Function at 0x100cbcc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10123079
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x1016e750]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x130], edi
mov ecx, dword [edi + 0xc]
sub ecx, 0x10
call fcn.10024750
lea esi, [eax + 0x10]
mov dword [ebp - 0x15c], esi
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x48]
push eax
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x114]
push str.WriteStubEntryPoint:_found_place_to_write_machine_code_at:_0x_p
push eax
call fcn.10044f30
add esp, 0xc
mov byte [ebp - 4], 1
mov ecx, str.ImaginaryExec
mov edx, dword [ebp - 0x114]
call fcn.10043b30
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x114]
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x100cbd66
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x130]
mov edi, dword [eax + 0x40]
sub edi, 0x2000
cmp edi, 0x100000
jbe 0x100cbdb7
lea ecx, [ecx]
push 4
push 0x3000
push 0x2000
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x134], eax
test eax, eax
jne 0x100cbe4a
mov eax, dword [ebp - 0x130]
sub edi, 0x1000
cmp edi, 0x100000
ja 0x100cbd80
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x134]
push str._WriteStubEntryPoint:_failed_allocating_RemoteData__LE_d
push eax
call fcn.10044f30
add esp, 0xc
mov byte [ebp - 4], 2
mov ecx, str.ImaginaryExec
mov edx, dword [ebp - 0x134]
call fcn.10043b30
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0x134]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100cbe0a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor edi, edi
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100cbe2d
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10103392
mov esp, ebp
pop ebp
ret
push eax
lea eax, [ebp - 0x114]
push str.WriteStubEntryPoint:_found_place_for_RemoteData:_0x_p
push eax
call fcn.10044f30
add esp, 0xc
mov byte [ebp - 4], 3
mov ecx, str.ImaginaryExec
mov edx, dword [ebp - 0x114]
call fcn.10043b30
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0x114]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100cbe97
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x130]
push 0
push 0
push 0
mov eax, dword [edi + 0x10]
sub eax, 0x10
push ecx
mov dword [ebp - 0x118], esp
push ecx
mov ecx, dword [eax]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x12c], esp
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 0x114]
mov edx, eax
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x128], eax
jl 0x100cbef8
cmp edx, dword [ecx]
jne 0x100cbef8
mov dword [ebp - 0x11c], ecx
mov eax, 1
mov ecx, dword [ebp - 0x128]
lock xadd dword [ecx], eax
jmp 0x100cbf4b
mov eax, dword [edx]
push 2
push dword [ecx + 4]
mov ecx, edx
mov eax, dword [eax]
call eax
mov ecx, eax
mov dword [ebp - 0x11c], ecx
test ecx, ecx
jne 0x100cbf16
call fcn.10024740
mov edx, dword [ebp - 0x114]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [edx + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
mov eax, dword [ebp - 0x11c]
add eax, 0x10
push eax
call fcn.10103d20
add esp, 0x10
mov ecx, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x11c]
add eax, 0x10
mov dword [ecx], eax
mov eax, 0x5c
mov ecx, dword [ebp - 0x118]
movzx edx, ax
call fcn.100452e0
add esp, 4
lea ecx, [ebp - 0x124]
xor edx, edx
call fcn.1003d3b0
add esp, 0x10
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x124]
add eax, 0xfffffff0
mov dword [ebp - 0x11c], eax
mov ecx, dword [eax]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 0x11c]
mov edx, eax
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x118], eax
jl 0x100cbfcc
cmp edx, dword [ecx]
jne 0x100cbfcc
mov edx, dword [ebp - 0x118]
mov eax, ecx
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x100cc02b
mov eax, dword [edx]
push 2
push dword [ecx + 4]
mov ecx, edx
mov eax, dword [eax]
call eax
mov edx, eax
mov dword [ebp - 0x114], edx
test edx, edx
jne 0x100cbfea
call fcn.10024740
mov ecx, dword [ebp - 0x11c]
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov edx, dword [ecx + 4]
mov ecx, dword [ebp - 0x114]
add ecx, 0x10
lea eax, [edx*2 + 2]
push eax
mov eax, dword [ebp - 0x11c]
add eax, 0x10
push eax
lea eax, [edx*2 + 2]
push eax
push ecx
call fcn.10103d20
mov eax, dword [ebp - 0x114]
add esp, 0x10
add eax, 0x10
push eax
mov dword [ebp - 0x118], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100cc04e
mov dword [ebp - 0x114], 1
test al, 0x10
jne 0x100cc058
mov dword [ebp - 0x114], 0
mov edx, dword [ebp - 0x118]
or ecx, 0xffffffff
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100cc078
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x114], 0
jne 0x100cc18b
push 0
push 0
push 0
push ecx
mov dword [ebp - 0x118], esp
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x100cc0ae
push 0x80004005
call fcn.100223c0
mov eax, dword [edx]
mov ecx, edx
mov eax, dword [eax + 0xc]
call eax
mov ecx, dword [ebp - 0x118]
add eax, 0x10
mov dword [ecx], eax
call fcn.10024960
xor edx, edx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x114]
call fcn.1003d3b0
add esp, 0x10
mov byte [ebp - 4], 6
mov edx, dword [eax]
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
mov dword [ebp - 0x128], ecx
lea eax, [edx - 0x10]
mov dword [ebp - 0x118], eax
lea eax, [edx - 0x10]
cmp eax, ecx
je 0x100cc167
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x12c], eax
jl 0x100cc158
mov eax, dword [edx - 0x10]
cmp eax, dword [ecx]
jne 0x100cc158
mov ecx, dword [ebp - 0x118]
call fcn.10024750
mov edx, dword [ebp - 0x12c]
or ecx, 0xffffffff
mov dword [ebp - 0x118], eax
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100cc14d
mov eax, dword [ebp - 0x128]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x118]
add eax, 0x10
mov dword [ebp - 0x124], eax
jmp 0x100cc167
push dword [edx - 0xc]
lea ecx, [ebp - 0x124]
push edx
call fcn.10024680
mov byte [ebp - 4], 4
or ecx, 0xffffffff
mov edx, dword [ebp - 0x114]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100cc18b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x134]
mov ecx, dword [esi - 0xc]
push 0
lea eax, [edx + 2]
lea eax, [eax + ecx*2]
mov dword [ebp - 0x114], eax
lea edi, [edx + 2]
mov eax, dword [ebp - 0x124]
lea edi, [edi + ecx*2]
mov eax, dword [eax - 0xc]
inc eax
lea eax, [edi + eax*2]
mov edi, dword [ebp - 0x130]
mov dword [ebp - 0x128], eax
add eax, 0x20
mov dword [ebp - 0x11c], eax
lea eax, [ecx*2 + 2]
push eax
push esi
push edx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x100cc23e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x114]
push str._WriteStubEntryPoint:_WriteProcessMemory_RemoteDllNameW__failed__LE_d
push eax
call fcn.10044f30
add esp, 0xc
mov byte [ebp - 4], 7
mov ecx, str.ImaginaryExec
mov edx, dword [ebp - 0x114]
call fcn.10043b30
mov byte [ebp - 4], 4
or ecx, 0xffffffff
mov edx, dword [ebp - 0x114]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100cc5fe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor edi, edi
jmp 0x100cc627
mov eax, dword [ebp - 0x124]
push 0
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push dword [ebp - 0x114]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x100cc2c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x114]
push str._WriteStubEntryPoint:_WriteProcessMemory_RemoteAssemblyDirW__failed__LE_d
push eax
call fcn.10044f30
add esp, 0xc
mov byte [ebp - 4], 8
mov ecx, str.ImaginaryExec
mov edx, dword [ebp - 0x114]
call fcn.10043b30
mov byte [ebp - 4], 4
or ecx, 0xffffffff
mov edx, dword [ebp - 0x114]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100cc5fe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor edi, edi
jmp 0x100cc627
mov eax, dword [ebp - 0x114]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x154], xmm0
push 0
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x11c]
push 0x20
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x158]
push eax
push dword [ebp - 0x128]
movq qword [ebp - 0x144], xmm0
push dword [edi]
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x158], 0x20
