Function at 0x100344cd
Capabilities:
Create process on windows
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061b8d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x168
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x8c], 0x66ca
mov dword [ebp - 0xe0], str.txnf_dcajhg_itzebh_wwn_blngrq_knrcqk_dkgoihn_diczsweb_dwylk_gib_pkpqiza
cmp dword [ebp - 0x8c], 0x69fe
jle 0x100345a2
and dword [ebp - 0x38], 0
jmp 0x10034523
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x54b
jge 0x10034595
and dword [ebp - 0x34], 0
jmp 0x10034539
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x71b6
jge 0x10034593
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x34]
cdq
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], edx
push dword [ebp - 0x114]
push dword [ebp - 0x118]
lea ecx, [ebp - 0x178]
call fcn.10001a55
pop ecx
pop ecx
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
call fcn.10004648
push eax
call fcn.100483dc
pop ecx
lea ecx, [ebp - 0x178]
call fcn.1000463e
jmp 0x10034532
jmp 0x1003451c
push 0x1489
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10034d38
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xfc], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0xe4], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xf8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x10c]
movzx eax, byte [eax]
test eax, eax
je 0x100346d0
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x128], eax
push dword [ebp - 0x128]
mov eax, dword [ebp - 0xcc]
push dword [eax]
mov eax, dword [ebp - 0xe8]
push dword [eax]
lea eax, [ebp - 0x160]
push eax
call fcn.1002f180
add esp, 0x10
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xec], eax
and dword [ebp - 4], 0
push dword [ebp - 0xec]
mov ecx, dword [ebp - 0xdc]
call fcn.10036212
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.10004a84
jmp 0x10034d36
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x5c], 0x44455595
mov dword [ebp - 0x58], 0x44455595
mov dword [ebp - 0x54], 0x44455595
mov dword [ebp - 0x50], 0x44455595
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x30], 0
jmp 0x1003472d
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x10034743
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xac], 0x9649
jmp 0x10034726
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + eax - 0x5c]
je 0x1003475e
mov dword [ebp - 0x88], 1
jmp 0x10034765
and dword [ebp - 0x88], 0
cmp dword [ebp - 0x88], 0xfffffffa
jl 0x1003477a
mov dword [ebp - 0x94], 1
jmp 0x10034781
and dword [ebp - 0x94], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x94]
sub ecx, dword [ebp + eax - 0x5c]
jne 0x100347b9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5c], 0
jne 0x100347b9
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5c], 0
jne 0x100347b9
and dword [ebp - 0x9c], 0
jmp 0x100347c3
mov dword [ebp - 0x9c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5c]
cmp eax, dword [ebp - 0x9c]
jle 0x100347e5
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x100347e5
and dword [ebp - 0xf0], 0
jmp 0x100347ef
mov dword [ebp - 0xf0], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5c]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x134], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x5c]
imul ecx, dword [ebp + eax - 0x5c]
cmp ecx, dword [ebp - 0x14]
jg 0x1003482e
mov dword [ebp - 0xa4], 1
jmp 0x10034835
and dword [ebp - 0xa4], 0
cmp dword [ebp - 0xa4], 0xa814b11f
ja 0x1003484d
mov dword [ebp - 0x11c], 1
jmp 0x10034854
and dword [ebp - 0x11c], 0
mov eax, 0x3bf58aae
test eax, eax
je 0x10034873
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5c], 0
je 0x10034873
mov dword [ebp - 0x68], 1
jmp 0x10034877
and dword [ebp - 0x68], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x68]
mov dword [ebp + eax - 0x5c], ecx
mov dword [ebp - 0x14], 0
jmp 0x10034894
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x100348b0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x5c]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xac], eax
jmp 0x1003488d
lea ecx, [ebp - 0x150]
call fcn.1003605d
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x60]
push dword [eax]
lea ecx, [ebp - 0x150]
call fcn.1001f7cf
and dword [ebp - 0x24], 0
jmp 0x100348df
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [eax]
jae 0x10034d04
push 1
lea ecx, [ebp - 0x48]
call fcn.10004892
mov byte [ebp - 4], 2
push 0x70ca
push 0x34f2
push 0x5345
push 0x7698
lea eax, [ebp - 0x154]
push eax
push 0
push 1
lea eax, [ebp - 0x48]
push eax
push 0x56ff
call fcn.1002d17a
add esp, 0x24
push 0
lea ecx, [ebp - 0x48]
call fcn.10004910
and dword [eax], 0
jmp 0x10034952
push 0
lea ecx, [ebp - 0x48]
call fcn.10004910
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x70]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x48]
call fcn.10004910
cmp dword [eax], 0x1a
jle 0x10034cb1
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x28], 0
jmp 0x1003497c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1003498f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x20], 0xfb6318d5
jmp 0x10034975
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x20], 0xffffffed
jmp 0x100349b4
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x20]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x20], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x20], 0xb
jl 0x10034acc
mov dword [ebp - 0x98], 0xed2
mov dword [ebp - 0xb0], str.nsrse_cuz_pgrrouou_ukdnu_bacoyspd_stbxjwcg_nhh_zdoaxm_bmdz_qclb
cmp dword [ebp - 0x98], 0xf29
jle 0x10034a53
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
and dword [ebp - 0x3c], 0
jmp 0x100349fa
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x4366
jge 0x10034a46
and dword [ebp - 0x2c], 0
jmp 0x10034a10
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x2ae7
jge 0x10034a44
mov eax, dword [ebp - 0x3c]
or eax, dword [ebp - 0x2c]
cdq
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], edx
push dword [ebp - 0x120]
push dword [ebp - 0x124]
mov ecx, 0x1007c858
call fcn.10004668
jmp 0x10034a09
jmp 0x100349f3
push 0xb0a
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov dword [ebp - 0xb8], 5
mov byte [ebp - 4], 3
cmp dword [ebp - 0x98], 0xd69
jge 0x10034a7d
mov edx, dword [ebp - 0xb0]
mov ecx, 0x1007c858
call fcn.10006b3c
jmp 0x10034a99
mov dword [ebp - 4], 2
jmp 0x10034aa9
mov dword [ebp - 0xb8], 4
push 0
lea ecx, [ebp - 0x48]
call fcn.10004910
cmp dword [eax], 0
je 0x10034ac7
jmp 0x1003499f
jmp 0x1003499f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x20], 0
jne 0x10034ae8
mov eax, 0x29ef4a04
test eax, eax
jne 0x10034ae8
and dword [ebp - 0x78], 0
jmp 0x10034aef
mov dword [ebp - 0x78], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
imul eax, dword [ebp - 0x78]
test eax, eax
je 0x10034b7e
push 0
lea ecx, [ebp - 0x48]
call fcn.10004910
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
push 4
pop edx
shl edx, 0
mov edx, dword [ebp + edx - 0x20]
imul edx, dword [ebp + ecx - 0x20]
cmp edx, dword [ebp + eax - 0x20]
jg 0x10034b38
mov dword [ebp - 0x90], 1
jmp 0x10034b3f
and dword [ebp - 0x90], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
cmp dword [ebp - 0x90], eax
jle 0x10034b5a
mov dword [ebp - 0x80], 1
jmp 0x10034b5e
and dword [ebp - 0x80], 0
cmp dword [ebp - 0x80], 3
jb 0x10034b77
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x10034b77
mov dword [ebp - 0xa0], 1
jmp 0x10034b7e
and dword [ebp - 0xa0], 0
push 0
lea ecx, [ebp - 0x48]
call fcn.10004910
push 0
lea ecx, [ebp - 0x48]
call fcn.10004910
cmp dword [eax], 0x2a2e
jne 0x10034bab
xor eax, eax
inc eax
je 0x10034bab
mov dword [ebp - 0xc0], 1
jmp 0x10034bb2
and dword [ebp - 0xc0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
mov dword [ebp - 0x138], eax
push 0
lea ecx, [ebp - 0x48]
call fcn.10004910
mov esi, dword [ebp - 0x6c]
push 0
lea ecx, [ebp - 0x48]
call fcn.10004910
cmp dword [eax], esi
jge 0x10034be6
mov dword [ebp - 0x4c], 1
jmp 0x10034bea
and dword [ebp - 0x4c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4c]
mov dword [ebp + eax - 0x20], ecx
cmp dword [ebp - 0x4c], 0
jne 0x10034c15
push 0
lea ecx, [ebp - 0x48]
call fcn.10004910
cmp dword [eax], 0
je 0x10034c15
mov dword [ebp - 0x64], 1
jmp 0x10034c19
and dword [ebp - 0x64], 0
cmp dword [ebp - 0x64], 0xffffffff
jg 0x10034c28
mov dword [ebp - 0x74], 1
jmp 0x10034c2c
and dword [ebp - 0x74], 0
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x74]
je 0x10034c6f
mov byte [ebp - 0x15], 0
push 0x4237
push 0xcef
push 0x69da
push 0
push 0x3ed9
push 0x6ced
push 1
push 0x6b65
lea eax, [ebp - 0x15]
push eax
push 0x58e6
push 1
call fcn.10032ab2
add esp, 0x2c
jmp 0x10034cac
mov dword [ebp - 0xc8], 2
push 0x16e8
lea eax, [ebp - 0xc8]
push eax
push 0
push 0
push 1
push 0x6f00
push 0xbc0
push 0x6fdd
push 0x2171
push 0x5e16
call fcn.10034de0
add esp, 0x28
jmp 0x1003493a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.100048f4
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
add eax, dword [ebp - 0x24]
xor edx, edx
div dword [0x1007beb0]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 4]
movzx edx, byte [eax + edx]
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
add eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ecx]
movzx ecx, byte [ecx + eax]
call fcn.10007eef
push eax
lea ecx, [ebp - 0x150]
call fcn.1003608c
jmp 0x100348d8
lea eax, [ebp - 0x150]
push eax
mov ecx, dword [ebp - 0xd0]
call fcn.1003606e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.1001c6d3
jmp 0x10034da0
jmp 0x10034d5b
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xd8], eax
push 0x14c6
push 0
push dword [ebp - 0xd8]
push 0x3674
call fcn.10035d46
add esp, 0x10
mov dword [ebp - 4], 5
cmp dword [ebp - 0x8c], 0x64f6
jge 0x10034d7a
push dword [ebp - 0xe0]
call fcn.100483dc
pop ecx
jmp 0x10034d96
or dword [ebp - 4], 0xffffffff
jmp 0x10034da0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret