Function at 0x10001320
Capabilities:
Create thread
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100693ae
mov eax, dword fs:[0]
push eax
mov eax, 0x1758
call fcn.10014500
mov eax, dword [0x10082094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x147c], edi
mov dword [ebp - 0x1544], edi
lea eax, [edi + 0x30]
mov dword [ebp - 4], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x14], 7
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], 0
jb 0x1000138d
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 0x48], ecx
mov dword [edi + 0x4c], ecx
mov dword [edi + 0x50], ecx
mov dword [edi + 0x54], ecx
mov dword [edi + 0x58], ecx
mov dword [edi + 0x5c], ecx
mov dword [edi + 0x60], ecx
mov dword [edi + 0x64], ecx
mov dword [edi + 0x68], ecx
lea esi, [edi + 0x407c]
mov byte [ebp - 4], 4
mov dword [ebp - 0x147c], esi
push 8
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ecx
call fcn.10013dd1
add esp, 4
test eax, eax
jne 0x100013de
call fcn.1003dff5
mov dword [esi], eax
xor ecx, ecx
xor edx, edx
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [ebp - 0x154c], ecx
mov dword [ebp - 0x1548], edx
mov dword [eax], esi
lea esi, [edi + 0x4090]
mov byte [ebp - 4], 5
mov dword [ebp - 0x147c], esi
push 8
mov dword [esi], edx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], edx
call fcn.10013dd1
add esp, 4
test eax, eax
jne 0x1000142a
call fcn.1003dff5
mov dword [esi], eax
xor ecx, ecx
xor edx, edx
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [ebp - 0x1554], ecx
mov dword [ebp - 0x1550], edx
mov dword [eax], esi
lea eax, [edi + 0x40a8]
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x14], 7
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], edx
jb 0x10001463
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea esi, [edi + 0x40d0]
mov byte [ebp - 4], 7
mov dword [ebp - 0x147c], esi
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov ecx, esi
call fcn.1000c370
mov dword [esi], eax
lea eax, [edi + 0x40e0]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x14], 7
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], 0
jb 0x100014b2
mov ecx, dword [eax]
jmp 0x100014b4
mov ecx, eax
add eax, 0x2c
xor edx, edx
mov word [ecx], dx
mov dword [eax + 0x14], 7
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], edx
jb 0x100014ce
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 0x4124], ecx
mov dword [edi + 0x4128], ecx
mov dword [edi + 0x412c], ecx
mov dword [edi + 0x4130], ecx
mov dword [edi + 0x4134], ecx
mov dword [edi + 0x4138], ecx
mov dword [edi + 0x413c], ecx
mov dword [edi + 0x4140], ecx
mov dword [edi + 0x4144], ecx
lea eax, [edi + 0x4180]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x14], 7
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], ecx
jb 0x10001527
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 4], 0xd
call fcn.1000b800
mov ecx, eax
test ecx, ecx
jne 0x10001545
push 0x80004005
call fcn.1000b380
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [edi + 0x4198], eax
lea eax, [edi + 0x419c]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x14], 7
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], 0
jb 0x1000157f
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
push ecx
mov dword [edi + 0x4178], ecx
mov dword [edi + 0x417c], ecx
lea ecx, [edi + 0x4198]
push 0x1006c564
mov byte [ebp - 4], 0xf
call fcn.1000c060
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [edi + 0x4170], eax
lea ecx, [edi + 0x407c]
mov dword [0x100a2574], 0
mov dword [edi + 0x416c], 0
mov byte [edi], 0
mov byte [edi + 0x14], 1
mov byte [0x10084430], 0
mov dword [edi + 0x28], 0x1000000
mov word [edi + 0x24], 1
mov dword [edi + 0x40d8], 0
mov dword [edi + 0x40dc], 0
mov word [edi + 0x415c], 0
mov byte [edi + 0x415e], 0
mov byte [edi + 0x27], 0
mov dword [0x10084444], 0
mov dword [edi + 0x4160], 0xffffffff
mov dword [edi + 0x4164], 0xffffffff
mov byte [edi + 0x2c], 0
mov dword [edi + 0x40a4], 0
call fcn.1000cd30
lea ecx, [edi + 0x4090]
call fcn.1000cd30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x4000000
push 0x4000000
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
call esi
push 0
push 0
push 1
push 0
mov dword [edi + 8], eax
call esi
push 0
push 0
push 0
push 0
mov dword [edi + 0xc], eax
call esi
push 0
push 0
push 0
push 0
mov dword [edi + 0x10], eax
call esi
push str.GlobalPCAScannerMutex
push 0
push 0x1f0001
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x10084440], eax
cmp dword [0x10084440], 0
je 0x100016c7
mov byte [0x10084431], 0
jmp 0x1000174d
lea eax, [ebp - 0x144c]
mov byte [ebp - 0x144c], 0
xorps xmm0, xmm0
mov word [ebp - 0x143b], 0
push 1
push eax
movups xmmword [ebp - 0x144b], xmm0
mov byte [ebp - 0x1439], 0
call fcn.1000f630
add esp, 8
lea eax, [ebp - 0x144c]
push 0
push 0
push 1
push eax
call dword [0x100a2950]
xorps xmm0, xmm0
mov dword [ebp - 0x1478], 0xc
lea eax, [ebp - 0x144c]
movq qword [ebp - 0x1474], xmm0
push str.GlobalPCAScannerMutex
mov dword [ebp - 0x1474], eax
lea eax, [ebp - 0x1478]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10084440], eax
mov byte [0x10084431], 1
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.10036890
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001780
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
dec ecx
cmp word [eax + ecx*2], 0x5c
lea eax, [eax + ecx*2]
je 0x100017b8
xor edx, edx
lea ecx, [ecx - 1]
mov word [eax], dx
lea eax, [ebp - 0x420]
cmp word [eax + ecx*2], 0x5c
lea eax, [eax + ecx*2]
jne 0x100017a0
cmp word [ebp - 0x420], 0
jne 0x100017c6
xor ecx, ecx
jmp 0x100017df
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100017d0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x420]
push eax
lea ecx, [edi + 0x30]
call fcn.1000d890
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10036890
add esp, 0xc
mov ecx, 0x23
cmp byte [ebp + 0x20], 0
mov eax, 0x1c
cmovne eax, ecx
push 0
push eax
lea eax, [ebp - 0x218]
push eax
push 0
call dword [0x100a2940]
lea eax, [ebp - 0x147c]
push eax
call fcn.1000b970
add esp, 4
push dword [eax]
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0x10
push eax
call dword [0x100a2920]
mov edx, dword [ebp - 0x147c]
or eax, 0xffffffff
mov byte [ebp - 4], 0xf
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1000186c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x218]
push eax
call dword [0x100a292c]
test eax, eax
jne 0x1000188c
lea eax, [ebp - 0x218]
push eax
call fcn.100094c0
add esp, 4
lea eax, [ebp - 0x218]
push eax
push 0x100
push 0x100a2578
call fcn.1003e79d
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x1006c958
push eax
call dword [0x100a2920]
lea eax, [ebp - 0x218]
push eax
call dword [0x100a292c]
test eax, eax
jne 0x100018d7
lea eax, [ebp - 0x218]
push eax
call fcn.100094c0
add esp, 4
xor eax, eax
mov dword [ebp - 0x1484], 7
mov dword [ebp - 0x1488], 0
mov word [ebp - 0x1498], ax
cmp word [0x100a2578], ax
jne 0x10001901
xor ecx, ecx
jmp 0x1000191f
mov ecx, 0x100a2578
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001910
sub ecx, edx
sar ecx, 1
push ecx
push 0x100a2578
lea ecx, [ebp - 0x1498]
call fcn.1000d890
push str.RPCA.conf
lea eax, [ebp - 0x1498]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x14b0]
push eax
call fcn.10009f40
add esp, 0xc
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x12
jb 0x1000195b
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call fcn.1000f0e0
mov esi, eax
add esp, 0x1c
mov eax, dword [ebp - 0x149c]
cmp eax, 8
jb 0x10001996
inc eax
lea ecx, [ebp - 0x14b0]
push eax
push dword [ebp - 0x14b0]
call fcn.1000da60
xor eax, eax
mov dword [ebp - 0x149c], 7
mov word [ebp - 0x14b0], ax
mov eax, dword [ebp - 0x1484]
mov dword [ebp - 0x14a0], 0
mov byte [ebp - 4], 0xf
cmp eax, 8
jb 0x100019d5
inc eax
lea ecx, [ebp - 0x1498]
push eax
push dword [ebp - 0x1498]
call fcn.1000da60
xor eax, eax
mov dword [ebp - 0x1484], 7
mov dword [ebp - 0x1488], 0
mov word [ebp - 0x1498], ax
cmp esi, 0xffffffff
je 0x10001cba
push eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0x800
lea eax, [ebp - 0xc20]
push 0
push eax
call fcn.10036890
push str.PidFile__
lea eax, [ebp - 0xc20]
push 0x800
push eax
call fcn.1003f5f3
add esp, 0x18
push str.RPCA.pid
sub esp, 0x18
mov ecx, esp
push 0x100a2578
call fcn.1000a920
lea eax, [ebp - 0x14e0]
push eax
call fcn.10008c20
add esp, 0x1c
push eax
lea eax, [ebp - 0x14c8]
mov byte [ebp - 4], 0x13
push eax
call fcn.10009c60
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x10001a77
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc20]
push 0x800
push eax
call fcn.1003f6b6
mov eax, dword [ebp - 0x14b4]
add esp, 0xc
cmp eax, 0x10
jb 0x10001aaa
inc eax
lea ecx, [ebp - 0x14c8]
push eax
push dword [ebp - 0x14c8]
call fcn.1000d9b0
mov eax, dword [ebp - 0x14cc]
mov dword [ebp - 0x14b4], 0xf
mov dword [ebp - 0x14b8], 0
mov byte [ebp - 0x14c8], 0
mov byte [ebp - 4], 0xf
cmp eax, 0x10
jb 0x10001ae7
inc eax
lea ecx, [ebp - 0x14e0]
push eax
push dword [ebp - 0x14e0]
call fcn.1000d9b0
push str.__r_nLogFile__
lea eax, [ebp - 0xc20]
mov dword [ebp - 0x14cc], 0xf
push 0x800
push eax
mov dword [ebp - 0x14d0], 0
mov byte [ebp - 0x14e0], 0
call fcn.1003f6b6
add esp, 0xc
push str.RPCA.log
sub esp, 0x18
mov ecx, esp
push 0x100a2578
call fcn.1000a920
lea eax, [ebp - 0x1510]
push eax
call fcn.10008c20
add esp, 0x1c
push eax
lea eax, [ebp - 0x14f8]
mov byte [ebp - 4], 0x14
push eax
call fcn.10009c60
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x10001b5a
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc20]
push 0x800
push eax
call fcn.1003f6b6
mov eax, dword [ebp - 0x14e4]
add esp, 0xc
cmp eax, 0x10
jb 0x10001b8d
inc eax
lea ecx, [ebp - 0x14f8]
push eax
push dword [ebp - 0x14f8]
call fcn.1000d9b0
mov eax, dword [ebp - 0x14fc]
mov dword [ebp - 0x14e4], 0xf
mov dword [ebp - 0x14e8], 0
mov byte [ebp - 0x14f8], 0
mov byte [ebp - 4], 0xf
cmp eax, 0x10
jb 0x10001bca
inc eax
lea ecx, [ebp - 0x1510]
push eax
push dword [ebp - 0x1510]
call fcn.1000d9b0
push str.__r_nDatabaseDirectory__
lea eax, [ebp - 0xc20]
mov dword [ebp - 0x14fc], 0xf
push 0x800
push eax
mov dword [ebp - 0x1500], 0
mov byte [ebp - 0x1510], 0
call fcn.1003f6b6
add esp, 0xc
push str.database
sub esp, 0x18
mov ecx, esp
push 0x100a2578
call fcn.1000a920
lea eax, [ebp - 0x171c]
push eax
call fcn.10008c20
add esp, 0x1c
push eax
lea eax, [ebp - 0x174c]
mov byte [ebp - 4], 0x15
push eax
call fcn.10009c60
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x10001c3d
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc20]
push 0x800
push eax
call fcn.1003f6b6
add esp, 0xc
lea ecx, [ebp - 0x174c]
call fcn.1000ab70
lea ecx, [ebp - 0x171c]
mov byte [ebp - 4], 0xf
call fcn.1000ab70
push str.__r_nTCPSocket_3310_r_nTCPAddr_127.0.0.1_r_nSelfCheck_0_r_nDisableCertCheck_yes_r_nForceToDisk_no_r_nScanELF_no_r_nPhishingSignatures_no_r_nPhishingScanURLs_no_r_n
lea eax, [ebp - 0xc20]
push 0x800
push eax
call fcn.1003f6b6
lea ecx, [ebp - 0xc20]
add esp, 0xc
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001c90
push 0
lea eax, [ebp - 0x1468]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0xc20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.1000ef70
add esp, 4
push 0x100a2578
lea ecx, [ebp - 0x1540]
call fcn.1000a920
push str.PCAU.conf
push eax
lea eax, [ebp - 0x1528]
mov byte [ebp - 4], 0x16
push eax
call fcn.10009f40
add esp, 0xc
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x17
jb 0x10001cef
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call fcn.1000f0e0
mov esi, eax
add esp, 0x1c
mov eax, dword [ebp - 0x1514]
cmp eax, 8
jb 0x10001d2a
inc eax
lea ecx, [ebp - 0x1528]
push eax
push dword [ebp - 0x1528]
call fcn.1000da60
xor eax, eax
mov dword [ebp - 0x1514], 7
mov word [ebp - 0x1528], ax
mov eax, dword [ebp - 0x152c]
mov dword [ebp - 0x1518], 0
mov byte [ebp - 4], 0xf
cmp eax, 8
jb 0x10001d69
inc eax
lea ecx, [ebp - 0x1540]
push eax
push dword [ebp - 0x1540]
call fcn.1000da60
xor eax, eax
mov dword [ebp - 0x152c], 7
mov dword [ebp - 0x1530], 0
mov word [ebp - 0x1540], ax
cmp esi, 0xffffffff
je 0x10001ebf
push eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [ebp + 0x18], 0
jne 0x10001db3
push str.database.clamav.net
lea ecx, [ebp + 8]
call fcn.1000aec0
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x16ec]
push str.DatabaseMirror
push eax
call fcn.1000a0b0
push str._r_nScriptedUpdates_yes
push eax
lea eax, [ebp - 0x1734]
mov byte [ebp - 4], 0x18
push eax
call fcn.10009f40
add esp, 0x18
lea ecx, [ebp + 8]
push eax
call fcn.1000ae40
lea ecx, [ebp - 0x1734]
call fcn.1000abb0
lea ecx, [ebp - 0x16ec]
mov byte [ebp - 4], 0xf
call fcn.1000abb0
push 0x800
lea eax, [ebp - 0x1420]
push 0
push eax
call fcn.10036890
sub esp, 0xc
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 7
cmp dword [ecx + 0x14], 8
mov dword [ecx + 0x10], 0
jb 0x10001e42
mov eax, dword [ecx]
jmp 0x10001e44
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp + 8]
push edx
push eax
call fcn.1000d770
lea eax, [ebp - 0x168c]
push eax
call fcn.10008c20
add esp, 0x1c
cmp dword [eax + 0x14], 0x10
jb 0x10001e6c
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x1420]
push 0x800
push eax
call fcn.1003f6b6
add esp, 0xc
lea ecx, [ebp - 0x168c]
call fcn.1000ab70
lea ecx, [ebp - 0x1420]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001e95
push 0
lea eax, [ebp - 0x146c]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x1420]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.1000ef70
add esp, 4
push 0x1006c5a0
push 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x1c], 0
call fcn.10048cc9
xor eax, eax
xorps xmm0, xmm0
mov word [ebp - 0x1438], ax
mov dword [ebp - 0x142e], eax
mov word [ebp - 0x142a], ax
mov dword [ebp - 0x1428], eax
mov dword [ebp - 0x1424], eax
lea eax, [ebp - 0x1438]
push eax
movq qword [ebp - 0x1436], xmm0
call fcn.1000f710
lea eax, [ebp - 0x1428]
push eax
lea eax, [ebp - 0x1438]
push eax
call fcn.1000f4a0
mov ecx, dword [ebp - 0x1424]
add esp, 0x14
and ecx, 0x7fffffff
xor eax, eax
or eax, dword [ebp - 0x1428]
mov dword [edi + 0x74], ecx
lea ecx, [ebp - 0x162c]
push 0x1006cb00
mov dword [edi + 0x70], eax
call fcn.1000a920
lea eax, [ebp - 0x162c]
mov byte [ebp - 4], 0x19
push eax
lea ecx, [edi + 0x48]
call fcn.1000e6f0
lea ecx, [ebp - 0x162c]
mov byte [ebp - 4], 0xf
call fcn.1000abb0
push 0x1006cb08
lea ecx, [ebp - 0x1644]
call fcn.1000a920
lea eax, [ebp - 0x1644]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [edi + 0x48]
call fcn.1000e6f0
lea ecx, [ebp - 0x1644]
mov byte [ebp - 4], 0xf
call fcn.1000abb0
push 0x1006cb10
lea ecx, [ebp - 0x165c]
call fcn.1000a920
lea eax, [ebp - 0x165c]
mov byte [ebp - 4], 0x1b
push eax
lea ecx, [edi + 0x48]
call fcn.1000e6f0
lea ecx, [ebp - 0x165c]
mov byte [ebp - 4], 0xf
call fcn.1000abb0
push 0x1006cb18
lea ecx, [ebp - 0x1674]
call fcn.1000a920
lea eax, [ebp - 0x1674]
mov byte [ebp - 4], 0x1c
push eax
lea ecx, [edi + 0x48]
call fcn.1000e6f0
lea ecx, [ebp - 0x1674]
mov byte [ebp - 4], 0xf
call fcn.1000abb0
push 0x1006cb20
lea ecx, [ebp - 0x156c]
call fcn.1000a920
mov byte [ebp - 4], 0x1d
lea eax, [ebp - 0x156c]
push eax
lea ecx, [edi + 0x48]
call fcn.1000e6f0
lea ecx, [ebp - 0x156c]
mov byte [ebp - 4], 0xf
call fcn.1000abb0
push 0x1006cb28
lea ecx, [ebp - 0x1584]
call fcn.1000a920
lea eax, [ebp - 0x1584]
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [edi + 0x48]
call fcn.1000e6f0
lea ecx, [ebp - 0x1584]
mov byte [ebp - 4], 0xf
call fcn.1000abb0
push 0x1006cb30
lea ecx, [ebp - 0x159c]
call fcn.1000a920
lea eax, [ebp - 0x159c]
mov byte [ebp - 4], 0x1f
push eax
lea ecx, [edi + 0x48]
call fcn.1000e6f0
lea ecx, [ebp - 0x159c]
mov byte [ebp - 4], 0xf
call fcn.1000abb0
push 0x1006cb38
lea ecx, [ebp - 0x15b4]
call fcn.1000a920
lea eax, [ebp - 0x15b4]
mov byte [ebp - 4], 0x20
push eax
lea ecx, [edi + 0x48]
call fcn.1000e6f0
lea ecx, [ebp - 0x15b4]
mov byte [ebp - 4], 0xf
call fcn.1000abb0
push 0x1006cb40
lea ecx, [ebp - 0x15cc]
call fcn.1000a920
lea eax, [ebp - 0x15cc]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [edi + 0x48]
call fcn.1000e6f0
lea ecx, [ebp - 0x15cc]
mov byte [ebp - 4], 0xf
call fcn.1000abb0
push 0x1006cb48
lea ecx, [ebp - 0x15e4]
call fcn.1000a920
lea eax, [ebp - 0x15e4]
mov byte [ebp - 4], 0x22
push eax
lea ecx, [edi + 0x48]
call fcn.1000e6f0
lea ecx, [ebp - 0x15e4]
mov byte [ebp - 4], 0xf
call fcn.1000abb0
push 0x1006cb50
lea ecx, [ebp - 0x15fc]
call fcn.1000a920
lea eax, [ebp - 0x15fc]
mov byte [ebp - 4], 0x23
push eax
lea ecx, [edi + 0x48]
call fcn.1000e6f0
lea ecx, [ebp - 0x15fc]
mov byte [ebp - 4], 0xf
call fcn.1000abb0
push 0x1006cb58
lea ecx, [ebp - 0x1614]
call fcn.1000a920
lea eax, [ebp - 0x1614]
mov byte [ebp - 4], 0x24
push eax
lea ecx, [edi + 0x48]
call fcn.1000e6f0
lea ecx, [ebp - 0x1614]
mov byte [ebp - 4], 0xf
call fcn.1000abb0
push 0x100a2578
lea ecx, [ebp - 0x16a4]
call fcn.1000a920
push str.databasemain.cvd
push eax
lea eax, [ebp - 0x1464]
mov byte [ebp - 4], 0x25
push eax
call fcn.10009f40
add esp, 0xc
lea ecx, [ebp - 0x16a4]
mov byte [ebp - 4], 0x27
call fcn.1000abb0
cmp dword [ebp - 0x1450], 8
lea eax, [ebp - 0x1464]
cmovae eax, dword [ebp - 0x1464]
push eax
call dword [0x100a292c]
test eax, eax
je 0x10002242
cmp dword [ebp - 0x1450], 8
lea eax, [ebp - 0x1464]
push 0
cmovae eax, dword [ebp - 0x1464]
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call fcn.1000f0e0
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x10002242
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jne 0x10002237
mov byte [edi + 0x2b], al
push esi
call fcn.1000ef70
add esp, 4
jmp 0x10002246
mov byte [edi + 0x2b], 0
cmp byte [edi + 0x2b], 0
je 0x10002253
mov ecx, edi
call fcn.10006a30
push 0x100a2578
lea ecx, [ebp - 0x16d4]
call fcn.1000a920
push str.RPCA.tm
push eax
lea eax, [ebp - 0x16bc]
mov byte [ebp - 4], 0x28
push eax
call fcn.10009f40
add esp, 0xc
lea ecx, [edi + 0x4180]
push eax
call fcn.1000ae40
lea ecx, [ebp - 0x16bc]
call fcn.1000abb0
lea ecx, [ebp - 0x16d4]
mov byte [ebp - 4], 0x27
call fcn.1000abb0
push 0x100a2578
lea ecx, [ebp - 0x1704]
call fcn.1000a920
push str.RPCACheck.tm
push eax
lea eax, [ebp - 0x1764]
mov byte [ebp - 4], 0x29
push eax
call fcn.10009f40
add esp, 0xc
lea ecx, [edi + 0x419c]
push eax
call fcn.1000ae40
lea ecx, [ebp - 0x1764]
call fcn.1000abb0
lea ecx, [ebp - 0x1704]
mov byte [ebp - 4], 0x27
call fcn.1000abb0
call fcn.10009750
test eax, eax
setg al
cmp dword [0x10084434], 0
jne 0x10002323
test al, al
jne 0x10002323
push 0
push 0
push edi
push 0x10002d20
push 0
push 0
call fcn.10048b4f
add esp, 0x18
mov dword [0x10084434], eax
cmp byte [edi + 0x2b], 0
jne 0x1000234b
cmp dword [0x1008443c], 0
jne 0x1000234b
push 0x7d0
mov byte [0x10084431], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, edi
call fcn.10007a80
lea ecx, [ebp - 0x1464]
call fcn.1000abb0
lea ecx, [ebp + 8]
call fcn.1000abb0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100143ff
mov esp, ebp
pop ebp
ret 0x1c