Function at 0x10031140
Capabilities:
Create process on windows
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10071195
mov eax, dword fs:[0]
push eax
sub esp, 0x694
mov eax, dword [0x1008c274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c4], 0
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
mov dword [ebp - 0x440], eax
mov ecx, dword [ebp - 0x440]
mov dword [ebp - 0x59c], ecx
lea edx, [ebp - 0x3ed]
mov dword [ebp - 0x444], edx
mov eax, dword [ebp - 0x444]
push eax
movzx ecx, byte [ebp - 0x3ee]
push ecx
lea ecx, [ebp - 0x40]
call fcn.100030d0
mov byte [ebp - 4], 1
lea edx, [ebp + 8]
push edx
lea ecx, [ebp - 0x40]
call fcn.10006840
mov byte [ebp - 4], 2
lea eax, [ebp + 8]
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0x44c], ecx
mov edx, dword [ebp - 0x44c]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0
jne 0x1003121e
push 0x10075bc8
call fcn.10051cf0
add esp, 4
mov dword [ebp - 0x454], eax
mov ecx, dword [ebp - 0x454]
push ecx
push 0x10075bc8
lea ecx, [ebp + 8]
call fcn.10006eb0
jmp 0x1003125e
push 0x10075bcc
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x1f8]
push eax
call fcn.1002fa20
add esp, 0xc
mov dword [ebp - 0x458], eax
mov ecx, dword [ebp - 0x458]
push ecx
lea ecx, [ebp + 8]
call fcn.1000a0f0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1f8]
call fcn.10006c00
mov byte [ebp - 4], 2
lea edx, [ebp + 8]
mov dword [ebp - 0x45c], edx
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x3f4], eax
mov ecx, dword [ebp - 0x3f4]
mov dword [ebp - 0x400], ecx
mov edx, dword [ebp - 0x3f4]
cmp dword [edx + 0x14], 0x10
jb 0x10031297
mov dword [ebp - 0x3fc], 1
jmp 0x100312a1
mov dword [ebp - 0x3fc], 0
movzx eax, byte [ebp - 0x3fc]
test eax, eax
je 0x100312ba
mov ecx, dword [ebp - 0x3f4]
mov edx, dword [ecx]
mov dword [ebp - 0x400], edx
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x460], eax
lea ecx, [ebp - 0x180]
push ecx
mov edx, dword [ebp - 0x460]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x3e0], 0
mov dword [ebp - 0x3e4], 0
mov dword [ebp - 0x3e8], 0
mov dword [ebp - 0x3ec], 0
mov dword [ebp - 0x3d8], 0
mov dword [ebp - 0x3dc], 0
push 0x10075bd0
lea ecx, [ebp - 0x40]
call fcn.10034210
movzx eax, al
test eax, eax
je 0x10031e31
lea ecx, [ebp - 0x180]
push ecx
mov edx, dword [ebp - 0x424]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x10031e2c
mov eax, dword [ebp - 0x180]
and eax, 0x10
jne 0x10031e27
push str.logininfo.py
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5d0], esp
lea edx, [ebp - 0x154]
push edx
call fcn.100040a0
lea eax, [ebp - 0x1e0]
push eax
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x464], eax
mov ecx, dword [ebp - 0x464]
mov dword [ebp - 0x468], ecx
mov ecx, dword [ebp - 0x468]
call fcn.10034540
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0
jne 0x100313c2
mov dword [ebp - 0x404], 1
jmp 0x100313cc
mov dword [ebp - 0x404], 0
mov dl, byte [ebp - 0x404]
mov byte [ebp - 0x3c5], dl
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1e0]
call fcn.10006c00
mov byte [ebp - 4], 2
movzx eax, byte [ebp - 0x3c5]
test eax, eax
je 0x10031405
mov dword [ebp - 0x3e0], 1
jmp 0x10031e2c
push str.mssa3d.m3d
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5e4], esp
lea edx, [ebp - 0x154]
push edx
call fcn.100040a0
lea eax, [ebp - 0x210]
push eax
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x470], eax
mov ecx, dword [ebp - 0x470]
mov dword [ebp - 0x474], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x3c4]
or edx, 1
mov dword [ebp - 0x3c4], edx
mov ecx, dword [ebp - 0x474]
call fcn.10034540
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0
je 0x10031716
push str.mssds3d.m3d
