Function at 0x10013a60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004bf4f
mov eax, dword fs:[0]
push eax
sub esp, 0x35c
mov eax, dword [0x100691d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.1002fe40
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x10053074
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10014424
xor eax, eax
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 7
mov word [ebp - 0x12c], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], 7
mov word [ebp - 0x144], ax
push 0x1388
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x364], esp
push str.SoftResHaoKanWP
call fcn.10003c00
mov esi, dword [0x1006b784]
mov byte [ebp - 4], 2
test esi, esi
jne 0x10013bb3
push 0x1006b788
mov dword [ebp - 0x368], 0x1006b788
call fcn.10017bee
add esp, 4
test eax, eax
je 0x10013b58
push eax
call fcn.10017ca6
add esp, 4
mov esi, dword [0x1006b784]
mov byte [ebp - 4], 3
test esi, esi
jne 0x10013b91
push 0x18
call fcn.10018a99
add esp, 4
mov dword [ebp - 0x35c], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x10013b89
mov ecx, eax
call fcn.1000b530
mov esi, eax
jmp 0x10013b8b
xor esi, esi
mov dword [0x1006b784], esi
push 0x1006b788
mov byte [ebp - 4], 5
call fcn.10017c13
add esp, 4
test eax, eax
je 0x10013baf
push eax
call fcn.10017ca6
add esp, 4
mov byte [ebp - 4], 2
push dword [0x1006bdf8]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.1000ce80
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1006c484]
mov esi, dword [eax + ecx*4]
mov eax, dword [0x1006b904]
cmp eax, dword [esi + 4]
jg 0x1001443f
mov eax, dword [0x1006b9cc]
cmp eax, dword [esi + 4]
jg 0x10014487
mov eax, dword [0x1006bde8]
cmp eax, dword [esi + 4]
jg 0x100144cf
push 0
push 0
push dword [0x1006bdf8]
mov ecx, 0x1006b868
call fcn.100082d0
lea eax, [ebp - 0x1d4]
mov ecx, 0x1006b908
push eax
call fcn.10010900
sub esp, 0x18
mov byte [ebp - 4], 9
mov edi, esp
lea ecx, [ebp - 0x1d4]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
cmp dword [ebp - 0x1c0], 8
mov eax, dword [ebp - 0x1c4]
cmovae ecx, dword [ebp - 0x1d4]
mov dword [ebp - 0x358], eax
mov dword [ebp - 0x360], ecx
cmp eax, 8
jae 0x10013c7c
movups xmm0, xmmword [ecx]
movups xmmword [edi], xmm0
mov dword [edi + 0x14], 7
jmp 0x10013cbe
mov esi, eax
mov ecx, edi
mov eax, SysReAllocString
or esi, 7
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.100037d0
mov ecx, dword [ebp - 0x358]
mov dword [edi], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x360]
push eax
call fcn.1002f8c0
mov eax, dword [ebp - 0x358]
add esp, 0xc
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], eax
call fcn.10006c20
add esp, 0x18
test edx, edx
jl 0x10013ce5
jg 0x10013cd3
test eax, eax
je 0x10013ce5
push edx
push eax
call fcn.10011e80
add esp, 8
test eax, eax
jne 0x10014403
sub esp, 0x18
mov esi, esp
push 0
call fcn.1003aa14
push edx
push eax
push esi
call fcn.10006af0
add esp, 0x10
mov ecx, 0x1006b908
call fcn.10010ee0
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0x10051f00
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.10007740
lea ecx, [ebp - 0x354]
call fcn.10011010
sub esp, 0x18
mov byte [ebp - 4], 0xa
mov ecx, esp
xor eax, eax
push str.HaoKanWp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.10007740
lea ecx, [ebp - 0x354]
call fcn.10011310
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10013dfc
lea eax, [ebp - 0x1ec]
mov ecx, 0x1006b868
push eax
call fcn.10008270
mov esi, eax
lea eax, [ebp - 0x12c]
cmp eax, esi
je 0x10013dc0
mov ecx, eax
call fcn.10003730
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x12c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x11c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x1ec]
call fcn.10003730
push 0xc
push str.HaoKaTiy.exe
lea ecx, [ebp - 0x12c]
call fcn.10003840
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
cmovae eax, dword [ebp - 0x12c]
push eax
call edi
test eax, eax
je 0x100140cc
lea eax, [ebp - 0x204]
mov ecx, 0x1006b868
push eax
call fcn.10008270
mov esi, eax
lea eax, [ebp - 0x12c]
cmp eax, esi
je 0x10013e4a
mov ecx, eax
call fcn.10003730
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x12c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x11c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x204]
call fcn.10003730
push 0xc
push str.HaoKaTiy.exe
lea ecx, [ebp - 0x12c]
call fcn.10003840
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
cmovae eax, dword [ebp - 0x12c]
push eax
call edi
test eax, eax
je 0x100140cc
lea eax, [ebp - 0x21c]
push str.CMD_REPORT_RETAIN_DESKTOP
push eax
call fcn.1000c890
add esp, 8
lea ecx, [ebp - 0x144]
push eax
call fcn.10003790
lea ecx, [ebp - 0x21c]
call fcn.10003730
cmp dword [ebp - 0x130], 8
lea eax, [ebp - 0x144]
cmovae eax, dword [ebp - 0x144]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.10011b00
add esp, 8
lea ecx, [ebp - 0x144]
push eax
call fcn.10003790
lea ecx, [ebp - 0x234]
call fcn.10003730
xor eax, eax
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 7
mov word [ebp - 0x15c], ax
push 0x10052260
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], 0xb
call fcn.10007740
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
push dword [ebp - 0x11c]
cmovae eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x15c]
push eax
call fcn.10003840
push 2
push 0x10052264
lea ecx, [ebp - 0x15c]
call fcn.10003840
cmp dword [ebp - 0x130], 8
lea eax, [ebp - 0x144]
push dword [ebp - 0x134]
cmovae eax, dword [ebp - 0x144]
lea ecx, [ebp - 0x15c]
push eax
call fcn.10003840
cmp dword [ebp - 0x148], 8
lea eax, [ebp - 0x15c]
mov ecx, 0x1006b9d0
cmovae eax, dword [ebp - 0x15c]
push eax
call fcn.10011890
lea eax, [ebp - 0x24c]
push str.CMD_SOFT_DAEMON
push eax
call fcn.1000c890
add esp, 8
lea ecx, [ebp - 0x144]
push eax
call fcn.10003790
lea ecx, [ebp - 0x24c]
call fcn.10003730
cmp dword [ebp - 0x130], 8
lea eax, [ebp - 0x144]
cmovae eax, dword [ebp - 0x144]
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.10011b00
add esp, 8
lea ecx, [ebp - 0x144]
push eax
call fcn.10003790
lea ecx, [ebp - 0x264]
call fcn.10003730
mov dword [ebp - 0x360], 0x1388
lea eax, [ebp - 0x144]
cmp dword [ebp - 0x130], 8
mov dword [ebp - 0x17c], 0
cmovae eax, dword [ebp - 0x144]
xor ecx, ecx
mov word [ebp - 0x18c], cx
lea ecx, [ebp - 0x18c]
push eax
mov dword [ebp - 0x178], 7
call fcn.10007740
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 0xc
cmovae eax, dword [ebp - 0x12c]
xor ecx, ecx
mov word [ebp - 0x174], cx
lea ecx, [ebp - 0x174]
push eax
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 7
call fcn.10007740
lea eax, [ebp - 0x360]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x18c]
mov ecx, 0x1006b9d0
push eax
lea eax, [ebp - 0x174]
push eax
call fcn.10011660
lea ecx, [ebp - 0x174]
call fcn.10003730
lea ecx, [ebp - 0x18c]
call fcn.10003730
lea ecx, [ebp - 0x15c]
jmp 0x100143f3
lea eax, [ebp - 0x27c]
mov ecx, 0x1006b908
push eax
call fcn.10010d20
mov esi, eax
lea eax, [ebp - 0x12c]
cmp eax, esi
je 0x1001411a
mov ecx, eax
call fcn.10003730
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x12c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x11c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x27c]
call fcn.10003730
cmp dword [ebp - 0x11c], 0
jbe 0x1001414d
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
cmovae eax, dword [ebp - 0x12c]
push eax
call edi
test eax, eax
jne 0x100141dc
lea eax, [ebp - 0x294]
mov ecx, 0x1006b868
push eax
call fcn.100082b0
mov esi, eax
lea eax, [ebp - 0x12c]
cmp eax, esi
je 0x1001419b
mov ecx, eax
call fcn.10003730
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x12c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x11c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x294]
call fcn.10003730
push 6
push str.kaqoae
lea ecx, [ebp - 0x12c]
call fcn.10003840
push 1
push 0x10051f04
lea ecx, [ebp - 0x12c]
call fcn.10003840
push 0xc
push str.HaoKaRgf.exe
lea ecx, [ebp - 0x12c]
call fcn.10003840
cmp dword [ebp - 0x11c], 0
jbe 0x10014204
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
cmovae eax, dword [ebp - 0x12c]
push eax
call edi
test eax, eax
jne 0x100142a5
lea eax, [ebp - 0x2ac]
mov ecx, 0x1006b868
push eax
call fcn.10008290
mov esi, eax
lea eax, [ebp - 0x12c]
cmp eax, esi
je 0x10014252
mov ecx, eax
call fcn.10003730
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x12c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x11c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x2ac]
call fcn.10003730
push 1
push 0x10051f04
lea ecx, [ebp - 0x12c]
call fcn.10003840
push 6
push str.pqoawp
lea ecx, [ebp - 0x12c]
call fcn.10003840
push 1
push 0x10051f04
lea ecx, [ebp - 0x12c]
call fcn.10003840
push 0xc
push str.HaoKaRgf.exe
lea ecx, [ebp - 0x12c]
call fcn.10003840
cmp dword [ebp - 0x11c], 0
jbe 0x100143f8
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
cmovae eax, dword [ebp - 0x12c]
push eax
call edi
test eax, eax
je 0x100143f8
lea eax, [ebp - 0x2c4]
push str.CMD_DESKTOP_SHELL_RETAIN_SVCHOST
push eax
call fcn.1000c890
add esp, 8
lea ecx, [ebp - 0x144]
push eax
call fcn.10003790
lea ecx, [ebp - 0x2c4]
call fcn.10003730
cmp dword [ebp - 0x130], 8
lea eax, [ebp - 0x144]
cmovae eax, dword [ebp - 0x144]
push eax
lea eax, [ebp - 0x2dc]
push eax
call fcn.10011b00
add esp, 8
lea ecx, [ebp - 0x144]
push eax
call fcn.10003790
lea ecx, [ebp - 0x2dc]
call fcn.10003730
cmp dword [ebp - 0x130], 8
lea eax, [ebp - 0x144]
mov dword [ebp - 0x358], 0x1388
cmovae eax, dword [ebp - 0x144]
xor ecx, ecx
mov word [ebp - 0x1bc], cx
lea ecx, [ebp - 0x1bc]
push eax
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1a8], 7
call fcn.10007740
cmp dword [ebp - 0x118], 8
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 0xe
cmovae eax, dword [ebp - 0x12c]
xor ecx, ecx
mov word [ebp - 0x1a4], cx
lea ecx, [ebp - 0x1a4]
push eax
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x190], 7
call fcn.10007740
lea eax, [ebp - 0x358]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x1bc]
mov ecx, 0x1006b9d0
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.10011660
lea ecx, [ebp - 0x1a4]
call fcn.10003730
lea ecx, [ebp - 0x1bc]
call fcn.10003730
lea ecx, [ebp - 0x354]
call fcn.10011180
lea ecx, [ebp - 0x1d4]
call fcn.10003730
lea ecx, [ebp - 0x144]
call fcn.10003730
lea ecx, [ebp - 0x12c]
call fcn.10003730
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10018ad7
mov esp, ebp
pop ebp
ret
push 0x1006b904
call fcn.100191ef
add esp, 4
cmp dword [0x1006b904], 0xffffffff
jne 0x10013be4
mov ecx, 0x1006b868
mov byte [ebp - 4], 6
call fcn.10007f90
push 0x1004cf20
call fcn.10018e36
push 0x1006b904
mov byte [ebp - 4], 1
call fcn.100191a5
add esp, 8
jmp 0x10013be4
push 0x1006b9cc
call fcn.100191ef
add esp, 4
cmp dword [0x1006b9cc], 0xffffffff
jne 0x10013bf5
mov ecx, 0x1006b908
mov byte [ebp - 4], 7
call fcn.100105c0
push 0x1004cf30
call fcn.10018e36
push 0x1006b9cc
mov byte [ebp - 4], 1
call fcn.100191a5
add esp, 8
jmp 0x10013bf5
push 0x1006bde8
call fcn.100191ef
add esp, 4
cmp dword [0x1006bde8], 0xffffffff
jne 0x10013c06
mov ecx, 0x1006b9d0
mov byte [ebp - 4], 8
call fcn.10011650
push 0x1004cf40
call fcn.10018e36
push 0x1006bde8
mov byte [ebp - 4], 1
call fcn.100191a5
add esp, 8
jmp 0x10013c06