Function at 0x10001659
Capabilities:
Delete file
Enumerate gui resources
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
push str.soul.exe
push 0x1009086c
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x10001b2e
push 0x10090218
push 1
push 0x100902c8
push 0x10090970
call fcn.100049d5
push 0x10090c48
call fcn.10005035
add esp, 0x14
call fcn.100021e0
mov ebx, eax
mov ecx, ebx
call fcn.10002160
and byte [ebp - 0x21c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x21b]
and byte [ebp - 0x118], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x118]
push str._swlzs.exe
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call edi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x118]
push str._sNdSafeDll.dll
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call edi
call fcn.1000428d
push 0x100014e1
call fcn.100036ca
pop ecx
call fcn.10004f50
test eax, eax
jne 0x10001b29
call fcn.10001000
call dword [sym.imp.MSVCRT.dll__getpid]
push eax
push 0x1000147f
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, str.SoulLogin.dll
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x1000178f
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10001777
push 1
push 0xd
lea eax, [ebp - 0xc]
push 0xa
push eax
push esi
mov ecx, ebx
mov byte [ebp - 0xc], 0x8d
mov byte [ebp - 0xb], 0x3c
mov byte [ebp - 0xa], 0x82
mov byte [ebp - 9], 0x8b
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0x24
mov byte [ebp - 6], 0x44
mov byte [ebp - 5], 0x83
mov byte [ebp - 4], 0xc7
mov byte [ebp - 3], 4
call fcn.10001efd
test eax, eax
jbe 0x100017da
push 0x10001054
push eax
mov ecx, ebx
call fcn.10001c8a
and byte [ebp - 8], 0
and byte [ebp - 7], 0
and byte [ebp - 6], 0
push 1
push 0x10
lea eax, [ebp - 0xc]
push 0xa
push eax
push esi
mov ecx, ebx
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0xb4
mov byte [ebp - 0xa], 0x24
mov byte [ebp - 9], 0x84
mov byte [ebp - 5], 0x81
mov byte [ebp - 4], 0xc1
mov byte [ebp - 3], 0xa4
call fcn.10001efd
test eax, eax
jbe 0x10001825
push 0x1000107f
push eax
mov ecx, ebx
call fcn.10001c8a
and byte [ebp - 4], 0
and byte [ebp - 3], 0
push 1
push 0xffffffffffffffe7
lea eax, [ebp - 8]
push 6
mov edi, str.soul.exe
push eax
push edi
mov ecx, ebx
mov byte [ebp - 8], 0x52
mov byte [ebp - 7], 0x68
mov byte [ebp - 6], 0x49
mov byte [ebp - 5], 3
call fcn.10001efd
test eax, eax
jbe 0x10001865
push 0x100010a0
push eax
mov ecx, ebx
call fcn.10001b84
and byte [ebp - 3], 0
push 1
push 0xffffffffffffffea
lea eax, [ebp - 0xc]
push 0xa
push eax
push esi
mov ecx, ebx
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x7c
mov byte [ebp - 0xa], 0x24
mov byte [ebp - 9], 0x2c
mov byte [ebp - 8], 0x8b
mov byte [ebp - 7], 0x54
mov byte [ebp - 6], 0x24
mov byte [ebp - 5], 0x10
mov byte [ebp - 4], 0x6a
call fcn.10001efd
test eax, eax
jbe 0x100018b0
push 0x100010fa
push eax
mov ecx, ebx
call fcn.10001c8a
push 1
push 9
lea eax, [ebp - 0xc]
push 9
push eax
push esi
mov ecx, ebx
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0xb
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0xd2
mov byte [ebp - 8], 0x85
mov byte [ebp - 7], 0xc9
mov byte [ebp - 6], 0xf
mov byte [ebp - 5], 0x9c
mov byte [ebp - 4], 0xc2
call fcn.10001efd
test eax, eax
jbe 0x100018f7
push 0x100011b2
push eax
mov ecx, ebx
call fcn.10001d7c
and byte [ebp - 9], 0
and byte [ebp - 8], 0
and byte [ebp - 3], 0
and byte [ebp - 2], 0
push 1
push 0xfffffffffffffffa
lea eax, [ebp - 0x14]
push 0x13
push eax
push esi
mov ecx, ebx
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0xc4
mov byte [ebp - 0x12], 4
mov byte [ebp - 0x11], 0x89
mov byte [ebp - 0x10], 0x44
mov byte [ebp - 0xf], 0x24
mov byte [ebp - 0xe], 0x38
mov byte [ebp - 0xd], 0x8d
mov byte [ebp - 0xc], 0xae
mov byte [ebp - 0xb], 0xc4
mov byte [ebp - 0xa], 7
mov byte [ebp - 7], 0x8d
mov byte [ebp - 6], 0x86
mov byte [ebp - 5], 0x98
mov byte [ebp - 4], 5
call fcn.10001efd
test eax, eax
jbe 0x10001966
push 0x10001200
push eax
mov ecx, ebx
call fcn.10001c8a
push 1
and byte [ebp - 4], 0
pop esi
lea eax, [ebp - 8]
push esi
push 0xffffffffffffffd9
push 5
push eax
push edi
mov ecx, ebx
mov byte [ebp - 8], 0x68
mov byte [ebp - 7], 0x94
mov byte [ebp - 6], 0x2f
mov byte [ebp - 5], 2
call fcn.10001efd
test eax, eax
jbe 0x1000199f
push 0x10001399
push eax
mov ecx, ebx
call fcn.10001b84
or byte [ebp - 0xb], 0xff
and byte [ebp - 8], 0
or byte [ebp - 6], 0xff
or byte [ebp - 5], 0xff
push esi
push 0xe
lea eax, [ebp - 0xc]
push 8
push eax
push edi
mov ecx, ebx
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 0xa], 0x8d
mov byte [ebp - 9], 0x8d
mov byte [ebp - 7], 0xfb
call fcn.10001efd
test eax, eax
jbe 0x100019e1
push 0x1000121d
push eax
mov ecx, ebx
call fcn.10001c8a
or byte [ebp - 0x10], 0xff
and byte [ebp - 6], 0
and byte [ebp - 5], 0
push esi
push 0xd
lea eax, [ebp - 0x10]
push 0xc
push eax
push edi
mov ecx, ebx
mov byte [ebp - 0xf], 0x52
mov byte [ebp - 0xe], 0x10
mov byte [ebp - 0xd], 0x8d
mov byte [ebp - 0xc], 0x45
mov byte [ebp - 0xb], 0xd8
mov byte [ebp - 0xa], 0x8d
mov byte [ebp - 9], 0x8b
mov byte [ebp - 8], 0xac
mov byte [ebp - 7], 0x28
call fcn.10001efd
test eax, eax
jbe 0x10001a33
push 0x10001278
push eax
mov ecx, ebx
call fcn.10001b84
or byte [ebp - 8], 0xff
or byte [ebp - 7], 0xff
push esi
push 0xd
lea eax, [ebp - 0xc]
push 9
push eax
push edi
mov ecx, ebx
mov byte [ebp - 0xc], 0x8d
mov byte [ebp - 0xb], 0x95
mov byte [ebp - 0xa], 0xa4
mov byte [ebp - 9], 0xfb
mov byte [ebp - 6], 0x8d
mov byte [ebp - 5], 0x45
mov byte [ebp - 4], 0xb8
call fcn.10001efd
test eax, eax
jbe 0x10001a79
push 0x10001330
push eax
mov ecx, ebx
call fcn.10001b84
mov esi, str.3DRole.dll
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x10001a96
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10001a7e
push 1
push 4
lea eax, [ebp - 8]
push 4
push eax
push esi
mov ecx, ebx
mov byte [ebp - 8], 0x52
mov byte [ebp - 7], 0x50
mov byte [ebp - 6], 0x6a
mov byte [ebp - 5], 0x33
call fcn.10001efd
test eax, eax
jbe 0x10001ac9
push 0x100013c2
push eax
mov ecx, ebx
call fcn.10001b84
and byte [ebp - 4], 0
and byte [ebp - 3], 0
push 1
push 0xffffff7e
lea eax, [ebp - 0xc]
push 0xa
push eax
push esi
mov ecx, ebx
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0xa], 8
mov byte [ebp - 9], 0x33
mov byte [ebp - 8], 0xd2
mov byte [ebp - 7], 0xb9
mov byte [ebp - 6], 0x10
mov byte [ebp - 5], 0x27
call fcn.10001efd
mov esi, eax
test esi, esi
jbe 0x10001b29
push 0x100012bc
push esi
mov ecx, ebx
call fcn.10001c8a
add esi, 0x27
push 0x100012fe
push esi
mov ecx, ebx
call fcn.10001c8a
push 1
pop eax
jmp 0x10001b30
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret