Function at 0x100019e0
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100aa998
mov eax, dword fs:[0]
push eax
sub esp, 0x31c
mov eax, dword [0x100c66d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x318], ecx
mov dword [ebp - 0x324], edx
cmp dword [eax + 0x14], esi
je 0x10002559
cmp dword [eax + 0x30], esi
je 0x10002559
lea edi, [eax + 0x20]
lea ebx, [esi + 8]
cmp dword [edi + 0x10], esi
je 0x10001a5d
cmp dword [edi + 0x14], ebx
jb 0x10001a4b
mov eax, dword [edi]
jmp 0x10001a4d
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test al, al
jne 0x10001a66
push edi
call fcn.10037fe0
add esp, 4
push 0x10
xor eax, eax
mov edi, 7
push str.2345Explorer.exe
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa8], esi
mov word [ebp - 0xb8], ax
call fcn.10005fb0
sub esp, 0x1c
mov dword [ebp - 4], esi
mov ecx, esp
mov dword [ebp - 0x314], esp
push esi
xor edx, edx
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], esi
push 0x100b61ec
mov word [ecx], dx
call fcn.10005fb0
lea edi, [ebp - 0xb8]
call fcn.1000f0f0
mov dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x309], al
cmp dword [ebp - 0xa4], ebx
jb 0x10001ae5
mov eax, dword [ebp - 0xb8]
push eax
call fcn.1003d468
add esp, 4
cmp byte [ebp - 0x309], 0
je 0x10001b05
mov ecx, dword [ebp - 0x324]
push 5
mov eax, 0x100b6214
call fcn.10005e70
jmp 0x10002559
lea esi, [ebp - 0x144]
call fcn.10025350
mov dword [ebp - 0x310], eax
lea esi, [ebp - 0x128]
mov dword [ebp - 4], 1
call fcn.10025410
mov esi, eax
mov eax, dword [ebp - 0x318]
lea edi, [ebp - 0x10c]
mov byte [ebp - 4], 2
call fcn.10006890
push eax
mov eax, 0x100b6220
lea esi, [ebp - 0xb8]
mov byte [ebp - 4], 3
call fcn.100068d0
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x310]
lea edi, [ebp - 0x160]
call fcn.10006920
cmp dword [ebp - 0xa4], ebx
jb 0x10001b85
mov ecx, dword [ebp - 0xb8]
push ecx
call fcn.1003d468
add esp, 4
mov edi, 7
xor esi, esi
xor edx, edx
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa8], esi
mov word [ebp - 0xb8], dx
cmp dword [ebp - 0xf8], ebx
jb 0x10001bb8
mov eax, dword [ebp - 0x10c]
push eax
call fcn.1003d468
add esp, 4
xor ecx, ecx
mov dword [ebp - 0xf8], edi
mov dword [ebp - 0xfc], esi
mov word [ebp - 0x10c], cx
cmp dword [ebp - 0x114], ebx
jb 0x10001be4
mov edx, dword [ebp - 0x128]
push edx
call fcn.1003d468
add esp, 4
xor eax, eax
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x118], esi
mov word [ebp - 0x128], ax
mov byte [ebp - 4], 9
cmp dword [ebp - 0x130], ebx
jb 0x10001c14
mov ecx, dword [ebp - 0x144]
push ecx
call fcn.1003d468
add esp, 4
xor edx, edx
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x130], 7
mov dword [ebp - 0x134], 0
mov word [ebp - 0x144], dx
call fcn.10025a10
mov dword [ebp - 0x310], eax
lea esi, [ebp - 0x80]
mov byte [ebp - 4], 0x14
call fcn.10025a70
mov esi, eax
mov eax, dword [ebp - 0x318]
push 0x100b6220
push eax
lea ecx, [ebp - 0x64]
push ecx
mov byte [ebp - 4], 0x15
call fcn.100069b0
add esp, 0xc
mov ecx, eax
mov eax, esi
lea edi, [ebp - 0x48]
mov byte [ebp - 4], 0x16
call fcn.10006920
push eax
mov eax, 0x100b6220
lea esi, [ebp - 0xd4]
mov byte [ebp - 4], 0x17
call fcn.100068d0
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x310]
lea edi, [ebp - 0xf0]
call fcn.10006920
cmp dword [ebp - 0xc0], ebx
jb 0x10001cbf
mov edx, dword [ebp - 0xd4]
push edx
call fcn.1003d468
add esp, 4
mov esi, 7
xor edi, edi
xor eax, eax
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0xc4], edi
mov word [ebp - 0xd4], ax
cmp dword [ebp - 0x34], ebx
jb 0x10001cec
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.1003d468
add esp, 4
xor edx, edx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], edi
mov word [ebp - 0x48], dx
cmp dword [ebp - 0x50], ebx
jb 0x10001d09
mov eax, dword [ebp - 0x64]
push eax
call fcn.1003d468
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], edi
mov word [ebp - 0x64], cx
cmp dword [ebp - 0x6c], ebx
jb 0x10001d26
mov edx, dword [ebp - 0x80]
push edx
call fcn.1003d468
add esp, 4
xor eax, eax
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x70], edi
mov word [ebp - 0x80], ax
mov byte [ebp - 4], 0x1e
cmp dword [ebp - 0x18], ebx
jb 0x10001d47
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.1003d468
add esp, 4
mov dword [ebp - 0x18], esi
xor edx, edx
lea esi, [ebp - 0x9c]
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], dx
call fcn.100259e0
lea edx, [ebp - 0xf0]
mov ecx, eax
mov byte [ebp - 4], 0x1f
call fcn.10003850
test al, al
sete byte [ebp - 0x309]
mov byte [ebp - 4], 0x1e
cmp dword [ebp - 0x88], ebx
jb 0x10001d93
mov eax, dword [ebp - 0x9c]
push eax
call fcn.1003d468
add esp, 4
cmp byte [ebp - 0x309], 0
je 0x10001db7
lea ecx, [ebp - 0xf0]
call fcn.10004230
lea ecx, [ebp - 0x160]
call fcn.10004230
jmp 0x10002559
lea eax, [ebp - 0x308]
call fcn.10019820
mov ecx, dword [ebp + 0xc]
push ecx
push 0x2f
sub esp, 0x1c
mov byte [ebp - 4], 0x20
mov esi, esp
mov dword [ebp - 0x314], esp
call fcn.10025aa0
sub esp, 0x1c
mov byte [ebp - 4], 0x21
mov esi, esp
mov dword [ebp - 0x310], esp
call fcn.10025b00
sub esp, 0x1c
mov ecx, esp
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x320], esp
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x160]
xor edx, edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], edi
push eax
mov word [ecx], dx
call fcn.10005150
lea ecx, [ebp - 0x308]
mov byte [ebp - 4], 0x20
call fcn.1001a790
lea ecx, [ebp - 0x9c]
push ecx
call fcn.10002e90
add esp, 4
push eax
mov eax, 0x100b622c
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 0x23
call fcn.100068d0
add esp, 4
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 0x24
call fcn.10005150
cmp dword [ebp - 0x18], ebx
jb 0x10001e74
mov edx, dword [ebp - 0x2c]
push edx
call fcn.1003d468
add esp, 4
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], ax
cmp dword [ebp - 0x88], ebx
jb 0x10001e9f
mov ecx, dword [ebp - 0x9c]
push ecx
call fcn.1003d468
add esp, 4
lea esi, [ebp - 0x9c]
call fcn.10025560
mov dword [ebp - 0x314], eax
lea esi, [ebp - 0x48]
mov byte [ebp - 4], 0x25
call fcn.10025530
mov dword [ebp - 0x310], eax
mov bl, 0x26
mov byte [ebp - 4], bl
mov eax, dword [0x100c9918]
cmp eax, edi
jne 0x10001efe
push 0x138
call fcn.1003d7eb
add esp, 4
mov dword [ebp - 0x320], eax
mov byte [ebp - 4], 0x27
cmp eax, edi
je 0x10001ef4
mov esi, eax
call fcn.10035040
jmp 0x10001ef6
xor eax, eax
mov byte [ebp - 4], bl
mov dword [0x100c9918], eax
lea ebx, [ebp - 0x64]
mov edi, eax
call fcn.10035310
mov ecx, eax
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0x310]
lea edi, [ebp - 0x80]
call fcn.10006920
mov ecx, eax
mov byte [ebp - 4], 0x29
mov eax, dword [ebp - 0x314]
lea edi, [ebp - 0x2c]
call fcn.10006920
push 0xffffffffffffffff
xor ebx, ebx
push ebx
push eax
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], 0x2a
call fcn.10005150
mov esi, 8
cmp dword [ebp - 0x18], esi
jb 0x10001f5b
mov edx, dword [ebp - 0x2c]
push edx
call fcn.1003d468
add esp, 4
xor eax, eax
mov edi, 7
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
cmp dword [ebp - 0x6c], esi
jb 0x10001f7d
mov ecx, dword [ebp - 0x80]
push ecx
call fcn.1003d468
add esp, 4
xor edx, edx
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x70], ebx
mov word [ebp - 0x80], dx
cmp dword [ebp - 0x50], esi
jb 0x10001f9a
mov eax, dword [ebp - 0x64]
push eax
call fcn.1003d468
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], ebx
mov word [ebp - 0x64], cx
cmp dword [ebp - 0x34], esi
jb 0x10001fb7
mov edx, dword [ebp - 0x48]
push edx
call fcn.1003d468
add esp, 4
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], ax
cmp dword [ebp - 0x88], esi
jb 0x10001fde
mov ecx, dword [ebp - 0x9c]
push ecx
call fcn.1003d468
add esp, 4
lea esi, [ebp - 0x9c]
call fcn.100252c0
mov dword [ebp - 0x310], eax
lea esi, [ebp - 0x48]
mov byte [ebp - 4], 0x2b
call fcn.10025530
mov dword [ebp - 0x314], eax
mov byte [ebp - 4], 0x2c
mov edi, dword [0x100c9918]
cmp edi, ebx
jne 0x10002041
push 0x138
call fcn.1003d7eb
add esp, 4
mov dword [ebp - 0x320], eax
mov byte [ebp - 4], 0x2d
cmp eax, ebx
je 0x10002033
mov esi, eax
call fcn.10035040
jmp 0x10002035
xor eax, eax
mov edi, eax
mov byte [ebp - 4], 0x2c
mov dword [0x100c9918], edi
lea ebx, [ebp - 0x64]
call fcn.10035310
mov ecx, eax
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0x314]
lea edi, [ebp - 0x80]
call fcn.10006920
mov ecx, eax
mov byte [ebp - 4], 0x2f
mov eax, dword [ebp - 0x310]
lea edi, [ebp - 0x2c]
call fcn.10006920
push 0xffffffffffffffff
xor ebx, ebx
push ebx
push eax
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0x30
call fcn.10005150
mov esi, 8
cmp dword [ebp - 0x18], esi
jb 0x1000209c
mov edx, dword [ebp - 0x2c]
push edx
call fcn.1003d468
add esp, 4
xor eax, eax
mov edi, 7
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
cmp dword [ebp - 0x6c], esi
jb 0x100020be
mov ecx, dword [ebp - 0x80]
push ecx
call fcn.1003d468
add esp, 4
xor edx, edx
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x70], ebx
mov word [ebp - 0x80], dx
cmp dword [ebp - 0x50], esi
jb 0x100020db
mov eax, dword [ebp - 0x64]
push eax
call fcn.1003d468
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], ebx
mov word [ebp - 0x64], cx
cmp dword [ebp - 0x34], esi
jb 0x100020f8
mov edx, dword [ebp - 0x48]
push edx
call fcn.1003d468
add esp, 4
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], ax
cmp dword [ebp - 0x88], esi
jb 0x1000211f
mov ecx, dword [ebp - 0x9c]
push ecx
call fcn.1003d468
add esp, 4
lea esi, [ebp - 0x9c]
call fcn.100253e0
mov dword [ebp - 0x310], eax
lea esi, [ebp - 0x48]
mov byte [ebp - 4], 0x31
call fcn.10025530
mov dword [ebp - 0x314], eax
mov byte [ebp - 4], 0x32
mov edi, dword [0x100c9918]
cmp edi, ebx
jne 0x10002182
push 0x138
call fcn.1003d7eb
add esp, 4
mov dword [ebp - 0x320], eax
mov byte [ebp - 4], 0x33
cmp eax, ebx
je 0x10002174
mov esi, eax
call fcn.10035040
jmp 0x10002176
xor eax, eax
mov edi, eax
mov byte [ebp - 4], 0x32
mov dword [0x100c9918], edi
lea ebx, [ebp - 0x64]
call fcn.10035310
mov ecx, eax
mov byte [ebp - 4], 0x34
mov eax, dword [ebp - 0x314]
lea edi, [ebp - 0x80]
call fcn.10006920
mov ecx, eax
mov byte [ebp - 4], 0x35
mov eax, dword [ebp - 0x310]
lea edi, [ebp - 0x2c]
call fcn.10006920
push 0xffffffffffffffff
xor ebx, ebx
push ebx
push eax
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x36
call fcn.10005150
mov esi, 8
cmp dword [ebp - 0x18], esi
jb 0x100021dd
mov edx, dword [ebp - 0x2c]
push edx
call fcn.1003d468
add esp, 4
xor eax, eax
mov edi, 7
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
cmp dword [ebp - 0x6c], esi
jb 0x100021ff
mov ecx, dword [ebp - 0x80]
push ecx
call fcn.1003d468
add esp, 4
xor edx, edx
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x70], ebx
mov word [ebp - 0x80], dx
cmp dword [ebp - 0x50], esi
jb 0x1000221c
mov eax, dword [ebp - 0x64]
push eax
call fcn.1003d468
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], ebx
mov word [ebp - 0x64], cx
cmp dword [ebp - 0x34], esi
jb 0x10002239
mov edx, dword [ebp - 0x48]
push edx
call fcn.1003d468
add esp, 4
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], ax
cmp dword [ebp - 0x88], esi
jb 0x10002260
mov ecx, dword [ebp - 0x9c]
push ecx
call fcn.1003d468
add esp, 4
lea edx, [ebp - 0x9c]
push edx
call fcn.100027b0
add esp, 4
push eax
lea edi, [ebp - 0x2c]
mov byte [ebp - 4], 0x37
call fcn.10033f90
add esp, 4
push eax
lea ecx, [ebp - 0x308]
mov byte [ebp - 4], 0x38
call fcn.1001a4e0
cmp dword [ebp - 0x18], 0x10
mov byte [ebp - 0x309], al
jb 0x100022a7
mov eax, dword [ebp - 0x2c]
push eax
call fcn.1003d468
add esp, 4
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], 0
cmp dword [ebp - 0x88], esi
jb 0x100022d0
mov ecx, dword [ebp - 0x9c]
push ecx
call fcn.1003d468
add esp, 4
cmp byte [ebp - 0x309], 0
je 0x1000250a
lea edx, [ebp - 0x2c]
push edx
call fcn.10002e90
add esp, 4
mov byte [ebp - 4], 0x39
cmp dword [ebp - 0x1c], ebx
jne 0x10002319
lea ecx, [ebp - 0x2c]
call fcn.10004230
lea eax, [ebp - 0x308]
call fcn.100198c0
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 9
call fcn.10004230
jmp 0x10002530
lea esi, [ebp - 0xd4]
call fcn.10025410
mov esi, eax
mov eax, dword [ebp - 0x318]
lea edi, [ebp - 0x48]
mov byte [ebp - 4], 0x3a
call fcn.10006890
push eax
mov eax, 0x100b6220
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 0x3b
call fcn.100068d0
add esp, 4
push eax
mov eax, 0x100b6224
lea esi, [ebp - 0x80]
mov byte [ebp - 4], 0x3c
call fcn.100068d0
add esp, 4
lea ecx, [ebp - 0x64]
call fcn.10004230
mov ecx, edi
call fcn.10004230
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x40
call fcn.10004230
lea esi, [ebp - 0x208]
call fcn.10025b00
mov ebx, eax
lea esi, [ebp - 0x1ec]
mov byte [ebp - 4], 0x41
call fcn.100252f0
mov esi, eax
lea eax, [ebp - 0x2c]
lea edi, [ebp - 0x1d0]
mov byte [ebp - 4], 0x42
call fcn.10006890
push eax
mov eax, 0x100b6220
lea esi, [ebp - 0x198]
mov byte [ebp - 4], 0x43
call fcn.100068d0
add esp, 4
mov ecx, eax
mov eax, ebx
lea edi, [ebp - 0x9c]
mov byte [ebp - 4], 0x44
call fcn.10006920
mov ecx, esi
call fcn.10004230
lea ecx, [ebp - 0x1d0]
call fcn.10004230
lea ecx, [ebp - 0x1ec]
call fcn.10004230
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 0x49
call fcn.10004230
mov eax, edi
push eax
lea ecx, [ebp - 0x80]
push ecx
call fcn.10038b20
mov ebx, dword [ebp - 0x31c]
add esp, 8
cmp dword [ebx + 0xbc], 0
je 0x100024ce
lea esi, [ebp - 0x17c]
call fcn.100253b0
mov dword [ebp - 0x31c], eax
lea esi, [ebp - 0x1b4]
mov byte [ebp - 4], 0x4a
call fcn.10025380
mov esi, eax
mov eax, dword [ebp - 0x318]
lea edi, [ebp - 0xd4]
mov byte [ebp - 4], 0x4b
call fcn.10006890
mov dword [ebp - 0x314], eax
lea esi, [ebp - 0x48]
mov byte [ebp - 4], 0x4c
call fcn.10025b00
mov esi, eax
lea eax, [ebx + 0xac]
lea edi, [ebp - 0x64]
mov byte [ebp - 4], 0x4d
call fcn.10006890
mov ebx, dword [ebp - 0x31c]
mov byte [ebp - 4], 0x4e
mov ecx, dword [ebp - 0x314]
mov edi, eax
call fcn.1000e500
lea ecx, [ebp - 0x64]
call fcn.10004230
lea ecx, [ebp - 0x48]
call fcn.10004230
lea ecx, [ebp - 0xd4]
call fcn.10004230
lea ecx, [ebp - 0x1b4]
call fcn.10004230
lea ecx, [ebp - 0x17c]
call fcn.10004230
lea ecx, [ebp - 0x9c]
call fcn.10004230
lea ecx, [ebp - 0x80]
call fcn.10004230
lea ecx, [ebp - 0x2c]
call fcn.10004230
lea eax, [ebp - 0x308]
call fcn.100198c0
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 9
call fcn.10004230
mov esi, 8
jmp 0x10002530
lea eax, [ebp - 0x308]
call fcn.100198c0
mov byte [ebp - 4], 9
cmp dword [ebp - 0xdc], esi
jb 0x10002530
mov edx, dword [ebp - 0xf0]
push edx
call fcn.1003d468
add esp, 4
mov ecx, dword [ebp - 0x324]
push 5
mov eax, str.e21
call fcn.10005e70
cmp dword [ebp - 0x14c], esi
jb 0x10002559
mov eax, dword [ebp - 0x160]
push eax
call fcn.1003d468
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003c5b5
mov esp, ebp
pop ebp
ret 8