Function at 0x100384be
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file attributes

Disassembly:
add byte [eax], al
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100384c0
sub ecx, esi
lea eax, [ebp - 0x18]
push ecx
push eax
mov ecx, edx
call fcn.1000b710
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x234], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x224], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x148]
mov byte [ebp - 4], 0xd
cmp edx, 0x10
jb 0x10038559
mov ecx, dword [ebp - 0x15c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1003854f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100390f6
push edx
push ecx
call fcn.1004cb1a
add esp, 8
cmp dword [ebp - 0x220], 0x10
lea edx, [ebp - 0x234]
mov dword [ebp - 0x14c], 0
cmovae edx, dword [ebp - 0x234]
mov ecx, edx
mov dword [ebp - 0x148], 0xf
mov byte [ebp - 0x15c], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0xf
lea esi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100385b0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x110]
call fcn.10005040
cmp dword [ebp - 0xfc], 0x10
lea eax, [ebp - 0x110]
cmovae eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100385ec
mov byte [ebp - 0x18], 0
jmp 0x100385f4
shr al, 4
and al, 1
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0xfc]
cmp edx, 0x10
jb 0x1003862e
mov ecx, dword [ebp - 0x110]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10038624
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100390fb
push edx
push ecx
call fcn.1004cb1a
add esp, 8
cmp byte [ebp - 0x18], 0
je 0x1003864a
call fcn.10023ce0
lea eax, [ebp - 0x234]
push 1
push eax
call fcn.100374a0
add esp, 8
movaps xmm0, xmmword [0x100795b0]
lea ecx, [ebp - 0x2c]
movups xmmword [ebp - 0x90], xmm0
lea edx, [ecx + 1]
mov dword [ebp - 0x2c], 0x795c3a64
movaps xmm0, xmmword [0x10079550]
mov dword [ebp - 0x28], 0x2072696d
mov dword [ebp - 0x24], 0x6b726f77
mov byte [ebp - 0x20], 0
movups xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x70], 0x656d616e
mov dword [ebp - 0x6c], 0x6c65642f
mov dword [ebp - 0x68], 0x20657465
mov word [ebp - 0x64], 0x7469
mov byte [ebp - 0x62], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0xf
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100386c0
sub ecx, edx
lea eax, [ebp - 0x2c]
push ecx
push eax
lea ecx, [ebp - 0x110]
call fcn.10005040
cmp dword [ebp - 0xfc], 0x10
lea eax, [ebp - 0x110]
cmovae eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100386ff
mov byte [ebp - 0x18], 0
jmp 0x10038707
shr al, 4
and al, 1
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0xfc]
cmp edx, 0x10
jb 0x10038741
mov ecx, dword [ebp - 0x110]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10038737
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10039100
push edx
push ecx
call fcn.1004cb1a
add esp, 8
cmp byte [ebp - 0x18], 0
je 0x1003875b
lea eax, [ebp - 0x90]
push eax
call fcn.10032ab0
add esp, 4
call fcn.10023ce0
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x1c], 0x696d795c
push eax
mov dword [ebp - 0x18], 0x6f772072
mov word [ebp - 0x14], 0x6b72
mov byte [ebp - 0x12], 0
call fcn.10037900
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xe
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10038790
sub ecx, esi
lea eax, [ebp - 0x1c]
push ecx
push eax
mov ecx, edx
call fcn.1000b710
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x208], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x21c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x20c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x118]
mov byte [ebp - 4], 0x10
cmp edx, 0x10
jb 0x10038829
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1003881f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10039105
push edx
push ecx
call fcn.1004cb1a
add esp, 8
cmp dword [ebp - 0x208], 0x10
lea edx, [ebp - 0x21c]
movaps xmm0, xmmword [0x10079580]
cmovae edx, dword [ebp - 0x21c]
movups xmmword [ebp - 0x290], xmm0
mov ecx, edx
mov dword [ebp - 0x11c], 0
movaps xmm0, xmmword [0x10079560]
movups xmmword [ebp - 0x280], xmm0
mov dword [ebp - 0x118], 0xf
movaps xmm0, xmmword [0x10079540]
lea esi, [ecx + 1]
mov byte [ebp - 0x12c], 0
movups xmmword [ebp - 0x270], xmm0
mov dword [ebp - 0x260], 0x20736120
mov dword [ebp - 0x25c], 0x68742061
mov dword [ebp - 0x258], 0x74616572
mov word [ebp - 0x254], 0x2e
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0xf
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100388d0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x110]
call fcn.10005040
cmp dword [ebp - 0xfc], 0x10
lea eax, [ebp - 0x110]
cmovae eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1003890c
mov byte [ebp - 0x18], 0
jmp 0x10038914
shr al, 4
and al, 1
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0xfc]
cmp edx, 0x10
jb 0x1003894e
mov ecx, dword [ebp - 0x110]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10038944
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003910a
push edx
push ecx
call fcn.1004cb1a
add esp, 8
cmp byte [ebp - 0x18], 0
je 0x100389ac
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x15c]
push eax
call fcn.100347a0
cmp dword [ebp - 0x148], 0x10
lea eax, [ebp - 0x15c]
mov byte [ebp - 4], 0x11
cmovae eax, dword [ebp - 0x15c]
push eax
call fcn.10032ab0
lea eax, [ebp - 0x21c]
push 1
push eax
call fcn.100374a0
add esp, 0x18
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x15c]
call fcn.100037b0
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x114], 0x63705c
push eax
call fcn.10037900
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0x12
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100389d4
sub ecx, esi
lea eax, [ebp - 0x114]
push ecx
push eax
mov ecx, edx
call fcn.1000b710
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x1f4], 0
mov dword [ebp - 0x1f0], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x204], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1f4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x148]
mov byte [ebp - 4], 0x14
cmp edx, 0x10
jb 0x10038a70
mov ecx, dword [ebp - 0x15c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10038a66
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003910f
push edx
push ecx
call fcn.1004cb1a
add esp, 8
cmp dword [ebp - 0x1f0], 0x10
lea edx, [ebp - 0x204]
mov dword [ebp - 0x14c], 0
cmovae edx, dword [ebp - 0x204]
mov ecx, edx
mov dword [ebp - 0x148], 0xf
mov byte [ebp - 0x15c], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0xf
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10038ac2
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x110]
call fcn.10005040
cmp dword [ebp - 0xfc], 0x10
lea eax, [ebp - 0x110]
cmovae eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10038afe
mov byte [ebp - 0x18], 0
jmp 0x10038b06
shr al, 4
and al, 1
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0xfc]
cmp edx, 0x10
jb 0x10038b40
mov ecx, dword [ebp - 0x110]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10038b36
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10039114
push edx
push ecx
call fcn.1004cb1a
add esp, 8
cmp byte [ebp - 0x18], 0
je 0x10038b9e
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.100347a0
cmp dword [ebp - 0xfc], 0x10
lea eax, [ebp - 0x110]
mov byte [ebp - 4], 0x15
cmovae eax, dword [ebp - 0x110]
push eax
call fcn.10032ab0
lea eax, [ebp - 0x204]
push 1
push eax
call fcn.100374a0
add esp, 0x18
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x110]
call fcn.100037b0
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x18], 0x3263705c
push eax
mov byte [ebp - 0x14], 0
call fcn.10037900
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x16
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10038bc4
sub ecx, esi
lea eax, [ebp - 0x18]
push ecx
push eax
mov ecx, edx
call fcn.1000b710
mov dword [ebp - 0x1ec], 0
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x1d8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x1ec], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1dc], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x118]
mov byte [ebp - 4], 0x18
cmp edx, 0x10
jb 0x10038c5d
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10038c53
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10039119
push edx
push ecx
call fcn.1004cb1a
add esp, 8
cmp dword [ebp - 0x1d8], 0x10
lea edx, [ebp - 0x1ec]
mov dword [ebp - 0x11c], 0
cmovae edx, dword [ebp - 0x1ec]
mov ecx, edx
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0xf
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10038cb0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x110]
call fcn.10005040
cmp dword [ebp - 0xfc], 0x10
lea eax, [ebp - 0x110]
cmovae eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10038cec
mov byte [ebp - 0x18], 0
jmp 0x10038cf4
shr al, 4
and al, 1
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0xfc]
cmp edx, 0x10
jb 0x10038d2e
mov ecx, dword [ebp - 0x110]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10038d24
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003911e
push edx
push ecx
call fcn.1004cb1a
add esp, 8
cmp byte [ebp - 0x18], 0
je 0x10038d8c
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x1ec]
push eax
lea eax, [ebp - 0x15c]
push eax
call fcn.100347a0
cmp dword [ebp - 0x148], 0x10
lea eax, [ebp - 0x15c]
mov byte [ebp - 4], 0x19
cmovae eax, dword [ebp - 0x15c]
push eax
call fcn.10032ab0
lea eax, [ebp - 0x1ec]
push 1
push eax
call fcn.100374a0
add esp, 0x18
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x15c]
call fcn.100037b0
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x18], 0x676d645c
push eax
mov byte [ebp - 0x14], 0
call fcn.10037900
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1a
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10038db2
sub ecx, esi
lea eax, [ebp - 0x18]
push ecx
push eax
mov ecx, edx
call fcn.1000b710
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x1c0], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x1d4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x148]
mov byte [ebp - 4], 0x1c
cmp edx, 0x10
jb 0x10038e4b
mov ecx, dword [ebp - 0x15c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10038e41
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10039123
push edx
push ecx
call fcn.1004cb1a
add esp, 8
cmp dword [ebp - 0x1c0], 0x10
lea edx, [ebp - 0x1d4]
mov dword [ebp - 0x14c], 0
cmovae edx, dword [ebp - 0x1d4]
mov ecx, edx
mov dword [ebp - 0x148], 0xf
mov byte [ebp - 0x15c], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0xf
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10038ea0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x110]
call fcn.10005040
cmp dword [ebp - 0xfc], 0x10
lea eax, [ebp - 0x110]
cmovae eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10038f32
test al, 0x10
je 0x10038f32
lea ecx, [ebp - 0x110]
call fcn.100037b0
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.100347a0
cmp dword [ebp - 0xfc], 0x10
lea eax, [ebp - 0x110]
mov byte [ebp - 4], 0x1d
cmovae eax, dword [ebp - 0x110]
push eax
call fcn.10032ab0
lea eax, [ebp - 0x1d4]
push 1
push eax
call fcn.100374a0
add esp, 0x18
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x110]
call fcn.100037b0
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x1c], 0x756f535c
push eax
mov dword [ebp - 0x18], 0x656372
call fcn.10037900
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x1e
push ecx
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.100291a0
add esp, 0x10
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0x20
call fcn.100037b0
cmp dword [ebp - 0x238], 0x10
lea edx, [ebp - 0x24c]
mov dword [ebp - 0x110], 0
cmovae edx, dword [ebp - 0x24c]
mov ecx, edx
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0xf
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10038fb5
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x110]
call fcn.10005040
cmp dword [ebp - 0xfc], 0x10
lea eax, [ebp - 0x110]
cmovae eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1003904b
test al, 0x10
je 0x1003904b
lea ecx, [ebp - 0x110]
call fcn.100037b0
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x15c]
push eax
call fcn.100347a0
cmp dword [ebp - 0x148], 0x10
lea eax, [ebp - 0x15c]
mov byte [ebp - 4], 0x21
cmovae eax, dword [ebp - 0x15c]
push eax
call fcn.10032ab0
lea eax, [ebp - 0x24c]
push 1
push eax
call fcn.100374a0
add esp, 0x18
lea ecx, [ebp - 0x15c]
jmp 0x10039051
lea ecx, [ebp - 0x110]
call fcn.100037b0
lea ecx, [ebp - 0x24c]
call fcn.100037b0
lea ecx, [ebp - 0x1d4]
call fcn.100037b0
lea ecx, [ebp - 0x1ec]
call fcn.100037b0
lea ecx, [ebp - 0x204]
call fcn.100037b0
lea ecx, [ebp - 0x21c]
call fcn.100037b0
lea ecx, [ebp - 0x234]
call fcn.100037b0
lea ecx, [ebp - 0x18c]
call fcn.100037b0
lea ecx, [ebp - 0x1a4]
call fcn.100037b0
lea ecx, [ebp - 0x1bc]
call fcn.100037b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret
call fcn.10051faf
call fcn.10051faf
call fcn.10051faf
call fcn.10051faf
call fcn.10051faf
call fcn.10051faf
call fcn.10051faf
call fcn.10051faf
call fcn.10051faf
call fcn.10051faf
int3