Function at 0x100357d4
Capabilities:
Create thread
Get common file path

Disassembly:
mov eax, 0x10059840
call fcn.10057d24
sub esp, 0xcc
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10035d00
xor ebx, ebx
cmp byte [ebp + 0x24], bl
je 0x1003589b
mov dword [ebp - 0x20], 0x82a
cmp dword [ebp - 0x20], 0x97b
jle 0x10035872
xor esi, esi
mov edi, ebx
inc esi
mov eax, ebx
mov dword [ebp - 0x18], ebx
mov ecx, ebx
mov dword [ebp - 0x34], ebx
add eax, edi
sar eax, cl
lea ecx, [ebp - 0xa8]
cdq
push edx
push eax
call fcn.10002811
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10035838
mov eax, dword [eax]
push eax
call fcn.100402ca
pop ecx
push ebx
push esi
lea ecx, [ebp - 0xa8]
call fcn.10001571
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x34], ecx
cmp ecx, 0x2d40
jl 0x1003581c
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x75d8
jl 0x10035817
inc edi
cmp edi, 0x91
jl 0x10035812
push 0x1dae
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x20], 0x51e
jge 0x10035dd6
push str.qdzyufqge_qoyqh_vuwjwtn_qjlkct
call fcn.100402ca
pop ecx
jmp 0x10035dd6
mov eax, dword [ebp + 0x2c]
xor esi, esi
mov dword [ebp - 0x34], eax
inc esi
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], 0x12af048
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x204795ed
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x1c], 0x44e0
cmp dword [ebp - 0x1c], 0x475b
jle 0x1003593a
mov edi, ebx
mov dword [ebp - 0x28], ebx
mov eax, ebx
mov dword [ebp - 0x18], ebx
xor eax, edi
mov edi, ebx
mov dword [ebp - 0x24], eax
or eax, edi
lea ecx, [ebp - 0xc0]
cdq
push edx
push eax
call fcn.10002811
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100358fd
mov eax, dword [eax]
push eax
call fcn.100402ca
pop ecx
push ebx
push esi
lea ecx, [ebp - 0xc0]
call fcn.10001571
mov eax, dword [ebp - 0x24]
inc edi
cmp edi, 0x2e2a
jl 0x100358e3
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x205b
jl 0x100358dc
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x10dc
jl 0x100358d7
cmp dword [ebp - 0x1c], 0x4202
jge 0x1003594e
push str.xfev_nznygu_xcvuldbp_uodw_rsbdgrm_xdkulhw_vbk_wowrl
call fcn.100402ca
pop ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], 0x1e60e779
mov dword [ebp - 0x18], ebx
jmp 0x1003596a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x90], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1003595d
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
cmp dword [ebp - 0x14], edx
jg 0x100359de
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
cmp eax, esi
mov eax, dword [ebp - 0x14]
setl cl
xor edx, edx
cmp ecx, eax
setg dl
xor ecx, ecx
mov dword [ebp - 0x8c], edx
mov eax, dword [ebp - 0x14]
cmp edx, eax
mov eax, ebx
setge cl
imul ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x100359e0
mov eax, esi
mov edx, 0x84c5
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x14]
cmp edx, eax
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x50], ebx
setg cl
xor eax, eax
mov dword [ebp - 0x24], ecx
mov word [ebp - 0x60], ax
push 4
pop eax
push eax
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], eax
call fcn.100013fd
mov byte [ebp - 4], 5
mov dword [ebp - 0x18], 0xa32b1cec
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x20], 0x48cb
cmp dword [ebp - 0x20], 0x4c27
jle 0x10035a75
mov edi, ebx
mov eax, edi
mov dword [ebp - 0x28], 0x4b14
mov dword [ebp - 0x1c], eax
mov esi, eax
mov ebx, 0x4a79
mov eax, esi
mov ecx, 0x10073b38
cdq
push edx
push eax
call fcn.10004192
dec esi
dec ebx
jne 0x10035a4a
mov eax, dword [ebp - 0x1c]
dec eax
dec dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
jne 0x10035a43
inc edi
cmp edi, 0x400f
jl 0x10035a37
xor esi, esi
inc esi
mov byte [ebp - 4], 6
cmp dword [ebp - 0x20], 0x45c0
jge 0x10035ab2
mov edx, str.sewpmixlv_zktsa_bamy_joplif_mwkzkgaln_cwgigm_amxjxtru_xafgte
mov ecx, 0x10073b38
call fcn.10005a51
jmp 0x10035ab2
lea eax, [ebp - 0x74]
mov dword [ebp - 4], 5
push eax
lea edx, [ebp - 0x68]
call fcn.1003757e
mov dword [ebp - 0x18], 3
pop ecx
cmp dword [ebp - 0x18], ebx
jl 0x10035af8
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x10035ae5
push ebx
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ecx
mov edx, 0xd88
xor cl, cl
call fcn.10035204
dec dword [ebp - 0x18]
pop ecx
jns 0x10035ad2
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 4
call fcn.10001439
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x34]
ja 0x10035b2e
mov ecx, dword [ebp + 0x28]
lea eax, [ebp - 0x60]
cmp ecx, eax
je 0x10035b1f
push 0xffffffffffffffff
push ebx
push eax
call fcn.10001603
push ebx
push esi
lea ecx, [ebp - 0x60]
call fcn.100016dd
jmp 0x10035dd6
push ecx
push ecx
xor dl, dl
call fcn.1003478d
mov dword [ebp - 0x1c], 0x2875
cmp dword [ebp - 0x1c], 0x29ca
pop ecx
pop ecx
jle 0x10035b76
mov edi, ebx
mov esi, ebx
mov eax, edi
mov ecx, 0x10073b38
cdq
idiv esi
mov eax, edx
cdq
push edx
push eax
call fcn.10004192
inc esi
cmp esi, 0x3675
jl 0x10035b4d
inc edi
cmp edi, 0x54e3
jl 0x10035b4b
xor esi, esi
inc esi
push 0x3e23
push esi
lea eax, [ebp - 0x34]
push eax
push 0x3088
push ebx
push esi
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x3c]
call fcn.10035418
add esp, 0x18
mov byte [ebp - 4], 8
cmp dword [ebp - 0x1c], 0x252c
jge 0x10035bd2
mov edx, str.izuktolni_zhvwoww_zkhfqrzmd_rtmhbhfc_zlg_nxlvlf_xwio_jax_rtdejz_fhnk_zhhq_badckonl
mov ecx, 0x10073b38
call fcn.10005a51
jmp 0x10035bd2
mov dword [ebp - 4], 4
mov dword [ebp - 0x14], ebx
jmp 0x10035bec
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x30], 0x17571177
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10035bde
mov dword [ebp - 0x14], ebx
jmp 0x10035c04
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x80], 0xdbeccce1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10035bf6
mov dword [ebp - 0x30], ebx
jmp 0x10035cbb
mov dword [ebp - 0x14], 0xfffffffd
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x10035cb8
push 4
lea ecx, [ebp - 0x48]
call fcn.100013fd
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0xa
push eax
push 0x24e7
push esi
lea eax, [ebp - 0x64]
mov edx, 0x28d1
push 0x37b7
push eax
xor cl, cl
call fcn.10036c49
mov eax, dword [ebp - 0x48]
add esp, 0x14
mov dword [eax + 0xc], 2
jmp 0x10035c99
mov dword [ebp - 0x24], 0xfffffffc
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 0x14]
cmp eax, 0x71f0
mov eax, dword [ebp - 0x80]
setle cl
xor edx, edx
cmp ecx, dword [edi]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x30]
dec dword [edi]
mov edi, dword [ebp - 0x48]
add edi, 0xc
cmp dword [edi], ebx
jge 0x10035c65
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 4
call fcn.10001439
dec dword [ebp - 0x14]
jns 0x10035c29
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xf
jne 0x10035c12
push 0x22cb
push 0x6767
push esi
push esi
push 0xc0c
push 0x52a4
lea eax, [ebp - 0x3c]
mov edx, 0x6ca
push eax
lea eax, [ebp - 0x60]
xor cl, cl
push eax
lea eax, [ebp - 0x34]
push eax
push 0x175e
call fcn.100357d4
add esp, 0x28
jmp 0x10035b0c
cmp byte [ebp + 0x20], 0
je 0x10035dc5
mov dword [ebp - 0x20], 0x34ea
cmp dword [ebp - 0x20], 0x379a
jle 0x10035d85
xor ebx, ebx
push ebx
push 0x61b
push ebx
push ebx
push 0x10e8
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, ebx
xor esi, esi
mov dword [ebp - 0x28], edi
inc esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], 0x69a8
mov eax, edi
lea ecx, [ebp - 0xd8]
cdq
push edx
push eax
call fcn.10002811
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10035d5c
mov eax, dword [eax]
push eax
call fcn.100402ca
pop ecx
push ebx
push esi
lea ecx, [ebp - 0xd8]
call fcn.10001571
dec edi
dec dword [ebp - 0x1c]
jne 0x10035d42
mov edi, dword [ebp - 0x28]
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x26d5
jl 0x10035d38
cmp dword [ebp - 0x20], 0x3392
jge 0x10035d99
push str.vvvxy_xyfyqujuq_yqqa_qanjthlwk_mxsmnroo_jlacv_tufaevarx_hllyzlp
call fcn.100402ca
pop ecx
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
jmp 0x10035dbd
mov ecx, dword [esi]
lea eax, [ecx + 2]
mov dword [esi], eax
call fcn.10034391
mov ecx, dword [ebp + 0x10]
movzx eax, ax
push eax
call fcn.100090a5
mov eax, dword [esi]
cmp eax, dword [edi]
jb 0x10035da5
jmp 0x10035dd6
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [eax], ecx
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret