Function at 0x69643685
Capabilities:
Create directory
Enumerate files on windows
Get common file path
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov eax, 0x436c
call fcn.696475d0
sub esp, eax
mov dword [ebp - 0x2c], 0x486
mov dword [esp], 0x1f4
call sym._affZoZyj5QQfO
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], str.c0a696a9e01006e0adf4a1342262b407e70fe319bf3856e1815c45416dc7b1fa8c8f323e71e68334051b1865fa066f6f0614578cf6048809df234e2139cc804aa843430a2e76a49640cd749897b078aebdd10177d3024672
lea eax, [ebp - 0x5c2]
mov ebx, 0x6964aec0
mov edx, 0x396
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x5c2]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
mov dword [esp], 0x396
call sym._y2Ob5
mov dword [ebp - 0x38], eax
mov dword [esp], 4
call sym._p9aL1QdQlUyq1vYE9yCDe0DMeIToW
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x9a8]
mov edx, 0x6964b260
mov ecx, 0xf9
mov edi, eax
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov edx, esi
mov eax, edi
movzx ecx, word [edx]
mov word [eax], cx
lea eax, [eax + 2]
lea edx, [edx + 2]
mov dword [ebp - 0x40], str.21188f520c000d50bdf7d22981797d4d7b2a8a26815ad04ac37381915e2378e7493cb43be1650f3ccef91baeea3221ba19b53e85bc74c8c589516b24555fee6b71c89e37d94d4b1f01fd5c1fad77a21703ab3f01fc06b8a2d1388666683bfe49b11549255f14b21ca4b67cdd0fe9165006bdea97d5fdb8474016ea71a3ff920f34e3d96a299c1facc85a1235829f4dec
lea eax, [ebp - 0x9a8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], eax
mov dword [esp], 0x3e6
call sym._y2Ob5
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0xd60]
mov ebx, 0x6964b660
mov edx, 0xee
mov edi, eax
mov esi, ebx
mov ecx, edx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x48], str.bb7aef80ea94d78fbd205914c0320c55169e603ad12cc238ef4254bb01d6c9d24b8fce31e2dec1627cefb050360274e9f9ed983d086e84ad8e6e11d0acc47cc9ac290f292197d05e6de7ecf0cc47f2dc5691af38b4e15c9fad23ee2d04378859
lea eax, [ebp - 0xd60]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x48]
mov dword [esp + 4], eax
mov dword [esp], 0x3b8
call sym._y2Ob5
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x1116]
mov ebx, 0x6964ba20
mov edx, 0x3b6
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x50], str.ad51bb4bfa34c4cf1183fb8f1d1abf2a7977bd6b76eb0f6d0879fc83110fbfa396457cb6faf211a8dfb7a69d47bcb3abb8c1b08cd4cad287
lea eax, [ebp - 0x1116]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x50]
mov dword [esp + 4], eax
mov dword [esp], 0x3b6
call sym._y2Ob5
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], str.4bdbd5f077db77ca48a9b2efc6e1eff369476d4d5a39f4a8fab6d0820d55b113ba032100aa86aea3
lea eax, [ebp - 0x1502]
mov ebx, 0x6964bde0
mov edx, 0x3ec
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1502]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x58]
mov dword [esp + 4], eax
mov dword [esp], 0x3ec
call sym._y2Ob5
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x18af]
mov ebx, 0x6964c1e0
mov edx, 0x3ad
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x60], str.e94ba8222aec1f38fae521164bce735a
lea eax, [ebp - 0x18af]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x60]
mov dword [esp + 4], eax
mov dword [esp], 0x3ad
call sym._y2Ob5
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x1c98]
mov edx, 0x6964c5a0
mov ecx, 0xfa
mov edi, eax
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov edx, esi
mov eax, edi
movzx ecx, byte [edx]
mov byte [eax], cl
lea eax, [eax + 1]
lea edx, [edx + 1]
mov dword [ebp - 0x68], str.158cfe2564b82c5e
lea eax, [ebp - 0x1c98]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x68]
mov dword [esp + 4], eax
mov dword [esp], 0x3e9
call sym._y2Ob5
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x54]
mov dword [eax], edx
mov eax, dword [ebp - 0x3c]
lea edx, [eax + 8]
mov eax, dword [ebp - 0x38]
mov dword [edx], eax
lea eax, [ebp - 0x20cf]
mov ebx, 0x6964c9a0
mov edx, 0x437
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x70], str.20e1d433837f0aaf29bf5389e1523ff7344f62a333802f12f902273c0e481a47a5f5f89540d865f6459f99932897e7aa03804ae6c2ab0bf47a3412ae3fe8c2a6
lea eax, [ebp - 0x20cf]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x70]
mov dword [esp + 4], eax
mov dword [esp], 0x437
call sym._y2Ob5
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], str.c60b26a9f537558b4d023adce7dc065539149bf57ec797a77a5683c0238dac78e26f54bfbefc5524e3bcf1028fdeb8a0c6e53c3884cbda5375294c591792735c227f038a720b0273
lea eax, [ebp - 0x248f]
mov ebx, 0x6964cde0
mov edx, 0x3c0
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x248f]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x78]
mov dword [esp + 4], eax
mov dword [esp], 0x3c0
call sym._y2Ob5
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x283b]
mov ebx, 0x6964d1a0
mov edx, 0x3ac
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x80], str.65bb23eafc8885795b376cb472190964ac3b1337f76e22ff
lea eax, [ebp - 0x283b]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x80]
mov dword [esp + 4], eax
mov dword [esp], 0x3ac
call sym._y2Ob5
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x2bcd]
mov ebx, str._r
mov edx, 0x392
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x88], str.4a44f2a21433a85f336976f72be921c27c9a254475068fd53544ee8064babf7c
lea eax, [ebp - 0x2bcd]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], eax
mov dword [esp], 0x392
call sym._y2Ob5
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x3c]
lea edx, [eax + 4]
mov eax, dword [ebp - 0x44]
mov dword [edx], eax
lea eax, [ebp - 0x2ff7]
mov ebx, 0x6964d900
mov edx, 0x42a
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x90], str.c9438367684b999a86f1f559f1dc5fd7b614c3960dc6836151e13437fef74434e74a5f8f5eee80bbabd32b288e5ced59492dc0a46a73e5d446f7a982e1e7247ea8f320e30056e6f756d33d24cbeb922d2047e5bf615776e8
lea eax, [ebp - 0x2ff7]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x90]
mov dword [esp + 4], eax
mov dword [esp], 0x42a
call sym._y2Ob5
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x98], str.7eb47adab3c67a09b904c82d62dfabb81dbceeafe0733b084bf8f06a1d147527
lea eax, [ebp - 0x342d]
mov ebx, 0x6964dd40
mov edx, 0x436
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x342d]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x98]
mov dword [esp + 4], eax
mov dword [esp], 0x436
call sym._y2Ob5
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa0], str.d8951e647c4eff3f0b7ea053dcb15660477a49b56cee0129668e6a0ec529fa17c138d689a43f4baaf217e9f6b71d36617041280b14374a1c1efeea2008cae0ab
lea eax, [ebp - 0x3861]
mov ebx, 0x6964e180
mov edx, 0x434
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x3861]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0xa0]
mov dword [esp + 4], eax
mov dword [esp], 0x434
call sym._y2Ob5
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], str.6d7d3b7bddedb678555fe26ab71c01bd2b752a281266a35ece0bcd131a34b0c393d96828e28523f83952c5562ce1793f607b87eed5c66edb
lea eax, [ebp - 0x3bf0]
mov edx, 0x6964e5c0
mov ecx, 0xe3
mov edi, eax
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov edx, esi
mov eax, edi
movzx ecx, word [edx]
mov word [eax], cx
lea eax, [eax + 2]
lea edx, [edx + 2]
movzx ecx, byte [edx]
mov byte [eax], cl
lea eax, [eax + 1]
lea edx, [edx + 1]
lea eax, [ebp - 0x3bf0]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0xa8]
mov dword [esp + 4], eax
mov dword [esp], 0x38f
call sym._y2Ob5
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x3c]
lea edx, [eax + 0xc]
mov eax, dword [ebp - 0x4c]
mov dword [edx], eax
mov dword [ebp - 0xb0], str.11524fc1d389ab3f5255889eec935608
lea eax, [ebp - 0x3fb3]
mov ebx, 0x6964e960
mov edx, 0x3c3
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x3fb3]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0xb0]
mov dword [esp + 4], eax
mov dword [esp], 0x3c3
call sym._y2Ob5
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0x435b]
mov ebx, 0x6964ed40
mov edx, 0x3a8
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb8], str.a570a43876d6eab0f79e967cc6747dcc15bfe93512eefe04f0102dfc2d12674bbc9ab8545823231178164e073620f16507772114fbb7d3b938427c1b19822fed
lea eax, [ebp - 0x435b]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0xb8]
mov dword [esp + 4], eax
mov dword [esp], 0x3a8
call sym._y2Ob5
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x1c], 0
add dword [ebp - 0x20], 1
mov dword [ebp - 0x24], 0
mov dword [ebp - 0xc0], 0xffffffff
cmp dword [ebp - 0x20], 0x6e
ja 0x69643dfd
mov dword [esp + 4], 3
mov dword [esp], 0
call sym._WeEn4c
lea edx, [eax*4]
mov eax, dword [ebp - 0x3c]
add eax, edx
mov eax, dword [eax]
mov dword [esp], eax
call sym._getenv
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x69643ea4
jmp 0x69644419
mov eax, dword [ebp - 0x94]
mov dword [esp], eax
call sym._getenv
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x69643ea4
mov eax, esp
mov ebx, eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call eax
sub esp, 8
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
add eax, 1
mov edx, eax
sub edx, 1
mov dword [ebp - 0xc8], edx
mov edx, 0x10
sub edx, 1
add eax, edx
mov esi, 0x10
mov edx, 0
div esi
imul eax, eax, 0x10
call fcn.696475d0
sub esp, eax
lea eax, [esp + 0x10]
add eax, 0
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call eax
sub esp, 8
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x24], eax
mov esp, ebx
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._strlen
cmp eax, 0xc4
ja 0x69644418
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._strcpy
mov eax, dword [ebp - 0x64]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendA]
call eax
sub esp, 8
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sym._p9aL1QdQlUyq1vYE9yCDe0DMeIToW
mov dword [ebp - 0xd0], eax
lea eax, [ebp - 0x22c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call eax
sub esp, 8
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xffffffff
jne 0x69643f30
mov eax, dword [ebp - 0xd0]
mov dword [esp], eax
call sym._free
jmp 0x69644419
mov eax, dword [ebp - 0x2c]
sub eax, 1
cmp dword [ebp - 0x1c], eax
jae 0x69644274
mov eax, dword [ebp - 0x22c]
and eax, 0x10
test eax, eax
je 0x6964424d
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x22c]
add eax, 0x2c
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x6964424d
mov eax, dword [ebp - 0xb4]
mov dword [esp + 4], eax
lea eax, [ebp - 0x22c]
add eax, 0x2c
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x6964424d
mov dword [esp + 4], 0x1e
mov dword [esp], 0xa
call sym._WeEn4c
mov dword [esp], eax
call sym._crdh9yB
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._strlen
mov ebx, eax
lea eax, [ebp - 0x22c]
add eax, 0x2c
mov dword [esp], eax
call sym._strlen
add ebx, eax
mov eax, dword [ebp - 0xd4]
mov dword [esp], eax
call sym._strlen
add eax, ebx
add eax, 3
cmp eax, 0x103
jbe 0x69644002
mov eax, dword [ebp - 0xd4]
mov dword [esp], eax
call sym._free
jmp 0x6964424d
lea eax, [ebp - 0x22c]
add eax, 0x2c
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [esp], eax
call sym._affZoZyj5QQfO
mov dword [ebp - 0xd8], eax
lea eax, [ebp - 0x22c]
add eax, 0x2c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd8]
mov dword [esp], eax
call sym._strcpy
mov dword [ebp - 0x28], 0
jmp 0x69644078
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x28]
add eax, edx
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll_tolower]
call eax
mov ecx, eax
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x28]
add eax, edx
mov edx, ecx
mov byte [eax], dl
add dword [ebp - 0x28], 1
mov eax, dword [ebp - 0xd8]
mov dword [esp], eax
call sym._strlen
cmp dword [ebp - 0x28], eax
jb 0x69644048
mov eax, dword [ebp - 0xac]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd8]
mov dword [esp], eax
call sym._strstr
test eax, eax
jne 0x6964418e
mov eax, dword [ebp - 0x7c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd8]
mov dword [esp], eax
call sym._strstr
test eax, eax
jne 0x6964418e
mov eax, dword [ebp - 0xa4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd8]
mov dword [esp], eax
call sym._strstr
test eax, eax
jne 0x6964418e
mov eax, dword [ebp - 0x74]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd8]
mov dword [esp], eax
call sym._strstr
test eax, eax
jne 0x6964418e
mov eax, dword [ebp - 0x5c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd8]
mov dword [esp], eax
call sym._strstr
test eax, eax
jne 0x6964418e
mov eax, dword [ebp - 0xbc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd8]
mov dword [esp], eax
call sym._strstr
test eax, eax
jne 0x6964418e
mov eax, dword [ebp - 0x8c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd8]
mov dword [esp], eax
call sym._strstr
test eax, eax
jne 0x6964418e
mov eax, dword [ebp - 0x9c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd8]
mov dword [esp], eax
call sym._strstr
test eax, eax
jne 0x6964418e
mov eax, dword [ebp - 0x84]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd8]
mov dword [esp], eax
call sym._strstr
test eax, eax
je 0x696441af
mov eax, dword [ebp - 0xd8]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xd4]
mov dword [esp], eax
call sym._free
jmp 0x6964424d
mov dword [esp], 0x104
call sym._affZoZyj5QQfO
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xd8]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xdc]
mov dword [esp], eax
call sym._strcpy
lea eax, [ebp - 0x22c]
add eax, 0x2c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xdc]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendA]
call eax
sub esp, 8
mov eax, dword [ebp - 0xd4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xdc]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendA]
call eax
sub esp, 8
mov eax, dword [ebp - 0x1c]
lea edx, [eax*4]
mov eax, dword [ebp - 0xd0]
add edx, eax
mov eax, dword [ebp - 0xdc]
mov dword [edx], eax
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0xd4]
mov dword [esp], eax
call sym._free
lea eax, [ebp - 0x22c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindNextFileA]
call eax
sub esp, 8
test eax, eax
jne 0x69643f30
jmp 0x69644275
nop
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._WeEn4c
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xe0]
lea edx, [eax*4]
mov eax, dword [ebp - 0xd0]
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0xe4], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xe4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call eax
sub esp, 8
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe4]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [esp], eax
call sym._affZoZyj5QQfO
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xe4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xec]
mov dword [esp], eax
call sym._strcpy
mov eax, dword [ebp - 0xd0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._Ukt2IuZcZClmmqA
cmp dword [ebp - 0xe8], 0
je 0x69644405
mov eax, dword [ebp - 0xb4]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xa4]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xbc]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x84]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x74]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
mov dword [esp], 4
call sym._Ukt2IuZcZClmmqA
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call sym._free
mov dword [esp + 4], 0x3002
mov eax, dword [ebp - 0xec]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call eax
sub esp, 8
mov eax, dword [ebp - 0x94]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xec]
jmp 0x6964441e
mov eax, dword [ebp - 0xec]
mov dword [esp], eax
call sym._free
jmp 0x69643d9f
nop
jmp 0x69643d9f
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret