Function at 0x10015200
Capabilities:
Check if file exists
Get file attributes
Manipulate boot configuration
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100340fc
mov eax, dword fs:[0]
push eax
sub esp, 0x958
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x92c], ecx
mov byte [ebp - 0x11c], 0
push 0xff
push 0
lea eax, [ebp - 0x11b]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
cmp dword [ebp + 0xc], 5
jg 0x100155cd
mov dword [ebp - 0x320], 0
mov dword [ebp - 0x328], 0
push 0x10037348
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.MSVCR80.dll_fopen]
add esp, 8
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
jne 0x10015294
xor eax, eax
jmp 0x100162d5
push 0x100000
call fcn.1000f66d
add esp, 4
mov dword [ebp - 0x8bc], eax
mov edx, dword [ebp - 0x8bc]
mov dword [ebp - 0x320], edx
push 0x100000
push 0
mov eax, dword [ebp - 0x320]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push pe_nt_image_headers32
push 0
lea ecx, [ebp - 0x11c]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x324]
push edx
push 0x200
lea eax, [ebp - 0x52c]
push eax
call dword [sym.imp.MSVCR80.dll_fgets]
add esp, 0xc
test eax, eax
je 0x100153f7
push 0x1003734c
call sub.ntdll.dll_strlen
add esp, 4
neg eax
sbb eax, eax
add eax, 1
push eax
lea ecx, [ebp - 0x52c]
push ecx
push 0x10037360
call dword [sym.imp.ntdll.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x1001533b
mov dword [ebp - 0x328], 1
cmp dword [ebp - 0x328], 0
je 0x100153dc
movsx edx, byte [ebp - 0x52c]
cmp edx, 0x5b
jne 0x100153dc
lea eax, [ebp - 0x52c]
push eax
call sub.ntdll.dll_strlen
add esp, 4
movsx ecx, byte [ebp + eax - 0x52d]
cmp ecx, 0x5d
jne 0x100153dc
mov edx, dword [ebp - 0x320]
push edx
call sub.ntdll.dll_strlen
add esp, 4
mov ecx, dword [ebp - 0x320]
movsx edx, byte [ecx + eax - 1]
cmp edx, 0xa
je 0x100153a7
push 0x10037374
mov eax, dword [ebp - 0x320]
push eax
call sub.ntdll.dll_strcat
add esp, 8
push 0x10037378
movsx ecx, byte [ebp + 0x10]
push ecx
push 0x10037380
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 0x320]
push ecx
call sub.ntdll.dll_strcat
add esp, 8
lea edx, [ebp - 0x52c]
push edx
mov eax, dword [ebp - 0x320]
push eax
call sub.ntdll.dll_strcat
add esp, 8
jmp 0x100152df
cmp dword [ebp - 0x328], 0
jne 0x10015495
mov ecx, dword [ebp - 0x320]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
mov edx, dword [ebp - 0x320]
movsx eax, byte [edx + eax - 1]
cmp eax, 0xa
je 0x10015437
push 0x1003739c
mov ecx, dword [ebp - 0x320]
push ecx
call sub.ntdll.dll_strcat
add esp, 8
mov edx, dword [ebp + 0x18]
and edx, 1
jne 0x10015460
push 0x100373a0
movsx eax, byte [ebp + 0x10]
push eax
push 0x100373a8
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x10
jmp 0x1001547f
push 0x100373c4
movsx edx, byte [ebp + 0x10]
push edx
push str._c:_s_AOMEI_Backupper__n
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 0x320]
push edx
call sub.ntdll.dll_strcat
add esp, 8
mov eax, dword [ebp - 0x324]
push eax
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
push pe_nt_image_headers32
push 0
lea ecx, [ebp - 0x11c]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x11c]
push eax
call sub.ntdll.dll_strcpy
add esp, 8
push 0x80
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x100154eb
xor eax, eax
jmp 0x100162d5
push 0x100373e8
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.MSVCR80.dll_fopen]
add esp, 8
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
jne 0x1001552e
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x8c0], eax
mov ecx, dword [ebp - 0x8c0]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
xor eax, eax
jmp 0x100162d5
mov edx, dword [ebp - 0x320]
push edx
call sub.ntdll.dll_strlen
add esp, 4
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x324]
push eax
mov ecx, dword [ebp - 0x530]
push ecx
push 1
mov edx, dword [ebp - 0x320]
push edx
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
cmp eax, dword [ebp - 0x530]
je 0x1001559d
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x8c4], eax
mov ecx, dword [ebp - 0x8c4]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov edx, dword [ebp - 0x324]
push edx
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
xor eax, eax
jmp 0x100162d5
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x8c8], eax
mov ecx, dword [ebp - 0x8c8]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov edx, dword [ebp - 0x324]
push edx
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
jmp 0x10016193
mov dword [ebp - 0x64c], 0
push 0x80000
call fcn.1000f66d
add esp, 4
mov dword [ebp - 0x8cc], eax
mov eax, dword [ebp - 0x8cc]
mov dword [ebp - 0x860], eax
push 0x80000
push 0
mov ecx, dword [ebp - 0x860]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x8ac], 0xffffffff
mov dword [ebp - 0x85c], 0xffffffff
mov dword [ebp - 0x8a8], 0xffffffff
mov dword [ebp - 0x858], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002df30
mov dword [ebp - 4], 0
lea edx, [ebp - 0x8ac]
push edx
lea eax, [ebp - 0x858]
push eax
lea ecx, [ebp - 0x648]
call fcn.1002de40
test eax, eax
jne 0x10015707
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x930], eax
push 0xe4
push 0x100373ec
call fcn.10010eb0
add esp, 8
push eax
push str._s:_Crate_read_PIPE_Failed.
mov ecx, dword [ebp - 0x930]
push ecx
mov edx, dword [ebp - 0x930]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
mov edx, dword [ebp - 0x8ac]
push edx
mov eax, dword [ebp - 0x858]
push eax
mov ecx, dword [ebp - 0x8a8]
push ecx
mov edx, dword [ebp - 0x85c]
push edx
call fcn.10010e80
add esp, 0x10
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0x8d0], eax
mov ecx, dword [ebp - 0x8d0]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x8d4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002ded0
mov eax, dword [ebp - 0x8d4]
jmp 0x100162d5
lea edx, [ebp - 0x8a8]
push edx
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x648]
call fcn.1002ddb0
test eax, eax
jne 0x100157c8
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x934], eax
push 0xec
push 0x10037418
call fcn.10010eb0
add esp, 8
push eax
push 0x10037428
mov ecx, dword [ebp - 0x934]
push ecx
mov edx, dword [ebp - 0x934]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
mov edx, dword [ebp - 0x8ac]
push edx
mov eax, dword [ebp - 0x858]
push eax
mov ecx, dword [ebp - 0x8a8]
push ecx
mov edx, dword [ebp - 0x85c]
push edx
call fcn.10010e80
add esp, 0x10
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0x8d8], eax
mov ecx, dword [ebp - 0x8d8]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x8dc], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002ded0
mov eax, dword [ebp - 0x8dc]
jmp 0x100162d5
mov edx, dword [ebp - 0x8a8]
push edx
mov eax, dword [ebp - 0x8ac]
push eax
lea ecx, [ebp - 0x648]
call fcn.1002db00
test eax, eax
jne 0x10015889
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x938], eax
push 0xf4
push 0x10037448
call fcn.10010eb0
add esp, 8
push eax
push 0x10037458
mov ecx, dword [ebp - 0x938]
push ecx
mov edx, dword [ebp - 0x938]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
mov edx, dword [ebp - 0x8ac]
push edx
mov eax, dword [ebp - 0x858]
push eax
mov ecx, dword [ebp - 0x8a8]
push ecx
mov edx, dword [ebp - 0x85c]
push edx
call fcn.10010e80
add esp, 0x10
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0x8e0], eax
mov ecx, dword [ebp - 0x8e0]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x8e4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002ded0
mov eax, dword [ebp - 0x8e4]
jmp 0x100162d5
mov byte [ebp - 0x63c], 0
push 0x103
push 0
lea edx, [ebp - 0x63b]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x63c]
push eax
call fcn.10011130
add esp, 4
test eax, eax
jne 0x10015904
cmp dword [ebp - 0x860], 0
je 0x100158dd
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0x8e8], ecx
mov edx, dword [ebp - 0x8e8]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x8ec], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002ded0
mov eax, dword [ebp - 0x8ec]
jmp 0x100162d5
mov byte [ebp - 0x854], 0
push 0x1ff
push 0
lea eax, [ebp - 0x853]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x63c]
push ecx
push str._s_bcdedit.exe__create__d__AOMEI_Backupper___application_BOOTSECTOR_n
lea edx, [ebp - 0x854]
push edx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x854]
push eax
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x854]
push ecx
mov edx, dword [ebp - 0x85c]
push edx
lea ecx, [ebp - 0x648]
call fcn.1002dd60
test eax, eax
jne 0x10015a4f
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x93c], eax
lea eax, [ebp - 0x854]
push eax
push 0x109
push 0x100374c0
call fcn.10010eb0
add esp, 8
push eax
push 0x100374d0
mov ecx, dword [ebp - 0x93c]
push ecx
mov edx, dword [ebp - 0x93c]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0x10
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x940], eax
push 0x10a
push 0x100374e0
call fcn.10010eb0
add esp, 8
push eax
push 0x100374f0
mov edx, dword [ebp - 0x940]
push edx
mov eax, dword [ebp - 0x940]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0xc
mov eax, dword [ebp - 0x8ac]
push eax
mov ecx, dword [ebp - 0x858]
push ecx
mov edx, dword [ebp - 0x8a8]
push edx
mov eax, dword [ebp - 0x85c]
push eax
call fcn.10010e80
add esp, 0x10
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0x8f0], ecx
mov edx, dword [ebp - 0x8f0]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x8f4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002ded0
mov eax, dword [ebp - 0x8f4]
jmp 0x100162d5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x64c]
push eax
mov ecx, dword [ebp - 0x860]
push ecx
mov edx, dword [ebp - 0x858]
push edx
lea ecx, [ebp - 0x648]
call fcn.1002dc20
test eax, eax
jne 0x10015b22
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x944], eax
push 0x113
push 0x1003750c
call fcn.10010eb0
add esp, 8
push eax
push 0x1003751c
mov eax, dword [ebp - 0x944]
push eax
mov ecx, dword [ebp - 0x944]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
add esp, 0xc
mov ecx, dword [ebp - 0x8ac]
push ecx
mov edx, dword [ebp - 0x858]
push edx
mov eax, dword [ebp - 0x8a8]
push eax
mov ecx, dword [ebp - 0x85c]
push ecx
call fcn.10010e80
add esp, 0x10
mov edx, dword [ebp - 0x860]
mov dword [ebp - 0x8f8], edx
mov eax, dword [ebp - 0x8f8]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x8fc], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002ded0
mov eax, dword [ebp - 0x8fc]
jmp 0x100162d5
mov dword [ebp - 0x650], 0
mov byte [ebp - 0x8a4], 0
push 0x3f
push 0
lea ecx, [ebp - 0x8a3]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x8b0], 0
jmp 0x10015b61
mov edx, dword [ebp - 0x8b0]
add edx, 1
mov dword [ebp - 0x8b0], edx
mov eax, dword [ebp - 0x8b0]
cmp eax, dword [ebp - 0x64c]
jge 0x10015c1c
mov ecx, dword [ebp - 0x860]
add ecx, dword [ebp - 0x8b0]
movsx edx, byte [ecx]
cmp edx, 0x7b
jne 0x10015c0c
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x8b8], eax
mov dword [ebp - 0x8b4], 0
jmp 0x10015bc1
mov ecx, dword [ebp - 0x8b8]
add ecx, 1
mov dword [ebp - 0x8b8], ecx
mov edx, dword [ebp - 0x8b4]
add edx, 1
mov dword [ebp - 0x8b4], edx
mov eax, dword [ebp - 0x8b8]
cmp eax, dword [ebp - 0x64c]
jge 0x10015c0c
mov ecx, dword [ebp - 0x860]
add ecx, dword [ebp - 0x8b8]
mov edx, dword [ebp - 0x8b4]
mov al, byte [ecx]
mov byte [ebp + edx - 0x8a4], al
mov ecx, dword [ebp - 0x860]
add ecx, dword [ebp - 0x8b8]
movsx edx, byte [ecx]
cmp edx, 0x7d
jne 0x10015c0a
mov dword [ebp - 0x650], 1
jmp 0x10015c0c
jmp 0x10015ba3
cmp dword [ebp - 0x650], 0
je 0x10015c17
jmp 0x10015c1c
jmp 0x10015b52
cmp dword [ebp - 0x650], 0
jne 0x10015cd0
mov eax, dword [ebp - 0x8ac]
push eax
mov ecx, dword [ebp - 0x858]
push ecx
mov edx, dword [ebp - 0x8a8]
push edx
mov eax, dword [ebp - 0x85c]
push eax
call fcn.10010e80
add esp, 0x10
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0x900], ecx
mov edx, dword [ebp - 0x900]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x948], eax
lea eax, [ebp - 0x854]
push eax
push 0x132
push 0x10037538
call fcn.10010eb0
add esp, 8
push eax
push str._s:__s_Failed.
mov ecx, dword [ebp - 0x948]
push ecx
mov edx, dword [ebp - 0x948]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0x10
mov dword [ebp - 0x904], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002ded0
mov eax, dword [ebp - 0x904]
jmp 0x100162d5
push 0x200
push 0
lea edx, [ebp - 0x854]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
movsx eax, byte [ebp + 0x10]
push eax
lea ecx, [ebp - 0x8a4]
push ecx
lea edx, [ebp - 0x63c]
push edx
push str._s_bcdedit.exe__set__s_device_partition_c:_n
lea eax, [ebp - 0x854]
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x14
lea ecx, [ebp - 0x854]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea edx, [ebp - 0x854]
push edx
mov eax, dword [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x648]
call fcn.1002dd60
test eax, eax
jne 0x10015e20
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x94c], eax
lea ecx, [ebp - 0x854]
push ecx
push 0x13c
push 0x10037588
call fcn.10010eb0
add esp, 8
push eax
push 0x10037598
mov edx, dword [ebp - 0x94c]
push edx
mov eax, dword [ebp - 0x94c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0x10
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x950], eax
push 0x13d
push 0x100375a8
call fcn.10010eb0
add esp, 8
push eax
push 0x100375b8
mov eax, dword [ebp - 0x950]
push eax
mov ecx, dword [ebp - 0x950]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
add esp, 0xc
mov ecx, dword [ebp - 0x8ac]
push ecx
mov edx, dword [ebp - 0x858]
push edx
mov eax, dword [ebp - 0x8a8]
push eax
mov ecx, dword [ebp - 0x85c]
push ecx
call fcn.10010e80
add esp, 0x10
mov edx, dword [ebp - 0x860]
mov dword [ebp - 0x908], edx
mov eax, dword [ebp - 0x908]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x90c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002ded0
mov eax, dword [ebp - 0x90c]
jmp 0x100162d5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x80000
push 0
mov ecx, dword [ebp - 0x860]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
lea edx, [ebp - 0x64c]
push edx
mov eax, dword [ebp - 0x860]
push eax
mov ecx, dword [ebp - 0x858]
push ecx
lea ecx, [ebp - 0x648]
call fcn.1002dc20
test eax, eax
jne 0x10015f09
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x954], eax
push 0x147
push 0x100375d4
call fcn.10010eb0
add esp, 8
push eax
push 0x100375e4
mov edx, dword [ebp - 0x954]
push edx
mov eax, dword [ebp - 0x954]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0xc
mov eax, dword [ebp - 0x8ac]
push eax
mov ecx, dword [ebp - 0x858]
push ecx
mov edx, dword [ebp - 0x8a8]
push edx
mov eax, dword [ebp - 0x85c]
push eax
call fcn.10010e80
add esp, 0x10
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0x910], ecx
mov edx, dword [ebp - 0x910]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x914], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002ded0
mov eax, dword [ebp - 0x914]
jmp 0x100162d5
push 0x200
push 0
lea eax, [ebp - 0x854]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0x10037600
lea ecx, [ebp - 0x8a4]
push ecx
lea edx, [ebp - 0x63c]
push edx
push str._s_bcdedit.exe__set__s_path__s_n
lea eax, [ebp - 0x854]
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x14
lea ecx, [ebp - 0x854]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea edx, [ebp - 0x854]
push edx
mov eax, dword [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x648]
call fcn.1002dd60
test eax, eax
jne 0x10016059
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x958], eax
lea ecx, [ebp - 0x854]
push ecx
push 0x154
push 0x10037630
call fcn.10010eb0
add esp, 8
push eax
push 0x10037640
mov edx, dword [ebp - 0x958]
push edx
mov eax, dword [ebp - 0x958]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0x10
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x95c], eax
push 0x155
push 0x10037650
call fcn.10010eb0
add esp, 8
push eax
push 0x10037660
mov eax, dword [ebp - 0x95c]
push eax
mov ecx, dword [ebp - 0x95c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
add esp, 0xc
mov ecx, dword [ebp - 0x8ac]
push ecx
mov edx, dword [ebp - 0x858]
push edx
mov eax, dword [ebp - 0x8a8]
push eax
mov ecx, dword [ebp - 0x85c]
push ecx
call fcn.10010e80
add esp, 0x10
mov edx, dword [ebp - 0x860]
mov dword [ebp - 0x918], edx
mov eax, dword [ebp - 0x918]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x91c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002ded0
mov eax, dword [ebp - 0x91c]
jmp 0x100162d5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x80000
push 0
mov ecx, dword [ebp - 0x860]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
lea edx, [ebp - 0x64c]
push edx
mov eax, dword [ebp - 0x860]
push eax
mov ecx, dword [ebp - 0x858]
push ecx
lea ecx, [ebp - 0x648]
call fcn.1002dc20
test eax, eax
jne 0x10016142
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x960], eax
push 0x15f
push 0x1003767c
call fcn.10010eb0
add esp, 8
push eax
push 0x1003768c
mov edx, dword [ebp - 0x960]
push edx
mov eax, dword [ebp - 0x960]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0xc
mov eax, dword [ebp - 0x8ac]
push eax
mov ecx, dword [ebp - 0x858]
push ecx
mov edx, dword [ebp - 0x8a8]
push edx
mov eax, dword [ebp - 0x85c]
push eax
call fcn.10010e80
add esp, 0x10
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0x920], ecx
mov edx, dword [ebp - 0x920]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x924], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002ded0
mov eax, dword [ebp - 0x924]
jmp 0x100162d5
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0x928], eax
mov ecx, dword [ebp - 0x928]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov edx, dword [ebp - 0x8ac]
push edx
mov eax, dword [ebp - 0x858]
push eax
mov ecx, dword [ebp - 0x8a8]
push ecx
mov edx, dword [ebp - 0x85c]
push edx
call fcn.10010e80
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002ded0
push pe_nt_image_headers32
push 0
lea eax, [ebp - 0x11c]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
movsx ecx, byte [ebp + 0x10]
push ecx
push 0x100376a8
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100161e7
push 0x80
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x100376b8
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.MSVCR80.dll_fopen]
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1001624d
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x964], eax
lea eax, [ebp - 0x11c]
push eax
push 0x18d
push 0x100376bc
call fcn.10010eb0
add esp, 8
push eax
push 0x100376cc
mov ecx, dword [ebp - 0x964]
push ecx
mov edx, dword [ebp - 0x964]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0x10
xor eax, eax
jmp 0x100162d5
mov byte [ebp - 0x31c], 0
push 0x1ff
push 0
lea edx, [ebp - 0x31b]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x100376e0
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x14
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x31c]
push edx
call sub.ntdll.dll_strlen
add esp, 4
push eax
push 1
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
push 2
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret 0x14