Function at 0x100109f0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Copy file
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100476b1
mov eax, dword fs:[0]
push eax
mov eax, 0x10b0
call fcn.1001b4d0
mov eax, dword [0x10062698]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1068], ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x105c], edi
mov dword [ebp - 0x10bc], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
cmp dword [eax - 0xc], 0
jne 0x10010b62
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10023e50
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x10063b18]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x105c]
mov ecx, ebx
push eax
call fcn.10010950
push dword [eax]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp - 0x105c]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10010ac5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.100018f0
mov ecx, eax
test ecx, ecx
je 0x10011359
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
test eax, 0xffff0000
jne 0x10010afc
movzx eax, ax
mov ecx, edi
push eax
call fcn.10007300
jmp 0x10010b23
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10010b05
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.10005170
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x10010b42
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001b4ae
mov esp, ebp
pop ebp
ret 8
push str.rand
push eax
call fcn.1003123d
add esp, 8
or ebx, 0xffffffff
test eax, eax
jne 0x10010c52
call fcn.100018f0
mov ecx, eax
test ecx, ecx
je 0x10011363
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1058], eax
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.1003158c
add esp, 4
call fcn.1003156b
cdq
mov esi, 0x1a
idiv esi
lea ebx, [edx + 0x61]
call fcn.1003156b
cdq
idiv esi
lea edi, [edx + 0x61]
call fcn.1003156b
cdq
idiv esi
lea esi, [edx + 0x61]
call fcn.1003156b
cdq
mov ecx, 0x1a
idiv ecx
movzx eax, bx
push eax
movzx eax, di
add edx, 0x61
push eax
movzx eax, si
push eax
movzx eax, dx
push eax
call fcn.1003156b
cdq
mov ecx, 0x1a
idiv ecx
add edx, 0x61
movzx eax, dx
push eax
lea eax, [ebp - 0x1058]
push str._c_c_c_c_c.exe
push eax
call fcn.10004090
add esp, 0x1c
lea eax, [ebp - 0x1058]
lea ecx, [ebp + 0xc]
push eax
call fcn.100036f0
mov edx, dword [ebp - 0x1058]
or ebx, 0xffffffff
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10010c4c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x105c]
mov ecx, dword [ebp - 0x1068]
lea eax, [ebp - 0x1060]
push eax
call fcn.10010950
mov eax, dword [ebp - 0x1060]
mov byte [ebp - 4], 3
test eax, eax
je 0x1001136d
push eax
push dword [ebp + 0xc]
call fcn.1003123d
add esp, 8
push 0x208
push 0
test eax, eax
jne 0x10010d87
lea eax, [ebp - 0x420]
push eax
call fcn.10023e50
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push dword [0x10063b18]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [ebp - 0x1060]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.100018f0
mov ecx, eax
test ecx, ecx
je 0x10011377
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 4
test eax, 0xffff0000
jne 0x10010d0f
movzx eax, ax
mov ecx, edi
push eax
call fcn.10007300
jmp 0x10010d3e
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10010d20
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.10005170
mov edx, dword [ebp - 0x1060]
mov eax, ebx
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10010d5f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x10010b42
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10010b42
lea eax, [ebp - 0xa38]
push eax
call fcn.10023e50
add esp, 0xc
lea eax, [ebp - 0xa38]
push 0x104
push eax
push dword [0x10063b18]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0xa38]
push eax
call esi
lea eax, [ebp - 0xa38]
push eax
call esi
push 0x208
lea eax, [ebp - 0xe48]
push 0
push eax
call fcn.10023e50
add esp, 0xc
lea eax, [ebp - 0xa38]
push str.config.ini
push eax
lea eax, [ebp - 0xe48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
call fcn.100018f0
mov ecx, eax
test ecx, ecx
je 0x10011381
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edx, [eax + 0x10]
mov dword [ebp - 0x1054], edx
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, 0x104
or eax, ecx
mov byte [ebp - 4], 5
jge 0x10010e40
push 0x104
lea ecx, [ebp - 0x1054]
call fcn.10001cd0
mov edx, dword [ebp - 0x1054]
cmp dword [edx - 8], 0x104
jl 0x1001138b
mov dword [edx - 0xc], 0x104
xor ecx, ecx
mov eax, dword [ebp - 0x1054]
mov word [eax + 0x208], cx
lea eax, [ebp - 0xe48]
push eax
push 0x104
push edx
push 0x1004af74
push 0x1004cd64
push str.mechanism
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [ebp - 0x1054]
push dword [eax - 8]
push eax
call fcn.10031043
mov edx, eax
add esp, 8
test edx, edx
js 0x1001138b
mov ecx, dword [ebp - 0x1054]
cmp edx, dword [ecx - 8]
jg 0x1001138b
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp - 0x1054]
push 0x208
push ecx
mov word [eax + edx*2], cx
lea eax, [ebp - 0x830]
push eax
call fcn.10023e50
add esp, 0xc
lea eax, [ebp - 0x830]
push 0x104
push eax
push dword [0x10063b18]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x830]
push eax
call esi
mov eax, dword [ebp - 0x1054]
cmp dword [eax - 0xc], 0
je 0x1001108a
xor eax, eax
mov dword [ebp - 0x10b8], 0x450043
mov dword [ebp - 0x10b4], 0x300043
mov dword [ebp - 0x10b0], 0x310039
mov dword [ebp - 0x10ac], 0x390030
mov dword [ebp - 0x10a8], 0x43002d
mov dword [ebp - 0x10a4], 0x350035
mov dword [ebp - 0x10a0], 0x2d0041
mov dword [ebp - 0x109c], 0x390034
mov dword [ebp - 0x1098], 0x410038
mov dword [ebp - 0x1094], 0x41002d
mov dword [ebp - 0x1090], 0x330042
mov dword [ebp - 0x108c], 0x2d0036
mov dword [ebp - 0x1088], 0x350043
mov dword [ebp - 0x1084], 0x460041
mov dword [ebp - 0x1080], 0x310030
mov dword [ebp - 0x107c], 0x340045
mov dword [ebp - 0x1078], 0x410039
mov dword [ebp - 0x1074], 0x310034
mov word [ebp - 0x1070], ax
call fcn.100018f0
mov ecx, eax
test ecx, ecx
je 0x10011395
mov eax, dword [ecx]
push 2
push 0x24
call dword [eax]
test eax, eax
je 0x1001139f
add eax, 0x10
mov dword [ebp - 0x1058], eax
cmp dword [eax - 8], 0x24
jl 0x1001138b
mov dword [eax - 0xc], 0x24
xor ecx, ecx
mov eax, dword [ebp - 0x1058]
push 0x24
mov word [eax + 0x48], cx
lea eax, [ebp - 0x10b8]
push eax
push 0x24
push dword [ebp - 0x1058]
call fcn.10001b40
lea eax, [ebp - 0x1058]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x1054]
push eax
lea eax, [ebp - 0x105c]
push eax
call fcn.10013730
add esp, 0x1c
mov edx, dword [ebp - 0x1058]
mov eax, ebx
mov byte [ebp - 4], 8
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001105f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x105c]
cmp dword [esi - 0xc], 0
jne 0x10011114
mov byte [ebp - 4], 5
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1001108a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x208
lea eax, [ebp - 0x1050]
push 0
push eax
call fcn.10023e50
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.10023e50
add esp, 0x18
lea eax, [ebp - 0x830]
push dword [ebp - 0x1060]
push eax
lea eax, [ebp - 0x1050]
push eax
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x628]
push eax
call esi
push 0
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x1050]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x10011243
call fcn.100018f0
mov ecx, eax
test ecx, ecx
je 0x100113a4
jmp 0x100111e6
push 0x208
lea eax, [ebp - 0xc40]
push 0
push eax
call fcn.10023e50
add esp, 0xc
lea eax, [ebp - 0x830]
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push eax
lea eax, [ebp - 0xc40]
push eax
call esi
lea eax, [ebp - 0xc40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100111bc
lea eax, [ebp - 0xc40]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100111bc
lea eax, [ebp - 0xc40]
mov ecx, edi
push eax
call fcn.10002a30
mov edx, dword [ebp - 0x105c]
mov eax, ebx
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10011192
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1054]
mov eax, ebx
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10010d3e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10010d3e
mov edx, dword [ebp - 0x105c]
mov eax, ebx
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10011090
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10011090
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, 0x1004af74
mov byte [ebp - 4], 9
mov ecx, edi
test eax, 0xffff0000
jne 0x1001120d
movzx eax, ax
push eax
call fcn.10007300
jmp 0x10011219
push 0
push 0x1004af74
call fcn.10005170
mov edx, dword [ebp - 0x1054]
mov eax, ebx
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10010d3e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10010d3e
lea eax, [ebp - 0x1068]
push eax
lea ecx, [ebp - 0x1061]
call fcn.100101d0
push eax
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x106c]
push eax
call fcn.10013b80
add esp, 0xc
mov edx, dword [ebp - 0x1068]
mov eax, ebx
mov byte [ebp - 4], 0xc
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001128e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0xe48]
push eax
push dword [ebp - 0x106c]
push 0x1004cd64
push str.mechanism
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call fcn.100018f0
mov ecx, eax
test ecx, ecx
je 0x100113ae
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x628]
mov byte [ebp - 4], 0xd
test eax, 0xffff0000
jne 0x100112e2
movzx eax, ax
mov ecx, edi
push eax
call fcn.10007300
jmp 0x1001130e
lea ecx, [ebp - 0x628]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100112f0
sub ecx, edx
lea eax, [ebp - 0x628]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.10005170
mov edx, dword [ebp - 0x106c]
mov eax, ebx
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001132f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1054]
mov eax, ebx
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10010d3e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10010d3e
push 0x80004005
call fcn.10001ab0
push 0x80004005
call fcn.10001ab0
push 0x80004005
call fcn.10001ab0
push 0x80004005
call fcn.10001ab0
push 0x80004005
call fcn.10001ab0
push 0x80070057
call fcn.10001ab0
push 0x80004005
call fcn.10001ab0
call fcn.10001d70
push 0x80004005
call fcn.10001ab0
push 0x80004005
call fcn.10001ab0
int3