Function at 0xc16026
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x68], 0
test edx, edi
lea esp, [esp]
ja 0xc1603d
lea esp, [esp]
js 0xc16047
mov eax, eax
jns 0xc16047
mov edx, 0x10568
add byte [eax + 0x1c], ch
stosd dword es:[edi], eax
rol byte [eax], 0xff
adc eax, sym.imp.KERNEL32.dll_GetSystemDirectoryA
push 0x105
push 0xc0ab1c
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, dword [esp + 8]
jl 0xc1605d
test ebx, edi
stc
jge 0xc16071
lea eax, [eax + 0x5e24]
lea eax, [eax - 0x5e24]
jl 0xc16071
mov edx, 0x6de945c6
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x15], 0x33
mov byte [ebp - 0x16], 0x34
mov byte [ebp - 0x14], 0x2f
mov byte [ebp - 0x19], 0x6f
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0x18], 0x66
mov byte [ebp - 0x10], 0
mov al, byte [ebp - 0x18]
sub al, 1
mov byte [ebp - 0x18], al
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x11], 0x6d
rol edi, 0
jbe 0xc160bb
jnp 0xc160a8
lea edx, [edx + 0x1838]
lea edx, [edx - 0x1838]
jno 0xc160b6
js 0xc160b8
ja 0xc160bb
xor eax, 0x4ce445c6
mov byte [ebp - 0x1c], 0x4c
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x1b], 0x66
js 0xc160c9
jg 0xc160d3
lea ecx, [ecx]
jnp 0xc160cf
jle 0xc160d3
mov edx, 0xe54d8a11
mov cl, byte [ebp - 0x1b]
sub cl, 1
mov byte [ebp - 0x1b], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x1c]
sub al, 1
mov byte [ebp - 0x1c], al
mov cl, byte [ebp - 0x1a]
sub cl, 1
mov byte [ebp - 0x1a], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov byte [ebp - 0x40], 0x71
mov byte [ebp - 0x3f], 0x6a
mov al, byte [ebp - 0x40]
sub al, 1
mov byte [ebp - 0x40], al
mov cl, byte [ebp - 0x3f]
sub cl, 1
mov byte [ebp - 0x3f], cl
xor edx, 0x1c58
xor edx, 0x1c58
cmp esp, 0x28d
jg 0xc16160
add esp, 0
jbe 0xc1617e
pushf
xchg esp, esp
popf
jg 0xc1616d
lea ecx, [ecx + 0x361c]
lea ecx, [ecx - 0x361c]
jnp 0xc1617b
ja 0xc1617e
add esi, 0xc634c245
inc ebp
ret
mov byte [ebp - 0x3e], 0x34
mov byte [ebp - 0x3d], 0x33
mov dl, byte [ebp - 0x3e]
sub dl, 1
mov byte [ebp - 0x3e], dl
mov al, byte [ebp - 0x3d]
sub al, 1
mov byte [ebp - 0x3d], al
mov byte [ebp - 0x44], 0x42
mov byte [ebp - 0x43], 0x65
test dword [esp + 4], edx
jnp 0xc161a5
ror eax, 0
ja 0xc161b2
xchg ecx, edi
xchg ecx, edi
jbe 0xc161b2
ljmp 0xe980:0xbc4d8ae0
mov cl, byte [ebp - 0x44]
sub cl, 1
mov byte [ebp - 0x44], cl
mov dl, byte [ebp - 0x43]
sub dl, 1
mov byte [ebp - 0x43], dl
je 0xc161c6
jae 0xc161cf
xchg ecx, edi
xchg ecx, edi
jb 0xc161cf
call 0x787fa799
mov byte [ebp - 0x42], 0x77
mov byte [ebp - 0x41], 0x62
mov al, byte [ebp - 0x42]
sub al, 1
mov byte [ebp - 0x42], al
mov cl, byte [ebp - 0x41]
sub cl, 1
mov byte [ebp - 0x41], cl
xchg edx, ebx
xchg edx, ebx
shr esp, 0
lea eax, [eax + 0x3bb]
sub eax, 0x3bb
cmp ecx, dword [esp + 8]
jns 0xc1620f
pushf
cmp ecx, esi
popf
jg 0xc16208
xchg esp, esp
jo 0xc1620c
js 0xc1620f
mov edx, 0xc445c6
mov byte [ebp - 0x3c], 0
shr edi, 0
jne 0xc16218
jo 0xc1622b
pushf
xchg edx, edi
xchg edx, edi
je 0xc16222
and ebx, ebx
popf
xchg esp, esp
jno 0xc1622b
lcall 0x45c6, 0x65b245c6
mov bl, 0x6d
mov byte [ebp - 0x4e], 0x65
mov byte [ebp - 0x4d], 0x6d
mov dl, byte [ebp - 0x4e]
sub dl, 1
mov byte [ebp - 0x4e], dl
mov al, byte [ebp - 0x4d]
sub al, 1
mov byte [ebp - 0x4d], al
ja 0xc16246
cld
jo 0xc16253
js 0xc1624b
xchg esp, esp
mov ecx, ecx
jno 0xc16253
add eax, 0xb045c637
outsd dx, dword [esi]
mov byte [ebp - 0x50], 0x6f
mov byte [ebp - 0x4f], 0x75
mov cl, byte [ebp - 0x50]
sub cl, 1
mov byte [ebp - 0x50], cl
mov dl, byte [ebp - 0x4f]
sub dl, 1
mov byte [ebp - 0x4f], dl
mov edx, edx
cmp edi, 0x40cb
and ebx, 0xffffffff
jno 0xc16283
jmp 0xc1627c
jbe 0xc1627e
jo 0xc16283
add eax, 0x45c6a3a6
mov ah, 0x6d
mov byte [ebp - 0x4c], 0x6d
mov byte [ebp - 0x4b], 0
mov al, byte [ebp - 0x4c]
sub al, 1
mov byte [ebp - 0x4c], al
dec eax
inc eax
jo 0xc162aa
pushf
jp 0xc1629b
cmp esp, 0x1197
popf
je 0xc162a5
jmp 0xc162a7
jno 0xc162aa
lcall 0x45c6, 0x34f845c6
stc
xor eax, esi
inc ebp
clc
xor ecx, dword [edx - 0x167f06b3]
add dword [eax + 0x7ff94d], ecx
mov byte [ebp - 8], 0x34
mov byte [ebp - 7], 0x33
mov byte [ebp - 8], 0x33
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
jg 0xc162c1
jo 0xc162d6
pushf
shl esp, 0
jae 0xc162ca
and esp, 0xffffffff
popf
mov esi, esi
xchg esp, esp
jno 0xc162d6
add eax, 0x56f445c6
mov byte [ebp - 0xc], 0x56
mov byte [ebp - 0xb], 0x74
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
xor ebx, dword [esp]
xor ebx, dword [esp]
test dword [esp], edx
je 0xc16304
lea esp, [esp]
mov esp, esp
jg 0xc16301
jne 0xc16304
call 0x67b7a8ce
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 9], 0x73
xor eax, 0
jo 0xc16335
pushf
xor ebx, dword [esp]
xor ebx, dword [esp]
xor ebx, ecx
xor ebx, ecx
push edx
add edx, 0x570d
ror edx, 0xe
pop edx
xor eax, dword [esp]
xor eax, dword [esp]
popf
jge 0xc16332
jno 0xc16335
sub eax, 0x80f64d8a
jmp 0xf70eeb3f
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov byte [ebp - 6], 0
jo 0xc1634d
shr esi, 0
jl 0xc1635b
xchg esp, esp
jle 0xc16356
mov esp, esp
jge 0xc1635b
add eax, 0x489c45c6
mov byte [ebp - 0x64], 0x48
mov byte [ebp - 0x5f], 0x65
mov byte [ebp - 0x5a], 0x62
mov byte [ebp - 0x55], 0x42
rol ecx, 0
test dword [esp], esi
or edi, edi
jbe 0xc1637d
xchg esp, esp
lea esp, [esp]
ja 0xc1637d
call 0x2d5da90b
add dword [eax + 0x4d8a9c45], ecx
mov eax, dword [0x8801e980]
dec ebp
mov eax, dword [0x80a6558a]
ljmp 0x458a
mov al, byte [ebp - 0x64]
sub al, 1
mov byte [ebp - 0x64], al
mov cl, byte [ebp - 0x5f]
sub cl, 1
mov byte [ebp - 0x5f], cl
mov dl, byte [ebp - 0x5a]
sub dl, 1
mov byte [ebp - 0x5a], dl
mov al, byte [ebp - 0x55]
sub al, 1
mov byte [ebp - 0x55], al
jle 0xc163a1
add esp, 0
stc
push edi
add edi, 0x5a1f
ror edi, 0x1c
pop edi
je 0xc163b9
xchg edi, edx
xchg edi, edx
jne 0xc163b9
sub eax, 0x669d45c6
mov byte [ebp - 0x63], 0x66
mov byte [ebp - 0x5e], 0x76
mov byte [ebp - 0x59], 0x6f
