Function at 0x1003f780
Capabilities:
Check http status code
Check if file exists
Get common file path
Inspect section memory permissions
Parse pe header
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100f4dba
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2094
call fcn.100d4920
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x2090], eax
push ebx
push esi
push edi
mov eax, dword [0x10139d00]
xor eax, esp
push eax
lea eax, [esp + 0x20a8]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor esi, esi
mov dword [esp + 0x24], esi
push 0x3f
mov dword [esp + 0x20], esi
lea eax, [esp + 0x51]
push esi
mov dword [esp + 0x28], esi
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], esi
mov byte [esp + 0x58], 0
call fcn.100d4cc0
add esp, 0xc
push 0x73c
lea ecx, [esp + 0x90]
push esi
push ecx
call fcn.100d4cc0
add esp, 0xc
cmp ebx, esi
je 0x100423e6
cmp edi, esi
je 0x100423e6
mov dword [0x101dd384], ebx
mov dword [0x101dd388], edi
mov byte [0x101dd380], 0
cmp dword [0x101d36ac], esi
je 0x1003f970
mov dword [0x101d36ac], esi
call fcn.10003800
test al, al
je 0x1003f855
mov byte [0x101e2b89], 1
push 0x7ce
xor esi, esi
lea eax, [esp + 0x10d2]
xor edx, edx
push esi
push eax
mov word [esp + 0x10d8], dx
call fcn.100d4cc0
add esp, 0xc
push 7
push edi
call ebx
push 0x101d9c20
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [0x101debb8]
mov edx, dword [ecx + 4]
push edx
mov ecx, 0x101deba0
call fcn.10044b20
mov eax, dword [0x101debb8]
mov dword [eax + 4], eax
mov eax, dword [0x101debb8]
mov dword [0x101debbc], esi
mov dword [eax], eax
mov eax, dword [0x101debb8]
mov dword [eax + 8], eax
mov eax, dword [0x101deb94]
mov ecx, dword [eax + 4]
push ecx
mov ecx, 0x101deb7c
call fcn.10044b20
mov eax, dword [0x101deb94]
mov dword [eax + 4], eax
mov eax, dword [0x101deb94]
mov dword [0x101deb98], esi
mov dword [eax], eax
mov eax, dword [0x101deb94]
mov dword [eax + 8], eax
call fcn.1002c0c0
lea eax, [esp + 0x10cc]
mov ecx, edi
mov edx, eax
mov esi, 0x7d0
sub ecx, edx
nop
lea edx, [esi + 0x7ffff82e]
test edx, edx
je 0x1003f920
movzx edx, word [eax + ecx]
test dx, dx
je 0x1003f920
mov word [eax], dx
add eax, 2
sub esi, 1
jne 0x1003f900
jmp 0x1003f924
test esi, esi
jne 0x1003f927
sub eax, 2
lea edx, [esp + 0x10cc]
xor ecx, ecx
push edx
mov word [eax], cx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x10cc]
call fcn.1002cd60
lea eax, [esp + 0x10cc]
call fcn.10034c90
call fcn.10022e40
call fcn.10035500
test al, al
jne 0x1003f9a7
call fcn.1002dab0
test eax, eax
jne 0x1003f9a7
push 9
push edi
call ebx
xor esi, esi
cmp dword [0x101e2cc0], esi
je 0x100401ed
lea edx, [esp + 0x4c]
push edx
call sym.TeslaCryptDecoder.dll_GetVirusInfo
add esp, 4
call fcn.10022e40
lea eax, [esp + 0x4c]
push edi
push eax
call fcn.10023830
add esp, 8
test al, al
jne 0x1003f9e7
call fcn.100230d0
jmp 0x1003f9ec
lea eax, [esp + 0x4c]
push eax
call sym.TeslaCryptDecoder.dll_GetVirusInfo
lea ecx, [esp + 0x50]
add esp, 4
push ecx
call fcn.100237a0
add esp, 4
test al, al
je 0x1003f9d6
mov dword [0x101e2cc0], 1
call fcn.100230d0
jmp 0x1003f96e
push 8
push edi
call ebx
call fcn.100230d0
xor eax, eax
jmp 0x100423e9
push 3
push edi
call ebx
push 1
push edi
call ebx
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x50]
call fcn.10023280
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, esi
je 0x1004012d
mov ecx, dword [esp + 0x20]
cmp ecx, 1
jne 0x1003fc34
mov cl, byte [0x101dd380]
test cl, cl
jne 0x1004012d
mov al, byte [0x101dd358]
mov dword [0x101d9c18], esi
test al, al
jne 0x1003fa48
push 0xc
push edi
call ebx
mov cl, byte [0x101dd380]
mov al, byte [0x101dd358]
mov ebx, dword [esp + 0x1c]
jmp 0x1003fa55
mov al, byte [0x101dd358]
cmp dword [0x101d9c18], 1
mov esi, 0xf
jne 0x1003fac1
test al, al
jne 0x1003fac5
test cl, cl
jne 0x1003fb0f
push 1
push edi
call dword [esp + 0x1c]
push 0
push 0
push 0x101d9c38
push 0x101d9e40
call ebx
test al, al
je 0x1003faae
push 3
push 0
push 0
push 0
call ebx
push 1
push 0x101dd568
push 0
push edi
call ebx
xor edx, edx
cmp al, 1
setne dl
add edx, 4
mov esi, edx
jmp 0x1003fb14
movzx esi, byte [0x101dd380]
neg esi
sbb esi, esi
and esi, 0xfffffff6
add esi, 0xf
jmp 0x1003fb14
test al, al
je 0x1003fb0b
cmp dword [esp + 0x4c], 0x6e65704f
jne 0x1003fafc
cmp byte [esp + 0x50], 0x4d
jne 0x1003fafc
cmp byte [esp + 0x51], 0x65
jne 0x1003fafc
push 1
push 0x101dd568
push 0
push edi
call ebx
cmp al, 1
jne 0x1003faf4
mov esi, 4
jmp 0x1003fb14
mov cl, byte [0x101dd380]
jmp 0x1003fb06
mov dword [0x101dd358], 0
mov esi, 5
test cl, cl
je 0x1003fb14
mov esi, 5
mov dword [0x101d9c18], 0
cmp esi, 5
jne 0x1003fb7e
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x50]
call fcn.1002f350
lea ecx, [esp + 0x10]
push ecx
push 0x101deba0
mov dword [esp + 0x20b8], 0
call fcn.10044440
inc dword [eax + 4]
add eax, 4
mov dword [esp + 0x20b0], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1003fbc1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x1003fbc1
cmp esi, 4
jne 0x1003fbc1
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x50]
call fcn.1002f350
lea edx, [esp + 0x20]
push edx
push 0x101deba0
mov dword [esp + 0x20b8], 1
call fcn.10044440
inc dword [eax]
lea eax, [esp + 0x20]
mov dword [esp + 0x20b0], 0xffffffff
call fcn.10020510
push esi
push edi
call dword [esp + 0x1c]
mov cl, byte [0x101dd380]
test cl, cl
jne 0x1003fbe6
cmp esi, 0xf
je 0x1003fa50
call fcn.100230d0
xor eax, eax
jmp 0x100423e9
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x50]
call fcn.1002f350
lea ecx, [esp + 0x10]
push ecx
push 0x101deba0
mov dword [esp + 0x20b8], 2
call fcn.10044440
inc dword [eax + 4]
add eax, 4
lea eax, [esp + 0x10]
mov dword [esp + 0x20b0], 0xffffffff
call fcn.10020510
call fcn.100230d0
xor eax, eax
jmp 0x100423e9
cmp ecx, esi
je 0x1003ffbc
cmp ecx, 2
jne 0x1004012d
push 0x800
lea edx, [esp + 0x8d0]
push 0
push edx
call fcn.100d4cc0
add esp, 0xc
push 0
push 0x1a
lea eax, [esp + 0x8d4]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.360Decryptor_PrivateKey.ini
mov esi, 0x800
lea ebx, [esp + 0x8d0]
call fcn.10004120
push 0x400
lea ecx, [esp + 0x1ca0]
push 0
push ecx
call fcn.100d4cc0
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0xc
mov edx, ebx
push edx
push 0x400
lea eax, [esp + 0x1ca4]
push eax
push 0x10128b0a
push str.UPLOADING
push str.Gryphon
call esi
test eax, eax
je 0x1004009f
push 0x400
lea ecx, [esp + 0x18a0]
push 0
push ecx
call fcn.100d4cc0
add esp, 0xc
cmp byte [0x101e2d04], 0
jne 0x1004007f
mov edx, ebx
push edx
push 0x400
lea eax, [esp + 0x18a4]
push eax
push 0x10128b0a
push 0x1012f1f8
push str.Gryphon
mov byte [0x101e2d04], 1
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x1012c8e4
lea ecx, [esp + 0x1ca0]
push ecx
call ebx
test eax, eax
jne 0x10040078
push 0x800
push eax
lea edx, [esp + 0x8d4]
push edx
call fcn.100d4cc0
mov ecx, dword [0x101dd35c]
add esp, 0xc
push 0x400
lea eax, [esp + 0x8d0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x8cc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str...360NetBase.dll
mov eax, 0x800
lea edi, [esp + 0x8d0]
call fcn.100044f0
mov eax, edi
push eax
call fcn.10007240
mov ecx, eax
call fcn.10007320
test eax, eax
je 0x1003f9e0
call fcn.10007130
mov esi, eax
test esi, esi
je 0x1003f9e0
call fcn.10007110
lea ecx, [esp + 0x189c]
push ecx
lea edx, [esp + 0x10d0]
push str.https:__inf.safe.360.cn_api_key_key_s
push edx
mov edi, eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x1388
push 0x9c
push esi
mov dword [esp + 0x2c], 0
call fcn.100070d0
add esp, 0xc
push 0x1388
push 0x9b
push esi
call fcn.100070d0
add esp, 0xc
lea eax, [esp + 0x10cc]
push eax
push 0x2712
push esi
call fcn.100070d0
add esp, 0xc
push 0
push 0x34
push esi
call fcn.100070d0
add esp, 0xc
push 1
push 0x50
push esi
call fcn.100070d0
add esp, 0xc
push 0
push 0x40
push esi
call fcn.100070d0
add esp, 0xc
push 0
push 0x51
push esi
call fcn.100070d0
add esp, 0xc
push edi
push 0x2727
push esi
call fcn.100070d0
add esp, 0xc
push 0x1003ebd0
push 0x4e2b
push esi
call fcn.100070d0
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
push 0x2711
push esi
call fcn.100070d0
add esp, 0xc
push 0
push 0x51
push esi
call fcn.100070d0
add esp, 0xc
push 0
push 0x40
push esi
call fcn.100070d0
add esp, 0xc
push esi
call fcn.100070b0
add esp, 4
lea edx, [esp + 0x24]
push edx
push 0x200002
push esi
mov dword [esp + 0x30], 0
call fcn.10007080
add esp, 0xc
test eax, eax
jne 0x1004008d
cmp dword [esp + 0x24], 0xc8
jne 0x1004008d
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10040074
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x10040069
mov eax, dword [esp + 0x20]
push str.null
push eax
call ebx
test eax, eax
je 0x10040069
push 0x800
lea ecx, [esp + 0x8d0]
push 0
push ecx
call fcn.100d4cc0
add esp, 0xc
push 0
push 0x1a
lea edx, [esp + 0x8d4]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.360Decryptor_PrivateKey.ini
mov esi, 0x800
lea ebx, [esp + 0x8d0]
call fcn.10004120
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, ebx
push eax
push 0
push 0x1012c8ec
push str.Gryphon
call esi
mov edx, dword [esp + 0x20]
mov ecx, ebx
push ecx
push edx
push 0x1012c8ec
push str.Gryphon
call esi
mov eax, ebx
push eax
push 0x10128b0a
push str.UPLOADING
push str.Gryphon
call esi
push 4
push 0
push 0
push 0
call dword [esp + 0x2c]
test al, al
je 0x10040069
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [esp + 0x10]
push 0x15
push edx
call dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
xor esi, esi
push 1
push 0x101dd568
push esi
push edi
call eax
lea ecx, [esp + 0x4c]
cmp al, 1
jne 0x1004001a
lea eax, [esp + 0x10]
push eax
call fcn.1002f350
lea ecx, [esp + 0x10]
push ecx
push 0x101deba0
mov dword [esp + 0x20b8], 3
call fcn.10044440
inc dword [eax]
lea eax, [esp + 0x10]
mov dword [esp + 0x20b0], 0xffffffff
call fcn.10020510
push 4
push edi
call ebx
call fcn.100230d0
xor eax, eax
jmp 0x100423e9
lea edx, [esp + 0x10]
push edx
call fcn.1002f350
lea eax, [esp + 0x10]
push eax
push 0x101deba0
mov dword [esp + 0x20b8], 4
call fcn.10044440
inc dword [eax + 4]
add eax, 4
lea eax, [esp + 0x10]
mov dword [esp + 0x20b0], 0xffffffff
call fcn.10020510
push 5
push edi
call ebx
call fcn.100230d0
xor eax, eax
jmp 0x100423e9
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, dword [esp + 0x10]
push 0x14
push edi
call dword [esp + 0x1c]
push 0x16
push edi
call dword [esp + 0x1c]
xor eax, eax
jmp 0x100423e9
mov edx, dword [esp + 0x10]
push 0x13
push edx
call dword [esp + 0x1c]
xor eax, eax
jmp 0x100423e9
push 0x10
push edi
mov dword [0x101d9c18], 0
call dword [esp + 0x1c]
cmp dword [0x101d9c18], 1
jne 0x10040113
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp byte [0x101dd358], 0
jne 0x1004011c
cmp byte [0x101dd380], 0
jne 0x10040126
push 0x101d9c38
call esi
test eax, eax
je 0x10040103
push 0x101d9e40
call esi
test eax, eax
je 0x10040103
push 0x101d9e40
call ebx
test eax, eax
je 0x10040103
push 0x101d9c38
call ebx
test eax, eax
jne 0x10040139
push 0x11
push edi
call dword [esp + 0x1c]
cmp dword [0x101d9c18], 1
je 0x100400c5
cmp byte [0x101dd358], 0
je 0x10040126
mov dword [0x101dd358], 0
push 5
push edi
call dword [esp + 0x1c]
call fcn.100230d0
xor eax, eax
jmp 0x100423e9
lea eax, [esp + 0x28]
push eax
call fcn.10034180
mov dword [esp + 0x20b0], 5
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x8cc]
mov dword [esp + 0x48], ecx
mov esi, edi
mov ecx, eax
mov edx, 0x800
sub esi, ecx
jmp 0x10040170
lea ecx, [edx + 0x7ffff7fe]
test ecx, ecx
je 0x10040190
movzx ecx, word [esi + eax]
test cx, cx
je 0x10040190
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10040170
jmp 0x10040194
test edx, edx
jne 0x10040197
sub eax, 2
xor edx, edx
mov word [eax], dx
lea eax, [esp + 0x8cc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [esp + 0x8cc]
lea ecx, [esp + 0x28]
call fcn.10033110
lea ecx, [esp + 0x4c]
push ecx
mov ecx, edi
lea edx, [esp + 0x2c]
call fcn.10033b50
call fcn.100343c0
push 0x12
push edi
call dword [esp + 0x1c]
lea esi, [esp + 0x28]
mov byte [0x101e2d04], 1
call fcn.10039e00
xor eax, eax
jmp 0x100423e9
mov ecx, edi
call fcn.10043f00
mov dword [esp + 0x10], eax
cmp eax, 0x6d
jne 0x10040274
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003ca30
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x1004024c
lea edx, [esp + 0x14]
push edx
mov ecx, str.BtcRansomware
call fcn.1002f350
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20b4], 6
mov ebx, 1
push 0x101deba0
mov dword [esp + 0x2c], ebx
call fcn.10044440
jmp 0x10040cd5
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.BtcRansomware
call fcn.1002f350
mov ebx, 2
mov dword [esp + 0x20b0], 7
mov dword [esp + 0x24], ebx
jmp 0x10040cc3
cmp eax, 0x6c
jne 0x100402eb
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003c900
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, str.Plantery
test eax, eax
jne 0x100402c8
lea eax, [esp + 0x14]
push eax
call fcn.1002f350
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x20b4], 8
mov ebx, 4
push 0x101deba0
mov dword [esp + 0x2c], ebx
call fcn.10044440
jmp 0x10040d75
lea edx, [esp + 0x10]
push edx
call fcn.1002f350
mov ebx, 8
mov dword [esp + 0x20b0], 9
mov dword [esp + 0x24], ebx
jmp 0x10040d63
cmp eax, 0x6b
jne 0x10040367
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003c7c0
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x1004033f
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.PokeMonGo
call fcn.1002f350
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x20b4], 0xa
mov ebx, 0x10
push 0x101deba0
mov dword [esp + 0x2c], ebx
call fcn.10044440
jmp 0x10040e32
lea eax, [esp + 0x10]
push eax
mov ecx, str.PokeMonGo
call fcn.1002f350
mov ebx, 0x20
mov dword [esp + 0x20b0], 0xb
mov dword [esp + 0x24], ebx
jmp 0x10040e20
cmp eax, 0x6a
jne 0x100403e8
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003cb70
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x100403bb
lea edx, [esp + 0x14]
push edx
mov ecx, str.SadRansomware
call fcn.1002f350
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20b4], 0xc
mov ebx, 0x40
push 0x101deba0
mov dword [esp + 0x2c], ebx
call fcn.10044440
jmp 0x10041aa3
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.SadRansomware
call fcn.1002f350
mov ebx, 0x80
lea edx, [esp + 0x10]
mov dword [esp + 0x20b0], 0xd
mov dword [esp + 0x24], ebx
push edx
jmp 0x10041a96
cmp eax, 0x69
jne 0x10040491
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003c690
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, str.PewCrypt
test eax, eax
jne 0x1004043d
lea eax, [esp + 0x14]
push eax
call fcn.1002f350
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x20b4], 0xe
mov esi, 0x100
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
jmp 0x1004046d
lea edx, [esp + 0x10]
push edx
call fcn.1002f350
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x20b4], 0xf
mov esi, 0x200
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x200
je 0x10040486
lea eax, [esp + 0x10]
and esi, 0xfffffdff
call fcn.10020510
test esi, 0x100
jmp 0x10041abb
cmp eax, 0x68
jne 0x1004053f
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003cca0
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x100404e6
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.QQ1766834247
call fcn.1002f350
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x20b4], 0x10
mov esi, 0x400
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
jmp 0x1004051b
lea eax, [esp + 0x10]
push eax
mov ecx, str.QQ1766834247
call fcn.1002f350
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x20b4], 0x11
mov esi, 0x800
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x800
je 0x10040534
lea eax, [esp + 0x10]
and esi, 0xfffff7ff
call fcn.10020510
test esi, 0x400
jmp 0x10041abb
cmp eax, 0x67
jne 0x100405ed
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003cdd0
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10040594
lea edx, [esp + 0x14]
push edx
mov ecx, str.XDataRansomware
call fcn.1002f350
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20b4], 0x12
mov esi, 0x1000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
jmp 0x100405c9
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.XDataRansomware
call fcn.1002f350
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x20b4], 0x13
mov esi, 0x2000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x2000
je 0x100405e2
lea eax, [esp + 0x10]
and esi, 0xffffdfff
call fcn.10020510
test esi, 0x1000
jmp 0x10041abb
cmp eax, 0x66
jne 0x10040696
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003cf00
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, str.CrazyCrypt
test eax, eax
jne 0x10040642
lea eax, [esp + 0x14]
push eax
call fcn.1002f350
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x20b4], 0x14
mov esi, 0x4000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
jmp 0x10040672
lea edx, [esp + 0x10]
push edx
call fcn.1002f350
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x20b4], 0x15
mov esi, 0x8000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x8000
je 0x1004068b
lea eax, [esp + 0x10]
and esi, 0xffff7fff
call fcn.10020510
test esi, 0x4000
jmp 0x10041abb
cmp eax, 0x65
jne 0x10040744
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003d060
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x100406eb
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.EnCiPhErEd
call fcn.1002f350
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x20b4], 0x16
mov esi, 0x10000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
jmp 0x10040720
lea eax, [esp + 0x10]
push eax
mov ecx, str.EnCiPhErEd
call fcn.1002f350
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x20b4], 0x17
mov esi, 0x20000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x20000
je 0x10040739
lea eax, [esp + 0x10]
and esi, 0xfffdffff
call fcn.10020510
test esi, 0x10000
jmp 0x10041abb
cmp eax, 0x64
jne 0x100407f2
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003d200
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10040799
lea edx, [esp + 0x14]
push edx
mov ecx, str.Israbye
call fcn.1002f350
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20b4], 0x18
mov esi, 0x40000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
jmp 0x100407ce
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.Israbye
call fcn.1002f350
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x20b4], 0x19
mov esi, 0x80000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x80000
je 0x100407e7
lea eax, [esp + 0x10]
and esi, 0xfff7ffff
call fcn.10020510
test esi, 0x40000
jmp 0x10041abb
cmp eax, 0x63
jne 0x1004089b
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003d360
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, str.FileLocker
test eax, eax
jne 0x10040847
lea eax, [esp + 0x14]
push eax
call fcn.1002f350
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x20b4], 0x1a
mov esi, 0x100000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
jmp 0x10040877
lea edx, [esp + 0x10]
push edx
call fcn.1002f350
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x20b4], 0x1b
mov esi, 0x200000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x200000
je 0x10040890
lea eax, [esp + 0x10]
and esi, 0xffdfffff
call fcn.10020510
test esi, 0x100000
jmp 0x10041abb
cmp eax, 0x62
jne 0x10040949
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003d4a0
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x100408f0
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.BenCrypt
call fcn.1002f350
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x20b4], 0x1c
mov esi, 0x400000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
jmp 0x10040925
lea eax, [esp + 0x10]
push eax
mov ecx, str.BenCrypt
call fcn.1002f350
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x20b4], 0x1d
mov esi, 0x800000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x800000
je 0x1004093e
lea eax, [esp + 0x10]
and esi, 0xff7fffff
call fcn.10020510
test esi, 0x400000
jmp 0x10041abb
cmp eax, 0x61
jne 0x10040a37
push 3
push edi
call ebx
push 0xff
lea edx, [esp + 0x7d1]
push 0
push edx
mov byte [esp + 0x7d8], 0
call fcn.100d4cc0
add esp, 0xc
push str.CrandCrabV5
lea eax, [esp + 0x7d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x7cc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x7cc]
dec edx
add eax, edx
push eax
push ebx
mov esi, edi
call fcn.1003c550
add esp, 8
mov dword [esp + 0x18], eax
lea esi, [esp + 0x7cc]
test eax, eax
jne 0x100409e7
lea eax, [esp + 0x14]
push eax
call fcn.100443c0
push eax
mov dword [esp + 0x20b4], 0x1e
mov esi, 0x1000000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
jmp 0x10040a13
lea ecx, [esp + 0x10]
push ecx
call fcn.100443c0
push eax
mov dword [esp + 0x20b4], 0x1f
mov esi, 0x2000000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x2000000
je 0x10040a2c
lea eax, [esp + 0x10]
and esi, 0xfdffffff
call fcn.10020510
test esi, 0x1000000
jmp 0x10041abb
cmp eax, 0x5c
jne 0x10040ae3
push 3
push edi
call ebx
push ebx
call fcn.1003c3b0
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, esi
jne 0x10040a8a
lea edx, [esp + 0x14]
push edx
mov ecx, str.SatanV4
call fcn.1002f350
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20b4], 0x20
mov esi, 0x4000000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
jmp 0x10040abf
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.SatanV4
call fcn.1002f350
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x20b4], 0x21
mov esi, 0x8000000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x8000000
je 0x10040ad8
lea eax, [esp + 0x10]
and esi, 0xf7ffffff
call fcn.10020510
test esi, 0x4000000
jmp 0x10041abb
cmp eax, 0x60
jne 0x10040ba1
push 3
push edi
call ebx
cmp byte [0x101dd381], 0
jne 0x10040b06
push 0x18
push edi
mov byte [0x101dd381], 1
call ebx
push ebx
mov esi, edi
call fcn.1003c270
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, str.CryptNar
test eax, eax
jne 0x10040b4d
lea eax, [esp + 0x14]
push eax
call fcn.1002f350
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x20b4], 0x22
mov esi, 0x10000000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
jmp 0x10040b7d
lea edx, [esp + 0x10]
push edx
call fcn.1002f350
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x20b4], 0x23
mov esi, 0x20000000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x20000000
je 0x10040b96
lea eax, [esp + 0x10]
and esi, 0xdfffffff
call fcn.10020510
test esi, 0x10000000
jmp 0x10041abb
cmp eax, 0x5f
jne 0x10040c4b
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003d5d0
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10040bf6
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.EoEo
call fcn.1002f350
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x20b4], 0x24
mov esi, 0x40000000
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
jmp 0x10040c2b
lea eax, [esp + 0x10]
push eax
mov ecx, str.EoEo
call fcn.1002f350
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x20b4], 0x25
mov esi, SysReAllocString
push 0x101deba0
mov dword [esp + 0x2c], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, esi
jns 0x10040c40
lea eax, [esp + 0x10]
and esi, 0x7fffffff
call fcn.10020510
test esi, 0x40000000
jmp 0x10041abb
cmp eax, 0x5e
jne 0x10040cf0
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003d750
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10040ca0
lea edx, [esp + 0x14]
push edx
mov ecx, str.KeyPass
call fcn.1002f350
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20b4], 0x26
mov ebx, 1
push 0x101deba0
mov dword [esp + 0x24], ebx
call fcn.10044440
jmp 0x10040cd5
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.KeyPass
call fcn.1002f350
mov ebx, 2
mov dword [esp + 0x20b0], 0x27
mov dword [esp + 0x1c], ebx
lea edx, [esp + 0x10]
push edx
push 0x101deba0
call fcn.10044440
add eax, 4
inc dword [eax]
test bl, 2
je 0x10040ce8
lea eax, [esp + 0x10]
and ebx, 0xfffffffd
call fcn.10020510
test bl, 1
jmp 0x10041abb
cmp eax, 0x5d
jne 0x10040d90
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003d890
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, str.Beep
test eax, eax
jne 0x10040d45
lea eax, [esp + 0x14]
push eax
call fcn.1002f350
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x20b4], 0x28
mov ebx, 4
push 0x101deba0
mov dword [esp + 0x24], ebx
call fcn.10044440
jmp 0x10040d75
lea edx, [esp + 0x10]
push edx
call fcn.1002f350
mov ebx, 8
mov dword [esp + 0x20b0], 0x29
mov dword [esp + 0x1c], ebx
lea eax, [esp + 0x10]
push eax
push 0x101deba0
call fcn.10044440
add eax, 4
inc dword [eax]
test bl, 8
je 0x10040d88
lea eax, [esp + 0x10]
and ebx, 0xfffffff7
call fcn.10020510
test bl, 4
jmp 0x10041abb
cmp eax, 0x5b
jne 0x10040e4d
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003d9d0
add esp, 4
cmp byte [0x101dd381], 0
mov dword [esp + 0x18], eax
jne 0x10040dc2
push 0x18
push edi
mov byte [0x101dd381], 1
call ebx
cmp dword [esp + 0x18], 0
jne 0x10040dfd
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.SatanV2
call fcn.1002f350
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x20b4], 0x2a
mov ebx, 0x10
push 0x101deba0
mov dword [esp + 0x24], ebx
call fcn.10044440
jmp 0x10040e32
lea eax, [esp + 0x10]
push eax
mov ecx, str.SatanV2
call fcn.1002f350
mov ebx, 0x20
mov dword [esp + 0x20b0], 0x2b
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x10]
push ecx
push 0x101deba0
call fcn.10044440
add eax, 4
inc dword [eax]
test bl, 0x20
je 0x10040e45
lea eax, [esp + 0x10]
and ebx, 0xffffffdf
call fcn.10020510
test bl, 0x10
jmp 0x10041abb
cmp eax, 0x5a
jne 0x10040ece
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003c0b0
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10040ea1
lea edx, [esp + 0x14]
push edx
mov ecx, 0x1012f0b4
call fcn.1002f350
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20b4], 0x2c
mov ebx, 0x40
push 0x101deba0
mov dword [esp + 0x24], ebx
call fcn.10044440
jmp 0x10041aa3
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x1012f0b4
call fcn.1002f350
mov ebx, 0x80
lea edx, [esp + 0x10]
mov dword [esp + 0x20b0], 0x2d
mov dword [esp + 0x1c], ebx
push edx
jmp 0x10041a96
cmp eax, 0x59
jne 0x10040f9f
push 3
push edi
call ebx
cmp byte [0x101dd381], 0
jne 0x10040ef1
push 0x18
push edi
mov byte [0x101dd381], 1
call ebx
push ebx
mov esi, edi
call fcn.1003bf70
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, str.Paradise
test eax, eax
jne 0x10040f38
lea eax, [esp + 0x14]
push eax
call fcn.1002f350
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x20b4], 0x2e
mov esi, 0x100
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
jmp 0x10040f68
lea edx, [esp + 0x10]
push edx
call fcn.1002f350
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x20b4], 0x2f
mov esi, 0x200
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x200
je 0x10040f81
lea eax, [esp + 0x10]
and esi, 0xfffffdff
call fcn.10020510
test esi, 0x100
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x58
jne 0x10041060
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003db00
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10040ff4
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Thanato
call fcn.1002f350
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x20b4], 0x30
mov esi, 0x400
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
jmp 0x10041029
lea eax, [esp + 0x10]
push eax
mov ecx, str.Thanato
call fcn.1002f350
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x20b4], 0x31
mov esi, 0x800
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x800
je 0x10041042
lea eax, [esp + 0x10]
and esi, 0xfffff7ff
call fcn.10020510
test esi, 0x400
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x57
jne 0x10041121
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003dc30
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x100410b5
lea edx, [esp + 0x14]
push edx
mov ecx, str.LockZip
call fcn.1002f350
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20b4], 0x32
mov esi, 0x1000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
jmp 0x100410ea
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.LockZip
call fcn.1002f350
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x20b4], 0x33
mov esi, 0x2000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x2000
je 0x10041103
lea eax, [esp + 0x10]
and esi, 0xffffdfff
call fcn.10020510
test esi, 0x1000
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x56
jne 0x100411dd
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003dd80
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, str.Ransomcrypt
test eax, eax
jne 0x10041176
lea eax, [esp + 0x14]
push eax
call fcn.1002f350
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x20b4], 0x34
mov esi, 0x4000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
jmp 0x100411a6
lea edx, [esp + 0x10]
push edx
call fcn.1002f350
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x20b4], 0x35
mov esi, 0x8000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x8000
je 0x100411bf
lea eax, [esp + 0x10]
and esi, 0xffff7fff
call fcn.10020510
test esi, 0x4000
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x55
jne 0x100412b3
push 3
push edi
call ebx
cmp byte [0x101dd381], 0
jne 0x10041200
push 0x18
push edi
mov byte [0x101dd381], 1
call ebx
push ebx
mov esi, edi
call fcn.1003dec0
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10041247
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Wood
call fcn.1002f350
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x20b4], 0x36
mov esi, 0x10000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
jmp 0x1004127c
lea eax, [esp + 0x10]
push eax
mov ecx, str.Wood
call fcn.1002f350
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x20b4], 0x37
mov esi, 0x20000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x20000
je 0x10041295
lea eax, [esp + 0x10]
and esi, 0xfffdffff
call fcn.10020510
test esi, 0x10000
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x54
jne 0x10041374
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003dff0
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10041308
lea edx, [esp + 0x14]
push edx
mov ecx, str.BookNish
call fcn.1002f350
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20b4], 0x38
mov esi, 0x40000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
jmp 0x1004133d
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.BookNish
call fcn.1002f350
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x20b4], 0x39
mov esi, 0x80000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x80000
je 0x10041356
lea eax, [esp + 0x10]
and esi, 0xfff7ffff
call fcn.10020510
test esi, 0x40000
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x53
jne 0x10041430
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003e130
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, str.LockDot
test eax, eax
jne 0x100413c9
lea eax, [esp + 0x14]
push eax
call fcn.1002f350
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x20b4], 0x3a
mov esi, 0x100000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
jmp 0x100413f9
lea edx, [esp + 0x10]
push edx
call fcn.1002f350
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x20b4], 0x3b
mov esi, 0x200000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x200000
je 0x10041412
lea eax, [esp + 0x10]
and esi, 0xffdfffff
call fcn.10020510
test esi, 0x100000
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x52
jne 0x100414ed
push 3
push edi
call ebx
mov esi, edi
call fcn.1003be00
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10041481
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Autoit
call fcn.1002f350
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x20b4], 0x3c
mov esi, 0x400000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
jmp 0x100414b6
lea eax, [esp + 0x10]
push eax
mov ecx, str.Autoit
call fcn.1002f350
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x20b4], 0x3d
mov esi, 0x800000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x800000
je 0x100414cf
lea eax, [esp + 0x10]
and esi, 0xff7fffff
call fcn.10020510
test esi, 0x400000
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x51
jne 0x100415ae
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003e2d0
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10041542
lea edx, [esp + 0x14]
push edx
mov ecx, str.Pubg
call fcn.1002f350
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20b4], 0x3e
mov esi, 0x1000000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
jmp 0x10041577
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.Pubg
call fcn.1002f350
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x20b4], 0x3f
mov esi, 0x2000000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x2000000
je 0x10041590
lea eax, [esp + 0x10]
and esi, 0xfdffffff
call fcn.10020510
test esi, 0x1000000
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x50
jne 0x1004167f
push 3
push edi
call ebx
cmp byte [0x101dd381], 0
jne 0x100415d1
push 0x18
push edi
mov byte [0x101dd381], 1
call ebx
push ebx
mov esi, edi
call fcn.1003bcd0
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, str.Lime
test eax, eax
jne 0x10041618
lea eax, [esp + 0x14]
push eax
call fcn.1002f350
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x20b4], 0x40
mov esi, 0x4000000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
jmp 0x10041648
lea edx, [esp + 0x10]
push edx
call fcn.1002f350
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x20b4], 0x41
mov esi, 0x8000000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x8000000
je 0x10041661
lea eax, [esp + 0x10]
and esi, 0xf7ffffff
call fcn.10020510
test esi, 0x4000000
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x4f
jne 0x10041740
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003e400
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x100416d4
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.BansomQara
call fcn.1002f350
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x20b4], 0x42
mov esi, 0x10000000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
jmp 0x10041709
lea eax, [esp + 0x10]
push eax
mov ecx, str.BansomQara
call fcn.1002f350
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x20b4], 0x43
mov esi, 0x20000000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x20000000
je 0x10041722
lea eax, [esp + 0x10]
and esi, 0xdfffffff
call fcn.10020510
test esi, 0x10000000
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x42
jne 0x100417fd
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003af60
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10041795
lea edx, [esp + 0x14]
push edx
mov ecx, str.zongqing
call fcn.1002f350
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20b4], 0x44
mov esi, 0x40000000
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
jmp 0x100417ca
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.zongqing
call fcn.1002f350
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x20b4], 0x45
mov esi, SysReAllocString
push 0x101deba0
mov dword [esp + 0x24], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, esi
jns 0x100417df
lea eax, [esp + 0x10]
and esi, 0x7fffffff
call fcn.10020510
test esi, 0x40000000
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x40
jne 0x100418ae
push 3
push edi
call ebx
mov edx, edi
mov ecx, ebx
call fcn.1003aac0
mov dword [esp + 0x18], eax
mov ecx, str.cryptxxx
cmp eax, esi
jne 0x10041850
lea eax, [esp + 0x14]
push eax
call fcn.1002f350
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x20b4], 0x46
mov ebx, 1
push 0x101deba0
mov dword [esp + 0x28], ebx
call fcn.10044440
jmp 0x10041880
lea edx, [esp + 0x10]
push edx
call fcn.1002f350
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x20b4], 0x47
mov ebx, 2
push 0x101deba0
mov dword [esp + 0x28], ebx
call fcn.10044440
add eax, 4
inc dword [eax]
test bl, 2
je 0x10041893
lea eax, [esp + 0x10]
and ebx, 0xfffffffd
call fcn.10020510
test bl, 1
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x41
jne 0x10041966
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003ac40
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10041903
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.crysis
call fcn.1002f350
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x20b4], 0x48
mov ebx, 4
push 0x101deba0
mov dword [esp + 0x28], ebx
call fcn.10044440
jmp 0x10041938
lea eax, [esp + 0x10]
push eax
mov ecx, str.crysis
call fcn.1002f350
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x20b4], 0x49
mov ebx, 8
push 0x101deba0
mov dword [esp + 0x28], ebx
call fcn.10044440
add eax, 4
inc dword [eax]
test bl, 8
je 0x1004194b
lea eax, [esp + 0x10]
and ebx, 0xfffffff7
call fcn.10020510
test bl, 4
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x43
jne 0x10041a1e
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003b1b0
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x100419bb
lea edx, [esp + 0x14]
push edx
mov ecx, str.Crypt888
call fcn.1002f350
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20b4], 0x4a
mov ebx, 0x10
push 0x101deba0
mov dword [esp + 0x28], ebx
call fcn.10044440
jmp 0x100419f0
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.Crypt888
call fcn.1002f350
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x20b4], 0x4b
mov ebx, 0x20
push 0x101deba0
mov dword [esp + 0x28], ebx
call fcn.10044440
add eax, 4
inc dword [eax]
test bl, 0x20
je 0x10041a03
lea eax, [esp + 0x10]
and ebx, 0xffffffdf
call fcn.10020510
test bl, 0x10
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x49
jne 0x10041ad3
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003b320
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, str.HelloEnCrypt
test eax, eax
jne 0x10041a73
lea eax, [esp + 0x14]
push eax
call fcn.1002f350
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x20b4], 0x4c
mov ebx, 0x40
push 0x101deba0
mov dword [esp + 0x28], ebx
call fcn.10044440
jmp 0x10041aa3
lea edx, [esp + 0x10]
push edx
call fcn.1002f350
mov ebx, 0x80
lea eax, [esp + 0x10]
mov dword [esp + 0x20b0], 0x4d
mov dword [esp + 0x20], ebx
push eax
push 0x101deba0
call fcn.10044440
add eax, 4
inc dword [eax]
test bl, bl
jns 0x10041ab8
lea eax, [esp + 0x10]
and ebx, 0xffffff7f
call fcn.10020510
test bl, 0x40
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x4a
jne 0x10041b94
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003b8d0
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10041b28
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.AllCry
call fcn.1002f350
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x20b4], 0x4e
mov esi, 0x100
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
jmp 0x10041b5d
lea eax, [esp + 0x10]
push eax
mov ecx, str.AllCry
call fcn.1002f350
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x20b4], 0x4f
mov esi, 0x200
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x200
je 0x10041b76
lea eax, [esp + 0x10]
and esi, 0xfffffdff
call fcn.10020510
test esi, 0x100
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x4b
jne 0x10041c55
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003ba20
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10041be9
lea edx, [esp + 0x14]
push edx
mov ecx, 0x1012f19c
call fcn.1002f350
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20b4], 0x50
mov esi, 0x400
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
jmp 0x10041c1e
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x1012f19c
call fcn.1002f350
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x20b4], 0x51
mov esi, 0x800
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x800
je 0x10041c37
lea eax, [esp + 0x10]
and esi, 0xfffff7ff
call fcn.10020510
test esi, 0x400
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x4e
jne 0x10041d11
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003e540
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, str.CrandCrab
test eax, eax
jne 0x10041caa
lea eax, [esp + 0x14]
push eax
call fcn.1002f350
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x20b4], 0x52
mov esi, 0x1000
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
jmp 0x10041cda
lea edx, [esp + 0x10]
push edx
call fcn.1002f350
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x20b4], 0x53
mov esi, 0x2000
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x2000
je 0x10041cf3
lea eax, [esp + 0x10]
and esi, 0xffffdfff
call fcn.10020510
test esi, 0x1000
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x4c
jne 0x10041de7
push 3
push edi
call ebx
cmp byte [0x101dd381], 0
jne 0x10041d34
push 0x18
push edi
mov byte [0x101dd381], 1
call ebx
push ebx
mov esi, edi
call fcn.1003bb70
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10041d7b
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Xiaoba
call fcn.1002f350
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x20b4], 0x54
mov esi, 0x4000
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
jmp 0x10041db0
lea eax, [esp + 0x10]
push eax
mov ecx, str.Xiaoba
call fcn.1002f350
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x20b4], 0x55
mov esi, 0x8000
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x8000
je 0x10041dc9
lea eax, [esp + 0x10]
and esi, 0xffff7fff
call fcn.10020510
test esi, 0x4000
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x4d
jne 0x10041ea8
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003e670
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10041e3c
lea edx, [esp + 0x14]
push edx
mov ecx, str.Xiaobasb
call fcn.1002f350
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20b4], 0x56
mov esi, 0x10000
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
jmp 0x10041e71
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.Xiaobasb
call fcn.1002f350
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x20b4], 0x57
mov esi, 0x20000
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x20000
je 0x10041e8a
lea eax, [esp + 0x10]
and esi, 0xfffdffff
call fcn.10020510
test esi, 0x10000
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x20
je 0x100422d3
cmp eax, 1
je 0x100422d3
cmp eax, 0x46
jne 0x10041f76
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003b620
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, str.noobcrypt3
test eax, eax
jne 0x10041f0f
lea eax, [esp + 0x14]
push eax
call fcn.1002f350
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x20b4], 0x5f
mov esi, 0x100000
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
jmp 0x10041f3f
lea edx, [esp + 0x10]
push edx
call fcn.1002f350
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x20b4], 0x60
mov esi, 0x200000
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x200000
je 0x10041f58
lea eax, [esp + 0x10]
and esi, 0xffdfffff
call fcn.10020510
test esi, 0x100000
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x45
jne 0x10042037
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003b490
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10041fcb
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.HiddenTearsV1
call fcn.1002f350
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x20b4], 0x61
mov esi, 0x400000
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
jmp 0x10042000
lea eax, [esp + 0x10]
push eax
mov ecx, str.HiddenTearsV1
call fcn.1002f350
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x20b4], 0x62
mov esi, 0x800000
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x800000
je 0x10042019
lea eax, [esp + 0x10]
and esi, 0xff7fffff
call fcn.10020510
test esi, 0x400000
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x48
jne 0x100420f8
push 3
push edi
call ebx
push edi
mov ecx, ebx
call fcn.1003e800
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, esi
jne 0x1004208c
lea edx, [esp + 0x14]
push edx
mov ecx, str.MCR4Ever
call fcn.1002f350
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x20b4], 0x63
mov esi, 0x1000000
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
jmp 0x100420c1
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.MCR4Ever
call fcn.1002f350
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x20b4], 0x64
mov esi, 0x2000000
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x2000000
je 0x100420da
lea eax, [esp + 0x10]
and esi, 0xfdffffff
call fcn.10020510
test esi, 0x1000000
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, 0x47
jne 0x100421b4
push 3
push edi
call ebx
push ebx
mov esi, edi
call fcn.1003b790
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, str.petya
test eax, eax
jne 0x1004214d
lea eax, [esp + 0x14]
push eax
call fcn.1002f350
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x20b4], 0x65
mov esi, 0x4000000
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
jmp 0x1004217d
lea edx, [esp + 0x10]
push edx
call fcn.1002f350
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x20b4], 0x66
mov esi, 0x8000000
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x8000000
je 0x10042196
lea eax, [esp + 0x10]
and esi, 0xf7ffffff
call fcn.10020510
test esi, 0x4000000
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp eax, esi
jne 0x10042622
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
lea ecx, [ebx + 1]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x10042622
push 0
push 0
push ebx
push esi
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, esi
call fcn.1003eac0
test al, al
jne 0x1004261b
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push esi
call ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
lea edx, [esp + 0x10]
push edx
mov ecx, eax
call fcn.1002f350
lea eax, [esp + 0x10]
push eax
push 0x101deba0
mov dword [esp + 0x20b8], 0x67
call fcn.10044440
inc dword [eax + 4]
add eax, 4
lea eax, [esp + 0x10]
mov dword [esp + 0x20b0], 0xffffffff
call fcn.10020510
push esi
call ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jle 0x1004261b
mov ecx, edi
call fcn.1003eb10
test al, al
je 0x1004261b
push esi
call ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call fcn.1002f350
lea edx, [esp + 0x1c]
push edx
push 0x101deb7c
mov dword [esp + 0x20b8], 0x68
call fcn.10044440
inc dword [eax + 4]
add eax, 4
lea eax, [esp + 0x1c]
call fcn.10020510
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x18]
jmp 0x100423e9
push edi
call fcn.10043720
mov esi, eax
add esp, 4
test esi, esi
jne 0x1004240d
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push edi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
lea eax, [esi + 1]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x100423e6
push 0
push 0
push esi
push ebx
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, ebx
call fcn.1003eac0
test al, al
jne 0x100423df
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push ebx
call esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
call fcn.1002f350
lea edx, [esp + 0x10]
push edx
push 0x101deba0
mov dword [esp + 0x20b8], 0x58
call fcn.10044440
inc dword [eax + 4]
add eax, 4
lea eax, [esp + 0x10]
mov dword [esp + 0x20b0], 0xffffffff
call fcn.10020510
push ebx
call esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jle 0x100423df
mov ecx, edi
call fcn.1003eb10
test al, al
je 0x100423df
push ebx
call esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
call fcn.1002f350
lea edx, [esp + 0x10]
push edx
push 0x101deb7c
mov dword [esp + 0x20b8], 0x59
call fcn.10044440
inc dword [eax + 4]
add eax, 4
lea eax, [esp + 0x10]
call fcn.10020510
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
or eax, 0xffffffff
mov ecx, dword [esp + 0x20a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2090]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
push 3
push edi
call ebx
push esi
mov esi, edi
mov ecx, ebx
call fcn.1003adb0
add esp, 4
cmp dword [esp + 0x10], 0x20
mov dword [esp + 0x18], eax
jne 0x100424cd
mov ecx, str.tesla
test eax, eax
jne 0x10042466
lea eax, [esp + 0x14]
push eax
call fcn.1002f350
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x20b4], 0x5a
mov esi, 0x40000
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
jmp 0x10042496
lea edx, [esp + 0x10]
push edx
call fcn.1002f350
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x20b4], 0x5b
mov esi, 0x80000
push 0x101deba0
mov dword [esp + 0x28], esi
call fcn.10044440
add eax, 4
inc dword [eax]
test esi, 0x80000
je 0x100424af
lea eax, [esp + 0x10]
and esi, 0xfff7ffff
call fcn.10020510
test esi, 0x40000
je 0x10042622
lea eax, [esp + 0x14]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
cmp dword [esp + 0x10], 1
jne 0x10042622
cmp dword [esp + 0x18], 0
jne 0x1004251c
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.tesla
call fcn.1002f350
lea edx, [esp + 0x10]
push edx
push 0x101deba0
mov dword [esp + 0x20b8], 0x5c
call fcn.10044440
inc dword [eax]
lea eax, [esp + 0x10]
call fcn.10020510
mov eax, dword [esp + 0x18]
jmp 0x100423e9
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
lea eax, [ebx + 1]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x10042622
push 0
push 0
push ebx
push esi
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, esi
call fcn.1003eac0
test al, al
jne 0x1004261b
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push esi
call ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
call fcn.1002f350
lea edx, [esp + 0x10]
push edx
push 0x101deba0
mov dword [esp + 0x20b8], 0x5d
call fcn.10044440
inc dword [eax + 4]
add eax, 4
lea eax, [esp + 0x10]
mov dword [esp + 0x20b0], 0xffffffff
call fcn.10020510
push esi
call ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jle 0x1004261b
mov ecx, edi
call fcn.1003eb10
test al, al
je 0x1004261b
push esi
call ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
call fcn.1002f350
lea edx, [esp + 0x10]
push edx
push 0x101deb7c
mov dword [esp + 0x20b8], 0x5e
call fcn.10044440
inc dword [eax + 4]
add eax, 4
lea eax, [esp + 0x10]
call fcn.10020510
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x18]
jmp 0x100423e9