Function at 0x10002620
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xebc
push ebx
push esi
push edi
test ch, ch
push edx
pop edx
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [eax], ebx
mov al, al
mov edi, dword [ebp + 8]
push 0x5c
push edi
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
jne 0x100026c2
lea ecx, [ebp - 0x2bc]
push 0x200
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test ah, ah
mov edi, 0x10006010
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2bc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ch, ch
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x2bc]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test ch, ch
jmp 0x100026e7
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x2bc]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test al, al
mov cl, 0x6c
mov byte [ebp - 0x28], 0x6e
mov byte [ebp - 0x27], 0x74
mov byte [ebp - 0x26], 0x64
mov byte [ebp - 0x25], cl
mov byte [ebp - 0x24], cl
mov byte [ebp - 0x23], 0x2e
mov byte [ebp - 0x22], 0x64
mov byte [ebp - 0x21], cl
mov byte [ebp - 0x20], cl
mov byte [ebp - 0x1f], bl
mov ebp, ebp
mov al, 0x65
mov dl, 0x69
mov byte [ebp - 0x50], 0x5a
mov byte [ebp - 0x4f], 0x77
mov byte [ebp - 0x4e], 0x43
mov byte [ebp - 0x4d], 0x72
mov byte [ebp - 0x4c], al
mov byte [ebp - 0x4b], 0x61
mov byte [ebp - 0x4a], 0x74
mov byte [ebp - 0x49], al
mov byte [ebp - 0x48], 0x46
mov byte [ebp - 0x47], dl
mov byte [ebp - 0x46], cl
mov byte [ebp - 0x45], al
mov byte [ebp - 0x44], bl
mov esi, esi
mov byte [ebp - 0x80], 0x5a
mov byte [ebp - 0x7f], 0x77
mov byte [ebp - 0x7e], 0x51
mov byte [ebp - 0x7d], 0x75
mov byte [ebp - 0x7c], al
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x79
mov byte [ebp - 0x79], 0x49
mov byte [ebp - 0x78], 0x6e
mov byte [ebp - 0x77], 0x66
mov byte [ebp - 0x76], 0x6f
mov byte [ebp - 0x75], 0x72
mov byte [ebp - 0x74], 0x6d
mov byte [ebp - 0x73], 0x61
mov byte [ebp - 0x72], 0x74
mov byte [ebp - 0x71], dl
mov byte [ebp - 0x70], 0x6f
mov byte [ebp - 0x6f], 0x6e
mov byte [ebp - 0x6e], 0x46
mov byte [ebp - 0x6d], dl
mov byte [ebp - 0x6c], cl
mov byte [ebp - 0x6b], al
mov byte [ebp - 0x6a], bl
test eax, 0x48f3
mov byte [ebp - 0x40], 0x5a
mov byte [ebp - 0x3f], 0x77
mov byte [ebp - 0x3e], 0x52
mov byte [ebp - 0x3d], al
mov byte [ebp - 0x3c], 0x61
mov byte [ebp - 0x3b], 0x64
mov byte [ebp - 0x3a], 0x46
mov byte [ebp - 0x39], dl
mov byte [ebp - 0x38], cl
mov byte [ebp - 0x37], al
mov byte [ebp - 0x36], bl
mov al, al
mov byte [ebp - 0xc], 0x5a
mov byte [ebp - 0xb], 0x77
mov byte [ebp - 0xa], 0x43
mov byte [ebp - 9], cl
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], al
mov byte [ebp - 5], bl
mov ah, ah
mov byte [ebp - 0x68], 0x52
mov byte [ebp - 0x67], 0x74
mov byte [ebp - 0x66], cl
mov byte [ebp - 0x65], 0x49
mov byte [ebp - 0x64], 0x6e
mov byte [ebp - 0x63], dl
mov byte [ebp - 0x62], 0x74
mov byte [ebp - 0x61], 0x55
mov byte [ebp - 0x60], 0x6e
mov byte [ebp - 0x5f], dl
mov byte [ebp - 0x5e], 0x63
mov byte [ebp - 0x5d], 0x6f
mov byte [ebp - 0x5c], 0x64
mov byte [ebp - 0x5b], al
mov byte [ebp - 0x5a], 0x53
mov byte [ebp - 0x59], 0x74
mov byte [ebp - 0x58], 0x72
mov byte [ebp - 0x57], dl
mov byte [ebp - 0x56], 0x6e
mov byte [ebp - 0x55], 0x67
mov byte [ebp - 0x54], bl
test ah, ah
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
push ecx
pop ecx
lea edx, [ebp - 0x50]
push edx
push edi
call fcn.10002400
mov esi, eax
test dh, dh
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.10002400
mov dword [ebp - 0xbc], eax
test al, al
lea ecx, [ebp - 0x40]
push ecx
push edi
call fcn.10002400
mov dword [ebp - 0xb4], eax
mov ch, ch
lea edx, [ebp - 0xc]
push edx
push edi
call fcn.10002400
mov dword [ebp + 8], eax
test dh, dh
lea eax, [ebp - 0x68]
push eax
push edi
call fcn.10002400
add esp, 0x28
mov dword [ebp - 0xb8], eax
test eax, 0x36dd
xor ecx, ecx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x84], ecx
nop
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
test esi, esi
mov dword [ebp - 4], ebx
push edx
pop edx
xor edx, edx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], edx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0x9c], edx
test ch, ch
mov esi, esi
test edx, edx
mov edi, edi
mov ecx, 0x5c
mov eax, 0x3f
mov word [ebp - 0x34], cx
mov word [ebp - 0x32], ax
mov word [ebp - 0x30], ax
mov word [ebp - 0x2e], cx
mov word [ebp - 0x2c], bx
mov bh, bh
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x6bc]
rep stosd dword es:[edi], eax
test eax, 0x5bbb
lea eax, [ebp - 0x6bc]
push 0x200
push eax
lea edi, [ebp - 0x2bc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [ebp - 0x2bc]
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test ebx, ebx
lea edx, [ebp - 0x34]
lea eax, [ebp - 0xebc]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
test eax, eax
lea ecx, [ebp - 0x6bc]
lea edx, [ebp - 0xebc]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 0x10
mov dh, dh
lea eax, [ebp - 0xebc]
lea ecx, [ebp - 0x1c]
push eax
push ecx
call dword [ebp - 0xb8]
mov dh, dh
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x98], 0x18
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x8c], 0x40
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov al, al
push ebx
push ebx
push 0x20
push 1
push 1
push pe_nt_image_headers32
lea eax, [ebp - 0x14]
push ebx
lea ecx, [ebp - 0x98]
push eax
push ecx
lea edx, [ebp - 4]
push 0x100001
push edx
call esi
mov al, al
cmp eax, ebx
jge 0x10002a03
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push 5
lea eax, [ebp - 0xb0]
push 0x18
lea ecx, [ebp - 0x14]
push eax
push ecx
push edx
call dword [ebp - 0xbc]
test eax, eax
cmp eax, ebx
jge 0x10002a34
mov eax, dword [ebp - 4]
push eax
call dword [ebp + 8]
mov edi, edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xa8]
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov esi, eax
test ebx, ebx
cmp esi, ebx
jne 0x10002a5e
mov edx, dword [ebp - 4]
push edx
call dword [ebp + 8]
test ah, ah
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xa8]
mov edx, dword [ebp - 4]
push ebx
push ebx
push eax
lea ecx, [ebp - 0x14]
push esi
push ecx
push ebx
push ebx
push ebx
push edx
call dword [ebp - 0xb4]
test eax, eax
cmp eax, ebx
jge 0x10002a9c
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov ecx, ecx
mov eax, dword [ebp - 4]
push eax
call dword [ebp + 8]
nop
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xa8]
mov dword [edx], ecx
test al, al
mov eax, dword [ebp - 4]
push eax
call dword [ebp + 8]
push edx
pop edx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret