Function at 0x10002780
Capabilities:
Connect pipe
Create thread
Set file attributes

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x20]
add ebp, 0xffffc99b
push edi
mov edi, eax
add eax, 0xfffffffc
mov dword [esp + 0x1c], eax
xor edi, 5
mov eax, dword [esp + 0x20]
lea edx, [esi - 0x365c]
add eax, 5
mov dword [esp + 0xc], edi
mov dword [esp + 0x18], eax
add eax, 0xb
mov dword [esp + 0x10], edx
cmp ebp, eax
jge 0x10002896
mov edx, dword [esp + 0x28]
mov eax, 0xffe31330
sub eax, dword [edx + 0x20]
add dword [edx + 0x11c], eax
mov ecx, dword [edx + 0x10]
sub ecx, dword [0x10165030]
mov eax, dword [0x10165054]
add eax, 0x80584
add eax, ecx
mov dword [0x10165054], eax
mov ecx, dword [edx + 0x38]
mov eax, dword [0x101650f0]
add ecx, 0x945ae
mov dword [eax + 0x90], ecx
mov eax, dword [edx + 0x140]
add eax, 0xbbf2e
mov dword [0x101650a4], eax
mov eax, dword [0x101650f0]
mov ecx, dword [eax + 0x58]
mov eax, dword [edx + 0x60]
add eax, 0xffee0266
add eax, ecx
mov dword [edx + 0x8c], eax
cmp dword [0x101650c4], 0xfba2
je 0x10002846
mov dword [edx + 0x100], 0x1ae
mov eax, dword [0x101650f0]
mov eax, dword [eax + 0x118]
add eax, dword [edx + 0xfc]
xor eax, 0x1c4331
mov dword [edx + 8], eax
mov ecx, dword [0x101650f0]
mov eax, dword [0x10165018]
cmp eax, dword [ecx + 0x13c]
jne 0x10002889
mov eax, dword [0x10165078]
mov ecx, dword [ecx + 0x94]
add eax, 0x1ab6e6
add eax, ecx
mov dword [0x10165078], eax
pop edi
pop esi
lea eax, [ebp + 0x3665]
pop ebp
add esp, 8
ret
imul eax, edi, 0x3659
xor eax, 0x366d
cmp dword [0x1016504c], eax
jb 0x10002a6b
push ebx
mov ebx, dword [esp + 0x2c]
mov eax, dword [ebx + 0x13c]
mov ecx, eax
or ecx, 0x3659
sub ecx, eax
lea eax, [edx + edi]
push ecx
xor eax, 0x3658
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [esp + 0x1c]
lea edx, [esi - 0x365c]
xor eax, esi
push eax
lea eax, [edi + 0x3652]
push eax
mov eax, dword [ebx + 0xfc]
xor eax, dword [esp + 0x28]
add eax, edx
push eax
mov eax, dword [ebx + 0xc0]
and eax, dword [esp + 0x28]
and eax, 0x3667
push eax
mov eax, dword [0x101650f0]
mov eax, dword [eax + 4]
imul eax, dword [0x10165028]
push eax
mov eax, dword [ebx + 0x128]
or eax, esi
push eax
mov eax, esi
sub eax, dword [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, dword [0x101650f0]
mov ecx, dword [edx + 0x118]
mov eax, ecx
and eax, dword [0x10164ff8]
push eax
lea eax, [esi - 0x365c]
and ecx, eax
mov eax, dword [ebx + 0x90]
xor eax, ebp
add ecx, 0x3656
push ecx
push eax
mov eax, dword [edx + 0x90]
lea ecx, [esi - 0x365c]
xor eax, ebp
push eax
mov eax, ecx
imul eax, ebp
push eax
lea eax, [ecx + esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call esi
mov eax, dword [0x10164fd4]
mov edx, dword [esp + 0x14]
add eax, 0xffffc99c
or eax, 0x366a
push edx
push eax
mov eax, edi
xor eax, 0x366d
push eax
mov eax, dword [esp + 0x28]
imul eax, dword [esp + 0x2c]
push eax
push ebx
call fcn.10002a80
mov ecx, dword [0x1016507c]
add esp, 0x14
imul ecx, dword [esp + 0x10]
mov edi, eax
push ecx
lea ecx, [ebp + 0x3656]
push ecx
mov ecx, dword [ebx + 8]
mov eax, dword [0x101650f0]
or ecx, 0x3664
xor ecx, dword [esp + 0x24]
push ecx
push 0
mov ecx, dword [eax + 0xd0]
sub ecx, dword [eax + 0xc]
mov eax, dword [esp + 0x30]
sub ecx, 0x3659
push ecx
xor eax, ebp
push eax
call esi
mov eax, dword [ebx + 0x94]
imul eax, dword [ebx + 0x88]
mov esi, dword [esp + 0x28]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_ExitThread]
pop edi
pop esi
lea eax, [ebp + 9]
pop ebp
add esp, 8
ret