mov byte [ebp - 0x54], 0
or ebx, ebx
shr edi, 0
add ecx, 0x3aa6
sub ecx, 0x3aa6
jp 0xc163e5
nop
jle 0xc163df
lea esp, [esp]
jnp 0xc163e5
lcall 0x1e9, 0x809d4d8a
mov cl, byte [ebp - 0x63]
sub cl, 1
mov byte [ebp - 0x63], cl
mov dl, byte [ebp - 0x5e]
sub dl, 1
mov byte [ebp - 0x5e], dl
mov al, byte [ebp - 0x59]
sub al, 1
mov byte [ebp - 0x59], al
mov byte [ebp - 0x54], 0
shr ebx, 0
test ebx, 0x2d4b
xor ecx, eax
xor ecx, eax
jns 0xc16412
jo 0xc1641d
mov esi, esi
mov esp, esp
jae 0xc1641a
jno 0xc1641d
add esi, 0xc6759e45
inc ebp
mov dword [0xa845c66d], eax
mov byte gs:[ebp - 0x53], 0
mov byte [ebp - 0x62], 0x75
mov byte [ebp - 0x5d], 0x6d
mov byte [ebp - 0x58], 0x65
mov byte [ebp - 0x53], 0
mov cl, byte [ebp - 0x62]
sub cl, 1
mov byte [ebp - 0x62], cl
mov dl, byte [ebp - 0x5d]
sub dl, 1
mov byte [ebp - 0x5d], dl
mov al, byte [ebp - 0x58]
sub al, 1
mov byte [ebp - 0x58], al
mov byte [ebp - 0x53], 0
lea ebx, [ebx]
jne 0xc16462
jmp 0xc16451
lea ecx, [ecx + 0x4cdd]
lea ecx, [ecx - 0x4cdd]
jbe 0xc1645f
je 0xc16462
jmp 0x4f60aa2c
mov byte [ebp - 0x61], 0x4e
mov byte [ebp - 0x5c], 0x66
mov byte [ebp - 0x57], 0x6d
mov byte [ebp - 0x52], 0
xchg edi, edi
jo 0xc16476
jle 0xc16489
pushf
xchg esp, esp
xchg ebx, edx
xchg ebx, edx
jnp 0xc16482
popf
jnp 0xc16486
jg 0xc16489
mov edi, 0x809f4d8a
jmp 0xa00eec93
mov cl, byte [ebp - 0x61]
sub cl, 1
mov byte [ebp - 0x61], cl
mov dl, byte [ebp - 0x5c]
sub dl, 1
mov byte [ebp - 0x5c], dl
mov al, byte [ebp - 0x57]
sub al, 1
mov byte [ebp - 0x57], al
mov byte [ebp - 0x52], 0
mov byte [ebp - 0x60], 0x70
mov byte [ebp - 0x5b], 0x49
mov byte [ebp - 0x56], 0x66
nop
test dword [esp + 8], edi
jnp 0xc164bf
ja 0xc164bc
jp 0xc164bf
mov edx, 0x80a04d8a
jmp 0xa10eecc9
mov cl, byte [ebp - 0x60]
sub cl, 1
mov byte [ebp - 0x60], cl
mov dl, byte [ebp - 0x5b]
sub dl, 1
mov byte [ebp - 0x5b], dl
mov al, byte [ebp - 0x56]
sub al, 1
mov byte [ebp - 0x56], al
push 0xc0ab1c
call fcn.00c2b319
add esp, 4
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x68]
push ecx
push 0xc0ab1c
push 0xc0ac24
call fcn.00c22778
add esp, 0xc
push 1
push 0xc093c4
mov edx, dword [ebp - 0x68]
add edx, 0xc0ac24
push edx
call fcn.00c22778
add esp, 0xc
mov eax, dword [ebp - 0x68]
add eax, 1
mov dword [ebp - 0x68], eax
rol esp, 0
jge 0xc16537
pushf
clc
test dword [esp], edx
xchg esp, esp
jle 0xc16530
popf
je 0xc16534
jl 0xc16537
sub eax, 0x51e44d8d
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00c2b319
add esp, 4
push eax
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x68]
add eax, 0xc0ac24
push eax
call fcn.00c22778
add esp, 0xc
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00c2b319
add esp, 4
mov edx, dword [ebp - 0x68]
add edx, eax
mov dword [ebp - 0x68], edx
mov eax, dword [ebp - 0x68]
mov byte [eax + 0xc0ac24], 0
call 0xc1657c
lea esp, [esp + 4]
xchg ebx, edi
xchg ebx, edi
jg 0xc16597
lea esi, [esi + 0x2133]
lea esi, [esi - 0x2133]
xchg esp, esp
jle 0xc16597
call 0xc16d8a03
add bh, bh
adc eax, sym.imp.KERNEL32.dll_LoadLibraryA
push 0xc0ac24
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x2c], eax
xchg edi, esi
xchg edi, esi
jle 0xc165ab
shr esp, 0
and esp, 0xffffffff
jae 0xc165c8
pushf
xor esi, dword [esp + 0x10]
xor esi, dword [esp + 0x10]
xor edi, ecx
xor edi, ecx
popf
jge 0xc165c5
jb 0xc165c8
sub eax, 0x89d44d8b
or eax, 0xc0a890
mov ecx, dword [ebp - 0x2c]
mov dword [0xc0a890], ecx
rol byte [eax], 0x8d
push ebp
mov al, 0x52
lea edx, [ebp - 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x30], eax
shl esp, 0
add edx, dword [esp]
sub edx, dword [esp]
xor esi, dword [esp + 8]
xor esi, dword [esp + 8]
je 0xc16604
pushf
neg edx
neg edx
mov esp, esp
nop
add esp, 0
popf
jg 0xc16601
jne 0xc16604
mov edx, 0x50f4458d
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x24], eax
nop
jp 0xc16621
jg 0xc16629
lea esp, [esp]
jle 0xc16629
add eax, 0xb014158b
rol byte [eax], 0x89
push ebp
int3
mov edx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x34], edx
test esp, 0x4e9f
jge 0xc1663f
jb 0xc1663c
jl 0xc1663f
lcall 0x8900, 0xc0b010a1
inc ebp
loopne 0xc165cf
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
xchg edx, edx
stc
sar cl, cl
shl esp, 0
cmp esi, edi
jbe 0xc1666c
pushf
xchg ebx, ebx
add esi, 0x17c5
sub esi, 0x17c5
popf
jp 0xc16665
lea ebx, [ebx]
jle 0xc16669
ja 0xc1666c
mov edx, 0x89d44d8b
or eax, 0xc004a4
mov ecx, dword [ebp - 0x2c]
mov dword [0xc004a4], ecx
lea edi, [edi]
nop
and edx, edx
je 0xc16698
pushf
ror ebx, 0x18
rol ebx, 0x18
test esi, 0x5cc
dec edx
inc edx
shr esp, 0
popf
je 0xc16693
jp 0xc16695
jne 0xc16698
mov ebx, 0x89d0558b
adc eax, 0xc004a0
mov edx, dword [ebp - 0x30]
mov dword [0xc004a0], edx
call 0xc166a6
lea esp, [esp + 4]
shl ebx, 0
rol edi, 0x1b
rol edi, 5
xor eax, dword [esp]
xor eax, dword [esp]
jg 0xc166c5
mov esp, esp
jbe 0xc166bf
xchg esp, esp
jle 0xc166c5
mov ebx, 0xd8458b23
mov eax, dword [ebp - 0x28]
mov dword [0xc004a8], eax
jle 0xc166cf
jno 0xc166d1
inc esi
dec esi
jp 0xc166e9
pushf
jo 0xc166d9
lea esp, [esp]
popf
lea edi, [edi + 0x5f]
lea edi, [edi - 0x5f]
jb 0xc166e6
jnp 0xc166e9
ljmp 0xac0d:0x89dc4d8b
mov ecx, dword [ebp - 0x24]
mov dword [0xc004ac], ecx
and eax, 0xffffffff
nop
ja 0xc16708
lea edi, [edi + 0x5c1a]
lea edi, [edi - 0x5c1a]
nop
jbe 0xc16708
lcall 0x9c15, 0x89cc558b
add al, 0xc0
add byte [edi], dh
mov edx, dword [ebp - 0x34]
mov dword [0xc0049c], edx
ja 0xc16713
jg 0xc16726
pushf
or edi, 0
xchg ecx, ecx
nop
popf
jnp 0xc16721
jo 0xc16723
jle 0xc16726
mov ebx, 0xa3e0458b
mov al, 4
rol byte [eax], 0x23
rol cl, 0xe2
add byte [ebp + 0xe], dh
mov eax, dword [ebp - 0x20]
mov dword [0xc004b0], eax
and eax, eax
shl edx, 0
jne 0xc16743
pushf
and edx, edx
sub edi, 0
popf
js 0xc16740
je 0xc16743
lcall 0x45e8, 0x51cc4d8d
pop ebp
invalid
lea ecx, [ebp - 0x34]
push ecx
call fcn.00c0c491
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret