Function at 0x10001655
Capabilities:
Delete file
Enumerate gui resources
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
push str.soul.exe
push 0x1009086c
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x10001b08
push 0x10090218
push 1
push 0x100902c8
push 0x10090970
call fcn.100049af
push 0x10090c48
call fcn.1000500f
add esp, 0x14
call fcn.100021ba
mov ebx, eax
mov ecx, ebx
call fcn.1000213a
and byte [ebp - 0x21c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x21b]
and byte [ebp - 0x118], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x118]
push str._swlzs.exe
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call edi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x118]
push str._sNdSafeDll.dll
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call edi
call fcn.10004267
push 0x100014dd
call fcn.100036a4
pop ecx
call fcn.10004f2a
test eax, eax
jne 0x10001b03
call fcn.10001000
call dword [sym.imp.MSVCRT.dll__getpid]
push eax
push 0x1000147b
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, str.SoulLogin.dll
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x1000178b
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10001773
push 1
push 6
pop edi
lea eax, [ebp - 8]
push edi
push edi
push eax
push esi
mov ecx, ebx
mov byte [ebp - 8], 0x83
mov byte [ebp - 7], 0xc7
mov byte [ebp - 6], 4
mov byte [ebp - 5], 0x53
mov byte [ebp - 4], 0x57
mov byte [ebp - 3], 0x56
call fcn.10001ed7
test eax, eax
jbe 0x100017c7
push 0x10001054
push eax
mov ecx, ebx
call fcn.10001c64
push 1
push edi
lea eax, [ebp - 8]
push edi
push eax
push esi
mov ecx, ebx
mov byte [ebp - 8], 0x83
mov byte [ebp - 7], 0xc0
mov byte [ebp - 6], 4
mov byte [ebp - 5], 0x57
mov byte [ebp - 4], 0x50
mov byte [ebp - 3], 0x56
call fcn.10001ed7
test eax, eax
jbe 0x10001800
push 0x1000107f
push eax
mov ecx, ebx
call fcn.10001c64
and byte [ebp - 4], 0
and byte [ebp - 3], 0
push 1
push 0xffffffffffffffe7
push edi
lea eax, [ebp - 8]
mov edi, str.soul.exe
push eax
push edi
mov ecx, ebx
mov byte [ebp - 8], 0x52
mov byte [ebp - 7], 0x68
mov byte [ebp - 6], 0x49
mov byte [ebp - 5], 3
call fcn.10001ed7
test eax, eax
jbe 0x1000183f
push 0x1000109c
push eax
mov ecx, ebx
call fcn.10001b5e
and byte [ebp - 3], 0
push 1
push 0xffffffffffffffea
lea eax, [ebp - 0xc]
push 0xa
push eax
push esi
mov ecx, ebx
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x7c
mov byte [ebp - 0xa], 0x24
mov byte [ebp - 9], 0x2c
mov byte [ebp - 8], 0x8b
mov byte [ebp - 7], 0x54
mov byte [ebp - 6], 0x24
mov byte [ebp - 5], 0x10
mov byte [ebp - 4], 0x6a
call fcn.10001ed7
test eax, eax
jbe 0x1000188a
push 0x100010f6
push eax
mov ecx, ebx
call fcn.10001c64
push 1
push 9
lea eax, [ebp - 0xc]
push 9
push eax
push esi
mov ecx, ebx
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0xb
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0xd2
mov byte [ebp - 8], 0x85
mov byte [ebp - 7], 0xc9
mov byte [ebp - 6], 0xf
mov byte [ebp - 5], 0x9c
mov byte [ebp - 4], 0xc2
call fcn.10001ed7
test eax, eax
jbe 0x100018d1
push 0x100011ae
push eax
mov ecx, ebx
call fcn.10001d56
and byte [ebp - 9], 0
and byte [ebp - 8], 0
and byte [ebp - 3], 0
and byte [ebp - 2], 0
push 1
push 0xfffffffffffffffa
lea eax, [ebp - 0x14]
push 0x13
push eax
push esi
mov ecx, ebx
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0xc4
mov byte [ebp - 0x12], 4
mov byte [ebp - 0x11], 0x89
mov byte [ebp - 0x10], 0x44
mov byte [ebp - 0xf], 0x24
mov byte [ebp - 0xe], 0x38
mov byte [ebp - 0xd], 0x8d
mov byte [ebp - 0xc], 0xae
mov byte [ebp - 0xb], 0xc4
mov byte [ebp - 0xa], 7
mov byte [ebp - 7], 0x8d
mov byte [ebp - 6], 0x86
mov byte [ebp - 5], 0x98
mov byte [ebp - 4], 5
call fcn.10001ed7
test eax, eax
jbe 0x10001940
push 0x100011fc
push eax
mov ecx, ebx
call fcn.10001c64
push 1
and byte [ebp - 4], 0
pop esi
lea eax, [ebp - 8]
push esi
push 0xffffffffffffffd9
push 5
push eax
push edi
mov ecx, ebx
mov byte [ebp - 8], 0x68
mov byte [ebp - 7], 0x94
mov byte [ebp - 6], 0x2f
mov byte [ebp - 5], 2
call fcn.10001ed7
test eax, eax
jbe 0x10001979
push 0x10001395
push eax
mov ecx, ebx
call fcn.10001b5e
or byte [ebp - 0xb], 0xff
and byte [ebp - 8], 0
or byte [ebp - 6], 0xff
or byte [ebp - 5], 0xff
push esi
push 0xe
lea eax, [ebp - 0xc]
push 8
push eax
push edi
mov ecx, ebx
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 0xa], 0x8d
mov byte [ebp - 9], 0x8d
mov byte [ebp - 7], 0xfb
call fcn.10001ed7
test eax, eax
jbe 0x100019bb
push 0x10001219
push eax
mov ecx, ebx
call fcn.10001c64
or byte [ebp - 0x10], 0xff
and byte [ebp - 6], 0
and byte [ebp - 5], 0
push esi
push 0xd
lea eax, [ebp - 0x10]
push 0xc
push eax
push edi
mov ecx, ebx
mov byte [ebp - 0xf], 0x52
mov byte [ebp - 0xe], 0x10
mov byte [ebp - 0xd], 0x8d
mov byte [ebp - 0xc], 0x45
mov byte [ebp - 0xb], 0xd8
mov byte [ebp - 0xa], 0x8d
mov byte [ebp - 9], 0x8b
mov byte [ebp - 8], 0xac
mov byte [ebp - 7], 0x28
call fcn.10001ed7
test eax, eax
jbe 0x10001a0d
push 0x10001274
push eax
mov ecx, ebx
call fcn.10001b5e
or byte [ebp - 8], 0xff
or byte [ebp - 7], 0xff
push esi
push 0xd
lea eax, [ebp - 0xc]
push 9
push eax
push edi
mov ecx, ebx
mov byte [ebp - 0xc], 0x8d
mov byte [ebp - 0xb], 0x95
mov byte [ebp - 0xa], 0xa4
mov byte [ebp - 9], 0xfb
mov byte [ebp - 6], 0x8d
mov byte [ebp - 5], 0x45
mov byte [ebp - 4], 0xb8
call fcn.10001ed7
test eax, eax
jbe 0x10001a53
push 0x1000132c
push eax
mov ecx, ebx
call fcn.10001b5e
mov esi, str.3DRole.dll
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x10001a70
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10001a58
push 1
push 4
lea eax, [ebp - 8]
push 4
push eax
push esi
mov ecx, ebx
mov byte [ebp - 8], 0x52
mov byte [ebp - 7], 0x50
mov byte [ebp - 6], 0x6a
mov byte [ebp - 5], 0x33
call fcn.10001ed7
test eax, eax
jbe 0x10001aa3
push 0x100013be
push eax
mov ecx, ebx
call fcn.10001b5e
and byte [ebp - 4], 0
and byte [ebp - 3], 0
push 1
push 0xffffff7e
lea eax, [ebp - 0xc]
push 0xa
push eax
push esi
mov ecx, ebx
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0xa], 8
mov byte [ebp - 9], 0x33
mov byte [ebp - 8], 0xd2
mov byte [ebp - 7], 0xb9
mov byte [ebp - 6], 0x10
mov byte [ebp - 5], 0x27
call fcn.10001ed7
mov esi, eax
test esi, esi
jbe 0x10001b03
push 0x100012b8
push esi
mov ecx, ebx
call fcn.10001c64
add esi, 0x27
push 0x100012fa
push esi
mov ecx, ebx
call fcn.10001c64
push 1
pop eax
jmp 0x10001b0a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret