Function at 0x1003c6c0
Capabilities:
Contain obfuscated stackstrings
Copy file
Create process on windows
Encode data using base64 via winapi
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100aa120
mov eax, dword fs:[0]
push eax
sub esp, 0x594
mov eax, dword [0x100d5688]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0x2a
push esi
mov dword [ebp - 0x588], edi
mov dword [ebp - 0x578], esi
call fcn.1007f76e
add esp, 8
test eax, eax
je 0x1003c717
add eax, 2
mov dword [ebp - 0x578], eax
call fcn.100079d0
mov ecx, eax
test ecx, ecx
je 0x1003dc3e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x568], eax
push str.ExpRunTrayIconDll
lea ecx, [ebp - 0x568]
mov dword [ebp - 4], 0
call fcn.10007f50
test al, al
jne 0x1003c763
push 0x11
push str.ExpRunTrayIconDll
lea ecx, [ebp - 0x568]
call fcn.10007bf0
mov dword [ebp - 4], 1
mov dword [ebp - method.LdsCommon::CMyLdsLogger.virtual_0], vtable.LdsCommon::CMyLdsLogger.0
call fcn.100079d0
mov ecx, eax
test ecx, ecx
je 0x1003dc48
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x59c], eax
mov byte [ebp - 4], 2
call fcn.100079d0
mov ecx, eax
test ecx, ecx
je 0x1003dc52
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x598], eax
mov byte [ebp - 4], 3
call fcn.100079d0
mov ecx, eax
test ecx, ecx
je 0x1003dc5c
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x594], eax
mov byte [ebp - 4], 4
call fcn.100079d0
mov ecx, eax
test ecx, ecx
je 0x1003dc66
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x590], eax
lea eax, [ebp - 0x568]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x59c]
call fcn.10007e40
lea ecx, [ebp - 0x594]
call fcn.10012170
push 3
push 0x100b472c
lea ecx, [ebp - 0x598]
call fcn.10007bf0
mov edx, dword [ebp - 0x568]
or eax, 0xffffffff
mov byte [ebp - 4], 7
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003c851
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.1007f220
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push dword [0x100d8aa0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call fcn.100079d0
mov ecx, eax
test ecx, ecx
je 0x1003dc70
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x584], eax
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x584]
call fcn.10007f50
test al, al
jne 0x1003c8f2
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003c8d0
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x584]
call fcn.10007bf0
mov byte [ebp - 4], 9
call fcn.100079d0
mov ecx, eax
test ecx, ecx
je 0x1003dc7a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x568], eax
push 0x100b4930
lea ecx, [ebp - 0x568]
mov byte [ebp - 4], 0xa
call fcn.10007f50
test al, al
jne 0x1003c93f
push 1
push 0x100b4930
lea ecx, [ebp - 0x568]
call fcn.10007bf0
mov byte [ebp - 4], 0xb
call fcn.100079d0
mov ecx, eax
test ecx, ecx
je 0x1003dc84
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x580], eax
push 0x100b4934
lea eax, [ebp - 0x584]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x58c]
push eax
call fcn.1000a860
lea eax, [ebp - 0x558]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x450]
mov dword [ebp - 0x558], 0
push eax
mov dword [ebp - 0x450], 0x360033
mov dword [ebp - 0x44c], 0x740030
mov dword [ebp - 0x448], 0x610072
mov dword [ebp - 0x444], 0x2e0079
mov dword [ebp - 0x440], 0x780065
mov dword [ebp - 0x43c], 0x65
call fcn.100298c0
mov esi, eax
mov dword [ebp - 0x558], 0
lea eax, [ebp - 0x558]
mov dword [ebp - 0x434], 0x360033
push eax
lea eax, [ebp - 0x434]
mov dword [ebp - 0x430], 0x730030
push eax
mov dword [ebp - 0x42c], 0x2e0064
mov dword [ebp - 0x428], 0x780065
mov dword [ebp - 0x424], 0x65
call fcn.100298c0
add esp, 0x1c
test esi, esi
jne 0x1003ca3b
test eax, eax
je 0x1003cba6
mov ecx, dword [edi + 0x38]
test ecx, ecx
je 0x1003cba6
call fcn.1003b1e0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.1008dacd
add esp, 4
call fcn.1008daac
cdq
mov ecx, 0x64
idiv ecx
cmp edx, esi
jl 0x1003cba6
cmp dword [edi + 0x38], 0
je 0x1003cb7a
call fcn.1005dde0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1003cb7a
mov ecx, dword [edi + 0x38]
call fcn.10020b10
push 4
push str.FILE
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x56c], eax
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
call fcn.1000c680
push 3
push 0x100aea94
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1000c680
mov byte [ebp - 4], 0x14
call fcn.1005dde0
mov edi, eax
lea ecx, [ebp - 0xa8]
push 0xf6
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.10009a70
mov esi, eax
push str.taskid:_d_no_rand_trayicon
push esi
mov byte [ebp - 4], 0x15
call fcn.100092f0
add esp, 8
mov ecx, esi
push dword [ebp - 0x56c]
call fcn.10010b10
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0xa8]
call fcn.1000a930
lea ecx, [ebp - 0x450]
call fcn.100074f0
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0xd
call fcn.100074f0
push str.ClsTool.exe
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 7
push str._hdnone
lea ecx, [ebp - 0x568]
call fcn.10011100
or esi, 0xffffffff
jmp 0x1003ce03
lea eax, [ebp - 0x574]
push 1
push eax
call fcn.100595a0
lea eax, [ebp - 0x56c]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x580]
mov dword [ebp - 0x56c], 0
push eax
lea eax, [ebp - 0x584]
push eax
push str.rd_notify
push dword [ebp - 0x574]
call fcn.1000afc0
add esp, 0x1c
cmp dword [edi + 0x38], 0
je 0x1003cd4e
call fcn.100079d0
mov ecx, eax
test ecx, ecx
je 0x1003dc8e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x558], eax
push dword [ebp - 0x580]
mov ecx, dword [edi + 0x38]
mov byte [ebp - 4], 0xf
call fcn.10020b10
push eax
lea eax, [ebp - 0x558]
push str.taskid:_d_strRundllTmpFileLink:_s
push eax
call fcn.100078e0
add esp, 0x10
call fcn.1005dde0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov esi, dword [ebp - 0x558]
movzx eax, al
sub eax, 1
jne 0x1003cd2e
push 4
push str.FILE
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
call fcn.1000c680
push 3
push 0x100aea94
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1000c680
mov byte [ebp - 4], 0x11
call fcn.1005dde0
mov dword [ebp - 0x55c], eax
lea ecx, [ebp - 0xa8]
push 0xbd
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.10009a70
mov edi, eax
test esi, esi
mov byte [ebp - 4], 0x12
mov ecx, 0x100ae9e4
cmovne ecx, esi
push ecx
push edi
call fcn.100092f0
mov ecx, dword [ebp - 0x55c]
add esp, 8
mov eax, dword [ecx]
push edi
call dword [eax + 0x1c]
lea ecx, [ebp - 0xa8]
call fcn.1000a930
lea ecx, [ebp - 0x450]
call fcn.100074f0
lea ecx, [ebp - 0x438]
call fcn.100074f0
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0xe
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003cd51
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1003cd51
or esi, 0xffffffff
push str.ClsTool.exe
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push dword [ebp - 0x580]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1003cdc5
mov edi, dword [ebp - 0x580]
lea ecx, [ebp - 0x420]
mov eax, ecx
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1003cdaf
movzx eax, word [ecx + edi]
test ax, ax
je 0x1003cdaf
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1003cd91
test edx, edx
lea eax, [ecx - 2]
push 5
cmovne eax, ecx
xor ecx, ecx
push str._hdok
mov word [eax], cx
jmp 0x1003cdd7
lea ecx, [ebp - 0x580]
call fcn.10012170
push 7
push str._hdfail
lea ecx, [ebp - 0x568]
call fcn.10011100
mov edx, dword [ebp - 0x574]
mov eax, esi
mov byte [ebp - 4], 0xd
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003ce03
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x420]
push eax
call fcn.10044de0
add esp, 4
test eax, eax
jne 0x1003ce38
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x5a0]
push str.fail_check_sign_s
push eax
call fcn.1003c5b0
add esp, 0xc
xor edi, edi
jmp 0x1003db64
call fcn.100079d0
mov ecx, eax
test ecx, ecx
je 0x1003dc98
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x574], eax
push dword [ebp - 0x578]
lea eax, [ebp - 0x574]
mov byte [ebp - 4], 0x16
push str.RunTrayIcon
push dword [ebp - 0x58c]
push str.__dll__s____entry_s__s
push eax
call fcn.100078e0
lea eax, [ebp - 0x56c]
push 1
push eax
call fcn.1005a080
add esp, 0x1c
mov ecx, str.home
mov eax, dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1003cebb
test dx, dx
je 0x1003ceb7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1003cebb
add eax, 4
add ecx, 4
test dx, dx
jne 0x1003ce95
xor edi, edi
jmp 0x1003cec0
sbb edi, edi
or edi, 1
mov edx, dword [ebp - 0x56c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003cedd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x1003d10c
lea ecx, [ebp - 0x78]
call fcn.1003c010
mov eax, dword [ebp - 0x574]
push str.cmd_line
mov byte [ebp - 4], 0x17
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
lea ecx, [ebp - 0x78]
call fcn.1003c3b0
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
sub esi, eax
mov dword [ebp - 0x560], eax
mov dword [ebp - 0x56c], esi
jne 0x1003cf2d
xor esi, esi
jmp 0x1003d068
push esi
mov dword [ebp - 0x558], 0
call fcn.10085f93
mov edi, eax
add esp, 4
mov dword [ebp - 0x55c], edi
test edi, edi
jne 0x1003cf53
xor esi, esi
jmp 0x1003d068
push esi
push dword [ebp - 0x560]
push edi
call fcn.1007e720
add esp, 0xc
xor edi, edi
test esi, esi
je 0x1003cfee
nop dword [eax]
mov eax, 0xd41d41d5
mov esi, edi
mul edi
mov eax, edi
mov ecx, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x23
sub esi, eax
mov eax, 0x2f684bdb
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x1b
sub ecx, eax
mov al, byte [ebp + esi - 0x44]
mov esi, dword [ebp - 0x56c]
xor al, byte [ebp + ecx - 0x5f]
mov byte [ebp - 0x55d], al
mov eax, 0xf0f0f0f1
mul edi
mov eax, edi
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
mov cl, byte [ebp - 0x55d]
xor cl, byte [ebp + eax - 0x70]
mov eax, edi
and eax, 7
xor cl, byte [ebp + eax - 0x78]
mov eax, dword [ebp - 0x55c]
xor byte [edi + eax], cl
inc edi
cmp edi, esi
jb 0x1003cf70
jmp 0x1003cff4
mov eax, dword [ebp - 0x55c]
lea ecx, [ebp - 0x558]
push ecx
push 0
push 0x40000001
push esi
mov esi, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
push eax
call esi
push dword [ebp - 0x558]
call fcn.1005ecfb
mov edi, dword [ebp - 0x55c]
lea ecx, [ebp - 0x558]
add esp, 4
mov dword [ebp - 0x560], eax
push ecx
push eax
push 0x40000001
push dword [ebp - 0x56c]
push edi
call esi
test eax, eax
je 0x1003d052
push dword [ebp - 0x560]
call fcn.1008fc4b
add esp, 4
mov esi, eax
jmp 0x1003d054
xor esi, esi
push edi
call fcn.10085f8e
push dword [ebp - 0x560]
call fcn.1005ed04
add esp, 8
push 0
push esi
lea ecx, [ebp - 0x554]
call fcn.1000f930
push dword [ebp - 0x554]
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x574]
push str.__s____param_s
push eax
call fcn.100078e0
mov eax, dword [ebp - 0x554]
lea ecx, [ebp - 0x550]
add esp, 0x10
cmp eax, ecx
je 0x1003d0b4
push eax
call fcn.10085f8e
add esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, eax
mov byte [ebp - 4], 0x19
call fcn.1003be40
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0
test ecx, ecx
je 0x1003d106
mov edx, dword [ebp - 0x14]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x1003d0fc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003dca2
push edx
push ecx
call fcn.1005eced
add esp, 8
mov byte [ebp - 4], 0x16
jmp 0x1003d160
mov eax, dword [ebp - 0x574]
add eax, 0xfffffff0
push eax
call fcn.10007690
lea esi, [eax + 0x10]
mov dword [ebp - 0x564], esi
push esi
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0x574]
push str.__s___s
push eax
call fcn.100078e0
add esp, 0x14
mov byte [ebp - 4], 0x16
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1003d160
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x588]
mov dword [ebp - 0x558], 0
mov ecx, dword [ecx + 0x38]
call fcn.10020b10
mov dword [ebp - 0x56c], eax
lea eax, [ebp - 0x56c]
push eax
call fcn.100251e0
mov ecx, eax
call fcn.10021360
mov esi, dword [ebp - 0x574]
cmp dword [esi - 4], 1
jle 0x1003d1b1
push dword [esi - 0xc]
lea ecx, [ebp - 0x574]
call fcn.10007860
mov esi, dword [ebp - 0x574]
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0x44
xor eax, eax
movlpd qword [ebp - 0x50], xmm0
mov word [ebp - 0x12], ax
xor edi, edi
mov eax, 1
mov dword [ebp - 0x55c], edi
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x22], xmm0
movlpd qword [ebp - 0x1a], xmm0
movups xmmword [ebp - 0x430], xmm0
mov dword [ebp - 0x28], 0x81
mov word [ebp - 0x24], ax
call fcn.10012410
mov dword [ebp - 0x56c], eax
test eax, eax
je 0x1003d295
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x1003d234
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x1003d289
push str.CreateProcessWithTokenW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1003d289
lea ecx, [ebp - 0x430]
push ecx
lea ecx, [ebp - 0x54]
push ecx
push 0
push 0
push 0
push esi
push 0
push 0
push dword [ebp - 0x56c]
call eax
test eax, eax
je 0x1003d289
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x430]
mov edi, 1
mov dword [ebp - 0x558], eax
mov dword [ebp - 0x55c], edi
push dword [ebp - 0x56c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi - 8]
push esi
call fcn.10085bc2
add esp, 8
test eax, eax
js 0x1003dc34
cmp eax, dword [esi - 8]
jg 0x1003dc34
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
test edi, edi
je 0x1003d2fd
cmp dword [ebp - 0x558], ecx
je 0x1003d6b0
mov eax, dword [ebp - 0x588]
mov ecx, dword [eax + 0x38]
call fcn.10020b10
push dword [ebp - 0x558]
mov dword [ebp - 0x56c], eax
lea eax, [ebp - 0x56c]
push eax
call fcn.100251e0
mov ecx, eax
call fcn.10021520
jmp 0x1003d6b0
call fcn.100079d0
mov ecx, eax
test ecx, ecx
je 0x1003dca7
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x558], eax
push dword [ebp - 0x578]
lea eax, [ebp - 0x558]
mov byte [ebp - 4], 0x1b
push str.RunTrayIcon
push dword [ebp - 0x58c]
push str.__dll__s____entry_s__s
push eax
call fcn.100078e0
add esp, 0x14
call fcn.100079d0
mov ecx, eax
test ecx, ecx
je 0x1003dcb1
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x560], eax
mov edi, dword [ebp - 0x558]
push edi
mov byte [ebp - 4], 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x560]
push str.LastError:_d__cmd_s
push eax
call fcn.100078e0
add esp, 0x10
call fcn.1005dde0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1003d486
push 4
push str.FILE
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], al
call fcn.1000c680
push 3
push 0x100aea94
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1000c680
mov byte [ebp - 4], 0x1e
call fcn.1005dde0
mov dword [ebp - 0x56c], eax
lea ecx, [ebp - 0x4e8]
push 0x177
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.10009a70
mov dword [ebp - 0x578], eax
mov ecx, dword [ebp - 0x560]
mov edx, 0x100ae9e4
test ecx, ecx
mov byte [ebp - 4], 0x1f
cmovne edx, ecx
push edx
push eax
call fcn.100092f0
mov ecx, dword [ebp - 0x56c]
add esp, 8
mov eax, dword [ecx]
push dword [ebp - 0x578]
call dword [eax + 0x1c]
lea ecx, [ebp - 0x4e8]
call fcn.1000a930
lea ecx, [ebp - 0x450]
call fcn.100074f0
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x1c
call fcn.100074f0
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x420]
movlpd qword [ebp - 0x2c], xmm0
push 0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x48], 0x1140
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x40], 0x100b3718
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
mov dword [ebp - 0x55c], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push eax
mov dword [ebp - 0x564], eax
lea eax, [ebp - 0x560]
push str.ShellExecuteEx_api__errcode_lu__hRet_d
push eax
call fcn.100078e0
add esp, 0x10
call fcn.1005dde0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov edi, dword [ebp - 0x560]
movzx eax, al
sub eax, 1
jne 0x1003d612
push 4
push str.FILE
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
call fcn.1000c680
push 3
push 0x100aea94
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1000c680
mov byte [ebp - 4], 0x21
call fcn.1005dde0
mov dword [ebp - 0x56c], eax
lea ecx, [ebp - 0x4e8]
push 0x18c
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.10009a70
mov dword [ebp - 0x578], eax
test edi, edi
mov byte [ebp - 4], 0x22
mov ecx, 0x100ae9e4
cmovne ecx, edi
push ecx
push eax
call fcn.100092f0
mov ecx, dword [ebp - 0x56c]
add esp, 8
mov eax, dword [ecx]
push dword [ebp - 0x578]
call dword [eax + 0x1c]
lea ecx, [ebp - 0x4e8]
call fcn.1000a930
lea ecx, [ebp - 0x450]
call fcn.100074f0
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x1c
call fcn.100074f0
push dword [ebp - 0x55c]
lea eax, [ebp - 0x5a0]
push dword [ebp - 0x564]
push str.ShellExecuteEx_api__errcode_lu__hRet_d
push eax
call fcn.1003c5b0
add esp, 0x10
cmp dword [ebp - 0x55c], 0
je 0x1003d66b
cmp dword [ebp - 0x14], 0
je 0x1003d66b
mov eax, dword [ebp - 0x588]
mov ecx, dword [eax + 0x38]
call fcn.10020b10
push dword [ebp - 0x14]
mov dword [ebp - 0x564], eax
lea eax, [ebp - 0x564]
push eax
call fcn.100251e0
mov ecx, eax
call fcn.10021520
lea edx, [edi - 0x10]
mov byte [ebp - 4], 0x1b
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003d689
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x558]
mov eax, edi
mov byte [ebp - 4], 0x16
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003d6aa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x55c]
test edi, edi
jne 0x1003d994
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.1007f220
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call edi
xor eax, eax
mov word [ebp - 0x560], ax
lea eax, [ebp - 0x560]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.100079d0
mov ecx, eax
test ecx, ecx
je 0x1003dcbb
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x56c], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0x23
push eax
lea eax, [ebp - 0x56c]
push str.CallServiceEx_szPath_s
push eax
call fcn.100078e0
add esp, 0xc
call fcn.1005dde0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov edi, dword [ebp - 0x56c]
movzx eax, al
sub eax, 1
jne 0x1003d858
push 4
push str.FILE
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
call fcn.1000c680
push 3
push 0x100aea94
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1000c680
mov byte [ebp - 4], 0x25
call fcn.1005dde0
mov dword [ebp - 0x564], eax
lea ecx, [ebp - 0x4e8]
push 0x1f4
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.10009a70
mov dword [ebp - 0x578], eax
test edi, edi
mov byte [ebp - 4], 0x26
mov ecx, 0x100ae9e4
cmovne ecx, edi
push ecx
push eax
call fcn.100092f0
mov ecx, dword [ebp - 0x564]
add esp, 8
mov eax, dword [ecx]
push dword [ebp - 0x578]
call dword [eax + 0x1c]
lea ecx, [ebp - 0x4e8]
call fcn.1000a930
lea ecx, [ebp - 0x450]
call fcn.100074f0
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x23
call fcn.100074f0
lea eax, [ebp - 0x218]
push eax
call fcn.10044de0
add esp, 4
test eax, eax
jne 0x1003d88e
mov byte [ebp - 4], 0x16
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1003d887
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
xor edi, edi
jmp 0x1003db46
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x578], eax
mov dword [ebp - 0x558], 0
test eax, eax
jne 0x1003d8b9
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1003d905
push str.CLSE
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x564], eax
test eax, eax
jne 0x1003d8dc
push 0x490
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1003d905
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
lea eax, [ebp - 0x558]
push eax
push str.processid
push esi
lea eax, [ebp - 0x420]
push eax
push str.createprocess
call dword [ebp - 0x564]
mov eax, dword [ebp - 0x558]
xor ecx, ecx
push eax
push dword [ebp - 0x578]
test eax, eax
lea eax, [ebp - 0x5a0]
push str.CallServiceEx__p__u
setne cl
push eax
mov dword [ebp - 0x55c], ecx
call fcn.1003c5b0
add esp, 0x10
cmp dword [ebp - 0x55c], 0
je 0x1003d972
cmp dword [ebp - 0x558], 0
je 0x1003d972
mov eax, dword [ebp - 0x588]
mov ecx, dword [eax + 0x38]
call fcn.10020b10
push dword [ebp - 0x558]
mov dword [ebp - 0x564], eax
lea eax, [ebp - 0x564]
push eax
call fcn.100251e0
mov ecx, eax
call fcn.10021550
mov byte [ebp - 4], 0x16
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1003d98e
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x55c]
mov eax, str._exfail
test edi, edi
mov edx, str._exok
cmove edx, eax
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x564], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003d9b0
sub ecx, dword [ebp - 0x564]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x568]
call fcn.10011100
mov byte [ebp - 0x55d], 0
lea eax, [ebp - 0x570]
mov byte [ebp - 4], 0x27
push eax
call fcn.10040575
lea eax, [ebp - 0x570]
mov dword [ebp - 0x57c], eax
lea eax, [ebp - 0x55d]
mov dword [ebp - 0x578], eax
lea eax, [ebp - 0x57c]
push eax
push 0x1000ddb0
push 0x100d8a8c
call fcn.1004081a
add esp, 0x10
test eax, eax
je 0x1003dc10
lea eax, [ebp - 0x570]
mov byte [ebp - 4], 0x29
push eax
call fcn.100405af
mov eax, dword [0x100d8a88]
add esp, 4
mov byte [ebp - 4], 0x16
mov ecx, dword [eax]
push 1
push 0
push dword [ebp - 0x568]
push 0x100aee70
push eax
call dword [ecx]
call fcn.1005dde0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1003db46
push 4
push str.FILE
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], al
call fcn.1000c680
push 3
push 0x100aea94
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x2c
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1000c680
mov byte [ebp - 4], 0x2d
call fcn.1005dde0
mov dword [ebp - 0x564], eax
lea ecx, [ebp - 0x4e8]
push 0x210
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.10009a70
mov edi, eax
push str.Start_by_rundll._bSuccess
push edi
mov byte [ebp - 4], 0x2e
call fcn.100092f0
add esp, 8
mov ecx, edi
push dword [ebp - 0x55c]
call fcn.10010b10
mov ecx, dword [ebp - 0x564]
push edi
mov eax, dword [ecx]
call dword [eax + 0x1c]
lea ecx, [ebp - 0x4e8]
call fcn.1000a930
lea ecx, [ebp - 0x450]
call fcn.100074f0
lea ecx, [ebp - 0x438]
call fcn.100074f0
mov edi, dword [ebp - 0x55c]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0xd
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003db64
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x58c]
mov eax, esi
mov byte [ebp - 4], 0xc
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003db85
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x580]
mov eax, esi
mov byte [ebp - 4], 0xb
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003dba6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x568]
mov eax, esi
mov byte [ebp - 4], 9
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1003dbc7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x584]
mov byte [ebp - 4], 7
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x1003dbe6
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x5a0]
call fcn.1003c190
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005f06c
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x570]
mov byte [ebp - 4], 0x2a
push eax
call fcn.100405d0
add esp, 4
mov byte [ebp - 4], 0x28
test al, al
je 0x1003dcdb
jmp 0x1003dcc5
push 0x80070057
call fcn.10007660
push 0x80004005
call fcn.10007660
push 0x80004005
call fcn.10007660
push 0x80004005
call fcn.10007660
push 0x80004005
call fcn.10007660
push 0x80004005
call fcn.10007660
push 0x80004005
call fcn.10007660
push 0x80004005
call fcn.10007660
push 0x80004005
call fcn.10007660
push 0x80004005
call fcn.10007660
push 0x80004005
call fcn.10007660
call fcn.10082829
push 0x80004005
call fcn.10007660
push 0x80004005
call fcn.10007660
push 0x80004005
call fcn.10007660
sub esp, 8
lea eax, [ebp - 0x570]
mov ecx, esp
push eax
call fcn.100082e0
call fcn.100092b0
call fcn.10040832
int3