Function at 0x1024fcc
Capabilities:
Accept command line arguments
Delete registry key
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 1
xor ebx, ebx
push ebx
push 0x10255c8
push reloc.SHELL32.dll_SHChangeNotifyRegister
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1055688
xor eax, eax
cmp dword [ebp - 0x40], ebx
sete al
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
cmp dword [ebp - 0x44], ebx
jne 0x1025030
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov esi, 0x10b2378
push esi
call fcn.01030b7f
push 0x10255a8
mov dword [0x10b10b0], 0x10253f8
mov dword [0x10b1088], esi
call fcn.010311dc
push 0x10b2478
push 0x10b24a8
push 0x100e878
push 0x10253b8
call fcn.01030c89
lea eax, [ebp - 0x34]
push eax
mov edi, 0x102556c
push edi
push 0x1015358
mov esi, SHChangeNotifyRegister
push esi
mov dword [ebp - 0x34], ebx
call fcn.0101922b
cmp dword [ebp - 0x34], ebx
je 0x10556ba
mov edi, SHChangeNotifyRegister
cmp dword [0x10b24cc], ebx
je 0x10250f9
mov al, byte [0x10b24d0]
cmp al, 4
jb 0x1025395
mov eax, dword [0x10b24b8]
mov ecx, dword [0x10b24bc]
mov edx, 0x4010000
and eax, edx
and ecx, edi
or eax, ecx
je 0x10250f9
mov eax, dword [0x10b24c0]
mov ecx, eax
and ecx, edx
mov edx, dword [0x10b24c4]
and edx, edi
cmp ecx, eax
jne 0x10250f9
cmp edx, dword [0x10b24c4]
jne 0x10250f9
push 0x10253c8
push dword [0x10b247c]
push dword [0x10b2478]
call fcn.0100e7c9
push ebx
push ebx
push 0x1025440
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push dword [ebp - 0x28]
call fcn.01033131
mov eax, dword [ebp - 0x28]
push ebx
push eax
push ebx
mov ecx, 0x10b23c8
mov dword [0x10b10b4], eax
call fcn.0103257e
test eax, eax
jl 0x10558dd
push ebx
push ebx
call fcn.01020e96
push 0x10b244c
push 0x1015358
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x24], ebx
call fcn.010326ad
mov esi, eax
cmp esi, 1
jne 0x102519b
push 0x1025408
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x102518a
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.01025639
mov esi, eax
neg esi
sbb esi, esi
and esi, 2
add esi, 3
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_899]
cmp esi, 3
jne 0x10556d3
cmp dword [0x10b24cc], ebx
je 0x1025210
mov al, byte [0x10b24d0]
cmp al, 4
jb 0x10253a2
mov eax, dword [0x10b24b8]
mov ecx, dword [0x10b24bc]
mov edx, 0x2010000
mov esi, 0x80010000
and eax, edx
and ecx, esi
or eax, ecx
je 0x1025210
mov eax, dword [0x10b24c0]
mov ecx, eax
and ecx, edx
mov edx, dword [0x10b24c4]
and edx, esi
cmp ecx, eax
jne 0x1025210
cmp edx, dword [0x10b24c4]
jne 0x1025210
push 0x10253e8
push dword [0x10b247c]
push dword [0x10b2478]
call fcn.0100e7c9
xor esi, esi
inc esi
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_188]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
call fcn.01030ba7
push ebx
push 0x12
push 0x12
push ebx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
call fcn.01032469
push ebx
mov dword [ebp - 0x38], eax
call dword [sym.imp.ole32.dll_OleInitialize]
mov dword [ebp - 0x30], eax
call fcn.01030d9f
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_660]
call fcn.0102fea5
call fcn.0102f750
call fcn.01030155
call fcn.010301c1
call fcn.010303bd
call fcn.0102f6f5
call fcn.0102ff3f
call fcn.0102fe21
push ebx
call fcn.0102f9f6
call sub.EXPLORERFRAME.dll_Ordinal_110
lea ecx, [ebp - 0x50]
call fcn.0102fdc9
call fcn.01025639
test eax, eax
jne 0x105581f
call fcn.010256f9
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x24], ebx
je 0x10252bd
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x28], ebx
je 0x10558a5
push ebx
push esi
push 0x590
push dword [0x10b10f0]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.010273ba
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push reloc.SHLWAPI.dll_SHLockShared
push 0x1002cd0
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
lea eax, [ebp - 0x24]
push eax
push 0x10266a8
push esi
push ebx
push 0x10266e8
mov dword [ebp - 0x24], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1025328
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push 0x1025624
push eax
call dword [ecx + 0xc]
cmp dword [0x10b24cc], ebx
je 0x10253af
mov al, byte [0x10b24d0]
cmp al, 4
jb 0x1055827
mov eax, dword [0x10b24b8]
mov ecx, dword [0x10b24bc]
mov esi, 0x4010000
and eax, esi
and ecx, edi
or eax, ecx
je 0x1025388
mov eax, dword [0x10b24c0]
mov edx, dword [0x10b24c4]
mov ecx, eax
and ecx, esi
and edx, edi
cmp ecx, eax
jne 0x1025388
cmp edx, dword [0x10b24c4]
jne 0x1025388
push 0x10253d8
push dword [0x10b247c]
push dword [0x10b2478]
call fcn.0100e7c9
push dword [ebp - 0x28]
call sub.SHELL32.dll_Ordinal_201
jmp 0x1055834
cmp al, bl
je 0x10250ae
jmp 0x10250f9
cmp al, bl
je 0x10251c0
jmp 0x1025210
mov esi, 0x4010000
jmp 0x1025388
lea eax, [ebp - 0x40]
push eax
push 0x1055994
push ebx
push dword [ebp - 0x2c]
call fcn.0101922b
lea eax, [ebp - 0x44]
push eax
push 0x1055958
push ebx
push dword [ebp - 0x2c]
call fcn.0101922b
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1025011
push ebx
call fcn.0108131b
push 1
push edi
push 0x1015358
push esi
call fcn.0107bfd3
jmp 0x1025094
cmp dword [ebp - 0x24], ebx
je 0x10556ea
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
cmp esi, 5
jne 0x1055708
call fcn.0106d9b5
jmp 0x10558d3
call fcn.01019281
cmp eax, ebx
mov dword [ebp - 0x30], eax
jl 0x10558d3
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
lea ecx, [ebp - 0x20]
push ecx
push eax
call fcn.0106d41b
test eax, eax
je 0x1055812
call fcn.01030d9f
cmp esi, 4
jne 0x1055789
lea eax, [ebp - 0x24]
push eax
push 0x10266a8
push 1
push ebx
push 0x10266e8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1055809
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x1055784
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x24]
jmp 0x1055803
lea eax, [ebp - 0x28]
push eax
push 0x1055948
push 1
push ebx
push 0x10559d8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1055809
push 0x40
lea eax, [ebp - 0x90]
push ebx
push eax
mov dword [ebp - 0x94], 0x44
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
test byte [ebp - 0x68], 1
lea edi, [ebp - 0x38]
mov dword [ebp - 0x3c], ebx
stosd dword es:[edi], eax
je 0x10557e2
movzx ecx, word [ebp - 0x64]
jmp 0x10557e5
push 0xa
pop ecx
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
push ecx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp - 0x18]
push dword [ebp - 0x20]
push 0x10559c8
push eax
call dword [edx + 0xc]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x20]
call dword [sym.imp.SHELL32.dll_ILFree]
push dword [ebp - 0x30]
call fcn.010192b3
jmp 0x10558d3
mov dword [ebp - 0x28], ebx
jmp 0x10252a6
cmp al, bl
je 0x102533d
jmp 0x10253af
cmp dword [0x10b24cc], ebx
je 0x105588d
mov al, byte [0x10b24d0]
cmp al, 4
jae 0x1055849
cmp al, bl
jne 0x105588d
mov eax, dword [0x10b24b8]
mov ecx, dword [0x10b24bc]
and eax, esi
and ecx, edi
or eax, ecx
je 0x105588d
mov eax, dword [0x10b24c0]
mov ecx, eax
and ecx, esi
mov esi, dword [0x10b24c4]
mov edx, esi
and edx, edi
cmp ecx, eax
jne 0x105588d
cmp edx, esi
jne 0x105588d
push 0x1055938
push dword [0x10b247c]
push dword [0x10b2478]
call fcn.0100e7c9
lea ecx, [ebp - 0x50]
call fcn.0106dbe9
lea eax, [ebp - 0x24]
push eax
call fcn.01002bee
push 1
call fcn.0102f9f6
call sub.EXPLORERFRAME.dll_Ordinal_111
cmp dword [ebp - 0x30], ebx
jl 0x10558b5
call dword [sym.imp.ole32.dll_OleUninitialize]
push dword [ebp - 0x38]
call fcn.010192b3
push ebx
call dword [sym.imp.SHELL32.dll_Ordinal_188]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x50], 0x102fe18
call fcn.0106dbe9
push 0x10b23c8
call fcn.0106db09
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
push eax
call fcn.0106d2cf
call fcn.0107c6dc
mov ecx, 0x10b1460
call fcn.0101a030
push ebx
call fcn.01024d35
push 0x10b2478
call fcn.0106da8c
call fcn.0106d8e4
cmp dword [0x10b3ac0], ebx
pop edi
pop esi
pop ebx
je 0x1055927
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.01001fef
leave
ret 0x10