Function at 0x100433e6
Capabilities:
Contain obfuscated stackstrings
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac4
mov eax, dword [0x10098428]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x72
pop ecx
push 0x65
pop eax
push 0x78
pop edi
push 0x6e
pop ebx
xor esi, esi
push 0x6f
pop edx
mov word [ebp - 0xd8], 0x56
mov word [ebp - 0xd6], 0x4d
mov word [ebp - 0xd4], 0x57
mov word [ebp - 0xd2], 0x61
mov word [ebp - 0xd0], cx
mov word [ebp - 0xce], ax
mov word [ebp - 0xcc], 0x54
mov word [ebp - 0xca], cx
mov word [ebp - 0xc8], 0x61
mov word [ebp - 0xc6], 0x79
mov word [ebp - 0xc4], 0x2e
mov word [ebp - 0xc2], ax
mov word [ebp - 0xc0], di
mov word [ebp - 0xbe], ax
mov word [ebp - 0xbc], si
mov word [ebp - 0xf8], 0x54
mov word [ebp - 0xf6], ax
mov word [ebp - 0xf4], 0x61
mov word [ebp - 0xf2], 0x6d
mov word [ebp - 0xf0], 0x56
mov word [ebp - 0xee], 0x69
mov word [ebp - 0xec], ax
mov word [ebp - 0xea], 0x77
mov word [ebp - 0xe8], ax
mov word [ebp - 0xe6], cx
mov word [ebp - 0xe4], 0x2e
mov word [ebp - 0xe2], ax
mov word [ebp - 0xe0], di
mov word [ebp - 0xde], ax
mov word [ebp - 0xdc], si
mov word [ebp - 0x118], 0x50
mov word [ebp - 0x116], 0x43
mov word [ebp - 0x114], 0x41
mov word [ebp - 0x112], bx
mov word [ebp - 0x110], 0x79
mov word [ebp - 0x10e], 0x57
mov word [ebp - 0x10c], 0x68
mov word [ebp - 0x10a], ax
mov word [ebp - 0x108], cx
mov word [ebp - 0x106], ax
mov word [ebp - 0x104], 0x2e
mov word [ebp - 0x102], ax
mov word [ebp - 0x100], di
mov word [ebp - 0xfe], ax
mov word [ebp - 0xfc], si
mov word [ebp - 0x30], 0x50
mov word [ebp - 0x2e], cx
mov word [ebp - 0x2c], dx
mov word [ebp - 0x2a], 0x63
mov word [ebp - 0x28], 0x4d
mov word [ebp - 0x26], dx
mov word [ebp - 0x24], bx
mov word [ebp - 0x22], 0x2e
mov word [ebp - 0x20], ax
mov word [ebp - 0x1e], di
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], si
mov word [ebp - 0xb8], 0x50
mov word [ebp - 0xb6], cx
mov word [ebp - 0xb4], dx
mov word [ebp - 0xb2], 0x63
mov word [ebp - 0xb0], 0x4d
mov word [ebp - 0xae], dx
mov word [ebp - 0xac], bx
mov word [ebp - 0xaa], 0x36
mov word [ebp - 0xa8], 0x34
mov word [ebp - 0xa6], ax
mov word [ebp - 0xa4], 0x2e
mov word [ebp - 0xa2], ax
mov word [ebp - 0xa0], di
mov word [ebp - 0x9e], ax
mov word [ebp - 0x9c], si
mov word [ebp - 0x48], 0x50
mov word [ebp - 0x46], cx
mov word [ebp - 0x44], dx
mov word [ebp - 0x42], 0x63
mov word [ebp - 0x40], 0x45
mov word [ebp - 0x3e], di
mov word [ebp - 0x3c], 0x70
mov word [ebp - 0x3a], 0x2e
mov word [ebp - 0x38], ax
mov word [ebp - 0x36], di
mov word [ebp - 0x34], ax
mov word [ebp - 0x32], si
mov word [ebp - 0x98], 0x50
mov word [ebp - 0x96], cx
mov word [ebp - 0x94], dx
mov word [ebp - 0x92], 0x63
mov word [ebp - 0x90], 0x45
mov word [ebp - 0x8e], di
mov word [ebp - 0x8c], 0x70
mov word [ebp - 0x8a], 0x36
mov word [ebp - 0x88], 0x34
mov word [ebp - 0x86], 0x2e
mov word [ebp - 0x84], ax
mov word [ebp - 0x82], di
mov word [ebp - 0x80], ax
mov word [ebp - 0x7e], si
mov word [ebp - 0x18], 0x58
mov word [ebp - 0x16], 0x75
mov word [ebp - 0x14], ax
mov word [ebp - 0x12], 0x74
mov word [ebp - 0x10], cx
mov word [ebp - 0xe], 0x2e
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], di
mov word [ebp - 8], ax
mov word [ebp - 6], si
mov word [ebp - 0x7c], 0x50
mov word [ebp - 0x7a], 0x43
mov word [ebp - 0x78], 0x48
mov word [ebp - 0x76], 0x75
mov word [ebp - 0x74], bx
mov word [ebp - 0x72], 0x74
mov word [ebp - 0x70], ax
mov word [ebp - 0x6e], cx
mov word [ebp - 0x6c], 0x2e
mov word [ebp - 0x6a], ax
mov word [ebp - 0x68], di
mov word [ebp - 0x66], ax
mov word [ebp - 0x64], si
mov word [ebp - 0x138], 0x50
mov word [ebp - 0x136], 0x43
mov word [ebp - 0x134], 0x48
mov word [ebp - 0x132], 0x75
mov word [ebp - 0x130], bx
mov word [ebp - 0x12e], 0x74
mov word [ebp - 0x12c], ax
mov word [ebp - 0x12a], cx
mov word [ebp - 0x128], 0x36
mov word [ebp - 0x126], 0x34
mov word [ebp - 0x124], 0x2e
mov word [ebp - 0x122], ax
mov word [ebp - 0x120], di
mov word [ebp - 0x11e], ax
mov word [ebp - 0x11c], si
mov word [ebp - 0x60], dx
mov word [ebp - 0x5e], 0x6c
mov word [ebp - 0x5c], 0x6c
mov word [ebp - 0x5a], 0x79
mov word [ebp - 0x58], 0x44
mov word [ebp - 0x56], 0x62
mov word [ebp - 0x54], 0x67
mov word [ebp - 0x52], 0x2e
mov word [ebp - 0x50], ax
mov word [ebp - 0x4e], di
mov word [ebp - 0x4c], ax
mov word [ebp - 0x4a], si
push 0x20
mov word [ebp - 0x16c], di
pop edi
push 0x67
mov word [ebp - 0x17a], dx
mov word [ebp - 0x166], dx
mov word [ebp - 0x158], dx
mov word [ebp - 0x148], dx
mov word [ebp - 0x140], dx
mov word [ebp - 0x1cc], dx
mov word [ebp - 0x1b4], dx
pop edx
mov word [ebp - 0x198], 0x53
mov word [ebp - 0x196], 0x79
mov word [ebp - 0x194], 0x73
mov word [ebp - 0x192], 0x69
mov word [ebp - 0x190], bx
mov word [ebp - 0x18e], 0x74
mov word [ebp - 0x18c], ax
mov word [ebp - 0x18a], cx
mov word [ebp - 0x188], bx
mov word [ebp - 0x186], 0x61
mov word [ebp - 0x184], 0x6c
mov word [ebp - 0x182], 0x73
mov word [ebp - 0x180], 0x20
mov word [ebp - 0x17e], 0x50
mov word [ebp - 0x17c], cx
mov word [ebp - 0x178], 0x63
mov word [ebp - 0x176], ax
mov word [ebp - 0x174], 0x73
mov word [ebp - 0x172], 0x73
mov word [ebp - 0x170], 0x20
mov word [ebp - 0x16e], 0x45
mov word [ebp - 0x16a], 0x70
mov word [ebp - 0x168], 0x6c
mov word [ebp - 0x164], cx
mov word [ebp - 0x162], ax
mov word [ebp - 0x160], cx
mov word [ebp - 0x15e], si
mov word [ebp - 0x15c], 0x50
mov word [ebp - 0x15a], cx
mov word [ebp - 0x156], 0x63
mov word [ebp - 0x154], ax
mov word [ebp - 0x152], 0x73
mov word [ebp - 0x150], 0x73
mov word [ebp - 0x14e], 0x73
mov word [ebp - 0x14c], di
mov word [ebp - 0x14a], 0x4d
mov word [ebp - 0x146], bx
mov word [ebp - 0x144], 0x69
mov word [ebp - 0x142], 0x74
mov word [ebp - 0x13e], cx
mov word [ebp - 0x13c], si
mov word [ebp - 0x1d4], 0x57
mov word [ebp - 0x1d2], 0x69
mov word [ebp - 0x1d0], bx
mov word [ebp - 0x1ce], 0x44
mov word [ebp - 0x1ca], 0x77
mov word [ebp - 0x1c8], 0x73
mov word [ebp - 0x1c6], di
mov word [ebp - 0x1c4], 0x47
mov word [ebp - 0x1c2], 0x55
mov word [ebp - 0x1c0], 0x49
mov word [ebp - 0x1be], di
mov word [ebp - 0x1bc], 0x73
mov word [ebp - 0x1ba], 0x79
mov word [ebp - 0x1b8], 0x6d
mov word [ebp - 0x1b6], 0x62
mov word [ebp - 0x1b2], 0x6c
mov word [ebp - 0x1b0], 0x69
mov word [ebp - 0x1ae], 0x63
mov word [ebp - 0x1ac], di
mov word [ebp - 0x1aa], 0x64
mov word [ebp - 0x1a8], ax
mov word [ebp - 0x1a6], 0x62
mov word [ebp - 0x1a4], 0x75
mov word [ebp - 0x1a2], dx
mov word [ebp - 0x1a0], dx
mov word [ebp - 0x19e], ax
mov word [ebp - 0x19c], cx
mov word [ebp - 0x19a], si
mov word [ebp - 0x210], ax
mov word [ebp - 0x20e], ax
mov word [ebp - 0x1e6], ax
mov word [ebp - 0x1dc], ax
lea eax, [ebp - 0xf8]
mov dword [ebp - 0xaac], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0xaa8], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0xaa4], eax
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xaa0], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0xa9c], eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0xa98], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0xa94], eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0xa90], eax
lea eax, [ebp - 0x138]
mov dword [ebp - 0xa8c], eax
lea eax, [ebp - 0xd8]
mov dword [ebp - 0xa88], eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0xa84], eax
lea eax, [ebp - 0x198]
mov dword [ebp - 0xa80], eax
lea eax, [ebp - 0x15c]
mov dword [ebp - 0xa7c], eax
lea eax, [ebp - 0x1d4]
mov dword [ebp - 0xa78], eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0xa74], eax
lea eax, [ebp - 0xa70]
push eax
push str.BootSpeedUpInfoEx2013
mov word [ebp - 0x214], 0x46
mov word [ebp - 0x212], cx
mov word [ebp - 0x20c], di
mov word [ebp - 0x20a], 0x33
mov word [ebp - 0x208], 0x32
mov word [ebp - 0x206], 0x2d
mov word [ebp - 0x204], 0x62
mov word [ebp - 0x202], 0x69
mov word [ebp - 0x200], 0x74
mov word [ebp - 0x1fe], di
mov word [ebp - 0x1fc], 0x41
mov word [ebp - 0x1fa], bx
mov word [ebp - 0x1f8], 0x61
mov word [ebp - 0x1f6], 0x6c
mov word [ebp - 0x1f4], 0x79
mov word [ebp - 0x1f2], 0x73
mov word [ebp - 0x1f0], 0x69
mov word [ebp - 0x1ee], bx
mov word [ebp - 0x1ec], dx
mov word [ebp - 0x1ea], di
mov word [ebp - 0x1e8], 0x44
mov word [ebp - 0x1e4], 0x62
mov word [ebp - 0x1e2], 0x75
mov word [ebp - 0x1e0], dx
mov word [ebp - 0x1de], dx
mov word [ebp - 0x1da], cx
mov word [ebp - 0x1d8], si
mov dword [ebp - 0xa70], esi
call fcn.10043115
test eax, eax
pop ecx
pop ecx
je 0x10043c2e
cmp dword [ebp - 0xa70], esi
je 0x10043c2e
xor eax, eax
inc eax
jmp 0x10043eed
lea eax, [ebp - 0xa6c]
push eax
push str.BootSpeedUpInfoEx2014
mov dword [ebp - 0xa6c], esi
call fcn.10043115
test eax, eax
pop ecx
pop ecx
je 0x10043c5a
cmp dword [ebp - 0xa6c], esi
je 0x10043c5a
xor eax, eax
jmp 0x10043eed
xor eax, eax
mov dword [ebp - 0xac0], esi
lea edi, [ebp - 0xabc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
push 2
mov dword [ebp - 0xa5c], esi
mov dword [ebp - 0xa60], esi
stosd dword es:[edi], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0xa64], ebx
je 0x10043e28
cmp ebx, esi
je 0x10043e28
mov edi, 0x22c
push edi
lea eax, [ebp - 0x860]
push esi
push eax
call fcn.100541d0
add esp, 0xc
lea eax, [ebp - 0x860]
push eax
push ebx
mov dword [ebp - 0x860], edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10043e10
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0x83c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, eax
cmp edi, esi
je 0x10043dea
push 0x206
lea eax, [ebp - 0x41e]
push esi
push eax
mov word [ebp - 0x420], si
call fcn.100541d0
push 0x103
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.10056e86
add esp, 0x18
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
push str.QQ.exe
lea eax, [ebp - 0x420]
push eax
call ebx
test eax, eax
jne 0x10043d56
cmp dword [ebp - 0xa60], 5
jae 0x10043d56
mov ecx, dword [ebp - 0xa60]
mov eax, dword [ebp - 0x858]
inc dword [ebp - 0xa60]
mov dword [ebp + ecx*4 - 0xac0], eax
xor edi, edi
push dword [ebp + edi*4 - 0xaac]
lea eax, [ebp - 0x420]
push eax
call ebx
test eax, eax
je 0x10043d74
inc edi
cmp edi, 0xb
jb 0x10043d58
jmp 0x10043d7e
mov dword [ebp - 0xa5c], 1
cmp dword [ebp - 0xa5c], esi
jne 0x10043dea
push 0x208
lea eax, [ebp - 0x62e]
push esi
push eax
mov word [ebp - 0x630], si
call fcn.100541d0
lea eax, [ebp - 0x630]
push eax
lea ecx, [ebp - 0x83c]
call fcn.10043176
add esp, 0x10
test eax, eax
je 0x10043dea
lea eax, [ebp - 0x630]
push eax
call fcn.10053c3b
test eax, eax
pop ecx
jbe 0x10043dea
xor edi, edi
lea eax, [ebp - 0x630]
push eax
push dword [ebp + edi*4 - 0xa80]
call fcn.100549b5
test eax, eax
pop ecx
pop ecx
jne 0x10043e06
inc edi
cmp edi, 4
jb 0x10043dcb
lea eax, [ebp - 0x860]
push eax
push dword [ebp - 0xa64]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10043cd0
jmp 0x10043e10
mov dword [ebp - 0xa5c], 1
push dword [ebp - 0xa64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xa5c], esi
jne 0x10043ee7
xor edi, edi
cmp dword [ebp - 0xa60], esi
mov dword [ebp - 0xa68], esi
jbe 0x10043ee7
push dword [ebp + edi*4 - 0xac0]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0xa64], esi
je 0x10043ece
lea eax, [ebp - 0xa58]
push eax
push ebx
mov dword [ebp - 0xa58], 0x428
call sub.KERNEL32.dll_Module32FirstW
lea eax, [ebp - 0xa38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp eax, esi
je 0x10043ea2
push str.remotecontrol.dll
push eax
call fcn.1005837b
test eax, eax
pop ecx
pop ecx
jne 0x10043e9a
mov dword [ebp - 0xa64], 1
cmp dword [ebp - 0xa64], esi
jne 0x10043eb5
lea eax, [ebp - 0xa58]
push eax
push ebx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x10043e6e
jmp 0x10043ebf
mov dword [ebp - 0xa68], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xa68], esi
jne 0x10043edd
inc edi
cmp edi, dword [ebp - 0xa60]
jb 0x10043e3c
jmp 0x10043ee7
mov dword [ebp - 0xa5c], 1
mov eax, dword [ebp - 0xa5c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10053c51
leave
ret