Function at 0x101af9f0
Capabilities:
Get file attributes
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x10257d10]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...heavygate.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.10003180
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [eax + 0x154]
test esi, esi
je 0x101afa5e
push esi
call edi
push 0xe
call fcn.10003680
add esp, 4
test eax, eax
je 0x101afa77
lea ecx, [ebp - 0x20c]
push ecx
call eax
jmp 0x101afa84
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
test esi, esi
je 0x101afa91
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0xffffffff
je 0x101afa9b
test bl, 0x10
je 0x101afb04
push str...deepscanheavygate.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x101afabf
push esi
call edi
push 0xe
call fcn.10003680
add esp, 4
test eax, eax
je 0x101afad8
lea ecx, [ebp - 0x20c]
push ecx
call eax
jmp 0x101afae5
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
test esi, esi
je 0x101afaf2
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0xffffffff
je 0x101affa2
test bl, 0x10
jne 0x101affa2
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.101b13a0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 8
test eax, eax
jne 0x101afcac
cmp dword [0x1023c00c], 0
je 0x101afc62
push 0x20a
lea eax, [ebp - 0x418]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push str.360Base.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x101afb5a
mov eax, dword [0x10257d10]
push 0x104
lea ecx, [ebp - 0x418]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...360Base.dll
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [0x1024e9f8], 0
jne 0x101afc24
push 0x1024e9e0
call edi
cmp dword [0x1024e9f8], 0
jne 0x101afc19
lea eax, [ebp - 0x418]
push eax
call fcn.101b1420
mov edi, eax
add esp, 4
mov ebx, 0x80004005
test edi, edi
je 0x101afc03
push str.InitLibs
push edi
call esi
push str.CreateObject
push edi
mov dword [ebp - 0x41c], eax
call esi
mov ecx, dword [ebp - 0x41c]
mov dword [0x1024e5d8], eax
test ecx, ecx
je 0x101afc54
push 0x1024e5dc
mov dword [0x1024e5dc], 0x100
call ecx
mov ebx, eax
test ebx, ebx
je 0x101afc5a
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x1024e5d4], 0
xor eax, eax
mov dword [0x1024e9f8], 1
test ebx, ebx
sete al
mov dword [0x1024e9fc], eax
push 0x1024e9e0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [0x1024e9fc]
test edi, edi
jne 0x101afc44
push 1
lea eax, [ebp - 0x418]
push 0x1024dcf0
push eax
call fcn.1001ac50
add esp, 0xc
mov dword [0x1023c00c], 0
test edi, edi
jne 0x101afc62
jmp 0x101afc7b
test eax, eax
je 0x101afbf2
xor ebx, ebx
mov dword [0x1024e5d4], edi
jmp 0x101afc03
push 0
lea eax, [ebp - 0x20c]
mov ecx, 0x1024e5d0
push eax
call fcn.101b1210
mov edi, eax
test edi, edi
jne 0x101afcac
push 1
lea eax, [ebp - 0x20c]
push 0x1024dcf0
push eax
call fcn.1001ac50
add esp, 0xc
test edi, edi
jne 0x101afcac
mov dword [0x1025b408], edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1025b408], eax
test eax, eax
je 0x101affa2
push str.sqlite3_open_v2
push eax
call esi
mov dword [0x1025b410], eax
test eax, eax
je 0x101aff94
push str.sqlite3_close
push dword [0x1025b408]
call esi
mov dword [0x1025b3c8], eax
test eax, eax
je 0x101aff94
push str.sqlite3_exec
push dword [0x1025b408]
call esi
mov dword [0x1025b3cc], eax
test eax, eax
je 0x101aff94
push str.sqlite3_free
push dword [0x1025b408]
call esi
mov dword [0x1025b3d0], eax
test eax, eax
je 0x101aff94
push str.sqlite3_prepare_v2
push dword [0x1025b408]
call esi
mov dword [0x1025b3d4], eax
test eax, eax
je 0x101aff94
push str.sqlite3_finalize
push dword [0x1025b408]
call esi
mov dword [0x1025b3dc], eax
test eax, eax
je 0x101aff94
push str.sqlite3_step
push dword [0x1025b408]
call esi
mov dword [0x1025b3d8], eax
test eax, eax
je 0x101aff94
push str.sqlite3_reset
push dword [0x1025b408]
call esi
mov dword [0x1025b3e0], eax
test eax, eax
je 0x101aff94
push str.sqlite3_bind_int
push dword [0x1025b408]
call esi
mov dword [0x1025b3e4], eax
test eax, eax
je 0x101aff94
push str.sqlite3_bind_int64
push dword [0x1025b408]
call esi
mov dword [0x1025b3e8], eax
test eax, eax
je 0x101aff94
push str.sqlite3_bind_text
push dword [0x1025b408]
call esi
mov dword [0x1025b3ec], eax
test eax, eax
je 0x101aff94
push str.sqlite3_bind_blob
push dword [0x1025b408]
call esi
mov dword [0x1025b3f0], eax
test eax, eax
je 0x101aff94
push str.sqlite3_column_int
push dword [0x1025b408]
call esi
mov dword [0x1025b3f4], eax
test eax, eax
je 0x101aff94
push str.sqlite3_column_int64
push dword [0x1025b408]
call esi
mov dword [0x1025b3f8], eax
test eax, eax
je 0x101aff94
push str.sqlite3_column_text
push dword [0x1025b408]
call esi
mov dword [0x1025b3fc], eax
test eax, eax
je 0x101aff94
push str.sqlite3_column_blob
push dword [0x1025b408]
call esi
mov dword [0x1025b400], eax
test eax, eax
je 0x101aff94
push str.sqlite3_column_bytes
push dword [0x1025b408]
call esi
mov dword [0x1025b404], eax
test eax, eax
je 0x101aff94
push 0x1025b414
call fcn.101af920
push 0x1025b418
call fcn.101af920
add esp, 8
cmp dword [0x1025b414], 0
je 0x101aff94
cmp dword [0x1025b418], 0
je 0x101aff94
cmp byte [0x1025b40d], 0
jne 0x101aff7c
mov eax, dword [0x1025b414]
lea edx, [ebp - 0x424]
push 0
push 0
push 0
push 8
push edx
mov byte [0x1025b40d], 1
mov dword [ebp - 0x424], 0x20110120
mov dword [ebp - 0x420], 0x20051010
mov ecx, dword [eax]
push 0x100
push eax
call dword [ecx + 0xc]
mov eax, dword [0x1025b414]
lea edx, [ebp - 0x41c]
push edx
push 0x1024dae0
push 0x100
mov dword [ebp - 0x41c], 0x100
mov ecx, dword [eax]
push 0x1024dae0
push eax
call dword [ecx + 0x10]
mov eax, dword [0x1025b418]
lea edx, [ebp - 0x424]
push 0
push 0
push 0
push 8
push edx
mov dword [ebp - 0x424], 0x20051010
mov dword [ebp - 0x420], 0x20110120
mov ecx, dword [eax]
push 0x100
push eax
call dword [ecx + 0xc]
mov eax, dword [0x1025b418]
lea edx, [ebp - 0x41c]
push edx
push 0x1024dbe8
push 0x100
mov dword [ebp - 0x41c], 0x100
mov ecx, dword [eax]
push 0x1024dbe8
push eax
call dword [ecx + 0x10]
pop edi
pop esi
mov byte [0x1025b40c], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
cmp byte [0x1025b40c], 0
jne 0x101affa2
call fcn.101affd0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret