Function at 0x10029110
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100955f5
mov eax, dword fs:[0]
push eax
sub esp, 0xa5c
mov eax, dword [0x100c3384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x510], ecx
call fcn.1003eb30
mov dword [ebp - 0x484], eax
push 1
mov eax, dword [ebp - 0x484]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x484]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 0x4fc], al
cmp byte [ebp - 0x4fc], 1
je 0x10029175
jmp 0x10029255
push 0x1009fa48
lea ecx, [ebp - 0x3a8]
call fcn.10004260
mov dword [ebp - 4], 0
push 0x1009faa8
lea ecx, [ebp - 0x3c0]
call fcn.10004260
mov byte [ebp - 4], 1
call fcn.1003eb30
mov dword [ebp - 0x488], eax
mov ecx, dword [ebp + 8]
push ecx
push str.driver_name:
lea edx, [ebp + 0x10]
push edx
push str.will_reject_process_id
push 0xf9
lea eax, [ebp - 0x3a8]
push eax
lea ecx, [ebp - 0x3c0]
push ecx
lea ecx, [ebp - 0xa68]
call fcn.10004a60
mov dword [ebp - 0x4f8], eax
mov edx, dword [ebp - 0x4f8]
mov dword [ebp - 0x4f4], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x4f4]
call fcn.10002a60
mov ecx, eax
call fcn.1001ebd0
mov ecx, eax
call fcn.10002a60
mov ecx, eax
call fcn.10002ad0
push eax
mov eax, dword [ebp - 0x488]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x488]
mov eax, dword [edx + 0x1c]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa68]
call fcn.10005a70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c0]
call fcn.10005680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3a8]
call fcn.10005680
mov ecx, dword [ebp + 8]
call fcn.10015240
movzx ecx, al
test ecx, ecx
jne 0x1002927d
mov ecx, dword [ebp + 0xc]
call fcn.10015240
movzx edx, al
test edx, edx
jne 0x1002927d
cmp dword [ebp + 0x10], 0
jne 0x10029376
call fcn.1003eb30
mov dword [ebp - 0x480], eax
push 1
mov eax, dword [ebp - 0x480]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x480]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 0x4f0], al
cmp byte [ebp - 0x4f0], 1
je 0x100292b1
jmp 0x1002936f
push 0x1009fad8
lea ecx, [ebp - 0x378]
call fcn.10004260
mov dword [ebp - 4], 3
push 0x1009fad4
lea ecx, [ebp - 0x390]
call fcn.10004260
mov byte [ebp - 4], 4
call fcn.1003eb30
mov dword [ebp - 0x48c], eax
push 0x1009fb38
push 0xfb
lea ecx, [ebp - 0x378]
push ecx
lea edx, [ebp - 0x390]
push edx
lea ecx, [ebp - 0x5a8]
call fcn.10004a60
mov dword [ebp - 0x4ec], eax
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x4e8], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x4e8]
call fcn.10002a60
push eax
mov ecx, dword [ebp - 0x48c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x48c]
mov eax, dword [edx + 0x1c]
call eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x5a8]
call fcn.10005a70
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x390]
call fcn.10005680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x378]
call fcn.10005680
xor eax, eax
jmp 0x10029e43
mov ecx, dword [ebp + 0xc]
call fcn.10006150
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100293a2
mov ecx, dword [ebp + 0xc]
call fcn.10006150
push eax
call fcn.10059240
add esp, 4
test eax, eax
jne 0x100294a6
call fcn.1003eb30
mov dword [ebp - 0x490], eax
push 1
mov ecx, dword [ebp - 0x490]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x490]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 0x4e4], al
cmp byte [ebp - 0x4e4], 1
je 0x100293d6
jmp 0x1002949f
push 0x1009fb48
lea ecx, [ebp - 0x348]
call fcn.10004260
mov dword [ebp - 4], 6
push 0x1009fb44
lea ecx, [ebp - 0x360]
call fcn.10004260
mov byte [ebp - 4], 7
call fcn.1003eb30
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x1009fba8
push 0x100
lea edx, [ebp - 0x348]
push edx
lea eax, [ebp - 0x360]
push eax
lea ecx, [ebp - 0x640]
call fcn.10004a60
mov dword [ebp - 0x4e0], eax
mov ecx, dword [ebp - 0x4e0]
mov dword [ebp - 0x4dc], ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x4dc]
call fcn.10002a60
mov ecx, eax
call fcn.10002ad0
push eax
mov edx, dword [ebp - 0x448]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x448]
mov edx, dword [eax + 0x1c]
call edx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x640]
call fcn.10005a70
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x360]
call fcn.10005680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x348]
call fcn.10005680
xor eax, eax
jmp 0x10029e43
lea ecx, [ebp - 0x430]
call fcn.1000f0b0
mov dword [ebp - 4], 9
mov eax, dword [ebp + 0x10]
push eax
push 0x1009fbb4
lea ecx, [ebp - 0x430]
push ecx
call fcn.10012be0
add esp, 0xc
lea ecx, [ebp - 0x430]
call fcn.10006150
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
je 0x10029627
call fcn.1003eb30
mov dword [ebp - 0x44c], eax
push 1
mov edx, dword [ebp - 0x44c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x44c]
mov edx, dword [eax + 8]
call edx
mov byte [ebp - 0x4d8], al
cmp byte [ebp - 0x4d8], 1
je 0x10029530
jmp 0x100295f3
push 0x1009fbf0
lea ecx, [ebp - 0x330]
call fcn.10004260
mov byte [ebp - 4], 0xa
push 0x1009fbec
lea ecx, [ebp - 0x288]
call fcn.10004260
mov byte [ebp - 4], 0xb
call fcn.1003eb30
mov dword [ebp - 0x450], eax
push 0x1009fc50
lea eax, [ebp + 0x10]
push eax
push 0x109
lea ecx, [ebp - 0x330]
push ecx
lea edx, [ebp - 0x288]
push edx
lea ecx, [ebp - 0x6d8]
call fcn.10004a60
mov dword [ebp - 0x4d4], eax
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x4d0], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x4d0]
call fcn.1001ebd0
mov ecx, eax
call fcn.10002a60
push eax
mov ecx, dword [ebp - 0x450]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x450]
mov eax, dword [edx + 0x1c]
call eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x6d8]
call fcn.10005a70
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x288]
call fcn.10005680
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x330]
call fcn.10005680
mov ecx, dword [ebp - 0x454]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4cc], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x430]
call fcn.100054b0
mov eax, dword [ebp - 0x4cc]
jmp 0x10029e43
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.10026e30
mov ecx, eax
call fcn.10032580
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x444]
call fcn.1000f0d0
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x440], 0
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
mov ecx, dword [ebp + 8]
call fcn.10006150
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x42c], 0
cmp dword [ebp - 0x43c], 0xffffffff
jne 0x100297a5
call fcn.1003eb30
mov dword [ebp - 0x458], eax
push 1
mov edx, dword [ebp - 0x458]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x458]
mov edx, dword [eax + 8]
call edx
mov byte [ebp - 0x4c8], al
cmp byte [ebp - 0x4c8], 1
je 0x100296c7
jmp 0x10029796
push 0x1009fc60
lea ecx, [ebp - 0x300]
call fcn.10004260
mov byte [ebp - 4], 0xe
push 0x1009fcc0
lea ecx, [ebp - 0x318]
call fcn.10004260
mov byte [ebp - 4], 0xf
call fcn.1003eb30
mov dword [ebp - 0x45c], eax
push str._failed
mov eax, dword [ebp + 8]
push eax
push str.create_file_dirver
push 0x117
lea ecx, [ebp - 0x300]
push ecx
lea edx, [ebp - 0x318]
push edx
lea ecx, [ebp - 0x770]
call fcn.10004a60
mov dword [ebp - 0x4c4], eax
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x4c0], eax
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x4c0]
call fcn.10002a60
mov ecx, eax
call fcn.10002ad0
mov ecx, eax
call fcn.10002a60
push eax
mov ecx, dword [ebp - 0x45c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x45c]
mov eax, dword [edx + 0x1c]
call eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x770]
call fcn.10005a70
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x318]
call fcn.10005680
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x300]
call fcn.10005680
mov dword [ebp - 0x42c], 1
jmp 0x10029dee
xor ecx, ecx
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x438], 0
push 0
lea edx, [ebp - 0x438]
push edx
push 0x10
lea eax, [ebp - 0x240]
push eax
push 0
push 0
push 0x8000c010
mov ecx, dword [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x1002990a
call fcn.1003eb30
mov dword [ebp - 0x460], eax
push 1
mov edx, dword [ebp - 0x460]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x460]
mov edx, dword [eax + 8]
call edx
mov byte [ebp - 0x4bc], al
cmp byte [ebp - 0x4bc], 1
je 0x10029838
jmp 0x100298fb
push 0x1009fce0
lea ecx, [ebp - 0x2d0]
call fcn.10004260
mov byte [ebp - 4], 0x11
push 0x1009fd40
lea ecx, [ebp - 0x2e8]
call fcn.10004260
mov byte [ebp - 4], 0x12
call fcn.1003eb30
mov dword [ebp - 0x464], eax
lea eax, [ebp + 0x10]
push eax
push str.DLLInjection::InjectByDrive_DeviceIoControl_1_fail_dwProcessId
push 0x121
lea ecx, [ebp - 0x2d0]
push ecx
lea edx, [ebp - 0x2e8]
push edx
lea ecx, [ebp - 0x808]
call fcn.10004a60
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x500], eax
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x500]
call fcn.10002a60
mov ecx, eax
call fcn.1001ebd0
push eax
mov ecx, dword [ebp - 0x464]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x464]
mov eax, dword [edx + 0x1c]
call eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x808]
call fcn.10005a70
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x2e8]
call fcn.10005680
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x2d0]
call fcn.10005680
mov dword [ebp - 0x42c], 2
jmp 0x10029dee
push 0x21e
push 0
lea ecx, [ebp - 0x230]
push ecx
call fcn.1006c6b0
add esp, 0xc
mov edx, dword [ebp - 0x240]
mov dword [ebp - 0x230], edx
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x228], ecx
mov edx, dword [ebp - 0x234]
mov dword [ebp - 0x224], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x220], eax
push 0x104
lea ecx, [ebp - 0x444]
call fcn.10007840
push eax
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
call fcn.100730d1
add esp, 0xc
push 0xffffffffffffffff
lea ecx, [ebp - 0x444]
call fcn.100160c0
lea ecx, [ebp - 0x258]
call fcn.100042d0
mov byte [ebp - 4], 0x14
push str.6804FACB_33CC_48a8_99B1_4E2A487F9638
lea ecx, [ebp - 0x2b8]
call fcn.10004260
mov byte [ebp - 4], 0x15
lea edx, [ebp - 0x21c]
mov dword [ebp - 0x424], edx
mov eax, dword [ebp - 0x424]
add eax, 2
mov dword [ebp - 0x504], eax
mov ecx, dword [ebp - 0x424]
mov dx, word [ecx]
mov word [ebp - 0x432], dx
add dword [ebp - 0x424], 2
cmp word [ebp - 0x432], 0
jne 0x100299c9
mov eax, dword [ebp - 0x424]
sub eax, dword [ebp - 0x504]
sar eax, 1
mov dword [ebp - 0x50c], eax
lea ecx, [ebp - 0x258]
push ecx
lea edx, [ebp - 0x2b8]
push edx
mov eax, dword [ebp - 0x50c]
lea ecx, [eax + eax + 0x14]
push ecx
lea edx, [ebp - 0x230]
push edx
call fcn.10057de0
add esp, 0x10
mov dword [ebp - 0x428], eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x2b8]
call fcn.10005680
cmp dword [ebp - 0x428], 0
je 0x10029a58
lea ecx, [ebp - 0x258]
call fcn.1000ba00
cmp eax, 0x10
jae 0x10029b6d
call fcn.1003eb30
mov dword [ebp - 0x468], eax
push 1
mov eax, dword [ebp - 0x468]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x468]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 0x4b8], al
cmp byte [ebp - 0x4b8], 1
je 0x10029a8c
jmp 0x10029b4f
push 0x1009fdb0
lea ecx, [ebp - 0x270]
call fcn.10004260
mov byte [ebp - 4], 0x16
push 0x1009fd44
lea ecx, [ebp - 0x2a0]
call fcn.10004260
mov byte [ebp - 4], 0x17
call fcn.1003eb30
mov dword [ebp - 0x46c], eax
lea ecx, [ebp + 0x10]
push ecx
push str.DLLInjection::InjectByDrive_Encrypt_Base64_Blowfish_fail_dwProcessId
push 0x132
lea edx, [ebp - 0x270]
push edx
lea eax, [ebp - 0x2a0]
push eax
lea ecx, [ebp - 0x8a0]
call fcn.10004a60
mov dword [ebp - 0x494], eax
mov ecx, dword [ebp - 0x494]
mov dword [ebp - 0x498], ecx
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x498]
call fcn.10002a60
mov ecx, eax
call fcn.1001ebd0
push eax
mov edx, dword [ebp - 0x46c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x46c]
mov edx, dword [eax + 0x1c]
call edx
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x8a0]
call fcn.10005a70
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x2a0]
call fcn.10005680
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x270]
call fcn.10005680
mov dword [ebp - 0x42c], 3
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x258]
call fcn.10005680
jmp 0x10029dee
mov dword [ebp - 0x438], 0
push 0
lea eax, [ebp - 0x438]
push eax
push 0
push 0
lea ecx, [ebp - 0x258]
call fcn.1000ba00
push eax
lea ecx, [ebp - 0x258]
call fcn.10009ce0
push eax
push 0x8000c018
mov ecx, dword [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x10029cd6
call fcn.1003eb30
mov dword [ebp - 0x470], eax
push 1
mov edx, dword [ebp - 0x470]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x470]
mov edx, dword [eax + 8]
call edx
mov byte [ebp - 0x49c], al
cmp byte [ebp - 0x49c], 1
je 0x10029bf5
jmp 0x10029cb8
push 0x1009fe58
lea ecx, [ebp - 0x3f0]
call fcn.10004260
mov byte [ebp - 4], 0x19
push 0x1009feb8
lea ecx, [ebp - 0x3d8]
call fcn.10004260
mov byte [ebp - 4], 0x1a
call fcn.1003eb30
mov dword [ebp - 0x474], eax
lea eax, [ebp + 0x10]
push eax
push str.DLLInjection::InjectByDrive_DeviceIoControl_2_fail_dwProcessId
push 0x140
lea ecx, [ebp - 0x3f0]
push ecx
lea edx, [ebp - 0x3d8]
push edx
lea ecx, [ebp - 0x938]
call fcn.10004a60
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x4a4], eax
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x4a4]
call fcn.10002a60
mov ecx, eax
call fcn.1001ebd0
push eax
mov ecx, dword [ebp - 0x474]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x474]
mov eax, dword [edx + 0x1c]
call eax
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x938]
call fcn.10005a70
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x3d8]
call fcn.10005680
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x3f0]
call fcn.10005680
mov dword [ebp - 0x42c], 4
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x258]
call fcn.10005680
jmp 0x10029dee
call fcn.1003eb30
mov dword [ebp - 0x478], eax
push 1
mov ecx, dword [ebp - 0x478]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x478]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 0x4a8], al
cmp byte [ebp - 0x4a8], 1
je 0x10029d0a
jmp 0x10029dcd
push 0x1009ff00
lea ecx, [ebp - 0x408]
call fcn.10004260
mov byte [ebp - 4], 0x1c
push 0x1009febc
lea ecx, [ebp - 0x420]
call fcn.10004260
mov byte [ebp - 4], 0x1d
call fcn.1003eb30
mov dword [ebp - 0x47c], eax
lea ecx, [ebp + 0x10]
push ecx
push str.DLLInjection::InjectByDrive_suc_dwProcessId
push 0x146
lea edx, [ebp - 0x408]
push edx
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x9d0]
call fcn.10004a60
mov dword [ebp - 0x4ac], eax
mov ecx, dword [ebp - 0x4ac]
mov dword [ebp - 0x4b0], ecx
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x4b0]
call fcn.10002a60
mov ecx, eax
call fcn.1001ebd0
push eax
mov edx, dword [ebp - 0x47c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x47c]
mov edx, dword [eax + 0x1c]
call edx
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x9d0]
call fcn.10005a70
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x420]
call fcn.10005680
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x408]
call fcn.10005680
mov dword [ebp - 0x440], 1
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x258]
call fcn.10005680
xor eax, eax
jne 0x10029686
mov ecx, dword [ebp - 0x42c]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x440]
push ecx
call fcn.10026e30
mov ecx, eax
call fcn.10032310
mov edx, dword [ebp - 0x440]
mov dword [ebp - 0x4b4], edx
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x444]
call fcn.100054b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x430]
call fcn.100054b0
mov eax, dword [ebp - 0x4b4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005dfd5
mov esp, ebp
pop ebp
ret 0xc