Function at 0x1000b3b0
Capabilities:
Check if file exists
Encode data using xor
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x658
mov eax, dword [ebp + 8]
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10051960
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movups xmm0, xmmword [0x1022b061]
movups xmmword [ebp - 0x2d], xmm0
movups xmm0, xmmword [str.C:UsersPublicDownloads_]
movups xmmword [ebp - 0x38], xmm0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5f4], eax
mov eax, esp
lea ecx, [ebp - 0x38]
mov dword [eax], ecx
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x5f0], ecx
call fcn.10006000
sub esp, 4
mov edx, dword [ebp - 0x5f4]
mov ecx, dword [ebp - 0x5f0]
mov dword [ebp - 0x10], 0
mov eax, esp
mov dword [eax + 8], edx
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x50]
mov dword [eax], ecx
call fcn.1000c360
jmp 0x1000b446
mov ebx, dword [0x1027f74c]
mov edi, dword [0x1027f750]
mov eax, ebx
xor eax, 0xffffffff
mov edx, edi
xor edx, 0xffffffff
mov ecx, eax
and ecx, 0x10dadc93
and ebx, 0xef25236c
mov esi, edx
and esi, 0x10dadc93
and edi, 0xef25236c
or ecx, ebx
or esi, edi
xor ecx, esi
or eax, edx
xor eax, 0xffffffff
or ecx, eax
xor ecx, 0xde8e5953
mov edx, ecx
and edx, 0x65362660
mov eax, ecx
or eax, 0x65362660
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, 0x9ac9d99f
or ecx, 0x9ac9d99f
imul ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
or eax, 0xfc9998b9
xor ecx, 0xffffffff
or ecx, 0x3666746
and eax, ecx
xor eax, 0xffffffff
mov dword [ebp - 0x5fc], eax
lea ecx, [ebp - 0x68]
call fcn.10006100
lea ecx, [ebp - 0x50]
call fcn.10008160
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x5fc]
cmp ecx, 0xffffffff
sete cl
mov byte [ebp - 0x5f5], cl
cmp eax, 0xfdb1747
je 0x1000c0db
mov al, byte [ebp - 0x5f5]
test al, 1
jne 0x1000b529
jmp 0x1000b586
mov ecx, dword [0x1027f754]
mov edx, dword [0x1027f758]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
add eax, 0x6c24174a
add eax, 0xe08da6dd
mov edx, eax
and edx, 0xd3031d7e
mov ecx, eax
or ecx, 0xd3031d7e
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x2cfce281
or eax, 0x2cfce281
imul eax, edx
add eax, ecx
cmp eax, 0x15d80d84
jbe 0x1000c0fc
mov dword [ebp - 0x6c], 1
jmp 0x1000c055
xor eax, eax
lea eax, [ebp - 0x170]
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
sub esp, 0x14
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
jl 0x1000bfd8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x600], eax
mov dword [ebp - 0x10], 1
mov eax, esp
lea ecx, [ebp - 0x170]
mov dword [eax], ecx
lea ecx, [ebp - 0x1d4]
call fcn.10006000
sub esp, 4
jmp 0x1000b5fa
mov eax, dword [0x1027f764]
mov ecx, dword [0x1027f768]
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0x6519c88
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x81e8a57d
or ecx, 0x7e175a82
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
or eax, 0xa29531f8
cmp eax, 0xb269ae31
jb 0x1000c108
mov dword [ebp - 0x10], 3
mov eax, esp
lea ecx, [ebp - 0x1d4]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x1bc]
mov dword [eax], ecx
mov dword [eax + 8], 0x1025dc14
call fcn.1000c510
jmp 0x1000b66e
mov ecx, dword [ebp - 0x600]
mov dword [ebp - 0x10], 4
mov eax, esp
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x1bc]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x1a4]
mov dword [eax], ecx
call fcn.1000c360
jmp 0x1000b69b
mov ecx, dword [0x1027f78c]
xor ecx, dword [0x1027f790]
or ecx, 0xbeeecdad
sub ecx, 0x52a54004
mov eax, ecx
xor eax, 0xd74dd468
and eax, ecx
cmp eax, 0xe49d11d0
ja 0x1000b69b
mov dword [ebp - 0x10], 5
mov eax, esp
lea ecx, [ebp - 0x1a4]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x18c]
mov dword [eax], ecx
mov dword [eax + 8], str..lnk
call fcn.1000c510
jmp 0x1000b6f2
mov eax, dword [0x1027f794]
imul eax, dword [0x1027f798]
mov ecx, eax
xor ecx, 0x2a77fad7
xor ecx, 0xffffffff
and ecx, 0x2a77fad7
shl ecx, 1
sub ecx, 0x2a77fad7
sub eax, ecx
and eax, 0x591f98b
or eax, 0xa959c10f
cmp eax, 0xb859a132
ja 0x1000c10d
mov eax, dword [0x1027f79c]
or eax, dword [0x1027f7a0]
sub eax, 0x4fa65128
mov ecx, eax
xor ecx, 0x182d4c3e
xor ecx, 0xffffffff
or eax, 0x182d4c3e
and eax, ecx
add eax, 0x2018c577
add eax, 1
mov dword [ebp - 0x608], eax
lea ecx, [ebp - 0x1a4]
call fcn.10006100
lea ecx, [ebp - 0x1bc]
call fcn.10006100
lea ecx, [ebp - 0x1d4]
call fcn.10006100
lea ecx, [ebp - 0x18c]
call fcn.10008160
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x608]
cmp ecx, 0xffffffff
setne cl
mov byte [ebp - 0x601], cl
cmp eax, 0xb9bb98f6
je 0x1000b72e
mov al, byte [ebp - 0x601]
test al, 1
jne 0x1000b7c8
jmp 0x1000b839
mov eax, dword [0x1027f7a4]
xor edx, edx
div dword [0x1027f7a8]
mov ecx, 0x78407ce4
xor edx, edx
div ecx
sub eax, 0xce462aa6
add eax, 0x255c04ae
cmp eax, 0xdcb8834f
jae 0x1000c14a
mov eax, dword [0x1027f7ac]
xor ecx, ecx
sub ecx, dword [0x1027f7b0]
add eax, ecx
or eax, 0x20de2122
mov ecx, 0xab353590
xor edx, edx
div ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0xfa392a9a
and eax, 0x5c6d565
sub eax, ecx
mov dword [ebp - 0x6c], 1
cmp eax, 0xde7356be
ja 0x1000c14a
jmp 0x1000beca
mov eax, dword [0x1027f7b4]
mov esi, dword [0x1027f7b8]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, esi
and edx, ecx
mov edi, esi
xor edi, 0xffffffff
mov ecx, eax
and ecx, edi
imul ecx, edx
mov edx, eax
and edx, esi
or eax, esi
imul eax, edx
add eax, ecx
mov ecx, 0xafcf7a85
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0x3da28ce7
xor ecx, 0xffffffff
add eax, 0x3da28ce7
add eax, 1
add eax, ecx
mov ecx, eax
and ecx, 0xe16e7eaa
shl ecx, 1
xor eax, 0xe16e7eaa
add eax, ecx
cmp eax, 0x7d72e0a0
je 0x1000c156
mov eax, dword [0x1027f7bc]
xor edx, edx
div dword [0x1027f7c0]
and eax, 0xf2792daf
mov ecx, 0x4fec3a4b
xor edx, edx
div ecx
add eax, 0x96278876
mov dword [ebp - 0x60c], eax
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.ole32.dll_CoInitialize]
sub esp, 4
mov eax, dword [ebp - 0x60c]
cmp eax, 0xffa3a11b
jae 0x1000b89e
lea eax, [ebp - 0x1d8]
mov dword [esp], eax
call fcn.1000c550
mov dword [ebp - 0x610], eax
mov eax, dword [0x1027f7c4]
add eax, dword [0x1027f7c8]
mov edx, eax
xor edx, 0xffffffff
and edx, 0xb7706487
mov ecx, eax
and ecx, 0x488f9b78
imul ecx, edx
mov edx, eax
and edx, 0xb7706487
or eax, 0xb7706487
imul eax, edx
add eax, ecx
mov ecx, 0x69b38563
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
or eax, 0xd7282715
and ecx, 0x28d7d8ea
xor eax, 0xffffffff
or eax, ecx
cmp eax, 0x797fe543
ja 0x1000c16d
mov eax, dword [ebp - 0x610]
mov ecx, dword [0x1027f7cc]
or ecx, dword [0x1027f7d0]
or ecx, 0xada0946b
sub ecx, 0x3a414795
mov edx, ecx
xor edx, 0x88ff8c1b
xor edx, 0xffffffff
and edx, 0x88ff8c1b
shl edx, 1
sub edx, 0x88ff8c1b
sub ecx, edx
mov dword [ebp - 0x618], ecx
lea edx, [0x1022d598]
xor ecx, ecx
lea ecx, [0x1022b194]
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 1
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
sub esp, 0x14
mov ecx, eax
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0x174], ecx
cmp dword [ebp - 0x174], 0
setge cl
mov byte [ebp - 0x611], cl
cmp eax, 0xfc5718b5
jae 0x1000c16d
mov al, byte [ebp - 0x611]
test al, 1
jne 0x1000ba06
jmp 0x1000bebd
mov eax, dword [0x1027f7d4]
and eax, dword [str._ri]
or eax, 0xa394a0e1
and eax, 0x5aaea87
mov edx, eax
xor edx, 0xffffffff
and edx, 0x3cd84c72
mov ecx, eax
and ecx, 0xc327b38d
imul ecx, edx
mov edx, eax
and edx, 0x3cd84c72
or eax, 0x3cd84c72
imul eax, edx
add eax, ecx
cmp eax, 0xb8836f3d
jbe 0x1000c1b0
lea ecx, [ebp - 0x50]
call fcn.10008160
mov ecx, eax
mov eax, esp
lea esi, [ebp - 0x3e0]
mov dword [eax + 0x10], esi
mov dword [eax + 8], ecx
mov dword [eax + 0x14], 0x104
mov dword [eax + 0xc], 0xffffffff
mov dword [eax + 4], 0
mov dword [eax], 0
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call eax
sub esp, 0x18
mov edx, dword [ebp - 0x1d8]
mov eax, dword [edx]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], 2
mov ecx, esp
mov dword [ecx + 4], esi
mov dword [ecx], edx
call eax
sub esp, 8
jmp 0x1000baae
jmp 0x1000bab3
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x620], eax
lea eax, [ebp - 0x3e4]
mov dword [esp], eax
call fcn.1000c6d0
mov dword [ebp - 0x61c], eax
mov eax, dword [0x1027f7f4]
xor edx, edx
div dword [0x1027f7f8]
mov ecx, eax
mov eax, ecx
xor eax, 0xf9cf15ac
xor eax, 0xffffffff
or ecx, 0xf9cf15ac
and ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x63cb5cd5
and ecx, 0x9c34a32a
sub ecx, eax
mov eax, ecx
and eax, 0xda63cbe9
or ecx, 0xda63cbe9
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0x8a81a5db
jae 0x1000c1fe
mov ecx, dword [ebp - 0x620]
mov eax, dword [0x1027f7fc]
xor edx, edx
div dword [0x1027f800]
or eax, 0xf22607d6
mov esi, 0xe52277d7
xor edx, edx
div esi
mov edx, eax
mov eax, edx
xor eax, 0xffffffff
and eax, 0x71a0c5f4
and edx, 0x8e5f3a0b
or eax, edx
xor eax, 0xd499ae95
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov dword [ebp - 0x624], ecx
cmp eax, 0x274b4357
jbe 0x1000bb23
mov eax, dword [ebp - 0x624]
mov edx, dword [ebp - 0x620]
mov esi, dword [ebp - 0x61c]
mov dword [ebp - 0x10], 2
mov ecx, esp
mov dword [ecx + 8], esi
mov dword [ecx], edx
mov dword [ecx + 4], 0x1022b1a4
call eax
sub esp, 0xc
mov dword [ebp - 0x628], eax
jmp 0x1000bba9
mov eax, dword [0x1027f804]
xor edx, edx
div dword [0x1027f808]
mov ecx, 0xd19d793d
xor edx, edx
div ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x170d0f9e
mov ecx, eax
and ecx, 0xe8f2f061
imul ecx, edx
mov edx, eax
and edx, 0x170d0f9e
or eax, 0x170d0f9e
imul eax, edx
add eax, ecx
xor eax, 0x31b45dc8
cmp eax, 0x89476261
ja 0x1000c203
mov ecx, dword [ebp - 0x628]
mov eax, dword [0x1027f80c]
xor eax, dword [0x1027f810]
or eax, 0x407bbe30
mov edx, eax
xor edx, 0x966db389
xor edx, 0xffffffff
or eax, 0x966db389
and eax, edx
add eax, 0xace60a8f
mov dword [ebp - 0x174], ecx
cmp dword [ebp - 0x174], 0
setge cl
mov byte [ebp - 0x629], cl
cmp eax, 0x33cb6895
jbe 0x1000c203
mov al, byte [ebp - 0x629]
test al, 1
jne 0x1000bc58
jmp 0x1000be40
mov esi, dword [0x1027f814]
mov edx, dword [0x1027f818]
mov eax, esi
xor eax, 0xffffffff
and eax, 0xa154633f
and esi, 0x5eab9cc0
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0xa154633f
and edx, 0x5eab9cc0
or eax, esi
or ecx, edx
xor eax, ecx
xor eax, 0x56124a78
imul eax, eax, 0xc54ef5c
sub eax, 0xd550d2e8
cmp eax, 0xb5e9e028
je 0x1000c214
mov ecx, dword [0x1027f81c]
or ecx, dword [0x1027f820]
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xe96a5d8f
and ecx, 0x1695a270
sub ecx, eax
mov eax, ecx
xor eax, 0xde2dff3e
and eax, ecx
sub eax, 0x9e7e3ef7
mov dword [ebp - 0x638], eax
lea ecx, [ebp - 0x18c]
call fcn.10008160
mov ecx, eax
xor eax, eax
lea eax, [ebp - 0x5ec]
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x104
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub esp, 0x18
mov eax, dword [ebp - 0x638]
mov ecx, dword [ebp - 0x3e4]
mov dword [ebp - 0x634], ecx
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov dword [ebp - 0x630], ecx
cmp eax, 0x86e12740
je 0x1000bca6
mov eax, dword [ebp - 0x630]
mov edx, dword [ebp - 0x634]
mov dword [ebp - 0x10], 2
mov ecx, esp
lea esi, [ebp - 0x5ec]
mov dword [ecx + 4], esi
mov dword [ecx], edx
mov dword [ecx + 8], 1
call eax
sub esp, 0xc
jmp 0x1000bd76
mov eax, dword [0x1027f82c]
mov ecx, dword [0x1027f830]
xor ecx, 0xffffffff
add eax, ecx
add eax, 1
mov ecx, 0xb6623bcd
xor edx, edx
div ecx
and eax, 0xec4e6a82
and eax, 0x7f4f9a72
mov ecx, dword [ebp - 0x3e4]
mov dword [ebp - 0x640], ecx
mov ecx, dword [ecx]
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x63c], ecx
cmp eax, 0x57d606b3
ja 0x1000c25e
mov eax, dword [ebp - 0x63c]
mov edx, dword [ebp - 0x640]
mov dword [ebp - 0x10], 2
mov ecx, esp
mov dword [ecx], edx
call eax
sub esp, 4
jmp 0x1000bddf
mov eax, dword [0x1027f834]
xor edx, edx
div dword [0x1027f838]
or eax, 0x4a55603e
or eax, 0x5832ab5b
mov ecx, eax
and ecx, 0x46feed9c
shl ecx, 1
add eax, 0x46feed9c
sub eax, ecx
cmp eax, 0xff79a78b
ja 0x1000c263
mov eax, dword [0x1027f83c]
or eax, dword [0x1027f840]
or eax, 0xb015d57e
mov ecx, 0x6cb1ec62
xor edx, edx
div ecx
sub eax, 0xb85a14c2
cmp eax, 0xb59b742e
jae 0x1000be12
jmp 0x1000be40
mov eax, dword [0x1027f844]
xor eax, dword [0x1027f848]
and eax, 0xd11d5657
mov ecx, eax
and ecx, 0xbae49bdf
xor ecx, 0xffffffff
add eax, 0xbae49bdf
add eax, 1
add eax, ecx
mov edx, eax
and edx, 0x7cc71db
mov ecx, eax
or ecx, 0x7cc71db
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xf8338e24
or eax, 0xf8338e24
imul eax, edx
add eax, ecx
cmp eax, 0xce8765a8
jae 0x1000c268
mov edx, dword [ebp - 0x1d8]
mov eax, dword [edx]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], 2
mov ecx, esp
mov dword [ecx], edx
call eax
sub esp, 4
jmp 0x1000beb8
jmp 0x1000bebd
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0x6c], 0
mov ecx, dword [0x1027f854]
mov esi, dword [0x1027f858]
mov edi, esi
xor edi, 0xffffffff
mov edx, ecx
and edx, edi
mov eax, ecx
or eax, edi
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, esi
or ecx, esi
imul ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
and eax, 0x4a6c9ff3
and ecx, 0xb593600c
or eax, ecx
xor eax, 0x7cc2399a
xor ecx, ecx
sub ecx, eax
add ecx, 0xcf1f2971
xor eax, eax
sub eax, ecx
cmp eax, 0xc54dec96
je 0x1000c274
mov eax, dword [0x1027f85c]
add eax, dword [0x1027f860]
mov ecx, 0xb5c1e183
xor edx, edx
div ecx
mov ecx, eax
or ecx, 0xccfe2699
mov eax, ecx
xor eax, 0xffffffff
or eax, 0x6d63d7ac
xor ecx, 0xffffffff
or ecx, 0x6d63d7ac
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov dword [ebp - 0x648], eax
lea ecx, [ebp - 0x18c]
call fcn.10006100
mov eax, dword [ebp - 0x648]
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x644], ecx
cmp eax, 0x78ad8ca9
jbe 0x1000c274
mov eax, dword [ebp - 0x644]
cmp eax, 0
jne 0x1000c055
mov ecx, dword [0x1027f864]
sub ecx, dword [0x1027f868]
xor ecx, 0xffffffff
or ecx, 0xd35c1124
mov eax, ecx
xor eax, 0xffffffff
and ecx, 0x4b50e334
and eax, 0xb4af1ccb
sub eax, ecx
add eax, 0x95ce2902
cmp eax, 0xd77c9ef3
ja 0x1000c284
jmp 0x1000bfd8
mov eax, dword [0x1027f874]
imul eax, dword [0x1027f878]
imul eax, eax, 0xdfbb99b8
mov ecx, eax
xor ecx, 0x47406dd4
and eax, 0xb8bf922b
shl eax, 1
sub eax, ecx
xor ecx, ecx
sub ecx, eax
add ecx, 0x3ba5b38a
xor eax, eax
sub eax, ecx
cmp eax, 0x6662a3f6
jb 0x1000c289
mov ecx, dword [0x1027f87c]
imul ecx, dword [0x1027f880]
add ecx, 0xda0f39b4
mov eax, ecx
xor eax, 0xffffffff
or eax, 0xe753904e
or ecx, 0x18ac6fb1
and eax, ecx
xor eax, 0x5a707bd9
mov dword [ebp - 0x6c], 0
cmp eax, 0x5b8e19e8
je 0x1000c289
jmp 0x1000c055
mov eax, dword [0x1027f88c]
xor edx, edx
div dword [0x1027f890]
add eax, 0x994f8dfa
mov ecx, eax
and ecx, 0xc9bb4d6d
mov edx, eax
xor edx, 0x3644b292
add eax, edx
sub eax, ecx
add eax, 0x2a7a2ce0
mov dword [ebp - 0x64c], eax
lea ecx, [ebp - 0x50]
call fcn.10006100
mov eax, dword [ebp - 0x64c]
cmp eax, 0x53164629
jbe 0x1000c055
mov eax, dword [0x1027f89c]
xor edx, edx
div dword [0x1027f8a0]
and eax, 0x1a035ab6
xor eax, 0xd40ca4bc
imul eax, eax, 0x2732707f
cmp eax, 0x8764db30
jbe 0x1000c295
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x658
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x68]
call fcn.10006100
lea ecx, [ebp - 0x50]
call fcn.10008160
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
jmp 0x1000b446
mov dword [ebp - 0x6c], 1
jmp 0x1000b57a
jmp 0x1000b643
lea ecx, [ebp - 0x1a4]
call fcn.10006100
lea ecx, [ebp - 0x1bc]
call fcn.10006100
lea ecx, [ebp - 0x1d4]
call fcn.10006100
lea ecx, [ebp - 0x18c]
call fcn.10008160
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
jmp 0x1000b72e
mov dword [ebp - 0x6c], 1
jmp 0x1000b7f3
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.ole32.dll_CoInitialize]
sub esp, 4
jmp 0x1000b89e
mov eax, dword [ebp - 0x610]
lea edx, [0x1022d598]
xor ecx, ecx
lea ecx, [0x1022b194]
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 1
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
sub esp, 0x14
mov dword [ebp - 0x174], eax
jmp 0x1000b959
lea ecx, [ebp - 0x50]
call fcn.10008160
mov ecx, eax
xor eax, eax
lea eax, [ebp - 0x3e0]
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x104
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub esp, 0x18
mov dword [ebp - 0x10], 2
jmp 0x1000ba4e
jmp 0x1000bb23
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x174], eax
jmp 0x1000bbf7
lea ecx, [ebp - 0x18c]
call fcn.10008160
mov ecx, eax
xor eax, eax
lea eax, [ebp - 0x5ec]
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x104
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub esp, 0x18
jmp 0x1000bca6
jmp 0x1000bd76
jmp 0x1000be12
mov dword [ebp - 0x10], 2
jmp 0x1000be98
lea ecx, [ebp - 0x18c]
call fcn.10006100
jmp 0x1000bf2b
jmp 0x1000bfd3
mov dword [ebp - 0x6c], 0
jmp 0x1000c014
jmp 0x1000c09f