Function at 0x100738e
Capabilities:
Contain obfuscated stackstrings
Delete file
Move file
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x8bec
call fcn.0100e330
mov ecx, dword [ebp + 0x10]
mov eax, dword [0x101348c]
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
mov dword [ebp - 0x8bac], ecx
lea ecx, [ebp - 0x8ba0]
push ecx
lea ecx, [ebp - 0x8bc4]
push ecx
lea ecx, [ebp - 0x8bec]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ecx
push eax
push edi
mov dword [ebp - 0x8bb0], edi
mov dword [ebp - 0x8bb8], eax
mov dword [ebp - 0x8bd4], ebx
mov dword [ebp - 0x8bc0], ebx
mov dword [ebp - 0x8bcc], ebx
call fcn.01008082
cmp eax, 0xfffffc15
jne 0x1007401
xor eax, eax
jmp 0x1007be4
neg eax
test al, 7
je 0x1007411
mov dword [ebp - 0x8bc0], 1
cmp word [ebp - 0x8aa0], bx
ja 0x1007423
mov word [ebp - 0x8aa0], 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0xa7280
push 0x42
mov dword [0x1033928], ebx
mov dword [ebp - 0x8ba4], 0x200000
call esi
push dword [ebp - 0x8ba4]
mov dword [0x103392c], eax
push 0x42
call esi
cmp eax, ebx
mov dword [0x1033930], eax
je 0x1007464
mov eax, dword [0x103392c]
cmp eax, ebx
jne 0x1007471
push 1
push edi
push 0x3ec
jmp 0x1007b97
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebx
mov dword [ebp - 0x8bd8], eax
je 0x1007b8f
push dword [0x1033930]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebx
mov dword [ebp - 0x8bd0], eax
je 0x1007b8f
push 0x4b0
push 0x42
call esi
push eax
mov dword [ebp - 0x8bb4], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebx
mov dword [ebp - 0x8be0], eax
je 0x1007b8f
mov esi, dword [ebp - 0x8bb8]
lea ecx, [ebp - 0x8ba0]
push ecx
push eax
lea eax, [ebp - 0x8bdc]
push eax
lea eax, [ebp - 0x8be8]
push eax
push esi
push edi
call fcn.010093b2
cmp eax, 0xfffffc15
je 0x1007b9c
push 3
push 0x80000000
push esi
push edi
call fcn.0100c756
cmp eax, 0xffffffff
mov dword [0x103393c], eax
je 0x1007b9c
push esi
push dword [ebp - 0x8bac]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1007593
push 0x200
lea eax, [ebp - 0x42c]
push eax
push 0x3c
push ebx
mov dword [ebp - 0x8bcc], 1
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x42c]
push eax
push esi
lea eax, [ebp - 0xa34]
push 0x1001464
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0xa34]
push eax
push edi
call fcn.0100b74c
test eax, eax
je 0x1007971
push ebx
mov esi, 0x1001448
push esi
call fcn.0100e6ba
test eax, eax
pop ecx
pop ecx
jne 0x1007589
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 2
push 0xc0000000
push esi
jmp 0x10075a0
push 2
push 0xc0000000
push dword [ebp - 0x8bac]
push edi
call fcn.0100c756
cmp eax, 0xffffffff
mov dword [0x1034868], eax
je 0x1007971
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x28
push edi
call fcn.0100c15e
push ebx
push ebx
push ebx
push dword [0x103393c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x7f02
push ebx
mov word [ebp - 0x42c], bx
mov dword [ebp - 0x8ba8], ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x10013a4
push 0xffff
push edi
call esi
push 0x200
lea eax, [ebp - 0x42c]
push eax
push 0x2f
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x42c]
push eax
push 0x3e8
push edi
call esi
mov esi, dword [sym.imp.USER32.dll_SetDlgItemInt]
push ebx
push dword [0x1033928]
push 0x3ea
push edi
call esi
push 0x3eb
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push ebx
push edi
mov dword [ebp - 0x8be4], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push ebx
lea eax, [ebp - 0x8ba4]
push eax
push 0x4000
lea eax, [ebp - 0x8a34]
push eax
push dword [0x103393c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1007887
lea eax, [ebp - 0x8a34]
neg eax
mov dword [ebp - 0x8bc8], eax
shr dword [ebp - 0x8ba4], 1
mov dword [ebp - 0x8bbc], ebx
je 0x100784b
mov ecx, dword [ebp - 0x8bbc]
add ecx, ecx
mov ax, word [ebp + ecx - 0x8a34]
cmp ax, 0xd
je 0x1007833
cmp ax, 0xfeff
je 0x1007833
cmp ax, 0xa
jne 0x1007802
mov eax, dword [ebp - 0x8ba8]
mov word [ebp + eax*2 - 0x42c], bx
push 0x1001438
lea eax, [ebp - 0x42c]
push eax
mov dword [ebp - 0x8ba8], ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1007708
mov dword [ebp - 0x8bc0], 1
jmp 0x1007833
push 0x100140c
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10077fa
push 0x10013f0
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10077fa
cmp dword [ebp - 0x8bc0], ebx
lea eax, [ebp - 0x42c]
je 0x10077ec
push eax
call fcn.0100b677
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1007833
push dword [ebp - 0x8aa0]
lea eax, [ebp - 0x42c]
push dword [ebp - 0x8bd0]
push dword [ebp - 0x8bd8]
push eax
lea eax, [ebp - 0x8be8]
push eax
push edi
call fcn.01005694
cmp eax, 1
jne 0x1007833
mov ecx, dword [0x1033928]
mov eax, dword [ebp - 0x8bd0]
mov edx, dword [ebp - 0x8bd4]
shl ecx, 5
mov dword [ecx + eax - 4], edx
push dword [0x1033928]
push eax
call fcn.01006c69
mov eax, dword [0x1033928]
push 0x64
xor edx, edx
pop ecx
div ecx
test edx, edx
jne 0x1007833
push ebx
push dword [0x1033928]
push 0x3ea
push edi
call esi
push ebx
push ebx
push dword [ebp - 0x8be4]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x1007833
push 0x10013a4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1007833
mov dword [ebp - 0x8bc0], ebx
jmp 0x1007833
cmp dword [ebp - 0x8ba8], ebx
jne 0x100781f
mov edx, dword [ebp - 0x8bc8]
add edx, ecx
lea ecx, [ebp + edx - 0x8a34]
mov dword [ebp - 0x8bd4], ecx
mov ecx, dword [ebp - 0x8ba8]
inc dword [ebp - 0x8ba8]
mov word [ebp + ecx*2 - 0x42c], ax
inc dword [ebp - 0x8bbc]
mov eax, dword [ebp - 0x8bbc]
cmp eax, dword [ebp - 0x8ba4]
jb 0x10076a1
mov eax, dword [ebp - 0x8ba4]
lea ecx, [eax + eax]
mov eax, 0x4000
cmp ecx, eax
jb 0x1007887
add dword [ebp - 0x8bc8], eax
push ebx
lea ecx, [ebp - 0x8ba4]
push ecx
push eax
lea eax, [ebp - 0x8a34]
push eax
push dword [0x103393c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100768f
push ebx
push dword [0x1033928]
push 0x3ea
push edi
call esi
push ebx
push ebx
push dword [ebp - 0x8be4]
call dword [sym.imp.USER32.dll_InvalidateRect]
cmp dword [ebp - 0x8bcc], ebx
je 0x10078f6
cmp dword [ebp - 0x8bc4], ebx
mov esi, 0x1001448
je 0x10078c8
push ebx
push ebx
lea eax, [ebp - 0x8ba0]
push eax
push esi
call fcn.01008505
cmp dword [ebp - 0x8bdc], ebx
je 0x10078ec
movzx eax, word [ebp - 0x8a38]
push eax
push dword [ebp - 0x8be0]
push ebx
push dword [ebp - 0x8bc4]
push esi
push edi
call fcn.010087ea
push 3
push 0xc0000000
push esi
jmp 0x1007948
cmp dword [ebp - 0x8bc4], ebx
je 0x1007912
push ebx
push ebx
lea eax, [ebp - 0x8ba0]
push eax
push dword [ebp - 0x8bac]
call fcn.01008505
cmp dword [ebp - 0x8bdc], ebx
je 0x100793b
movzx eax, word [ebp - 0x8a38]
push eax
push dword [ebp - 0x8be0]
push ebx
push dword [ebp - 0x8bc4]
push dword [ebp - 0x8bac]
push edi
call fcn.010087ea
push 3
push 0xc0000000
push dword [ebp - 0x8bac]
push edi
call fcn.0100c756
mov esi, dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f00
push ebx
mov dword [0x1034868], eax
call esi
push eax
call dword [sym.imp.USER32.dll_SetCursor]
cmp dword [0x1034868], 0xffffffff
jne 0x1007982
push dword [0x103393c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1007b9c
push 0x7f02
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0x4b
push edi
call fcn.0100c15e
mov esi, 0x100142c
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x8bb0]
mov word [ebp - 0x2c], 0x662f
mov word [ebp - 0x2a], 0x5426
mov word [ebp - 0x28], 0x751f
mov word [ebp - 0x26], 0x6210
mov word [ebp - 0x24], 0x91cd
mov word [ebp - 0x22], 0x7801
mov word [ebp - 0x20], 0x8868
mov word [ebp - 0x1e], 0x28
mov word [ebp - 0x1c], 0x59
mov word [ebp - 0x1a], 0x2f
mov word [ebp - 0x18], 0x4e
mov word [ebp - 0x16], 0x29
mov word [ebp - 0x14], 0x3f
mov word [ebp - 0x12], bx
movsw word es:[edi], word [esi]
call fcn.0100b74c
test eax, eax
je 0x1007a81
push dword [ebp - 0x8bb8]
lea eax, [ebp - 0x634]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x2e
lea eax, [ebp - 0x634]
push eax
call fcn.0100c4ab
cmp eax, ebx
je 0x1007a32
mov word [eax], bx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x634]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 2
push 0xc0000000
lea eax, [ebp - 0x634]
push eax
push dword [ebp - 0x8bb0]
call fcn.0100c756
cmp eax, 0xffffffff
mov dword [0x1034874], eax
jne 0x1007a81
push dword [0x103393c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x1034868]
call esi
jmp 0x1007b9c
mov edi, dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f00
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push dword [ebp - 0x8bd8]
push dword [ebp - 0x8bd0]
push dword [0x1034868]
push dword [0x103393c]
push dword [ebp - 0x8bb0]
call fcn.01005372
push dword [0x103392c]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x103392c]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call esi
push dword [0x1033930]
call esi
push 0x7f00
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_SetCursor]
cmp dword [ebp - 0x8bb4], ebx
je 0x1007afa
push dword [ebp - 0x8bb4]
call esi
push dword [0x103393c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x1034868]
call esi
mov eax, dword [0x1034874]
cmp eax, ebx
jbe 0x1007b1c
push eax
call esi
cmp dword [ebp - 0x8bcc], ebx
je 0x1007b41
push dword [ebp - 0x8bb8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x8bb8]
push 0x1001448
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x200
lea eax, [ebp - 0x42c]
push eax
push 0x42
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x42c]
push eax
push dword [ebp - 0x8bb0]
mov word [ebp - 0x10], 0x8bcd
mov word [ebp - 0xe], 0x8bed
mov word [ebp - 0xc], 0x6392
mov word [ebp - 0xa], 0x5e8f
mov word [ebp - 8], bx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
inc eax
jmp 0x1007be3
push 1
push edi
push 0x3ed
call fcn.0100b820
push ebx
mov esi, 0x1001448
push esi
call fcn.0100c50f
test eax, eax
jne 0x1007bb3
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x1033930]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
je 0x1007bc5
push eax
call esi
mov eax, dword [0x103392c]
cmp eax, ebx
je 0x1007bd1
push eax
call esi
cmp dword [ebp - 0x8bb4], ebx
je 0x1007be1
push dword [ebp - 0x8bb4]
call esi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.0100dd00
leave
ret 0xc