Function at 0x10099ab8
Capabilities:
Parse pe header

Disassembly:
push 0xf8
mov eax, 0x100e89b8
call fcn.100d393a
mov esi, ecx
mov dword [ebp - 0xfc], esi
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x100], edi
call fcn.1009c821
pop ecx
test al, al
je 0x1009a5dd
push ebx
call fcn.1009c6de
pop ecx
test al, al
je 0x1009a5dd
xor ebx, ebx
mov eax, edi
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], ebx
jb 0x10099b14
mov eax, dword [edi]
push dword [ebp - 0x34]
xor ecx, ecx
mov dword [ebp - 4], ebx
mov word [eax], cx
lea eax, [ebp - 0xdc]
push eax
call fcn.1009a6b8
pop ecx
pop ecx
cmp dword [ebp - 0xcc], 0
mov byte [ebp - 4], 1
jne 0x10099c3b
push 4
pop ebx
mov edi, 0x10114fdc
lea ecx, [ebp - 0x4c]
push edi
call fcn.10042e1e
push edi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.10042e1e
push dword [esi + 4]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.10042e1e
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], bl
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100b7903
add esp, 0xc
mov dword [ebp - 0xfc], eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 5
call fcn.10042e1e
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 6
call fcn.10042e1e
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 7
call fcn.10042e1e
cmp dword [ebp - 0xfc], 0
mov byte [ebp - 4], 1
je 0x1009a4a2
push edi
lea ecx, [ebp - 0x4c]
call fcn.10042e1e
push edi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 8
call fcn.10042e1e
push dword [esi + 4]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 9
call fcn.10042e1e
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100b7903
add esp, 0xc
mov esi, dword [eax]
push str.GetFromVDIStorage
push str.Unable_to_retrieve_AppData_Roaming_Path_in__s
push edi
mov ecx, dword [esi + 0x24]
push eax
call dword [0x101097a0]
call dword [esi + 0x24]
add esp, 0x10
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xb
call fcn.10042e1e
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xc
call fcn.10042e1e
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x4c]
jmp 0x1009a49d
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], 0xf
mov byte [ebp - 0xac], bl
mov edi, 0x10114fdc
mov byte [ebp - 4], 0xe
push edi
lea ecx, [ebp - 0x4c]
call fcn.10042e1e
push edi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xf
call fcn.10042e1e
push dword [esi + 4]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x10
call fcn.10042e1e
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100b7903
add esp, 0xc
mov dword [ebp - 0xf8], eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x12
call fcn.10042e1e
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x13
call fcn.10042e1e
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x14
call fcn.10042e1e
cmp dword [ebp - 0xf8], 0
mov byte [ebp - 4], 0xe
je 0x10099d70
push edi
lea ecx, [ebp - 0x4c]
call fcn.10042e1e
push edi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x15
call fcn.10042e1e
push dword [esi + 4]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x16
call fcn.10042e1e
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100b7903
add esp, 0xc
mov ecx, eax
cmp dword [ebp - 0xc8], 8
lea eax, [ebp - 0xdc]
cmovae eax, dword [ebp - 0xdc]
mov esi, dword [ecx]
push eax
push str.GetFromVDIStorage
push str._s_:_Reading_data_from_location__s
push ecx
mov ecx, dword [esi + 4]
call dword [0x101097a0]
call dword [esi + 4]
add esp, 0x10
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x18
call fcn.10042e1e
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x19
call fcn.10042e1e
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x1a
call fcn.10042e1e
mov esi, dword [ebp - 0xfc]
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x34], ebx
call fcn.10042e1e
lea ecx, [ebp - 0xdc]
push ecx
mov ecx, eax
call fcn.100b8842
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x1b
call fcn.10042e1e
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.10042e1e
pop ecx
pop ecx
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x15], al
call fcn.100660ee
cmp byte [ebp - 0x15], 0
jne 0x10099ebe
push 8
pop ebx
push edi
lea ecx, [ebp - 0x4c]
call fcn.10042e1e
push edi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x1c
call fcn.10042e1e
push dword [esi + 4]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x1d
call fcn.10042e1e
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100b7903
add esp, 0xc
mov dword [ebp - 0xf8], eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x1f
call fcn.10042e1e
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x20
call fcn.10042e1e
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x21
call fcn.10042e1e
cmp dword [ebp - 0xf8], 0
mov byte [ebp - 4], 0x1b
je 0x1009a48b
push edi
lea ecx, [ebp - 0x4c]
call fcn.10042e1e
push edi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x22
call fcn.10042e1e
push dword [esi + 4]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x23
call fcn.10042e1e
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x24
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100b7903
add esp, 0xc
mov esi, dword [eax]
push str.GetFromVDIStorage
push str.Failed_in_reading_file_content_in__s
push edi
mov ecx, dword [esi + 0x24]
push eax
call dword [0x101097a0]
call dword [esi + 0x24]
add esp, 0x10
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x25
call fcn.10042e1e
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x26
call fcn.10042e1e
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x4c]
jmp 0x1009a486
cmp dword [ebp - 0x9c], 0
jne 0x10099fc3
push 8
pop ebx
push edi
lea ecx, [ebp - 0x4c]
call fcn.10042e1e
push edi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x28
call fcn.10042e1e
push dword [esi + 4]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x29
call fcn.10042e1e
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x2a
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100b7903
add esp, 0xc
mov dword [ebp - 0xf8], eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x2b
call fcn.10042e1e
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x2c
call fcn.10042e1e
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x2d
call fcn.10042e1e
cmp dword [ebp - 0xf8], 0
mov byte [ebp - 4], 0x1b
je 0x1009a48b
push edi
lea ecx, [ebp - 0x4c]
call fcn.10042e1e
push edi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x2e
call fcn.10042e1e
push dword [esi + 4]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x2f
call fcn.10042e1e
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x30
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100b7903
mov ecx, eax
add esp, 0xc
mov eax, dword [ecx]
push str.GetFromVDIStorage
push str.Data_not_found_in__s
push ecx
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x101097a0]
call esi
add esp, 0xc
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x31
call fcn.10042e1e
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x32
call fcn.10042e1e
mov byte [ebp - 4], 0x33
jmp 0x10099eb6
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0x15]
call fcn.10042e1e
xor eax, eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], 0xf
mov byte [ebp - 0xc4], bl
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 0x36
push eax
lea eax, [ebp - 0xf8]
mov dword [ebp - 0xf8], 2
push eax
call fcn.10042e1e
pop ecx
pop ecx
test eax, eax
je 0x1009a120
push 4
pop ebx
push edi
lea ecx, [ebp - 0x7c]
call fcn.10042e1e
push edi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x37
call fcn.10042e1e
push dword [esi + 4]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x38
call fcn.10042e1e
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 0x39
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100b7903
add esp, 0xc
mov dword [ebp - 0xf8], eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x3a
call fcn.10042e1e
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x3b
call fcn.10042e1e
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x3c
call fcn.10042e1e
cmp dword [ebp - 0xf8], 0
mov byte [ebp - 4], 0x36
je 0x1009a461
push edi
lea ecx, [ebp - 0x7c]
call fcn.10042e1e
push edi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x3d
call fcn.10042e1e
push dword [esi + 4]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x3e
call fcn.10042e1e
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 0x3f
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100b7903
add esp, 0xc
mov esi, dword [eax]
push str.GetFromVDIStorage
push str.Failed_in_fetching_decryption_key_in__s
push edi
mov ecx, dword [esi + 0x24]
push eax
call dword [0x101097a0]
call dword [esi + 0x24]
add esp, 0x10
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x40
call fcn.10042e1e
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x41
call fcn.10042e1e
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x7c]
jmp 0x1009a45c
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.10042e1e
pop ecx
pop ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], bl
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x43
push eax
push 1
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.100c30ee
add esp, 0x10
test eax, eax
je 0x1009a3c3
push 4
pop ebx
push edi
lea ecx, [ebp - 0x94]
call fcn.10042e1e
push edi
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x44
call fcn.10042e1e
push dword [esi + 4]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x45
call fcn.10042e1e
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 0x46
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100b7903
add esp, 0xc
mov dword [ebp - 0xf8], eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x47
call fcn.10042e1e
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x48
call fcn.10042e1e
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x49
call fcn.10042e1e
cmp dword [ebp - 0xf8], 0
mov byte [ebp - 4], 0x43
je 0x1009a290
push edi
lea ecx, [ebp - 0x94]
call fcn.10042e1e
push edi
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x4a
call fcn.10042e1e
push dword [esi + 4]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x4b
call fcn.10042e1e
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 0x4c
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100b7903
add esp, 0xc
mov esi, eax
mov dword [ebp - 0xf8], esi
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, dword [esi]
push eax
push str.GetFromVDIStorage
push str.Failed_in_decrypting_data_in__s__with_last_error__d
mov ecx, dword [esi + 0x24]
push edi
push dword [ebp - 0xf8]
call dword [0x101097a0]
call dword [esi + 0x24]
add esp, 0x14
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x4d
call fcn.10042e1e
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x4e
call fcn.10042e1e
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x4f
call fcn.10042e1e
mov esi, dword [ebp - 0xfc]
mov byte [ebp - 4], 0x43
push edi
lea ecx, [ebp - 0x94]
call fcn.10042e1e
push edi
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x50
call fcn.10042e1e
push dword [esi + 4]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x51
call fcn.10042e1e
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 0x52
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100b7903
add esp, 0xc
mov dword [ebp - 0xf8], eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x53
call fcn.10042e1e
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x54
call fcn.10042e1e
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x55
call fcn.10042e1e
cmp dword [ebp - 0xf8], 0
mov byte [ebp - 4], 0x43
je 0x1009a455
push edi
lea ecx, [ebp - 0x94]
call fcn.10042e1e
push edi
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x56
call fcn.10042e1e
push dword [esi + 4]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x57
call fcn.10042e1e
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 0x58
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100b7903
add esp, 0xc
lea ecx, [ebp - 0xac]
cmp dword [ebp - 0x98], 0x10
mov edx, eax
lea eax, [ebp - 0xc4]
cmovae ecx, dword [ebp - 0xac]
cmp dword [ebp - 0xb0], 0x10
mov esi, dword [edx]
cmovae eax, dword [ebp - 0xc4]
push ecx
push eax
mov ecx, dword [esi + 4]
push str.GetFromVDIStorage
push str._s_:_Decryption_key_used_was__s__and_the_base64_encoded_data_was__s
push edx
call dword [0x101097a0]
call dword [esi + 4]
add esp, 0x14
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x59
call fcn.10042e1e
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x5a
call fcn.10042e1e
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x94]
jmp 0x1009a450
push 0xf
pop eax
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x7c], bl
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x30], bl
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x5d
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.10098a89
xor eax, eax
mov dword [ebp - 0x84], ebx
add esp, 0xc
mov dword [ebp - 0x80], 7
mov word [ebp - 0x94], ax
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 0x5e
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.10042e1e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x100]
lea eax, [ebp - 0x94]
push eax
call fcn.10042e1e
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x5f
call fcn.10042e1e
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x60
call fcn.10042e1e
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x7c]
call fcn.10042e1e
mov byte [ebp - 4], 0x62
lea ecx, [ebp - 0x4c]
call fcn.10042e1e
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 0x63
call fcn.10042e1e
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x64
call fcn.10042e1e
mov byte [ebp - 4], 0x65
lea ecx, [ebp - 0xf4]
call fcn.10042e1e
lea ecx, [ebp - 0x34]
call fcn.1006605c
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0xac]
call fcn.10042e1e
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 0x67
call fcn.10042e1e
jmp 0x1009a5d9
mov eax, ebx
jmp 0x1009a5e0
push 5
pop eax
call fcn.100d3887
ret 0x14