Function at 0x10001c9c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], 1
call fcn.10001f0c
mov byte [ebp - 8], al
lea eax, [ebp - 4]
push eax
call fcn.100015f7
test eax, eax
pop ecx
jne 0x10001f05
push 0x40
lea edi, [ebp - 0x10f]
pop ecx
mov byte [ebp - 0x110], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x104
lea eax, [ebp - 0x110]
push esi
push eax
push dword [0x10010750]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10001f05
mov eax, dword [ebp - 4]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
add eax, 0x150
push eax
lea eax, [ebp - 0x110]
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x10001dab
cmp byte [ebp - 8], bl
je 0x10001d37
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.10001697
pop ecx
pop ecx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1a], 1
jbe 0x10001d4e
push 6
push dword [ebp - 8]
push eax
call fcn.10001c3f
add esp, 0xc
push esi
lea eax, [ebp - 0x110]
push ebx
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x110]
push esi
push eax
mov eax, dword [ebp - 4]
add eax, 0x160
push eax
call fcn.1000103b
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
je 0x10001f05
push 4
push eax
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp + 8]
push ecx
push ebx
push 0x28
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10001f05
mov eax, dword [ebp - 4]
cmp byte [eax + 0x20], bl
je 0x10001e26
add eax, 0x22
push eax
lea eax, [ebp - 0x110]
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x10001e23
cmp byte [ebp - 8], bl
jne 0x10001f05
cmp dword [ebp + 8], 0x27
jne 0x10001f05
lea eax, [ebp - 0xc]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x1001007c
push 0x80000002
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
cmp esi, ebx
jne 0x10001e1c
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.10001000
pop ecx
pop ecx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10001f07
mov eax, dword [ebp - 4]
cmp byte [eax + 0x298], bl
jne 0x10001e36
cmp byte [eax + 0x322], bl
je 0x10001e43
push eax
call fcn.100027d4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
pop ecx
mov cl, byte [eax + 0x1a]
cmp cl, 1
je 0x10001e5b
cmp cl, bl
je 0x10001e5b
push dword [ebp - 8]
push eax
call fcn.1000197b
pop ecx
jmp 0x10001e63
push dword [ebp - 8]
call fcn.10001fda
mov eax, dword [ebp - 4]
pop ecx
cmp byte [eax + 0x298], bl
je 0x10001e80
cmp dword [ebp - 0xc], ebx
jne 0x10001e77
mov byte [eax + 0x19], bl
push dword [ebp - 4]
call fcn.1000202a
pop ecx
push dword [ebp - 4]
call fcn.10001a54
test eax, eax
pop ecx
je 0x10001f05
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x213]
mov byte [ebp - 0x214], bl
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x214]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x214]
push esi
push eax
push str._shelldoc.dll
call fcn.1000103b
add esp, 0xc
test eax, eax
jne 0x10001ee5
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x80
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.10001c3f
add esp, 0xc
cmp dword [ebp - 0xc], ebx
jne 0x10001f05
push dword [ebp - 4]
call fcn.100022a2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret