Function at 0x10011a2a
Capabilities:
Check for time delay via gettickcount
Create process on windows
Delete registry value
Persist via run registry key
Self delete
Set registry value

Disassembly:
mov eax, 0x100cbcc0
call fcn.10030644
sub esp, 0x54
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.10003571
push dword [ebp + 0x18]
mov ecx, esi
mov edi, eax
call fcn.100c0556
cmp eax, ebx
je 0x10011a7a
lea ecx, [ebp - 0x60]
push ecx
mov ecx, eax
call fcn.100be6fe
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp + 8]
push str.main
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011aa1
push ebx
push 0x1450
push 0x111
push dword [edi + 0x1c]
jmp 0x10011f36
lea eax, [ebp + 8]
push str.exitapp
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011abd
push ebx
push 0x406
jmp 0x10011a94
lea eax, [ebp + 8]
push str.enter
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011ad6
push ebx
push 5
jmp 0x10011a94
lea eax, [ebp + 8]
push str.back
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011aef
push ebx
push 6
jmp 0x10011a94
lea eax, [ebp + 8]
push str.connect
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011b0b
push ebx
push 0x41d
jmp 0x10011a94
lea eax, [ebp + 8]
push str.nettest
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011b2a
push ebx
push 0x8014
jmp 0x10011a94
lea eax, [ebp + 8]
push str.hungup
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
jne 0x10011b79
lea eax, [ebp + 8]
push str.setapppath
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011b5e
mov ecx, esi
call fcn.1006447d
jmp 0x10012442
lea eax, [ebp + 8]
push str.hunguprefresh
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011b85
mov byte [esi + 0xa0], 1
mov ecx, edi
call fcn.10026058
jmp 0x10012442
lea eax, [ebp + 8]
push str.cancel
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011ba8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc8]
jmp 0x10012442
lea eax, [ebp + 8]
push str.advancesetup
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011bc8
mov ecx, esi
call fcn.1001a73a
jmp 0x10012442
lea eax, [ebp + 8]
push str.checkupdate
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011be8
mov ecx, esi
call fcn.10019cbd
jmp 0x10012442
lea eax, [ebp + 8]
push str.language
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011c08
mov ecx, esi
call fcn.10019b3d
jmp 0x10012442
lea eax, [ebp + 8]
push str.process_l2tp
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011c28
mov ecx, esi
call fcn.1001a4c6
jmp 0x10012442
lea eax, [ebp + 8]
push str.setserver
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011c76
mov edi, dword [edi + 0x684]
cmp edi, ebx
je 0x10012442
push 0x3f1
mov ecx, esi
call fcn.100c0556
mov ebx, eax
mov ecx, esi
push ebx
call fcn.10014b8a
push ebx
push eax
mov ecx, esi
call fcn.100132a3
push eax
mov ecx, edi
call fcn.100053e4
jmp 0x10012442
lea eax, [ebp + 8]
push str.help
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011c96
mov ecx, esi
call fcn.100133ac
jmp 0x10012442
lea eax, [ebp + 8]
push 0x100fbef0
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011cb6
mov ecx, esi
call fcn.100169ac
jmp 0x10012442
lea eax, [ebp + 8]
push 0x100fbeec
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011cd6
mov ecx, esi
call fcn.10016a58
jmp 0x10012442
lea eax, [ebp + 8]
push str.setup
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011cf6
mov ecx, esi
call fcn.10019c09
jmp 0x10012442
lea eax, [ebp + 8]
push str.charge
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011d16
mov ecx, esi
call fcn.10016acc
jmp 0x10012442
lea eax, [ebp + 8]
push str.getpwd
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011d36
mov ecx, esi
call fcn.10017107
jmp 0x10012442
lea eax, [ebp + 8]
push str.query
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011d56
mov ecx, esi
call fcn.10017525
jmp 0x10012442
lea eax, [ebp + 8]
push str.getip
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011d76
mov ecx, esi
call fcn.1001822d
jmp 0x10012442
lea eax, [ebp + 8]
push str.search
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011dc1
lea eax, [ebp + 0x18]
push 0x44f
push eax
mov ecx, esi
call fcn.1001160d
push eax
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 1
call fcn.100c11ae
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], bl
call fcn.100c1067
mov ecx, esi
call fcn.10014670
jmp 0x10012442
lea eax, [ebp + 8]
push str.cardcheck
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011de1
mov ecx, esi
call fcn.100178b0
jmp 0x10012442
lea eax, [ebp + 8]
push str.changepwd
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011e01
mov ecx, esi
call fcn.10017ca8
jmp 0x10012442
lea eax, [ebp + 8]
push str.speedtest
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011e21
mov ecx, esi
call fcn.10015792
jmp 0x10012442
lea eax, [ebp + 8]
push str.addtap
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011e41
mov ecx, esi
call fcn.100166c2
jmp 0x10012442
lea eax, [ebp + 8]
push str.deltap
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011e61
mov ecx, esi
call fcn.10016876
jmp 0x10012442
lea eax, [ebp + 8]
push str.killprocess
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011e81
mov ecx, esi
call fcn.10019878
jmp 0x10012442
lea eax, [ebp + 8]
push str.enterfromdialog
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011eb5
push ebx
push 5
push 0x111
push dword [edi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc4]
jmp 0x10012442
lea eax, [ebp + 8]
push str.parentreping
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011ef4
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x10109680]
cmp eax, 0x3e8
jbe 0x10012442
call esi
push ebx
mov dword [0x10109680], eax
push 0x189d
jmp 0x10011a94
lea eax, [ebp + 8]
push str.reping
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011f41
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [0x10109684]
cmp eax, 0x3e8
jbe 0x10012442
call edi
push ebx
push 0x189d
push 0x111
mov dword [0x10109684], eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x10012442
lea eax, [ebp + 8]
push str.stopping
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011f61
mov ecx, esi
call fcn.10015ff5
jmp 0x10012442
lea eax, [ebp + 8]
push str.pppoe
push eax
call fcn.100038e0
pop ecx
test al, al
pop ecx
je 0x10011f81
mov ecx, esi
call fcn.10018201
jmp 0x10012442
push 4
lea eax, [ebp - 0x34]
push ebx
push eax
lea ecx, [ebp + 8]
call fcn.1000db8d
push str.tab:
push eax
mov byte [ebp - 4], 2
call fcn.100038e0
pop ecx
mov byte [ebp - 0xd], al
pop ecx
mov byte [ebp - 4], bl
push 1
lea ecx, [ebp - 0x34]
call fcn.10002424
cmp byte [ebp - 0xd], bl
je 0x10012015
push dword [0x100d6d18]
lea eax, [ebp - 0x34]
lea ecx, [ebp + 8]
push 4
push eax
call fcn.1000db8d
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.100087d2
sub esp, 0x10
mov dword [ebp + 0x18], eax
mov al, byte [ebp + 0x1b]
mov edi, esp
mov dword [ebp - 0x1c], esp
push ebx
mov ecx, edi
mov byte [edi], al
call fcn.10002424
push dword [ebp + 0x18]
call fcn.10030730
pop ecx
push eax
mov ecx, edi
push dword [ebp + 0x18]
call fcn.100036bc
mov ecx, esi
call fcn.100160df
mov byte [ebp - 4], bl
push 1
lea ecx, [ebp - 0x34]
jmp 0x100123cc
push 0xb
lea eax, [ebp - 0x34]
push ebx
push eax
lea ecx, [ebp + 8]
call fcn.1000db8d
push str.replacetab:
push eax
mov byte [ebp - 4], 4
call fcn.100038e0
pop ecx
mov byte [ebp - 0xd], al
pop ecx
mov byte [ebp - 4], bl
push 1
lea ecx, [ebp - 0x34]
call fcn.10002424
cmp byte [ebp - 0xd], bl
je 0x100120a9
push dword [0x100d6d18]
lea eax, [ebp - 0x34]
lea ecx, [ebp + 8]
push 0xb
push eax
call fcn.1000db8d
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.100087d2
sub esp, 0x10
mov dword [ebp + 0x18], eax
mov al, byte [ebp + 0x1b]
mov edi, esp
mov dword [ebp - 0x1c], esp
push ebx
mov ecx, edi
mov byte [edi], al
call fcn.10002424
push dword [ebp + 0x18]
call fcn.10030730
pop ecx
push eax
mov ecx, edi
push dword [ebp + 0x18]
call fcn.100036bc
mov ecx, esi
call fcn.10016071
mov byte [ebp - 4], bl
push 1
lea ecx, [ebp - 0x34]
jmp 0x100123cc
push 6
lea eax, [ebp - 0x34]
pop edi
lea ecx, [ebp + 8]
push edi
push ebx
push eax
call fcn.1000db8d
push str.check:
push eax
mov byte [ebp - 4], 6
call fcn.100038e0
pop ecx
mov byte [ebp - 0xd], al
pop ecx
mov byte [ebp - 4], bl
push 1
lea ecx, [ebp - 0x34]
call fcn.10002424
cmp byte [ebp - 0xd], bl
je 0x100122a5
push dword [0x100d6d18]
lea eax, [ebp - 0x34]
lea ecx, [ebp + 8]
push edi
push eax
call fcn.1000db8d
mov eax, dword [eax + 4]
mov byte [ebp - 4], 7
cmp eax, ebx
jne 0x10012107
mov eax, 0x100d6d1c
push eax
lea ecx, [ebp - 0x14]
call fcn.10002736
push 1
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 9
call fcn.10002424
push dword [ebp + 0x18]
mov ecx, esi
call fcn.100c0556
cmp eax, ebx
jne 0x10012144
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x10012442
call fcn.10002801
mov dword [ebp - 0x14], ebx
jmp 0x10012442
mov ecx, eax
call fcn.10058342
mov edi, eax
lea eax, [ebp - 0x14]
push edi
push ecx
mov ecx, esp
mov dword [ebp + 0x18], esp
push eax
call fcn.10002717
mov ecx, esi
call fcn.1001b1ff
push str.autorun
lea ecx, [ebp - 0x18]
call fcn.10002736
push eax
lea ecx, [ebp - 0x14]
call fcn.10005a15
mov ecx, dword [ebp - 0x18]
mov byte [ebp + 0x1b], al
cmp ecx, ebx
je 0x10012189
call fcn.10002801
cmp byte [ebp + 0x1b], bl
je 0x1001225b
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push ebx
lea eax, [ebp + 0x1b]
sub esp, 0x10
mov ecx, esp
mov dword [ebp + 0x18], esp
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.10003536
lea eax, [ebp - 0x1c]
push eax
call fcn.10020042
add esp, 0x14
mov ecx, eax
call fcn.10003ab9
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x1c]
mov esi, eax
cmp ecx, ebx
je 0x100121df
call fcn.10002801
cmp esi, ebx
jne 0x10012250
cmp edi, ebx
je 0x10012237
lea eax, [ebp + 0x18]
mov ecx, 0x10109850
push eax
call fcn.100c6357
mov eax, dword [ebp + 0x18]
mov byte [ebp - 4], 0xa
mov ecx, dword [eax - 8]
mov eax, dword [0x10109698]
cmp eax, ebx
je 0x1001220c
mov esi, dword [eax]
jmp 0x1001220e
xor esi, esi
lea eax, [ecx + ecx]
lea ecx, [ebp + 0x18]
push eax
push ebx
call fcn.100c14ac
push eax
push 1
push ebx
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 9
call fcn.100c1067
jmp 0x10012250
mov eax, dword [0x10109698]
cmp eax, ebx
je 0x10012244
mov eax, dword [eax]
jmp 0x10012246
xor eax, eax
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10012290
push str.autosort
lea ecx, [ebp - 0x1c]
call fcn.10002736
push eax
lea ecx, [ebp - 0x14]
call fcn.10005a15
mov ecx, dword [ebp - 0x1c]
mov byte [ebp + 0x1b], al
cmp ecx, ebx
je 0x10012280
call fcn.10002801
cmp byte [ebp + 0x1b], bl
je 0x10012290
cmp edi, ebx
je 0x10012290
mov ecx, esi
call fcn.10015835
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x10012442
call fcn.10002801
jmp 0x10012442
push edi
lea eax, [ebp - 0x34]
push ebx
push eax
lea ecx, [ebp + 8]
call fcn.1000db8d
push str.popup:
push eax
mov byte [ebp - 4], 0xb
call fcn.100038e0
pop ecx
mov byte [ebp + 0x1b], al
pop ecx
mov byte [ebp - 4], bl
push 1
lea ecx, [ebp - 0x34]
call fcn.10002424
cmp byte [ebp + 0x1b], bl
je 0x1001233d
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x10109650
call fcn.10002736
push dword [ebp - 0x20]
lea eax, [ebp - 0x34]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xc
push dword [ebp - 0x24]
push dword [0x100d6d18]
push edi
push eax
call fcn.1000db8d
sub esp, 0x10
lea ecx, [ebp + 0x1b]
mov edi, esp
mov dword [ebp - 0x18], esp
push ecx
mov ecx, eax
mov byte [ebp - 4], 0xd
call fcn.100087d2
push eax
mov ecx, edi
call fcn.10003536
mov ecx, esi
mov byte [ebp - 4], 0xe
call fcn.100164f3
mov byte [ebp - 4], bl
push 1
lea ecx, [ebp - 0x34]
jmp 0x100123cc
push 7
lea eax, [ebp - 0x34]
push ebx
push eax
lea ecx, [ebp + 8]
call fcn.1000db8d
push str.dialog:
push eax
mov byte [ebp - 4], 0xf
call fcn.100038e0
pop ecx
mov byte [ebp + 0x1b], al
pop ecx
mov byte [ebp - 4], bl
push 1
lea ecx, [ebp - 0x34]
call fcn.10002424
cmp byte [ebp + 0x1b], bl
je 0x100123d3
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x10109650
call fcn.10002736
push dword [0x100d6d18]
lea eax, [ebp - 0x34]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x10
push 7
push eax
call fcn.1000db8d
sub esp, 0x10
lea ecx, [ebp + 0x1b]
mov edi, esp
mov dword [ebp - 0x18], esp
push ecx
mov ecx, eax
mov byte [ebp - 4], 0x11
call fcn.100087d2
push eax
mov ecx, edi
call fcn.10003536
mov ecx, esi
mov byte [ebp - 4], 0x12
call fcn.100163d7
mov byte [ebp - 4], bl
push 1
lea ecx, [ebp - 0x34]
call fcn.10002424
jmp 0x10012442
cmp dword [ebp + 0x10], ebx
jbe 0x10012442
push 5
push ebx
push ebx
lea ecx, [ebp + 8]
call fcn.100087d2
push eax
lea ecx, [ebp + 0x18]
call fcn.10002736
mov ecx, eax
mov byte [ebp - 4], 0x13
call fcn.10003ab9
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.100c10db
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.10012b9e
mov ecx, eax
mov byte [ebp - 4], 0x14
call fcn.1000b810
push eax
push 0x100fb344
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x13
call fcn.100c1067
mov ecx, dword [ebp + 0x18]
cmp ecx, ebx
je 0x10012442
call fcn.10002801
mov dword [ebp + 0x18], ebx
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp + 8]
call fcn.10002424
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x14