Function at 0x1004199
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Create thread
Generate random numbers via winapi
Get common file path
Get disk information
Get disk size
Get file attributes
Inspect section memory permissions
Query environment variable
Read file on windows
Set environment variable
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x944
push ebx
push esi
push edi
xor ebx, ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x20]
push 0x100aba0
mov dword [ebp + 0x5c], 0x5c3a63
mov byte [ebp + 0x5b], 0x63
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x14], 0xc
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x40], ebx
mov dword [ebp - 0x2c0], 0x80000000
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [0x100a384], 1
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x100abb8], eax
call fcn.010026e9
push 0x104
mov edi, 0x100aa80
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003478
sub eax, esi
lea eax, [eax + 0x100aa80]
jmp 0x1003493
lea ecx, [eax - 1]
cmp byte [ecx], 0x5c
je 0x1003497
mov eax, ecx
cmp eax, edi
ja 0x1003489
push eax
call fcn.01002f33
push edi
mov dword [ebp + 0x74], eax
call fcn.01002742
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov dword [ebp + 0x54], esi
xor ecx, ecx
mov al, byte [esi]
cmp al, 0x20
je 0x10034c1
cmp al, 9
je 0x10034c1
cmp al, 0x22
jne 0x10034cb
cmp al, 0x22
jne 0x10034c8
xor ecx, ecx
inc ecx
inc esi
jmp 0x10034b3
cmp ecx, ebx
mov dword [ebp + 0x54], esi
je 0x10034e7
cmp byte [esi], bl
mov eax, esi
je 0x10034e7
cmp byte [eax], 0x22
je 0x10034e4
inc eax
cmp byte [eax], bl
jne 0x10034d8
jmp 0x10034e7
mov byte [eax], 0x20
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
cmp al, bl
jne 0x10034ec
sub ecx, edx
lea ecx, [ecx + esi - 1]
jmp 0x1003508
mov al, byte [ecx]
cmp al, 0x20
je 0x1003505
cmp al, 9
jne 0x100350c
mov byte [ecx], bl
dec ecx
cmp ecx, esi
jae 0x10034fb
mov eax, dword [ebp + 0x74]
mov ecx, eax
lea edx, [ecx + 1]
mov dword [ebp + 0x44], ebx
mov byte [0x100ace0], bl
mov dword [ebp + 0x6c], edx
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x1003520
sub ecx, dword [ebp + 0x6c]
lea edx, [ecx + eax - 1]
jmp 0x1003536
cmp byte [edx], 0x2e
je 0x100353c
dec edx
cmp edx, eax
ja 0x1003530
jmp 0x100356f
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003541
sub eax, esi
lea ecx, [eax + 1]
mov dword [ebp + 0x44], eax
mov eax, ecx
shr ecx, 2
mov esi, edx
mov edi, 0x100ace0
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x54]
mov byte [edx], bl
mov edi, 0x100aa80
cmp byte [esi], bl
mov dword [ebp + 0x38], 0x100188c
mov dword [ebp + 0x64], esi
je 0x1003693
mov eax, dword [ebp + 0x74]
mov cl, byte [eax]
mov dl, byte [esi]
or cl, 0x20
or dl, 0x20
cmp dl, cl
jne 0x1003672
lea edi, [esi + 1]
lea esi, [eax + 1]
jmp 0x10035a4
cmp al, bl
je 0x10035bf
inc edi
inc esi
mov al, byte [esi]
mov cl, byte [edi]
mov dl, al
or cl, 0x20
or dl, 0x20
cmp dl, cl
mov dword [ebp + 0x70], edi
je 0x100359e
cmp al, bl
jne 0x1003672
cmp byte [edi], 0x2e
mov dword [ebp + 0x6c], ebx
jne 0x100360c
cmp dword [ebp + 0x44], ebx
jbe 0x100360c
xor eax, eax
cmp dword [ebp + 0x44], ebx
mov dword [ebp + 0x6c], 1
jbe 0x1003606
mov dword [ebp + 0x3c], edi
sub dword [ebp + 0x3c], 0x100ace0
mov ecx, dword [ebp + 0x3c]
lea esi, [eax + 0x100ace0]
mov cl, byte [ecx + esi]
mov dl, byte [esi]
or cl, 0x20
or dl, 0x20
cmp cl, dl
jne 0x1003683
inc eax
cmp eax, dword [ebp + 0x44]
jb 0x10035e4
add edi, dword [ebp + 0x44]
mov dword [ebp + 0x70], edi
mov al, byte [edi]
cmp al, 0x20
je 0x100361a
cmp al, 9
je 0x100361a
cmp al, bl
jne 0x1003672
mov esi, dword [ebp + 0x54]
mov eax, dword [ebp + 0x70]
sub eax, esi
mov ecx, eax
mov edx, ecx
shr ecx, 2
mov edi, 0x100a960
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp dword [ebp + 0x6c], ebx
rep movsb byte es:[edi], byte [esi]
lea edi, [eax + 0x100a960]
mov byte [edi], bl
jne 0x1003663
mov ecx, dword [ebp + 0x44]
mov edx, ecx
shr ecx, 2
mov esi, 0x100ace0
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov byte [eax + ecx + 0x100a960], bl
push 0x100a960
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x1003688
mov esi, dword [ebp + 0x64]
inc esi
cmp byte [esi], bl
mov dword [ebp + 0x64], esi
jne 0x1003581
jmp 0x100368e
mov dword [ebp + 0x6c], ebx
jmp 0x100360c
mov eax, dword [ebp + 0x70]
mov dword [ebp + 0x38], eax
mov edi, 0x100aa80
mov eax, dword [ebp + 0x38]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003699
sub eax, edx
cmp eax, 3
jb 0x100374d
mov ecx, dword [ebp + 0x38]
add eax, 0xfffffffe
cmp eax, ebx
mov dword [ebp + 0x64], ecx
mov dword [ebp + 0x6c], eax
jbe 0x100374d
mov eax, dword [ebp + 0x64]
mov esi, dword [eax]
and esi, 0xffdffdff
xor eax, eax
or esi, 0x20000000
inc eax
cmp esi, 0x20582d20
jne 0x10036e0
mov dword [0x100a54c], eax
cmp esi, 0x3a582d20
jne 0x1003705
mov eax, dword [ebp + 0x64]
add eax, 4
push eax
mov dword [0x100a54c], 1
call fcn.0100267b
test eax, eax
je 0x1003768
xor eax, eax
inc eax
cmp esi, 0x20552d20
jne 0x1003712
mov dword [0x101ae00], eax
cmp esi, 0x20512d20
jne 0x1003724
mov dword [0x100a550], eax
mov dword [0x101ae00], eax
cmp esi, 0x20532d20
jne 0x1003731
mov dword [0x100aa68], eax
cmp esi, 0x3a532d20
jne 0x100373e
mov dword [0x100aa68], eax
dec dword [ebp + 0x6c]
inc dword [ebp + 0x64]
cmp dword [ebp + 0x6c], ebx
ja 0x10036bf
mov eax, dword [0x10011e4]
and eax, 0xffff0000
cmp eax, 0xcab00000
jne 0x100376f
push 0x20000001
jmp 0x1004171
push 0x52
jmp 0x1004171
test byte [0x10011e7], 0x80
jne 0x1003782
mov dword [0x100a54c], 1
and byte [0x10011e7], 0x7f
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x100aa74], eax
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x1002bc4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x10037b6
push 8
jmp 0x1004171
push 0xffffffffffffffff
push dword [0x100aa74]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x100aa64], ebx
jne 0x10037d6
push 0x4c7
jmp 0x1004171
cmp dword [0x100a550], ebx
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
je 0x1003816
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push dword [0x100aa64]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x100aa70]
push dword [0x100aa64]
call dword [sym.imp.USER32.dll_SetParent]
cmp dword [0x100a550], ebx
jne 0x1003859
push dword [ebp + 0x74]
push ebx
push 0xc
push 0x68
push dword [0x100aa64]
call esi
mov eax, dword [0x10011e0]
add eax, 0xffff
shr eax, 0x10
shl eax, 0x10
push eax
push ebx
push 0x401
push 0x6a
push dword [0x100aa64]
call esi
push ebx
push 1
push 0x404
push 0x6a
push dword [0x100aa64]
call esi
push ebx
push ebx
push edi
call fcn.01002d87
or dword [ebp + 0x6c], 0xffffffff
mov dword [ebp + 0x54], eax
mov eax, dword [0x10011e0]
add esp, 0xc
cmp eax, ebx
mov dword [ebp + 0x74], eax
je 0x100375e
mov edi, 0x100ae00
mov ecx, 0x10000
cmp eax, ecx
mov dword [ebp + 0x70], eax
jbe 0x100388f
mov dword [ebp + 0x70], ecx
push dword [ebp + 0x70]
push edi
push dword [ebp + 0x54]
call fcn.01002dc6
add esp, 0xc
push dword [ebp + 0x70]
push edi
push dword [ebp + 0x6c]
call fcn.01002713
cmp dword [0x100a550], ebx
mov dword [ebp + 0x6c], eax
jne 0x10038c6
push ebx
push ebx
push 0x405
push 0x6a
push dword [0x100aa64]
call esi
mov eax, dword [ebp + 0x74]
sub eax, dword [ebp + 0x70]
mov dword [ebp + 0x74], eax
jne 0x1003880
cmp dword [ebp + 0x6c], ebx
jne 0x100375e
lea eax, [ebp - 0x54]
push eax
push ebx
push fcn.01002415
push 0x10023f6
push 0x1002dee
push fcn.01002dc6
push fcn.01002d87
push 0x10023e3
push fcn.01002d69
call fcn.010077ee
push ebx
push ebx
push dword [ebp + 0x54]
mov dword [ebp + 0x3c], eax
call fcn.01002415
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 0x54]
push dword [ebp + 0x3c]
call fcn.0100787e
add esp, 0x3c
test eax, eax
je 0x100375e
cmp dword [0x100a550], ebx
jne 0x1003943
push ebx
push dword [0x100aa64]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.01002e16
test eax, eax
jne 0x100395f
push 0xffffffffffffffff
jmp 0x1004171
push 1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x10039f4
push 2
push 0x100
lea eax, [ebp - 0x4cc]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x10039f4
push dword [ebp + 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
push 0x10000000
push 2
lea eax, [ebp - 0x4cc]
push eax
call edi
test eax, eax
je 0x10039f4
push dword [ebp + 0x74]
lea eax, [ebp - 0x4cc]
push 0x10000000
push 2
push eax
call edi
test eax, eax
je 0x10039f4
push dword [ebp + 0x6c]
lea eax, [ebp - 0x4cc]
push 0x10000000
push 2
push eax
call edi
test eax, eax
je 0x10039f4
push ebx
lea eax, [ebp - 0x4cc]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x10039f4
lea eax, [ebp + 0x14]
mov dword [ebp + 0x40], eax
cmp byte [0x100abc0], bl
mov edi, 0x100abc0
je 0x1003a2a
push ebx
push dword [ebp + 0x40]
push edi
call fcn.01003157
test eax, eax
jne 0x1003a17
mov byte [0x100abc0], bl
jmp 0x1003a2a
cmp byte [0x100abc0], bl
mov dword [ebp + 0x50], 1
jne 0x1003c9a
cmp dword [0x101ae00], ebx
jne 0x1003a3e
cmp dword [0x100a54c], ebx
jne 0x1003c85
push 0xffff
push 0x100ae00
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, byte [0x100ae00]
or al, 0x20
mov byte [ebp + 0x63], al
mov dword [ebp + 0x68], ebx
mov dword [ebp + 0x6c], ebx
mov byte [ebp + 0x5c], 0x61
lea eax, [ebp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp + 0x74], eax
push 2
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.01004450
add esp, 0xc
push 0x400
lea eax, [ebp - 0x8cc]
push eax
lea eax, [ebp + 0x64]
push eax
mov byte [ebp + 0x66], bl
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
cmp dword [ebp + 0x74], 3
je 0x1003aa6
cmp dword [ebp + 0x74], 6
jne 0x1003b15
cmp eax, ebx
je 0x1003b15
lea eax, [ebp - 0x8cc]
push 0x1001950
push eax
call fcn.01004348
pop ecx
push eax
call fcn.01004270
test eax, eax
pop ecx
pop ecx
jne 0x1003b15
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x1003b15
mov eax, dword [ebp + 0x24]
imul eax, dword [ebp + 0x2c]
mov cl, byte [ebp + 0x5c]
mul dword [ebp + 0x28]
cmp cl, byte [ebp + 0x63]
jne 0x1003b00
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x6c], edx
jmp 0x1003b15
cmp edx, dword [ebp + 0x4c]
jb 0x1003b15
ja 0x1003b0c
cmp eax, dword [ebp + 0x48]
jbe 0x1003b15
mov dword [ebp + 0x48], eax
mov dword [ebp + 0x4c], edx
mov byte [ebp + 0x5b], cl
inc byte [ebp + 0x5c]
cmp byte [ebp + 0x5c], 0x7a
jle 0x1003a62
mov eax, dword [0x10011e8]
cmp eax, 0xcab00eee
je 0x1003b3a
cmp dword [ebp + 0x4c], ebx
ja 0x1003b5a
jb 0x1003b3a
cmp dword [ebp + 0x48], eax
jae 0x1003b5a
mov eax, dword [ebp + 0x6c]
cmp dword [ebp + 0x4c], eax
ja 0x1003b5a
jb 0x1003b4c
mov ecx, dword [ebp + 0x48]
cmp ecx, dword [ebp + 0x68]
jae 0x1003b5a
mov ecx, dword [ebp + 0x68]
mov dword [ebp + 0x4c], eax
mov al, byte [ebp + 0x63]
mov dword [ebp + 0x48], ecx
jmp 0x1003b5d
mov al, byte [ebp + 0x5b]
push 0xf0000000
push 1
push ebx
mov byte [ebp + 0x5c], al
push ebx
lea eax, [ebp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1003c29
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x6c], ebx
lea eax, [ebp - 0xb8]
push eax
push 0x10
push dword [ebp + 0x30]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1003bde
lea eax, [ebp + 0x5c]
push eax
push 0x100194c
push edi
call fcn.010042f0
lea eax, [eax + 0x100abc0]
add esp, 0xc
mov dword [ebp + 0x70], ebx
mov dword [ebp + 0x74], eax
mov eax, dword [ebp + 0x70]
movzx eax, byte [ebp + eax - 0xb8]
push eax
push 0x1001948
push dword [ebp + 0x74]
call fcn.010042f0
add dword [ebp + 0x74], 2
add esp, 0xc
inc dword [ebp + 0x70]
cmp dword [ebp + 0x70], 0x10
jb 0x1003bb5
cmp byte [0x100abc0], bl
je 0x1003bfe
push 1
push dword [ebp + 0x40]
push edi
call fcn.01003157
test eax, eax
je 0x1003c05
mov dword [ebp + 0x50], 1
jmp 0x1003c05
mov dword [ebp + 0x54], 1
inc dword [ebp + 0x6c]
cmp dword [ebp + 0x50], ebx
jne 0x1003c1f
cmp dword [ebp + 0x54], ebx
jne 0x1003c1f
cmp dword [ebp + 0x6c], 0x2710
jb 0x1003b81
push ebx
push dword [ebp + 0x30]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [ebp + 0x50], ebx
jne 0x1003c9a
push edi
push 0x100193c
lea eax, [ebp + 0x5c]
push eax
call fcn.01002380
mov dword [ebp + 0x64], eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [ebp - 8]
imul eax, dword [0x10011e0]
push dword [ebp + 0x64]
and eax, 0xffff
push eax
call fcn.01002440
push 1
push dword [ebp + 0x40]
push edi
call fcn.01003157
test eax, eax
jne 0x1003c93
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ebx
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x1003c9a
mov dword [ebp + 0x50], 1
cmp dword [0x101ae00], ebx
jne 0x1003d44
cmp dword [0x100a54c], ebx
jne 0x1003cc8
mov eax, dword [0x10011e0]
push 3
pop ecx
mul ecx
cmp dword [ebp + 0x4c], edx
ja 0x1003d44
jb 0x1003cc8
cmp dword [ebp + 0x48], eax
jae 0x1003d44
push ebx
push 0x1002f6a
push dword [0x100aa64]
push 0x6b
push dword [0x100a380]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 0xffffffff
je 0x1003958
cmp eax, ebx
je 0x10037cc
cmp byte [eax], bl
je 0x10037cc
mov ecx, eax
lea edx, [ecx + 1]
mov dword [ebp + 0x74], edx
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x1003d03
sub ecx, dword [ebp + 0x74]
inc ecx
cmp ecx, 0x104
jae 0x1003768
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x1003d1e
push ebx
push dword [ebp + 0x40]
push edi
call fcn.01003157
test eax, eax
je 0x1003d3d
mov dword [ebp + 0x50], 1
cmp dword [ebp + 0x50], ebx
je 0x1003cc8
jmp 0x1003d5c
cmp dword [ebp + 0x50], ebx
jne 0x1003d5c
push 1
push dword [ebp + 0x40]
push edi
call fcn.01003157
test eax, eax
je 0x1003768
cmp dword [0x100a550], ebx
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
jne 0x1003e09
push 0x104
push 0x100ace0
push 0x20000004
push dword [0x100a380]
call edi
push 0x104
push 0x100a960
push 0x20000006
push dword [0x100a380]
call edi
push 0x100ace0
push ebx
push 0xc
push 0x65
push dword [0x100aa64]
call esi
push 0x100a960
push ebx
push 0xc
push 0x66
push dword [0x100aa64]
call esi
push 0x100abc0
push ebx
push 0xc
push 0x69
push dword [0x100aa64]
call esi
push ebx
push ebx
push 0x402
push 0x6a
push dword [0x100aa64]
call esi
movzx eax, word [ebp - 0x42]
shl eax, 0x10
push eax
push ebx
push 0x401
push 0x6a
push dword [0x100aa64]
call esi
push 5
push dword [0x100aa64]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
push 0x100320b
push ebx
push 0x100188c
push 0x100aa80
push dword [ebp + 0x3c]
call fcn.0100875c
add esp, 0x1c
test eax, eax
je 0x100375e
mov ecx, dword [0x101ae00]
cmp ecx, ebx
mov eax, dword [0x100aa64]
jne 0x1003e45
cmp eax, ebx
je 0x10037cc
cmp dword [0x100abbc], ebx
je 0x10040e9
cmp dword [0x100a54c], ebx
jne 0x10040e9
cmp dword [0x100a550], ebx
jne 0x1003e73
push dword [0x100aa6c]
push ebx
push 0xc
push 0x68
push eax
call esi
mov eax, dword [0x100abbc]
lea edx, [ebp - 0x3cc]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x1003e80
lea eax, [ebp - 0x3cc]
push 0x1001928
push eax
call fcn.01004270
cmp eax, ebx
pop ecx
pop ecx
je 0x1003eb5
mov byte [eax], bl
lea eax, [ebp - 0x3cc]
push eax
push 0x1001914
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
push ebx
mov esi, 0x10018f8
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x1003f7d
lea eax, [ebp - 0x3cc]
push eax
push 0x10018e8
push 0x100abc0
call fcn.01002380
push ebx
push 0x4000002
push 1
push ebx
push 3
push 0xc0000000
lea eax, [ebp - 0x3cc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, eax
cmp edx, 0xffffffff
mov dword [0x10011ec], edx
je 0x1003f7d
xor eax, eax
push ebx
mov ecx, 0x84
lea edi, [ebp - 0x2c8]
rep stosd dword es:[edi], eax
lea eax, [ebp + 0x74]
push eax
mov edi, 0x210
push edi
lea eax, [ebp - 0x2c8]
push eax
push edx
mov dword [ebp - 0x2c8], 0x6e776453
mov dword [ebp - 0x2c4], 0x10000
mov dword [ebp - 0x2c0], 0xc0000013
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1003f6a
cmp dword [ebp + 0x74], edi
jne 0x1003f6a
lea eax, [ebp - 0x3cc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x1003f7d
push dword [0x10011ec]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x10011ec], 0xffffffff
mov eax, dword [0x100abbc]
mov edi, 0x100ace0
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x1003f8b
mov eax, dword [ebp + 0x38]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003f9a
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x1003fa4
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 0x11
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x98]
rep stosd dword es:[edi], eax
inc eax
mov dword [ebp - 0x6c], eax
mov word [ebp - 0x68], ax
lea eax, [ebp + 4]
push eax
lea eax, [ebp - 0x98]
push eax
push dword [0x101ae04]
mov dword [ebp - 0x98], 0x44
push ebx
push 0x20
push ebx
push ebx
push ebx
push 0x100ace0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1003958
cmp dword [0x100a550], ebx
jne 0x100401b
push ebx
push dword [0x100aa64]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 4]
push 0xffffffffffffffff
push eax
mov dword [0x100ab84], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 0x34]
push eax
push dword [ebp + 4]
mov dword [0x100ab84], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp + 8]
call esi
mov eax, dword [0x10011ec]
cmp eax, 0xffffffff
je 0x10040d4
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp + 0x74]
push eax
mov esi, 0x210
push esi
lea eax, [ebp - 0x2c8]
push eax
push dword [0x10011ec]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10040cd
cmp dword [ebp + 0x74], esi
jne 0x10040cd
cmp dword [ebp - 0x2c8], 0x6e776453
jne 0x10040cd
test byte [ebp - 0x2bd], 0x80
jne 0x10040d4
or byte [ebp - 0x2bd], 0x40
cmp dword [ebp - 0x2c4], 0x10000
mov byte [ebp - 0xb9], bl
jne 0x10040d4
test dword [ebp - 0x2c0], 0x3fffffec
jne 0x10040d4
and byte [ebp - 0x2bd], 0xbf
jmp 0x10040d4
or byte [ebp - 0x2bd], 0x80
cmp dword [ebp + 0x34], 0xcabf00d1
jne 0x10040e2
mov dword [ebp + 0x34], ebx
jmp 0x1004120
call fcn.010024f3
jmp 0x1004120
cmp ecx, ebx
jne 0x1004120
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x104
mov esi, 0x100ace0
push esi
push 0x20000002
push dword [0x100a380]
call edi
push 0x10030
push esi
push esi
push dword [0x100aa64]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x2c0]
test eax, eax
js 0x1004176
test eax, 0x40000000
jne 0x1004163
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0x2b8]
push ecx
mov ecx, eax
shr ecx, 4
and ecx, 1
push ecx
mov ecx, eax
shr ecx, 1
and ecx, 1
push ecx
and eax, 1
push eax
call fcn.01002bf0
test eax, eax
jne 0x1004163
or byte [ebp - 0x2bd], 0x40
test byte [ebp - 0x2bd], 0x40
je 0x1004176
push 0x20000007
call fcn.01002b26
cmp dword [0x100a384], ebx
je 0x100418f
push 0x100aba0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [0x100a384], ebx
push dword [ebp + 0x34]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x10033f0