mov dword [ebp - 0x154], 0x14
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x100cc386
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x114]
push str._WriteStubEntryPoint:_WriteProcessMemory_RemoteActCtx__failed__LE_d
push eax
call fcn.10044f30
add esp, 0xc
mov byte [ebp - 4], 9
mov ecx, str.ImaginaryExec
mov edx, dword [ebp - 0x114]
call fcn.10043b30
mov byte [ebp - 4], 4
or ecx, 0xffffffff
mov edx, dword [ebp - 0x114]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100cc5fe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor edi, edi
jmp 0x100cc627
mov ecx, dword [edi + 0x18]
push 0
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
push ecx
push dword [ebp - 0x11c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x100cc407
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x114]
push str._WriteStubEntryPoint:_WriteProcessMemory_RemoteManifestFileW__failed__LE_d
push eax
call fcn.10044f30
add esp, 0xc
mov byte [ebp - 4], 0xa
mov ecx, str.ImaginaryExec
mov edx, dword [ebp - 0x114]
call fcn.10043b30
mov byte [ebp - 4], 4
or ecx, 0xffffffff
mov edx, dword [ebp - 0x114]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100cc5fe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor edi, edi
jmp 0x100cc627
xor eax, eax
cmp dword [edi + 0x1c], eax
je 0x100cc416
cmp dword [edi + 0x43c], eax
jmp 0x100cc41c
cmp dword [edi + 0x334], eax
setne al
mov byte [ebp - 0x110], 0xcc
push 0xff
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x10f]
push 0
push eax
call fcn.101078f0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
add esp, 0xc
cmp dword [ebp - 0x114], ecx
jne 0x100cc4c4
mov eax, dword [ebp - 0x128]
push 0x1014987c
push str.KERNEL32.DLL
mov byte [ebp - 0x110], 0x68
mov dword [ebp - 0x10f], eax
mov byte [ebp - 0x10b], 0xe8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call edi
mov ecx, 0xfffffff6
mov byte [ebp - 0x106], 0xe8
sub ecx, dword [ebp - 0x120]
push 0x101428e0
add eax, ecx
push str.KERNEL32.DLL
mov dword [ebp - 0x10a], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call edi
mov ecx, 0xfffffff1
sub ecx, dword [ebp - 0x120]
add eax, ecx
mov ecx, 0xf
mov dword [ebp - 0x105], eax
mov eax, dword [ebp - 0x134]
lea edi, [ebp - 0x110]
mov byte [ebp + ecx - 0x110], 0x68
mov dword [ebp + ecx - 0x10f], eax
mov byte [ebp + ecx - 0x10b], 0xe8
add ecx, 6
add edi, ecx
add ecx, 4
push 0x101429e0
push str.KERNEL32.DLL
mov dword [ebp - 0x114], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x114]
sub eax, ecx
sub eax, dword [ebp - 0x120]
mov dword [edi], eax
lea edi, [ebp - 0x110]
mov eax, dword [ebp - 0x11c]
mov byte [ebp + ecx - 0x110], 0x68
mov dword [ebp + ecx - 0x10f], eax
mov byte [ebp + ecx - 0x10b], 0xe8
add ecx, 6
add edi, ecx
add ecx, 4
push 0x101427b4
push str.KERNEL32.DLL
mov dword [ebp - 0x114], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x114]
lea ecx, [ebp - 0x110]
sub eax, edx
mov dword [ebp - 0x138], 0
sub eax, dword [ebp - 0x120]
mov dword [edi], eax
mov edi, dword [ebp - 0x130]
mov byte [ebp + edx - 0x110], 0xe9
inc edx
add ecx, edx
add edx, 4
mov eax, dword [edi + 0x44]
sub eax, edx
mov edx, dword [ebp - 0x120]
sub eax, edx
mov dword [ecx], eax
lea eax, [ebp - 0x138]
push eax
push 4
push 0x100
push edx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 0x100
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x120]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x100cc602
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
push eax
push str._WriteProcessMemory_StubExe__EntryPoint__failed__LE_d
push ecx
call fcn.10044f30
add esp, 0xc
call fcn.100ca0e0
add esp, 4
xor edi, edi
jmp 0x100cc627
lea eax, [ebp - 0x138]
push eax
push dword [ebp - 0x138]
push 0x100
push dword [ebp - 0x120]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edi, 1
mov byte [ebp - 4], 0
or ecx, 0xffffffff
mov edx, dword [ebp - 0x124]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100cbe0c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x100cbe0c