Function at 0x100072b0
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101808f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x530
push esi
push edi
lea eax, [ebp - 0x440]
mov dword [ebp - 0x14], ecx
push eax
mov esi, edx
push 0x104
mov dword [ebp - 0x7c], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x4c], 0
movups xmmword [ebp - 0x60], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007320
sub ecx, edx
lea eax, [ebp - 0x440]
push ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.10005380
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x4c]
mov eax, edx
mov ecx, dword [ebp - 0x50]
sub eax, ecx
push 0xc
push str.monitor.bat
cmp eax, 0xc
jb 0x1000737d
cmp edx, 0xf
lea esi, [ebp - 0x60]
lea eax, [ecx + 0xc]
cmova esi, dword [ebp - 0x60]
add esi, ecx
mov dword [ebp - 0x50], eax
push esi
call fcn.101579a0
mov byte [esi + 0xc], 0
lea eax, [ebp - 0x60]
mov esi, dword [ebp - 0x7c]
add esp, 0xc
jmp 0x1000738e
mov byte [ebp - 0x48], 0
lea ecx, [ebp - 0x60]
push dword [ebp - 0x48]
push 0xc
call fcn.100059b0
mov dword [ebp - 0x68], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x78], xmm0
mov dword [ebp - 0x64], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x78], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x68], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
sub esp, 8
mov byte [ebp - 4], 1
lea eax, [ebp - 0x78]
lea ecx, [ebp - 0x188]
push 2
push eax
call fcn.10009520
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x64]
cmp ecx, 0xf
jbe 0x10007415
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000740b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000840e
push ecx
push edx
call fcn.10154c15
add esp, 8
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0xf
mov byte [ebp - 0x78], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x4c]
cmp ecx, 0xf
jbe 0x1000745f
mov edx, dword [ebp - 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10007455
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000840e
push ecx
push edx
call fcn.10154c15
add esp, 8
cmp dword [ebp - 0x138], 0
mov edi, dword [ebx + 8]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
je 0x10007938
mov edx, str._echo_off_n
lea ecx, [ebp - 0x188]
call fcn.10004fc0
mov edx, str.:CheckProcess_n
lea ecx, [ebp - 0x188]
call fcn.10004fc0
mov edx, str.set__ProcessName
lea ecx, [ebp - 0x188]
call fcn.10004fc0
mov ecx, eax
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x14], 0xf
mov edx, dword [eax + 0x10]
jbe 0x100074c1
mov eax, dword [eax]
push edx
mov edx, eax
call fcn.1000bd90
add esp, 4
mov edx, 0x101c6974
mov ecx, eax
call fcn.10004fc0
mov edx, str.set__ProcessPath
lea ecx, [ebp - 0x188]
call fcn.10004fc0
cmp dword [esi + 0x14], 0xf
mov edx, esi
jbe 0x100074f2
mov edx, dword [esi]
push dword [esi + 0x10]
mov ecx, eax
call fcn.1000bd90
add esp, 4
mov edx, 0x101c6974
mov ecx, eax
call fcn.10004fc0
mov edx, str.set__BackupProcessPath
lea ecx, [ebp - 0x188]
call fcn.10004fc0
xorps xmm0, xmm0
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007540
sub ecx, edx
lea eax, [ebp - 0x440]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.10005380
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x18]
mov eax, edx
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
push 0xd
push str._backup.exe__n
cmp eax, 0xd
jb 0x10007597
cmp edx, 0xf
lea esi, [ebp - 0x2c]
lea eax, [ecx + 0xd]
cmova esi, dword [ebp - 0x2c]
add esi, ecx
mov dword [ebp - 0x1c], eax
push esi
call fcn.101579a0
add esp, 0xc
mov byte [esi + 0xd], 0
lea eax, [ebp - 0x2c]
jmp 0x100075a8
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x14]
push 0xd
call fcn.100059b0
mov dword [ebp - 0x34], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x30], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x44], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x34], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 6
cmp dword [ebp - 0x30], 0xf
push dword [ebp - 0x34]
cmova edx, dword [ebp - 0x44]
call fcn.1000bd90
mov byte [ebp - 4], 5
add esp, 4
mov ecx, dword [ebp - 0x30]
cmp ecx, 0xf
jbe 0x10007634
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000762a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008413
push ecx
push edx
call fcn.10154c15
add esp, 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp ecx, 0xf
jbe 0x1000767e
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10007674
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008413
push ecx
push edx
call fcn.10154c15
add esp, 8
mov edx, str.set__DLLPath
lea ecx, [ebp - 0x188]
call fcn.10004fc0
cmp dword [edi + 0x14], 0xf
mov edx, edi
jbe 0x10007698
mov edx, dword [edi]
push dword [edi + 0x10]
mov ecx, eax
call fcn.1000bd90
add esp, 4
mov edx, 0x101c6974
mov ecx, eax
call fcn.10004fc0
mov edx, str.set__BackupDLLPath
lea ecx, [ebp - 0x188]
call fcn.10004fc0
xorps xmm0, xmm0
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100076e2
sub ecx, edx
lea eax, [ebp - 0x440]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.10005380
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x18]
mov eax, edx
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
push 0xd
push str._backup.dll__n
cmp eax, 0xd
jb 0x10007739
cmp edx, 0xf
lea esi, [ebp - 0x2c]
lea eax, [ecx + 0xd]
cmova esi, dword [ebp - 0x2c]
add esi, ecx
mov dword [ebp - 0x1c], eax
push esi
call fcn.101579a0
add esp, 0xc
mov byte [esi + 0xd], 0
lea eax, [ebp - 0x2c]
jmp 0x1000774a
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x14]
push 0xd
call fcn.100059b0
mov dword [ebp - 0x34], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x30], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x44], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x34], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 8
cmp dword [ebp - 0x30], 0xf
push dword [ebp - 0x34]
cmova edx, dword [ebp - 0x44]
call fcn.1000bd90
mov byte [ebp - 4], 7
add esp, 4
mov ecx, dword [ebp - 0x30]
cmp ecx, 0xf
jbe 0x100077d6
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100077cc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008418
push ecx
push edx
call fcn.10154c15
add esp, 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp ecx, 0xf
jbe 0x10007820
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10007816
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008418
push ecx
push edx
call fcn.10154c15
add esp, 8
mov edx, str.if_not_exist___ProcessPath_____n
lea ecx, [ebp - 0x188]
call fcn.10004fc0
mov edx, str.____echo_Process_file_not_found__restoring_from_backup..._n
lea ecx, [ebp - 0x188]
call fcn.10004fc0
mov edx, str.____copy__Y___BackupProcessPath_____ProcessPath___n
lea ecx, [ebp - 0x188]
call fcn.10004fc0
mov edx, 0x101c6a8c
lea ecx, [ebp - 0x188]
call fcn.10004fc0
mov edx, str.if_not_exist___DLLPath_____n
lea ecx, [ebp - 0x188]
call fcn.10004fc0
mov edx, str.____echo_DLL_file_not_found__restoring_from_backup..._n
lea ecx, [ebp - 0x188]
call fcn.10004fc0
mov edx, str.____copy__Y___BackupDLLPath_____DLLPath___n
lea ecx, [ebp - 0x188]
call fcn.10004fc0
mov edx, 0x101c6a8c
lea ecx, [ebp - 0x188]
call fcn.10004fc0
mov edx, str.tasklist__FI__IMAGENAME_eq__ProcessName____findstr__I___ProcessName____nul_n
lea ecx, [ebp - 0x188]
call fcn.10004fc0
mov edx, str.if__ERRORLEVEL__neq_0___n
lea ecx, [ebp - 0x188]
call fcn.10004fc0
mov edx, str.____start______ProcessPath___n
lea ecx, [ebp - 0x188]
call fcn.10004fc0
mov edx, 0x101c6a8c
lea ecx, [ebp - 0x188]
call fcn.10004fc0
mov edx, str.timeout__t_30__nobreak__nul_n
lea ecx, [ebp - 0x188]
call fcn.10004fc0
mov edx, str.goto_CheckProcess_n
lea ecx, [ebp - 0x188]
call fcn.10004fc0
lea ecx, [ebp - 0x184]
call fcn.10009e90
test eax, eax
jne 0x10007938
mov eax, dword [ebp - 0x188]
lea ecx, [ebp - 0x188]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10002fc0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007956
sub ecx, edx
lea eax, [ebp - 0x440]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.10005380
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x18]
mov eax, edx
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
push 0xc
push str.monitor.bat
cmp eax, 0xc
jb 0x100079ad
cmp edx, 0xf
lea esi, [ebp - 0x2c]
lea eax, [ecx + 0xc]
cmova esi, dword [ebp - 0x2c]
add esi, ecx
mov dword [ebp - 0x1c], eax
push esi
call fcn.101579a0
add esp, 0xc
mov byte [esi + 0xc], 0
lea eax, [ebp - 0x2c]
jmp 0x100079be
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x14]
push 0xc
call fcn.100059b0
mov dword [ebp - 0x34], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x30], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x44], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x34], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0xf
cmova eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x540]
push str.cmd.exe__B__c___s_
push eax
call fcn.10007220
mov ecx, dword [ebp - 0x30]
add esp, 0xc
cmp ecx, 0xf
jbe 0x10007a49
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10007a3f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000841d
push ecx
push edx
call fcn.10154c15
add esp, 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp ecx, 0xf
jbe 0x10007a93
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10007a89
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000841d
push ecx
push edx
call fcn.10154c15
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007ab1
sub ecx, edx
lea eax, [ebp - 0x440]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.10005380
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x18]
mov eax, edx
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
push 0xb
push str._backup.dll
cmp eax, 0xb
jb 0x10007b08
cmp edx, 0xf
lea esi, [ebp - 0x2c]
lea eax, [ecx + 0xb]
cmova esi, dword [ebp - 0x2c]
add esi, ecx
mov dword [ebp - 0x1c], eax
push esi
call fcn.101579a0
add esp, 0xc
mov byte [esi + 0xb], 0
lea eax, [ebp - 0x2c]
jmp 0x10007b19
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x14]
push 0xb
call fcn.100059b0
mov dword [ebp - 0xa0], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0xb0], xmm0
mov dword [ebp - 0x9c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xb0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xa0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x10007b97
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10007b8d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008422
push ecx
push edx
call fcn.10154c15
add esp, 8
cmp dword [ebp - 0x9c], 0xf
lea eax, [ebp - 0xb0]
mov dword [ebp - 0x1c], 0
mov ecx, edi
cmova eax, dword [ebp - 0xb0]
cmp dword [edi + 0x14], 0xf
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
jbe 0x10007bc7
mov ecx, dword [edi]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x10007c05
mov edx, str.Failed_to_create_backup_DLL._Please_check_the_DLL_path:
mov ecx, 0x101efa68
call fcn.10004fc0
cmp dword [edi + 0x14], 0xf
mov ecx, dword [edi + 0x10]
jbe 0x10007bef
mov edi, dword [edi]
push ecx
mov edx, edi
mov ecx, eax
call fcn.1000bd90
add esp, 4
push eax
call fcn.1000a490
add esp, 4
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x4c], 0
movups xmmword [ebp - 0x60], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007c23
sub ecx, edx
lea eax, [ebp - 0x440]
push ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.10005380
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x4c]
mov eax, edx
mov ecx, dword [ebp - 0x50]
sub eax, ecx
push 0xb
push str._backup.exe
cmp eax, 0xb
jb 0x10007c7a
cmp edx, 0xf
lea esi, [ebp - 0x60]
lea eax, [ecx + 0xb]
cmova esi, dword [ebp - 0x60]
add esi, ecx
mov dword [ebp - 0x50], eax
push esi
call fcn.101579a0
add esp, 0xc
mov byte [esi + 0xb], 0
lea eax, [ebp - 0x60]
jmp 0x10007c8b
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x60]
push dword [ebp - 0x14]
push 0xb
call fcn.100059b0
mov dword [ebp - 0x88], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x98], xmm0
mov dword [ebp - 0x84], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x98], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x88], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x4c]
cmp ecx, 0xf
jbe 0x10007d09
mov edx, dword [ebp - 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10007cff
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008427
push ecx
push edx
call fcn.10154c15
add esp, 8
mov esi, dword [ebp - 0x7c]
lea eax, [ebp - 0x98]
cmp dword [ebp - 0x84], 0xf
mov ecx, esi
mov dword [ebp - 0x50], 0
cmova eax, dword [ebp - 0x98]
cmp dword [esi + 0x14], 0xf
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
jbe 0x10007d3c
mov ecx, dword [esi]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x10007d7a
mov edx, str.Failed_to_create_backup_EXE._Please_check_the_EXE_path:
mov ecx, 0x101efa68
call fcn.10004fc0
cmp dword [esi + 0x14], 0xf
mov ecx, dword [esi + 0x10]
jbe 0x10007d64
mov esi, dword [esi]
push ecx
mov edx, esi
mov ecx, eax
call fcn.1000bd90
add esp, 4
push eax
call fcn.1000a490
add esp, 4
xorps xmm0, xmm0
mov dword [ebp - 0x1d0], 0x44
xor eax, eax
movlpd qword [ebp - 0x1cc], xmm0
lea ecx, [ebp - 0x440]
movlpd qword [ebp - 0x1c4], xmm0
movlpd qword [ebp - 0x1bc], xmm0
lea edx, [ecx + 1]
movlpd qword [ebp - 0x1b4], xmm0
movlpd qword [ebp - 0x1ac], xmm0
movlpd qword [ebp - 0x19e], xmm0
movlpd qword [ebp - 0x196], xmm0
mov word [ebp - 0x18e], ax
mov dword [ebp - 0x1a4], 1
mov word [ebp - 0x1a0], ax
movups xmmword [ebp - 0xd8], xmm0
mov dword [ebp - 0x1c], eax
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007df3
sub ecx, edx
lea eax, [ebp - 0x440]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.10005380
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x18]
mov eax, edx
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
push 0xb
push str.monitor.pid
cmp eax, 0xb
jb 0x10007e4a
cmp edx, 0xf
lea esi, [ebp - 0x2c]
lea eax, [ecx + 0xb]
cmova esi, dword [ebp - 0x2c]
add esi, ecx
mov dword [ebp - 0x1c], eax
push esi
call fcn.101579a0
add esp, 0xc
mov byte [esi + 0xb], 0
lea eax, [ebp - 0x2c]
jmp 0x10007e5b
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x14]
push 0xb
call fcn.100059b0
mov dword [ebp - 0x68], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x78], xmm0
mov dword [ebp - 0x64], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x78], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x68], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
sub esp, 8
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x78]
lea ecx, [ebp - 0x338]
push 1
push eax
call fcn.10008560
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x64]
cmp ecx, 0xf
jbe 0x10007ee2
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10007ed8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000842c
push ecx
push edx
call fcn.10154c15
add esp, 8
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0xf
mov byte [ebp - 0x78], 0
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x10007f2c
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10007f22
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000842c
push ecx
push edx
call fcn.10154c15
add esp, 8
cmp dword [ebp - 0x2dc], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x80], 0
je 0x10007fba
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x338]
call fcn.1000a530
lea ecx, [ebp - 0x328]
call fcn.10009e90
test eax, eax
jne 0x10007f95
mov eax, dword [ebp - 0x338]
lea ecx, [ebp - 0x338]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10002fc0
mov eax, dword [ebp - 0x80]
test eax, eax
je 0x10007fba
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x10007fba
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000825a
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x1d0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x540]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1000825a
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008010
sub ecx, edx
lea eax, [ebp - 0x440]
push ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.10005380
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x30]
mov eax, edx
mov ecx, dword [ebp - 0x34]
sub eax, ecx
push 0xb
push str.monitor.pid
cmp eax, 0xb
jb 0x10008067
cmp edx, 0xf
lea esi, [ebp - 0x44]
lea eax, [ecx + 0xb]
cmova esi, dword [ebp - 0x44]
add esi, ecx
mov dword [ebp - 0x34], eax
push esi
call fcn.101579a0
add esp, 0xc
mov byte [esi + 0xb], 0
lea eax, [ebp - 0x44]
jmp 0x10008078
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x44]
push dword [ebp - 0x14]
push 0xb
call fcn.100059b0
mov dword [ebp - 0xb8], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0xc8], xmm0
mov dword [ebp - 0xb4], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xc8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xb8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
sub esp, 8
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0xc8]
lea ecx, [ebp - 0x280]
push 2
push eax
call fcn.10009520
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0xb4]
cmp ecx, 0xf
jbe 0x10008117
mov edx, dword [ebp - 0xc8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000810d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008431
push ecx
push edx
call fcn.10154c15
add esp, 8
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0xf
mov byte [ebp - 0xc8], 0
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x30]
cmp ecx, 0xf
jbe 0x1000816a
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10008160
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008431
push ecx
push edx
call fcn.10154c15
add esp, 8
cmp dword [ebp - 0x230], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
je 0x100081ce
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x280]
call fcn.10009630
lea ecx, [ebp - 0x27c]
call fcn.10009e90
test eax, eax
jne 0x100081ce
mov eax, dword [ebp - 0x280]
lea ecx, [ebp - 0x280]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10002fc0
push dword [ebp - 0xd8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xd4]
call esi
mov eax, dword [ebp - 0x280]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x280]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x284], eax
lea ecx, [ebp - 0x27c]
call fcn.100091b0
mov eax, dword [ebp - 0x280]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x280]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x284], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0x1a
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.10156d1c
add esp, 4
mov eax, dword [ebp - 0x338]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x338]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x33c], eax
lea ecx, [ebp - 0x328]
call fcn.100091b0
mov eax, dword [ebp - 0x338]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x338]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x33c], eax
lea eax, [ebp - 0x2c8]
mov byte [ebp - 4], 0x1b
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.10156d1c
mov byte [ebp - 4], 0xc
add esp, 4
mov ecx, dword [ebp - 0x84]
cmp ecx, 0xf
jbe 0x1000830e
mov edx, dword [ebp - 0x98]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10008304
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008436
push ecx
push edx
call fcn.10154c15
add esp, 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0xf
mov byte [ebp - 0x98], 0
cmp ecx, 0xf
jbe 0x10008367
mov edx, dword [ebp - 0xb0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000835d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008436
push ecx
push edx
call fcn.10154c15
add esp, 8
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0xf
mov byte [ebp - 0xb0], 0
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x188]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x18c], eax
lea ecx, [ebp - 0x184]
call fcn.100091b0
mov eax, dword [ebp - 0x188]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x188]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x18c], eax
lea eax, [ebp - 0x120]
mov dword [ebp - 4], 0x1c
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.10156d1c
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1015ff88
call fcn.1015ff88
call fcn.1015ff88
call fcn.1015ff88
call fcn.1015ff88
call fcn.1015ff88
call fcn.1015ff88
call fcn.1015ff88
call fcn.1015ff88
int3