Function at 0x10003af0
Capabilities:
Contain obfuscated stackstrings
Create directory
Delete directory
Delete file
Encode data using base64
Move file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100453bc
mov eax, dword fs:[0]
push eax
sub esp, 0x198
mov eax, dword [0x1005a280]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14c], ebx
lea eax, [ebp - 0x148]
mov dword [ebp - 4], 0
lea edi, [ebp - 0x146]
mov byte [ebp - 4], 1
mov word [ebp - 0x148], 0x5453
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0
sub edi, eax
je 0x10003ba3
cmp edi, 0x7fffffff
ja 0x10005453
push edi
lea ecx, [ebp - 0x144]
call fcn.100087d0
mov esi, dword [ebp - 0x144]
lea eax, [ebp - 0x148]
push edi
push eax
push esi
call fcn.100291e0
lea eax, [esi + edi]
add esp, 0xc
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x158]
mov byte [ebp - 4], 2
lea edi, [ebp - 0x156]
mov word [ebp - 0x158], 0x4447
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
sub edi, eax
je 0x10003c16
cmp edi, 0x7fffffff
ja 0x10005458
push edi
lea ecx, [ebp - 0x138]
call fcn.100087d0
mov esi, dword [ebp - 0x138]
lea eax, [ebp - 0x158]
push edi
push eax
push esi
call fcn.100291e0
lea eax, [esi + edi]
add esp, 0xc
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x15c]
mov byte [ebp - 4], 3
lea edi, [ebp - 0x15a]
mov word [ebp - 0x15c], 0x5047
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
sub edi, eax
je 0x10003c89
cmp edi, 0x7fffffff
ja 0x1000545d
push edi
lea ecx, [ebp - 0x12c]
call fcn.100087d0
mov esi, dword [ebp - 0x12c]
lea eax, [ebp - 0x15c]
push edi
push eax
push esi
call fcn.100291e0
lea eax, [edi + esi]
add esp, 0xc
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x174]
mov byte [ebp - 4], 4
lea edi, [ebp - 0x171]
mov word [ebp - 0x174], 0x5055
mov byte [ebp - 0x172], 0x46
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
sub edi, eax
je 0x10003d03
cmp edi, 0x7fffffff
ja 0x10005462
push edi
lea ecx, [ebp - 0x120]
call fcn.100087d0
mov esi, dword [ebp - 0x120]
lea eax, [ebp - 0x174]
push edi
push eax
push esi
call fcn.100291e0
lea eax, [edi + esi]
add esp, 0xc
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x178]
mov byte [ebp - 4], 5
lea edi, [ebp - 0x175]
mov word [ebp - 0x178], 0x5552
mov byte [ebp - 0x176], 0x46
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
sub edi, eax
je 0x10003d7d
cmp edi, 0x7fffffff
ja 0x10005467
push edi
lea ecx, [ebp - 0x114]
call fcn.100087d0
mov esi, dword [ebp - 0x114]
lea eax, [ebp - 0x178]
push edi
push eax
push esi
call fcn.100291e0
lea eax, [edi + esi]
add esp, 0xc
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x17c]
mov byte [ebp - 4], 6
lea edi, [ebp - 0x179]
mov word [ebp - 0x17c], 0x4453
mov byte [ebp - 0x17a], 0x46
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x100], 0
sub edi, eax
je 0x10003df7
cmp edi, 0x7fffffff
ja 0x1000546c
push edi
lea ecx, [ebp - 0x108]
call fcn.100087d0
mov esi, dword [ebp - 0x108]
lea eax, [ebp - 0x17c]
push edi
push eax
push esi
call fcn.100291e0
lea eax, [esi + edi]
add esp, 0xc
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 7
lea edi, [ebp - 0x17d]
mov word [ebp - 0x180], 0x4544
mov byte [ebp - 0x17e], 0x4c
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0
sub edi, eax
je 0x10003e71
cmp edi, 0x7fffffff
ja 0x10005471
push edi
lea ecx, [ebp - 0xfc]
call fcn.100087d0
mov esi, dword [ebp - 0xfc]
lea eax, [ebp - 0x180]
push edi
push eax
push esi
call fcn.100291e0
lea eax, [edi + esi]
add esp, 0xc
mov dword [ebp - 0xf8], eax
lea eax, [ebp - 0x160]
mov byte [ebp - 4], 8
lea edi, [ebp - 0x15e]
mov word [ebp - 0x160], 0x5845
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 0
sub edi, eax
je 0x10003ee4
cmp edi, 0x7fffffff
ja 0x10005476
push edi
lea ecx, [ebp - 0xf0]
call fcn.100087d0
mov esi, dword [ebp - 0xf0]
lea eax, [ebp - 0x160]
push edi
push eax
push esi
call fcn.100291e0
lea eax, [esi + edi]
add esp, 0xc
mov dword [ebp - 0xec], eax
lea eax, [ebp - 0x184]
mov byte [ebp - 4], 9
lea edi, [ebp - 0x181]
mov word [ebp - 0x184], 0x4443
mov byte [ebp - 0x182], 0x49
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0
sub edi, eax
je 0x10003f5e
cmp edi, 0x7fffffff
ja 0x1000547b
push edi
lea ecx, [ebp - 0xe4]
call fcn.100087d0
mov esi, dword [ebp - 0xe4]
lea eax, [ebp - 0x184]
push edi
push eax
push esi
call fcn.100291e0
lea eax, [edi + esi]
add esp, 0xc
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0x188]
mov byte [ebp - 4], 0xa
lea edi, [ebp - 0x185]
mov word [ebp - 0x188], 0x4444
mov byte [ebp - 0x186], 0x49
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd0], 0
sub edi, eax
je 0x10003fd8
cmp edi, 0x7fffffff
ja 0x10005480
push edi
lea ecx, [ebp - 0xd8]
call fcn.100087d0
mov esi, dword [ebp - 0xd8]
lea eax, [ebp - 0x188]
push edi
push eax
push esi
call fcn.100291e0
lea eax, [esi + edi]
add esp, 0xc
mov dword [ebp - 0xd4], eax
lea eax, [ebp - 0x18c]
mov byte [ebp - 4], 0xb
lea edi, [ebp - 0x189]
mov word [ebp - 0x18c], 0x4652
mov byte [ebp - 0x18a], 0x49
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 0
sub edi, eax
je 0x10004052
cmp edi, 0x7fffffff
ja 0x10005485
push edi
lea ecx, [ebp - 0xcc]
call fcn.100087d0
mov esi, dword [ebp - 0xcc]
lea eax, [ebp - 0x18c]
push edi
push eax
push esi
call fcn.100291e0
lea eax, [edi + esi]
add esp, 0xc
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0x164]
mov byte [ebp - 4], 0xc
lea edi, [ebp - 0x161]
mov word [ebp - 0x164], 0x4452
mov byte [ebp - 0x162], 0x49
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0
sub edi, eax
je 0x100040cc
cmp edi, 0x7fffffff
ja 0x1000548a
push edi
lea ecx, [ebp - 0xc0]
call fcn.100087d0
mov esi, dword [ebp - 0xc0]
lea eax, [ebp - 0x164]
push edi
push eax
push esi
call fcn.100291e0
lea eax, [esi + edi]
add esp, 0xc
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x19c]
mov byte [ebp - 4], 0xd
push eax
lea edx, [ebp - 0x144]
mov dword [ebp - 0x198], 0
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x150], edx
lea eax, [ebp - 0x150]
mov dword [ebp - 0x19c], ecx
push eax
sub ecx, edx
mov dword [ebp - 0x194], 0
mov eax, 0x2aaaaaab
mov dword [ebp - 0x190], 0
imul ecx
lea ecx, [ebp - 0x198]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
call fcn.10002b80
push fcn.100016c0
push 0xc
push 0xc
lea eax, [ebp - 0x144]
mov byte [ebp - 4], 0xf
push eax
call fcn.10027912
push 0x18
call fcn.10027895
add esp, 4
mov dword [ebp - 0x150], eax
mov byte [ebp - 4], 0x10
test eax, eax
je 0x1000416e
mov ecx, eax
call fcn.100054c0
mov edi, eax
jmp 0x10004170
xor edi, edi
mov dword [ebp - 0x164], edi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x11
mov eax, dword [eax + 4]
add eax, 4
push eax
call fcn.10003650
push dword [ebp - 0x198]
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x12
push eax
mov ecx, edi
call fcn.100244e0
mov ecx, eax
mov edx, ecx
cmp dword [ecx + 0x14], 0xf
jbe 0x100041b0
mov edx, dword [ecx]
push dword [ecx + 0x10]
cmp dword [ebp - 0x70], 0xf
lea eax, [ebp - 0x84]
push edx
cmova eax, dword [ebp - 0x84]
push dword [ebp - 0x74]
push eax
call fcn.10002fa0
mov ecx, dword [ebp - 0x18]
add esp, 0x10
mov byte [ebp - 0x147], al
cmp ecx, 0xf
jbe 0x10004211
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10004201
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000548f
push ecx
push edx
call fcn.100278c5
mov al, byte [ebp - 0x147]
add esp, 8
test al, al
je 0x1000421c
mov ecx, ebx
call fcn.10006e10
mov eax, dword [ebp - 0x198]
mov ecx, edi
add eax, 0xc
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.100244e0
mov ecx, eax
mov edx, ecx
cmp dword [ecx + 0x14], 0xf
jbe 0x1000423d
mov edx, dword [ecx]
push dword [ecx + 0x10]
cmp dword [ebp - 0x70], 0xf
lea eax, [ebp - 0x84]
push edx
cmova eax, dword [ebp - 0x84]
push dword [ebp - 0x74]
push eax
call fcn.10002fa0
mov ecx, dword [ebp - 0x18]
add esp, 0x10
mov byte [ebp - 0x147], al
cmp ecx, 0xf
jbe 0x1000429e
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000428e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10005494
push ecx
push edx
call fcn.100278c5
mov al, byte [ebp - 0x147]
add esp, 8
test al, al
je 0x100042a9
mov ecx, ebx
call fcn.10006e10
mov eax, dword [ebp - 0x198]
mov ecx, edi
add eax, 0x18
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.100244e0
mov ecx, eax
mov edx, ecx
cmp dword [ecx + 0x14], 0xf
jbe 0x100042ca
mov edx, dword [ecx]
push dword [ecx + 0x10]
cmp dword [ebp - 0x70], 0xf
lea eax, [ebp - 0x84]
push edx
cmova eax, dword [ebp - 0x84]
push dword [ebp - 0x74]
push eax
call fcn.10002fa0
mov ecx, dword [ebp - 0x18]
add esp, 0x10
mov byte [ebp - 0x147], al
cmp ecx, 0xf
jbe 0x1000432b
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000431b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10005499
push ecx
push edx
call fcn.100278c5
mov al, byte [ebp - 0x147]
add esp, 8
test al, al
je 0x10004342
mov eax, dword [ebp + 8]
mov ecx, ebx
mov eax, dword [eax + 4]
add eax, 0xac
push eax
call fcn.10007660
mov eax, dword [ebp - 0x198]
mov ecx, edi
add eax, 0x24
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.100244e0
mov ecx, eax
mov edx, ecx
cmp dword [ecx + 0x14], 0xf
jbe 0x10004363
mov edx, dword [ecx]
push dword [ecx + 0x10]
cmp dword [ebp - 0x70], 0xf
lea eax, [ebp - 0x84]
push edx
cmova eax, dword [ebp - 0x84]
push dword [ebp - 0x74]
push eax
call fcn.10002fa0
mov ecx, dword [ebp - 0x18]
add esp, 0x10
mov byte [ebp - 0x147], al
cmp ecx, 0xf
jbe 0x100043c4
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100043b4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000549e
push ecx
push edx
call fcn.100278c5
mov al, byte [ebp - 0x147]
add esp, 8
test al, al
je 0x1000476b
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x13
mov eax, dword [eax + 4]
add eax, 0x1c
push eax
call fcn.10003650
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x14
push eax
call fcn.10011320
add esp, 4
test al, al
je 0x1000458d
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.10013d60
add esp, 8
cmp dword [eax + 0x14], 7
jbe 0x10004412
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x68]
mov esi, eax
call fcn.10005b30
test esi, esi
jne 0x10004511
lea eax, [ebp - 0x147]
mov dword [ebp - 0x4c], 0x6f727245
push eax
lea ecx, [ebp - 0x2e]
mov dword [ebp - 0x48], 0x70552072
push ecx
lea edx, [ebp - 0x4c]
mov dword [ebp - 0x44], 0x64616f6c
push edx
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x40], 0x20676e6f
mov dword [ebp - 0x3c], 0x656c6966
mov dword [ebp - 0x38], 0x43202c20
mov dword [ebp - 0x34], 0x2065646f
mov word [ebp - 0x30], 0x203a
call fcn.10003a80
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [ebp - 4], 0x15
call esi
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.100023d0
add esp, 8
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x170]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x68]
mov ecx, edi
push eax
call fcn.100244e0
push dword [ebp - 0x150]
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x17
push eax
push dword [ebp - 0x150]
call fcn.10003740
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 0x18
push eax
mov ecx, ebx
call fcn.10007290
lea ecx, [ebp - 0x9c]
call fcn.10001670
lea ecx, [ebp - 0x68]
call fcn.10001670
lea ecx, [ebp - 0xb4]
call fcn.10001670
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0x14
call fcn.100016c0
jmp 0x10004517
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x154]
push eax
call fcn.10009c20
mov ecx, dword [ebp - 0x150]
add esp, 4
cmp ecx, 0x7fffffff
jg 0x10004568
mov eax, dword [ebp - 0x154]
jl 0x10004543
cmp eax, 0xe2329aff
jae 0x10004568
add eax, 0x1dcd6500
mov dword [ebp - 0x154], eax
lea eax, [ebp - 0x154]
adc ecx, 0
push eax
mov dword [ebp - 0x150], ecx
call fcn.10003150
add esp, 4
jmp 0x10004593
lea eax, [ebp - 0x154]
mov dword [ebp - 0x154], 0xffffffff
push eax
mov dword [ebp - 0x150], SysReAllocString
call fcn.10003150
add esp, 4
jmp 0x10004593
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
add eax, 0xdc
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.10011610
add esp, 8
test al, al
lea eax, [ebp - 0x147]
push eax
jne 0x10004697
lea ecx, [ebp - 0x2e]
mov dword [ebp - 0x4c], 0x6f727245
push ecx
lea edx, [ebp - 0x4c]
mov dword [ebp - 0x48], 0x70552072
push edx
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x44], 0x64616f6c
mov dword [ebp - 0x40], 0x20676e6f
mov dword [ebp - 0x3c], 0x656c6966
mov dword [ebp - 0x38], 0x43202c20
mov dword [ebp - 0x34], 0x2065646f
mov word [ebp - 0x30], 0x203a
call fcn.10003a80
mov byte [ebp - 4], 0x19
call esi
push eax
lea eax, [ebp - 0x87]
push eax
call fcn.10001440
add esp, 8
lea ecx, [ebp - 0x147]
push ecx
lea ecx, [ebp - 0x87]
push ecx
push eax
lea ecx, [ebp - 0xb4]
call fcn.100012b0
lea eax, [ebp - 0x170]
mov byte [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0x68]
mov ecx, edi
push eax
call fcn.100244e0
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x1b
push ecx
push eax
push dword [ebp - 0x150]
lea ecx, [ebp - 0x9c]
call fcn.10003740
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 0x1c
push eax
mov ecx, ebx
call fcn.10007290
lea ecx, [ebp - 0x9c]
call fcn.10001670
lea ecx, [ebp - 0x68]
call fcn.10001670
lea ecx, [ebp - 0xb4]
jmp 0x1000474c
lea ecx, [ebp - 0x86]
mov dword [ebp - 0x98], 0x63637553
push ecx
lea edx, [ebp - 0x98]
mov dword [ebp - 0x94], 0x46737365
push edx
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x90], 0x55206c75
mov dword [ebp - 0x8c], 0x616f6c70
mov word [ebp - 0x88], 0x2064
call fcn.10003a80
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x1d
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.100127d0
add esp, 8
mov esi, eax
lea eax, [ebp - 0x170]
mov byte [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0x68]
mov ecx, edi
push eax
call fcn.100244e0
push esi
push eax
push dword [ebp - 0x150]
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x1f
call fcn.10003740
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 0x20
push eax
mov ecx, ebx
call fcn.10007290
lea ecx, [ebp - 0xb4]
call fcn.10001670
lea ecx, [ebp - 0x68]
call fcn.10001670
lea ecx, [ebp - 0x48]
call fcn.10001670
lea ecx, [ebp - 0x170]
call fcn.100016c0
lea ecx, [ebp - 0x2c]
call fcn.10001670
mov dword [ebp - 4], 0x12
mov eax, dword [ebp - 0x198]
mov ecx, edi
add eax, 0x30
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.100244e0
mov ecx, eax
mov edx, ecx
cmp dword [ecx + 0x14], 0xf
jbe 0x1000478c
mov edx, dword [ecx]
push dword [ecx + 0x10]
cmp dword [ebp - 0x70], 0xf
lea eax, [ebp - 0x84]
push edx
cmova eax, dword [ebp - 0x84]
push dword [ebp - 0x74]
push eax
call fcn.10002fa0
add esp, 0x10
lea ecx, [ebp - 0x48]
mov bl, al
call fcn.10001670
mov esi, dword [ebp - 0x14c]
test bl, bl
je 0x100047d2
mov eax, dword [ebp + 8]
mov ecx, esi
mov eax, dword [eax + 4]
add eax, 0x64
push eax
call fcn.10008380
mov eax, dword [ebp - 0x198]
mov ecx, edi
add eax, 0x3c
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.100244e0
mov ecx, eax
mov edx, ecx
cmp dword [ecx + 0x14], 0xf
jbe 0x100047f3
mov edx, dword [ecx]
push dword [ecx + 0x10]
cmp dword [ebp - 0x70], 0xf
lea eax, [ebp - 0x84]
push edx
cmova eax, dword [ebp - 0x84]
push dword [ebp - 0x74]
push eax
call fcn.10002fa0
add esp, 0x10
lea ecx, [ebp - 0x48]
mov bl, al
call fcn.10001670
test bl, bl
je 0x10004837
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
lea eax, [ecx + 0x64]
push eax
lea eax, [ecx + 0x34]
mov ecx, esi
push eax
call fcn.10009090
mov eax, dword [ebp - 0x198]
mov ecx, edi
add eax, 0x48
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.100244e0
mov ecx, eax
mov edx, ecx
cmp dword [ecx + 0x14], 0xf
jbe 0x10004858
mov edx, dword [ecx]
push dword [ecx + 0x10]
cmp dword [ebp - 0x70], 0xf
lea eax, [ebp - 0x84]
push edx
cmova eax, dword [ebp - 0x84]
push dword [ebp - 0x74]
push eax
call fcn.10002fa0
add esp, 0x10
lea ecx, [ebp - 0x48]
mov bl, al
call fcn.10001670
test bl, bl
je 0x10004aab
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
add eax, 0x34
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.10013d60
add esp, 8
cmp dword [eax + 0x14], 7
jbe 0x100048a9
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x48]
mov esi, eax
call fcn.10005b30
test esi, esi
jne 0x10004aab
lea eax, [ebp - 0x147]
mov dword [ebp - 0x2c], 0x656c6544
push eax
lea ecx, [ebp - 0x16]
mov dword [ebp - 0x28], 0x69466574
push ecx
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x24], 0x4520656c
push edx
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x20], 0x726f7272
mov dword [ebp - 0x1c], 0x646f4320
mov word [ebp - 0x18], 0x2065
call fcn.10003a80
mov byte [ebp - 4], 0x26
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x87]
push eax
call fcn.10001440
add esp, 8
lea ecx, [ebp - 0x147]
push ecx
lea ecx, [ebp - 0x87]
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.100012b0
lea eax, [ebp - 0x170]
mov byte [ebp - 4], 0x27
push eax
lea eax, [ebp - 0x48]
mov ecx, edi
push eax
call fcn.100244e0
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x28
push ecx
push eax
push dword [ebp - 0x150]
lea ecx, [ebp - 0xb4]
call fcn.10003740
mov esi, dword [ebp - 0x14c]
lea eax, [ebp - 0xb4]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x29
call fcn.10007290
lea ecx, [ebp - 0xb4]
call fcn.10001670
lea ecx, [ebp - 0x48]
call fcn.10001670
lea ecx, [ebp - 0x68]
call fcn.10001670
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0x12
call fcn.100016c0
jmp 0x10004ab1
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10004a87
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x10004a87
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x10004a87
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100278e1
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x198]
mov ecx, edi
add eax, 0x54
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.100244e0
mov ecx, eax
mov edx, ecx
cmp dword [ecx + 0x14], 0xf
jbe 0x10004ad2
mov edx, dword [ecx]
push dword [ecx + 0x10]
cmp dword [ebp - 0x70], 0xf
lea eax, [ebp - 0x84]
push edx
cmova eax, dword [ebp - 0x84]
push dword [ebp - 0x74]
push eax
call fcn.10002fa0
add esp, 0x10
lea ecx, [ebp - 0x48]
mov bl, al
call fcn.10001670
test bl, bl
je 0x10004c0a
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
add eax, 0x34
push eax
call fcn.10010c20
add esp, 4
test al, al
jne 0x10004c0a
lea eax, [ebp - 0x147]
mov dword [ebp - 0x6c], 0x63657845
push eax
lea ecx, [ebp - 0x51]
mov dword [ebp - 0x68], 0x20657475
push ecx
lea edx, [ebp - 0x6c]
mov dword [ebp - 0x64], 0x656c6966
push edx
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x60], 0x72726520
mov dword [ebp - 0x5c], 0x4320726f
mov dword [ebp - 0x58], 0x2065646f
mov word [ebp - 0x54], 0x203a
mov byte [ebp - 0x52], 0x20
call fcn.10003a80
mov byte [ebp - 4], 0x2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x87]
push eax
call fcn.10001440
add esp, 8
lea ecx, [ebp - 0x147]
push ecx
lea ecx, [ebp - 0x87]
push ecx
push eax
lea ecx, [ebp - 0xb4]
call fcn.100012b0
lea eax, [ebp - 0x170]
mov byte [ebp - 4], 0x2b
push eax
lea eax, [ebp - 0x48]
mov ecx, edi
push eax
call fcn.100244e0
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x2c
push ecx
push eax
push dword [ebp - 0x150]
lea ecx, [ebp - 0x68]
call fcn.10003740
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 0x2d
push eax
mov ecx, esi
call fcn.10007290
lea ecx, [ebp - 0x68]
call fcn.10001670
lea ecx, [ebp - 0x48]
call fcn.10001670
lea ecx, [ebp - 0xb4]
call fcn.10001670
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0x12
call fcn.100016c0
mov eax, dword [ebp - 0x198]
mov ecx, edi
add eax, 0x60
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.100244e0
mov ecx, eax
mov edx, ecx
cmp dword [ecx + 0x14], 0xf
jbe 0x10004c2b
mov edx, dword [ecx]
push dword [ecx + 0x10]
cmp dword [ebp - 0x70], 0xf
lea eax, [ebp - 0x84]
push edx
cmova eax, dword [ebp - 0x84]
push dword [ebp - 0x74]
push eax
call fcn.10002fa0
add esp, 0x10
lea ecx, [ebp - 0x48]
mov bl, al
call fcn.10001670
test bl, bl
je 0x10004d89
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
add eax, 0x7c
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.10013d60
add esp, 8
cmp dword [eax + 0x14], 7
jbe 0x10004c7c
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x48]
mov esi, eax
call fcn.10005b30
test esi, esi
jne 0x10004d89
lea eax, [ebp - 0x147]
mov dword [ebp - 0x6c], 0x61657243
push eax
lea ecx, [ebp - 0x4e]
mov dword [ebp - 0x68], 0x46206574
push ecx
lea edx, [ebp - 0x6c]
mov dword [ebp - 0x64], 0x65646c6f
push edx
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x60], 0x72452072
mov dword [ebp - 0x5c], 0x20726f72
mov dword [ebp - 0x58], 0x6f727245
mov dword [ebp - 0x54], 0x3a202072
mov word [ebp - 0x50], 0x2020
call fcn.10003a80
mov byte [ebp - 4], 0x2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x87]
push eax
call fcn.10001440
add esp, 8
lea ecx, [ebp - 0x147]
push ecx
lea ecx, [ebp - 0x87]
push ecx
push eax
lea ecx, [ebp - 0xb4]
call fcn.100012b0
lea eax, [ebp - 0x170]
mov byte [ebp - 4], 0x2f
push eax
lea eax, [ebp - 0x48]
mov ecx, edi
push eax
call fcn.100244e0
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x30
push ecx
push eax
push dword [ebp - 0x150]
lea ecx, [ebp - 0x68]
call fcn.10003740
mov ecx, dword [ebp - 0x14c]
lea eax, [ebp - 0x68]
push eax
mov byte [ebp - 4], 0x31
call fcn.10007290
lea ecx, [ebp - 0x68]
call fcn.10001670
lea ecx, [ebp - 0x48]
call fcn.10001670
lea ecx, [ebp - 0xb4]
call fcn.10001670
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0x12
call fcn.100016c0
mov eax, dword [ebp - 0x198]
mov ecx, edi
add eax, 0x6c
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.100244e0
mov ecx, eax
mov edx, ecx
cmp dword [ecx + 0x14], 0xf
jbe 0x10004daa
mov edx, dword [ecx]
push dword [ecx + 0x10]
cmp dword [ebp - 0x70], 0xf
lea eax, [ebp - 0x84]
push edx
cmova eax, dword [ebp - 0x84]
push dword [ebp - 0x74]
push eax
call fcn.10002fa0
add esp, 0x10
lea ecx, [ebp - 0x48]
mov bl, al
call fcn.10001670
test bl, bl
je 0x10004efc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
add eax, 0x7c
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.10013d60
add esp, 8
cmp dword [eax + 0x14], 7
jbe 0x10004dfb
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x48]
mov esi, eax
call fcn.10005b30
test esi, esi
jne 0x10004efc
lea eax, [ebp - 0x147]
mov dword [ebp - 0x2c], 0x656c6544
push eax
lea ecx, [ebp - 0x16]
mov dword [ebp - 0x28], 0x46206574
push ecx
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x24], 0x65646c6f
push edx
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x20], 0x72452072
mov dword [ebp - 0x1c], 0x20726f72
mov word [ebp - 0x18], 0x203a
call fcn.10003a80
mov byte [ebp - 4], 0x32
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x87]
push eax
call fcn.10001440
add esp, 8
lea ecx, [ebp - 0x147]
push ecx
lea ecx, [ebp - 0x87]
push ecx
push eax
lea ecx, [ebp - 0xb4]
call fcn.100012b0
lea eax, [ebp - 0x170]
mov byte [ebp - 4], 0x33
push eax
lea eax, [ebp - 0x48]
mov ecx, edi
push eax
call fcn.100244e0
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x34
push ecx
push eax
push dword [ebp - 0x150]
lea ecx, [ebp - 0x68]
call fcn.10003740
mov ebx, dword [ebp - 0x14c]
lea eax, [ebp - 0x68]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x35
call fcn.10007290
lea ecx, [ebp - 0x68]
call fcn.10001670
lea ecx, [ebp - 0x48]
call fcn.10001670
lea ecx, [ebp - 0xb4]
call fcn.10001670
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0x12
call fcn.100016c0
jmp 0x10004f02
mov ebx, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x198]
mov ecx, edi
add eax, 0x78
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.100244e0
mov ecx, eax
mov edx, ecx
cmp dword [ecx + 0x14], 0xf
jbe 0x10004f23
mov edx, dword [ecx]
push dword [ecx + 0x10]
cmp dword [ebp - 0x70], 0xf
lea eax, [ebp - 0x84]
push edx
cmova eax, dword [ebp - 0x84]
push dword [ebp - 0x74]
push eax
call fcn.10002fa0
mov ecx, dword [ebp - 0x54]
add esp, 0x10
mov byte [ebp - 0x147], al
cmp ecx, 0xf
jbe 0x10004f84
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10004f74
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100054a3
push ecx
push edx
call fcn.100278c5
mov al, byte [ebp - 0x147]
add esp, 8
test al, al
je 0x100050da
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
add eax, 0x94
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.10013d60
add esp, 8
mov esi, eax
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0x36
mov eax, dword [eax + 4]
add eax, 0x34
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.10013d60
add esp, 8
cmp dword [esi + 0x14], 7
jbe 0x10004fc8
mov esi, dword [esi]
cmp dword [eax + 0x14], 7
jbe 0x10004fd0
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x48]
mov esi, eax
call fcn.10005b30
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x12
call fcn.10005b30
test esi, esi
jne 0x100050da
lea eax, [ebp - 0x147]
mov dword [ebp - 0x2c], 0x616e6552
push eax
lea ecx, [ebp - 0x15]
mov dword [ebp - 0x28], 0x4f20656d
push ecx
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x24], 0x63656a62
push edx
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x20], 0x45202074
mov dword [ebp - 0x1c], 0x726f7272
mov word [ebp - 0x18], 0x3a20
mov byte [ebp - 0x16], 0x20
call fcn.10003a80
mov byte [ebp - 4], 0x37
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x87]
push eax
call fcn.10001440
add esp, 8
lea ecx, [ebp - 0x147]
push ecx
lea ecx, [ebp - 0x87]
push ecx
push eax
lea ecx, [ebp - 0xb4]
call fcn.100012b0
lea eax, [ebp - 0x170]
mov byte [ebp - 4], 0x38
push eax
lea eax, [ebp - 0x48]
mov ecx, edi
push eax
call fcn.100244e0
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x39
push ecx
push eax
push dword [ebp - 0x150]
lea ecx, [ebp - 0x68]
call fcn.10003740
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 0x3a
push eax
mov ecx, ebx
call fcn.10007290
lea ecx, [ebp - 0x68]
call fcn.10001670
lea ecx, [ebp - 0x48]
call fcn.10001670
lea ecx, [ebp - 0xb4]
call fcn.10001670
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0x12
call fcn.100016c0
mov eax, dword [ebp - 0x198]
mov ecx, edi
add eax, 0x84
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.100244e0
mov ecx, eax
mov edx, ecx
cmp dword [ecx + 0x14], 0xf
jbe 0x100050fd
mov edx, dword [ecx]
push dword [ecx + 0x10]
cmp dword [ebp - 0x70], 0xf
lea eax, [ebp - 0x84]
push edx
cmova eax, dword [ebp - 0x84]
push dword [ebp - 0x74]
push eax
call fcn.10002fa0
mov ecx, dword [ebp - 0x54]
add esp, 0x10
mov byte [ebp - 0x147], al
cmp ecx, 0xf
jbe 0x1000515e
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000514e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100054a8
push ecx
push edx
call fcn.100278c5
mov al, byte [ebp - 0x147]
add esp, 8
test al, al
je 0x100052b0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
add eax, 0x94
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.10013d60
add esp, 8
mov esi, eax
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0x3b
mov eax, dword [eax + 4]
add eax, 0x34
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.10013d60
add esp, 8
cmp dword [esi + 0x14], 7
jbe 0x100051a2
mov esi, dword [esi]
cmp dword [eax + 0x14], 7
jbe 0x100051aa
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x48]
mov esi, eax
call fcn.10005b30
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x12
call fcn.10005b30
test esi, esi
jne 0x100052b0
lea eax, [ebp - 0x147]
mov dword [ebp - 0x2c], 0x616e6552
push eax
lea ecx, [ebp - 0x15]
mov dword [ebp - 0x28], 0x4f20656d
push ecx
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x24], 0x63656a62
push edx
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x20], 0x45202074
mov dword [ebp - 0x1c], 0x726f7272
mov word [ebp - 0x18], 0x3a20
mov byte [ebp - 0x16], 0x20
call fcn.10003a80
mov byte [ebp - 4], 0x3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x87]
push eax
call fcn.10001440
add esp, 8
lea ecx, [ebp - 0x147]
push ecx
lea ecx, [ebp - 0x87]
push ecx
push eax
lea ecx, [ebp - 0xb4]
call fcn.100012b0
lea eax, [ebp - 0x170]
mov byte [ebp - 4], 0x3d
push eax
lea eax, [ebp - 0x48]
mov ecx, edi
push eax
call fcn.100244e0
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x3e
push ecx
push eax
push dword [ebp - 0x150]
lea ecx, [ebp - 0x68]
call fcn.10003740
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 0x3f
push eax
mov ecx, ebx
call fcn.10007290
lea ecx, [ebp - 0x68]
call fcn.10001670
lea ecx, [ebp - 0x48]
call fcn.10001670
lea ecx, [ebp - 0xb4]
call fcn.10001670
lea ecx, [ebp - 0x170]
call fcn.100016c0
mov ecx, dword [ebp - 0x70]
cmp ecx, 0xf
jbe 0x100052e7
mov edx, dword [ebp - 0x84]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100052dd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100054ad
push ecx
push edx
call fcn.100278c5
add esp, 8
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0xf
mov byte [ebp - 0x84], 0
call fcn.10005d00
mov esi, dword [ebp - 0x198]
test esi, esi
je 0x10004a5f
mov edi, dword [ebp - 0x194]
cmp esi, edi
je 0x10005374
nop
mov eax, dword [esi]
test eax, eax
je 0x10005367
mov ecx, dword [esi + 8]
sub ecx, eax
cmp ecx, 0x1000
jb 0x10005349
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100054ad
mov eax, edx
push ecx
push eax
call fcn.100278c5
mov dword [esi], 0
add esp, 8
mov dword [esi + 4], 0
mov dword [esi + 8], 0
add esi, 0xc
cmp esi, edi
jne 0x10005320
mov esi, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x190]
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 2
cmp ecx, 0x1000
jb 0x100053b0
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100054ad
push ecx
push esi
call fcn.100278c5
add esp, 8
jmp 0x10004a5f
call fcn.100021d0
call fcn.100021d0
call fcn.100021d0
call fcn.100021d0
call fcn.100021d0
call fcn.100021d0
call fcn.100021d0
call fcn.100021d0
call fcn.100021d0
call fcn.100021d0
call fcn.100021d0
call fcn.100021d0
call fcn.1002caaf
call fcn.1002caaf
call fcn.1002caaf
call fcn.1002caaf
call fcn.1002caaf
call fcn.1002caaf
call fcn.1002caaf
int3