Function at 0x9300c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb15a30
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x728
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x6fc], ebx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x724], edi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x700], esi
mov dword [ebp - 0x680], edx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x694], eax
mov dword [ebp - 0x738], ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x72c], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x6a8], ecx
xor ecx, ecx
mov dword [ebp - 0x730], ecx
mov dword [ebp - 0x718], ecx
mov dword [ebp - 0x67c], ecx
mov dword [ebp - 0x69c], ecx
mov dword [ebp - 0x6dc], ecx
mov dword [ebp - 0x6e4], ecx
wait
mov dword [ebp - 4], ecx
mov dword [ebp - 0x6d8], ecx
mov dword [ebp - 0x684], ecx
mov dword [ebp - 0x708], ecx
cmp eax, ecx
je 0x93017d
mov dword [eax], ecx
cmp edx, ecx
je 0x930183
mov dword [edx], ecx
cmp edi, ecx
je 0x930189
mov dword [edi], ecx
mov eax, esi
call fcn.00964530
mov dword [ebp - 0x6b8], eax
cmp eax, ecx
jne 0x9301a6
cmp ebx, ecx
je 0x9301f1
cmp byte [ebx], cl
je 0x9301f1
cmp eax, ecx
je 0x9301c8
push 1
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x6d8], eax
mov ebx, esi
call fcn.0094b560
mov edi, eax
mov dword [ebp - 0x6bc], edi
jmp 0x9301d5
call fcn.0094b570
mov dword [ebp - 0x6bc], eax
mov edi, eax
test edi, edi
jne 0x930201
cmp dword [ebp - 0x6b8], edi
je 0x9301f1
push edi
push edi
mov edx, dword [ebp - 0x6d8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
wait
mov dword [ebp - 4], 0xfffffffe
or eax, 0xffffffff
jmp 0x931a08
mov esi, edi
call fcn.0094b580
mov ebx, eax
mov dword [ebp - 0x6b8], ebx
push 0x12c
push 0
lea eax, [ebp - 0x678]
push eax
call fcn.00a7ffb0
add esp, 0xc
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x678]
mov eax, edi
call fcn.0094b640
add esp, 8
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x67c], eax
cmp eax, 0xffffffff
je 0x93045d
test bl, 1
je 0x930467
cmp eax, 2
jne 0x93045d
cmp byte [0xbfa5a0], 0
jne 0x93027a
push 0xbfa5a0
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x12c
push 0
lea ecx, [ebp - 0x678]
push ecx
call fcn.00a7ffb0
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x678]
mov eax, edi
call fcn.0094b640
add esp, 8
test eax, eax
je 0x9302b2
mov dword [ebp - 0x684], 1
test byte [ebp - 0x570], 0x10
jne 0x93045d
mov eax, dword [ebp - 0x550]
test eax, eax
je 0x93045d
mov ebx, eax
cmp dword [ebp - 0x684], 0
jne 0x930467
push 0x12c
push 0
lea edx, [ebp - 0x678]
push edx
call fcn.00a7ffb0
add esp, 0xc
push 0
push 1
lea edx, [ebp - 0x678]
mov eax, edi
call fcn.0094b640
add esp, 8
mov esi, eax
mov eax, 1
test esi, esi
je 0x930317
mov dword [ebp - 0x684], eax
test byte [ebp - 0x570], 0x10
je 0x93032b
mov dword [ebp - 0x684], eax
jmp 0x930467
cmp ebx, dword [ebp - 0x550]
je 0x93033e
mov dword [ebp - 0x684], eax
jmp 0x930467
mov byte [ebp - 0x440], 0
push 0x103
push 0
lea eax, [ebp - 0x43f]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x548], 0
push 0x103
push 0
lea ecx, [ebp - 0x547]
push ecx
call fcn.00a7ffb0
add esp, 0xc
lea edx, [ebp - 0x440]
push edx
push 0
push 0xae4720
push 0xbfa5a0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
call ebx
push 0
push edi
lea ecx, [ebp - 0x440]
call fcn.0094b690
add esp, 8
test esi, esi
je 0x9303b4
mov dword [ebp - 0x684], 1
jmp 0x930433
lea eax, [ebp - 0x548]
push eax
push 0
push 0xae4720
push 0xbfa5a0
call ebx
mov esi, 1
push esi
push edi
lea ecx, [ebp - 0x548]
call fcn.0094b690
add esp, 8
xor ebx, ebx
cmp dword [ebp - 0x684], ebx
jne 0x930433
mov dword [ebp - 0x698], ebx
push esi
push ebx
lea edx, [ebp - 0x698]
lea ecx, [ebp - 0x440]
call fcn.0095a0f0
push esi
push ebx
lea edx, [ebp - 0x698]
lea ecx, [ebp - 0x548]
call fcn.0095a0f0
add esp, 0x10
cmp dword [ebp - 0x698], ebx
jne 0x930427
mov dword [ebp - 0x684], esi
jmp 0x930433
mov dword [ebp - 0x684], ebx
mov dword [ebp - 0x708], esi
cmp byte [ebp - 0x440], 0
je 0x930447
lea eax, [ebp - 0x440]
call fcn.0094dd20
cmp byte [ebp - 0x548], 0
je 0x930467
lea eax, [ebp - 0x548]
call fcn.0094dd20
jmp 0x930467
mov dword [ebp - 0x684], 1
test byte [ebp - 0x6b8], 1
je 0x93048f
mov ecx, dword [ebp - 0x6a8]
test ecx, ecx
je 0x93048f
mov eax, dword [ecx]
test eax, eax
jbe 0x93048f
cmp eax, 4
jne 0x93068b
mov dword [ecx], 0xff
cmp dword [ebp - 0x684], 0
jne 0x931934
xor edi, edi
mov dword [ebp - 0x68c], edi
mov dword [ebp - 0x6b0], edi
mov dword [ebp - 0x6cc], edi
mov dword [ebp - 0x6a4], edi
mov dword [ebp - 0x710], edi
mov dword [ebp - 0x6c0], edi
mov dword [ebp - 0x6f0], edi
mov dword [ebp - 0x6e0], edi
mov dword [ebp - 0x6c8], edi
mov dword [ebp - 0x6ec], edi
mov dword [ebp - 0x6d0], edi
mov dword [ebp - 0x6d4], edi
mov dword [ebp - 0x6f8], 0xffffffff
mov dword [ebp - 0x6c4], edi
mov dword [ebp - 0x6a0], edi
mov dword [ebp - 0x6ac], edi
mov dword [ebp - 0x6b4], edi
mov byte [ebp - 0x230], 0
push 0x103
push edi
lea edx, [ebp - 0x22f]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x338], 0
push 0x103
push edi
lea eax, [ebp - 0x337]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x690], edi
jmp 0x930550
mov ebx, dword [ebp - 0x67c]
cmp dword [ebp - 0x690], ebx
jge 0x9305b2
mov dword [ebp - 0x714], edi
push 0x12c
push edi
lea ecx, [ebp - 0x678]
push ecx
call fcn.00a7ffb0
add esp, 0xc
push edi
mov edx, dword [ebp - 0x690]
push edx
lea edx, [ebp - 0x678]
mov eax, dword [ebp - 0x6bc]
call fcn.0094b640
add esp, 8
cmp eax, edi
je 0x93073c
mov dword [ebp - 0x68c], edi
cmp ebx, 1
jne 0x9305b2
mov dword [ebp - 0x67c], 0xffffffff
mov ecx, dword [ebp - 0x68c]
mov ebx, 1
cmp ecx, ebx
jne 0x9318e5
mov dword [ebp - 0x67c], ebx
cmp dword [ebp - 0x6f0], 0
je 0x931934
cmp dword [ebp - 0x6ac], 0
jne 0x931934
cmp dword [ebp - 0x6e0], 0
je 0x931934
cmp dword [ebp - 0x6ec], 0
jne 0x931934
cmp dword [ebp - 0x6c8], 3
jae 0x931934
cmp dword [ebp - 0x6b0], ebx
je 0x930621
cmp dword [ebp - 0x6cc], 0
je 0x931934
cmp dword [ebp - 0x6a4], 0
jne 0x931934
cmp dword [ebp - 0x6b4], 0
jne 0x931934
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x338]
call fcn.0094c330
test eax, eax
je 0x931934
cmp dword [ebp - 0x6d4], 0
jne 0x931934
mov eax, dword [ebp - 0x680]
test eax, eax
je 0x93066d
mov dword [eax], ebx
mov eax, dword [ebp - 0x694]
test eax, eax
je 0x931934
cmp dword [eax], 0
jne 0x931934
mov dword [eax], ebx
jmp 0x931934
cmp eax, 1
je 0x930699
cmp eax, 2
jne 0x93048f
xor esi, esi
mov dword [ebp - 0x728], esi
cmp esi, dword [ebp - 0x67c]
jge 0x93048f
push 0x12c
push 0
lea ecx, [ebp - 0x678]
push ecx
call fcn.00a7ffb0
add esp, 0xc
push 0
push esi
lea edx, [ebp - 0x678]
mov eax, edi
call fcn.0094b640
add esp, 8
test eax, eax
jne 0x93048f
test byte [ebp - 0x570], 0x10
jne 0x930736
cmp dword [ebp - 0x550], eax
jle 0x930736
mov dword [ebp - 0x6e8], eax
mov ebx, dword [ebp - 0x6a8]
mov edx, dword [ebx]
push edx
lea eax, [ebp - 0x674]
push eax
mov ecx, dword [ebp - 0x6fc]
push ecx
lea ecx, [ebp - 0x6e8]
call fcn.0092fbf0
add esp, 0xc
test eax, eax
je 0x930729
mov dword [ebx], 0xff
jmp 0x93048f
cmp dword [ebp - 0x6e8], 0
jne 0x93048f
inc esi
jmp 0x93069b
test byte [ebp - 0x570], 0x10
je 0x9307a5
mov ebx, 1
mov dword [ebp - 0x6b4], ebx
lea edi, [ebp - 0x674]
call fcn.009229c0
test eax, eax
je 0x9318d8
mov eax, dword [ebp - 0x680]
test eax, eax
je 0x930773
mov dword [eax], 0
mov eax, dword [ebp - 0x694]
test eax, eax
je 0x930783
mov dword [eax], 0
add dword [ebp - 0x68c], 2
cmp dword [ebp - 0x67c], ebx
jne 0x9305b2
mov dword [ebp - 0x67c], 0
jmp 0x9305b2
lea eax, [ebp - 0x674]
mov dword [ebp - 0x734], eax
cmp byte [eax], 0
je 0x9307b9
inc eax
jmp 0x9307ab
lea ecx, [ebp - 0x674]
sub eax, ecx
xor esi, esi
mov dword [ebp - 0x71c], esi
xor edx, edx
mov dword [ebp - 0x720], edx
cmp edx, eax
jge 0x9307f0
mov cl, byte [ebp + edx - 0x674]
cmp cl, 0x5f
je 0x9307e6
cmp cl, 0x20
jne 0x9307ed
inc esi
mov dword [ebp - 0x71c], esi
inc edx
jmp 0x9307cb
cmp esi, eax
je 0x9318d8
cmp dword [ebp - 0x550], edi
jle 0x9318cb
mov dword [ebp - 0x688], edi
mov byte [ebp - 0x128], 0
push 0x103
push edi
lea edx, [ebp - 0x127]
push edx
call fcn.00a7ffb0
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x698], esi
push 0x2e
lea eax, [ebp - 0x674]
push eax
call fcn.00a7aa50
add esp, 8
cmp eax, edi
je 0x930864
push 0x103
push eax
lea ecx, [ebp - 0x128]
push ecx
call fcn.00a7a620
add esp, 0xc
cmp byte [ebp - 0x26], 0
je 0x93089f
mov byte [ebp - 0x25], 0
jmp 0x93089f
push 0x5f
lea eax, [ebp - 0x674]
push eax
call fcn.00a7aa50
add esp, 8
cmp eax, edi
je 0x9308ad
push 0x103
push eax
lea ecx, [ebp - 0x128]
push ecx
call fcn.00a7a620
add esp, 0xc
cmp byte [ebp - 0x26], 0
je 0x930898
mov byte [ebp - 0x25], 0
mov byte [ebp - 0x128], 0x2e
lea edx, [ebp - 0x128]
mov esi, edx
mov dword [ebp - 0x698], edx
cmp dword [ebp - 0x6f8], 0xffffffff
jne 0x930b08
mov al, 0x5c
lea edx, [ebp - 0x674]
call fcn.00975920
mov edi, eax
mov al, 0x2f
lea edx, [ebp - 0x674]
call fcn.00975920
add edi, eax
mov dword [ebp - 0x6f8], edi
cmp edi, 1
jl 0x9308ed
mov dword [ebp - 0x6b4], 1
cmp edi, 2
jl 0x930b08
mov eax, dword [ebp - 0x680]
xor edi, edi
cmp eax, edi
je 0x930904
mov dword [eax], edi
add dword [ebp - 0x68c], 2
cmp ebx, 1
jne 0x9305b2
mov eax, str..SCR
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930a98
mov eax, str..PIF
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930a98
mov eax, str..VBE
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930a98
mov eax, str..VBS
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930a98
mov eax, str..COM
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930a98
mov eax, str..CPL
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930a98
mov eax, str..WSF
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930a98
mov eax, str..HTA
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930a98
mov eax, str..CMD
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930a98
mov eax, str..MSI
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930a98
mov eax, str..CHM
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930a98
mov eax, str..SHTML
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930a98
mov eax, str..URL
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930a98
mov eax, 0xace5c0
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x930a48
mov eax, str..JSON
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930a48
mov eax, str..JSP
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x930a98
mov eax, 0xace5d4
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930a98
mov eax, str..JSE
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930a98
mov eax, str..JAR
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930a98
mov eax, str..LNK
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930a98
mov eax, 0xace5f4
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x930ad4
mov eax, str..MSI
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x930aba
mov al, 0x2e
lea edx, [ebp - 0x674]
call fcn.00975920
cmp eax, 3
jg 0x930ad4
push edi
push str._setup_
lea eax, [ebp - 0x674]
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x930aeb
mov eax, dword [ebp - 0x694]
cmp eax, edi
je 0x930ae0
mov dword [eax], edi
mov dword [ebp - 0x67c], edi
jmp 0x9305b2
cmp dword [ebp - 0x694], edi
je 0x9305b2
mov ecx, dword [ebp - 0x694]
mov dword [ecx], 1
jmp 0x9305b2
xor ebx, ebx
lea edi, [ebp - 0x674]
call fcn.009229c0
test eax, eax
je 0x930dad
mov edi, 1
mov dword [ebp - 0x6f4], edi
test esi, esi
je 0x930d67
mov eax, str..SCR
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930d24
mov eax, str..PIF
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930d24
mov eax, str..VBE
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930d24
mov eax, str..VBS
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930d24
mov eax, str..COM
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930d24
mov eax, str..CPL
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930d24
mov eax, str..WSF
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930d24
mov eax, str..HTA
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930d24
mov eax, str..CMD
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930d24
mov eax, str..MSI
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930d24
mov eax, str..CHM
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930d24
mov eax, str..SHTML
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930d24
mov eax, str..URL
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930d24
mov eax, 0xace5c0
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x930c68
mov eax, str..JSON
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930c68
mov eax, str..JSP
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x930d24
mov eax, 0xace5d4
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930d24
mov eax, str..JSE
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930d24
mov eax, str..JAR
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930d24
mov eax, str..LNK
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930d24
mov eax, 0xace5f4
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930d24
mov eax, str..DOC
mov ecx, esi
call fcn.0094c3e0
test eax, eax
je 0x930d24
mov eax, str..DOT
mov ecx, esi
call fcn.0094c3e0
test eax, eax
je 0x930d24
mov eax, str..RTF
mov ecx, esi
call fcn.0094c3e0
test eax, eax
je 0x930d24
mov eax, str..XLS
mov ecx, esi
call fcn.0094c3e0
test eax, eax
je 0x930d24
mov eax, str..XLT
mov ecx, esi
call fcn.0094c3e0
test eax, eax
je 0x930d24
mov eax, str..PUB
mov ecx, esi
call fcn.0094c3e0
test eax, eax
jne 0x930d67
mov eax, str..MSI
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x930d46
mov al, 0x2e
lea edx, [ebp - 0x674]
call fcn.00975920
cmp eax, 3
jg 0x930d61
push 0
push str._setup_
lea edx, [ebp - 0x674]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x930d9d
mov dword [ebp - 0x6f4], edi
mov eax, dword [ebp - 0x680]
test eax, eax
je 0x930d73
mov dword [eax], ebx
mov eax, dword [ebp - 0x694]
test eax, eax
je 0x930d7f
mov dword [eax], ebx
add dword [ebp - 0x68c], 2
cmp dword [ebp - 0x67c], edi
jne 0x9305b2
mov dword [ebp - 0x67c], ebx
jmp 0x9305b2
mov dword [ebp - 0x688], edi
mov dword [ebp - 0x6f4], ebx
mov ebx, edi
jmp 0x930db2
mov ebx, 1
xor edi, edi
cmp esi, edi
je 0x930eb8
mov eax, 0xae0f28
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930e13
mov eax, str..json
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930e13
mov eax, 0xae0f18
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930e13
mov eax, str..xaml
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x930e26
mov dword [ebp - 0x688], ebx
mov dword [ebp - 0x6c4], ebx
inc dword [ebp - 0x690]
jmp 0x930550
mov dword [ebp - 0x688], ebx
inc dword [ebp - 0x690]
xor edi, edi
jmp 0x930550
cmp esi, edi
je 0x930eb8
lea eax, [ebp - 0x674]
push eax
call fcn.00919c00
add esp, 4
test eax, eax
je 0x930eb8
cmp byte [ebp - 0x230], 0
jne 0x930e84
push 0x103
lea ecx, [ebp - 0x674]
push ecx
lea edx, [ebp - 0x230]
push edx
call fcn.00a7a620
add esp, 0xc
mov byte [ebp - 0x12d], 0
push 0x2e
lea eax, [ebp - 0x230]
push eax
call fcn.00a7aa50
add esp, 8
cmp eax, edi
je 0x930e84
mov byte [eax], 0
mov dword [ebp - 0x688], ebx
cmp dword [ebp - 0x6b0], 4
jae 0x930ea6
add dword [ebp - 0x6b0], ebx
inc dword [ebp - 0x690]
xor edi, edi
jmp 0x930550
add dword [ebp - 0x68c], 2
mov dword [ebp - 0x6b0], edi
jmp 0x9318aa
mov dword [ebp - 0x70c], edi
cmp byte [ebp - 0x338], 0
jne 0x930f01
push 0x103
lea ecx, [ebp - 0x674]
push ecx
lea edx, [ebp - 0x338]
push edx
call fcn.00a7a620
add esp, 0xc
mov byte [ebp - 0x235], 0
push 0x2e
lea eax, [ebp - 0x338]
push eax
call fcn.00a7aa50
add esp, 8
cmp eax, edi
je 0x930f01
mov byte [eax], 0
mov edi, dword [ebp - 0x690]
test edi, edi
jne 0x930f42
mov edx, dword [ebp - 0x718]
test edx, edx
je 0x930f2c
lea ecx, [ebp - 0x674]
jmp 0x930f20
mov al, byte [ecx]
mov byte [edx], al
add ecx, ebx
add edx, ebx
test al, al
jne 0x930f20
test edi, edi
jne 0x930f42
mov eax, dword [ebp - 0x730]
test eax, eax
je 0x930f42
mov ecx, dword [ebp - 0x550]
mov dword [eax], ecx
test esi, esi
je 0x93100d
mov edi, dword [ebp - 0x694]
test edi, edi
je 0x93100d
cmp dword [edi], 0
jne 0x93100d
mov edx, dword [ebp - 0x550]
push edx
lea eax, [ebp - 0x674]
push eax
call fcn.00919660
add esp, 8
test eax, eax
jne 0x930f97
cmp dword [ebp - 0x6c4], eax
je 0x93100d
mov eax, 0xace578
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x93100d
mov dword [ebp - 0x688], ebx
cmp dword [ebp - 0x6b4], 0
je 0x930faf
cmp dword [ebp - 0x69c], 0
jne 0x930fb1
mov dword [edi], ebx
mov eax, str..ISO
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930ff1
mov eax, str..IMG
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930ff1
mov eax, str..ING
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x930ff1
mov eax, str..DAA
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x93100d
mov ebx, dword [ebp - 0x680]
test ebx, ebx
je 0x931001
mov dword [ebx], 1
mov dword [ebp - 0x6a4], 1
jmp 0x931013
mov ebx, dword [ebp - 0x680]
test esi, esi
je 0x931839
mov eax, str..SCR
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9317af
mov eax, str..PIF
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9317af
mov eax, str..VBE
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9317af
mov eax, str..VBS
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9317af
mov eax, str..COM
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9317af
mov eax, str..CPL
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9317af
mov eax, str..WSF
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9317af
mov eax, str..HTA
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9317af
mov eax, str..CHM
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9317af
mov eax, str..SHTML
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9317af
mov eax, str..URL
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9317af
mov eax, 0xace5c0
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x93112b
mov eax, str..JSON
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x93112b
mov eax, str..JSP
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x9317af
mov eax, str..JSE
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9317af
mov eax, str..JAR
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9317af
mov eax, str..LNK
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9317af
cmp dword [ebp - 0x6c4], 0
je 0x931184
mov eax, 0xace578
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x9317af
mov eax, str..HTM
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x93164a
mov eax, str..HTML
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x93164a
inc esi
call fcn.00975880
mov edi, dword [ebp - 0x698]
test eax, eax
jne 0x93157a
mov eax, str..ZIP
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x93157a
mov eax, str..CAB
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x93157a
mov eax, 0xae46f0
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x93157a
mov eax, 0xae46f4
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x93157a
mov eax, str..ACE
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x93157a
mov eax, str..ARJ
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x93157a
mov eax, 0xae4708
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x93157a
mov eax, 0xace5f4
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x93152e
mov eax, str..CMD
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x93152e
mov eax, 0xace5d4
mov ecx, edi
call fcn.0094c330
test eax, eax
jne 0x9312ee
push eax
push str._setup_
lea ecx, [ebp - 0x674]
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x93184e
mov ecx, 1
mov dword [ebp - 0x688], ecx
mov dword [ebp - 0x6c0], ecx
fild dword [ebp - 0x550]
fcomp qword [0xb0bb78]
fnstsw ax
test ah, 5
jp 0x93184e
test ebx, ebx
je 0x9312d0
mov dword [ebx], ecx
cmp dword [ebp - 0x690], 0
jne 0x93184e
mov edx, dword [ebp - 0x550]
mov dword [ebp - 0x6a0], edx
jmp 0x93184e
mov eax, str..MSI
mov ecx, edi
call fcn.0094c330
test eax, eax
jne 0x931368
mov al, 0x2e
lea edx, [ebp - 0x674]
call fcn.00975920
mov ecx, eax
cmp ecx, 3
jg 0x931325
mov eax, 1
mov dword [ebp - 0x688], eax
mov dword [ebp - 0x6c0], eax
jmp 0x931335
mov eax, dword [ebp - 0x694]
test eax, eax
je 0x931335
mov dword [eax], 0
fild dword [ebp - 0x550]
fcomp qword [0xb0bb78]
fnstsw ax
test ah, 5
jp 0x93184e
cmp ecx, 3
jg 0x93184e
test ebx, ebx
je 0x931822
mov dword [ebx], 1
jmp 0x931822
mov eax, str..DOC
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x9313f7
mov eax, str..DOT
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x9313f7
mov eax, str..RTF
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x9313f7
mov eax, str..XLS
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x9313f7
mov eax, str..XLT
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x9313f7
mov eax, str..PUB
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x9313f7
test ebx, ebx
je 0x9313d7
cmp dword [ebx], 1
je 0x9313d7
mov dword [ebx], 0
mov eax, edi
lea ecx, [ebp - 0x674]
call fcn.00922bc0
test eax, eax
je 0x931848
inc dword [ebp - 0x69c]
jmp 0x931848
mov eax, 1
mov dword [ebp - 0x714], eax
mov dword [ebp - 0x688], eax
fild dword [ebp - 0x550]
fcomp qword [0xb0bb78]
fnstsw ax
test ah, 5
jp 0x931510
xor ebx, ebx
mov dword [ebp - 0x6a8], ebx
mov dword [ebp - 0x6f0], 1
lea esi, [ebp - 0x674]
call fcn.00905840
lea esi, [ebx + 1]
test eax, eax
je 0x93146f
add dword [ebp - 0x6c8], esi
mov dword [ebp - 0x6e0], esi
push ebx
push str.resume
lea ecx, [ebp - 0x674]
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x93146f
mov dword [ebp - 0x6ec], esi
cmp dword [ebp - 0x6cc], 0
je 0x931496
cmp dword [ebp - 0x6b4], 0
jne 0x931496
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x338]
call fcn.0094c330
test eax, eax
jne 0x9314cb
push edi
lea edx, [ebp - 0x674]
push edx
mov eax, dword [ebp - 0x700]
push eax
lea ecx, [ebp - 0x6a8]
mov edx, dword [ebp - 0x6fc]
call fcn.0092f8a0
add esp, 0xc
mov ebx, dword [ebp - 0x6a8]
test eax, eax
je 0x931502
cmp ebx, 0x230
je 0x93150a
mov eax, dword [ebp - 0x680]
test eax, eax
je 0x9314d7
mov dword [eax], esi
mov dword [ebp - 0x6a4], esi
mov eax, dword [ebp - 0x694]
test eax, eax
je 0x9314ee
cmp dword [eax], 0
jne 0x9314ee
mov dword [eax], esi
mov eax, dword [ebp - 0x738]
test eax, eax
je 0x931502
cmp dword [eax], 0x379
je 0x931502
mov dword [eax], ebx
cmp ebx, 0x230
jne 0x931510
add dword [ebp - 0x69c], esi
cmp dword [ebp - 0x690], 0
jne 0x93184e
mov ecx, dword [ebp - 0x550]
mov dword [ebp - 0x6a0], ecx
jmp 0x93184e
cmp dword [ebp - 0x690], 0
jne 0x931543
mov edx, dword [ebp - 0x550]
mov dword [ebp - 0x6a0], edx
cmp dword [ebp - 0x550], 0x5c00
jle 0x93156f
mov eax, 1
mov dword [ebp - 0x688], eax
mov dword [ebp - 0x6c0], eax
test ebx, ebx
je 0x93184e
mov dword [ebx], eax
jmp 0x93184e
inc dword [ebp - 0x6dc]
jmp 0x93184e
lea esi, [ebp - 0x674]
call fcn.00905840
mov eax, edi
mov ecx, esi
call fcn.00922bc0
test eax, eax
mov eax, 1
je 0x93159d
add dword [ebp - 0x69c], eax
mov dword [ebp - 0x688], eax
mov dword [ebp - 0x710], eax
fild dword [ebp - 0x550]
fcomp qword [0xb0bb78]
fnstsw ax
test ah, 5
jp 0x93184e
push 0x20
lea eax, [ebp - 0x674]
push eax
call fcn.00a7a2c0
add esp, 8
test eax, eax
jne 0x93184e
mov al, 0x2e
lea edx, [ebp - 0x674]
call fcn.00975920
cmp eax, 2
jge 0x93184e
mov al, 0x5f
lea edx, [ebp - 0x674]
call fcn.00975920
cmp eax, 1
jge 0x93184e
mov dword [ebp - 0x704], 1
lea ecx, [ebp - 0x704]
push ecx
push str.IgnoreNestedArchive
mov ecx, str.SoftwareMicroWorld
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0x704], 0
jne 0x93184e
test ebx, ebx
je 0x9312d0
mov dword [ebx], 1
jmp 0x9312d0
cmp dword [ebp - 0x690], 0
jne 0x93165f
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x6a0], eax
mov edi, 1
mov dword [ebp - 0x688], edi
mov esi, dword [ebp - 0x550]
cmp esi, 0x400
jl 0x9316b3
mov al, 0x2e
lea edx, [ebp - 0x674]
call fcn.00975920
cmp eax, 2
jge 0x9316b3
mov al, 0x2d
lea edx, [ebp - 0x674]
call fcn.00975920
cmp eax, 2
jge 0x9316b3
cmp esi, 0x5000
jge 0x93184e
add dword [ebp - 0x6e4], edi
jmp 0x93184e
lea esi, [ebp - 0x674]
call fcn.00905840
test eax, eax
je 0x93184e
push 0
push str.mailer
mov ecx, esi
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x93184e
push 0
push str.email
mov edx, esi
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x93184e
push 0
push str.Report
mov eax, esi
