Function at 0x10001bf7
Capabilities:
Delete file
Enumerate gui resources
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll__stricmp]
mov ebx, 0x100921ac
push str.Wow.exe
push ebx
call edi
pop ecx
test eax, eax
pop ecx
jne 0x100020d3
push 0x10091b58
push 1
push 0x10091c08
push 0x100922b0
call fcn.10004f71
push 0x10092588
call fcn.100055d1
add esp, 0x14
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x213]
push 0x40
mov byte [ebp - 0x214], bl
pop ecx
mov byte [ebp - 0x110], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push str._sScan.dll
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
call esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push str._sScan.dll.new
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
call esi
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.100054ec
test eax, eax
jne 0x1000213f
call dword [sym.imp.MSVCRT.dll__getpid]
push eax
push 0x100019b3
call dword [sym.imp.USER32.dll_EnumWindows]
call fcn.10002771
mov edi, eax
call fcn.10004829
push 0x10001a80
call fcn.10003c66
mov eax, dword [0x1000b244]
pop ecx
cmp eax, 1
je 0x1000213f
cmp eax, 2
je 0x1000213f
cmp eax, ebx
mov esi, str.wow.exe
jne 0x10001f65
push str.1333900800
call fcn.100059ba
pop ecx
mov dword [0x10091d98], eax
push 1
push 9
lea eax, [ebp - 0xc]
push 9
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x33
mov byte [ebp - 0xa], 3
mov byte [ebp - 9], 0xf0
mov byte [ebp - 8], 0xb9
mov byte [ebp - 7], 0x55
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
mov byte [ebp - 4], bl
call fcn.10002513
cmp eax, ebx
jbe 0x10001d8a
push 0x1000130b
push eax
mov ecx, edi
call fcn.10002392
or byte [ebp - 3], 0xff
or byte [ebp - 2], 0xff
push 1
push 0xe
lea eax, [ebp - 8]
push 8
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x50
mov byte [ebp - 7], 0x8d
mov byte [ebp - 6], 0x8d
mov byte [ebp - 5], bl
mov byte [ebp - 4], 0xfb
mov byte [ebp - 1], 0x51
call fcn.10002513
cmp eax, ebx
jbe 0x10001dcc
push 0x10001360
push eax
mov ecx, edi
call fcn.1000219a
push 1
push 0x20
lea eax, [ebp - 0xc]
push 0xa
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0xf
mov byte [ebp - 0xb], 0xb6
mov byte [ebp - 0xa], 0x90
mov byte [ebp - 9], 0xed
mov byte [ebp - 8], 0x46
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], 0x39
mov byte [ebp - 4], 0x56
mov byte [ebp - 3], 0x28
call fcn.10002513
cmp eax, ebx
jbe 0x10001e15
push 0x1000142f
push eax
mov ecx, edi
call fcn.1000219a
push 1
push 6
lea eax, [ebp - 8]
push 6
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x8b
mov byte [ebp - 7], 0x55
mov byte [ebp - 6], 0x10
mov byte [ebp - 5], 0x89
mov byte [ebp - 4], 0x4b
mov byte [ebp - 3], 0x10
call fcn.10002513
cmp eax, ebx
jbe 0x10001e50
push 0x10001486
push eax
mov ecx, edi
call fcn.100022a0
push 1
push 0xffffffffffffffd1
lea eax, [ebp - 8]
push 8
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0xd9
mov byte [ebp - 7], 0xe0
mov byte [ebp - 6], 0xde
mov byte [ebp - 5], 0xc1
mov byte [ebp - 4], 0xdd
mov byte [ebp - 3], 0x1c
mov byte [ebp - 2], 0x24
mov byte [ebp - 1], 0x50
call fcn.10002513
cmp eax, ebx
jbe 0x10001e93
push 0x100014ec
push eax
mov ecx, edi
call fcn.100022a0
push 1
push 0xd
lea eax, [ebp - 0xc]
push 9
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], 1
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 0x83
mov byte [ebp - 6], 0xc1
mov byte [ebp - 5], 4
mov byte [ebp - 4], 0x51
call fcn.10002513
cmp eax, ebx
jbe 0x10001ed7
push 0x100013f2
push eax
mov ecx, edi
call fcn.1000219a
push 1
push 0x16
lea eax, [ebp - 0xc]
push 9
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 0xa], 0x44
mov byte [ebp - 9], 0x8d
mov byte [ebp - 8], 0x8f
mov byte [ebp - 7], 0x68
mov byte [ebp - 6], 4
mov byte [ebp - 5], bl
mov byte [ebp - 4], bl
call fcn.10002513
cmp eax, ebx
jbe 0x10001f1c
push 0x1000172a
push eax
mov ecx, edi
call fcn.1000219a
push 0x10001859
push 0x80470f
mov ecx, edi
call fcn.1000219a
push 0x100018ba
push 0x804720
mov ecx, edi
call fcn.1000219a
push 0x100016bb
push 0x80474f
mov ecx, edi
call fcn.1000219a
push 0x1000190a
push 0x8047f1
mov ecx, edi
call fcn.1000219a
mov eax, dword [0x1000b244]
cmp eax, 1
jne 0x1000213f
push eax
push 9
lea eax, [ebp - 0xc]
push 9
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x33
mov byte [ebp - 0xa], 3
mov byte [ebp - 9], 0xf0
mov byte [ebp - 8], 0xb9
mov byte [ebp - 7], 0x55
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
mov byte [ebp - 4], bl
call fcn.10002513
cmp eax, ebx
jbe 0x10001fb1
push 0x1000130b
push eax
mov ecx, edi
call fcn.10002392
or byte [ebp - 7], 0xff
push 1
push 0xffffffffffffffa5
lea eax, [ebp - 0xc]
push 0xc
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x56
mov byte [ebp - 0xb], 0x50
mov byte [ebp - 0xa], 0x8b
mov byte [ebp - 9], 0x42
mov byte [ebp - 8], 0x5c
mov byte [ebp - 6], 0xd0
mov byte [ebp - 5], 0x5f
mov byte [ebp - 4], 0x5e
mov byte [ebp - 3], 0x8b
mov byte [ebp - 2], 0xe5
mov byte [ebp - 1], 0x5d
call fcn.10002513
cmp eax, ebx
jbe 0x10002004
push 0x10001360
push eax
mov ecx, edi
call fcn.1000219a
push 1
push 6
lea eax, [ebp - 8]
push 6
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x8b
mov byte [ebp - 7], 0x55
mov byte [ebp - 6], 0x10
mov byte [ebp - 5], 0x89
mov byte [ebp - 4], 0x4b
mov byte [ebp - 3], 0x10
call fcn.10002513
cmp eax, ebx
jbe 0x1000203f
push 0x10001486
push eax
mov ecx, edi
call fcn.100022a0
push 1
push 0xffffffffffffffd1
lea eax, [ebp - 8]
push 5
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x89
mov byte [ebp - 7], 0x4d
mov byte [ebp - 6], pe_nt_image_headers32
mov byte [ebp - 5], 0x8b
mov byte [ebp - 4], 0xc8
call fcn.10002513
cmp eax, ebx
jbe 0x10002076
push 0x1000152e
push eax
mov ecx, edi
call fcn.100022a0
push 0x1000190a
push 0x7edca1
mov ecx, edi
call fcn.1000219a
push 0x100013f2
push 0x61ea12
mov ecx, edi
call fcn.1000219a
push 1
push 0x41
lea eax, [ebp - 8]
push 8
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0xf
mov byte [ebp - 7], 0xb6
mov byte [ebp - 6], 0x88
mov byte [ebp - 5], 0x85
mov byte [ebp - 4], 1
mov byte [ebp - 3], bl
mov byte [ebp - 2], bl
mov byte [ebp - 1], 0x51
call fcn.10002513
cmp eax, ebx
jbe 0x1000213f
push 0x1000142f
jmp 0x10002137
mov esi, str.BigFoot.exe
push esi
push ebx
call edi
pop ecx
test eax, eax
pop ecx
jne 0x10002144
call fcn.10002771
push 0x7d0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 2
push 0xa
lea eax, [ebp - 0xc]
push 0xa
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x83
mov byte [ebp - 0xb], 0xc0
mov byte [ebp - 0xa], 4
mov byte [ebp - 9], 0x50
mov byte [ebp - 8], 0x8b
mov byte [ebp - 7], 0x4d
mov byte [ebp - 6], 0xe8
mov byte [ebp - 5], 0x83
mov byte [ebp - 4], 0xc1
mov byte [ebp - 3], 4
call fcn.10002513
test eax, eax
jbe 0x1000213f
push 0x10001961
push eax
mov ecx, edi
call fcn.1000219a
push 1
pop eax
jmp 0x10002146
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret