Function at 0x922c80
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xa9acb6
mov eax, dword fs:[0]
push eax
sub esp, 0xadc
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0xa88], ecx
mov dword [ebp - 0xa60], eax
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0xa80]
push ecx
mov dword [ebp - 0xad0], ebx
mov dword [ebp - 0xa98], esi
mov dword [ebp - 0xa58], edi
mov dword [ebp - 0xad8], edx
mov dword [ebp - 0xa94], eax
mov dword [ebp - 0xadc], 0
call fcn.009931a0
xor eax, eax
mov dword [ebp - 4], eax
test byte [0xc100b0], 1
mov dword [ebp - 0xa64], eax
mov dword [ebp - 0xa9c], eax
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0xab8], eax
mov dword [ebp - 0xa5c], eax
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xacc], eax
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xaac], eax
jne 0x922d6e
or dword [0xc100b0], 1
push 0xa9d260
mov dword [0xc0e9d8], eax
mov dword [0xc0e9dc], eax
call fcn.00a7a607
add esp, 4
xor eax, eax
mov dword [ebp - 0xa84], eax
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xa68], eax
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xa50], eax
cmp esi, eax
je 0x922da0
mov dword [esi], eax
cmp edi, eax
je 0x922da6
mov dword [edi], eax
cmp ebx, eax
je 0x922dad
mov byte [ebx], 0
cmp byte [0xbfa388], 0
jne 0x922e74
push 0x104
push 0xbfa388
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, 0xbfa388
call fcn.00960950
push esi
push str.C:WINDOWS_system327z.dll
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [str.C:WINDOWS_system327z.dll], 0
je 0x922e16
mov eax, str.C:WINDOWS_system327z.dll
mov edi, edi
inc eax
cmp byte [eax], 0
jne 0x922df0
sub eax, str.C:WINDOWS_system327z.dll
je 0x922e16
cmp byte [eax + 0xbfa48f], 0x5c
je 0x922e16
push 0xaa1564
push str.C:WINDOWS_system327z.dll
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0xae3194
push str.C:WINDOWS_system327z.dll
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
push 0
xor edx, edx
mov ecx, str.C:WINDOWS_system327z.dll
call fcn.0095a0f0
add esp, 8
test eax, eax
je 0x922ea6
call fcn.00968110
test eax, eax
je 0x922e74
push str.SysWow64_
push str.System32_
push str.C:WINDOWS_system327z.dll
call fcn.0095e130
add esp, 0xc
push 1
push 0
xor edx, edx
mov ecx, str.C:WINDOWS_system327z.dll
call fcn.0095a0f0
add esp, 8
test eax, eax
je 0x922ea6
cmp dword [0xbfa594], 0
jne 0x922eb0
mov eax, dword [ebp - 0xa74]
test eax, eax
je 0x922e90
push eax
call fcn.00a7a9b9
add esp, 4
xor eax, eax
mov dword [ebp - 0xa74], eax
mov dword [ebp - 0xa70], eax
mov dword [ebp - 0xa6c], eax
jmp 0x922f0c
mov dword [0xbfa594], 1
mov ecx, dword [ebp - 0xa60]
xor esi, esi
cmp ecx, esi
je 0x922ec1
cmp word [ecx], si
jne 0x922f39
mov eax, dword [ebp - 0xa88]
cmp eax, esi
je 0x922ed0
cmp eax, 0xffffffff
jne 0x922f3f
cmp dword [0xbfa384], esi
jne 0x922ee7
call fcn.00a759e0
mov dword [0xbfa384], 1
mov eax, dword [ebp - 0xa74]
cmp eax, esi
je 0x922efa
push eax
call fcn.00a7a9b9
add esp, 4
mov dword [ebp - 0xa74], esi
mov dword [ebp - 0xa70], esi
mov dword [ebp - 0xa6c], esi
mov edx, dword [ebp - 0xa80]
push edx
call fcn.00a7a9b9
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xa88]
cmp eax, esi
je 0x923058
cmp eax, 0xffffffff
je 0x923058
mov edi, dword [ebp - 0xa88]
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push edi
call esi
push 0
push 0
push 0
push edi
mov dword [ebp - 0xaac], eax
call esi
mov dword [ebp - 0xa8c], edi
xor esi, esi
push esi
xor eax, eax
lea ecx, [ebp - 0xa90]
push ecx
push 0x20
lea edx, [ebp - 0xa40]
push edx
push edi
mov byte [ebp - 0xa40], 0
mov dword [ebp - 0xa3f], eax
mov dword [ebp - 0xa3b], eax
mov dword [ebp - 0xa37], eax
mov dword [ebp - 0xa33], eax
mov dword [ebp - 0xa2f], eax
mov dword [ebp - 0xa2b], eax
mov dword [ebp - 0xa27], eax
mov word [ebp - 0xa23], ax
mov byte [ebp - 0xa21], al
mov dword [ebp - 0xa90], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x923184
push esi
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov al, byte [ebp - 0xa40]
cmp al, 0x52
jne 0x92310e
cmp byte [ebp - 0xa3f], 0x61
jne 0x923184
cmp byte [ebp - 0xa3e], 0x72
jne 0x923184
cmp byte [ebp - 0xa3d], 0x21
jne 0x923184
cmp byte [ebp - 0xa3c], 0x1a
jne 0x923184
cmp byte [ebp - 0xa3b], 7
jne 0x923184
mov al, byte [ebp - 0xa3a]
test al, al
jne 0x9230ed
mov dword [ebp - 0xa68], 4
jmp 0x923184
cmp ecx, esi
je 0x92307b
cmp word [ecx], si
je 0x92307b
push 0
push 3
push 3
push 0x80000000
mov ebx, ecx
call fcn.0094dc00
mov ebx, dword [ebp - 0xad0]
jmp 0x92308d
push 0
push 3
push 3
push 0x80000000
xor edi, edi
call fcn.0094db00
mov edi, eax
add esp, 0x10
xor esi, esi
mov dword [ebp - 0xa8c], edi
cmp edi, 0xffffffff
jne 0x922f7c
cmp ebx, esi
je 0x9230bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_open_archive__MyCreateFileA_Failed_with_error__u
push ebx
call fcn.00a78f30
add esp, 0xc
mov eax, dword [ebp - 0xa74]
cmp eax, esi
je 0x9230cf
push eax
call fcn.00a7a9b9
add esp, 4
mov eax, dword [ebp - 0xa80]
mov dword [ebp - 0xa74], esi
mov dword [ebp - 0xa70], esi
mov dword [ebp - 0xa6c], esi
push eax
jmp 0x922f13
cmp al, 1
jne 0x923184
cmp byte [ebp - 0xa39], 0
jne 0x923184
mov dword [ebp - 0xa68], 5
jmp 0x923184
cmp al, 0x37
jne 0x92314b
cmp byte [ebp - 0xa3f], 0x7a
jne 0x923184
cmp byte [ebp - 0xa3e], 0xbc
jne 0x923184
cmp byte [ebp - 0xa3d], 0xaf
jne 0x923184
cmp byte [ebp - 0xa3c], 0x27
jne 0x923184
cmp byte [ebp - 0xa3b], 0x1c
jne 0x923184
mov dword [ebp - 0xac8], 1
jmp 0x923184
cmp al, 0x1f
jne 0x923164
cmp byte [ebp - 0xa3f], 0x8b
jne 0x923184
mov dword [ebp - 0xab4], 1
jmp 0x923184
cmp al, 0x42
jne 0x923184
cmp byte [ebp - 0xa3f], 0x5a
jne 0x923184
cmp byte [ebp - 0xa3e], 0x68
jne 0x923184
mov dword [ebp - 0xa50], 1
mov eax, dword [ebp - 0xa60]
cmp eax, esi
je 0x9231d5
cmp word [eax], si
je 0x9231d5
push 0x2e
push eax
call fcn.00a7c507
add esp, 8
cmp eax, esi
je 0x9231d5
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x9231a7
sub ecx, esi
sar ecx, 1
cmp ecx, 4
jne 0x9231d5
movzx eax, word [eax + 4]
cmp ax, 0x30
jb 0x9231d5
cmp ax, 0x39
ja 0x9231d5
mov dword [ebp - 0xac4], 1
mov esi, dword [ebp - 0xa58]
xor ebx, ebx
cmp esi, ebx
je 0x9231eb
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0xa58], ebx
mov dword [ebp - 0xaa4], 0xffffffff
mov dword [ebp - 0xa90], ebx
cmp dword [0xbfa384], ebx
jne 0x92321c
call fcn.00a759e0
mov dword [0xbfa384], 1
mov dword [ebp - 0xa4c], 0xb0b848
mov dword [ebp - 0xa48], 0xc0e9d8
mov dword [ebp - 0xa2c], 0xf
mov dword [ebp - 0xa30], ebx
mov byte [ebp - 0xa40], 0
mov dword [ebp - 0xa28], ebx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xa68]
cmp eax, 4
jne 0x923268
mov dword [ebp - 0xa28], 5
jmp 0x9232c3
cmp eax, 5
jne 0x923279
mov dword [ebp - 0xa28], 0xb
jmp 0x9232c3
cmp dword [ebp - 0xac8], ebx
je 0x92328d
mov dword [ebp - 0xa28], 1
jmp 0x9232c3
cmp dword [ebp - 0xab4], ebx
je 0x9232a1
mov dword [ebp - 0xa28], 3
jmp 0x9232c3
cmp dword [ebp - 0xa50], ebx
je 0x9232b5
mov dword [ebp - 0xa28], 4
jmp 0x9232c3
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0xa4c]
call fcn.00a75eb0
mov eax, dword [ebp - 0xa94]
cmp eax, ebx
je 0x9232d9
mov eax, dword [eax]
mov dword [ebp - 0xa24], eax
cmp eax, ebx
ja 0x9232df
mov dword [ebp - 0xa24], ebx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0xa8c]
push ecx
lea edx, [ebp - 0xa4c]
push edx
lea edx, [ebp - 0xa80]
lea ecx, [ebp - 0xa58]
call fcn.00a75f40
cmp dword [ebp - 0xa58], ebx
je 0x9234fd
mov eax, dword [ebp - 0xa94]
cmp eax, ebx
je 0x9234f2
cmp dword [eax], ebx
jbe 0x9234f2
push 0x207
lea eax, [ebp - 0x21f]
push ebx
push eax
mov byte [ebp - 0x220], 0
call fcn.00a7ffb0
add esp, 0xc
cmp byte [ebp - 0x220], 0
jne 0x92336d
mov eax, dword [ebp - 0xa60]
cmp eax, ebx
je 0x92336d
cmp word [eax], bx
je 0x92336d
push eax
lea ecx, [ebp - 0x220]
push 0xaa8700
push ecx
call fcn.00a78f30
add esp, 0xc
lea esi, [ebp - 0xae0]
lea edi, [ebp - 0xa80]
call fcn.00933d60
mov edi, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0xa54], edi
mov dword [ebp - 0xa50], edx
nop
mov esi, dword [ebp - 0xa70]
cmp dword [ebp - 0xa74], esi
jbe 0x9233a3
call fcn.00a7a8a1
cmp edi, ebx
je 0x9233af
cmp edi, dword [ebp - 0xa80]
je 0x9233b4
call fcn.00a7a8a1
cmp dword [ebp - 0xa50], esi
je 0x9235f1
cmp edi, ebx
jne 0x92341c
call fcn.00a7a8a1
xor eax, eax
mov ecx, dword [ebp - 0xa50]
cmp ecx, dword [eax + 0x10]
jb 0x9233db
call fcn.00a7a8a1
mov edx, dword [ebp - 0xa50]
cmp dword [edx + 0x208], ebx
jne 0x9234c4
lea esi, [ebp - 0xa54]
call fcn.00933d80
cmp dword [eax + 0x20c], ebx
je 0x9234c4
mov ecx, dword [ebp - 0xa94]
mov eax, dword [ecx]
cmp eax, 4
jne 0x923420
mov dword [ecx], 0xff
jmp 0x9235f1
mov eax, dword [edi]
jmp 0x9233cb
cmp eax, 1
je 0x92342e
cmp eax, 2
jne 0x9234be
push 0x7ff
lea eax, [ebp - 0xa1f]
push ebx
push eax
mov dword [ebp - 0xa58], ebx
mov byte [ebp - 0xa20], 0
call fcn.00a7ffb0
add esp, 0xc
lea esi, [ebp - 0xa54]
call fcn.00933d80
test eax, eax
je 0x9234be
call fcn.00933d80
cmp byte [eax], 0
je 0x9234be
call fcn.00933d80
lea edx, [ebp - 0xa20]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x923474
mov esi, dword [ebp - 0xa94]
mov ecx, dword [esi]
push ecx
lea edx, [ebp - 0xa20]
push edx
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0xa58]
call fcn.0092fbf0
add esp, 0xc
cmp eax, ebx
je 0x9234b2
mov dword [esi], 0xff
jmp 0x9235f1
cmp dword [ebp - 0xa58], ebx
jne 0x9235f1
inc dword [ebp - 0xa84]
cmp edi, ebx
jne 0x9234ee
call fcn.00a7a8a1
xor eax, eax
mov ecx, dword [ebp - 0xa50]
cmp ecx, dword [eax + 0x10]
jb 0x9234df
call fcn.00a7a8a1
add dword [ebp - 0xa50], 0x210
jmp 0x923390
mov eax, dword [edi]
jmp 0x9234cf
mov dword [ebp - 0xa64], ebx
jmp 0x9235f1
mov esi, dword [ebp - 0xa74]
mov eax, dword [ebp - 0xa70]
cmp esi, eax
jbe 0x923518
call fcn.00a7a8a1
mov eax, dword [ebp - 0xa70]
mov edi, dword [ebp - 0xa80]
mov ebx, esi
mov dword [ebp - 0xa54], edi
mov dword [ebp - 0xa50], ebx
lea esp, [esp]
mov esi, eax
cmp dword [ebp - 0xa74], eax
jbe 0x92353f
call fcn.00a7a8a1
test edi, edi
je 0x92354b
cmp edi, dword [ebp - 0xa80]
je 0x923550
call fcn.00a7a8a1
cmp ebx, esi
je 0x9235ef
cmp dword [ebp - 0xad4], 0
mov esi, dword [ebp - 0xa54]
je 0x923590
test esi, esi
jne 0x923640
call fcn.00a7a8a1
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x923580
call fcn.00a7a8a1
push ebx
push str._ARC__fn:__s_
push 0
call fcn.0096a780
add esp, 0xc
test esi, esi
jne 0x923647
call fcn.00a7a8a1
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x9235a9
call fcn.00a7a8a1
cmp dword [ebx + 0x208], 0
je 0x923655
test esi, esi
jne 0x92364e
call fcn.00a7a8a1
cmp ebx, dword [esi + 0x10]
jb 0x9235cd
call fcn.00a7a8a1
mov edi, dword [ebp - 0xa50]
mov ebx, 1
call fcn.009229c0
test eax, eax
je 0x923aa7
mov dword [ebp - 0xa64], 0
xor ebx, ebx
cmp dword [ebp - 0xa2c], 0x10
jb 0x923609
mov edx, dword [ebp - 0xa40]
push edx
call fcn.00a7a9b9
add esp, 4
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0xa88]
mov esi, dword [ebp - 0xa5c]
xor edi, edi
cmp eax, edi
je 0x923b2f
cmp eax, 0xffffffff
je 0x923b2f
mov ecx, dword [ebp - 0xaac]
push edi
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x923b3b
mov eax, dword [esi]
jmp 0x923576
mov eax, dword [esi]
jmp 0x92359f
mov esi, dword [esi]
jmp 0x9235c3
push 0x7ff
lea edx, [ebp - 0xa1f]
push 0
push edx
mov byte [ebp - 0xa20], 0
call fcn.00a7ffb0
add esp, 0xc
xor edi, edi
test esi, esi
jne 0x9236c1
call fcn.00a7a8a1
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x923689
call fcn.00a7a8a1
test esi, esi
jne 0x9236c5
call fcn.00a7a8a1
cmp ebx, dword [esi + 0x10]
jb 0x92369c
call fcn.00a7a8a1
cmp byte [ebx], 0
je 0x9236c9
lea esi, [ebp - 0xa54]
call fcn.00933d80
lea edx, [ebp - 0xa20]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x9236b2
jmp 0x92377f
mov eax, dword [esi]
jmp 0x92367f
mov esi, dword [esi]
jmp 0x923692
cmp dword [ebp + 0xc], 1
jne 0x92377f
mov esi, dword [ebp - 0xadc]
xor ebx, ebx
mov dword [ebp - 0xa58], ebx
cmp esi, ebx
je 0x9236e9
cmp byte [esi], bl
jne 0x923724
cmp dword [ebp - 0xa60], ebx
je 0x92377f
mov eax, dword [ebp - 0xa60]
cmp word [eax], si
je 0x92377f
mov ecx, eax
push ecx
lea ebx, [ebp - 0xa58]
call fcn.00970520
mov esi, dword [ebp - 0xa58]
add esp, 4
test esi, esi
je 0x92377f
mov ebx, 1
test esi, esi
je 0x923772
cmp byte [esi], 0
je 0x923772
push 0x5c
push esi
call fcn.00a7aa50
add esp, 8
test eax, eax
je 0x92373f
inc eax
jmp 0x923741
mov eax, esi
mov ecx, eax
lea edx, [ebp - 0xa20]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x923750
lea edx, [ebp - 0xa20]
push 0x2e
push edx
call fcn.00a7aa50
add esp, 8
test eax, eax
je 0x923772
mov byte [eax], 0
test ebx, ebx
je 0x92377f
push esi
call fcn.00a78fec
add esp, 4
cmp dword [ebp - 0xaa4], 0xffffffff
jne 0x9237cc
xor ebx, ebx
mov dword [ebp - 0xaa4], ebx
cmp byte [ebp - 0xa20], bl
je 0x92380a
mov al, 0x5c
lea edx, [ebp - 0xa20]
call fcn.00975920
mov esi, eax
mov al, 0x2f
lea edx, [ebp - 0xa20]
call fcn.00975920
add esi, eax
cmp esi, 2
mov dword [ebp - 0xaa4], esi
jl 0x9237cc
mov dword [ebp - 0xa64], ebx
jmp 0x9235ef
cmp byte [ebp - 0xa20], 0
je 0x92380a
lea eax, [ebp - 0xa20]
push 0x2e
push eax
call fcn.00a7aa50
mov edi, eax
add esp, 8
test edi, edi
jne 0x923812
lea ecx, [ebp - 0xa20]
push 0x5f
push ecx
call fcn.00a7aa50
mov edi, eax
add esp, 8
test edi, edi
je 0x923a0f
mov byte [edi], 0x2e
test edi, edi
je 0x923a0f
mov eax, str..txt
mov ecx, edi
call fcn.0094c330
test eax, eax
jne 0x923836
cmp dword [ebp - 0xa9c], 3
jae 0x923836
inc dword [ebp - 0xa9c]
jmp 0x923aa7
test edi, edi
je 0x923a0f
mov eax, 0xae0f28
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x923aa7
mov eax, str..json
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x923aa7
mov eax, 0xae0f18
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x923aa7
lea edx, [ebp - 0xa20]
push edx
call fcn.00919c00
add esp, 4
test eax, eax
je 0x9238bb
cmp dword [ebp - 0xaa0], 0
jne 0x9238a5
mov dword [ebp - 0xaa0], 1
jmp 0x923a5f
add dword [ebp - 0xa5c], 2
mov dword [ebp - 0xaa0], 0
jmp 0x923a5f
mov ebx, dword [ebp - 0xa98]
test ebx, ebx
je 0x923a0f
lea esi, [ebp - 0xa54]
call fcn.00933d80
mov eax, dword [eax + 0x20c]
push eax
lea ecx, [ebp - 0xa20]
push ecx
call fcn.00919660
add esp, 8
test eax, eax
jne 0x923906
mov eax, 0xaba8a4
lea ecx, [ebp - 0xa20]
call fcn.0094c3e0
test eax, eax
jne 0x923a0f
mov eax, str..LNK
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x923978
mov eax, 0xace5f4
mov ecx, edi
call fcn.0094c330
test eax, eax
jne 0x923932
mov dword [ebp - 0xacc], 1
jmp 0x923978
mov eax, 0xace5d4
mov ecx, edi
call fcn.0094c330
test eax, eax
jne 0x92394e
mov dword [ebp - 0xab0], 1
jmp 0x923978
mov eax, str..SCR
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x92396e
mov eax, str..PIF
mov ecx, edi
call fcn.0094c330
test eax, eax
jne 0x923978
mov dword [ebp - 0xabc], 1
cmp dword [ebp - 0xaa8], 0
mov dword [ebx], 1
jne 0x92399e
lea esi, [ebp - 0xa54]
call fcn.00933d80
mov edx, dword [eax + 0x20c]
mov dword [ebp - 0xaa8], edx
push 0x103
lea eax, [ebp - 0x11f]
push 0
push eax
mov dword [ebp - 0xa68], 0
mov byte [ebp - 0x120], 0
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp - 0xa68]
push ecx
push str.cmd.exe_chcp.com_route.exe_conime.exe_userinit.exe_winlogon.exe_imapi.exe_svchost.exe_taskeng.exe_netsh.exe_eventvwr.exe_cnab5rpk.exe_wscntfy.exe_mobsync.exe_xcopy.exe_SearchFilterHost.exe_AUDIODG.EXE_conhost.exe_cacls.exe_cleanmgr.exe_control.exe_cscript.exe_ctfmon.exe_drwtsn32.exe_dwwin.exe_ntbackup.exe_PresentationHost.exe_reg.exe_regsvr32.exe_rundll32.exe_sndvol32.exe_taskhost.exe_tcpsvcs.exe_wbengine.exe_wiaacmgr.exe_CompatTelRunner.exe_DeviceDisplayObjectProvider.exe_dinotify.exe_DllHost.exe_hkcmd.exe_igfxtray.exe_netplwiz.exe_ntvdm.exe_rstrui.exe_SearchProtocolHost.exe_SndVol.exe_sndvol32.exe_spoolsv.exe_sysocmgr.exe_WScript.exe_wgatray.exe_systempropertiesadvanced.exe_systempropertiesprotection.exe_inetinfo.exe_mode.com_logon.scr_logonui.exe_mmc.exe_msdtc.exe_mshta.exe_mspaint.exe_notepad.exe_smss.exe_csrss.exe_wininit.exe_lsass.exe_services.exe_vshost.exe
mov bl, 0x2c
lea edi, [ebp - 0x120]
call fcn.0095ae80
add esp, 8
cmp dword [ebp - 0xa68], 0xffffffff
je 0x923a2a
push 0
mov edx, edi
push edx
lea eax, [ebp - 0xa20]
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x9239c5
mov dword [ebp - 0xa90], 1
jmp 0x923a2a
mov eax, edi
lea ecx, [ebp - 0xa20]
call fcn.00922bc0
test eax, eax
je 0x923a2a
mov dword [ebp - 0xab8], 1
mov edi, 1
cmp dword [ebp - 0xa5c], edi
jne 0x923a59
cmp dword [ebp - 0xa84], 0
jle 0x923a59
lea esi, [ebp - 0xa54]
call fcn.00933d80
mov edx, dword [ebp - 0xaa8]
cmp dword [eax + 0x20c], edx
je 0x923aa1
add dword [ebp - 0xa5c], edi
cmp dword [ebp - 0xa5c], 1
jbe 0x923aa1
mov eax, dword [ebp - 0xa98]
test eax, eax
je 0x9235e5
mov ecx, 1
cmp dword [eax], ecx
jne 0x9235e5
cmp dword [ebp - 0xa90], 0
je 0x9235e5
mov dword [ebp - 0xa5c], ecx
mov dword [ebp - 0xa64], ecx
jmp 0x9235ef
inc dword [ebp - 0xa84]
mov edi, dword [ebp - 0xa54]
test edi, edi
jne 0x923ae3
call fcn.00a7a8a1
xor eax, eax
mov ecx, dword [ebp - 0xa50]
cmp ecx, dword [eax + 0x10]
jb 0x923ac8
call fcn.00a7a8a1
add dword [ebp - 0xa50], 0x210
mov eax, dword [ebp - 0xa70]
mov ebx, dword [ebp - 0xa50]
jmp 0x923530
mov eax, dword [edi]
jmp 0x923ab8
lea edx, [ebp - 0xa8c]
push edx
call fcn.00985290
cmp esi, 1
jne 0x923b54
cmp dword [ebp - 0xab8], edi
je 0x923b54
mov eax, dword [ebp - 0xad8]
cmp eax, edi
je 0x923b54
mov dword [eax], esi
mov eax, dword [ebp - 0xac0]
cmp eax, edi
jne 0x923b9b
cmp esi, 1
jne 0x923b79
cmp dword [ebp - 0xac4], edi
je 0x923ba4
mov eax, dword [ebp - 0xa98]
cmp eax, edi
je 0x923ba4
mov dword [eax], esi
jmp 0x923ba4
cmp esi, 2
je 0x923b83
cmp esi, 3
jne 0x923b9b
cmp dword [ebp - 0xabc], edi
jne 0x923ba4
cmp dword [ebp - 0xacc], edi
jne 0x923ba4
cmp dword [ebp - 0xab0], edi
jne 0x923ba4
cmp esi, 1
jne 0x923be2
cmp eax, edi
jne 0x923be2
mov eax, dword [ebp - 0xa74]
cmp eax, edi
je 0x923bb7
push eax
call fcn.00a7a9b9
add esp, 4
mov eax, dword [ebp - 0xa80]
push eax
mov dword [ebp - 0xa74], edi
mov dword [ebp - 0xa70], edi
mov dword [ebp - 0xa6c], edi
call fcn.00a7a9b9
add esp, 4
mov eax, 1
jmp 0x922f1d
mov eax, dword [ebp - 0xa74]
cmp eax, edi
je 0x923bf5
push eax
call fcn.00a7a9b9
add esp, 4
mov ecx, dword [ebp - 0xa80]
push ecx
mov dword [ebp - 0xa74], edi
mov dword [ebp - 0xa70], edi
mov dword [ebp - 0xa6c], edi
call fcn.00a7a9b9
mov eax, dword [ebp - 0xa64]
add esp, 4
jmp 0x922f1d