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5e8], esp
lea eax, [ebp - 0x154]
push eax
call fcn.100040a0
lea ecx, [ebp - 0x3c0]
push ecx
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x47c], eax
mov edx, dword [ebp - 0x47c]
mov dword [ebp - 0x480], edx
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x3c4]
or eax, 2
mov dword [ebp - 0x3c4], eax
mov ecx, dword [ebp - 0x480]
call fcn.10034540
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0
je 0x10031716
push str.mssdx7.m3d
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5ec], esp
lea edx, [ebp - 0x154]
push edx
call fcn.100040a0
lea eax, [ebp - 0x198]
push eax
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x488], eax
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x48c], ecx
mov dword [ebp - 4], 7
mov edx, dword [ebp - 0x3c4]
or edx, 4
mov dword [ebp - 0x3c4], edx
mov ecx, dword [ebp - 0x48c]
call fcn.10034540
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 0
je 0x10031716
push str.msseax.m3d
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x594], esp
lea eax, [ebp - 0x154]
push eax
call fcn.100040a0
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x590], eax
mov edx, dword [ebp - 0x590]
mov dword [ebp - 0x58c], edx
mov dword [ebp - 4], 8
mov eax, dword [ebp - 0x3c4]
or eax, 8
mov dword [ebp - 0x3c4], eax
mov ecx, dword [ebp - 0x58c]
call fcn.10034540
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x588], 0
je 0x10031716
push str.mssrsx.m3d
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x598], esp
lea edx, [ebp - 0x154]
push edx
call fcn.100040a0
lea eax, [ebp - 0x1c8]
push eax
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x584], eax
mov ecx, dword [ebp - 0x584]
mov dword [ebp - 0x580], ecx
mov dword [ebp - 4], 9
mov edx, dword [ebp - 0x3c4]
or edx, 0x10
mov dword [ebp - 0x3c4], edx
mov ecx, dword [ebp - 0x580]
call fcn.10034540
mov dword [ebp - 0x57c], eax
cmp dword [ebp - 0x57c], 0
je 0x10031716
push str.mssrdx.m3d
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5f0], esp
lea eax, [ebp - 0x154]
push eax
call fcn.100040a0
lea ecx, [ebp - 0x360]
push ecx
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x578], eax
mov edx, dword [ebp - 0x578]
mov dword [ebp - 0x574], edx
mov dword [ebp - 4], 0xa
mov eax, dword [ebp - 0x3c4]
or eax, 0x20
mov dword [ebp - 0x3c4], eax
mov ecx, dword [ebp - 0x574]
call fcn.10034540
mov dword [ebp - 0x570], eax
cmp dword [ebp - 0x570], 0
je 0x10031716
push str.msssoft.m3d
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5a0], esp
lea edx, [ebp - 0x154]
push edx
call fcn.100040a0
lea eax, [ebp - 0x348]
push eax
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x56c], eax
mov ecx, dword [ebp - 0x56c]
mov dword [ebp - 0x568], ecx
mov edx, dword [ebp - 0x3c4]
or edx, 0x40
mov dword [ebp - 0x3c4], edx
mov ecx, dword [ebp - 0x568]
call fcn.10034540
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 0
je 0x10031716
mov dword [ebp - 0x408], 1
jmp 0x10031720
mov dword [ebp - 0x408], 0
mov al, byte [ebp - 0x408]
mov byte [ebp - 0x3c6], al
mov ecx, dword [ebp - 0x3c4]
and ecx, 0x40
je 0x10031750
and dword [ebp - 0x3c4], 0xffffffbf
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0x348]
call fcn.10006c00
mov dword [ebp - 4], 9
mov edx, dword [ebp - 0x3c4]
and edx, 0x20
je 0x1003177b
and dword [ebp - 0x3c4], 0xffffffdf
mov dword [ebp - 4], 0xc
lea ecx, [ebp - 0x360]
call fcn.10006c00
mov dword [ebp - 4], 8
mov eax, dword [ebp - 0x3c4]
and eax, 0x10
je 0x100317a6
and dword [ebp - 0x3c4], 0xffffffef
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0x1c8]
call fcn.10006c00
mov dword [ebp - 4], 7
mov ecx, dword [ebp - 0x3c4]
and ecx, 8
je 0x100317d1
and dword [ebp - 0x3c4], 0xfffffff7
mov dword [ebp - 4], 0xe
lea ecx, [ebp - 0x1b0]
call fcn.10006c00
mov dword [ebp - 4], 6
mov edx, dword [ebp - 0x3c4]
and edx, 4
je 0x100317fc
and dword [ebp - 0x3c4], 0xfffffffb
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0x198]
call fcn.10006c00
mov dword [ebp - 4], 5
mov eax, dword [ebp - 0x3c4]
and eax, 2
je 0x10031827
and dword [ebp - 0x3c4], 0xfffffffd
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 0x3c0]
call fcn.10006c00
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x3c4]
and ecx, 1
je 0x10031853
and dword [ebp - 0x3c4], 0xfffffffe
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x210]
call fcn.10006c00
mov byte [ebp - 4], 2
movzx edx, byte [ebp - 0x3c6]
test edx, edx
je 0x1003190a
push 0
push 0x10075c3c
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5a4], esp
lea eax, [ebp - 0x154]
push eax
call fcn.100040a0
lea ecx, [ebp - 0x3a8]
push ecx
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x560], eax
mov edx, dword [ebp - 0x560]
mov dword [ebp - 0x55c], edx
mov ecx, dword [ebp - 0x55c]
call fcn.10034740
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0xffffffff
je 0x100318c7
mov dword [ebp - 0x40c], 1
jmp 0x100318d1
mov dword [ebp - 0x40c], 0
mov al, byte [ebp - 0x40c]
mov byte [ebp - 0x3c7], al
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x3a8]
call fcn.10006c00
mov byte [ebp - 4], 2
movzx ecx, byte [ebp - 0x3c7]
test ecx, ecx
je 0x1003190a
mov dword [ebp - 0x3e4], 1
jmp 0x10031e2c
push str.mssmp3.asi
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5a8], esp
lea edx, [ebp - 0x154]
push edx
call fcn.100040a0
lea eax, [ebp - 0x2d0]
push eax
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x558], eax
mov ecx, dword [ebp - 0x558]
mov dword [ebp - 0x554], ecx
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x3c4]
or edx, 0x80
mov dword [ebp - 0x3c4], edx
mov ecx, dword [ebp - 0x554]
call fcn.10034540
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 0
je 0x10031a5f
push str.mssa3d.asi
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5ac], esp
lea eax, [ebp - 0x154]
push eax
call fcn.100040a0
lea ecx, [ebp - 0x378]
push ecx
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x54c], eax
mov edx, dword [ebp - 0x54c]
mov dword [ebp - 0x548], edx
mov dword [ebp - 4], 0x14
mov eax, dword [ebp - 0x3c4]
or eax, 0x100
mov dword [ebp - 0x3c4], eax
mov ecx, dword [ebp - 0x548]
call fcn.10034540
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0
je 0x10031a5f
push str.mssvoice.asi
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5b0], esp
lea edx, [ebp - 0x154]
push edx
call fcn.100040a0
lea eax, [ebp - 0x390]
push eax
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x53c], eax
mov ecx, dword [ebp - 0x53c]
mov dword [ebp - 0x538], ecx
mov edx, dword [ebp - 0x3c4]
or edx, 0x200
mov dword [ebp - 0x3c4], edx
mov ecx, dword [ebp - 0x538]
call fcn.10034540
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 0
je 0x10031a5f
mov dword [ebp - 0x410], 1
jmp 0x10031a69
mov dword [ebp - 0x410], 0
mov al, byte [ebp - 0x410]
mov byte [ebp - 0x3c8], al
mov ecx, dword [ebp - 0x3c4]
and ecx, 0x200
je 0x10031a9f
and dword [ebp - 0x3c4], 0xfffffdff
mov dword [ebp - 4], 0x15
lea ecx, [ebp - 0x390]
call fcn.10006c00
mov dword [ebp - 4], 0x13
mov edx, dword [ebp - 0x3c4]
and edx, 0x100
je 0x10031ad0
and dword [ebp - 0x3c4], 0xfffffeff
mov dword [ebp - 4], 0x16
lea ecx, [ebp - 0x378]
call fcn.10006c00
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x3c4]
and eax, 0x80
je 0x10031b01
and dword [ebp - 0x3c4], 0xffffff7f
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x2d0]
call fcn.10006c00
mov byte [ebp - 4], 2
movzx ecx, byte [ebp - 0x3c8]
test ecx, ecx
je 0x10031bb8
push 0
push 0x10075c6c
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5b8], esp
lea edx, [ebp - 0x154]
push edx
call fcn.100040a0
lea eax, [ebp - 0x330]
push eax
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x530], eax
mov ecx, dword [ebp - 0x530]
mov dword [ebp - 0x528], ecx
mov ecx, dword [ebp - 0x528]
call fcn.10034740
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 0xffffffff
je 0x10031b75
mov dword [ebp - 0x414], 1
jmp 0x10031b7f
mov dword [ebp - 0x414], 0
mov dl, byte [ebp - 0x414]
mov byte [ebp - 0x3c9], dl
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x330]
call fcn.10006c00
mov byte [ebp - 4], 2
movzx eax, byte [ebp - 0x3c9]
test eax, eax
je 0x10031bb8
mov dword [ebp - 0x3e8], 1
jmp 0x10031e2c
push str.mssdsp.flt
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5bc], esp
lea edx, [ebp - 0x154]
push edx
call fcn.100040a0
lea eax, [ebp - 0x318]
push eax
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x494], eax
mov ecx, dword [ebp - 0x494]
mov dword [ebp - 0x498], ecx
mov ecx, dword [ebp - 0x498]
call fcn.10034540
mov dword [ebp - 0x49c], eax
mov edx, dword [ebp - 0x49c]
mov dword [ebp - 0x4a0], edx
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x318]
call fcn.10006c00
mov byte [ebp - 4], 2
cmp dword [ebp - 0x4a0], 0
je 0x10031cda
push 0
push 0x10075c80
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5c0], esp
lea eax, [ebp - 0x154]
push eax
call fcn.100040a0
lea ecx, [ebp - 0x300]
push ecx
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x4a4], eax
mov edx, dword [ebp - 0x4a4]
mov dword [ebp - 0x4a8], edx
mov ecx, dword [ebp - 0x4a8]
call fcn.10034740
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 0xffffffff
je 0x10031c97
mov dword [ebp - 0x418], 1
jmp 0x10031ca1
mov dword [ebp - 0x418], 0
mov al, byte [ebp - 0x418]
mov byte [ebp - 0x3d2], al
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x300]
call fcn.10006c00
mov byte [ebp - 4], 2
movzx ecx, byte [ebp - 0x3d2]
test ecx, ecx
je 0x10031cda
mov dword [ebp - 0x3ec], 1
jmp 0x10031e2c
push 0
push 0x10075c88
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5c4], esp
lea edx, [ebp - 0x154]
push edx
call fcn.100040a0
lea eax, [ebp - 0x2e8]
push eax
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x4b0], eax
mov ecx, dword [ebp - 0x4b0]
mov dword [ebp - 0x4b4], ecx
mov ecx, dword [ebp - 0x4b4]
call fcn.10034740
mov dword [ebp - 0x4b8], eax
cmp dword [ebp - 0x4b8], 0xffffffff
je 0x10031d3f
mov dword [ebp - 0x41c], 1
jmp 0x10031d49
mov dword [ebp - 0x41c], 0
mov dl, byte [ebp - 0x41c]
mov byte [ebp - 0x3ca], dl
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x2e8]
call fcn.10006c00
mov byte [ebp - 4], 2
movzx eax, byte [ebp - 0x3ca]
test eax, eax
je 0x10031d82
mov dword [ebp - 0x3d8], 1
jmp 0x10031e2c
push 0
push 0x10075c90
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5c8], esp
lea edx, [ebp - 0x154]
push edx
call fcn.100040a0
lea eax, [ebp - 0x2b8]
push eax
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x4bc], eax
mov ecx, dword [ebp - 0x4bc]
mov dword [ebp - 0x4c0], ecx
mov ecx, dword [ebp - 0x4c0]
call fcn.10034740
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 0xffffffff
je 0x10031de7
mov dword [ebp - 0x420], 1
jmp 0x10031df1
mov dword [ebp - 0x420], 0
mov dl, byte [ebp - 0x420]
mov byte [ebp - 0x3cb], dl
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x2b8]
call fcn.10006c00
mov byte [ebp - 4], 2
movzx eax, byte [ebp - 0x3cb]
test eax, eax
je 0x10031e27
mov dword [ebp - 0x3dc], 1
jmp 0x10031e2c
jmp 0x10031334
jmp 0x1003224e
lea ecx, [ebp - 0x180]
push ecx
mov edx, dword [ebp - 0x424]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1003224e
mov eax, dword [ebp - 0x180]
and eax, 0x10
jne 0x10032249
push 0
push 0x10075c98
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5cc], esp
lea edx, [ebp - 0x154]
push edx
call fcn.100040a0
lea eax, [ebp - 0x2a0]
push eax
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x4c8], eax
mov ecx, dword [ebp - 0x4c8]
mov dword [ebp - 0x4cc], ecx
mov ecx, dword [ebp - 0x4cc]
call fcn.10034740
mov dword [ebp - 0x4d0], eax
cmp dword [ebp - 0x4d0], 0xffffffff
je 0x10031ec1
mov dword [ebp - 0x428], 1
jmp 0x10031ecb
mov dword [ebp - 0x428], 0
mov dl, byte [ebp - 0x428]
mov byte [ebp - 0x3cc], dl
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x2a0]
call fcn.10006c00
mov byte [ebp - 4], 2
movzx eax, byte [ebp - 0x3cc]
test eax, eax
je 0x10031f04
mov dword [ebp - 0x3e4], 1
jmp 0x1003224e
push 0
push 0x10075ca0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5b4], esp
lea edx, [ebp - 0x154]
push edx
call fcn.100040a0
lea eax, [ebp - 0x288]
push eax
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x4d4], eax
mov ecx, dword [ebp - 0x4d4]
mov dword [ebp - 0x4d8], ecx
mov ecx, dword [ebp - 0x4d8]
call fcn.10034740
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0xffffffff
je 0x10031f69
mov dword [ebp - 0x42c], 1
jmp 0x10031f73
mov dword [ebp - 0x42c], 0
mov dl, byte [ebp - 0x42c]
mov byte [ebp - 0x3cd], dl
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x288]
call fcn.10006c00
mov byte [ebp - 4], 2
movzx eax, byte [ebp - 0x3cd]
test eax, eax
je 0x10031fac
mov dword [ebp - 0x3e8], 1
jmp 0x1003224e
push 0
push 0x10075ca8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5d4], esp
lea edx, [ebp - 0x154]
push edx
call fcn.100040a0
lea eax, [ebp - 0x270]
push eax
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x4e0], eax
mov ecx, dword [ebp - 0x4e0]
mov dword [ebp - 0x4e4], ecx
mov ecx, dword [ebp - 0x4e4]
call fcn.10034740
mov dword [ebp - 0x4e8], eax
cmp dword [ebp - 0x4e8], 0xffffffff
je 0x10032011
mov dword [ebp - 0x430], 1
jmp 0x1003201b
mov dword [ebp - 0x430], 0
mov dl, byte [ebp - 0x430]
mov byte [ebp - 0x3ce], dl
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x270]
call fcn.10006c00
mov byte [ebp - 4], 2
movzx eax, byte [ebp - 0x3ce]
test eax, eax
je 0x10032054
mov dword [ebp - 0x3ec], 1
jmp 0x1003224e
push 0
push 0x10075cb0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5d8], esp
lea edx, [ebp - 0x154]
push edx
call fcn.100040a0
lea eax, [ebp - 0x258]
push eax
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x4ec], eax
mov ecx, dword [ebp - 0x4ec]
mov dword [ebp - 0x4f0], ecx
mov ecx, dword [ebp - 0x4f0]
call fcn.10034740
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 0xffffffff
je 0x100320b9
mov dword [ebp - 0x434], 1
jmp 0x100320c3
mov dword [ebp - 0x434], 0
mov dl, byte [ebp - 0x434]
mov byte [ebp - 0x3d1], dl
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x258]
call fcn.10006c00
mov byte [ebp - 4], 2
movzx eax, byte [ebp - 0x3d1]
test eax, eax
je 0x100320fc
mov dword [ebp - 0x3d8], 1
jmp 0x1003224e
push 0
push 0x10075cb8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5dc], esp
lea edx, [ebp - 0x154]
push edx
call fcn.100040a0
lea eax, [ebp - 0x240]
push eax
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x4f8], eax
mov ecx, dword [ebp - 0x4f8]
mov dword [ebp - 0x4fc], ecx
mov ecx, dword [ebp - 0x4fc]
call fcn.10034740
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x500], 0xffffffff
je 0x10032161
mov dword [ebp - 0x438], 1
jmp 0x1003216b
mov dword [ebp - 0x438], 0
mov dl, byte [ebp - 0x438]
mov byte [ebp - 0x3d0], dl
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x240]
call fcn.10006c00
mov byte [ebp - 4], 2
movzx eax, byte [ebp - 0x3d0]
test eax, eax
je 0x100321a4
mov dword [ebp - 0x3e0], 1
jmp 0x1003224e
push 0
push 0x10075cbc
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5e0], esp
lea edx, [ebp - 0x154]
push edx
call fcn.100040a0
lea eax, [ebp - 0x228]
push eax
call fcn.10034970
add esp, 0x1c
mov dword [ebp - 0x504], eax
mov ecx, dword [ebp - 0x504]
mov dword [ebp - 0x508], ecx
mov ecx, dword [ebp - 0x508]
call fcn.10034740
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 0xffffffff
je 0x10032209
mov dword [ebp - 0x43c], 1
jmp 0x10032213
mov dword [ebp - 0x43c], 0
mov dl, byte [ebp - 0x43c]
mov byte [ebp - 0x3cf], dl
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x228]
call fcn.10006c00
mov byte [ebp - 4], 2
movzx eax, byte [ebp - 0x3cf]
test eax, eax
je 0x10032249
mov dword [ebp - 0x3dc], 1
jmp 0x1003224e
jmp 0x10031e31
cmp dword [ebp - 0x3e0], 0
jne 0x10032288
cmp dword [ebp - 0x3e4], 0
jne 0x10032288
cmp dword [ebp - 0x3e8], 0
jne 0x10032288
cmp dword [ebp - 0x3ec], 0
jne 0x10032288
cmp dword [ebp - 0x3d8], 0
jne 0x10032288
cmp dword [ebp - 0x3dc], 0
je 0x1003248f
lea ecx, [ebp - 0x28]
call fcn.10004160
mov byte [ebp - 4], 0x23
cmp dword [ebp - 0x3e0], 1
jne 0x100322c4
push 0x10075cc4
call fcn.10051cf0
add esp, 4
mov dword [ebp - 0x510], eax
mov ecx, dword [ebp - 0x510]
push ecx
push 0x10075cc4
lea ecx, [ebp - 0x28]
call fcn.10006eb0
cmp dword [ebp - 0x3e4], 1
jne 0x100322f4
push str..m3d
call fcn.10051cf0
add esp, 4
mov dword [ebp - 0x514], eax
mov edx, dword [ebp - 0x514]
push edx
push str..m3d
lea ecx, [ebp - 0x28]
call fcn.10006eb0
cmp dword [ebp - 0x3e8], 1
jne 0x10032324
push str..asi
call fcn.10051cf0
add esp, 4
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0x518]
push eax
push str..asi
lea ecx, [ebp - 0x28]
call fcn.10006eb0
cmp dword [ebp - 0x3ec], 1
jne 0x10032354
push str..flt
call fcn.10051cf0
add esp, 4
mov dword [ebp - 0x51c], eax
mov ecx, dword [ebp - 0x51c]
push ecx
push str..flt
lea ecx, [ebp - 0x28]
call fcn.10006eb0
cmp dword [ebp - 0x3d8], 1
jne 0x10032384
push str..mix
call fcn.10051cf0
add esp, 4
mov dword [ebp - 0x520], eax
mov edx, dword [ebp - 0x520]
push edx
push str..mix
lea ecx, [ebp - 0x28]
call fcn.10006eb0
cmp dword [ebp - 0x3dc], 1
jne 0x100323b4
push str..ahk
call fcn.10051cf0
add esp, 4
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x524]
push eax
push str..ahk
lea ecx, [ebp - 0x28]
call fcn.10006eb0
push 1
push 0x40
push 8
push 0x10075cf0
lea ecx, [ebp - 0x6a0]
call fcn.10008f60
mov byte [ebp - 4], 0x24
push str._file_extension_detected
lea ecx, [ebp - 0x28]
push ecx
push str._Folder
lea edx, [ebp + 8]
push edx
push 0x10075d24
lea eax, [ebp - 0x6a0]
push eax
call fcn.10007880
add esp, 8
push eax
call fcn.10016680
add esp, 8
push eax
call fcn.10007880
add esp, 8
push eax
call fcn.10016680
add esp, 8
push eax
call fcn.10007880
add esp, 8
lea ecx, [ebp - 0x6a0]
call fcn.1000d930
push 5
push 0
push 0
push str.Logs.txt
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.10022100
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x638]
call fcn.10009be0
lea ecx, [ebp - 0x638]
mov dword [ebp - 0x3f8], ecx
mov edx, dword [ebp - 0x3f8]
mov dword [edx], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov byte [ebp - 4], 0x25
mov eax, dword [ebp - 0x3f8]
mov dword [eax], vtable.std::ios_base.0
mov ecx, dword [ebp - 0x3f8]
push ecx
call fcn.1004aff1
add esp, 4
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x28]
call fcn.10006c00
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x40]
call fcn.10006c00
mov dword [ebp - 4], 0x28
lea ecx, [ebp + 8]
call fcn.10006c00
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004c5a5
mov esp, ebp
pop ebp
ret