Function at 0x100023ba
Capabilities:
Check for time delay via gettickcount
Delete file
Initialize winsock library
Query or enumerate registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec8
xor eax, eax
push ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [0x1000b494], eax
mov eax, dword [ebp + 0x14]
mov dword [0x1000b498], eax
mov eax, dword [ebp + 0x10]
mov dword [0x1000b49c], eax
push esi
lea eax, [ebp - 0x538]
push edi
push eax
mov dword [ebp - 0x20], 0x7530
mov dword [ebp - 0x18], 1
call main
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x538]
push 0x10005414
push eax
call esi
test eax, eax
jne 0x10002488
mov ebx, 0x1000ac88
push ebx
call main
mov edi, 0x10007060
push edi
call main
push 0x10006458
call main
push 0x10006860
call main
push 0x1000b090
call main
push 0x1000a480
call main
push 0x10009c70
call main
push 0x10007460
call main
push 0x10006c60
call main
lea eax, [ebp - 0x538]
push eax
call main
jmp 0x10002576
lea eax, [ebp - 0x538]
push 0x10005408
push eax
call esi
test eax, eax
mov ebx, 0x1000ac88
jne 0x10002501
push ebx
call main
mov edi, 0x10007060
push edi
call main
push 0x10006458
call main
push 0x10006860
call main
push 0x1000b090
call main
push 0x1000a070
call main
push 0x10006c60
call main
push 0x1000a888
call main
lea eax, [ebp - 0x538]
push eax
call main
mov dword [ebp - 0x24], 1
jmp 0x1000257d
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x100053f8
push ebx
call esi
mov edi, 0x10007060
push 0x100053e8
push edi
call esi
push 0x100053d0
push 0x10006458
call esi
push 0x100053b8
push 0x10006860
call esi
push 0x100053a4
push 0x1000b090
call esi
push 0x1000538c
push 0x1000a480
call esi
push 0x10005374
push 0x10009c70
call esi
push 0x1000535c
push 0x10007460
call esi
push 0x10005338
push 0x10006c60
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov dword [ebp - 0x24], 2
lea eax, [ebp - 0x538]
push 0xa
push eax
lea eax, [ebp - 0xd38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0xd38]
push 0x1000532c
push eax
call esi
test eax, eax
jne 0x100025c1
lea eax, [ebp - 0x52f]
push eax
call fcn.100030e4
mov dword [ebp - 0x20], eax
pop ecx
lea eax, [ebp - 0x538]
push eax
call main
lea eax, [ebp - 0x538]
push 0x10005324
push eax
call esi
test eax, eax
jne 0x100025f3
and dword [ebp - 0x18], eax
push 0x10007860
mov dword [ebp - 0x1c], 1
call main
lea eax, [ebp - 0x538]
push eax
call main
lea eax, [ebp - 0x538]
push 0x10005318
push eax
call esi
test eax, eax
jne 0x10002614
and dword [ebp - 0x18], eax
lea eax, [ebp - 0x538]
push eax
call main
lea eax, [ebp - 0x938]
push eax
call main
xor eax, eax
push eax
push eax
push 2
push eax
push 1
lea eax, [ebp - 0x938]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x30], eax
jne 0x1000266a
lea eax, [ebp - 0x938]
push eax
lea eax, [ebp - 0xd38]
push 0x10005304
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea esi, [ebp - 0xd38]
jmp 0x10002d3f
mov esi, dword [ebp + 8]
test esi, esi
je 0x10002718
push 0x100052f4
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push 0x10002d66
push 0xfffffffffffffffc
push esi
mov dword [0x1000b08c], eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push esi
push 1
push dword [0x1000b08c]
mov dword [0x1000b088], eax
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp byte [ebp - 0x938], 0
lea eax, [ebp - 0x938]
je 0x100026d1
inc eax
cmp byte [eax], 0
jne 0x100026b7
jmp 0x100026d1
cmp eax, ecx
je 0x100026e1
push eax
lea eax, [ebp - 0x938]
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x5c
lea ecx, [ebp - 0x938]
jne 0x100026bf
cmp eax, ecx
je 0x100026e1
inc eax
push eax
lea eax, [ebp - 0xd38]
push ebx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0xd38]
push eax
push 0x3ee
push dword [0x1000a47c]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push edi
push dword [0x10007c64]
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea eax, [ebp - 0xec8]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
xor ebx, ebx
xor esi, esi
cmp dword [ebp - 0x18], ebx
mov edi, 0x10007c70
je 0x10002808
lea eax, [ebp - 0x28]
push eax
push 0x20019
push ebx
push 0x100052b8
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10002808
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 4
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0x14]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x100052ac
push dword [ebp - 0x28]
call ebx
test eax, eax
jne 0x100027f6
cmp dword [ebp + 0x14], 4
jne 0x100027f6
cmp dword [ebp + 0x10], eax
je 0x100027f6
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x2000
push eax
lea eax, [ebp + 0x14]
push edi
push eax
push esi
push 0x100052a0
push dword [ebp - 0x28]
call ebx
test eax, eax
jne 0x100027f6
cmp dword [ebp + 0x14], 1
jne 0x100027f6
push 0x10005298
push edi
call fcn.10001d2d
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x100027cc
mov esi, edi
jmp 0x100027cf
add esi, 5
push 0x10005294
push esi
call fcn.10001d2d
pop ecx
test eax, eax
pop ecx
je 0x100027e3
and byte [eax], 0
push 0x10005290
push esi
call fcn.10001d2d
pop ecx
test eax, eax
pop ecx
je 0x100027f6
xor esi, esi
push dword [ebp - 0x28]
and byte [0x10009c6f], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
cmp dword [ebp - 0x1c], 1
jne 0x10002813
mov esi, 0x10007860
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push 0x44
mov dword [ebp - 0x34], eax
call fcn.100022a8
cmp eax, ebx
pop ecx
je 0x10002849
cmp esi, ebx
je 0x10002833
cmp byte [esi], 0
jne 0x10002835
xor esi, esi
push esi
push 0x4000
push 0xffffffffffffffff
mov ecx, eax
call fcn.1000187a
mov dword [ebp + 0xc], eax
jmp 0x1000284c
mov dword [ebp + 0xc], ebx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + 0xc]
push 0x1000526c
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp + 0x10], eax
call fcn.100019ab
mov ecx, dword [ebp + 0xc]
push 0x10005260
call fcn.100019ab
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x538]
push eax
call fcn.10001ac7
mov esi, 0x400
xor ebx, ebx
cmp dword [0x10007c60], ebx
je 0x100028a0
mov dword [ebp - 4], 0x10005258
cmp dword [ebp - 4], ebx
jne 0x10002cf3
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
call fcn.10001f9b
cmp eax, 0xffffffff
jne 0x100028d4
push esi
lea eax, [ebp - 0x538]
push dword [ebx + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x538]
mov dword [ebp - 4], eax
jmp 0x1000288f
xor ebx, ebx
inc ebx
cmp eax, ebx
jne 0x1000290f
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 8], eax
jl 0x10002906
jg 0x100028ed
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xc], eax
jb 0x10002906
mov ecx, dword [ebp + 0xc]
call fcn.10002221
cmp eax, 2
jne 0x10002906
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0x10005250
jmp 0x1000288f
mov dword [ebp - 4], 0x1000523c
jmp 0x1000288f
mov ecx, dword [ebp + 0xc]
call fcn.10002221
test eax, eax
jne 0x10002939
call edi
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x20]
add ecx, edx
cmp ecx, eax
jae 0x10002cda
mov dword [ebp - 4], 0x10005220
jmp 0x1000288f
mov ecx, dword [ebp + 0xc]
call fcn.10002221
cmp eax, ebx
jne 0x10002974
push 0
push 0
push 0x10005210
call fcn.10002341
add esp, 0xc
call edi
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x20]
add ecx, edx
cmp ecx, eax
jae 0x10002cda
mov dword [ebp - 4], 0x100051f0
jmp 0x1000288f
mov ecx, dword [ebp + 0xc]
call fcn.10002221
cmp eax, 2
jne 0x10002ce7
cmp dword [ebp - 0x1c], 0
jne 0x100029da
mov dword [ebp - 0x1c], ebx
call edi
mov ecx, dword [ebp + 0xc]
mov dword [ebp + 0x10], eax
call fcn.1000227a
mov ebx, eax
or eax, edx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], edx
jne 0x100029b0
mov dword [ebp - 4], 0x100051c8
jmp 0x100029da
mov eax, dword [0x1000685c]
test eax, eax
je 0x100029da
push 0x75300000
push 0
push 0x401
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 0x10]
mov dword [0x10007c68], ebx
mov dword [0x10007c6c], eax
and dword [ebp - 0x18], 0
jmp 0x10002c8a
inc dword [ebp - 0x18]
mov ecx, 0x2000
cmp eax, ecx
jle 0x100029f1
mov eax, ecx
mov ecx, dword [ebp + 0xc]
push eax
push 0x10007c70
call fcn.10002261
mov ebx, eax
test ebx, ebx
jle 0x10002c71
call edi
mov dword [ebp + 0x10], eax
lea eax, [ebp - 0x38]
push 0
push eax
push ebx
push 0x10007c70
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, ebx
cdq
add dword [ebp - 0xc], eax
adc dword [ebp - 8], edx
call edi
sub eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, 0x3e8
div ecx
test eax, eax
mov dword [ebp + 0x14], eax
jne 0x10002a42
inc eax
cdq
push edx
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.10003330
push dword [ebp - 8]
mov edi, eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp + 0x14]
call fcn.100022d6
mov ebx, eax
add esp, 0x14
sub ebx, dword [ebp + 0x14]
cmp dword [ebp - 0x24], 2
jne 0x10002b88
cmp ebx, 1
jne 0x10002a86
mov dword [ebp + 0x14], 0x10006458
jmp 0x10002ad0
push 0x3c
mov dword [ebp + 0x14], 0x1000a480
pop ecx
cmp ebx, ecx
jl 0x10002ad0
mov eax, ebx
mov ebx, ecx
cdq
idiv ebx
mov ebx, eax
cmp ebx, 1
jne 0x10002aab
mov dword [ebp + 0x14], 0x10006860
jmp 0x10002ad0
cmp ebx, ecx
mov dword [ebp + 0x14], 0x10009c70
jl 0x10002ad0
mov eax, ebx
mov dword [ebp + 0x14], 0x1000b090
cdq
idiv ecx
mov ebx, eax
cmp ebx, 1
je 0x10002ad0
mov dword [ebp + 0x14], 0x10007460
lea eax, [ebp - 0xb8]
push eax
push 0
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.10003330
push edx
push eax
call fcn.10003165
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
push 0
push esi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.10003330
push edx
push eax
call fcn.10003165
lea eax, [edi + edi*4]
mov ecx, esi
add eax, eax
add esp, 0xc
cdq
idiv ecx
push 0xa
pop ecx
cdq
idiv ecx
mov eax, edi
mov ecx, esi
push edx
cdq
idiv ecx
push eax
lea eax, [ebp - 0x138]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x64
call fcn.100022d6
add esp, 0x14
push eax
lea eax, [ebp - 0xb8]
push eax
push 0x10006c60
push 0x10007c70
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
test ebx, ebx
je 0x10002c56
push ebx
mov edi, 0x10007c70
push dword [ebp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, edi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x10002c56
cmp dword [ebp - 0x24], 1
jne 0x10002c56
push 0x3c
mov dword [ebp + 0x14], 0x10006458
pop ecx
cmp ebx, ecx
jl 0x10002bc0
mov eax, ebx
mov ebx, ecx
cdq
idiv ebx
mov dword [ebp + 0x14], 0x10006860
mov ebx, eax
cmp ebx, ecx
jl 0x10002bc0
cdq
idiv ecx
mov dword [ebp + 0x14], 0x1000b090
mov ebx, eax
lea eax, [edi + edi*4]
mov ecx, esi
add eax, eax
push 0xa
cdq
idiv ecx
pop ecx
cdq
idiv ecx
mov eax, edi
mov ecx, esi
push edx
cdq
idiv ecx
push eax
push 0
push esi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.10003330
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x64
call fcn.100022d6
add esp, 0x14
push eax
push 0
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.10003330
push eax
push 0x10006c60
push 0x10007c70
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
test ebx, ebx
je 0x10002c56
cmp ebx, 1
mov eax, 0x10005450
je 0x10002c34
mov eax, 0x1000a070
push eax
mov edi, 0x10007c70
push dword [ebp + 0x14]
push ebx
push 0x1000a888
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, edi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x10007c70
call fcn.10002341
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0xc
jmp 0x10002c8a
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 8], eax
jg 0x10002c8a
jl 0x10002c83
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xc], eax
jae 0x10002c8a
mov dword [ebp - 4], 0x100051b8
mov ecx, dword [ebp + 0xc]
call fcn.1000224a
test eax, eax
jg 0x100029e3
call edi
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x20]
add ecx, edx
cmp eax, ecx
jbe 0x10002cd0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xc], eax
jne 0x10002cb8
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 8], eax
je 0x10002cc4
mov dword [ebp - 4], 0x100051a0
jmp 0x1000288f
mov dword [ebp - 0x2c], 1
jmp 0x100028fd
cmp dword [ebp - 0x18], 0
jne 0x1000288f
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000288f
mov dword [ebp - 4], 0x10005188
jmp 0x1000288f
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x10002d18
push esi
push ebx
push dword [0x1000b08c]
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x1000b088]
push 0xfffffffffffffffc
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
cmp dword [ebp + 0xc], ebx
je 0x10002d2e
mov ecx, dword [ebp + 0xc]
call fcn.10001986
push dword [ebp + 0xc]
call fcn.100022b5
pop ecx
call sub.WS2_32.dll_WSACleanup
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 4]
cmp dword [0x10007c60], 0
jne 0x10002d4e
cmp dword [ebp - 0x2c], 0
jne 0x10002d5b
lea eax, [ebp - 0x938]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.10003284
pop edi
pop esi
pop ebx
leave
ret