Function at 0x10004208
Capabilities:
Check if file exists
Create thread
Get common file path
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bb6c
mov eax, dword fs:[0]
push eax
mov eax, 0x1748
call fcn.10039a80
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x171c], ebx
mov dword [ebp - 0x1750], ebx
xor edx, edx
lea edi, [ebx + 0x30]
mov dword [ebp - 4], edx
mov dword [edi + 0x14], 7
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], edx
jb 0x10004264
mov eax, dword [edi]
jmp 0x10004266
mov eax, edi
xor ecx, ecx
mov word [eax], cx
mov dword [ebx + 0x48], edx
mov dword [ebx + 0x4c], edx
mov dword [ebx + 0x50], edx
mov dword [ebx + 0x54], edx
mov dword [ebx + 0x58], edx
mov dword [ebx + 0x5c], edx
mov dword [ebx + 0x60], edx
mov dword [ebx + 0x64], edx
mov dword [ebx + 0x68], edx
lea ecx, [ebx + 0x407c]
mov byte [ebp - 4], 4
call fcn.10006427
lea ecx, [ebx + 0x4090]
mov byte [ebp - 4], 5
call fcn.10006427
lea eax, [ebx + 0x40a8]
xor edx, edx
mov dword [eax + 0x14], 7
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], edx
jb 0x100042be
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 4], 7
lea esi, [ebx + 0x40d0]
mov dword [ebp - 0x171c], esi
mov dword [esi], edx
mov dword [esi + 4], edx
call fcn.10007817
mov dword [esi], eax
lea eax, [ebx + 0x40e0]
xor ecx, ecx
push 7
pop esi
mov dword [eax + 0x14], esi
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], ecx
jb 0x100042fa
mov ecx, dword [eax]
jmp 0x100042fc
mov ecx, eax
add eax, 0x2c
xor edx, edx
mov word [ecx], dx
mov dword [eax + 0x14], esi
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], edx
jb 0x10004312
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [ebx + 0x4124], edx
mov dword [ebx + 0x4128], edx
mov dword [ebx + 0x412c], edx
mov dword [ebx + 0x4130], edx
mov dword [ebx + 0x4134], edx
mov dword [ebx + 0x4138], edx
mov dword [ebx + 0x413c], edx
mov dword [ebx + 0x4140], edx
mov dword [ebx + 0x4144], edx
lea eax, [ebx + 0x4180]
mov dword [eax + 0x14], esi
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], edx
jb 0x10004361
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 4], 0xd
lea esi, [ebx + 0x4198]
call fcn.10008541
push eax
mov ecx, esi
call fcn.1000835e
lea eax, [ebx + 0x419c]
xor edx, edx
mov dword [eax + 0x14], 7
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], edx
jb 0x10004397
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 4], 0xf
mov ecx, esi
push 0x10046230
mov dword [ebx + 0x4178], edx
mov dword [ebx + 0x417c], edx
call fcn.10008a3b
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
or dword [ebx + 0x4160], 0xffffffff
lea ecx, [ebx + 0x407c]
or dword [ebx + 0x4164], 0xffffffff
mov dword [ebx + 0x4170], eax
xor eax, eax
mov dword [0x10050a9c], eax
mov dword [ebx + 0x416c], eax
mov byte [ebx], al
mov byte [ebx + 0x14], 1
mov byte [0x10050a9b], al
mov dword [ebx + 0x28], 0x1000000
mov word [ebx + 0x24], 1
mov dword [ebx + 0x40d8], eax
mov dword [ebx + 0x40dc], eax
mov word [ebx + 0x415c], ax
mov byte [ebx + 0x415e], al
mov byte [ebx + 0x27], al
mov dword [0x10050ca0], eax
mov byte [ebx + 0x2c], al
mov dword [ebx + 0x40a4], eax
call fcn.100068e0
lea ecx, [ebx + 0x4090]
call fcn.100068e0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, 0x4000000
push ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
xor eax, eax
push eax
push eax
push 1
push eax
call esi
mov dword [ebx + 8], eax
xor eax, eax
push eax
push eax
push 1
push eax
call esi
mov dword [ebx + 0xc], eax
xor eax, eax
push eax
push eax
push eax
push eax
call esi
mov dword [ebx + 0x10], eax
xor eax, eax
push eax
push eax
push eax
push eax
call esi
mov dword [ebx + 4], eax
mov esi, str.GlobalPCAScannerMutex
push esi
xor eax, eax
push eax
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x10050ca4], eax
xor eax, eax
cmp dword [0x10050ca4], eax
je 0x100044a9
mov byte [0x10050a9a], al
jmp 0x1000451e
mov byte [ebp - 0x1748], al
lea edi, [ebp - 0x1747]
xor eax, eax
stosd dword es:[edi], eax
push 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1748]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor eax, eax
push eax
push eax
push 1
lea eax, [ebp - 0x1748]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
xor ecx, ecx
mov dword [ebp - 0x1734], 0xc
lea eax, [ebp - 0x1748]
mov dword [ebp - 0x172c], ecx
push esi
mov dword [ebp - 0x1730], eax
lea eax, [ebp - 0x1734]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10050ca4], eax
lea edi, [ebx + 0x30]
mov byte [0x10050a9a], 1
xor eax, eax
push 0x208
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.10022700
add esp, 0xc
lea eax, [ebp - 0x420]
xor esi, esi
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x420]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, si
jne 0x10004551
sub edx, ecx
push 0x5c
sar edx, 1
pop ecx
jmp 0x1000456f
xor eax, eax
mov word [ebp + edx*2 - 0x420], ax
dec edx
cmp word [ebp + edx*2 - 0x420], cx
jne 0x10004565
lea eax, [ebp - 0x420]
mov ecx, edi
push eax
call fcn.10006c7d
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10022700
add esp, 0xc
xor edx, edx
cmp byte [ebp + 0x20], dl
push edx
push 0x1c
pop eax
push 0x23
pop ecx
cmovne eax, ecx
push eax
lea eax, [ebp - 0x218]
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x171c]
call fcn.10008282
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push dword [eax]
lea eax, [ebp - 0x218]
push eax
call esi
lea ecx, [ebp - 0x171c]
call fcn.10008ac5
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x10004600
lea ecx, [ebp - 0x218]
call fcn.10003e83
lea eax, [ebp - 0x218]
push eax
push 0x100
push 0x10050aa0
call fcn.100277f7
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x10045dc0
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x1000463f
lea ecx, [ebp - 0x218]
call fcn.10003e83
xor eax, eax
mov dword [ebp - 0x143c], 7
push 0x10050aa0
lea ecx, [ebp - 0x1450]
mov dword [ebp - 0x1440], eax
mov word [ebp - 0x1450], ax
call fcn.10006c7d
push str.RPCA.conf
lea edx, [ebp - 0x1450]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x15f8]
call fcn.100078e2
pop ecx
cmp dword [eax + 0x14], 8
jb 0x1000468b
mov eax, dword [eax]
xor ecx, ecx
push ecx
push 0x80
push 2
push ecx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor edi, edi
lea ecx, [ebp - 0x15f8]
push edi
push 1
mov esi, eax
call fcn.10006b0c
push edi
push 1
lea ecx, [ebp - 0x1450]
mov byte [ebp - 4], 0xf
call fcn.10006b0c
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x100048ef
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
push 0x800
push eax
lea eax, [ebp - 0xc20]
push eax
call fcn.10022700
push str.PidFile__
lea eax, [ebp - 0xc20]
push 0x800
push eax
call fcn.10028153
add esp, 0x18
push str.RPCA.pid
sub esp, 0x18
mov ecx, esp
push 0x10050aa0
call fcn.1000668f
lea ecx, [ebp - 0x1628]
call fcn.1000162d
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1610]
call fcn.10007a70
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10004753
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc20]
push 0x800
push eax
call fcn.100281ad
add esp, 0xc
lea ecx, [ebp - 0x1610]
xor eax, eax
push eax
push 1
call fcn.10006e98
xor eax, eax
mov byte [ebp - 4], 0xf
push eax
push 1
lea ecx, [ebp - 0x1628]
call fcn.10006e98
push str.__r_nLogFile__
lea eax, [ebp - 0xc20]
push 0x800
push eax
call fcn.100281ad
add esp, 0xc
push str.RPCA.log
sub esp, 0x18
mov ecx, esp
push 0x10050aa0
call fcn.1000668f
lea ecx, [ebp - 0x1658]
call fcn.1000162d
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1640]
call fcn.10007a70
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100047e1
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc20]
push 0x800
push eax
call fcn.100281ad
add esp, 0xc
lea ecx, [ebp - 0x1640]
xor eax, eax
push eax
push 1
call fcn.10006e98
xor eax, eax
mov byte [ebp - 4], 0xf
push eax
push 1
lea ecx, [ebp - 0x1658]
call fcn.10006e98
push str.__r_nDatabaseDirectory__
lea eax, [ebp - 0xc20]
push 0x800
push eax
call fcn.100281ad
add esp, 0xc
push str.database
sub esp, 0x18
mov ecx, esp
push 0x10050aa0
call fcn.1000668f
lea ecx, [ebp - 0x1700]
call fcn.1000162d
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1670]
call fcn.10007a70
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000486f
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc20]
push 0x800
push eax
call fcn.100281ad
add esp, 0xc
lea ecx, [ebp - 0x1670]
xor eax, eax
push eax
push 1
call fcn.10006e98
xor eax, eax
mov byte [ebp - 4], 0xf
push eax
push 1
lea ecx, [ebp - 0x1700]
call fcn.10006e98
push str.__r_nTCPSocket_3310_r_nTCPAddr_127.0.0.1_r_nSelfCheck_0_r_nDisableCertCheck_yes_r_nForceToDisk_no_r_nScanELF_no_r_nPhishingSignatures_no_r_nPhishingScanURLs_no_r_n
lea eax, [ebp - 0xc20]
push 0x800
push eax
call fcn.100281ad
lea ecx, [ebp - 0xc20]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100048ca
xor eax, eax
sub ecx, edx
push eax
lea eax, [ebp - 0x174c]
push eax
push ecx
lea eax, [ebp - 0xc20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call edi
xor eax, eax
mov dword [ebp - 0x14dc], 7
push 0x10050aa0
lea ecx, [ebp - 0x14f0]
mov dword [ebp - 0x14e0], eax
mov word [ebp - 0x14f0], ax
call fcn.10006c7d
push str.PCAU.conf
lea edx, [ebp - 0x14f0]
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x1688]
call fcn.100078e2
pop ecx
cmp dword [eax + 0x14], 8
jb 0x1000493b
mov eax, dword [eax]
xor ecx, ecx
push ecx
push 0x80
push 2
push ecx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
lea ecx, [ebp - 0x1688]
xor eax, eax
push eax
push 1
call fcn.10006b0c
xor eax, eax
mov byte [ebp - 4], 0xf
push eax
push 1
lea ecx, [ebp - 0x14f0]
call fcn.10006b0c
cmp esi, 0xffffffff
je 0x10004a89
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [ebp + 0x18], 0
jne 0x100049a9
push str.database.clamav.net
lea ecx, [ebp + 8]
call fcn.10006c7d
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x16b8]
call fcn.10007b72
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x16a0]
mov edx, eax
mov dword [esp], str._r_nScriptedUpdates_yes
call fcn.100078e2
pop ecx
push eax
lea ecx, [ebp + 8]
call fcn.10006619
xor eax, eax
lea ecx, [ebp - 0x16a0]
push eax
push 1
call fcn.10006b0c
xor eax, eax
mov byte [ebp - 4], 0xf
push eax
push 1
lea ecx, [ebp - 0x16b8]
call fcn.10006b0c
xor eax, eax
push 0x800
push eax
lea eax, [ebp - 0x1420]
push eax
call fcn.10022700
sub esp, 0xc
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.100066b4
lea ecx, [ebp - 0x16d0]
call fcn.1000162d
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x10004a36
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x1420]
push 0x800
push eax
call fcn.100281ad
add esp, 0xc
lea ecx, [ebp - 0x16d0]
xor eax, eax
push eax
push 1
call fcn.10006e98
lea ecx, [ebp - 0x1420]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10004a64
xor eax, eax
sub ecx, edx
push eax
lea eax, [ebp - 0x1754]
push eax
push ecx
lea eax, [ebp - 0x1420]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call edi
xor eax, eax
push 0x10045a64
push eax
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x1c], eax
call fcn.10027c85
xor eax, eax
lea edi, [ebp - 0x14a6]
mov word [ebp - 0x14a8], ax
stosd dword es:[edi], eax
pop ecx
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0x1728], eax
mov dword [ebp - 0x1724], eax
lea eax, [ebp - 0x14a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x1728]
push eax
lea eax, [ebp - 0x14a8]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov ecx, dword [ebp - 0x1724]
xor eax, eax
or eax, dword [ebp - 0x1728]
and ecx, 0x7fffffff
xor edx, edx
mov dword [ebx + 0x70], eax
or ecx, edx
mov dword [ebp - 0x14f4], 7
mov dword [ebx + 0x74], ecx
xor eax, eax
push 0x10045f68
lea ecx, [ebp - 0x1508]
mov dword [ebp - 0x14f8], edx
mov word [ebp - 0x1508], ax
call fcn.10006c7d
lea eax, [ebp - 0x1508]
mov byte [ebp - 4], 0x16
lea esi, [ebx + 0x48]
push eax
mov ecx, esi
call fcn.10006571
xor edi, edi
mov byte [ebp - 4], 0xf
push edi
push 1
lea ecx, [ebp - 0x1508]
call fcn.10006b0c
xor eax, eax
mov dword [ebp - 0x150c], 7
push 0x10045f70
lea ecx, [ebp - 0x1520]
mov dword [ebp - 0x1510], edi
mov word [ebp - 0x1520], ax
call fcn.10006c7d
lea eax, [ebp - 0x1520]
mov byte [ebp - 4], 0x17
push eax
mov ecx, esi
call fcn.10006571
push edi
push 1
lea ecx, [ebp - 0x1520]
mov byte [ebp - 4], 0xf
call fcn.10006b0c
xor eax, eax
mov dword [ebp - 0x1524], 7
push 0x10045f78
lea ecx, [ebp - 0x1538]
mov dword [ebp - 0x1528], edi
mov word [ebp - 0x1538], ax
call fcn.10006c7d
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x1538]
mov ecx, esi
push eax
call fcn.10006571
push edi
push 1
lea ecx, [ebp - 0x1538]
mov byte [ebp - 4], 0xf
call fcn.10006b0c
xor eax, eax
mov dword [ebp - 0x153c], 7
push 0x10045f80
lea ecx, [ebp - 0x1550]
mov dword [ebp - 0x1540], edi
mov word [ebp - 0x1550], ax
call fcn.10006c7d
lea eax, [ebp - 0x1550]
mov byte [ebp - 4], 0x19
push eax
mov ecx, esi
call fcn.10006571
push edi
push 1
lea ecx, [ebp - 0x1550]
mov byte [ebp - 4], 0xf
call fcn.10006b0c
xor eax, eax
mov dword [ebp - 0x1554], 7
push 0x10045f88
lea ecx, [ebp - 0x1568]
mov dword [ebp - 0x1558], edi
mov word [ebp - 0x1568], ax
call fcn.10006c7d
lea eax, [ebp - 0x1568]
mov byte [ebp - 4], 0x1a
push eax
mov ecx, esi
call fcn.10006571
push edi
push 1
lea ecx, [ebp - 0x1568]
mov byte [ebp - 4], 0xf
call fcn.10006b0c
xor eax, eax
mov dword [ebp - 0x156c], 7
push 0x10045f90
lea ecx, [ebp - 0x1580]
mov dword [ebp - 0x1570], edi
mov word [ebp - 0x1580], ax
call fcn.10006c7d
lea eax, [ebp - 0x1580]
mov byte [ebp - 4], 0x1b
push eax
mov ecx, esi
call fcn.10006571
push edi
push 1
lea ecx, [ebp - 0x1580]
mov byte [ebp - 4], 0xf
call fcn.10006b0c
xor eax, eax
mov dword [ebp - 0x1584], 7
push 0x10045f98
lea ecx, [ebp - 0x1598]
mov dword [ebp - 0x1588], edi
mov word [ebp - 0x1598], ax
call fcn.10006c7d
lea eax, [ebp - 0x1598]
mov byte [ebp - 4], 0x1c
push eax
mov ecx, esi
call fcn.10006571
push edi
push 1
lea ecx, [ebp - 0x1598]
mov byte [ebp - 4], 0xf
call fcn.10006b0c
xor eax, eax
mov dword [ebp - 0x159c], 7
push 0x10045fa0
lea ecx, [ebp - 0x15b0]
mov dword [ebp - 0x15a0], edi
mov word [ebp - 0x15b0], ax
call fcn.10006c7d
lea eax, [ebp - 0x15b0]
mov byte [ebp - 4], 0x1d
push eax
mov ecx, esi
call fcn.10006571
push edi
push 1
lea ecx, [ebp - 0x15b0]
mov byte [ebp - 4], 0xf
call fcn.10006b0c
xor eax, eax
mov dword [ebp - 0x15b4], 7
push 0x10045fa8
lea ecx, [ebp - 0x15c8]
mov dword [ebp - 0x15b8], edi
mov word [ebp - 0x15c8], ax
call fcn.10006c7d
lea eax, [ebp - 0x15c8]
mov byte [ebp - 4], 0x1e
push eax
mov ecx, esi
call fcn.10006571
push edi
push 1
lea ecx, [ebp - 0x15c8]
mov byte [ebp - 4], 0xf
call fcn.10006b0c
xor eax, eax
mov dword [ebp - 0x15cc], 7
push 0x10045fb0
lea ecx, [ebp - 0x15e0]
mov dword [ebp - 0x15d0], edi
mov word [ebp - 0x15e0], ax
call fcn.10006c7d
lea eax, [ebp - 0x15e0]
mov byte [ebp - 4], 0x1f
push eax
mov ecx, esi
call fcn.10006571
push edi
push 1
lea ecx, [ebp - 0x15e0]
mov byte [ebp - 4], 0xf
call fcn.10006b0c
xor eax, eax
mov dword [ebp - 0x146c], 7
push 0x10045fb8
lea ecx, [ebp - 0x1480]
mov dword [ebp - 0x1470], edi
mov word [ebp - 0x1480], ax
call fcn.10006c7d
lea eax, [ebp - 0x1480]
mov byte [ebp - 4], 0x20
push eax
mov ecx, esi
call fcn.10006571
push edi
push 1
lea ecx, [ebp - 0x1480]
mov byte [ebp - 4], 0xf
call fcn.10006b0c
xor eax, eax
mov dword [ebp - 0x14c4], 7
push 0x10045fc0
lea ecx, [ebp - 0x14d8]
mov dword [ebp - 0x14c8], edi
mov word [ebp - 0x14d8], ax
call fcn.10006c7d
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x14d8]
mov ecx, esi
push eax
call fcn.10006571
push edi
push 1
lea ecx, [ebp - 0x14d8]
mov byte [ebp - 4], 0xf
call fcn.10006b0c
xor eax, eax
mov dword [ebp - 0x14ac], 7
push 0x10050aa0
lea ecx, [ebp - 0x14c0]
mov dword [ebp - 0x14b0], edi
mov word [ebp - 0x14c0], ax
call fcn.10006c7d
push str.databasemain.cvd
lea edx, [ebp - 0x14c0]
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x1438]
call fcn.100078e2
pop ecx
push edi
push 1
lea ecx, [ebp - 0x14c0]
mov byte [ebp - 4], 0x24
call fcn.10006b0c
cmp dword [ebp - 0x1424], 8
lea eax, [ebp - 0x1438]
cmovae eax, dword [ebp - 0x1438]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10004f63
cmp dword [ebp - 0x1424], 8
lea eax, [ebp - 0x1438]
cmovae eax, dword [ebp - 0x1438]
xor ecx, ecx
push ecx
push 0x80
push 3
push ecx
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10004f63
xor eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jne 0x10004f5a
mov byte [ebx + 0x2b], al
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10004f68
xor eax, eax
mov byte [ebx + 0x2b], al
cmp byte [ebx + 0x2b], 0
je 0x10004f75
mov ecx, ebx
call fcn.10005342
xor eax, eax
mov dword [ebp - 0x1484], 7
push 0x10050aa0
lea ecx, [ebp - 0x1498]
mov dword [ebp - 0x1488], eax
mov word [ebp - 0x1498], ax
call fcn.10006c7d
push str.RPCA.tm
lea edx, [ebp - 0x1498]
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x1718]
call fcn.100078e2
pop ecx
push eax
lea ecx, [ebx + 0x4180]
call fcn.10006619
xor eax, eax
lea ecx, [ebp - 0x1718]
push eax
push 1
call fcn.10006b0c
xor eax, eax
mov byte [ebp - 4], 0x24
push eax
push 1
lea ecx, [ebp - 0x1498]
call fcn.10006b0c
xor eax, eax
mov dword [ebp - 0x1454], 7
push 0x10050aa0
lea ecx, [ebp - 0x1468]
mov dword [ebp - 0x1458], eax
mov word [ebp - 0x1468], ax
call fcn.10006c7d
push str.RPCACheck.tm
lea edx, [ebp - 0x1468]
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x16e8]
call fcn.100078e2
pop ecx
push eax
lea ecx, [ebx + 0x419c]
call fcn.10006619
xor eax, eax
lea ecx, [ebp - 0x16e8]
push eax
push 1
call fcn.10006b0c
xor eax, eax
mov byte [ebp - 4], 0x24
push eax
push 1
lea ecx, [ebp - 0x1468]
call fcn.10006b0c
call fcn.10004048
test eax, eax
setg al
xor ecx, ecx
cmp dword [0x10050cb0], ecx
jne 0x1000508e
test al, al
jne 0x1000508e
push ecx
push ecx
push ebx
push 0x1000383c
push ecx
push ecx
call fcn.10027ad1
add esp, 0x18
mov dword [0x10050cb0], eax
xor ecx, ecx
cmp byte [ebx + 0x2b], 0
jne 0x100050b5
cmp dword [0x10050ca8], ecx
jne 0x100050b5
push 0x7d0
mov byte [0x10050a9a], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
call fcn.10006095
xor eax, eax
lea ecx, [ebp - 0x1438]
push eax
push 1
call fcn.10006b0c
xor eax, eax
lea ecx, [ebp + 8]
push eax
push 1
call fcn.10006b0c
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000a179
mov esp, ebp
pop ebp
ret 0x1c