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x93184e
push 0
push str.Diag
mov ecx, esi
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x93184e
push 0
push str.Profile
mov edx, esi
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x93184e
push 0
push str.risk
mov eax, esi
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x93184e
push 0
push str.Certif
mov ecx, esi
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x93184e
push 0
push str.Read
mov edx, esi
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x93184e
test ebx, ebx
je 0x9317a4
mov dword [ebx], edi
mov dword [ebp - 0x6a4], edi
jmp 0x93184e
mov edi, 1
mov dword [ebp - 0x688], edi
mov eax, str..VBE
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x93180a
mov eax, str..VBS
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x93180a
mov eax, 0xace5c0
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x93180a
mov eax, str..JSE
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x93180a
mov eax, str..WSF
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x931816
mov dword [ebp - 0x70c], edi
add dword [ebp - 0x6d0], edi
test ebx, ebx
je 0x93181c
mov dword [ebx], edi
mov dword [ebp - 0x6a4], edi
cmp dword [ebp - 0x690], 0
jne 0x93184e
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x6a0], eax
jmp 0x93184e
test ebx, ebx
je 0x931848
cmp dword [ebx], 1
je 0x931848
mov dword [ebx], 0
inc dword [ebp - 0x6ac]
cmp dword [ebp - 0x70c], 0
je 0x931865
mov ecx, dword [ebp - 0x6d0]
add ecx, 0xfffffffe
cmp ecx, 1
jbe 0x9318d8
mov eax, dword [ebp - 0x690]
test eax, eax
jle 0x9318aa
mov edx, dword [ebp - 0x550]
cmp edx, dword [ebp - 0x6a0]
jne 0x93189d
cmp dword [ebp - 0x714], 0
jne 0x93189d
mov dword [ebp - 0x6cc], 1
inc dword [ebp - 0x690]
xor edi, edi
jmp 0x930550
test eax, eax
jle 0x9318aa
cmp dword [ebp - 0x6e0], 0
jne 0x9318d8
cmp dword [ebp - 0x688], 0
jne 0x9318c5
mov eax, dword [ebp - 0x6d4]
inc eax
mov dword [ebp - 0x6d4], eax
cmp eax, 4
jb 0x9318d8
inc dword [ebp - 0x68c]
cmp dword [ebp - 0x68c], 2
jg 0x9305b2
inc dword [ebp - 0x690]
xor edi, edi
jmp 0x930550
mov esi, dword [ebp - 0x680]
test esi, esi
je 0x9318f3
cmp dword [esi], ebx
je 0x9318ff
mov eax, dword [ebp - 0x6a4]
cmp eax, ebx
jne 0x931934
jmp 0x931905
mov eax, dword [ebp - 0x6a4]
cmp ecx, 2
jne 0x931934
test eax, eax
jne 0x931916
cmp dword [ebp - 0x6c0], eax
je 0x93192a
cmp dword [ebp - 0x710], ebx
jne 0x931922
test eax, eax
je 0x93192a
mov dword [ebp - 0x67c], ebx
jmp 0x931947
test esi, esi
je 0x931934
mov dword [esi], 0
mov ebx, 1
mov esi, dword [ebp - 0x680]
cmp dword [ebp - 0x67c], ebx
jne 0x93196b
mov eax, dword [ebp - 0x72c]
test eax, eax
je 0x93196b
cmp dword [ebp - 0x69c], ebx
je 0x931969
cmp dword [ebp - 0x6dc], ebx
je 0x931969
cmp dword [ebp - 0x6e4], ebx
jne 0x93196b
mov dword [eax], ebx
mov edi, dword [ebp - 0x6bc]
mov eax, edi
call fcn.0094ba80
test al, al
je 0x93198a
mov ebx, edi
call fcn.0094ba00
mov ebx, 1
jmp 0x931995
call fcn.00947670
mov esi, dword [ebp - 0x680]
test byte [ebp - 0x6b8], 1
je 0x9319bd
cmp dword [ebp - 0x708], 0
jne 0x9319bd
mov eax, dword [ebp - 0x724]
test eax, eax
je 0x9319b3
mov dword [eax], ebx
test esi, esi
je 0x9319bd
mov dword [esi], 0
mov ecx, dword [ebp - 0x700]
mov eax, ecx
call fcn.00964530
test eax, eax
je 0x9319e0
push 0
push 0
mov eax, dword [ebp - 0x6d8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
wait
jmp 0x9319fb
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x67c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret