Function at 0x1003a620
Capabilities:
Contain obfuscated stackstrings
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008abdc
mov eax, dword fs:[0]
push eax
sub esp, 0x5f8
mov eax, dword [0x100bb758]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0x2a
push esi
mov dword [ebp - 0x5ec], edi
mov dword [ebp - 0x5c4], esi
call fcn.10060f2c
add esp, 8
test eax, eax
je 0x1003a677
add eax, 2
mov dword [ebp - 0x5c4], eax
call fcn.10006430
mov ecx, eax
test ecx, ecx
je 0x1003bd5c
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x5cc], eax
push str.ExpRunTrayIconDll
lea ecx, [ebp - 0x5cc]
mov dword [ebp - 4], 0
call fcn.100069b0
test al, al
jne 0x1003a6c3
push 0x11
push str.ExpRunTrayIconDll
lea ecx, [ebp - 0x5cc]
call fcn.10006650
mov dword [ebp - 4], 1
mov dword [ebp - method.LdsCommon::CMyLdsLogger.virtual_0], vtable.LdsCommon::CMyLdsLogger.0
call fcn.10006430
mov ecx, eax
test ecx, ecx
je 0x1003bd66
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x600], eax
mov byte [ebp - 4], 2
call fcn.10006430
mov ecx, eax
test ecx, ecx
je 0x1003bd70
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x5fc], eax
mov byte [ebp - 4], 3
call fcn.10006430
mov ecx, eax
test ecx, ecx
je 0x1003bd7a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x5f8], eax
mov byte [ebp - 4], 4
call fcn.10006430
mov ecx, eax
test ecx, ecx
je 0x1003bd84
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x5f4], eax
lea eax, [ebp - 0x5cc]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x600]
call fcn.100068a0
lea ecx, [ebp - 0x5f8]
call fcn.10010690
push 3
push 0x10095e7c
lea ecx, [ebp - 0x5fc]
call fcn.10006650
mov edx, dword [ebp - 0x5cc]
or eax, 0xffffffff
mov byte [ebp - 4], 7
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003a7b1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100609f0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x100bd974]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call fcn.10006430
mov ecx, eax
test ecx, ecx
je 0x1003bd8e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x5e4], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x5e4]
call fcn.100069b0
test al, al
jne 0x1003a852
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003a830
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x5e4]
call fcn.10006650
mov byte [ebp - 4], 9
call fcn.10006430
mov ecx, eax
test ecx, ecx
je 0x1003bd98
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x5dc], eax
push 0x10096080
lea ecx, [ebp - 0x5dc]
mov byte [ebp - 4], 0xa
call fcn.100069b0
test al, al
jne 0x1003a89f
push 1
push 0x10096080
lea ecx, [ebp - 0x5dc]
call fcn.10006650
mov byte [ebp - 4], 0xb
call fcn.10006430
mov ecx, eax
test ecx, ecx
je 0x1003bda2
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x5e0], eax
push 0x10096084
lea eax, [ebp - 0x5e4]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x5f0]
push eax
call fcn.10009190
lea eax, [ebp - 0x5c0]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x450]
mov dword [ebp - 0x5c0], 0
push eax
mov dword [ebp - 0x450], 0x360033
mov dword [ebp - 0x44c], 0x740030
mov dword [ebp - 0x448], 0x610072
mov dword [ebp - 0x444], 0x2e0079
mov dword [ebp - 0x440], 0x780065
mov dword [ebp - 0x43c], 0x65
call fcn.100271e0
mov esi, eax
mov dword [ebp - 0x5c0], 0
lea eax, [ebp - 0x5c0]
mov dword [ebp - 0x434], 0x360033
push eax
lea eax, [ebp - 0x434]
mov dword [ebp - 0x430], 0x730030
push eax
mov dword [ebp - 0x42c], 0x2e0064
mov dword [ebp - 0x428], 0x780065
mov dword [ebp - 0x424], 0x65
call fcn.100271e0
add esp, 0x1c
test esi, esi
jne 0x1003a99b
test eax, eax
je 0x1003ab5e
mov ecx, dword [edi + 0x38]
test ecx, ecx
je 0x1003ab5e
call fcn.10039610
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.1006ed8d
add esp, 4
call fcn.1006ed6c
cdq
mov ecx, 0x64
idiv ecx
cmp edx, esi
jl 0x1003ab5e
cmp dword [edi + 0x38], 0
je 0x1003aada
call fcn.10054f50
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1003aada
mov ecx, dword [edi + 0x38]
call fcn.1001e2b0
push 4
push str.FILE
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
call fcn.1000afb0
push 3
push 0x1008ea34
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1000afb0
mov byte [ebp - 4], 0x15
call fcn.10054f50
mov edi, eax
lea ecx, [ebp - 0x550]
push 0xe4
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.100083a0
mov esi, eax
push str.taskid:_d_no_rand_trayicon
push esi
mov byte [ebp - 4], 0x16
call fcn.10007c20
add esp, 8
mov ecx, esi
push dword [ebp - 0x5c0]
call fcn.1000efa0
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x550]
call fcn.10009260
lea ecx, [ebp - 0x450]
call fcn.10005f50
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0xd
call fcn.10005f50
lea eax, [ebp - 0x5c0]
push 1
push eax
call fcn.10051200
push str.home
push eax
mov byte [ebp - 4], 0x17
call fcn.1003a440
mov edx, dword [ebp - 0x5c0]
or esi, 0xffffffff
add esp, 0x10
mov byte [ebp - 0x5d1], al
mov byte [ebp - 4], 0xd
add edx, 0xfffffff0
mov ecx, esi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x1003ab2a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp - 0x5d1]
test al, al
lea eax, [ebp - 0x218]
je 0x1003ab3b
push str.Tool.exe
jmp 0x1003ab40
push str.HpNotify.exe
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 7
push str._hdnone
lea ecx, [ebp - 0x5dc]
call fcn.1000f610
jmp 0x1003ae13
lea eax, [ebp - 0x5cc]
push 1
push eax
call fcn.10050740
lea eax, [ebp - 0x5d8]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x5e0]
mov dword [ebp - 0x5d8], 0
push eax
lea eax, [ebp - 0x5e4]
push eax
push str.rd_notify
push dword [ebp - 0x5cc]
call fcn.100098f0
add esp, 0x1c
cmp dword [edi + 0x38], 0
je 0x1003ad06
call fcn.10006430
mov ecx, eax
test ecx, ecx
je 0x1003bdac
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x5c0], eax
push dword [ebp - 0x5e0]
mov ecx, dword [edi + 0x38]
mov byte [ebp - 4], 0xf
call fcn.1001e2b0
push eax
lea eax, [ebp - 0x5c0]
push str.taskid:_d_strRundllTmpFileLink:_s
push eax
call fcn.10006340
add esp, 0x10
call fcn.10054f50
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov esi, dword [ebp - 0x5c0]
movzx eax, al
sub eax, 1
jne 0x1003ace6
push 4
push str.FILE
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
call fcn.1000afb0
push 3
push 0x1008ea34
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1000afb0
mov byte [ebp - 4], 0x11
call fcn.10054f50
mov dword [ebp - 0x5d0], eax
lea ecx, [ebp - 0x550]
push 0xb5
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.100083a0
mov edi, eax
test esi, esi
mov byte [ebp - 4], 0x12
mov ecx, 0x1008e984
cmovne ecx, esi
push ecx
push edi
call fcn.10007c20
mov ecx, dword [ebp - 0x5d0]
add esp, 8
mov eax, dword [ecx]
push edi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x550]
call fcn.10009260
lea ecx, [ebp - 0x450]
call fcn.10005f50
lea ecx, [ebp - 0x438]
call fcn.10005f50
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0xe
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003ad09
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1003ad09
or esi, 0xffffffff
lea eax, [ebp - 0x5c0]
push 1
push eax
call fcn.10051200
push str.home
push eax
mov byte [ebp - 4], 0x13
call fcn.1003a440
mov edx, dword [ebp - 0x5c0]
add esp, 0x10
mov byte [ebp - 0x5d1], al
add edx, 0xfffffff0
mov byte [ebp - 4], 0xe
mov ecx, esi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x1003ad56
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp - 0x5d1]
test al, al
lea eax, [ebp - 0x218]
je 0x1003ad67
push str.Tool.exe
jmp 0x1003ad6c
push str.HpNotify.exe
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push dword [ebp - 0x5e0]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1003add5
mov edi, dword [ebp - 0x5e0]
lea ecx, [ebp - 0x218]
mov eax, ecx
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1003adbf
movzx eax, word [ecx + edi]
test ax, ax
je 0x1003adbf
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1003ada1
test edx, edx
lea eax, [ecx - 2]
push 5
cmovne eax, ecx
xor ecx, ecx
push str._hdok
mov word [eax], cx
jmp 0x1003ade7
lea ecx, [ebp - 0x5e0]
call fcn.10010690
push 7
push str._hdfail
lea ecx, [ebp - 0x5dc]
call fcn.1000f610
mov edx, dword [ebp - 0x5cc]
mov eax, esi
mov byte [ebp - 4], 0xd
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003ae13
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x218]
push eax
call fcn.100400f0
add esp, 4
test eax, eax
jne 0x1003ae48
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x604]
push str.fail_check_sign_s
push eax
call fcn.1003a610
add esp, 0xc
xor edi, edi
jmp 0x1003bca6
call fcn.10006430
mov ecx, eax
test ecx, ecx
je 0x1003bdb6
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x5d8], eax
push dword [ebp - 0x5c4]
lea eax, [ebp - 0x5d8]
mov byte [ebp - 4], 0x18
push str.RunTrayIcon
push dword [ebp - 0x5f0]
push str.__dll__s____entry_s__s
push eax
call fcn.10006340
lea eax, [ebp - 0x5c0]
push 1
push eax
call fcn.10051200
add esp, 0x1c
mov ecx, 0x10094808
mov eax, dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1003aecb
test dx, dx
je 0x1003aec7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1003aecb
add eax, 4
add ecx, 4
test dx, dx
jne 0x1003aea5
xor edi, edi
jmp 0x1003aed0
sbb edi, edi
or edi, 1
mov edx, dword [ebp - 0x5c0]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003aeed
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x1003af8e
lea ecx, [ebp - 0x4b8]
call fcn.1002c250
mov eax, dword [ebp - 0x5d8]
push str.cmd_line
mov byte [ebp - 4], 0x19
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
lea ecx, [ebp - 0x4b8]
call fcn.1002c7c0
push 0
lea ecx, [ebp - 0x4b8]
call fcn.1003ce40
push eax
lea ecx, [ebp - 0x5bc]
call fcn.1000dfb0
push dword [ebp - 0x5bc]
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0x5d8]
push str.__s____param_s
push eax
call fcn.10006340
mov eax, dword [ebp - 0x5bc]
lea ecx, [ebp - 0x5b8]
add esp, 0x10
cmp eax, ecx
je 0x1003af7d
push eax
call fcn.1006724e
add esp, 4
lea ecx, [ebp - 0x4b8]
mov byte [ebp - 4], 0x18
call fcn.1002c3e0
jmp 0x1003afe2
mov eax, dword [ebp - 0x5d8]
add eax, 0xfffffff0
push eax
call fcn.100060f0
lea esi, [eax + 0x10]
mov dword [ebp - 0x5c8], esi
push esi
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0x1b
push eax
lea eax, [ebp - 0x5d8]
push str.__s___s
push eax
call fcn.10006340
add esp, 0x14
mov byte [ebp - 4], 0x18
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1003afe2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x5ec]
mov dword [ebp - 0x5c0], 0
mov ecx, dword [ecx + 0x38]
call fcn.1001e2b0
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x5cc]
push eax
call fcn.10022790
mov ecx, eax
call fcn.1001eb00
mov esi, dword [ebp - 0x5d8]
cmp dword [esi - 4], 1
jle 0x1003b033
push dword [esi - 0xc]
lea ecx, [ebp - 0x5d8]
call fcn.100062c0
mov esi, dword [ebp - 0x5d8]
xorps xmm0, xmm0
mov dword [ebp - 0x494], 0x44
xor eax, eax
movlpd qword [ebp - 0x490], xmm0
mov word [ebp - 0x452], ax
xor edi, edi
mov eax, 1
mov dword [ebp - 0x5d0], edi
movlpd qword [ebp - 0x488], xmm0
movlpd qword [ebp - 0x480], xmm0
movlpd qword [ebp - 0x478], xmm0
movlpd qword [ebp - 0x470], xmm0
movlpd qword [ebp - 0x462], xmm0
movlpd qword [ebp - 0x45a], xmm0
movups xmmword [ebp - 0x430], xmm0
mov dword [ebp - 0x468], 0x81
mov word [ebp - 0x464], ax
call fcn.10010930
mov dword [ebp - 0x5cc], eax
test eax, eax
je 0x1003b13b
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x1003b0d7
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x1003b12f
push str.CreateProcessWithTokenW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1003b12f
lea ecx, [ebp - 0x430]
push ecx
lea ecx, [ebp - 0x494]
push ecx
push 0
push 0
push 0
push esi
push 0
push 0
push dword [ebp - 0x5cc]
call eax
test eax, eax
je 0x1003b12f
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x430]
mov edi, 1
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5d0], edi
push dword [ebp - 0x5cc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi - 8]
push esi
call fcn.10066e82
add esp, 8
test eax, eax
js 0x1003bd52
cmp eax, dword [esi - 8]
jg 0x1003bd52
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
test edi, edi
je 0x1003b1a3
cmp dword [ebp - 0x5c0], ecx
je 0x1003b729
mov eax, dword [ebp - 0x5ec]
mov ecx, dword [eax + 0x38]
call fcn.1001e2b0
push dword [ebp - 0x5c0]
mov dword [ebp - 0x5c4], eax
lea eax, [ebp - 0x5c4]
push eax
call fcn.10022790
mov ecx, eax
call fcn.1001ed00
jmp 0x1003b729
call fcn.10006430
mov ecx, eax
test ecx, ecx
je 0x1003bdc0
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x5cc], eax
push dword [ebp - 0x5c4]
lea eax, [ebp - 0x5cc]
mov byte [ebp - 4], 0x1c
push str.RunTrayIcon
push dword [ebp - 0x5f0]
push str.__dll__s____entry_s__s
push eax
call fcn.10006340
lea eax, [ebp - 0x5c0]
push 1
push eax
call fcn.10051200
add esp, 0x1c
mov edi, eax
mov ecx, dword [edi]
mov byte [ebp - 4], 0x1d
mov ecx, dword [ecx - 0x10]
test ecx, ecx
je 0x1003b215
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x1003b22d
call fcn.10006430
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x1003bdca
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x5c4], eax
push str.home
lea ecx, [ebp - 0x5c4]
mov byte [ebp - 4], 0x1e
call fcn.100069b0
test al, al
jne 0x1003b265
push str.home
lea ecx, [ebp - 0x5c4]
call fcn.1003a3b0
mov eax, dword [ebp - 0x5c4]
mov byte [ebp - 4], 0x1d
test eax, eax
je 0x1003bdd4
mov ecx, dword [edi]
mov edx, eax
nop dword [eax + eax]
mov di, word [ecx]
cmp di, word [edx]
jne 0x1003b2ae
test di, di
je 0x1003b2a2
mov di, word [ecx + 2]
cmp di, word [edx + 2]
jne 0x1003b2ae
add ecx, 4
add edx, 4
test di, di
jne 0x1003b280
mov dword [ebp - 0x5c4], 0
jmp 0x1003b2b9
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x5c4], ecx
or edi, 0xffffffff
lea edx, [eax - 0x10]
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003b2d3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5c0]
mov eax, edi
mov byte [ebp - 4], 0x1c
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003b2f4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x5c4], 0
je 0x1003b391
lea ecx, [ebp - 0x520]
call fcn.1002c250
mov eax, dword [ebp - 0x5cc]
push str.cmd_line
mov byte [ebp - 4], 0x1f
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
lea ecx, [ebp - 0x520]
call fcn.1002c7c0
push 0
lea ecx, [ebp - 0x520]
call fcn.1003ce40
push eax
lea ecx, [ebp - 0x31c]
call fcn.1000dfb0
push dword [ebp - 0x31c]
lea eax, [ebp - 0x5cc]
mov byte [ebp - 4], 0x20
push str.__param_s
push eax
call fcn.10006340
mov eax, dword [ebp - 0x31c]
lea ecx, [ebp - 0x318]
add esp, 0xc
cmp eax, ecx
je 0x1003b382
push eax
call fcn.1006724e
add esp, 4
lea ecx, [ebp - 0x520]
mov byte [ebp - 4], 0x1c
call fcn.1002c3e0
call fcn.10006430
mov ecx, eax
test ecx, ecx
je 0x1003bdde
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x5c0], eax
mov edi, dword [ebp - 0x5cc]
push edi
mov byte [ebp - 4], 0x21
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x5c0]
push str.LastError:_d__cmd_s
push eax
call fcn.10006340
add esp, 0x10
call fcn.10054f50
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1003b4d2
push 4
push str.FILE
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], al
call fcn.1000afb0
push 3
push 0x1008ea34
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1000afb0
mov byte [ebp - 4], 0x23
call fcn.10054f50
mov dword [ebp - 0x5c4], eax
lea ecx, [ebp - 0x550]
push 0x15b
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.100083a0
mov dword [ebp - 0x5d0], eax
mov ecx, dword [ebp - 0x5c0]
mov edx, 0x1008e984
test ecx, ecx
mov byte [ebp - 4], 0x24
cmovne edx, ecx
push edx
push eax
call fcn.10007c20
mov ecx, dword [ebp - 0x5c4]
add esp, 8
mov eax, dword [ecx]
push dword [ebp - 0x5d0]
call dword [eax + 0x1c]
lea ecx, [ebp - 0x550]
call fcn.10009260
lea ecx, [ebp - 0x450]
call fcn.10005f50
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x21
call fcn.10005f50
xorps xmm0, xmm0
mov dword [ebp - 0x474], 0
lea eax, [ebp - 0x218]
movlpd qword [ebp - 0x46c], xmm0
push 0
movlpd qword [ebp - 0x464], xmm0
movlpd qword [ebp - 0x45c], xmm0
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x48c], 0x3c
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x488], 0x1140
mov dword [ebp - 0x478], edi
mov dword [ebp - 0x470], 5
mov dword [ebp - 0x480], 0x10094e68
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x48c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
mov dword [ebp - 0x5d0], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push eax
mov dword [ebp - 0x5c8], eax
lea eax, [ebp - 0x5c0]
push str.ShellExecuteEx_api__errcode_lu__hRet_d
push eax
call fcn.10006340
add esp, 0x10
call fcn.10054f50
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov edi, dword [ebp - 0x5c0]
movzx eax, al
sub eax, 1
jne 0x1003b685
push 4
push str.FILE
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
call fcn.1000afb0
push 3
push 0x1008ea34
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1000afb0
mov byte [ebp - 4], 0x26
call fcn.10054f50
mov dword [ebp - 0x5c4], eax
lea ecx, [ebp - 0x550]
push 0x170
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.100083a0
mov dword [ebp - 0x5e8], eax
test edi, edi
mov byte [ebp - 4], 0x27
mov ecx, 0x1008e984
cmovne ecx, edi
push ecx
push eax
call fcn.10007c20
mov ecx, dword [ebp - 0x5c4]
add esp, 8
mov eax, dword [ecx]
push dword [ebp - 0x5e8]
call dword [eax + 0x1c]
lea ecx, [ebp - 0x550]
call fcn.10009260
lea ecx, [ebp - 0x450]
call fcn.10005f50
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x21
call fcn.10005f50
push dword [ebp - 0x5d0]
lea eax, [ebp - 0x604]
push dword [ebp - 0x5c8]
push str.ShellExecuteEx_api__errcode_lu__hRet_d
push eax
call fcn.1003a610
add esp, 0x10
cmp dword [ebp - 0x5d0], 0
je 0x1003b6e4
cmp dword [ebp - 0x454], 0
je 0x1003b6e4
mov eax, dword [ebp - 0x5ec]
mov ecx, dword [eax + 0x38]
call fcn.1001e2b0
push dword [ebp - 0x454]
mov dword [ebp - 0x5c8], eax
lea eax, [ebp - 0x5c8]
push eax
call fcn.10022790
mov ecx, eax
call fcn.1001ed00
lea edx, [edi - 0x10]
mov byte [ebp - 4], 0x1c
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003b702
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5cc]
mov eax, edi
mov byte [ebp - 4], 0x18
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003b723
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x5d0]
test edi, edi
jne 0x1003ba7c
push 0x208
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.100609f0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x420]
push eax
call edi
lea eax, [ebp - 0x420]
push eax
call edi
lea eax, [ebp - 0x480]
mov dword [ebp - 0x480], 0x720070
push eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x47c], 0x76006f
push eax
mov dword [ebp - 0x478], 0x640069
mov dword [ebp - 0x474], 0x720065
mov dword [ebp - 0x470], 0x77005c
mov dword [ebp - 0x46c], 0x700070
mov dword [ebp - 0x468], 0x6f0072
mov dword [ebp - 0x464], 0x690076
mov dword [ebp - 0x460], 0x650064
mov dword [ebp - 0x45c], 0x2e0072
mov dword [ebp - 0x458], 0x6c0064
mov dword [ebp - 0x454], 0x6c
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.10006430
mov ecx, eax
test ecx, ecx
je 0x1003bde8
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x5c4], eax
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 0x28
push eax
lea eax, [ebp - 0x5c4]
push str.CallServiceEx_szPath_s
push eax
call fcn.10006340
add esp, 0xc
call fcn.10054f50
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov edi, dword [ebp - 0x5c4]
movzx eax, al
sub eax, 1
jne 0x1003b940
push 4
push str.FILE
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
call fcn.1000afb0
push 3
push 0x1008ea34
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1000afb0
mov byte [ebp - 4], 0x2a
call fcn.10054f50
mov dword [ebp - 0x5c8], eax
lea ecx, [ebp - 0x550]
push 0x1c5
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.100083a0
mov dword [ebp - 0x5e8], eax
test edi, edi
mov byte [ebp - 4], 0x2b
mov ecx, 0x1008e984
cmovne ecx, edi
push ecx
push eax
call fcn.10007c20
mov ecx, dword [ebp - 0x5c8]
add esp, 8
mov eax, dword [ecx]
push dword [ebp - 0x5e8]
call dword [eax + 0x1c]
lea ecx, [ebp - 0x550]
call fcn.10009260
lea ecx, [ebp - 0x450]
call fcn.10005f50
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x28
call fcn.10005f50
lea eax, [ebp - 0x420]
push eax
call fcn.100400f0
add esp, 4
test eax, eax
jne 0x1003b976
mov byte [ebp - 4], 0x18
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1003b96f
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
xor edi, edi
jmp 0x1003bc88
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x5e8], eax
mov dword [ebp - 0x5c0], 0
test eax, eax
jne 0x1003b9a1
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1003b9ed
push str.CLSE
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x5c8], eax
test eax, eax
jne 0x1003b9c4
push 0x490
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1003b9ed
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
lea eax, [ebp - 0x5c0]
push eax
push str.processid
push esi
lea eax, [ebp - 0x218]
push eax
push str.createprocess
call dword [ebp - 0x5c8]
mov eax, dword [ebp - 0x5c0]
xor ecx, ecx
push eax
push dword [ebp - 0x5e8]
test eax, eax
lea eax, [ebp - 0x604]
push str.CallServiceEx__p__u
setne cl
push eax
mov dword [ebp - 0x5d0], ecx
call fcn.1003a610
add esp, 0x10
cmp dword [ebp - 0x5d0], 0
je 0x1003ba5a
cmp dword [ebp - 0x5c0], 0
je 0x1003ba5a
mov eax, dword [ebp - 0x5ec]
mov ecx, dword [eax + 0x38]
call fcn.1001e2b0
push dword [ebp - 0x5c0]
mov dword [ebp - 0x5c8], eax
lea eax, [ebp - 0x5c8]
push eax
call fcn.10022790
mov ecx, eax
call fcn.1001ed30
mov byte [ebp - 4], 0x18
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1003ba76
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x5d0]
mov eax, str._exfail
test edi, edi
mov edx, str._exok
cmove edx, eax
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x5c8], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003ba96
sub ecx, dword [ebp - 0x5c8]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x5dc]
call fcn.1000f610
mov ecx, dword [0x100bd968]
test ecx, ecx
jne 0x1003bb20
push 0x100b1078
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x100bd968], 0
jne 0x1003bb07
push 0x1c
call fcn.10055e2d
add esp, 4
mov dword [ebp - 0x5c8], eax
test eax, eax
je 0x1003bb00
lea ecx, [eax + 4]
mov dword [eax], vtable._BaseModule::CCriticalSection.0
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp - 0x5c8]
jmp 0x1003bb02
xor eax, eax
mov dword [0x100bd968], eax
push 0x100b1078
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x100bd968]
test ecx, ecx
jne 0x1003bb20
xor edx, edx
jmp 0x1003bb7e
mov edx, dword [0x100bd964]
test edx, edx
jne 0x1003bb7e
mov eax, dword [ecx]
push ecx
call dword [eax]
cmp dword [0x100bd964], 0
jne 0x1003bb6d
push 0x1c
call fcn.10055e2d
add esp, 4
mov dword [ebp - 0x5c8], eax
mov byte [ebp - 4], 0x2c
test eax, eax
je 0x1003bb5b
mov ecx, eax
call fcn.10006c30
mov ecx, eax
jmp 0x1003bb5d
xor ecx, ecx
mov byte [ebp - 4], 0x18
xchg dword [ebp - 0x5c8], eax
mov dword [0x100bd964], ecx
mov eax, dword [0x100bd968]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [0x100bd964]
mov eax, dword [edx]
push 1
push 0
push dword [ebp - 0x5dc]
push 0x1008edf8
push edx
call dword [eax]
call fcn.10054f50
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1003bc88
push 4
push str.FILE
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], al
call fcn.1000afb0
push 3
push 0x1008ea34
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1000afb0
mov byte [ebp - 4], 0x2e
call fcn.10054f50
mov dword [ebp - 0x5c8], eax
lea ecx, [ebp - 0x550]
push 0x1e0
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.100083a0
mov edi, eax
push str.Start_by_rundll._bSuccess
push edi
mov byte [ebp - 4], 0x2f
call fcn.10007c20
add esp, 8
mov ecx, edi
push dword [ebp - 0x5d0]
call fcn.1000efa0
mov ecx, dword [ebp - 0x5c8]
push edi
mov eax, dword [ecx]
call dword [eax + 0x1c]
lea ecx, [ebp - 0x550]
call fcn.10009260
lea ecx, [ebp - 0x450]
call fcn.10005f50
lea ecx, [ebp - 0x438]
call fcn.10005f50
mov edi, dword [ebp - 0x5d0]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0xd
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003bca6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5f0]
mov eax, esi
mov byte [ebp - 4], 0xc
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003bcc7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5e0]
mov eax, esi
mov byte [ebp - 4], 0xb
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003bce8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5dc]
mov eax, esi
mov byte [ebp - 4], 9
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003bd09
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x5e4]
mov byte [ebp - 4], 7
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x1003bd28
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x604]
call fcn.1003a300
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100561dc
mov esp, ebp
pop ebp
ret 8
push 0x80070057
call fcn.100060c0
push 0x80004005
call fcn.100060c0
push 0x80004005
call fcn.100060c0
push 0x80004005
call fcn.100060c0
push 0x80004005
call fcn.100060c0
push 0x80004005
call fcn.100060c0
push 0x80004005
call fcn.100060c0
push 0x80004005
call fcn.100060c0
push 0x80004005
call fcn.100060c0
push 0x80004005
call fcn.100060c0
push 0x80004005
call fcn.100060c0
push 0x80004005
call fcn.100060c0
push 0x80004005
call fcn.100060c0
push 0x80004005
call fcn.100060c0
push 0x80004005
call fcn.100060c0
push 0x80004005
call fcn.100060c0
int3