Function at 0x100013d0
Capabilities:
Access peb ldr_data
Create thread
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004b533
mov eax, dword fs:[0]
push eax
mov eax, 0x174c
call fcn.10013ac0
mov eax, dword [0x1005f0b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x147c], esi
mov dword [ebp - 0x1480], esi
mov dword [ebp - 0x16b0], esi
xor ecx, ecx
mov dword [esi + 0x30], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 7
mov word [esi + 0x30], cx
lea edi, [esi + 0x48]
mov dword [edi], ecx
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x58], ecx
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], ecx
push 8
mov byte [ebp - 4], 4
mov dword [esi + 0x407c], ecx
mov dword [esi + 0x4080], ecx
mov dword [esi + 0x4084], ecx
mov dword [esi + 0x4088], ecx
mov dword [esi + 0x408c], ecx
call fcn.100133ce
lea ecx, [esi + 0x407c]
mov dword [eax + 4], 0
mov dword [ecx], eax
mov dword [eax], ecx
push 8
mov byte [ebp - 4], 5
mov dword [esi + 0x4090], 0
mov dword [esi + 0x4094], 0
mov dword [esi + 0x4098], 0
mov dword [esi + 0x409c], 0
mov dword [esi + 0x40a0], 0
call fcn.100133ce
lea ecx, [esi + 0x4090]
mov dword [eax + 4], 0
mov dword [ecx], eax
mov dword [eax], ecx
xor eax, eax
mov dword [esi + 0x40a8], 0
mov dword [esi + 0x40b8], 0
mov dword [esi + 0x40bc], 7
mov word [esi + 0x40a8], ax
add esi, 0x40d0
mov byte [ebp - 4], 7
push 0x28
mov dword [ebp - 0x1480], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.100133ce
add esp, 0xc
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov esi, dword [ebp - 0x147c]
xor eax, eax
mov dword [esi + 0x40e0], 0
mov dword [esi + 0x40f0], 0
mov dword [esi + 0x40f4], 7
mov word [esi + 0x40e0], ax
mov dword [esi + 0x410c], eax
mov dword [esi + 0x411c], eax
mov dword [esi + 0x4120], 7
mov dword [esi + 0x4124], eax
mov dword [esi + 0x4128], eax
mov dword [esi + 0x412c], eax
mov dword [esi + 0x4130], eax
mov dword [esi + 0x4134], eax
mov dword [esi + 0x4138], eax
mov dword [esi + 0x413c], eax
mov dword [esi + 0x4140], eax
mov dword [esi + 0x4144], eax
xor ecx, ecx
mov dword [esi + 0x4180], eax
mov dword [esi + 0x4190], eax
mov dword [esi + 0x4194], 7
mov word [esi + 0x4180], cx
mov byte [ebp - 4], 0xd
call fcn.1000d860
mov ecx, eax
test ecx, ecx
je 0x10002cf5
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
lea ecx, [esi + 0x4198]
mov dword [ecx], eax
xor edx, edx
mov dword [esi + 0x419c], 0
mov dword [esi + 0x41ac], 0
mov dword [esi + 0x41b0], 7
mov word [esi + 0x419c], dx
push edx
push 0x1004d4d0
mov byte [ebp - 4], 0xf
mov dword [esi + 0x4178], edx
mov dword [esi + 0x417c], edx
call fcn.1000e220
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [esi + 0x4170], eax
lea ecx, [esi + 0x407c]
mov dword [0x1007deb4], 0
mov dword [esi + 0x416c], 0
mov byte [esi], 0
mov byte [esi + 0x14], 1
mov byte [0x1005fd71], 0
mov dword [esi + 0x28], 0x1000000
mov word [esi + 0x24], 1
mov dword [esi + 0x40d8], 0
mov dword [esi + 0x40dc], 0
mov word [esi + 0x415c], 0
mov byte [esi + 0x415e], 0
mov byte [esi + 0x27], 0
mov dword [0x1005fd84], 0
mov dword [esi + 0x4160], 0xffffffff
mov dword [esi + 0x4164], 0xffffffff
mov byte [esi + 0x2c], 0
mov dword [esi + 0x40a4], 0
call fcn.1000ea20
lea ecx, [esi + 0x4090]
call fcn.1000ea20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x4000000
push 0x4000000
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
call esi
mov ecx, dword [ebp - 0x147c]
push 0
push 0
push 1
push 0
mov dword [ecx + 8], eax
call esi
mov ecx, dword [ebp - 0x147c]
push 0
push 0
push 0
push 0
mov dword [ecx + 0xc], eax
call esi
mov ecx, dword [ebp - 0x147c]
push 0
push 0
push 0
push 0
mov dword [ecx + 0x10], eax
call esi
mov esi, dword [ebp - 0x147c]
push str.GlobalPCAScannerMutex
push 0
push 0x1f0001
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x1005fd80], eax
cmp dword [0x1005fd80], 0
je 0x10001768
mov byte [0x1005fd72], 0
jmp 0x100017df
lea eax, [ebp - 0x145c]
mov dword [ebp - 0x144c], 0
xorps xmm0, xmm0
push 1
push eax
movups xmmword [ebp - 0x145c], xmm0
call fcn.100100a0
push 0
push 0
lea eax, [ebp - 0x145c]
push 1
push eax
call fcn.10010390
add esp, 0x18
mov dword [ebp - 0x1470], 0
lea eax, [ebp - 0x145c]
mov dword [ebp - 0x1478], 0xc
mov dword [ebp - 0x1474], eax
lea eax, [ebp - 0x1478]
push str.GlobalPCAScannerMutex
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x1005fd80], eax
mov byte [0x1005fd72], 1
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.100158a0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001812
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
dec ecx
cmp word [eax + ecx*2], 0x5c
lea eax, [eax + ecx*2]
je 0x1000184a
xor edx, edx
lea ecx, [ecx - 1]
mov word [eax], dx
lea eax, [ebp - 0x420]
cmp word [eax + ecx*2], 0x5c
lea eax, [eax + ecx*2]
jne 0x10001832
lea edx, [ebp - 0x420]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10001853
sub edx, ecx
lea eax, [ebp - 0x420]
sar edx, 1
lea ecx, [esi + 0x30]
push edx
push eax
call fcn.1000f080
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100158a0
add esp, 0xc
mov ecx, 0x23
cmp byte [ebp + 0x20], 0
mov eax, 0x1c
cmovne eax, ecx
push 0
push eax
lea eax, [ebp - 0x218]
push eax
push 0
call dword [0x1007e23c]
lea eax, [ebp - 0x14e4]
push eax
call fcn.1000d990
add esp, 4
push dword [eax]
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0x10
push eax
call dword [0x1007e21c]
mov edx, dword [ebp - 0x14e4]
or eax, 0xffffffff
mov byte [ebp - 4], 0xf
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100018ef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x218]
push eax
call dword [0x1007e228]
test eax, eax
jne 0x1000190f
lea eax, [ebp - 0x218]
push eax
call fcn.1000b110
add esp, 4
lea eax, [ebp - 0x218]
push eax
push 0x100
push 0x1007deb8
call fcn.1001ecb0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x1004d910
push eax
call dword [0x1007e21c]
lea eax, [ebp - 0x218]
push eax
call dword [0x1007e228]
test eax, eax
jne 0x1000195a
lea eax, [ebp - 0x218]
push eax
call fcn.1000b110
add esp, 4
mov ecx, 0x1007deb8
mov dword [ebp - 0x1544], 0
xor eax, eax
mov dword [ebp - 0x1534], 0
mov dword [ebp - 0x1530], 7
mov word [ebp - 0x1544], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001990
sub ecx, edx
sar ecx, 1
push ecx
push 0x1007deb8
lea ecx, [ebp - 0x1544]
call fcn.1000f080
push str.RPCA.conf
lea eax, [ebp - 0x1544]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x1634]
push eax
call fcn.1000bb00
add esp, 0xc
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x12
jb 0x100019db
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call fcn.1000fb50
mov edx, dword [ebp - 0x1620]
add esp, 0x1c
mov dword [ebp - 0x147c], eax
mov byte [ebp - 4], 0x11
cmp edx, 8
jb 0x10001a40
mov ecx, dword [ebp - 0x1634]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10001a36
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002cff
push edx
push ecx
call fcn.100133fe
add esp, 8
mov edx, dword [ebp - 0x1530]
xor eax, eax
mov dword [ebp - 0x1624], 0
mov dword [ebp - 0x1620], 7
mov word [ebp - 0x1634], ax
mov byte [ebp - 4], 0xf
cmp edx, 8
jb 0x10001aa1
mov ecx, dword [ebp - 0x1544]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10001a97
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002cff
push edx
push ecx
call fcn.100133fe
add esp, 8
xor eax, eax
mov dword [ebp - 0x1534], 0
mov word [ebp - 0x1544], ax
mov eax, dword [ebp - 0x147c]
mov dword [ebp - 0x1530], 7
cmp eax, 0xffffffff
je 0x10001f4a
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp - 0x147c]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0x800
lea eax, [ebp - 0xc20]
push 0
push eax
call fcn.100158a0
push str.PidFile__
lea eax, [ebp - 0xc20]
push 0x800
push eax
call fcn.1001fe83
add esp, 0x18
mov ecx, 0x1007deb8
push str.RPCA.pid
sub esp, 0x18
lea eax, [ecx + 2]
mov edx, esp
mov dword [ebp - 0x1480], eax
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001b40
sub ecx, dword [ebp - 0x1480]
sar ecx, 1
push ecx
push 0x1007deb8
mov ecx, edx
call fcn.1000f080
lea eax, [ebp - 0x1664]
push eax
call fcn.1000a8b0
add esp, 0x1c
push eax
lea eax, [ebp - 0x164c]
mov byte [ebp - 4], 0x13
push eax
call fcn.1000baa0
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x10001b8b
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc20]
push 0x800
push eax
call fcn.1001ff46
mov edx, dword [ebp - 0x1638]
add esp, 0xc
cmp edx, 0x10
jb 0x10001bda
mov ecx, dword [ebp - 0x164c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001bd0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002d04
push edx
push ecx
call fcn.100133fe
add esp, 8
mov edx, dword [ebp - 0x1650]
mov dword [ebp - 0x163c], 0
mov dword [ebp - 0x1638], 0xf
mov byte [ebp - 0x164c], 0
mov byte [ebp - 4], 0xf
cmp edx, 0x10
jb 0x10001c33
mov ecx, dword [ebp - 0x1664]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001c29
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002d04
push edx
push ecx
call fcn.100133fe
add esp, 8
push str.__r_nLogFile__
lea eax, [ebp - 0xc20]
mov dword [ebp - 0x1654], 0
push 0x800
push eax
mov dword [ebp - 0x1650], 0xf
mov byte [ebp - 0x1664], 0
call fcn.1001ff46
add esp, 0xc
mov ecx, 0x1007deb8
push str.RPCA.log
sub esp, 0x18
lea eax, [ecx + 2]
mov edx, esp
mov dword [ebp - 0x1480], eax
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001c93
sub ecx, dword [ebp - 0x1480]
sar ecx, 1
push ecx
push 0x1007deb8
mov ecx, edx
call fcn.1000f080
lea eax, [ebp - 0x1694]
push eax
call fcn.1000a8b0
add esp, 0x1c
push eax
lea eax, [ebp - 0x167c]
mov byte [ebp - 4], 0x14
push eax
call fcn.1000baa0
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x10001cde
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc20]
push 0x800
push eax
call fcn.1001ff46
mov edx, dword [ebp - 0x1668]
add esp, 0xc
cmp edx, 0x10
jb 0x10001d2d
mov ecx, dword [ebp - 0x167c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001d23
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002d09
push edx
push ecx
call fcn.100133fe
add esp, 8
mov edx, dword [ebp - 0x1680]
mov dword [ebp - 0x166c], 0
mov dword [ebp - 0x1668], 0xf
mov byte [ebp - 0x167c], 0
mov byte [ebp - 4], 0xf
cmp edx, 0x10
jb 0x10001d86
mov ecx, dword [ebp - 0x1694]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001d7c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002d09
push edx
push ecx
call fcn.100133fe
add esp, 8
push str.__r_nDatabaseDirectory__
lea eax, [ebp - 0xc20]
mov dword [ebp - 0x1684], 0
push 0x800
push eax
mov dword [ebp - 0x1680], 0xf
mov byte [ebp - 0x1694], 0
call fcn.1001ff46
add esp, 0xc
mov ecx, 0x1007deb8
push str.database
sub esp, 0x18
lea eax, [ecx + 2]
mov edx, esp
mov dword [ebp - 0x1480], eax
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001de6
sub ecx, dword [ebp - 0x1480]
sar ecx, 1
push ecx
push 0x1007deb8
mov ecx, edx
call fcn.1000f080
lea eax, [ebp - 0x16f8]
push eax
call fcn.1000a8b0
add esp, 0x1c
push eax
lea eax, [ebp - 0x16ac]
mov byte [ebp - 4], 0x15
push eax
call fcn.1000baa0
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x10001e31
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc20]
push 0x800
push eax
call fcn.1001ff46
mov edx, dword [ebp - 0x1698]
add esp, 0xc
cmp edx, 0x10
jb 0x10001e80
mov ecx, dword [ebp - 0x16ac]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001e76
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002d0e
push edx
push ecx
call fcn.100133fe
add esp, 8
mov edx, dword [ebp - 0x16e4]
mov dword [ebp - 0x169c], 0
mov dword [ebp - 0x1698], 0xf
mov byte [ebp - 0x16ac], 0
mov byte [ebp - 4], 0xf
cmp edx, 0x10
jb 0x10001ed9
mov ecx, dword [ebp - 0x16f8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001ecf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002d0e
push edx
push ecx
call fcn.100133fe
add esp, 8
push str.__r_nTCPSocket_3310_r_nTCPAddr_127.0.0.1_r_nSelfCheck_0_r_nDisableCertCheck_yes_r_nForceToDisk_no_r_nScanELF_no_r_nPhishingSignatures_no_r_nPhishingScanURLs_no_r_n
lea eax, [ebp - 0xc20]
mov dword [ebp - 0x16e8], 0
push 0x800
push eax
mov dword [ebp - 0x16e4], 0xf
mov byte [ebp - 0x16f8], 0
call fcn.1001ff46
lea ecx, [ebp - 0xc20]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001f16
push 0
lea eax, [ebp - 0x1424]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0xc20]
push eax
push dword [ebp - 0x147c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x147c]
call fcn.1000f9e0
add esp, 4
mov ecx, 0x1007deb8
mov dword [ebp - 0x155c], 0
xor eax, eax
mov dword [ebp - 0x154c], 0
mov dword [ebp - 0x1548], 7
mov word [ebp - 0x155c], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001f80
sub ecx, edx
sar ecx, 1
push ecx
push 0x1007deb8
lea ecx, [ebp - 0x155c]
call fcn.1000f080
push str.PCAU.conf
lea eax, [ebp - 0x155c]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x16c8]
push eax
call fcn.1000bb00
add esp, 0xc
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x17
jb 0x10001fcb
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call fcn.1000fb50
mov edx, dword [ebp - 0x16b4]
add esp, 0x1c
mov dword [ebp - 0x147c], eax
mov byte [ebp - 4], 0x16
cmp edx, 8
jb 0x10002030
mov ecx, dword [ebp - 0x16c8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002026
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002d13
push edx
push ecx
call fcn.100133fe
add esp, 8
mov edx, dword [ebp - 0x1548]
xor eax, eax
mov dword [ebp - 0x16b8], 0
mov dword [ebp - 0x16b4], 7
mov word [ebp - 0x16c8], ax
mov byte [ebp - 4], 0xf
cmp edx, 8
jb 0x10002091
mov ecx, dword [ebp - 0x155c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002087
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002d13
push edx
push ecx
call fcn.100133fe
add esp, 8
xor eax, eax
mov dword [ebp - 0x154c], 0
mov word [ebp - 0x155c], ax
mov eax, dword [ebp - 0x147c]
mov dword [ebp - 0x1548], 7
cmp eax, 0xffffffff
je 0x10002249
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp - 0x147c]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp + 0x18]
test ecx, ecx
jne 0x100020ef
push 0x13
push str.database.clamav.net
lea ecx, [ebp + 8]
call fcn.1000f080
mov ecx, dword [ebp + 0x18]
mov eax, 0x7ffffffe
sub eax, ecx
cmp eax, 0xf
jb 0x10002d18
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ecx
cmovae eax, dword [ebp + 8]
lea ecx, [ebp - 0x1710]
push eax
push 0xf
push str.DatabaseMirror
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x1424]
call fcn.1000c920
push str._r_nScriptedUpdates_yes
lea eax, [ebp - 0x1710]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x1728]
push eax
call fcn.1000bb00
add esp, 0xc
lea ecx, [ebp + 8]
push eax
call fcn.1000cf10
lea ecx, [ebp - 0x1728]
call fcn.1000cc80
lea ecx, [ebp - 0x1710]
mov byte [ebp - 4], 0xf
call fcn.1000cc80
push 0x800
lea eax, [ebp - 0x1420]
push 0
push eax
call fcn.100158a0
sub esp, 0xc
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.1000c680
lea eax, [ebp - 0x16e0]
push eax
call fcn.1000a8b0
add esp, 0x1c
cmp dword [eax + 0x14], 0x10
jb 0x100021a2
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x1420]
push 0x800
push eax
call fcn.1001ff46
mov edx, dword [ebp - 0x16cc]
add esp, 0xc
cmp edx, 0x10
jb 0x100021f1
mov ecx, dword [ebp - 0x16e0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100021e7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002d1d
push edx
push ecx
call fcn.100133fe
add esp, 8
lea ecx, [ebp - 0x1420]
mov dword [ebp - 0x16d0], 0
mov dword [ebp - 0x16cc], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x16e0], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002215
push 0
lea eax, [ebp - 0x1448]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x1420]
push eax
push dword [ebp - 0x147c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x147c]
call fcn.1000f9e0
add esp, 4
push 0x1004d53c
push 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
call fcn.1002acfa
xorps xmm0, xmm0
lea eax, [ebp - 0x146c]
push eax
movups xmmword [ebp - 0x146c], xmm0
movlpd qword [ebp - 0x142c], xmm0
call fcn.10010180
lea eax, [ebp - 0x142c]
push eax
lea eax, [ebp - 0x146c]
push eax
call fcn.1000ff10
mov ecx, dword [ebp - 0x1428]
add esp, 0x14
xor eax, eax
mov dword [ebp - 0x1498], 0
or eax, dword [ebp - 0x142c]
and ecx, 0x7fffffff
mov dword [esi + 0x70], eax
xor eax, eax
push 3
mov dword [esi + 0x74], ecx
lea ecx, [ebp - 0x1498]
push 0x1004dab8
mov dword [ebp - 0x1488], 0
mov dword [ebp - 0x1484], 7
mov word [ebp - 0x1498], ax
call fcn.1000f080
mov eax, dword [edi + 4]
mov byte [ebp - 4], 0x19
cmp eax, dword [edi + 8]
je 0x1000232b
movups xmm0, xmmword [ebp - 0x1498]
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x1488]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [edi + 4], 0x18
mov dword [ebp - 0x1488], 0
mov word [ebp - 0x1498], ax
jmp 0x10002340
lea ecx, [ebp - 0x1498]
push ecx
push eax
mov ecx, edi
call fcn.1000c040
mov edx, dword [ebp - 0x1484]
mov byte [ebp - 4], 0xf
cmp edx, 8
jb 0x1000237e
mov ecx, dword [ebp - 0x1498]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002374
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002d22
push edx
push ecx
call fcn.100133fe
add esp, 8
xor eax, eax
mov dword [ebp - 0x1488], 0
push 3
mov dword [ebp - 0x14b0], eax
lea ecx, [ebp - 0x14b0]
push 0x1004dac0
mov dword [ebp - 0x1484], 7
mov word [ebp - 0x1498], ax
mov dword [ebp - 0x14a0], eax
mov dword [ebp - 0x149c], 7
mov word [ebp - 0x14b0], ax
call fcn.1000f080
mov eax, dword [edi + 4]
mov byte [ebp - 4], 0x1a
cmp eax, dword [edi + 8]
je 0x1000240b
movups xmm0, xmmword [ebp - 0x14b0]
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x14a0]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [edi + 4], 0x18
mov dword [ebp - 0x14a0], 0
mov word [ebp - 0x14b0], ax
jmp 0x10002420
lea ecx, [ebp - 0x14b0]
push ecx
push eax
mov ecx, edi
call fcn.1000c040
mov edx, dword [ebp - 0x149c]
mov byte [ebp - 4], 0xf
cmp edx, 8
jb 0x1000245e
mov ecx, dword [ebp - 0x14b0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002454
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002d22
push edx
push ecx
call fcn.100133fe
add esp, 8
xor eax, eax
mov dword [ebp - 0x14a0], 0
push 3
mov dword [ebp - 0x14c8], eax
lea ecx, [ebp - 0x14c8]
push 0x1004dac8
mov dword [ebp - 0x149c], 7
mov word [ebp - 0x14b0], ax
mov dword [ebp - 0x14b8], eax
mov dword [ebp - 0x14b4], 7
mov word [ebp - 0x14c8], ax
call fcn.1000f080
mov eax, dword [edi + 4]
mov byte [ebp - 4], 0x1b
cmp eax, dword [edi + 8]
je 0x100024eb
movups xmm0, xmmword [ebp - 0x14c8]
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x14b8]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [edi + 4], 0x18
mov dword [ebp - 0x14b8], 0
mov word [ebp - 0x14c8], ax
jmp 0x10002500
lea ecx, [ebp - 0x14c8]
push ecx
push eax
mov ecx, edi
call fcn.1000c040
mov edx, dword [ebp - 0x14b4]
mov byte [ebp - 4], 0xf
cmp edx, 8
jb 0x1000253e
mov ecx, dword [ebp - 0x14c8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002534
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002d22
push edx
push ecx
call fcn.100133fe
add esp, 8
xor eax, eax
mov dword [ebp - 0x14b8], 0
push 3
mov dword [ebp - 0x14e0], eax
lea ecx, [ebp - 0x14e0]
push 0x1004dad0
mov dword [ebp - 0x14b4], 7
mov word [ebp - 0x14c8], ax
mov dword [ebp - 0x14d0], eax
mov dword [ebp - 0x14cc], 7
mov word [ebp - 0x14e0], ax
call fcn.1000f080
mov eax, dword [edi + 4]
mov byte [ebp - 4], 0x1c
cmp eax, dword [edi + 8]
je 0x100025cb
movups xmm0, xmmword [ebp - 0x14e0]
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x14d0]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [edi + 4], 0x18
mov dword [ebp - 0x14d0], 0
mov word [ebp - 0x14e0], ax
jmp 0x100025e0
lea ecx, [ebp - 0x14e0]
push ecx
push eax
mov ecx, edi
call fcn.1000c040
mov edx, dword [ebp - 0x14cc]
mov byte [ebp - 4], 0xf
cmp edx, 8
jb 0x1000261e
mov ecx, dword [ebp - 0x14e0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002614
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002d22
push edx
push ecx
call fcn.100133fe
add esp, 8
xor eax, eax
mov dword [ebp - 0x14d0], 0
push 3
mov dword [ebp - 0x14fc], eax
lea ecx, [ebp - 0x14fc]
push 0x1004dad8
mov dword [ebp - 0x14cc], 7
mov word [ebp - 0x14e0], ax
mov dword [ebp - 0x14ec], eax
mov dword [ebp - 0x14e8], 7
mov word [ebp - 0x14fc], ax
call fcn.1000f080
mov eax, dword [edi + 4]
mov byte [ebp - 4], 0x1d
cmp eax, dword [edi + 8]
je 0x100026b0
movups xmm0, xmmword [ebp - 0x14fc]
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x14ec]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [edi + 4], 0x18
mov dword [ebp - 0x14ec], 0
mov dword [ebp - 0x14e8], 7
mov word [ebp - 0x14fc], ax
jmp 0x100026bf
lea ecx, [ebp - 0x14fc]
push ecx
push eax
mov ecx, edi
call fcn.1000c040
lea ecx, [ebp - 0x14fc]
mov byte [ebp - 4], 0xf
call fcn.1000cc80
push 3
xor eax, eax
mov dword [ebp - 0x1514], 0
push 0x1004dae0
lea ecx, [ebp - 0x1514]
mov dword [ebp - 0x1504], 0
mov dword [ebp - 0x1500], 7
mov word [ebp - 0x1514], ax
call fcn.1000f080
mov eax, dword [edi + 4]
mov byte [ebp - 4], 0x1e
cmp eax, dword [edi + 8]
je 0x1000274d
movups xmm0, xmmword [ebp - 0x1514]
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x1504]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [edi + 4], 0x18
mov dword [ebp - 0x1504], 0
mov dword [ebp - 0x1500], 7
mov word [ebp - 0x1514], ax
jmp 0x1000275c
lea ecx, [ebp - 0x1514]
push ecx
push eax
mov ecx, edi
call fcn.1000c040
lea ecx, [ebp - 0x1514]
mov byte [ebp - 4], 0xf
call fcn.1000cc80
push 3
xor eax, eax
mov dword [ebp - 0x152c], 0
push 0x1004dae8
lea ecx, [ebp - 0x152c]
mov dword [ebp - 0x151c], 0
mov dword [ebp - 0x1518], 7
mov word [ebp - 0x152c], ax
call fcn.1000f080
mov eax, dword [edi + 4]
mov byte [ebp - 4], 0x1f
cmp eax, dword [edi + 8]
je 0x100027ea
movups xmm0, xmmword [ebp - 0x152c]
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x151c]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [edi + 4], 0x18
mov dword [ebp - 0x151c], 0
mov dword [ebp - 0x1518], 7
mov word [ebp - 0x152c], ax
jmp 0x100027f9
lea ecx, [ebp - 0x152c]
push ecx
push eax
mov ecx, edi
call fcn.1000c040
lea ecx, [ebp - 0x152c]
mov byte [ebp - 4], 0xf
call fcn.1000cc80
push 3
xor eax, eax
mov dword [ebp - 0x158c], 0
push 0x1004daf0
lea ecx, [ebp - 0x158c]
mov dword [ebp - 0x157c], 0
mov dword [ebp - 0x1578], 7
mov word [ebp - 0x158c], ax
call fcn.1000f080
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x158c]
push ecx
mov byte [ebp - 4], 0x20
push eax
cmp eax, dword [edi + 8]
je 0x10002864
push edi
call fcn.1000c280
add esp, 0xc
add dword [edi + 4], 0x18
jmp 0x1000286b
mov ecx, edi
call fcn.1000c040
lea ecx, [ebp - 0x158c]
mov byte [ebp - 4], 0xf
call fcn.1000cc80
push 3
xor eax, eax
mov dword [ebp - 0x15a4], 0
push 0x1004daf8
lea ecx, [ebp - 0x15a4]
mov dword [ebp - 0x1594], 0
mov dword [ebp - 0x1590], 7
mov word [ebp - 0x15a4], ax
call fcn.1000f080
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x15a4]
push ecx
mov byte [ebp - 4], 0x21
push eax
cmp eax, dword [edi + 8]
je 0x100028d6
push edi
call fcn.1000c280
add esp, 0xc
add dword [edi + 4], 0x18
jmp 0x100028dd
mov ecx, edi
call fcn.1000c040
lea ecx, [ebp - 0x15a4]
mov byte [ebp - 4], 0xf
call fcn.1000cc80
push 3
xor eax, eax
mov dword [ebp - 0x15bc], 0
push 0x1004db00
lea ecx, [ebp - 0x15bc]
mov dword [ebp - 0x15ac], 0
mov dword [ebp - 0x15a8], 7
mov word [ebp - 0x15bc], ax
call fcn.1000f080
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x15bc]
push ecx
mov byte [ebp - 4], 0x22
push eax
cmp eax, dword [edi + 8]
je 0x10002948
push edi
call fcn.1000c280
add esp, 0xc
add dword [edi + 4], 0x18
jmp 0x1000294f
mov ecx, edi
call fcn.1000c040
lea ecx, [ebp - 0x15bc]
mov byte [ebp - 4], 0xf
call fcn.1000cc80
push 3
xor eax, eax
mov dword [ebp - 0x15d4], 0
push 0x1004db08
lea ecx, [ebp - 0x15d4]
mov dword [ebp - 0x15c4], 0
mov dword [ebp - 0x15c0], 7
mov word [ebp - 0x15d4], ax
call fcn.1000f080
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x15d4]
push ecx
mov byte [ebp - 4], 0x23
push eax
cmp eax, dword [edi + 8]
je 0x100029ba
push edi
call fcn.1000c280
add esp, 0xc
add dword [edi + 4], 0x18
jmp 0x100029c1
mov ecx, edi
call fcn.1000c040
lea ecx, [ebp - 0x15d4]
mov byte [ebp - 4], 0xf
call fcn.1000cc80
push 3
xor eax, eax
mov dword [ebp - 0x1574], 0
push 0x1004db10
lea ecx, [ebp - 0x1574]
mov dword [ebp - 0x1564], 0
mov dword [ebp - 0x1560], 7
mov word [ebp - 0x1574], ax
call fcn.1000f080
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x1574]
push ecx
mov byte [ebp - 4], 0x24
push eax
cmp eax, dword [edi + 8]
je 0x10002a2c
push edi
call fcn.1000c280
add esp, 0xc
add dword [edi + 4], 0x18
jmp 0x10002a33
mov ecx, edi
call fcn.1000c040
lea ecx, [ebp - 0x1574]
mov byte [ebp - 4], 0xf
call fcn.1000cc80
mov ecx, 0x1007deb8
mov dword [ebp - 0x15ec], 0
xor eax, eax
mov dword [ebp - 0x15dc], 0
mov dword [ebp - 0x15d8], 7
mov word [ebp - 0x15ec], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10002a71
sub ecx, edx
sar ecx, 1
push ecx
push 0x1007deb8
lea ecx, [ebp - 0x15ec]
call fcn.1000f080
push str.databasemain.cvd
lea eax, [ebp - 0x15ec]
mov byte [ebp - 4], 0x25
push eax
lea eax, [ebp - 0x1444]
push eax
call fcn.1000bb00
add esp, 0xc
lea ecx, [ebp - 0x15ec]
mov byte [ebp - 4], 0x27
call fcn.1000cc80
cmp dword [ebp - 0x1430], 8
lea eax, [ebp - 0x1444]
cmovae eax, dword [ebp - 0x1444]
push eax
call dword [0x1007e228]
test eax, eax
je 0x10002b2f
cmp dword [ebp - 0x1430], 8
lea eax, [ebp - 0x1444]
push 0
cmovae eax, dword [ebp - 0x1444]
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call fcn.1000fb50
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
je 0x10002b2f
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jne 0x10002b24
mov byte [esi + 0x2b], al
push edi
call fcn.1000f9e0
add esp, 4
jmp 0x10002b33
mov byte [esi + 0x2b], 0
cmp byte [esi + 0x2b], 0
je 0x10002b40
mov ecx, esi
call fcn.10008260
mov ecx, 0x1007deb8
mov dword [ebp - 0x1604], 0
xor eax, eax
mov dword [ebp - 0x15f4], 0
mov dword [ebp - 0x15f0], 7
mov word [ebp - 0x1604], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10002b70
sub ecx, edx
sar ecx, 1
push ecx
push 0x1007deb8
lea ecx, [ebp - 0x1604]
call fcn.1000f080
push str.RPCA.tm
lea eax, [ebp - 0x1604]
mov byte [ebp - 4], 0x28
push eax
lea eax, [ebp - 0x1758]
push eax
call fcn.1000bb00
add esp, 0xc
lea ecx, [esi + 0x4180]
push eax
call fcn.1000cf10
lea ecx, [ebp - 0x1758]
call fcn.1000cc80
lea ecx, [ebp - 0x1604]
mov byte [ebp - 4], 0x27
call fcn.1000cc80
mov ecx, 0x1007deb8
mov dword [ebp - 0x161c], 0
xor eax, eax
mov dword [ebp - 0x160c], 0
mov dword [ebp - 0x1608], 7
mov word [ebp - 0x161c], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10002c04
sub ecx, edx
sar ecx, 1
push ecx
push 0x1007deb8
lea ecx, [ebp - 0x161c]
call fcn.1000f080
push str.RPCACheck.tm
lea eax, [ebp - 0x161c]
mov byte [ebp - 4], 0x29
push eax
lea eax, [ebp - 0x1740]
push eax
call fcn.1000bb00
add esp, 0xc
lea ecx, [esi + 0x419c]
push eax
call fcn.1000cf10
lea ecx, [ebp - 0x1740]
call fcn.1000cc80
lea ecx, [ebp - 0x161c]
mov byte [ebp - 4], 0x27
call fcn.1000cc80
call fcn.1000b3d0
test eax, eax
setg al
cmp dword [0x1005fd74], 0
jne 0x10002c9b
test al, al
jne 0x10002c9b
push 0
push 0
push esi
push 0x10003590
push 0
push 0
call fcn.100298e0
add esp, 0x18
mov dword [0x1005fd74], eax
cmp byte [esi + 0x2b], 0
jne 0x10002cc3
cmp dword [0x1005fd7c], 0
jne 0x10002cc3
push 0x7d0
mov byte [0x1005fd72], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, esi
call fcn.10009450
lea ecx, [ebp - 0x1444]
call fcn.1000cc80
lea ecx, [ebp + 8]
call fcn.1000cc80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100139b7
mov esp, ebp
pop ebp
ret 0x1c
push 0x80004005
call fcn.1000d3a0
call fcn.1001e389
call fcn.1001e389
call fcn.1001e389
call fcn.1001e389
call fcn.1001e389
call fcn.1000eaf0
call fcn.1001e389
call fcn.1001e389
int3