Function at 0x100067b0
Capabilities:
Check if file exists
Create directory
Create process on windows
Create thread
Delete file
Get common file path
Get disk information
Get file attributes
Get socket status
Move file
Resolve function by parsing pe exports
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e6f1a
mov eax, dword fs:[0]
push eax
sub esp, 0x4c0
mov eax, dword [0x1012f5f0]
xor eax, esp
mov dword [esp + 0x4b8], eax
push ebx
push esi
push edi
mov eax, dword [0x1012f5f0]
xor eax, esp
push eax
lea eax, [esp + 0x4d0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x38], eax
mov eax, 1
add dword [0x1013c144], eax
test byte [0x1013c170], al
mov dword [esp + 0x20], ecx
jne 0x10006862
or dword [0x1013c170], eax
xor ebx, ebx
mov dword [esp + 0x4d8], ebx
call fcn.10011430
mov dword [0x1013c160], eax
mov byte [eax + 0x15], 1
mov eax, dword [0x1013c160]
mov dword [eax + 4], eax
mov eax, dword [0x1013c160]
mov dword [eax], eax
mov eax, dword [0x1013c160]
mov dword [eax + 8], eax
push 0x100e7100
mov dword [0x1013c164], ebx
call fcn.1001fb02
add esp, 4
mov dword [esp + 0x4d8], 0xffffffff
jmp 0x10006864
xor ebx, ebx
mov edi, dword [esp + 0x20]
xor eax, eax
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x8c], 0xa
mov dword [esp + 0x90], ebx
call fcn.100b7a50
add esp, 4
lea edx, [esp + 0x88]
push edx
push ebx
push ebx
lea ecx, [esp + 0x3c8]
mov dword [esp + 0x3cc], eax
push ecx
add eax, 1
push eax
mov dword [esp + 0x3d0], 1
call sub.WS2_32.dll_select
cmp eax, ebx
jne 0x1000691b
xor eax, eax
mov dword [esp + 0x6a], eax
mov word [esp + 0x68], bx
mov dword [esp + 0x6e], eax
mov dword [esp + 0x72], eax
mov word [esp + 0x76], ax
mov byte [esp + 0x6a], bl
xor esi, esi
cmp edi, ebx
je 0x1000690d
mov edx, 0x10
sub edx, esi
push edx
lea eax, [esp + esi + 0x6c]
push eax
push edi
call fcn.100b6040
add esp, 0xc
cmp eax, ebx
jle 0x1000690b
add esi, eax
cmp esi, 0x10
jl 0x100068e4
jmp 0x1000690d
mov esi, eax
cmp esi, 0x10
je 0x10006868
jmp 0x10008182
jl 0x10008182
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push ecx
mov ebx, 0x10
call fcn.10017040
add esp, 4
cmp eax, ebx
jne 0x10008182
mov dword [esp + 0xf4], 0xf
mov dword [esp + 0xf0], 0
mov byte [esp + 0xe0], 0
mov dword [esp + 0x4d8], 1
mov ax, word [esp + 0x28]
test ax, ax
jbe 0x10006995
movzx edx, ax
push edx
lea eax, [esp + 0xe0]
push eax
mov ebx, edi
call fcn.100170c0
movzx ecx, word [esp + 0x30]
add esp, 8
cmp eax, ecx
jne 0x1000804a
cmp word [esp + 0x2a], 0
je 0x10006a39
mov edi, dword [esp + 0x20]
lea esi, [esp + 0xf8]
call fcn.100171b0
mov byte [esp + 0x4d8], 2
cmp dword [esp + 0x10c], 0
je 0x10008078
cmp dword [esp + 0x110], 0x10
mov eax, dword [esp + 0xfc]
jae 0x100069df
lea eax, [esp + 0xfc]
push 0x10
push 0
push eax
call fcn.1001f395
mov esi, eax
add esp, 0xc
test esi, esi
jle 0x10006a0f
mov ebx, dword [esp + 0x20]
lea edx, [esp + 0xdc]
push esi
push edx
call fcn.100170c0
add esp, 8
cmp eax, esi
jne 0x100080e9
mov byte [esp + 0x4d8], 1
cmp dword [esp + 0x110], 0x10
jb 0x10006a31
mov eax, dword [esp + 0xfc]
push eax
call fcn.1001d705
add esp, 4
test esi, esi
jg 0x100069a1
mov ecx, dword [0x1013c160]
mov ebx, dword [ecx]
mov edi, 0x1013c15c
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x58], edi
mov edi, edi
test edi, edi
mov esi, dword [0x1013c160]
je 0x10006a62
cmp edi, 0x1013c15c
je 0x10006a67
call fcn.100201de
cmp ebx, esi
je 0x10006c37
test edi, edi
jne 0x10006a78
call fcn.100201de
cmp ebx, dword [edi + 4]
jne 0x10006a82
call fcn.100201de
mov edx, dword [ebx + 0x10]
push edx
mov eax, 0x65
call fcn.100190e0
test eax, eax
je 0x10006aec
cmp dword [esp + 0xf4], 0x10
mov ecx, dword [esp + 0xe0]
jae 0x10006aac
lea ecx, [esp + 0xe0]
mov edx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0xf4]
push fcn.10017330
push edx
mov edx, dword [esp + 0x30]
push ecx
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [esp + 0x48]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x4c]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x50]
mov dword [ecx + 0xc], edx
call eax
add esp, 0x20
test eax, eax
jne 0x10006c37
cmp ebx, dword [edi + 4]
jne 0x10006af6
call fcn.100201de
mov eax, dword [ebx + 0x10]
push eax
mov eax, str.DllGetClassObject
call fcn.100190e0
test eax, eax
je 0x10006bf1
cmp eax, 0xffffffff
je 0x10006bf1
mov dword [esp + 0x14], 0
lea ecx, [esp + 0x14]
push ecx
push 0x1011d6c4
push 0x10129fe8
mov byte [esp + 0x4e4], 3
call eax
test eax, eax
jne 0x10006bd9
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x4dc], 4
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push 0x10129ff8
push 0
push eax
call edx
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10006bc5
mov ecx, dword [eax]
lea edx, [esp + 0x64]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
movsx ecx, byte [esp + 0x26]
cmp dword [esp + 0x64], ecx
jne 0x10006bc1
cmp dword [esp + 0xf4], 0x10
mov ecx, dword [esp + 0xe0]
jae 0x10006b9a
lea ecx, [esp + 0xe0]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov edx, dword [eax]
mov edx, dword [edx + 0x20]
push esi
push dword [esp + 0x3c]
mov esi, dword [esp + 0xf8]
push esi
push ecx
lea ecx, [esp + 0x34]
push ecx
push eax
call edx
test eax, eax
je 0x10006c07
mov eax, dword [esp + 0x1c]
test eax, eax
mov byte [esp + 0x4d8], 3
je 0x10006bd9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x4d8], 1
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10006bf1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea esi, [esp + 0x58]
call fcn.100114b0
mov ebx, dword [esp + 0x5c]
mov edi, dword [esp + 0x58]
jmp 0x10006a50
mov byte [esp + 0x4d8], 3
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10006c1f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x4d8], 1
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10006c37
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
test edi, edi
mov esi, dword [0x1013c160]
je 0x10006c49
cmp edi, 0x1013c15c
je 0x10006c4e
call fcn.100201de
cmp ebx, esi
jne 0x1000801c
mov al, byte [esp + 0x26]
cmp al, 1
jne 0x10006c82
mov eax, dword [esp + 0x2c]
push 0
push 0
push eax
push 0x10008940
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000801c
cmp al, 6
je 0x10008150
cmp al, 8
jne 0x10006e77
mov ecx, dword [0x1013c160]
mov edi, dword [ecx]
mov ebx, 0x1013c15c
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
jmp 0x10006cb0
test ebx, ebx
mov esi, dword [0x1013c160]
je 0x10006cc2
cmp ebx, 0x1013c15c
je 0x10006cc7
call fcn.100201de
cmp edi, esi
je 0x10006e1f
test ebx, ebx
jne 0x10006cd8
call fcn.100201de
cmp edi, dword [ebx + 4]
jne 0x10006ce2
call fcn.100201de
mov edx, dword [edi + 0x10]
push edx
mov eax, str.DllGetClassObject
call fcn.100190e0
test eax, eax
je 0x10006dc8
cmp eax, 0xffffffff
je 0x10006dc8
xor esi, esi
mov dword [esp + 0x1c], esi
lea ecx, [esp + 0x1c]
push ecx
push 0x1011d6c4
mov bl, 5
push 0x10129fe8
mov byte [esp + 0x4e4], bl
call eax
cmp eax, esi
jne 0x10006db0
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x14]
push ecx
mov byte [esp + 0x4dc], 6
mov eax, dword [esp + 0x20]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push 0x10129ff8
push esi
push eax
call edx
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x10006d9d
mov ecx, dword [eax]
lea edx, [esp + 0x60]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov cl, byte [esp + 0x60]
mov eax, dword [esp + 0x14]
mov byte [esp + 0xb6], cl
mov ecx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x3c]
push ecx
push 4
lea ecx, [esp + 0x58]
push ecx
lea ecx, [esp + 0xc4]
mov dword [esp + 0x5c], 0x706f7473
mov edx, dword [eax]
mov edx, dword [edx + 0x20]
push ecx
push eax
call edx
mov eax, dword [esp + 0x14]
cmp eax, esi
mov byte [esp + 0x4d8], bl
je 0x10006db0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x4d8], 1
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x10006dc8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x50]
cmp edi, dword [eax + 4]
jne 0x10006dd6
call fcn.100201de
mov esi, dword [edi + 0x10]
test esi, esi
je 0x10006e09
cmp dword [esi], 0
je 0x10006e00
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push 0
push 0
push ecx
call edx
mov eax, dword [esi + 8]
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push esi
call fcn.1001d705
add esp, 4
lea esi, [esp + 0x50]
call fcn.100114b0
mov edi, dword [esp + 0x54]
mov ebx, dword [esp + 0x50]
jmp 0x10006cb0
mov ecx, dword [0x1013c160]
mov edi, dword [ecx + 4]
cmp byte [edi + 0x15], 0
mov esi, edi
jne 0x10006e51
mov edx, dword [esi + 8]
push edx
mov ecx, 0x1013c15c
call fcn.1000e510
mov esi, dword [esi]
push edi
call fcn.1001d705
add esp, 4
cmp byte [esi + 0x15], 0
mov edi, esi
je 0x10006e30
mov eax, dword [0x1013c160]
mov dword [eax + 4], eax
mov eax, dword [0x1013c160]
mov dword [0x1013c164], 0
mov dword [eax], eax
mov eax, dword [0x1013c160]
mov dword [eax + 8], eax
jmp 0x1000801c
cmp al, 7
jne 0x10006fc5
mov edi, 0x12
cmp dword [esp + 0xf0], edi
jne 0x10007fa7
cmp dword [esp + 0xf4], 0x10
mov eax, dword [esp + 0xe0]
jae 0x10006ea9
lea eax, [esp + 0xe0]
mov ecx, dword [eax]
mov dword [esp + 0xf8], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0xfc], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x100], ecx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x104], edx
mov ax, word [eax + 0x10]
lea edx, [esp + 0xfa]
mov word [esp + 0x108], ax
mov byte [esp + 0xf8], 0
mov byte [esp + 0xf9], 0x73
call fcn.1000a070
test al, al
je 0x10006f83
mov dword [esp + 0x12c], 0xf
mov dword [esp + 0x128], 0
mov byte [esp + 0x118], 0
lea ecx, [esp + 0x114]
push ecx
mov byte [esp + 0x4dc], 7
call fcn.1000a730
sub esp, 0x18
lea edx, [esp + 0x116]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.1000af20
lea ecx, [esp + 0x130]
call fcn.1000a330
lea eax, [esp + 0x130]
add esp, 0x1c
push eax
call fcn.1000a4b0
add esp, 4
lea ecx, [esp + 0x114]
mov byte [esp + 0xf8], al
mov byte [esp + 0x4d8], 1
call fcn.1000af90
mov esi, dword [esp + 0x20]
push 0x10
lea ecx, [esp + 0x28]
push ecx
push esi
mov word [esp + 0x34], di
mov word [esp + 0x36], 0
call fcn.10017330
add esp, 0xc
cmp eax, 0x10
jne 0x1000816b
push edi
lea edx, [esp + 0xfc]
push edx
push esi
call fcn.10017330
add esp, 0xc
cmp eax, edi
jmp 0x10008016
cmp al, 3
jne 0x100070d8
mov ebx, 0x102
cmp dword [esp + 0xf0], ebx
jne 0x10007fa7
cmp dword [esp + 0xf4], 0x10
mov esi, dword [esp + 0xe0]
jae 0x10006ff7
lea esi, [esp + 0xe0]
mov ecx, 0x40
lea edi, [esp + 0x174]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
mov byte [esp + 0x174], 0
mov byte [esp + 0x175], 0x73
mov dword [esp + 0x12c], 0xf
mov dword [esp + 0x128], esi
mov byte [esp + 0x118], 0
lea eax, [esp + 0x114]
push eax
mov byte [esp + 0x4dc], 9
call fcn.1000a730
sub esp, 0x18
lea edx, [esp + 0x192]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.1000af20
lea ecx, [esp + 0x130]
call fcn.1000a150
lea eax, [esp + 0x130]
add esp, 0x1c
push eax
call fcn.1000a4b0
add esp, 4
lea ecx, [esp + 0x114]
mov byte [esp + 0x174], al
mov byte [esp + 0x4d8], 1
call fcn.1000af90
push 0x10
lea ecx, [esp + 0x28]
mov word [esp + 0x2e], si
mov esi, dword [esp + 0x24]
push ecx
push esi
mov word [esp + 0x34], bx
call fcn.10017330
add esp, 0xc
cmp eax, 0x10
jne 0x1000816b
push ebx
lea edx, [esp + 0x178]
push edx
push esi
call fcn.10017330
add esp, 0xc
cmp eax, ebx
jmp 0x10008016
cmp al, 4
jne 0x10007371
cmp dword [esp + 0xf0], 0
je 0x1000801c
cmp dword [esp + 0xf4], 0x10
mov eax, dword [esp + 0xe0]
jae 0x10007106
lea eax, [esp + 0xe0]
mov ecx, dword [esp + 0xf0]
push ecx
push eax
call fcn.10004ff0
mov esi, eax
add esp, 8
test esi, esi
je 0x1000816b
push 0
lea eax, [esp + 0x280]
mov ecx, esi
call fcn.10005100
add esp, 4
test eax, eax
jne 0x1000816b
mov edx, dword [esp + 0x3a4]
push edx
call fcn.1001d0f1
mov ebx, eax
mov eax, dword [esp + 0x3a8]
add esp, 4
push eax
mov ecx, ebx
xor edx, edx
mov eax, esi
call fcn.10005140
add esp, 4
lea edi, [esp + 0xdc]
mov dword [esp + 0x18], eax
call fcn.1000b1b0
cmp dword [esp + 0x18], 0
jne 0x1000718b
mov ecx, dword [esp + 0x3a4]
push ecx
push ebx
mov eax, edi
call fcn.1000afc0
push ebx
call fcn.100205c0
add esp, 4
mov edi, esi
call fcn.10005180
cmp dword [esp + 0xf0], 0
je 0x1000816b
push 0x18
call fcn.1001dbd3
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x100071c9
mov esi, eax
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
mov dword [esp + 0x14], esi
jmp 0x100071cf
mov dword [esp + 0x14], ebx
mov esi, ebx
cmp dword [esp + 0xf4], 0x10
mov eax, dword [esp + 0xe0]
jae 0x100071e7
lea eax, [esp + 0xe0]
mov ecx, dword [esp + 0xf0]
push eax
mov edi, esi
call fcn.10018fe0
test eax, eax
je 0x1000735f
push esi
mov eax, str.DllGetClassObject
mov dword [esp + 0x20], ebx
call fcn.100190e0
cmp eax, ebx
je 0x100072a9
cmp eax, 0xffffffff
je 0x100072a9
mov dword [esp + 0x18], ebx
lea edx, [esp + 0x18]
push edx
push 0x1011d6c4
push 0x10129fe8
mov byte [esp + 0x4e4], 0xb
call eax
cmp eax, ebx
jne 0x1000728f
mov dword [esp + 0x34], ebx
lea edx, [esp + 0x34]
push edx
mov byte [esp + 0x4dc], 0xc
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push 0x10129ff8
push ebx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov eax, dword [esp + 0x34]
cmp eax, ebx
je 0x1000727b
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov eax, dword [esp + 0x34]
cmp eax, ebx
mov byte [esp + 0x4d8], 0xb
je 0x1000728f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x4d8], 1
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x10007318
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x10007318
push esi
mov eax, 0x4e
call fcn.100190e0
mov edi, eax
push esi
mov eax, 0x6c
call fcn.100190e0
cmp edi, ebx
mov dword [esp + 0x18], eax
je 0x1000816b
cmp eax, ebx
je 0x1000816b
call edi
mov dword [esp + 0x1c], eax
mov eax, dword [0x1013c160]
mov dword [esp + 0x84], eax
lea ebx, [esp + 0x1c]
lea eax, [esp + 0xc4]
mov dword [esp + 0x80], 0x1013c15c
call fcn.1000c1a0
lea esi, [esp + 0x80]
mov edi, eax
call fcn.1000c220
test al, al
je 0x10007318
call dword [esp + 0x18]
mov ecx, dword [0x1013c160]
lea ebx, [esp + 0x1c]
lea eax, [esp + 0xac]
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x78], 0x1013c15c
call fcn.1000c1a0
lea esi, [esp + 0x78]
mov edi, eax
call fcn.1000c220
test al, al
je 0x10007359
call fcn.1000c120
mov edx, dword [esp + 0x14]
mov dword [eax], edx
jmp 0x1000801c
mov esi, dword [esp + 0x14]
xor ebx, ebx
cmp esi, ebx
je 0x1000801c
call fcn.10006780
jmp 0x1000801c
cmp al, 5
jne 0x100077d4
lea eax, [esp + 0x3bc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [esp + 0xf0]
test eax, eax
je 0x1000801c
cmp dword [esp + 0xf4], 0x10
mov ecx, dword [esp + 0xe0]
jae 0x100073b3
lea ecx, [esp + 0xe0]
push eax
push ecx
call fcn.10004ff0
mov ebx, eax
xor eax, eax
add esp, 8
cmp ebx, eax
je 0x1000816b
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov byte [esp + 0x4d8], 0xd
mov dword [esp + 0x14], eax
push eax
lea eax, [esp + 0x280]
mov ecx, ebx
call fcn.10005100
add esp, 4
test eax, eax
jne 0x1000761c
jmp 0x10007400
mov ecx, dword [esp + 0x14]
push ecx
lea eax, [esp + 0x280]
mov ecx, ebx
call fcn.10005100
add esp, 4
test eax, eax
jne 0x1000761c
mov edx, dword [esp + 0x3a4]
push edx
call fcn.1001d0f1
mov ecx, dword [esp + 0x3a8]
mov edx, dword [esp + 0x18]
add esp, 4
push ecx
mov dword [esp + 0x1c], eax
mov ecx, eax
mov eax, ebx
call fcn.10005140
add esp, 4
lea edi, [esp + 0xdc]
mov esi, eax
call fcn.1000b1b0
test esi, esi
jne 0x100075d4
lea eax, [esp + 0x280]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10007470
sub eax, edx
cmp eax, 4
jle 0x100074d8
mov edi, str..exe
lea esi, [esp + eax + 0x27c]
mov ecx, 5
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x100074d8
lea eax, [esp + 0x280]
push eax
lea ecx, [esp + 0x118]
call fcn.1000af20
lea ecx, [esp + 0x114]
push ecx
lea esi, [esp + 0x40]
mov byte [esp + 0x4dc], 0xe
call fcn.1000c2b0
lea ecx, [esp + 0x114]
mov byte [esp + 0x4d8], 0xd
call fcn.1000af90
mov edx, dword [esp + 0x3a4]
mov eax, dword [esp + 0x18]
push edx
push eax
lea eax, [esp + 0xe4]
call fcn.1000afc0
cmp dword [esp + 0xf0], 0
je 0x1000761c
lea ecx, [esp + 0x3bc]
push ecx
lea ecx, [esp + 0x140]
call fcn.1000af20
push eax
lea edx, [esp + 0x118]
push edx
lea edi, [esp + 0x288]
mov byte [esp + 0x4e0], 0xf
call fcn.10011ae0
add esp, 8
mov esi, 0x10
mov byte [esp + 0x4d8], 0x10
cmp dword [eax + 0x18], esi
jb 0x1000754a
mov eax, dword [eax + 4]
jmp 0x1000754d
add eax, 4
push eax
lea eax, [esp + 0x178]
push eax
call fcn.1000c360
lea ecx, [esp + 0x114]
mov byte [esp + 0x4d8], 0x12
call fcn.1000af90
lea ecx, [esp + 0x13c]
mov byte [esp + 0x4d8], 0x13
call fcn.1000af90
cmp dword [esp + 0x1c4], 0
je 0x10007608
cmp dword [esp + 0xf4], esi
mov eax, dword [esp + 0xe0]
jae 0x100075a4
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x178]
push ecx
mov ecx, dword [esp + 0xf8]
call fcn.1000b530
lea edi, [esp + 0x174]
call fcn.1000c4e0
mov eax, edi
mov byte [esp + 0x4d8], 0xd
call fcn.100081b0
mov edx, dword [esp + 0x18]
push edx
call fcn.100205c0
mov eax, dword [esp + 0x18]
add eax, 1
add esp, 4
mov dword [esp + 0x14], eax
push eax
lea eax, [esp + 0x280]
mov ecx, ebx
call fcn.10005100
add esp, 4
test eax, eax
je 0x10007400
jmp 0x1000761c
lea eax, [esp + 0x174]
mov byte [esp + 0x4d8], 0xd
call fcn.100081b0
mov edi, ebx
call fcn.10005180
xor ebx, ebx
mov dword [esp + 0x18], ebx
lea esp, [esp]
mov esi, dword [esp + 0x40]
test esi, esi
mov edi, dword [esp + 0x44]
je 0x10007799
mov ecx, edi
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jae 0x10007799
lea eax, [esp + 0x174]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xor edi, edi
lea eax, [esp + 0x3bc]
mov dword [esp + 0x12c], 0xf
mov dword [esp + 0x128], edi
mov byte [esp + 0x118], 0
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10007693
sub eax, edx
push eax
lea ecx, [esp + 0x3c0]
push ecx
lea ecx, [esp + 0x11c]
call fcn.1000f5f0
mov byte [esp + 0x4d8], 0x14
mov esi, dword [esp + 0x40]
cmp esi, edi
je 0x100076e0
mov ecx, dword [esp + 0x44]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x100076e9
call fcn.100201de
mov esi, dword [esp + 0x40]
mov edx, dword [esp + 0x18]
add esi, edx
push esi
lea eax, [esp + 0x118]
push eax
lea ecx, [esp + 0x144]
push ecx
call fcn.10011bb0
mov esi, 0x10
add esp, 0xc
cmp dword [eax + 0x18], esi
jb 0x10007717
mov eax, dword [eax + 4]
jmp 0x1000771a
add eax, 4
lea edx, [esp + 0xcc]
push edx
lea ecx, [esp + 0x178]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp dword [esp + 0x154], esi
jb 0x10007751
mov edx, dword [esp + 0x140]
push edx
call fcn.1001d705
add esp, 4
mov byte [esp + 0x4d8], 0xd
cmp dword [esp + 0x12c], esi
mov dword [esp + 0x154], 0xf
mov dword [esp + 0x150], edi
mov byte [esp + 0x140], 0
jb 0x1000778c
mov eax, dword [esp + 0x118]
push eax
call fcn.1001d705
add esp, 4
add ebx, 1
add dword [esp + 0x18], 0x1c
jmp 0x10007630
test esi, esi
mov byte [esp + 0x4d8], 1
je 0x100077c1
mov ecx, dword [esp + 0x4c]
push ecx
mov eax, esi
call fcn.10012990
mov edx, dword [esp + 0x44]
add esp, 4
push edx
call fcn.1001d705
add esp, 4
xor eax, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
jmp 0x1000801c
cmp al, 2
jne 0x10007fa7
cmp dword [esp + 0xf0], 0xa
jb 0x10007fa7
cmp dword [esp + 0xf4], 0x10
mov eax, dword [esp + 0xe0]
jae 0x10007802
lea eax, [esp + 0xe0]
mov ecx, dword [eax]
mov dword [esp + 0x130], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x134], edx
mov ax, word [eax + 8]
test al, al
mov word [esp + 0x138], ax
je 0x10007d3e
cmp al, 1
je 0x10007d3e
cmp al, 2
je 0x10007c8a
cmp al, 3
je 0x10007c8a
cmp al, 4
jne 0x100078f2
push 0xffffffffffffffff
mov ecx, 0xa
lea esi, [esp + 0x118]
lea edx, [esp + 0xe0]
call fcn.1000b250
mov byte [esp + 0x4d8], 0x18
mov eax, dword [esp + 0x118]
mov edi, 0x10
cmp dword [esp + 0x12c], edi
jae 0x10007887
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100078d9
mov esi, eax
and esi, edi
jne 0x100078b7
cmp dword [esp + 0x12c], edi
mov eax, dword [esp + 0x118]
jae 0x100078b0
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test esi, esi
je 0x100078d9
sub esp, 0x1c
lea edx, [esp + 0x130]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.1000af60
call fcn.10016910
add esp, 0x1c
lea ecx, [esp + 0x114]
mov byte [esp + 0x4d8], 1
call fcn.1000af90
jmp 0x1000801c
cmp al, 5
jne 0x10007b26
mov eax, 0xf
xor edi, edi
mov dword [esp + 0x110], eax
mov dword [esp + 0x10c], edi
mov byte [esp + 0xfc], 0
mov dword [esp + 0x12c], eax
mov dword [esp + 0x128], edi
mov byte [esp + 0x118], 0
mov dword [esp + 0x154], eax
mov dword [esp + 0x150], edi
mov byte [esp + 0x140], 0
mov bl, 0x1b
push 0xffffffffffffffff
lea ecx, [eax - 6]
lea esi, [esp + 0x94]
lea edx, [esp + 0xe0]
mov byte [esp + 0x4dc], bl
call fcn.1000b250
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x104]
mov byte [esp + 0x4e4], 0x1c
call fcn.1000d5f0
mov ecx, esi
mov byte [esp + 0x4d8], bl
call fcn.1000af90
mov eax, dword [esp + 0x10c]
cmp eax, 1
jb 0x10007ae5
cmp dword [esp + 0x110], 0x10
mov ecx, dword [esp + 0xfc]
jae 0x100079b2
lea ecx, [esp + 0xfc]
movzx edi, byte [ecx]
cmp eax, edi
jb 0x10007ae5
push edi
mov ecx, 1
lea esi, [esp + 0x94]
lea edx, [esp + 0xfc]
call fcn.1000b250
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x120]
mov byte [esp + 0x4e4], 0x1d
call fcn.1000d5f0
mov ecx, esi
mov byte [esp + 0x4d8], bl
call fcn.1000af90
push 0xffffffffffffffff
lea ecx, [edi + 1]
lea esi, [esp + 0x94]
lea edx, [esp + 0xfc]
call fcn.1000b250
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x104]
mov byte [esp + 0x4e4], 0x1e
call fcn.1000d5f0
mov ecx, esi
mov byte [esp + 0x4d8], bl
call fcn.1000af90
mov ecx, dword [esp + 0x10c]
cmp ecx, 1
jb 0x10007ae5
mov eax, dword [esp + 0xfc]
mov edi, 0x10
cmp dword [esp + 0x110], edi
jae 0x10007a68
lea eax, [esp + 0xfc]
movzx eax, byte [eax]
cmp ecx, eax
jb 0x10007ae5
push eax
mov ecx, 1
lea esi, [esp + 0x94]
lea edx, [esp + 0xfc]
call fcn.1000b250
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x148]
mov byte [esp + 0x4e4], 0x1f
call fcn.1000d5f0
mov ecx, esi
mov byte [esp + 0x4d8], bl
call fcn.1000af90
cmp dword [esp + 0x154], edi
mov ecx, dword [esp + 0x140]
jae 0x10007ac6
lea ecx, [esp + 0x140]
cmp dword [esp + 0x12c], edi
mov eax, dword [esp + 0x118]
jae 0x10007add
lea eax, [esp + 0x118]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea ecx, [esp + 0x13c]
mov byte [esp + 0x4d8], 0x1a
call fcn.1000af90
lea ecx, [esp + 0x114]
mov byte [esp + 0x4d8], 0x19
call fcn.1000af90
lea ecx, [esp + 0xf8]
mov byte [esp + 0x4d8], 1
call fcn.1000af90
jmp 0x1000801c
cmp al, 6
jne 0x10007bb5
push 0xffffffffffffffff
mov ecx, 0xa
lea esi, [esp + 0x118]
lea edx, [esp + 0xe0]
call fcn.1000b250
mov eax, dword [esp + 0x118]
mov esi, 0x10
cmp dword [esp + 0x12c], esi
jae 0x10007b64
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10007ba4
test al, 0x10
jne 0x10007ba4
cmp dword [esp + 0x12c], esi
mov eax, dword [esp + 0x118]
jae 0x10007b8b
lea eax, [esp + 0x118]
push 1
push 0
push 0
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x114]
call fcn.1000af90
jmp 0x1000801c
cmp al, 7
jne 0x10007c0f
push 0xffffffffffffffff
mov ecx, 0xa
lea esi, [esp + 0x118]
lea edx, [esp + 0xe0]
call fcn.1000b250
mov eax, dword [esp + 0x130]
test eax, eax
je 0x10007bfe
cmp dword [esp + 0x12c], 0x10
mov ecx, dword [esp + 0x118]
jae 0x10007bf6
lea ecx, [esp + 0x118]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x114]
call fcn.1000af90
jmp 0x1000801c
cmp al, 8
jne 0x1000801c
push 0xffffffffffffffff
mov ecx, 0xa
lea esi, [esp + 0x15c]
lea edx, [esp + 0xe0]
call fcn.1000b250
mov eax, dword [esp + 0x15c]
mov esi, 0x10
cmp dword [esp + 0x170], esi
jae 0x10007c4d
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10007c79
cmp dword [esp + 0x170], esi
mov eax, dword [esp + 0x15c]
jae 0x10007c70
lea eax, [esp + 0x15c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [esp + 0x158]
call fcn.1000af90
jmp 0x1000801c
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0xe0]
call fcn.1000b0b0
test byte [0x1013c170], 2
jne 0x10007cbe
or dword [0x1013c170], 2
push 0xa
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [0x1013c16c], eax
mov eax, dword [0x1013c148]
mov ecx, eax
add eax, 1
cmp ecx, 0xa
mov dword [0x1013c148], eax
jge 0x10007cf3
mov edx, dword [0x1013c16c]
push 0
push 0
push edx
push 0x100081d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1c
call fcn.1001dbd3
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
mov byte [esp + 0x4d8], 0x17
je 0x10007d1e
lea ecx, [esp + 0xdc]
push ecx
mov ecx, eax
call fcn.1000af60
jmp 0x10007d20
xor eax, eax
mov edx, dword [esp + 0x38]
mov ecx, dword [0x1013c16c]
push eax
mov eax, dword [0x1013c144]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
jmp 0x1000801c
push 0xffffffffffffffff
mov ecx, 0xa
lea esi, [esp + 0xfc]
lea edx, [esp + 0xe0]
call fcn.1000b250
mov bl, 0x15
mov byte [esp + 0x4d8], bl
cmp byte [esp + 0x139], 0
jbe 0x10007f07
cmp dword [esp + 0x10c], 0
je 0x10007f07
sub esp, 0x1c
mov edx, esi
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.1000af60
lea ecx, [esp + 0xac]
call fcn.10016530
add esp, 0x1c
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0xe8]
mov byte [esp + 0x4e4], 0x16
call fcn.1000d5f0
lea ecx, [esp + 0x90]
mov byte [esp + 0x4d8], bl
call fcn.1000af90
mov eax, dword [esp + 0x10c]
mov esi, dword [esp + 0x20]
push 0x10
lea ecx, [esp + 0x28]
push ecx
add eax, 0xa
push esi
mov word [esp + 0x34], ax
mov word [esp + 0x36], 1
call fcn.10017330
add esp, 0xc
cmp eax, 0x10
jne 0x10008157
mov dl, byte [esp + 0x10c]
push 0xa
lea eax, [esp + 0x134]
push eax
push esi
mov byte [esp + 0x144], 1
mov byte [esp + 0x145], dl
call fcn.10017330
add esp, 0xc
cmp eax, 0xa
jne 0x10008157
cmp dword [esp + 0x110], 0x10
mov ecx, dword [esp + 0xfc]
jae 0x10007e46
lea ecx, [esp + 0xfc]
mov eax, dword [esp + 0x10c]
push eax
push ecx
push esi
mov edi, eax
call fcn.10017330
add esp, 0xc
cmp eax, edi
jne 0x10008157
mov ecx, dword [esp + 0xf0]
push ecx
push 0x10129bd4
lea edx, [esp + 0x3b4]
push 0x10
push edx
call fcn.100208d2
mov edi, eax
push edi
lea eax, [esp + 0x3c0]
push eax
push esi
call fcn.10017330
add esp, 0x1c
cmp eax, edi
jne 0x10008157
mov eax, dword [esp + 0xf0]
test eax, eax
je 0x10007f91
cmp dword [esp + 0xf4], 0x10
mov ecx, dword [esp + 0xe0]
jae 0x10007ec1
lea ecx, [esp + 0xe0]
push eax
push ecx
push esi
mov edi, eax
call fcn.10017330
add esp, 0xc
cmp eax, edi
jne 0x10008157
push 0
push 0x10129bd4
lea ecx, [esp + 0x3b4]
push 0x10
push ecx
call fcn.100208d2
mov edi, eax
push edi
lea edx, [esp + 0x3c0]
push edx
push esi
call fcn.10017330
add esp, 0x1c
cmp eax, edi
jmp 0x10007f8b
lea eax, [esp + 0x174]
push eax
push 0x80
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov ebx, eax
test ebx, ebx
je 0x10007f91
mov esi, dword [esp + 0x20]
push 0x10
lea edx, [esp + 0x28]
push edx
lea ecx, [ebx + 0xa]
push esi
mov word [esp + 0x34], cx
mov word [esp + 0x36], 0
call fcn.10017330
add esp, 0xc
cmp eax, 0x10
jne 0x10008157
push 0xa
lea eax, [esp + 0x134]
push eax
push esi
mov byte [esp + 0x145], bl
mov byte [esp + 0x144], 0
call fcn.10017330
add esp, 0xc
cmp eax, 0xa
jne 0x10008157
push ebx
lea ecx, [esp + 0x178]
push ecx
push esi
call fcn.10017330
add esp, 0xc
cmp eax, ebx
jne 0x10008157
lea ecx, [esp + 0xf8]
mov byte [esp + 0x4d8], 1
call fcn.1000af90
jmp 0x1000801c
push str.has_no_opcode
lea ecx, [esp + 0xe0]
call fcn.1000d6d0
mov dx, word [esp + 0xf0]
mov edi, dword [esp + 0x20]
push 0x10
lea eax, [esp + 0x28]
push eax
push edi
mov word [esp + 0x34], dx
mov word [esp + 0x36], 0
call fcn.10017330
add esp, 0xc
cmp eax, 0x10
jne 0x1000816b
cmp dword [esp + 0xf4], eax
mov ecx, dword [esp + 0xe0]
jae 0x10008000
lea ecx, [esp + 0xe0]
mov eax, dword [esp + 0xf0]
push eax
push ecx
push edi
mov esi, eax
call fcn.10017330
add esp, 0xc
cmp eax, esi
jne 0x1000816b
mov dword [esp + 0x4d8], 0xffffffff
cmp dword [esp + 0xf4], 0x10
jb 0x10006862
mov ecx, dword [esp + 0xe0]
push ecx
call fcn.1001d705
add esp, 4
jmp 0x10006862
mov dword [esp + 0x4d8], 0xffffffff
cmp dword [esp + 0xf4], 0x10
jb 0x10008182
mov edx, dword [esp + 0xe0]
push edx
call fcn.1001d705
add esp, 4
jmp 0x10008182
mov esi, 0x10
mov byte [esp + 0x4d8], 1
cmp dword [esp + 0x110], esi
jb 0x1000809e
mov eax, dword [esp + 0xfc]
push eax
call fcn.1001d705
add esp, 4
mov dword [esp + 0x4d8], 0xffffffff
cmp dword [esp + 0xf4], esi
mov dword [esp + 0x110], 0xf
mov dword [esp + 0x10c], 0
mov byte [esp + 0xfc], 0
jb 0x10008182
mov ecx, dword [esp + 0xe0]
push ecx
call fcn.1001d705
add esp, 4
jmp 0x10008182
mov esi, 0x10
mov byte [esp + 0x4d8], 1
cmp dword [esp + 0x110], esi
jb 0x1000810f
mov edx, dword [esp + 0xfc]
push edx
call fcn.1001d705
add esp, 4
xor eax, eax
mov dword [esp + 0x4d8], 0xffffffff
cmp dword [esp + 0xf4], esi
mov dword [esp + 0x110], 0xf
mov dword [esp + 0x10c], eax
mov byte [esp + 0xfc], al
jb 0x10008182
mov eax, dword [esp + 0xe0]
push eax
call fcn.1001d705
add esp, 4
jmp 0x10008182
push 0
call fcn.1001d688
lea ecx, [esp + 0xf8]
mov byte [esp + 0x4d8], 1
call fcn.1000af90
lea ecx, [esp + 0xdc]
mov dword [esp + 0x4d8], 0xffffffff
call fcn.1000af90
mov ecx, dword [esp + 0x4d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4b8]
xor ecx, esp
call fcn.1001d3e9
mov esp, ebp
pop ebp
ret