x10024963
mov dword [ebp - 4], 0
jmp 0x10024990
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x100249a6
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x18c], 0
jmp 0x10024989
mov dword [ebp - 0x34], 0
jmp 0x100249b6
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffe2
jge 0x10024a89
mov dword [ebp - 0x44], 0x33843046
mov dword [ebp - 0x3c], 0
jmp 0x100249d7
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x100249ed
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x104], 0xffffffff
jmp 0x100249d0
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x104], 0
jmp 0x10024a1b
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x104]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x104], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x104], 3
jg 0x10024a46
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x104]
cmp dword [ebp + eax*4 - 0x180], 0
je 0x10024a44
jmp 0x10024a46
jmp 0x10024a00
mov dword [ebp - 0x44], 0xc
jmp 0x10024a56
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xc
jl 0x10024a84
mov byte [ebp - 0x17], 0
movzx eax, byte [ebp - 0x17]
test eax, eax
je 0x10024a82
push 0x5c7
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10024a4f
jmp 0x100249af
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x10], 0x7e2799ac
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x74], 0xfffffffe
mov dword [ebp - 8], 0
jmp 0x10024aba
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x10024acd
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x6c], 0x92657cf7
jmp 0x10024ab3
mov dword [ebp - 8], 0
jmp 0x10024add
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x10024af3
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x9c], 0xfff9
jmp 0x10024ad6
mov dword [ebp - 0x10], 0
jmp 0x10024b03
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 6
jl 0x10024ea8
mov dword [ebp - 0x14], 0xfd4914d2
mov dword [ebp - 0x54], 0xfff8
mov dword [ebp - 0xc], 0
jmp 0x10024b2b
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x10024b41
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1a8], 0x71fda660
jmp 0x10024b24
mov dword [ebp - 0xc], 0
jmp 0x10024b51
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x10024b67
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xf4], 0x8c4b0538
jmp 0x10024b4a
cmp dword [ebp - 0x14], 0
je 0x10024b72
jmp 0x10024ea8
cmp dword [ebp - 0x14], 0x9ac196a1
jne 0x10024d00
mov dword [ebp - 0x68], 0xcf04b064
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
je 0x10024ba3
mov dword [ebp - 0xcc], 1
jmp 0x10024baa
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xcc], eax
je 0x10024bbe
mov dword [ebp - 0x7c], 1
jmp 0x10024bc2
and dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x7c], eax
jg 0x10024bd6
mov dword [ebp - 0xa4], 1
jmp 0x10024bdd
and dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0xa4]
sub eax, dword [ebp - 0x68]
cmp dword [ebp - 0x14], eax
jl 0x10024bf7
mov dword [ebp - 0x84], 1
jmp 0x10024bfe
and dword [ebp - 0x84], 0
cmp dword [ebp - 0x84], 0xfffffffe
jbe 0x10024c13
mov dword [ebp - 0xc8], 1
jmp 0x10024c1a
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xc8], eax
jg 0x10024c31
mov dword [ebp - 0x8c], 1
jmp 0x10024c38
and dword [ebp - 0x8c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x8c], eax
je 0x10024c54
xor eax, eax
inc eax
je 0x10024c54
mov dword [ebp - 0xac], 1
jmp 0x10024c5b
and dword [ebp - 0xac], 0
cmp dword [ebp - 0xac], 0x5f9c7104
jg 0x10024c73
mov dword [ebp - 0xd4], 1
jmp 0x10024c7a
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x128], eax
mov eax, 0xde6eab3a
cmp eax, 0xd5ec7e01
jb 0x10024c9b
mov dword [ebp - 0x94], 1
jmp 0x10024ca2
and dword [ebp - 0x94], 0
mov eax, dword [ebp - 0x94]
add eax, 0xe4b9
cmp eax, 0xffff
ja 0x10024cc6
cmp dword [ebp - 0x90], 0
jne 0x10024cc6
and dword [ebp - 0xdc], 0
jmp 0x10024cd0
mov dword [ebp - 0xdc], 1
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x54], eax
jl 0x10024cea
mov dword [ebp - 0x70], 1
jmp 0x10024cee
and dword [ebp - 0x70], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x70]
mov dword [ebp + eax - 0x6c], ecx
jmp 0x10024ea3
mov dword [ebp - 0x4c], 0
jmp 0x10024d10
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x10024d26
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xec], 0xfffffff8
jmp 0x10024d09
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x118], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
inc eax
mov dword [ebp - 0x78], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x78]
mov dword [ebp + eax - 0x9c], ecx
mov eax, dword [ebp - 0x74]
add eax, dword [ebp - 0x78]
jne 0x10024d61
mov dword [ebp - 0x80], 1
jmp 0x10024d65
and dword [ebp - 0x80], 0
cmp dword [ebp - 0x80], 6
ja 0x10024d77
mov dword [ebp - 0x88], 1
jmp 0x10024d7e
and dword [ebp - 0x88], 0
push 2
pop eax
sub eax, dword [ebp - 0x88]
add eax, 0x7dbc1552
jne 0x10024da0
cmp dword [ebp - 0x90], 0
jne 0x10024da0
and dword [ebp - 0x98], 0
jmp 0x10024daa
mov dword [ebp - 0x98], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
cmp dword [ebp - 0x98], eax
jg 0x10024dcb
mov dword [ebp - 0xa0], 1
jmp 0x10024dd2
and dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0xa0]
test eax, eax
jne 0x10024df6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6c], 0
jne 0x10024df6
and dword [ebp - 0xa8], 0
jmp 0x10024e00
mov dword [ebp - 0xa8], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6c]
cmp dword [ebp - 0xa8], eax
jne 0x10024e1e
mov dword [ebp - 0xb0], 1
jmp 0x10024e25
and dword [ebp - 0xb0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
cmp dword [ebp - 0xb0], eax
jg 0x10024e46
mov dword [ebp - 0xbc], 1
jmp 0x10024e4d
and dword [ebp - 0xbc], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0xbc]
test eax, eax
jne 0x10024e7b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xec], 0
jne 0x10024e7b
and dword [ebp - 0xc4], 0
jmp 0x10024e85
mov dword [ebp - 0xc4], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc4]
mov dword [ebp + eax - 0xf4], ecx
cmp dword [ebp - 0x10], 0
je 0x10024ea3
jmp 0x10024afc
jmp 0x10024afc
mov eax, dword [ebp - 0x5c]
mov dword [eax], 9
jmp 0x10024ebe
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x5c]
cmp dword [eax], 0xffffffe6
jl 0x10024edd
mov dword [ebp - 0xd0], 0x66c93ee
cmp dword [ebp - 0xd0], 0
je 0x10024edb
jmp 0x10024edd
jmp 0x10024eb3
mov esp, ebp
pop ebp
ret