Function at 0x10015250
Capabilities:
Check if file exists
Get file attributes
Manipulate boot configuration
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035ff0
mov eax, dword fs:[0]
push eax
sub esp, 0x958
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x92c], ecx
mov byte [ebp - 0x11c], 0
push 0xff
push 0
lea eax, [ebp - 0x11b]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
cmp dword [ebp + 0xc], 5
jg 0x1001561d
mov dword [ebp - 0x320], 0
mov dword [ebp - 0x328], 0
push 0x10039468
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.MSVCR80.dll_fopen]
add esp, 8
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
jne 0x100152e4
xor eax, eax
jmp 0x10016325
push 0x100000
call fcn.1000f6bd
add esp, 4
mov dword [ebp - 0x8bc], eax
mov edx, dword [ebp - 0x8bc]
mov dword [ebp - 0x320], edx
push 0x100000
push 0
mov eax, dword [ebp - 0x320]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x11c]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x324]
push edx
push 0x200
lea eax, [ebp - 0x52c]
push eax
call dword [sym.imp.MSVCR80.dll_fgets]
add esp, 0xc
test eax, eax
je 0x10015447
push 0x1003946c
call sub.ntdll.dll_strlen
add esp, 4
neg eax
sbb eax, eax
add eax, 1
push eax
lea ecx, [ebp - 0x52c]
push ecx
push 0x10039480
call dword [sym.imp.ntdll.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x1001538b
mov dword [ebp - 0x328], 1
cmp dword [ebp - 0x328], 0
je 0x1001542c
movsx edx, byte [ebp - 0x52c]
cmp edx, 0x5b
jne 0x1001542c
lea eax, [ebp - 0x52c]
push eax
call sub.ntdll.dll_strlen
add esp, 4
movsx ecx, byte [ebp + eax - 0x52d]
cmp ecx, 0x5d
jne 0x1001542c
mov edx, dword [ebp - 0x320]
push edx
call sub.ntdll.dll_strlen
add esp, 4
mov ecx, dword [ebp - 0x320]
movsx edx, byte [ecx + eax - 1]
cmp edx, 0xa
je 0x100153f7
push 0x10039494
mov eax, dword [ebp - 0x320]
push eax
call sub.ntdll.dll_strcat
add esp, 8
push 0x10039498
movsx ecx, byte [ebp + 0x10]
push ecx
push 0x100394a0
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 0x320]
push ecx
call sub.ntdll.dll_strcat
add esp, 8
lea edx, [ebp - 0x52c]
push edx
mov eax, dword [ebp - 0x320]
push eax
call sub.ntdll.dll_strcat
add esp, 8
jmp 0x1001532f
cmp dword [ebp - 0x328], 0
jne 0x100154e5
mov ecx, dword [ebp - 0x320]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
mov edx, dword [ebp - 0x320]
movsx eax, byte [edx + eax - 1]
cmp eax, 0xa
je 0x10015487
push 0x100394bc
mov ecx, dword [ebp - 0x320]
push ecx
call sub.ntdll.dll_strcat
add esp, 8
mov edx, dword [ebp + 0x18]
and edx, 1
jne 0x100154b0
push 0x100394c0
movsx eax, byte [ebp + 0x10]
push eax
push 0x100394c8
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x10
jmp 0x100154cf
push 0x100394e4
movsx edx, byte [ebp + 0x10]
push edx
push str._c:_s_AOMEI_Backupper__n
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 0x320]
push edx
call sub.ntdll.dll_strcat
add esp, 8
mov eax, dword [ebp - 0x324]
push eax
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
push 0x100
push 0
lea ecx, [ebp - 0x11c]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x11c]
push eax
call sub.ntdll.dll_strcpy
add esp, 8
push 0x80
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x1001553b
xor eax, eax
jmp 0x10016325
push 0x10039508
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.MSVCR80.dll_fopen]
add esp, 8
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
jne 0x1001557e
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x8c0], eax
mov ecx, dword [ebp - 0x8c0]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
xor eax, eax
jmp 0x10016325
mov edx, dword [ebp - 0x320]
push edx
call sub.ntdll.dll_strlen
add esp, 4
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x324]
push eax
mov ecx, dword [ebp - 0x530]
push ecx
push 1
mov edx, dword [ebp - 0x320]
push edx
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
cmp eax, dword [ebp - 0x530]
je 0x100155ed
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x8c4], eax
mov ecx, dword [ebp - 0x8c4]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov edx, dword [ebp - 0x324]
push edx
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
xor eax, eax
jmp 0x10016325
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x8c8], eax
mov ecx, dword [ebp - 0x8c8]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov edx, dword [ebp - 0x324]
push edx
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
jmp 0x100161e3
mov dword [ebp - 0x64c], 0
push 0x80000
call fcn.1000f6bd
add esp, 4
mov dword [ebp - 0x8cc], eax
mov eax, dword [ebp - 0x8cc]
mov dword [ebp - 0x860], eax
push 0x80000
push 0
mov ecx, dword [ebp - 0x860]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x8ac], 0xffffffff
mov dword [ebp - 0x85c], 0xffffffff
mov dword [ebp - 0x8a8], 0xffffffff
mov dword [ebp - 0x858], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002fcd0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x8ac]
push edx
lea eax, [ebp - 0x858]
push eax
lea ecx, [ebp - 0x648]
call fcn.1002fbe0
test eax, eax
jne 0x10015757
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x930], eax
push 0xe4
push 0x1003950c
call fcn.10010f00
add esp, 8
push eax
push str._s:_Crate_read_PIPE_Failed.
mov ecx, dword [ebp - 0x930]
push ecx
mov edx, dword [ebp - 0x930]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
mov edx, dword [ebp - 0x8ac]
push edx
mov eax, dword [ebp - 0x858]
push eax
mov ecx, dword [ebp - 0x8a8]
push ecx
mov edx, dword [ebp - 0x85c]
push edx
call fcn.10010ed0
add esp, 0x10
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0x8d0], eax
mov ecx, dword [ebp - 0x8d0]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x8d4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002fc70
mov eax, dword [ebp - 0x8d4]
jmp 0x10016325
lea edx, [ebp - 0x8a8]
push edx
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x648]
call fcn.1002fb50
test eax, eax
jne 0x10015818
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x934], eax
push 0xec
push 0x10039538
call fcn.10010f00
add esp, 8
push eax
push 0x10039548
mov ecx, dword [ebp - 0x934]
push ecx
mov edx, dword [ebp - 0x934]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
mov edx, dword [ebp - 0x8ac]
push edx
mov eax, dword [ebp - 0x858]
push eax
mov ecx, dword [ebp - 0x8a8]
push ecx
mov edx, dword [ebp - 0x85c]
push edx
call fcn.10010ed0
add esp, 0x10
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0x8d8], eax
mov ecx, dword [ebp - 0x8d8]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x8dc], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002fc70
mov eax, dword [ebp - 0x8dc]
jmp 0x10016325
mov edx, dword [ebp - 0x8a8]
push edx
mov eax, dword [ebp - 0x8ac]
push eax
lea ecx, [ebp - 0x648]
call fcn.1002f8a0
test eax, eax
jne 0x100158d9
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x938], eax
push 0xf4
push 0x10039568
call fcn.10010f00
add esp, 8
push eax
push 0x10039578
mov ecx, dword [ebp - 0x938]
push ecx
mov edx, dword [ebp - 0x938]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
mov edx, dword [ebp - 0x8ac]
push edx
mov eax, dword [ebp - 0x858]
push eax
mov ecx, dword [ebp - 0x8a8]
push ecx
mov edx, dword [ebp - 0x85c]
push edx
call fcn.10010ed0
add esp, 0x10
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0x8e0], eax
mov ecx, dword [ebp - 0x8e0]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x8e4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002fc70
mov eax, dword [ebp - 0x8e4]
jmp 0x10016325
mov byte [ebp - 0x63c], 0
push 0x103
push 0
lea edx, [ebp - 0x63b]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x63c]
push eax
call fcn.10011180
add esp, 4
test eax, eax
jne 0x10015954
cmp dword [ebp - 0x860], 0
je 0x1001592d
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0x8e8], ecx
mov edx, dword [ebp - 0x8e8]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x8ec], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002fc70
mov eax, dword [ebp - 0x8ec]
jmp 0x10016325
mov byte [ebp - 0x854], 0
push 0x1ff
push 0
lea eax, [ebp - 0x853]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x63c]
push ecx
push str._s_bcdedit.exe__create__d__AOMEI_Backupper___application_BOOTSECTOR_n
lea edx, [ebp - 0x854]
push edx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x854]
push eax
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x854]
push ecx
mov edx, dword [ebp - 0x85c]
push edx
lea ecx, [ebp - 0x648]
call fcn.1002fb00
test eax, eax
jne 0x10015a9f
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x93c], eax
lea eax, [ebp - 0x854]
push eax
push 0x109
push 0x100395e0
call fcn.10010f00
add esp, 8
push eax
push 0x100395f0
mov ecx, dword [ebp - 0x93c]
push ecx
mov edx, dword [ebp - 0x93c]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0x10
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x940], eax
push 0x10a
push 0x10039600
call fcn.10010f00
add esp, 8
push eax
push 0x10039610
mov edx, dword [ebp - 0x940]
push edx
mov eax, dword [ebp - 0x940]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0xc
mov eax, dword [ebp - 0x8ac]
push eax
mov ecx, dword [ebp - 0x858]
push ecx
mov edx, dword [ebp - 0x8a8]
push edx
mov eax, dword [ebp - 0x85c]
push eax
call fcn.10010ed0
add esp, 0x10
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0x8f0], ecx
mov edx, dword [ebp - 0x8f0]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x8f4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002fc70
mov eax, dword [ebp - 0x8f4]
jmp 0x10016325
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x64c]
push eax
mov ecx, dword [ebp - 0x860]
push ecx
mov edx, dword [ebp - 0x858]
push edx
lea ecx, [ebp - 0x648]
call fcn.1002f9c0
test eax, eax
jne 0x10015b72
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x944], eax
push 0x113
push 0x1003962c
call fcn.10010f00
add esp, 8
push eax
push 0x1003963c
mov eax, dword [ebp - 0x944]
push eax
mov ecx, dword [ebp - 0x944]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
add esp, 0xc
mov ecx, dword [ebp - 0x8ac]
push ecx
mov edx, dword [ebp - 0x858]
push edx
mov eax, dword [ebp - 0x8a8]
push eax
mov ecx, dword [ebp - 0x85c]
push ecx
call fcn.10010ed0
add esp, 0x10
mov edx, dword [ebp - 0x860]
mov dword [ebp - 0x8f8], edx
mov eax, dword [ebp - 0x8f8]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x8fc], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002fc70
mov eax, dword [ebp - 0x8fc]
jmp 0x10016325
mov dword [ebp - 0x650], 0
mov byte [ebp - 0x8a4], 0
push 0x3f
push 0
lea ecx, [ebp - 0x8a3]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x8b0], 0
jmp 0x10015bb1
mov edx, dword [ebp - 0x8b0]
add edx, 1
mov dword [ebp - 0x8b0], edx
mov eax, dword [ebp - 0x8b0]
cmp eax, dword [ebp - 0x64c]
jge 0x10015c6c
mov ecx, dword [ebp - 0x860]
add ecx, dword [ebp - 0x8b0]
movsx edx, byte [ecx]
cmp edx, 0x7b
jne 0x10015c5c
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x8b8], eax
mov dword [ebp - 0x8b4], 0
jmp 0x10015c11
mov ecx, dword [ebp - 0x8b8]
add ecx, 1
mov dword [ebp - 0x8b8], ecx
mov edx, dword [ebp - 0x8b4]
add edx, 1
mov dword [ebp - 0x8b4], edx
mov eax, dword [ebp - 0x8b8]
cmp eax, dword [ebp - 0x64c]
jge 0x10015c5c
mov ecx, dword [ebp - 0x860]
add ecx, dword [ebp - 0x8b8]
mov edx, dword [ebp - 0x8b4]
mov al, byte [ecx]
mov byte [ebp + edx - 0x8a4], al
mov ecx, dword [ebp - 0x860]
add ecx, dword [ebp - 0x8b8]
movsx edx, byte [ecx]
cmp edx, 0x7d
jne 0x10015c5a
mov dword [ebp - 0x650], 1
jmp 0x10015c5c
jmp 0x10015bf3
cmp dword [ebp - 0x650], 0
je 0x10015c67
jmp 0x10015c6c
jmp 0x10015ba2
cmp dword [ebp - 0x650], 0
jne 0x10015d20
mov eax, dword [ebp - 0x8ac]
push eax
mov ecx, dword [ebp - 0x858]
push ecx
mov edx, dword [ebp - 0x8a8]
push edx
mov eax, dword [ebp - 0x85c]
push eax
call fcn.10010ed0
add esp, 0x10
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0x900], ecx
mov edx, dword [ebp - 0x900]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x948], eax
lea eax, [ebp - 0x854]
push eax
push 0x132
push 0x10039658
call fcn.10010f00
add esp, 8
push eax
push str._s:__s_Failed.
mov ecx, dword [ebp - 0x948]
push ecx
mov edx, dword [ebp - 0x948]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0x10
mov dword [ebp - 0x904], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002fc70
mov eax, dword [ebp - 0x904]
jmp 0x10016325
push 0x200
push 0
lea edx, [ebp - 0x854]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
movsx eax, byte [ebp + 0x10]
push eax
lea ecx, [ebp - 0x8a4]
push ecx
lea edx, [ebp - 0x63c]
push edx
push str._s_bcdedit.exe__set__s_device_partition_c:_n
lea eax, [ebp - 0x854]
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x14
lea ecx, [ebp - 0x854]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea edx, [ebp - 0x854]
push edx
mov eax, dword [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x648]
call fcn.1002fb00
test eax, eax
jne 0x10015e70
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x94c], eax
lea ecx, [ebp - 0x854]
push ecx
push 0x13c
push 0x100396a8
call fcn.10010f00
add esp, 8
push eax
push 0x100396b8
mov edx, dword [ebp - 0x94c]
push edx
mov eax, dword [ebp - 0x94c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0x10
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x950], eax
push 0x13d
push 0x100396c8
call fcn.10010f00
add esp, 8
push eax
push 0x100396d8
mov eax, dword [ebp - 0x950]
push eax
mov ecx, dword [ebp - 0x950]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
add esp, 0xc
mov ecx, dword [ebp - 0x8ac]
push ecx
mov edx, dword [ebp - 0x858]
push edx
mov eax, dword [ebp - 0x8a8]
push eax
mov ecx, dword [ebp - 0x85c]
push ecx
call fcn.10010ed0
add esp, 0x10
mov edx, dword [ebp - 0x860]
mov dword [ebp - 0x908], edx
mov eax, dword [ebp - 0x908]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x90c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002fc70
mov eax, dword [ebp - 0x90c]
jmp 0x10016325
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x80000
push 0
mov ecx, dword [ebp - 0x860]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
lea edx, [ebp - 0x64c]
push edx
mov eax, dword [ebp - 0x860]
push eax
mov ecx, dword [ebp - 0x858]
push ecx
lea ecx, [ebp - 0x648]
call fcn.1002f9c0
test eax, eax
jne 0x10015f59
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x954], eax
push 0x147
push 0x100396f4
call fcn.10010f00
add esp, 8
push eax
push 0x10039704
mov edx, dword [ebp - 0x954]
push edx
mov eax, dword [ebp - 0x954]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0xc
mov eax, dword [ebp - 0x8ac]
push eax
mov ecx, dword [ebp - 0x858]
push ecx
mov edx, dword [ebp - 0x8a8]
push edx
mov eax, dword [ebp - 0x85c]
push eax
call fcn.10010ed0
add esp, 0x10
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0x910], ecx
mov edx, dword [ebp - 0x910]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x914], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002fc70
mov eax, dword [ebp - 0x914]
jmp 0x10016325
push 0x200
push 0
lea eax, [ebp - 0x854]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0x10039720
lea ecx, [ebp - 0x8a4]
push ecx
lea edx, [ebp - 0x63c]
push edx
push str._s_bcdedit.exe__set__s_path__s_n
lea eax, [ebp - 0x854]
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x14
lea ecx, [ebp - 0x854]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea edx, [ebp - 0x854]
push edx
mov eax, dword [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x648]
call fcn.1002fb00
test eax, eax
jne 0x100160a9
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x958], eax
lea ecx, [ebp - 0x854]
push ecx
push 0x154
push 0x10039750
call fcn.10010f00
add esp, 8
push eax
push 0x10039760
mov edx, dword [ebp - 0x958]
push edx
mov eax, dword [ebp - 0x958]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0x10
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x95c], eax
push 0x155
push 0x10039770
call fcn.10010f00
add esp, 8
push eax
push 0x10039780
mov eax, dword [ebp - 0x95c]
push eax
mov ecx, dword [ebp - 0x95c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
add esp, 0xc
mov ecx, dword [ebp - 0x8ac]
push ecx
mov edx, dword [ebp - 0x858]
push edx
mov eax, dword [ebp - 0x8a8]
push eax
mov ecx, dword [ebp - 0x85c]
push ecx
call fcn.10010ed0
add esp, 0x10
mov edx, dword [ebp - 0x860]
mov dword [ebp - 0x918], edx
mov eax, dword [ebp - 0x918]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x91c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002fc70
mov eax, dword [ebp - 0x91c]
jmp 0x10016325
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x80000
push 0
mov ecx, dword [ebp - 0x860]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
lea edx, [ebp - 0x64c]
push edx
mov eax, dword [ebp - 0x860]
push eax
mov ecx, dword [ebp - 0x858]
push ecx
lea ecx, [ebp - 0x648]
call fcn.1002f9c0
test eax, eax
jne 0x10016192
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x960], eax
push 0x15f
push 0x1003979c
call fcn.10010f00
add esp, 8
push eax
push 0x100397ac
mov edx, dword [ebp - 0x960]
push edx
mov eax, dword [ebp - 0x960]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0xc
mov eax, dword [ebp - 0x8ac]
push eax
mov ecx, dword [ebp - 0x858]
push ecx
mov edx, dword [ebp - 0x8a8]
push edx
mov eax, dword [ebp - 0x85c]
push eax
call fcn.10010ed0
add esp, 0x10
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0x920], ecx
mov edx, dword [ebp - 0x920]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 0x924], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002fc70
mov eax, dword [ebp - 0x924]
jmp 0x10016325
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0x928], eax
mov ecx, dword [ebp - 0x928]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov edx, dword [ebp - 0x8ac]
push edx
mov eax, dword [ebp - 0x858]
push eax
mov ecx, dword [ebp - 0x8a8]
push ecx
mov edx, dword [ebp - 0x85c]
push edx
call fcn.10010ed0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1002fc70
push 0x100
push 0
lea eax, [ebp - 0x11c]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
movsx ecx, byte [ebp + 0x10]
push ecx
push 0x100397c8
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10016237
push 0x80
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x100397d8
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.MSVCR80.dll_fopen]
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1001629d
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x964], eax
lea eax, [ebp - 0x11c]
push eax
push 0x18d
push 0x100397dc
call fcn.10010f00
add esp, 8
push eax
push 0x100397ec
mov ecx, dword [ebp - 0x964]
push ecx
mov edx, dword [ebp - 0x964]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0x10
xor eax, eax
jmp 0x10016325
mov byte [ebp - 0x31c], 0
push 0x1ff
push 0
lea edx, [ebp - 0x31b]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x10039800
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x14
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x31c]
push edx
call sub.ntdll.dll_strlen
add esp, 4
push eax
push 1
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
push 2
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret 0x14