Function at 0x10003805
Capabilities:
Enumerate files on windows
Query environment variable
Write file on windows

Disassembly:
jmp 0x10008410
push 0xffffffffffffffff
push 0x1007cd31
mov eax, dword fs:[0]
push eax
sub esp, 0x590
mov eax, dword [0x100a0000]
xor eax, esp
mov dword [esp + 0x58c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100a0000]
xor eax, esp
push eax
lea eax, [esp + 0x5a4]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x5b4]
xor eax, eax
push 0x206
push eax
mov word [esp + 0x3a0], ax
lea eax, [esp + 0x3a2]
push eax
call fcn.100535f0
push 8
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call fcn.10052413
add esp, 0x10
test eax, eax
jne 0x100084aa
call fcn.10052031
mov dword [esp + 0x14], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x14]
mov dword [eax], ecx
xor eax, eax
mov dword [esp + 0x5ac], 0
mov dword [esp + 0xb4], 7
mov dword [esp + 0xb0], 0
mov word [esp + 0xa0], ax
mov dword [esp + 0x144], 7
mov dword [esp + 0x140], eax
mov word [esp + 0x130], ax
mov ebp, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x104
lea eax, [esp + 0x39c]
push eax
push 0x10085fe8
mov byte [esp + 0x5b8], 2
call ebp
test eax, eax
je 0x100086be
mov ax, word [esp + 0x398]
cmp ax, 0x25
je 0x100086be
cmp word [esp + 0x39e], 0
lea ecx, [esp + 0x39e]
je 0x1000857d
movzx edx, word [ecx]
cmp edx, 0x5c
je 0x10008570
cmp edx, 0x2f
je 0x10008570
add ecx, 2
cmp word [ecx], 0
jne 0x10008558
jmp 0x1000857d
xor eax, eax
mov word [ecx], ax
mov ax, word [esp + 0x398]
xor ecx, ecx
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], 0
mov word [esp + 0x58], cx
test ax, ax
je 0x100085b2
lea ecx, [esp + 0x398]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100085a3
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x39c]
push eax
lea ecx, [esp + 0x60]
call fcn.10003adf
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
inc eax
mov byte [esp + 0x5ac], 3
cmp edx, eax
ja 0x100085e8
push 1
lea ecx, [esp + 0x18]
call fcn.10002f31
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x18]
dec edx
and ecx, edx
add eax, ecx
and eax, edx
mov dword [esp + 0x20], ecx
lea edi, [eax*4]
cmp dword [edi + esi], 0
jne 0x1000862c
push 0x18
call fcn.10052413
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x10008621
call fcn.10052031
mov eax, dword [esp + 0x18]
mov dword [edi + eax], ecx
mov esi, dword [esp + 0x18]
mov esi, dword [edi + esi]
test esi, esi
je 0x1000869d
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp dword [esp + 0x6c], 8
jae 0x10008667
mov eax, dword [esp + 0x68]
inc eax
je 0x10008675
add eax, eax
push eax
lea eax, [esp + 0x5c]
push eax
push esi
call fcn.10052470
add esp, 0xc
jmp 0x10008675
mov eax, dword [esp + 0x58]
mov dword [esi], eax
mov dword [esp + 0x58], 0
mov eax, dword [esp + 0x68]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esi + 0x14], eax
mov eax, 7
xor ecx, ecx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x68], 0
mov word [esp + 0x58], cx
jmp 0x100086a1
mov eax, dword [esp + 0x6c]
inc dword [esp + 0x24]
mov byte [esp + 0x5ac], 2
cmp eax, 8
jb 0x100086be
push dword [esp + 0x58]
call fcn.10052462
add esp, 4
push 0x104
lea eax, [esp + 0x39c]
push eax
push str._PROGRAMFILES_x86__
call ebp
test eax, eax
je 0x1000886b
mov ax, word [esp + 0x398]
cmp ax, 0x25
je 0x1000886b
cmp word [esp + 0x39e], 0
lea ecx, [esp + 0x39e]
je 0x10008725
mov edi, edi
movzx edx, word [ecx]
cmp edx, 0x5c
je 0x10008718
cmp edx, 0x2f
je 0x10008718
add ecx, 2
cmp word [ecx], 0
jne 0x10008700
jmp 0x10008725
xor eax, eax
mov word [ecx], ax
mov ax, word [esp + 0x398]
xor ecx, ecx
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], 0
mov word [esp + 0x58], cx
test ax, ax
je 0x1000875f
lea ecx, [esp + 0x398]
lea edx, [ecx + 2]
jmp 0x10008750
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008750
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x39c]
push eax
lea ecx, [esp + 0x60]
call fcn.10003adf
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
inc eax
mov byte [esp + 0x5ac], 4
cmp edx, eax
ja 0x10008795
push 1
lea ecx, [esp + 0x18]
call fcn.10002f31
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x18]
dec edx
and ecx, edx
add eax, ecx
and eax, edx
mov dword [esp + 0x20], ecx
lea edi, [eax*4]
cmp dword [edi + esi], 0
jne 0x100087d9
push 0x18
call fcn.10052413
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x100087ce
call fcn.10052031
mov eax, dword [esp + 0x18]
mov dword [edi + eax], ecx
mov esi, dword [esp + 0x18]
mov esi, dword [edi + esi]
test esi, esi
je 0x1000884a
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp dword [esp + 0x6c], 8
jae 0x10008814
mov eax, dword [esp + 0x68]
inc eax
je 0x10008822
add eax, eax
push eax
lea eax, [esp + 0x5c]
push eax
push esi
call fcn.10052470
add esp, 0xc
jmp 0x10008822
mov eax, dword [esp + 0x58]
mov dword [esi], eax
mov dword [esp + 0x58], 0
mov eax, dword [esp + 0x68]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esi + 0x14], eax
mov eax, 7
xor ecx, ecx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x68], 0
mov word [esp + 0x58], cx
jmp 0x1000884e
mov eax, dword [esp + 0x6c]
inc dword [esp + 0x24]
mov byte [esp + 0x5ac], 2
cmp eax, 8
jb 0x1000886b
push dword [esp + 0x58]
call fcn.10052462
add esp, 4
lea ecx, [esp + 0x40]
call fcn.100022d4
lea ecx, [esp + 0x28]
mov byte [esp + 0x5ac], 5
call fcn.100022d4
cmp dword [ebx + 0x14], 8
mov byte [esp + 0x5ac], 6
jb 0x10008897
mov eax, dword [ebx]
jmp 0x10008899
mov eax, ebx
lea ecx, [esp + 0x40]
push ecx
push eax
call fcn.1000ab90
add esp, 8
test al, al
je 0x10008f7e
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.1000ac20
add esp, 8
test al, al
je 0x10008f7e
xor eax, eax
push 0xffffffffffffffff
push eax
push ebx
lea ecx, [esp + 0x7c]
mov dword [esp + 0x90], 7
mov dword [esp + 0x8c], 0
mov word [esp + 0x7c], ax
call fcn.10001f28
push 1
push 0xffffffffffffffff
push 0x10086190
lea ecx, [esp + 0x7c]
mov byte [esp + 0x5b8], 7
call fcn.10001f50
cmp eax, 0xffffffff
je 0x10008987
push 0xffffffffffffffff
inc eax
push eax
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x7c]
call fcn.10001d93
mov esi, eax
lea eax, [esp + 0x70]
cmp eax, esi
je 0x1000896e
cmp dword [esp + 0x84], 8
jb 0x10008947
push dword [esp + 0x70]
call fcn.10052462
add esp, 4
xor eax, eax
push esi
lea ecx, [esp + 0x74]
mov dword [esp + 0x88], 7
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
call fcn.10002b3f
cmp dword [esp + 0x9c], 8
jb 0x10008987
push dword [esp + 0x88]
call fcn.10052462
add esp, 4
push 1
push 0xffffffffffffffff
push 0x10086194
lea ecx, [esp + 0x7c]
call fcn.10001f50
cmp eax, 0xffffffff
je 0x10008a12
push eax
push 0
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x7c]
call fcn.10001d93
mov esi, eax
lea eax, [esp + 0x70]
cmp eax, esi
je 0x100089f9
cmp dword [esp + 0x84], 8
jb 0x100089d2
push dword [esp + 0x70]
call fcn.10052462
add esp, 4
xor eax, eax
push esi
lea ecx, [esp + 0x74]
mov dword [esp + 0x88], 7
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
call fcn.10002b3f
cmp dword [esp + 0x9c], 8
jb 0x10008a12
push dword [esp + 0x88]
call fcn.10052462
add esp, 4
lea eax, [esp + 0x70]
push eax
call fcn.10009020
add esp, 4
cmp dword [esp + 0x24], 0
je 0x10008f4b
mov edi, dword [esp + 0x5b8]
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x18]
call fcn.100032f6
mov edx, eax
mov eax, dword [edx]
test eax, eax
je 0x10008a49
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, dword [edx + 8]
mov eax, dword [eax + ecx*4]
lea ecx, [esp + 0xa0]
cmp ecx, eax
je 0x10008a6b
push 0xffffffffffffffff
push 0
push eax
call fcn.10001f28
cmp dword [esp + 0x24], 0
je 0x10008ab5
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
dec ecx
and ecx, dword [esp + 0x20]
mov esi, dword [eax + ecx*4]
cmp dword [esi + 0x14], 8
jb 0x10008a92
push dword [esi]
call fcn.10052462
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
dec dword [esp + 0x24]
jne 0x10008ab1
mov dword [esp + 0x20], eax
jmp 0x10008ab5
inc dword [esp + 0x20]
push 0x100861a0
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x108]
push eax
call fcn.100010c8
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x10008ada
mov eax, dword [eax]
lea ecx, [esp + 0x148]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp dword [esp + 0x114], 8
mov ebp, eax
jb 0x10008b04
push dword [esp + 0x100]
call fcn.10052462
add esp, 4
xor eax, eax
mov dword [esp + 0x114], 7
mov dword [esp + 0x110], 0
mov word [esp + 0x100], ax
cmp ebp, 0xffffffff
je 0x10008f40
lea ecx, [ecx]
mov eax, dword [esp + 0x148]
test al, 0x10
je 0x10008f09
test eax, 0x400
jne 0x10008f09
mov ecx, 0x100861b0
lea eax, [esp + 0x174]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10008b7c
test dx, dx
je 0x10008b78
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10008b7c
add eax, 4
add ecx, 4
test dx, dx
jne 0x10008b56
xor eax, eax
jmp 0x10008b81
sbb eax, eax
or eax, 1
test eax, eax
je 0x10008f09
mov ecx, 0x100861b4
lea eax, [esp + 0x174]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10008bbb
test dx, dx
je 0x10008bb7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10008bbb
add eax, 4
add ecx, 4
test dx, dx
jne 0x10008b95
xor eax, eax
jmp 0x10008bc0
sbb eax, eax
or eax, 1
test eax, eax
je 0x10008f09
lea eax, [esp + 0x174]
push str.temp
push eax
call fcn.10053af6
add esp, 8
test eax, eax
je 0x10008f09
lea eax, [esp + 0x174]
push str.microsoft
push eax
call fcn.10053af6
add esp, 8
test eax, eax
je 0x10008f09
lea eax, [esp + 0x174]
push str.packages
push eax
call fcn.10053af6
add esp, 8
test eax, eax
je 0x10008f09
mov eax, str.ca_certs
lea ecx, [esp + 0x174]
jmp 0x10008c30
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x10008c56
test dx, dx
je 0x10008c52
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x10008c56
add ecx, 4
add eax, 4
test dx, dx
jne 0x10008c30
xor eax, eax
jmp 0x10008c5b
sbb eax, eax
or eax, 1
test eax, eax
lea eax, [esp + 0xa0]
jne 0x10008e50
push 0x1008621c
push eax
lea eax, [esp + 0xc0]
push eax
call fcn.100010c8
lea ecx, [esp + 0x180]
push ecx
push eax
lea eax, [esp + 0xe4]
push eax
mov byte [esp + 0x5c4], 8
call fcn.10001fcd
push 0x10086218
push eax
lea eax, [esp + 0x138]
push eax
mov byte [esp + 0x5d0], 9
call fcn.10001fcd
lea ecx, [esp + 0x94]
push ecx
push eax
lea eax, [esp + 0x114]
push eax
mov byte [esp + 0x5dc], 0xa
call fcn.100033d2
push str..pem
push eax
lea eax, [esp + 0xc0]
push eax
mov byte [esp + 0x5e8], 0xb
call fcn.10001fcd
add esp, 0x3c
cmp dword [esp + 0xfc], 8
jb 0x10008d0b
push dword [esp + 0xe8]
call fcn.10052462
add esp, 4
xor eax, eax
mov dword [esp + 0xfc], 7
mov dword [esp + 0xf8], 0
mov word [esp + 0xe8], ax
cmp dword [esp + 0x12c], 8
jb 0x10008d44
push dword [esp + 0x118]
call fcn.10052462
add esp, 4
xor eax, eax
mov dword [esp + 0x12c], 7
mov dword [esp + 0x128], 0
mov word [esp + 0x118], ax
cmp dword [esp + 0xe4], 8
jb 0x10008d7d
push dword [esp + 0xd0]
call fcn.10052462
add esp, 4
xor eax, eax
mov dword [esp + 0xe4], 7
mov dword [esp + 0xe0], 0
mov word [esp + 0xd0], ax
cmp dword [esp + 0xcc], 8
mov byte [esp + 0x5ac], 0x10
jb 0x10008dbe
push dword [esp + 0xb8]
call fcn.10052462
add esp, 4
xor eax, eax
cmp dword [esp + 0x9c], 8
mov word [esp + 0xb8], ax
lea eax, [esp + 0x88]
cmovae eax, dword [esp + 0x88]
push 0x10086220
push eax
mov dword [esp + 0xd4], 7
mov dword [esp + 0xd0], 0
call fcn.100548fd
mov esi, eax
add esp, 8
test esi, esi
je 0x10008e2e
push esi
lea ecx, [esp + 0x2c]
call fcn.1000277f
push eax
push 1
lea ecx, [esp + 0x34]
call fcn.10003670
push eax
call fcn.1005487f
push esi
call fcn.10053f58
add esp, 0x14
cmp dword [esp + 0x9c], 8
mov byte [esp + 0x5ac], 7
jb 0x10008ef0
push dword [esp + 0x88]
jmp 0x10008ee8
push 0x10086228
push eax
lea eax, [esp + 0xc0]
push eax
call fcn.100010c8
lea ecx, [esp + 0x180]
push ecx
push eax
lea eax, [esp + 0x9c]
push eax
mov byte [esp + 0x5c4], 0x11
call fcn.10001fcd
add esp, 0x18
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x5b0], 0x12
call fcn.10003053
cmp dword [esp + 0x9c], 8
jb 0x10008eaf
push dword [esp + 0x88]
call fcn.10052462
add esp, 4
xor eax, eax
cmp dword [esp + 0xcc], 8
mov dword [esp + 0x9c], 7
mov dword [esp + 0x98], 0
mov word [esp + 0x88], ax
mov byte [esp + 0x5ac], 7
jb 0x10008ef0
push dword [esp + 0xb8]
call fcn.10052462
add esp, 4
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and bl, 1
jne 0x10008f20
lea eax, [esp + 0x148]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10008b30
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and bl, 1
jne 0x10008f4b
cmp dword [esp + 0x24], 0
jne 0x10008a31
cmp dword [esp + 0x84], 8
jb 0x10008f61
push dword [esp + 0x70]
call fcn.10052462
add esp, 4
xor eax, eax
mov dword [esp + 0x84], 7
mov dword [esp + 0x80], 0
mov word [esp + 0x70], ax
lea ecx, [esp + 0x28]
mov byte [esp + 0x5ac], 5
call fcn.100034ef
lea ecx, [esp + 0x40]
mov byte [esp + 0x5ac], 2
call fcn.100034ef
cmp dword [esp + 0xb4], 8
jb 0x10008fb9
push dword [esp + 0xa0]
call fcn.10052462
add esp, 4
xor eax, eax
lea ecx, [esp + 0x14]
mov dword [esp + 0xb4], 7
mov dword [esp + 0xb0], 0
mov word [esp + 0xa0], ax
call fcn.10003166
push dword [esp + 0x14]
call fcn.10052462
add esp, 4
mov ecx, dword [esp + 0x5a4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58c]
xor ecx, esp
call fcn.10052ab4
add esp, 0x59c
ret