Function at 0x516a8c
Capabilities:
Contain obfuscated stackstrings
Create directory

Disassembly:
mov eax, 0x6a9024
call fcn.00640244
sub esp, 0x634
cmp byte [0x78bbec], 0
je 0x51780d
push ebx
push esi
push edi
push 0x5c
xor ebx, ebx
mov dword [ebp - 0x3f0], 0xca038230
pop eax
mov byte [0x78bbec], bl
mov dword [ebp - 0x3ec], 0xb2028230
mov dword [ebp - 0x3e8], 0x10203a0
mov dword [ebp - 0x3e4], 0x90202
mov dword [ebp - 0x3e0], 0x9a6abb8
mov byte [ebp - 0x3dc], al
mov dword [ebp - 0x3db], 0x304afe29
mov dword [ebp - 0x3d7], 0x2a09060d
mov dword [ebp - 0x3d3], 0xf7864886
mov dword [ebp - 0x3cf], 0x501010d
mov dword [ebp - 0x3cb], 0x4c300005
mov dword [ebp - 0x3c7], 0x9300b31
mov dword [ebp - 0x3c3], 0x4550306
mov dword [ebp - 0x3bf], 0x55021306
mov dword [ebp - 0x3bb], 0x300b3153
mov dword [ebp - 0x3b7], 0x55030609
mov dword [ebp - 0x3b3], 0x2130804
mov dword [ebp - 0x3af], 0x17314143
mov dword [ebp - 0x3ab], 0x3061530
mov dword [ebp - 0x3a7], 0x130a0455
mov dword [ebp - 0x3a3], 0x7469420e
mov dword [ebp - 0x39f], 0x72726f54
mov dword [ebp - 0x39b], 0x20746e65
mov dword [ebp - 0x397], 0x31636e49
mov dword [ebp - 0x393], 0x6153017
mov dword [ebp - 0x38f], 0x3045503
mov dword [ebp - 0x38b], 0x6f630e13
mov dword [ebp - 0x387], 0x69622e6d
mov dword [ebp - 0x383], 0x726f7474
mov dword [ebp - 0x37f], 0x746e6572
mov dword [ebp - 0x37b], 0xd171e30
mov dword [ebp - 0x377], 0x37303231
mov dword [ebp - 0x373], 0x32323332
mov dword [ebp - 0x36f], 0x37353331
mov dword [ebp - 0x36b], 0x310d175a
mov dword [ebp - 0x367], 0x32373034
mov dword [ebp - 0x363], 0x31323233
mov dword [ebp - 0x35f], 0x5a373533
mov dword [ebp - 0x35b], 0xb314c30
mov dword [ebp - 0x357], 0x3060930
mov dword [ebp - 0x353], 0x13060455
mov dword [ebp - 0x34f], 0x31535502
mov dword [ebp - 0x34b], 0x609300b
mov dword [ebp - 0x347], 0x8045503
mov dword [ebp - 0x343], 0x41430213
mov dword [ebp - 0x33f], 0x15301731
mov dword [ebp - 0x33b], 0x4550306
mov dword [ebp - 0x337], 0x420e130a
mov dword [ebp - 0x333], 0x6f547469
mov dword [ebp - 0x32f], 0x6e657272
mov dword [ebp - 0x32b], 0x6e492074
mov dword [ebp - 0x327], 0x30173163
mov dword [ebp - 0x323], 0x55030615
mov dword [ebp - 0x31f], 0xe130304
mov dword [ebp - 0x31b], 0x2e6d6f63
mov dword [ebp - 0x317], 0x74746962
mov dword [ebp - 0x313], 0x6572726f
mov dword [ebp - 0x30f], 0x8230746e
mov dword [ebp - 0x30b], 0xd302201
mov dword [ebp - 0x307], 0x862a0906
mov dword [ebp - 0x303], 0xdf78648
mov dword [ebp - 0x2ff], 0x5010101
mov dword [ebp - 0x2fb], 0x1820300
mov dword [ebp - 0x2f7], 0x8230000f
mov dword [ebp - 0x2f3], 0x82020a01
mov dword [ebp - 0x2ef], 0xda000101
mov dword [ebp - 0x2eb], 0x5710aeca
mov dword [ebp - 0x2e7], 0x8e5f34fe
mov dword [ebp - 0x2e3], 0xb9322fd6
mov dword [ebp - 0x2df], 0x6586324
mov dword [ebp - 0x2db], 0x569743cc
mov dword [ebp - 0x2d7], 0xdea31b9a
mov dword [ebp - 0x2d3], 0x2b1bc9db
mov dword [ebp - 0x2cf], 0xada6c948
push 0x18
pop ecx
mov dword [ebp - 0x2cb], 0x2ae18873
mov dword [ebp - 0x2c7], 0xb0f1fa0e
mov dword [ebp - 0x2c3], 0x86c758
mov dword [ebp - 0x2bf], 0x94cf52e2
mov dword [ebp - 0x2bb], 0x3b8f168b
mov dword [ebp - 0x2b7], 0xabcb0bcb
mov dword [ebp - 0x2b3], 0xce0cdb33
mov dword [ebp - 0x2af], 0xc45a05ed
mov dword [ebp - 0x2ab], 0x6dc4dc49
mov dword [ebp - 0x2a7], 0x39738f60
mov dword [ebp - 0x2a3], 0xda9294de
mov dword [ebp - 0x29f], 0x23eaf9bc
mov dword [ebp - 0x29b], 0x7cba3d09
mov dword [ebp - 0x297], 0x7bbfa993
mov dword [ebp - 0x293], 0xfafb4033
mov dword [ebp - 0x28f], 0x294203b3
mov dword [ebp - 0x28b], 0x2f05799d
mov dword [ebp - 0x287], 0x334253a
mov dword [ebp - 0x283], 0x2831b43e
mov dword [ebp - 0x27f], 0xa12bb130
mov dword [ebp - 0x27b], 0x484d047f
mov dword [ebp - 0x277], 0xbd692945
mov dword [ebp - 0x273], 0xc1287db4
mov dword [ebp - 0x26f], 0x4ee33947
mov dword [ebp - 0x26b], 0x2b53c794
mov dword [ebp - 0x267], 0x45ed4d30
mov dword [ebp - 0x263], 0x85e96b6c
mov dword [ebp - 0x25f], 0x32cdde39
mov dword [ebp - 0x25b], 0xe6409746
mov dword [ebp - 0x257], 0x7cdd227f
mov dword [ebp - 0x253], 0x6c997f8
mov dword [ebp - 0x24f], 0x882a6d1a
mov dword [ebp - 0x24b], 0x74412746
mov dword [ebp - 0x247], 0x5963fe25
mov dword [ebp - 0x243], 0xb034ec4f
mov dword [ebp - 0x23f], 0x73b03b47
mov dword [ebp - 0x23b], 0x44b44446
mov dword [ebp - 0x237], 0x648116b3
mov dword [ebp - 0x233], 0xc7f19a25
mov dword [ebp - 0x22f], 0x867ff71c
mov dword [ebp - 0x22b], 0x13885ee2
mov dword [ebp - 0x227], 0xc5e55dad
mov word [ebp - 0x223], 0x7633
mov byte [ebp - 0x221], 0x77
mov byte [ebp - 0x220], cl
mov dword [ebp - 0x21f], 0xce216284
mov dword [ebp - 0x21b], 0x5af8b6fc
mov dword [ebp - 0x217], 0x17575a3d
mov dword [ebp - 0x213], 0x3e919dc1
mov dword [ebp - 0x20f], 0xc9e175a2
mov dword [ebp - 0x20b], 0xc50423bd
mov dword [ebp - 0x207], 0x47882ed8
mov dword [ebp - 0x203], 0x2e74d701
mov dword [ebp - 0x1ff], 0x72dffebc
mov dword [ebp - 0x1fb], 0xf3f61255
mov dword [ebp - 0x1f7], 0x567fe4de
mov dword [ebp - 0x1f3], 0x110f26b3
mov dword [ebp - 0x1ef], 0x27d7b2e
mov dword [ebp - 0x1eb], 0x1000103
mov dword [ebp - 0x1e7], 0x30ae81a3
mov dword [ebp - 0x1e3], 0x1d30ab81
mov dword [ebp - 0x1df], 0x1d550306
mov dword [ebp - 0x1db], 0x416040e
mov dword [ebp - 0x1d7], 0xf2010914
mov dword [ebp - 0x1d3], 0x89de7d05
mov dword [ebp - 0x1cf], 0xa9653c70
mov word [ebp - 0x1cb], 0xc2fd
mov byte [ebp - 0x1c9], 0xac
mov byte [ebp - 0x1c8], cl
mov dword [ebp - 0x1c7], 0x6425c6f4
mov dword [ebp - 0x1c3], 0x67c3025
mov dword [ebp - 0x1bf], 0x231d5503
mov dword [ebp - 0x1bb], 0x73307504
mov dword [ebp - 0x1b7], 0x1091480
mov dword [ebp - 0x1b3], 0xde7d05f2
mov dword [ebp - 0x1af], 0x653c7089
mov dword [ebp - 0x1ab], 0xacc2fda9
mov byte [ebp - 0x1a7], cl
mov dword [ebp - 0x1a6], 0x6425c6f4
mov dword [ebp - 0x1a2], 0xa450a125
mov dword [ebp - 0x19e], 0x314c304e
mov dword [ebp - 0x19a], 0x609300b
mov dword [ebp - 0x196], 0x6045503
mov dword [ebp - 0x192], 0x53550213
mov dword [ebp - 0x18e], 0x9300b31
mov dword [ebp - 0x18a], 0x4550306
mov dword [ebp - 0x186], 0x43021308
mov dword [ebp - 0x182], 0x30173141
mov dword [ebp - 0x17e], 0x55030615
mov dword [ebp - 0x17a], 0xe130a04
mov dword [ebp - 0x176], 0x54746942
mov dword [ebp - 0x172], 0x6572726f
mov dword [ebp - 0x16e], 0x4920746e
mov dword [ebp - 0x16a], 0x1731636e
mov dword [ebp - 0x166], 0x3061530
mov dword [ebp - 0x162], 0x13030455
mov dword [ebp - 0x15e], 0x6d6f630e
mov dword [ebp - 0x15a], 0x7469622e
mov dword [ebp - 0x156], 0x72726f74
mov dword [ebp - 0x152], 0x82746e65
mov dword [ebp - 0x14e], 0xabb80009
mov word [ebp - 0x14a], 0x9a6
mov byte [ebp - 0x148], al
mov dword [ebp - 0x147], 0x304afe29
mov dword [ebp - 0x143], 0x5503060c
mov dword [ebp - 0x13f], 0x504131d
mov dword [ebp - 0x13b], 0x1010330
mov dword [ebp - 0x137], 0x60d30ff
mov dword [ebp - 0x133], 0x48862a09
mov dword [ebp - 0x12f], 0x10df786
mov dword [ebp - 0x12b], 0x50501
mov dword [ebp - 0x127], 0x1018203
mov dword [ebp - 0x123], 0xd28c6700
mov dword [ebp - 0x11f], 0x45cec288
mov dword [ebp - 0x11b], 0xaeb80d2b
mov dword [ebp - 0x117], 0xdd5e084e
mov dword [ebp - 0x113], 0xc96b2daf
mov dword [ebp - 0x10f], 0xd0792cc5
mov dword [ebp - 0x10b], 0x39b21c17
mov dword [ebp - 0x107], 0xa02cb923
mov dword [ebp - 0x103], 0x9c344ee3
mov dword [ebp - 0xff], 0x229a39b2
mov dword [ebp - 0xfb], 0xb66a8e24
mov dword [ebp - 0xf7], 0xf03f6789
mov dword [ebp - 0xf3], 0x364a3896
mov dword [ebp - 0xef], 0xd7f527b0
mov dword [ebp - 0xeb], 0x173d3e0d
mov dword [ebp - 0xe7], 0xb36af565
mov dword [ebp - 0xe3], 0x84445f65
mov dword [ebp - 0xdf], 0xf2b61283
mov dword [ebp - 0xdb], 0x9048217f
mov dword [ebp - 0xd7], 0xa4f9dca7
mov dword [ebp - 0xd3], 0x7564048f
mov dword [ebp - 0xcf], 0x203cbfe9
mov dword [ebp - 0xcb], 0x5a135d04
mov dword [ebp - 0xc7], 0x6936767b
mov dword [ebp - 0xc3], 0x8d98052b
mov dword [ebp - 0xbf], 0xc04cbf57
mov dword [ebp - 0xbb], 0xb847f832
mov dword [ebp - 0xb7], 0xba2178b5
mov dword [ebp - 0xb3], 0x87337e4f
mov dword [ebp - 0xaf], 0x6ad60e46
mov dword [ebp - 0xab], 0x749ba461
mov dword [ebp - 0xa7], 0x49bcabfc
mov word [ebp - 0xa3], 0x6b04
mov byte [ebp - 0xa1], 0xec
mov byte [ebp - 0xa0], al
mov dword [ebp - 0x9f], 0xc9f18104
mov dword [ebp - 0x9b], 0xebd510f6
mov dword [ebp - 0x97], 0x65a715dd
mov dword [ebp - 0x93], 0xa3366b2
mov dword [ebp - 0x8f], 0x1ee70d27
mov dword [ebp - 0x8b], 0xfc9e8533
mov dword [ebp - 0x87], 0x3a299667
mov dword [ebp - 0x83], 0x7186d087
mov dword [ebp - 0x7f], 0x49049242
mov dword [ebp - 0x7b], 0xd181e28a
mov dword [ebp - 0x77], 0xd2599b69
mov dword [ebp - 0x73], 0x33411d90
mov dword [ebp - 0x6f], 0x9a9c6640
mov byte [ebp - 0x2c], al
lea eax, [ebp - 0x434]
push str.trusted
push eax
mov dword [ebp - 0x6b], 0x9de8e8e0
mov dword [ebp - 0x67], 0x2103c52d
mov dword [ebp - 0x63], 0x586553f2
mov dword [ebp - 0x5f], 0x77903b5a
mov dword [ebp - 0x5b], 0x3c308d02
mov dword [ebp - 0x57], 0x786d5a9f
mov dword [ebp - 0x53], 0xd50db2d8
mov dword [ebp - 0x4f], 0xc7d96680
mov dword [ebp - 0x4b], 0x8e4f8ec2
mov dword [ebp - 0x47], 0x5a0ec743
mov dword [ebp - 0x43], 0x84e88aa4
mov dword [ebp - 0x3f], 0x4aff30c8
mov dword [ebp - 0x3b], 0xc02be7a0
mov dword [ebp - 0x37], 0x14ec873d
mov dword [ebp - 0x33], 0xb7c8d204
mov word [ebp - 0x2f], 0x164
mov byte [ebp - 0x2d], 0x48
mov dword [ebp - 0x2b], 0x313dd510
mov dword [ebp - 0x27], 0x1398a75e
mov byte [ebp - 0x23], 0xe3
call fcn.0047354f
cmp dword [ebp - 0x420], 8
mov esi, dword [ebp - 0x434]
mov dword [ebp - 4], ebx
jae 0x51745b
lea esi, [ebp - 0x434]
push 0x105
push esi
lea eax, [ebp - 0x640]
push eax
call fcn.00429389
mov ebx, esi
xor edi, edi
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, di
jne 0x517474
sub ebx, ecx
push 0x5c
sar ebx, 1
pop eax
push esi
mov word [ebp + ebx*2 - 0x640], ax
call fcn.00461022
test al, al
jne 0x51752c
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov eax, 0x104
sub eax, ebx
push eax
lea eax, [ebp - 0x63e]
push str.bittorrent.crt
lea eax, [eax + ebx*2]
push eax
call fcn.00429389
push 0x80
push 7
lea eax, [ebp - 0x640]
push eax
call fcn.00461598
mov dword [ebp - 0x18], eax
mov ebx, 0x3ce
cmp eax, 0xffffffff
je 0x5174f7
push ebx
lea ecx, [ebp - 0x3f0]
push ecx
push eax
call fcn.00461a64
lea eax, [ebp - 0x18]
push eax
call fcn.00461528
push ebx
lea eax, [ebp - 0x3f0]
push eax
lea ecx, [ebp - 0x20]
call fcn.0051677f
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00517f06
test al, al
je 0x51751f
lea ecx, [ebp - 0x20]
call fcn.00517fb6
lea ecx, [ebp - 0x20]
call fcn.00516858
jmp 0x5177fc
mov dword [ebp - 0x3fc], edi
mov dword [ebp - 0x3f8], edi
mov dword [ebp - 0x3f4], edi
push edi
push esi
lea eax, [ebp - 0x3fc]
mov byte [ebp - 4], 2
push eax
call fcn.00461131
mov eax, dword [ebp - 0x3f8]
sub eax, dword [ebp - 0x3fc]
push 0x18
cdq
pop ecx
idiv ecx
test eax, eax
je 0x5177f1
push 0x8000
call fcn.004600d6
mov edi, dword [ebp - 0x3f8]
mov esi, dword [ebp - 0x3fc]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edi
cmp esi, edi
je 0x5177e7
mov ecx, 0x104
lea edx, [ebp - 0x63e]
sub ecx, ebx
lea edx, [edx + ebx*2]
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x414], edx
cmp dword [esi + 0x14], 8
jb 0x5175b4
mov eax, dword [esi]
jmp 0x5175b6
mov eax, esi
push ecx
push eax
push edx
call fcn.00429389
push 0x80
push 4
lea eax, [ebp - 0x640]
push eax
call fcn.00461598
mov dword [ebp - 0x400], eax
cmp eax, 0xffffffff
je 0x5177cb
lea ecx, [ebp - 0x404]
push ecx
push 0
push 0
push 0x8000
push dword [ebp - 0x14]
push eax
call fcn.004617d4
mov ebx, eax
lea eax, [ebp - 0x400]
push eax
call fcn.00461528
test ebx, ebx
jne 0x5177cb
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x5177cb
mov ebx, dword [ebp - 0x14]
cmp eax, 0x1b
jb 0x5176bb
push 0x1b
push str._____BEGIN_CERTIFICATE_____
push ebx
call fcn.006593f7
add esp, 0xc
test eax, eax
jne 0x5176b8
mov ecx, dword [ebp - 0x10]
xor edx, edx
push 0x1b
pop eax
mov dword [ebp - 0x408], eax
cmp ecx, eax
jbe 0x517699
mov edi, eax
mov al, byte [edi + ebx]
cmp al, 0x2f
jb 0x51765f
cmp al, 0x39
jbe 0x51768d
cmp al, 0x41
jb 0x517667
cmp al, 0x5a
jbe 0x51768d
cmp al, 0x61
jb 0x51766f
cmp al, 0x7a
jbe 0x51768d
cmp al, 0x2b
je 0x51768d
cmp al, 0x3d
je 0x51768d
cmp al, 0xa
je 0x517691
cmp al, 0xd
je 0x517691
cmp al, 9
je 0x517691
cmp al, 0xb
je 0x517691
cmp al, 0x20
jne 0x517696
jmp 0x517691
mov byte [edx + ebx], al
inc edx
inc edi
cmp edi, ecx
jb 0x517654
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edx
push eax
push ebx
push edx
push ebx
call fcn.00575ebd
test eax, eax
jne 0x5177cb
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
jmp 0x5176bb
mov eax, dword [ebp - 0x10]
test ebx, ebx
je 0x5177cb
push eax
push ebx
lea ecx, [ebp - 0x20]
call fcn.0051677f
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.00517f06
test al, al
je 0x5177bf
mov edx, dword [ebp - 0x20]
xor ecx, ecx
movzx eax, byte [edx + ecx + 0xc3]
mov edi, str.com.bittorrent
cmp al, byte [edi + ecx]
mov edi, dword [ebp - 0x18]
jne 0x5177a2
inc ecx
cmp ecx, 0xf
jne 0x5176e6
mov eax, 0x3ce
cmp dword [ebp - 0x10], eax
jne 0x517724
push eax
lea eax, [ebp - 0x3f0]
push ebx
push eax
call fcn.006593f7
add esp, 0xc
test eax, eax
je 0x5177a2
push 0x80
push 7
lea eax, [ebp - 0x640]
push eax
call fcn.00461598
mov dword [ebp - 0x40c], eax
cmp eax, 0xffffffff
je 0x517760
push 0x3ce
lea ecx, [ebp - 0x3f0]
push ecx
push eax
call fcn.00461a64
lea eax, [ebp - 0x40c]
push eax
call fcn.00461528
push 0x3ce
lea eax, [ebp - 0x3f0]
push eax
lea ecx, [ebp - 0x41c]
call fcn.0051677f
lea ecx, [ebp - 0x41c]
mov byte [ebp - 4], 4
call fcn.00517f06
test al, al
je 0x517795
lea ecx, [ebp - 0x41c]
call fcn.00517fb6
lea ecx, [ebp - 0x41c]
call fcn.00516858
jmp 0x5177bf
lea ecx, [ebp - 0x20]
call fcn.00517fb6
mov eax, dword [ebp - 0x20]
add eax, 0xc3
push eax
push str._s_trusted_n
call fcn.0040dfc1
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.00516858
mov ecx, dword [ebp - 0x410]
mov edx, dword [ebp - 0x414]
push 0x18
pop eax
add esi, eax
cmp esi, edi
jne 0x5175aa
mov eax, dword [ebp - 0x14]
push 1
push eax
call fcn.004600c9
xor edi, edi
lea ecx, [ebp - 0x3fc]
call fcn.00438b7a
push edi
push 1
lea ecx, [ebp - 0x434]
call fcn.004281f2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret