Function at 0x10026a8a
Capabilities:
Create thread
Delete file

Disassembly:
mov eax, 0x10068c96
call fcn.100575f8
sub esp, 0x254
mov eax, dword [0x10084500]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x10023781
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov esi, 0x10085a50
push esi
push 0x65
push ebx
push 3
call fcn.10004566
add esp, 0x10
push esi
call fcn.10056d60
pop ecx
mov cl, byte [eax + 0x10085a4f]
dec eax
cmp cl, 0x5c
je 0x10026ae3
cmp cl, 0x2f
jne 0x10026ad2
push 0x104
lea eax, [eax + 0x10085a51]
push eax
push 0x10085b58
call fcn.10057be0
lea eax, [ebp - 0x1e8]
push eax
call fcn.10023308
add esp, 0x10
lea eax, [ebp - 0x1e8]
push eax
push 0x420
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp dword [0x10084050], ebx
mov dword [0x10085fbc], eax
je 0x10026b81
cmp dword [0x10084054], 0x10
mov eax, dword [0x10084040]
jae 0x10026b40
mov eax, 0x10084040
push eax
push 0x66
push ebx
push 3
call fcn.10004566
add esp, 0x10
xor esi, esi
cmp esi, 0xa
jge 0x10026b81
cmp dword [0x10084054], 0x10
mov eax, dword [0x10084040]
jae 0x10026b68
mov eax, 0x10084040
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x10026b81
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
jmp 0x10026b50
call fcn.1001e3c3
test al, al
jne 0x10026bb3
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.RegisterServiceProcess
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10026bac
push 1
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [0x10085db4]
call fcn.10026044
cmp eax, ebx
pop ecx
jne 0x10026bd5
push 0x71
push ebx
push 1
call fcn.10004566
add esp, 0xc
jmp 0x100270bd
cmp dword [0x1008401c], 0x10
mov ecx, dword [0x10084008]
jae 0x10026be9
mov ecx, 0x10084008
cmp dword [0x10084038], 0x10
mov eax, dword [0x10084024]
jae 0x10026bfc
mov eax, 0x10084024
push ecx
push eax
push 0x10085ff8
push 0x1006f044
call sym.mnbv.DLL_f
lea eax, [ebp - 0xa4]
add esp, 0x10
push eax
call fcn.10023350
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
pop ecx
lea eax, [ebp - 0xa4]
push eax
push ebx
push 1
push ebx
call esi
mov dword [ebp - 0x20c], eax
call fcn.100044c6
mov dword [0x10083d60], eax
lea eax, [ebp - 0x70]
push eax
call fcn.10001937
pop ecx
lea eax, [ebp - 0x70]
push eax
push 1
push ebx
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
push eax
mov dword [0x1008599c], eax
call edi
push 0x10087d48
push ebx
push ebx
push ebx
call esi
push ebx
mov dword [0x100859a0], eax
call fcn.10024045
cmp byte [0x10085974], bl
pop ecx
mov dword [ebp - 0x200], eax
mov dword [ebp - 0x1fc], edx
je 0x10026c94
push dword [0x100859a0]
call edi
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ec], eax
lea eax, [ebp - 0x1f0]
push eax
push dword [0x100859a0]
call fcn.10024eb8
pop ecx
pop ecx
push 0x10087430
push ebx
push ebx
push ebx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push 0x10087710
push ebx
push ebx
mov dword [0x100859a4], eax
call esi
cmp dword [0x10083d60], ebx
mov edi, dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
push 1
push ebx
mov dword [0x100859a8], eax
mov dword [ebp - 0x1ec], ebx
mov dword [ebp - 0x1f0], ebx
lea ecx, [ebp - 0x1f0]
push ebx
je 0x10026d0e
push 0x2bf20
jmp 0x10026d13
push 0x1388
push ecx
push eax
call edi
push 0x10089214
push ebx
push ebx
call esi
push 1
push ebx
push ebx
push 0x2710
lea ecx, [ebp - 0x1f0]
push ecx
push eax
mov dword [0x100859ac], eax
mov dword [ebp - 0x1ec], ebx
mov dword [ebp - 0x1f0], ebx
call edi
push 0x10087850
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
mov dword [0x100859b0], eax
call esi
push ebx
push ebx
push ebx
push 0x36ee80
lea ecx, [ebp - 0x244]
push ecx
push eax
mov dword [0x100859b4], eax
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
call edi
mov ecx, dword [0x10085fc8]
cmp ecx, ebx
je 0x10026d89
call fcn.1002531b
push str.backup_timer_6DC72050_53CF
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ecx, [ebp - 0x208]
push ecx
push eax
mov dword [0x100859b8], eax
mov dword [ebp - 0x208], 0xb4
mov dword [ebp - 0x204], ebx
call fcn.10024eb8
pop ecx
pop ecx
push ebx
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push 0x3e8
lea ecx, [ebp - 0x22c]
push ecx
push eax
mov dword [0x100859bc], eax
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
call edi
push ebx
push ebx
push ebx
call esi
push 1
push ebx
push ebx
push 0x493e0
lea ecx, [ebp - 0x21c]
push ecx
push eax
mov dword [0x100859c0], eax
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x1f8]
push eax
push ebx
push ebx
push 0x10023b8c
push ebx
push ebx
mov dword [ebp - 0x1f8], ebx
call esi
mov dword [0x1008598c], eax
lea eax, [ebp - 0x1f8]
push eax
push ebx
push ebx
push 0x10024b19
push ebx
push ebx
call esi
push 0x67
push ebx
push 3
mov dword [0x10085988], eax
call fcn.10004566
add esp, 0xc
mov dword [ebp - 0x1f4], ebx
call fcn.100235c6
cdq
push 0xa
pop ecx
idiv ecx
mov dword [ebp - 0x1fc], eax
lea eax, [ebp - 0xe4]
push eax
call fcn.100233e0
mov dword [esp], 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x1008401c], 0x10
mov ecx, dword [0x10084008]
jae 0x10026e97
mov ecx, 0x10084008
cmp dword [0x10084038], 0x10
mov eax, dword [0x10084024]
jae 0x10026eaa
mov eax, 0x10084024
push ecx
push eax
mov edi, 0x10085ff8
push edi
push 0x1006f024
call sym.mnbv.DLL_f
add esp, 0x10
call fcn.10023cdd
push 0xbf
push 0xffffffffffffffff
push ebx
push 0x1008599c
push 0xa
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, 0xa
ja case.default.0x10026ede
jmp dword [eax*4 + 0x10027265]
cmp dword [0x10083d60], ebx
je 0x10026ef2
call fcn.100105a1
push 0x7c
push ebx
push 3
call fcn.10004566
add esp, 0xc
jmp case.default.0x10026ede
mov eax, dword [0x10085994]
cmp dword [eax + 0x20], 4
jne 0x10026f65
cmp dword [eax + 0x3c], ebx
je 0x10026f65
mov eax, dword [eax + 0x34]
cmp eax, ebx
mov esi, eax
jne 0x10026f1f
mov esi, 0x5265c00
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, dword [0x10085994]
sub ecx, dword [eax + 0x3c]
cmp ecx, esi
jae 0x10026f65
mov eax, esi
sub eax, ecx
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x224]
push eax
push dword [0x100859a0]
call fcn.10024eb8
pop ecx
pop ecx
jmp case.default.0x10026ede
call fcn.10004d07
cmp al, bl
je 0x10026f9d
call fcn.10004da9
cmp al, bl
jne 0x10026f9d
mov eax, dword [0x10085994]
cmp dword [eax + 0x28], 0x36ee80
jl 0x10026f9d
mov dword [ebp - 0x214], 0x1a4
mov dword [ebp - 0x210], ebx
lea eax, [ebp - 0x214]
jmp 0x10026f52
call fcn.10023ecc
mov ecx, dword [0x10085994]
push 2
call fcn.10022e80
push ebx
call fcn.1000cea2
cmp eax, ebx
pop ecx
je 0x1002701b
cmp dword [0x10083714], ebx
je 0x10026ff3
push ebx
push dword [ebp - 0x20c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10026ff3
lea eax, [ebp - 0x23c]
push eax
push dword [0x100859a4]
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x23c], ebx
call fcn.10024eb8
pop ecx
pop ecx
mov eax, dword [0x10085994]
mov dword [eax + 0x28], 0x36ee80
mov ecx, dword [0x10085994]
push 4
call fcn.10022e80
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x10085994]
mov dword [ecx + 0x3c], eax
push ebx
call fcn.10024045
mov dword [ebp - 0x234], eax
pop ecx
mov dword [ebp - 0x230], edx
lea eax, [ebp - 0x234]
jmp 0x10026f52
push 1
push dword [0x100859a4]
call fcn.10024f19
jmp 0x10026f5e
cmp dword [0x10083d60], ebx
jne 0x10027058
call fcn.100105a1
inc dword [ebp - 0x1f4]
mov eax, dword [ebp - 0x1f4]
cdq
idiv dword [ebp - 0x1fc]
test edx, edx
jne 0x10027074
call fcn.1002685c
call fcn.10012fb1
jmp case.default.0x10026ede
lea eax, [ebp - 0xe4]
push eax
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov esi, eax
cmp esi, ebx
jne 0x100270b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x100270b6
call fcn.10021f97
call fcn.10022103
call fcn.100257ba
jmp case.default.0x10026ede
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
xor eax, eax
call fcn.100568ae
pop edi
pop esi
pop ebx
leave
ret 0x10
call fcn.10025959
jmp case.default.0x10026ede
push dword [0x100859a0]
mov ecx, dword [0x10085994]
call fcn.10021338
jmp case.default.0x10026ede
lea eax, [ebp - 0x208]
push eax
push dword [0x100859b8]
call fcn.10024eb8
pop ecx
pop ecx
mov ecx, dword [0x10085fc8]
cmp ecx, ebx
je case.default.0x10026ede
call fcn.1002531b
jmp case.default.0x10026ede
call fcn.10023db8
call fcn.10023e75
jmp case.default.0x10026ede
push dword [0x100859cc]
lea eax, [ebp - 0x3c]
push str.111p_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x10084008]
add esp, 0xc
cmp dword [0x1008401c], 0x10
jae 0x1002715f
mov ecx, 0x10084008
cmp dword [0x10084038], 0x10
mov eax, dword [0x10084024]
jae 0x10027172
mov eax, 0x10084024
push ecx
push eax
push edi
push 0x1006f014
call sym.mnbv.DLL_f
add esp, 0x10
jmp case.default.0x10026ede
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je case.default.0x10026ede
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp case.0x10026ede.10