Function at 0x1002dc90
Capabilities:
Contain obfuscated stackstrings
Copy file
Encode data using xor
Query environment variable

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cb2ed
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x6a8
mov eax, dword [0x100fd230]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x220]
mov dword [ebp - 0x5fc], 0
push 0
push eax
call fcn.10091da0
add esp, 0xc
mov dword [ebp - 0x5f0], 0x1b003e
mov edx, 0x3e
mov dword [ebp - 0x5ec], 0x47006d
mov dword [ebp - 0x5e8], 0x4a004d
xor ecx, ecx
mov dword [ebp - 0x5e4], 0x53005b
mov dword [ebp - 0x5e0], 0x51006c
mov dword [ebp - 0x5dc], 0x4a0051
mov dword [ebp - 0x5d8], 0x62001b
mov dword [ebp - 0x5d4], 0x47004d
mov dword [ebp - 0x5d0], 0x4a004d
mov dword [ebp - 0x5cc], 0x53005b
mov dword [ebp - 0x5c8], 0xc000d
mov dword [ebp - 0x5c4], 0x5a0062
mov dword [ebp - 0x5c0], 0x57004c
mov dword [ebp - 0x5bc], 0x5b0048
mov dword [ebp - 0x5b8], 0x4d004c
mov dword [ebp - 0x5b4], 0x470062
mov dword [ebp - 0x5b0], 0x500057
mov dword [ebp - 0x5ac], 0x540059
mov dword [ebp - 0x5a8], 0x5f0057
mov dword [ebp - 0x5a4], 0x4b0050
mov dword [ebp - 0x5a0], 0x100051
mov dword [ebp - 0x59c], 0x47004d
mov dword [ebp - 0x598], 0x4d
nop
mov ax, word [ebp + ecx*2 - 0x5ee]
xor ax, dx
mov word [ebp + ecx*2 - 0x594], ax
inc ecx
cmp ecx, 0x2c
jae 0x1002de02
mov dx, word [ebp - 0x5f0]
jmp 0x1002dde0
xor eax, eax
mov word [ebp - 0x53c], ax
lea eax, [ebp - 0x220]
push 0x104
push eax
lea eax, [ebp - 0x594]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1002dedb
push ecx
lea ecx, [ebp - 0x6b8]
call fcn.100043e0
mov edx, str.ExpandEnvironmentStrings_error:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x6a8]
call fcn.10006590
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.1001c750
call fcn.100035c0
mov esi, eax
lea ecx, [ebp - 0x6b8]
lea eax, [ebp - 0x460]
push eax
call fcn.100042f0
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 0x10
jb 0x1002de84
mov eax, dword [eax]
sub esp, 8
mov ecx, esi
push eax
push 0
call fcn.10003d10
mov ecx, dword [ebp - 0x44c]
cmp ecx, 0x10
jb 0x1002decb
mov edx, dword [ebp - 0x460]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002dec1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ee1a
push ecx
push edx
call fcn.1008f79d
add esp, 8
lea ecx, [ebp - 0x6b8]
call fcn.10004220
jmp 0x1002edfc
xor eax, eax
mov dword [ebp - 0x470], 0x350069
mov dword [ebp - 0x46c], 0x1b002d
mov dword [ebp - 0x468], 0x1f0000
mov dword [ebp - 0x464], 0x1b000c
mov dword [ebp - 0x460], 0x35001a
mov word [ebp - 0x45c], ax
mov dword [ebp - 4], 2
xorps xmm0, xmm0
mov ecx, dword [ebp - 0x470]
mov eax, ecx
xor eax, dword [ebp - 0x46e]
mov word [ebp - 0x45a], ax
mov eax, ecx
xor eax, dword [ebp - 0x46c]
mov word [ebp - 0x458], ax
mov eax, ecx
xor eax, dword [ebp - 0x46a]
mov word [ebp - 0x456], ax
mov eax, ecx
xor eax, dword [ebp - 0x468]
mov word [ebp - 0x454], ax
mov eax, ecx
xor eax, dword [ebp - 0x466]
mov word [ebp - 0x452], ax
mov eax, ecx
xor eax, dword [ebp - 0x464]
mov word [ebp - 0x450], ax
mov eax, ecx
xor eax, dword [ebp - 0x462]
mov word [ebp - 0x44e], ax
mov eax, ecx
xor ecx, dword [ebp - 0x45e]
xor eax, dword [ebp - 0x460]
mov word [ebp - 0x44c], ax
xor eax, eax
mov word [ebp - 0x44a], cx
lea ecx, [ebp - 0x45a]
mov word [ebp - 0x448], ax
lea edx, [ecx + 2]
movups xmmword [ebp - 0x508], xmm0
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x4f4], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002dfd0
sub ecx, edx
lea eax, [ebp - 0x45a]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x508]
call fcn.10017940
mov byte [ebp - 4], 4
call fcn.1001b000
mov edx, 0x5e
test al, al
je 0x1002e0b6
xor eax, eax
mov dword [ebp - 0x488], 0x2005e
mov dword [ebp - 0x484], 0x370027
mov dword [ebp - 0x480], 0x390030
mov dword [ebp - 0x47c], 0x370034
mov dword [ebp - 0x478], 0x30003f
mov dword [ebp - 0x474], 0x31002b
mov dword [ebp - 0x470], 0x2d0070
mov dword [ebp - 0x46c], 0x2d0027
mov word [ebp - 0x468], ax
mov esi, 1
mov byte [ebp - 4], 5
mov dword [ebp - 0x5f8], esi
xor ecx, ecx
mov dword [ebp - 0x5fc], esi
nop dword [eax + eax]
mov ax, word [ebp + ecx*2 - 0x486]
xor ax, dx
mov word [ebp + ecx*2 - 0x466], ax
inc ecx
cmp ecx, 0xf
jae 0x1002e0a2
mov dx, word [ebp - 0x488]
jmp 0x1002e080
xor eax, eax
lea edx, [ebp - 0x466]
mov word [ebp - 0x448], ax
jmp 0x1002e171
xor eax, eax
mov dword [ebp - 0x4f0], 0x1a0046
mov edx, 0x46
mov dword [ebp - 0x4ec], 0x2f003f
mov dword [ebp - 0x4e8], 0x210028
mov dword [ebp - 0x4e4], 0x2f002c
mov dword [ebp - 0x4e0], 0x280027
mov dword [ebp - 0x4dc], 0x290033
mov dword [ebp - 0x4d8], 0x740075
mov dword [ebp - 0x4d4], 0x350068
mov dword [ebp - 0x4d0], 0x35003f
mov word [ebp - 0x4cc], ax
mov esi, 2
mov dword [ebp - 4], 6
mov dword [ebp - 0x5f8], esi
xor ecx, ecx
mov dword [ebp - 0x5fc], esi
nop dword [eax + eax]
mov ax, word [ebp + ecx*2 - 0x4ee]
xor ax, dx
mov word [ebp + ecx*2 - 0x4ca], ax
inc ecx
cmp ecx, 0x11
jae 0x1002e162
mov dx, word [ebp - 0x4f0]
jmp 0x1002e140
xor eax, eax
lea edx, [ebp - 0x4ca]
mov word [ebp - 0x4a8], ax
mov ecx, edx
mov dword [ebp - 0x528], 0
xorps xmm0, xmm0
mov dword [ebp - 0x524], 0
movups xmmword [ebp - 0x538], xmm0
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002e194
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x538]
call fcn.10017940
mov dword [ebp - 4], 7
mov eax, dword [ebp - 0x5f8]
test al, 2
je 0x1002e1ca
and eax, 0xfffffffd
mov dword [ebp - 0x5f8], eax
mov byte [ebp - 4], 9
test al, 1
je 0x1002e1db
and eax, 0xfffffffe
mov dword [ebp - 0x5f8], eax
call fcn.1001b1a0
test al, al
je 0x1002e276
mov dword [ebp - 0x440], 0x2a005d
mov dword [ebp - 0x43c], 0x330034
mov dword [ebp - 0x438], 0x6a
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x440]
mov eax, dword [ebp - 0x43e]
xor eax, ecx
mov word [ebp - 0x434], ax
mov eax, dword [ebp - 0x43c]
xor eax, ecx
mov word [ebp - 0x432], ax
mov eax, dword [ebp - 0x43a]
xor eax, ecx
mov word [ebp - 0x430], ax
mov eax, dword [ebp - 0x438]
xor eax, ecx
lea ecx, [ebp - 0x434]
mov word [ebp - 0x42e], ax
lea edx, [ecx + 2]
xor eax, eax
mov word [ebp - 0x42c], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002e260
lea eax, [ebp - 0x434]
jmp 0x1002e641
lea ecx, [ebp - 0x460]
call fcn.1001a920
mov byte [ebp - 4], 0xb
mov esi, dword [ebp - 0x5f8]
mov edx, dword [eax + 0x10]
or esi, 0x10
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0x5f8], esi
mov dword [ebp - 0x5fc], esi
jb 0x1002e2a5
mov eax, dword [eax]
push 4
push str.win8
mov ecx, eax
call fcn.10016fa0
add esp, 8
test al, al
jne 0x1002e2f5
lea ecx, [ebp - 0x4a0]
call fcn.1001a920
or esi, 0x20
mov dword [ebp - 0x5f8], esi
cmp dword [eax + 0x14], 0x10
mov edx, dword [eax + 0x10]
jb 0x1002e2d9
mov eax, dword [eax]
push 6
push str.win8.1
mov ecx, eax
call fcn.10016fa0
add esp, 8
mov byte [ebp - 0x5f1], 0
test al, al
je 0x1002e2fc
mov byte [ebp - 0x5f1], 1
mov eax, dword [ebp - 0x5f8]
test al, 0x20
je 0x1002e36a
mov ecx, dword [ebp - 0x48c]
and eax, 0xffffffdf
mov dword [ebp - 0x5f8], eax
cmp ecx, 0x10
jb 0x1002e34f
mov edx, dword [ebp - 0x4a0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002e33f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ee1f
push ecx
push edx
call fcn.1008f79d
mov eax, dword [ebp - 0x5f8]
add esp, 8
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x48c], 0xf
mov byte [ebp - 0x4a0], 0
mov dword [ebp - 4], 9
test al, 0x10
je 0x1002e3b8
mov ecx, dword [ebp - 0x44c]
and eax, 0xffffffef
mov dword [ebp - 0x5f8], eax
cmp ecx, 0x10
jb 0x1002e3b8
mov edx, dword [ebp - 0x460]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002e3ae
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ee1f
push ecx
push edx
call fcn.1008f79d
add esp, 8
cmp byte [ebp - 0x5f1], 0
je 0x1002e456
mov dword [ebp - 0x440], 0x5e0029
mov dword [ebp - 0x43c], 0x470040
mov dword [ebp - 0x438], 0x11
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x440]
mov eax, dword [ebp - 0x43e]
xor eax, ecx
mov word [ebp - 0x434], ax
mov eax, dword [ebp - 0x43c]
xor eax, ecx
mov word [ebp - 0x432], ax
mov eax, dword [ebp - 0x43a]
xor eax, ecx
mov word [ebp - 0x430], ax
mov eax, dword [ebp - 0x438]
xor eax, ecx
lea ecx, [ebp - 0x434]
mov word [ebp - 0x42e], ax
lea edx, [ecx + 2]
xor eax, eax
mov word [ebp - 0x42c], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002e440
lea eax, [ebp - 0x434]
jmp 0x1002e641
lea ecx, [ebp - 0x460]
call fcn.1001a920
mov byte [ebp - 4], 0xd
mov esi, dword [ebp - 0x5f8]
mov edx, dword [eax + 0x10]
or esi, 0x40
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0x5f8], esi
mov dword [ebp - 0x5fc], esi
jb 0x1002e485
mov eax, dword [eax]
push 5
push str.win11
mov ecx, eax
call fcn.10016fa0
add esp, 8
test al, al
jne 0x1002e4d8
lea ecx, [ebp - 0x4a0]
call fcn.1001a920
or esi, 0x80
mov dword [ebp - 0x5f8], esi
cmp dword [eax + 0x14], 0x10
mov edx, dword [eax + 0x10]
jb 0x1002e4bc
mov eax, dword [eax]
push 5
push str.win10
mov ecx, eax
call fcn.10016fa0
add esp, 8
mov byte [ebp - 0x5f1], 0
test al, al
je 0x1002e4df
mov byte [ebp - 0x5f1], 1
mov eax, dword [ebp - 0x5f8]
test al, al
jns 0x1002e54f
mov ecx, dword [ebp - 0x48c]
and eax, 0xffffff7f
mov dword [ebp - 0x5f8], eax
cmp ecx, 0x10
jb 0x1002e534
mov edx, dword [ebp - 0x4a0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002e524
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ee24
push ecx
push edx
call fcn.1008f79d
mov eax, dword [ebp - 0x5f8]
add esp, 8
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x48c], 0xf
mov byte [ebp - 0x4a0], 0
mov dword [ebp - 4], 9
test al, 0x40
je 0x1002e594
mov ecx, dword [ebp - 0x44c]
cmp ecx, 0x10
jb 0x1002e594
mov edx, dword [ebp - 0x460]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002e58a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ee24
push ecx
push edx
call fcn.1008f79d
add esp, 8
cmp byte [ebp - 0x5f1], 0
je 0x1002e656
xor eax, eax
mov dword [ebp - 0x460], 0x720005
mov dword [ebp - 0x45c], 0x6b006c
mov dword [ebp - 0x458], 0x350034
mov word [ebp - 0x454], ax
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x460]
mov eax, dword [ebp - 0x45e]
xor eax, ecx
mov word [ebp - 0x452], ax
mov eax, dword [ebp - 0x45c]
xor eax, ecx
mov word [ebp - 0x450], ax
mov eax, dword [ebp - 0x45a]
xor eax, ecx
mov word [ebp - 0x44e], ax
mov eax, dword [ebp - 0x458]
xor eax, ecx
mov word [ebp - 0x44c], ax
mov eax, dword [ebp - 0x456]
xor eax, ecx
lea ecx, [ebp - 0x452]
mov word [ebp - 0x44a], ax
lea edx, [ecx + 2]
xor eax, eax
mov word [ebp - 0x448], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002e630
lea eax, [ebp - 0x452]
sub ecx, edx
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x508]
call fcn.1001f400
mov byte [ebp - 4], 9
push 0x208
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.10091da0
add esp, 0xc
cmp dword [0x100fde5c], 0
push 0x100fde4c
jne 0x1002e68a
lea ecx, [ebp - 0x4a0]
call fcn.10017090
jmp 0x1002e708
lea ecx, [ebp - 0x440]
call fcn.10017090
xor esi, esi
cmp dword [0x100fde5c], esi
jbe 0x1002e6ea
nop
cmp dword [ebp - 0x42c], 8
lea ecx, [ebp - 0x440]
mov eax, dword [0x100fde48]
cmovae ecx, dword [ebp - 0x440]
setae byte [ebp - 0x5f1]
add eax, esi
xor ax, word [ecx + esi*2]
cmp byte [ebp - 0x5f1], 0
movzx ecx, ax
lea eax, [ebp - 0x440]
cmovne eax, dword [ebp - 0x440]
mov word [eax + esi*2], cx
inc esi
cmp esi, dword [0x100fde5c]
jb 0x1002e6a0
movups xmm0, xmmword [ebp - 0x440]
movups xmmword [ebp - 0x4a0], xmm0
movq xmm0, qword [ebp - 0x430]
movq qword [ebp - 0x490], xmm0
mov edi, dword [ebp - 0x48c]
lea ecx, [ebp - 0x4a0]
mov esi, dword [ebp - 0x4a0]
lea edx, [ebp - 0x428]
cmp edi, 8
cmovae ecx, esi
sub edx, ecx
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x1002e730
cmp edi, 8
jb 0x1002e774
lea ecx, [edi*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x1002e76a
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ee47
push ecx
push esi
call fcn.1008f79d
add esp, 8
mov ecx, dword [ebp - 0x4f8]
mov eax, bind
mov edx, dword [ebp - 0x528]
sub eax, ecx
mov dword [ebp - 0x5f8], ecx
cmp eax, edx
jb 0x1002ee29
cmp dword [ebp - 0x4f4], 8
lea eax, [ebp - 0x508]
mov esi, 7
lea edi, [ebp - 0x520]
cmovae eax, dword [ebp - 0x508]
xorps xmm0, xmm0
cmp dword [ebp - 0x524], 8
mov dword [ebp - 0x604], eax
lea eax, [ebp - 0x538]
cmovae eax, dword [ebp - 0x538]
mov dword [ebp - 0x600], eax
lea eax, [ecx + edx]
mov dword [ebp - 0x5fc], eax
movups xmmword [ebp - 0x520], xmm0
cmp eax, esi
jbe 0x1002e82c
mov esi, eax
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x1002e7ff
mov esi, bind
jmp 0x1002e809
mov eax, 0xa
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x520]
call fcn.100179d0
mov ecx, dword [ebp - 0x5f8]
mov edi, eax
mov eax, dword [ebp - 0x5fc]
mov dword [ebp - 0x520], edi
mov dword [ebp - 0x50c], esi
lea esi, [ecx + ecx]
push esi
push dword [ebp - 0x604]
mov dword [ebp - 0x510], eax
push edi
call fcn.100917c0
mov eax, dword [ebp - 0x528]
lea ecx, [edi + esi]
add esp, 0xc
add eax, eax
push eax
push dword [ebp - 0x600]
push ecx
call fcn.100917c0
mov eax, dword [ebp - 0x5fc]
xor ecx, ecx
add esp, 0xc
mov word [edi + eax*2], cx
mov byte [ebp - 4], 0xf
lea edx, [ebp - 0x520]
cmp dword [ebp - 0x50c], 8
cmovae edx, dword [ebp - 0x520]
mov esi, edx
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1002e890
lea edi, [ebp - 0x428]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1002e8a6
mov ecx, edx
mov dword [ebp - 0x430], 0
shr ecx, 2
xorps xmm0, xmm0
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [ebp - 0x42c], 0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x220]
movups xmmword [ebp - 0x440], xmm0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002e8e7
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x440]
call fcn.10017940
cmp dword [ebp - 0x42c], 8
lea eax, [ebp - 0x440]
push 0
cmovae eax, dword [ebp - 0x440]
push eax
call fcn.100a2562
mov ecx, dword [ebp - 0x42c]
add esp, 8
cmp eax, 0xffffffff
setne al
mov byte [ebp - 0x5f1], al
cmp ecx, 8
jb 0x1002e97a
mov edx, dword [ebp - 0x440]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1002e96a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ee2e
push ecx
push edx
call fcn.1008f79d
mov al, byte [ebp - 0x5f1]
add esp, 8
test al, al
je 0x1002ebac
xorps xmm0, xmm0
mov dword [ebp - 0x430], 0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x42c], 0
movups xmmword [ebp - 0x440], xmm0
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002e9b0
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x440]
call fcn.10017940
lea edx, [ebp - 0x440]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x460]
call fcn.1000fb00
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x42c]
cmp ecx, 8
jb 0x1002ea2b
mov edx, dword [ebp - 0x440]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1002ea21
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ee33
push ecx
push edx
call fcn.1008f79d
add esp, 8
xor eax, eax
mov dword [ebp - 0x430], 0
xorps xmm0, xmm0
mov dword [ebp - 0x42c], 7
lea ecx, [ebp - 0x428]
mov word [ebp - 0x440], ax
movups xmmword [ebp - 0x4a0], xmm0
mov dword [ebp - 0x490], eax
lea edx, [ecx + 2]
mov dword [ebp - 0x48c], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002ea67
sub ecx, edx
lea eax, [ebp - 0x428]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x4a0]
call fcn.10017940
lea edx, [ebp - 0x4a0]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x4c0]
call fcn.1000fb00
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x48c]
cmp ecx, 8
jb 0x1002eae2
mov edx, dword [ebp - 0x4a0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1002ead8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ee38
push ecx
push edx
call fcn.1008f79d
add esp, 8
cmp dword [ebp - 0x4ac], 0x10
lea eax, [ebp - 0x4c0]
mov edi, dword [ebp - 0x4c0]
lea ecx, [ebp - 0x460]
push dword [ebp - 0x4b0]
mov esi, dword [ebp - 0x460]
cmovae eax, edi
cmp dword [ebp - 0x44c], 0x10
mov edx, dword [ebp - 0x450]
cmovae ecx, esi
push eax
call fcn.10016fa0
movzx eax, al
add esp, 8
xor eax, 1
mov dword [ebp - 0x600], eax
mov eax, dword [ebp - 0x4ac]
cmp eax, 0x10
jb 0x1002eb65
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x1002eb5b
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ee47
push ecx
push edi
call fcn.1008f79d
add esp, 8
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x44c]
cmp eax, 0x10
jb 0x1002eb9f
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x1002eb95
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ee47
push ecx
push esi
call fcn.1008f79d
add esp, 8
cmp dword [ebp - 0x600], 0
je 0x1002ed40
push 0
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1002ed40
push ecx
lea ecx, [ebp - 0x5f0]
call fcn.100043e0
mov edx, str._TID:
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x5e0]
call fcn.10006590
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call fcn.1001c750
mov edx, 0x100e5420
mov ecx, eax
call fcn.10006590
movaps xmm0, xmmword [0x100e8c70]
mov esi, eax
movups xmmword [ebp - 0x4d0], xmm0
mov dword [ebp - 0x4c0], 0x4711141c
mov byte [ebp - 0x4bc], 0
mov byte [ebp - 4], 0x15
xor ecx, ecx
nop dword [eax]
mov al, byte [ebp + ecx - 0x4cf]
xor al, byte [ebp - 0x4d0]
mov byte [ebp + ecx - 0x4bb], al
inc ecx
cmp ecx, 0x13
jb 0x1002ec30
lea edx, [ebp - 0x4bb]
mov byte [ebp - 0x4a8], 0
mov ecx, esi
call fcn.10006590
lea ecx, [ebp - 0x460]
mov esi, eax
call fcn.1001a4f0
mov byte [ebp - 4], 0x16
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x1002ec7a
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, esi
call fcn.10006f60
mov byte [ebp - 4], 0x15
add esp, 4
mov ecx, dword [ebp - 0x44c]
cmp ecx, 0x10
jb 0x1002ecc5
mov edx, dword [ebp - 0x460]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002ecbb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ee3d
push ecx
push edx
call fcn.1008f79d
add esp, 8
mov byte [ebp - 4], 0x14
call fcn.100035c0
mov esi, eax
lea ecx, [ebp - 0x5f0]
lea eax, [ebp - 0x460]
push eax
call fcn.100042f0
mov byte [ebp - 4], 0x17
cmp dword [eax + 0x14], 0x10
jb 0x1002ecee
mov eax, dword [eax]
sub esp, 8
mov ecx, esi
push eax
push 4
call fcn.10003d10
mov ecx, dword [ebp - 0x44c]
cmp ecx, 0x10
jb 0x1002ed35
mov edx, dword [ebp - 0x460]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002ed2b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ee42
push ecx
push edx
call fcn.1008f79d
add esp, 8
lea ecx, [ebp - 0x5f0]
call fcn.10004220
mov eax, dword [ebp - 0x50c]
cmp eax, 8
jb 0x1002ed80
mov edx, dword [ebp - 0x520]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1002ed76
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ee47
push ecx
push edx
call fcn.1008f79d
add esp, 8
mov eax, dword [ebp - 0x524]
cmp eax, 8
jb 0x1002edc0
mov edx, dword [ebp - 0x538]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1002edb6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ee47
push ecx
push edx
call fcn.1008f79d
add esp, 8
mov ecx, dword [ebp - 0x4f4]
cmp ecx, 8
jb 0x1002edfc
mov edx, dword [ebp - 0x508]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1002edf2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ee47
push ecx
push edx
call fcn.1008f79d
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1008f445
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1009b8bf
call fcn.1009b8bf
call fcn.1009b8bf
call fcn.10002f30
call fcn.1009b8bf
call fcn.1009b8bf
call fcn.1009b8bf
call fcn.1009b8bf
call fcn.1009b8bf
call fcn.1009b8bf
int3