Function at 0x1003325b
Capabilities:
Delete file
Get file size
Move file
Read file on windows
Write file on windows

Disassembly:
push ebp
sub esp, 0x730
lea ebp, [esp - 4]
mov eax, dword [0x10139d20]
xor eax, ebp
mov dword [ebp + 0x730], eax
push 0x140
mov eax, 0x100ea2bc
call fcn.100773f7
call fcn.100058ef
mov ecx, eax
call fcn.10017bf1
push eax
lea ecx, [ebp + 0x138]
call fcn.10001df0
lea eax, [ebp + 0x138]
xor ebx, ebx
push eax
lea ecx, [ebp + 0x1c4]
mov dword [ebp - 4], ebx
call fcn.10003c90
lea eax, [ebp + 0x138]
push eax
lea ecx, [ebp + 0xac]
mov byte [ebp - 4], 1
call fcn.10003c90
push str.WnSlation.exe
lea ecx, [ebp + 0xac]
mov byte [ebp - 4], 2
call fcn.10003cf0
push 0x206
lea eax, [ebp + 0x26e]
push ebx
push eax
mov word [ebp + 0x26c], bx
call fcn.10077be0
lea eax, [ebp + 0x138]
push eax
lea eax, [ebp + 0x100]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x30], ebx
call fcn.1001b179
add esp, 0x14
push str.Temp.xml
lea ecx, [ebp + 0x100]
mov byte [ebp - 4], 3
call fcn.1001b0b4
lea eax, [ebp + 0x100]
push eax
lea eax, [ebp + 0x18c]
push eax
call fcn.1001b49e
pop ecx
pop ecx
cmp dword [ebp + 0x1a4], 8
mov eax, dword [ebp + 0x190]
mov byte [ebp - 4], 4
jae 0x10033352
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x138]
push eax
lea eax, [ebp + 0x90]
push eax
call fcn.1001b179
pop ecx
pop ecx
push str.Config.xml
lea ecx, [ebp + 0x90]
mov byte [ebp - 4], 5
call fcn.1001b0b4
lea eax, [ebp + 0x138]
push eax
lea eax, [ebp + 0xc8]
push eax
call fcn.1001b179
pop ecx
pop ecx
push str.temp.dat
lea ecx, [ebp + 0xc8]
mov byte [ebp - 4], 6
call fcn.1001b0b4
lea ecx, [ebp - 0x14c]
call fcn.100b4a50
push 0x38
mov byte [ebp - 4], 7
call fcn.10054d4d
pop ecx
mov dword [ebp - 0x20], eax
cmp eax, ebx
mov byte [ebp - 4], 8
je 0x100333e5
push 0x1011e018
push 0x100f2398
push 0x100f23a0
mov ecx, eax
call fcn.100b5160
jmp 0x100333e7
xor eax, eax
push eax
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 7
call fcn.100b3ee0
push 0x50
call fcn.10054d4d
pop ecx
mov dword [ebp - 0x20], eax
cmp eax, ebx
mov byte [ebp - 4], 9
je 0x1003341b
push str.TheQueryInfo
mov ecx, eax
call fcn.100b5640
mov dword [ebp - 0x28], eax
jmp 0x1003341e
mov dword [ebp - 0x28], ebx
push 0x50
mov byte [ebp - 4], 7
call fcn.10054d4d
pop ecx
mov dword [ebp - 0x20], eax
cmp eax, ebx
mov byte [ebp - 4], 0xa
je 0x10033446
push str.PushList
mov ecx, eax
call fcn.100b5640
mov dword [ebp - 0x18], eax
jmp 0x10033449
mov dword [ebp - 0x18], ebx
mov esi, dword [ebp + 0x73c]
mov eax, dword [esi + 8]
add esi, 4
push esi
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
mov dword [ebp - 0x20], esi
call fcn.1004a4ca
mov eax, dword [esi + 8]
push esi
jmp 0x10034567
lea ecx, [ebp - 0x3c]
call fcn.1000c5bc
mov esi, dword [eax + 0x1c]
push str.PushName
lea ecx, [ebp + 0x170]
call fcn.10001df0
mov eax, dword [esi]
lea ecx, [ebp + 0x170]
push ecx
mov ecx, esi
mov byte [ebp - 4], 0xb
call dword [eax + 0x1c]
push ebx
push 1
lea ecx, [ebp + 0x170]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 7
call fcn.10001fc0
push str.ChooseInstall
lea ecx, [ebp + 0x1a8]
call fcn.10001df0
mov eax, dword [esi]
lea ecx, [ebp + 0x1a8]
push ecx
mov ecx, esi
mov byte [ebp - 4], 0xc
call dword [eax + 0x1c]
push ebx
push 1
lea ecx, [ebp + 0x1a8]
mov edi, eax
mov byte [ebp - 4], 7
call fcn.10001fc0
cmp edi, ebx
je 0x10034558
cmp dword [edi + 0x18], 8
jb 0x100334fa
mov edi, dword [edi + 4]
jmp 0x100334fd
add edi, 4
push 0x100f29a8
push edi
call fcn.100782e7
test eax, eax
pop ecx
pop ecx
jne 0x10034558
push str.InstallPushUrl
lea ecx, [ebp + 0x1a8]
call fcn.10001df0
mov eax, dword [esi]
lea ecx, [ebp + 0x1a8]
push ecx
mov ecx, esi
mov byte [ebp - 4], 0xd
call dword [eax + 0x1c]
push ebx
push 1
lea ecx, [ebp + 0x1a8]
mov edi, eax
mov byte [ebp - 4], 7
call fcn.10001fc0
push str.InstallGreenBag
lea ecx, [ebp - 0x78]
call fcn.10001df0
mov eax, dword [esi]
lea ecx, [ebp - 0x78]
push ecx
mov ecx, esi
mov byte [ebp - 4], 0xe
call dword [eax + 0x1c]
push ebx
push 1
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 7
call fcn.10001fc0
push str.InstallRunParam
lea ecx, [ebp - 0x94]
call fcn.10001df0
mov eax, dword [esi]
lea ecx, [ebp - 0x94]
push ecx
mov ecx, esi
mov byte [ebp - 4], 0xf
call dword [eax + 0x1c]
push ebx
push 1
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 7
call fcn.10001fc0
push str.InstallRunExe
lea ecx, [ebp - 0x104]
call fcn.10001df0
mov eax, dword [esi]
lea ecx, [ebp - 0x104]
push ecx
mov ecx, esi
mov byte [ebp - 4], 0x10
call dword [eax + 0x1c]
push ebx
push 1
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 7
call fcn.10001fc0
push str.InstallRunLocalExe
lea ecx, [ebp - 0xcc]
call fcn.10001df0
mov eax, dword [esi]
lea ecx, [ebp - 0xcc]
push ecx
mov ecx, esi
mov byte [ebp - 4], 0x11
call dword [eax + 0x1c]
push ebx
push 1
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 7
call fcn.10001fc0
push str.InstallType
lea ecx, [ebp - 0xe8]
call fcn.10001df0
mov eax, dword [esi]
lea ecx, [ebp - 0xe8]
push ecx
mov ecx, esi
mov byte [ebp - 4], 0x12
call dword [eax + 0x1c]
push ebx
push 1
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 7
call fcn.10001fc0
push str.InstallUACType
lea ecx, [ebp - 0xb0]
call fcn.10001df0
mov eax, dword [esi]
lea ecx, [ebp - 0xb0]
push ecx
mov ecx, esi
mov byte [ebp - 4], 0x13
call dword [eax + 0x1c]
push ebx
push 1
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 7
call fcn.10001fc0
push str.InstallWmiMode
lea ecx, [ebp + 0x154]
call fcn.10001df0
mov eax, dword [esi]
lea ecx, [ebp + 0x154]
push ecx
mov ecx, esi
mov byte [ebp - 4], 0x14
call dword [eax + 0x1c]
push ebx
push 1
lea ecx, [ebp + 0x154]
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 7
call fcn.10001fc0
cmp dword [ebp - 0x14], ebx
je 0x10033e65
mov esi, dword [ebp - 0x14]
cmp dword [esi + 0x18], 8
jb 0x100336d9
add esi, 4
mov eax, dword [esi]
jmp 0x100336de
add esi, 4
mov eax, esi
push str.hao123kantu
push eax
call fcn.100782e7
test eax, eax
pop ecx
pop ecx
jne 0x10033b97
cmp edi, ebx
je 0x10034558
lea ecx, [ebp + 0x1c]
call fcn.100302ed
push 8
pop esi
cmp dword [edi + 0x18], esi
mov byte [ebp - 4], 0x15
jb 0x10033714
mov edi, dword [edi + 4]
jmp 0x10033717
add edi, 4
push edi
lea ecx, [ebp + 0x1c]
call fcn.100303db
lea ecx, [ebp + 0x1c]
call fcn.100302ab
push eax
lea ecx, [ebp + 0x154]
call fcn.10001df0
lea eax, [ebp + 0x154]
push eax
lea ecx, [ebp + 0x250]
mov byte [ebp - 4], 0x16
call fcn.10003c90
mov eax, dword [ebp - 0x34]
cmp eax, ebx
mov byte [ebp - 4], 0x17
je 0x1003376e
cmp dword [eax + 0x18], esi
jb 0x1003375f
mov eax, dword [eax + 4]
jmp 0x10033762
add eax, 4
push eax
lea ecx, [ebp + 0x250]
call fcn.10003cf0
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x18], esi
jb 0x1003377b
mov eax, dword [eax + 4]
jmp 0x1003377e
add eax, 4
push str.open_explorer
push eax
call fcn.100782e7
test eax, eax
pop ecx
pop ecx
je 0x100338fc
push 0x1011e03c
lea ecx, [ebp + 0x234]
call fcn.10001df0
mov edi, dword [ebp - 0x1c]
cmp edi, ebx
mov byte [ebp - 4], 0x18
lea ecx, [ebp + 0x234]
jne 0x100337c8
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x250]
push eax
call fcn.10002540
jmp 0x1003387d
push 0x100f57cc
call fcn.10003cc0
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x250]
push eax
lea ecx, [ebp + 0x234]
call fcn.10004260
push 0x100f5858
lea ecx, [ebp + 0x234]
call fcn.10003cf0
cmp dword [edi + 0x18], esi
jb 0x10033801
mov edi, dword [edi + 4]
jmp 0x10033804
add edi, 4
push edi
lea ecx, [ebp + 0x234]
call fcn.10003cf0
call fcn.1001ad52
push 0x62
mov edi, eax
lea eax, [ebp + 0x6ce]
push ebx
push eax
mov word [ebp + 0x6cc], bx
call fcn.10077be0
push 0x62
lea eax, [ebp + 0x66a]
push ebx
push eax
mov word [ebp + 0x668], bx
call fcn.10077be0
push edi
lea eax, [ebp + 0x6cc]
push 0x100f2494
push eax
call fcn.100054f5
lea eax, [ebp + 0x6d0]
push eax
lea eax, [ebp + 0x668]
push eax
call fcn.100780db
add esp, 0x2c
lea eax, [ebp + 0x668]
push eax
lea ecx, [ebp + 0x234]
call fcn.10003cf0
cmp dword [ebp + 0x24c], esi
mov eax, dword [ebp + 0x238]
jae 0x10033891
lea eax, [ebp + 0x238]
push eax
call fcn.1001a8a5
lea ecx, [ebp + 0x234]
mov dword [esp], 0x100f57cc
call fcn.10003cc0
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x250]
push eax
lea ecx, [ebp + 0x234]
call fcn.10004260
push str.__CreateStartMenu
lea ecx, [ebp + 0x234]
call fcn.10003cf0
cmp dword [ebp + 0x24c], esi
mov eax, dword [ebp + 0x238]
jae 0x100338e2
lea eax, [ebp + 0x238]
push eax
call fcn.1001a8a5
pop ecx
push ebx
push 1
lea ecx, [ebp + 0x234]
call fcn.10001fc0
jmp 0x10033b6a
push 0x50
pop esi
push esi
mov dword [ebp - 0x24], 1
call fcn.10054d4d
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x19
je 0x10033929
push str.PushItem
mov ecx, eax
call fcn.100b5640
mov dword [ebp - 0x14], eax
jmp 0x1003392c
mov dword [ebp - 0x14], ebx
push esi
mov byte [ebp - 4], 0x17
call fcn.10054d4d
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x1a
je 0x10033952
push 0x100faa54
mov ecx, eax
call fcn.100b5640
mov edi, eax
jmp 0x10033954
xor edi, edi
push 0x1f3
lea eax, [ebp + 0x475]
push ebx
push eax
mov byte [ebp - 4], 0x17
mov byte [ebp + 0x474], bl
call fcn.10077be0
mov eax, dword [ebp + 0x254]
add esp, 0xc
cmp dword [ebp + 0x268], 8
jae 0x10033988
lea eax, [ebp + 0x254]
lea ecx, [ebp + 0x474]
push ecx
push eax
call fcn.100195d0
push 0x30
call fcn.10054d4d
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x1b
je 0x100339ba
lea ecx, [ebp + 0x474]
push ecx
mov ecx, eax
call fcn.1000550b
jmp 0x100339bc
xor eax, eax
push eax
mov ecx, edi
mov byte [ebp - 4], 0x17
call fcn.100b3ee0
mov ecx, dword [ebp - 0x14]
push edi
call fcn.100b3ee0
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x10033aff
cmp dword [eax + 0x18], 8
jb 0x100339e7
mov eax, dword [eax + 4]
jmp 0x100339ea
add eax, 4
push eax
lea ecx, [ebp + 0x218]
call fcn.10001df0
mov byte [ebp - 4], 0x1c
call fcn.1001ad52
push 0x62
mov edi, eax
lea eax, [ebp + 0x66a]
push ebx
push eax
mov word [ebp + 0x668], bx
call fcn.10077be0
push 0x62
lea eax, [ebp + 0x6ce]
push ebx
push eax
mov word [ebp + 0x6cc], bx
call fcn.10077be0
push edi
lea eax, [ebp + 0x668]
push 0x100f2494
push eax
call fcn.100054f5
lea eax, [ebp + 0x66c]
push eax
lea eax, [ebp + 0x6cc]
push eax
call fcn.100780db
add esp, 0x2c
lea eax, [ebp + 0x6cc]
push eax
lea ecx, [ebp + 0x218]
call fcn.10003cf0
push esi
call fcn.10054d4d
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x1d
je 0x10033a89
push 0x100faa44
mov ecx, eax
call fcn.100b5640
mov edi, eax
jmp 0x10033a8b
xor edi, edi
cmp dword [ebp + 0x230], 8
mov eax, dword [ebp + 0x21c]
mov byte [ebp - 4], 0x1c
jae 0x10033aa4
lea eax, [ebp + 0x21c]
lea ecx, [ebp + 0x474]
push ecx
push eax
call fcn.100195d0
push 0x30
call fcn.10054d4d
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x1e
je 0x10033ad6
lea ecx, [ebp + 0x474]
push ecx
mov ecx, eax
call fcn.1000550b
jmp 0x10033ad8
xor eax, eax
push eax
mov ecx, edi
mov byte [ebp - 4], 0x1c
call fcn.100b3ee0
mov ecx, dword [ebp - 0x14]
push edi
call fcn.100b3ee0
push ebx
push 1
lea ecx, [ebp + 0x218]
mov byte [ebp - 4], 0x17
call fcn.10001fc0
push esi
call fcn.10054d4d
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x1f
je 0x10033b21
push str.InstallRunFullPath
mov ecx, eax
call fcn.100b5640
mov edi, eax
jmp 0x10033b23
xor edi, edi
push 0x30
mov byte [ebp - 4], 0x17
call fcn.10054d4d
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x20
je 0x10033b48
push str.true
mov ecx, eax
call fcn.1000550b
jmp 0x10033b4a
xor eax, eax
push eax
mov ecx, edi
mov byte [ebp - 4], 0x17
call fcn.100b3ee0
mov ecx, dword [ebp - 0x14]
push edi
call fcn.100b3ee0
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.100b3ee0
push ebx
push 1
lea ecx, [ebp + 0x250]
call fcn.10001fc0
push ebx
push 1
lea ecx, [ebp + 0x154]
call fcn.10001fc0
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 7
call fcn.100302b9
jmp 0x10034558
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x18], 8
jb 0x10033ba2
mov esi, dword [esi]
push str.juzibrowse
push esi
call fcn.100782e7
test eax, eax
pop ecx
pop ecx
jne 0x10033e65
cmp edi, ebx
je 0x10034558
lea ecx, [ebp]
call fcn.10037454
push 8
pop esi
cmp dword [edi + 0x18], esi
mov byte [ebp - 4], 0x21
jb 0x10033bd8
mov edi, dword [edi + 4]
jmp 0x10033bdb
add edi, 4
push edi
lea ecx, [ebp]
call fcn.10037827
lea ecx, [ebp]
call fcn.100302ab
push eax
lea ecx, [ebp + 0x154]
call fcn.10001df0
push 0x7d0
mov byte [ebp - 4], 0x22
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 0x154]
push eax
lea ecx, [ebp + 0x250]
call fcn.10003c90
push str.jzbrowse.exe
lea ecx, [ebp + 0x250]
mov byte [ebp - 4], 0x23
call fcn.10003cf0
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x18], esi
jb 0x10033c3a
mov eax, dword [eax + 4]
jmp 0x10033c3d
add eax, 4
push str.open_explorer
push eax
call fcn.100782e7
test eax, eax
pop ecx
pop ecx
je 0x10033c6e
cmp dword [ebp + 0x268], esi
mov eax, dword [ebp + 0x254]
jae 0x10033c62
lea eax, [ebp + 0x254]
push eax
call fcn.1001a8a5
pop ecx
jmp 0x10033e38
push 0x50
mov dword [ebp - 0x24], 1
call fcn.10054d4d
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x24
je 0x10033c99
push str.PushItem
mov ecx, eax
call fcn.100b5640
mov dword [ebp - 0x14], eax
jmp 0x10033c9c
mov dword [ebp - 0x14], ebx
push 0x50
mov byte [ebp - 4], 0x23
call fcn.10054d4d
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x25
je 0x10033cc3
push 0x100faa54
mov ecx, eax
call fcn.100b5640
mov edi, eax
jmp 0x10033cc5
xor edi, edi
push 0x1f3
lea eax, [ebp + 0x475]
push ebx
push eax
mov byte [ebp - 4], 0x23
mov byte [ebp + 0x474], bl
call fcn.10077be0
mov eax, dword [ebp + 0x254]
add esp, 0xc
cmp dword [ebp + 0x268], esi
jae 0x10033cf8
lea eax, [ebp + 0x254]
lea ecx, [ebp + 0x474]
push ecx
push eax
call fcn.100195d0
push 0x30
call fcn.10054d4d
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x26
je 0x10033d2a
lea ecx, [ebp + 0x474]
push ecx
mov ecx, eax
call fcn.1000550b
jmp 0x10033d2c
xor eax, eax
push eax
mov ecx, edi
mov byte [ebp - 4], 0x23
call fcn.100b3ee0
mov ecx, dword [ebp - 0x14]
push edi
call fcn.100b3ee0
mov edi, dword [ebp - 0x1c]
cmp edi, ebx
je 0x10033dcc
push 0x50
call fcn.10054d4d
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x27
je 0x10033d6f
push 0x100faa44
mov ecx, eax
call fcn.100b5640
mov esi, eax
jmp 0x10033d71
xor esi, esi
cmp dword [edi + 0x18], 8
mov byte [ebp - 4], 0x23
jb 0x10033d80
mov eax, dword [edi + 4]
jmp 0x10033d83
lea eax, [edi + 4]
lea ecx, [ebp + 0x474]
push ecx
push eax
call fcn.100195d0
push 0x30
call fcn.10054d4d
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x28
je 0x10033db5
lea ecx, [ebp + 0x474]
push ecx
mov ecx, eax
call fcn.1000550b
jmp 0x10033db7
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 0x23
call fcn.100b3ee0
mov ecx, dword [ebp - 0x14]
push esi
call fcn.100b3ee0
push 0x50
call fcn.10054d4d
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x29
je 0x10033def
push str.InstallRunFullPath
mov ecx, eax
call fcn.100b5640
mov edi, eax
jmp 0x10033df1
xor edi, edi
push 0x30
mov byte [ebp - 4], 0x23
call fcn.10054d4d
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x2a
je 0x10033e16
push str.true
mov ecx, eax
call fcn.1000550b
jmp 0x10033e18
xor eax, eax
push eax
mov ecx, edi
mov byte [ebp - 4], 0x23
call fcn.100b3ee0
mov ecx, dword [ebp - 0x14]
push edi
call fcn.100b3ee0
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.100b3ee0
push ebx
push 1
lea ecx, [ebp + 0x250]
call fcn.10001fc0
push ebx
push 1
lea ecx, [ebp + 0x154]
call fcn.10001fc0
lea ecx, [ebp]
mov byte [ebp - 4], 7
call fcn.10037415
jmp 0x10034558
cmp edi, ebx
je 0x10034558
xor esi, esi
inc esi
cmp dword [edi + 0x18], 8
mov dword [ebp - 0x14], esi
jb 0x10033e7e
mov edi, dword [edi + 4]
jmp 0x10033e81
add edi, 4
push edi
lea ecx, [ebp + 0x250]
call fcn.10001df0
cmp dword [ebp + 0x268], 8
mov eax, dword [ebp + 0x254]
mov byte [ebp - 4], 0x2b
jae 0x10033ea6
lea eax, [ebp + 0x254]
lea ecx, [ebp + 0x26c]
push ecx
push eax
call fcn.10019d63
pop ecx
pop ecx
lea eax, [ebp + 0x1c4]
push eax
lea ecx, [ebp + 0x1e0]
call fcn.10003c90
lea eax, [ebp + 0x26c]
push eax
lea ecx, [ebp + 0x1e0]
mov byte [ebp - 4], 0x2c
call fcn.10003cf0
cmp dword [ebp + 0x1f8], 8
mov eax, dword [ebp + 0x1e4]
jae 0x10033ef2
lea eax, [ebp + 0x1e4]
push eax
call fcn.1001a1c9
pop ecx
lea ecx, [ebp - 0x5c]
call fcn.10001bc0
cmp dword [ebp + 0x1dc], 8
mov eax, dword [ebp + 0x1c8]
mov byte [ebp - 4], 0x2d
jae 0x10033f1a
lea eax, [ebp + 0x1c8]
push eax
lea ecx, [ebp + 0x1a8]
call fcn.10001df0
cmp dword [ebp + 0x268], 8
mov eax, dword [ebp + 0x254]
mov byte [ebp - 4], 0x2e
jae 0x10033f3f
lea eax, [ebp + 0x254]
push eax
lea ecx, [ebp + 0x170]
call fcn.10001df0
lea eax, [ebp + 0x1a8]
push eax
lea eax, [ebp + 0x170]
push eax
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x2f
call fcn.10001c60
push ebx
push esi
lea ecx, [ebp + 0x170]
movzx edi, al
call fcn.10001fc0
push ebx
push esi
lea ecx, [ebp + 0x1a8]
mov byte [ebp - 4], 0x2d
call fcn.10001fc0
cmp dword [ebp + 0x1dc], 8
mov ecx, dword [ebp + 0x1c8]
jae 0x10033f9b
lea ecx, [ebp + 0x1c8]
cmp dword [ebp + 0x268], 8
mov eax, dword [ebp + 0x254]
jae 0x10033fb0
lea eax, [ebp + 0x254]
push edi
push ecx
push eax
push str.__s___s___d_
call fcn.1001c6e0
add esp, 0x10
cmp edi, ebx
je 0x1003452e
mov eax, dword [ebp + 0x1c8]
push 8
pop edi
cmp dword [ebp + 0x1dc], edi
jae 0x10033fdf
lea eax, [ebp + 0x1c8]
push eax
lea ecx, [ebp + 0x234]
call fcn.10001df0
lea eax, [ebp + 0x26c]
push eax
lea ecx, [ebp + 0x218]
mov byte [ebp - 4], 0x30
call fcn.10001df0
mov eax, dword [ebp - 0x40]
cmp eax, ebx
mov byte [ebp - 4], 0x31
je 0x1003410d
cmp dword [eax + 0x18], edi
jb 0x1003401a
mov eax, dword [eax + 4]
jmp 0x1003401d
add eax, 4
push 0x100f29a8
push eax
call fcn.100782e7
test eax, eax
pop ecx
pop ecx
jne 0x1003410d
call fcn.100058ef
mov ecx, eax
call fcn.10017bf1
push eax
lea ecx, [ebp + 0x1a8]
call fcn.10001df0
cmp dword [ebp + 0x1dc], edi
mov eax, dword [ebp + 0x1c8]
mov byte [ebp - 4], 0x32
jae 0x10034062
lea eax, [ebp + 0x1c8]
push eax
lea ecx, [ebp + 0x170]
call fcn.10001df0
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x218]
push eax
lea ecx, [ebp + 0x170]
mov byte [ebp - 4], 0x33
call fcn.10004260
lea eax, [ebp + 0x170]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.1001b179
pop ecx
pop ecx
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x34
jb 0x100340a8
mov eax, dword [eax + 4]
jmp 0x100340ab
add eax, 4
cmp dword [ebp + 0x1c0], edi
mov ecx, dword [ebp + 0x1ac]
jae 0x100340bf
lea ecx, [ebp + 0x1ac]
push ebx
push eax
push ecx
call fcn.10029409
add esp, 0xc
push ebx
push esi
lea ecx, [ebp - 0x78]
call fcn.10001f70
cmp dword [ebp + 0x230], edi
mov eax, dword [ebp + 0x21c]
jae 0x100340e8
lea eax, [ebp + 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push esi
lea ecx, [ebp + 0x170]
call fcn.10001fc0
push ebx
push esi
lea ecx, [ebp + 0x1a8]
mov byte [ebp - 4], 0x31
call fcn.10001fc0
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x100341cb
cmp dword [eax + 0x18], edi
jb 0x10034122
mov eax, dword [eax + 4]
jmp 0x10034125
add eax, 4
push eax
lea ecx, [ebp + 0x218]
call fcn.10003cc0
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x218]
push eax
lea ecx, [ebp + 0x234]
call fcn.10004260
cmp dword [ebp + 0x24c], edi
mov ecx, dword [ebp + 0x238]
jae 0x1003415a
lea ecx, [ebp + 0x238]
cmp dword [ebp + 0x1f8], edi
mov eax, dword [ebp + 0x1e4]
jae 0x1003416e
lea eax, [ebp + 0x1e4]
push ecx
push eax
call fcn.10019f75
cmp dword [ebp + 0x24c], edi
pop ecx
pop ecx
mov ecx, dword [ebp + 0x238]
jae 0x1003418b
lea ecx, [ebp + 0x238]
cmp dword [ebp + 0x1f8], edi
mov eax, dword [ebp + 0x1e4]
jae 0x1003419f
lea eax, [ebp + 0x1e4]
push ecx
push eax
push str.__s___s_
call fcn.1001c6e0
mov eax, dword [ebp + 0x1e4]
add esp, 0xc
cmp dword [ebp + 0x1f8], edi
jae 0x100341c2
lea eax, [ebp + 0x1e4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x100341dd
lea eax, [ebp + 0x26c]
push eax
lea ecx, [ebp + 0x234]
call fcn.10003cf0
mov edi, dword [ebp - 0x50]
cmp edi, ebx
je 0x10034216
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x138]
push eax
lea ecx, [ebp + 0x234]
mov dword [ebp - 0x14], ebx
call fcn.10002540
cmp dword [edi + 0x18], 8
jb 0x10034207
mov edi, dword [edi + 4]
jmp 0x1003420a
add edi, 4
push edi
lea ecx, [ebp + 0x234]
call fcn.10003cf0
push 0x1011e03c
lea ecx, [ebp + 0x1fc]
call fcn.10001df0
mov edi, dword [ebp - 0x1c]
cmp edi, ebx
mov byte [ebp - 4], 0x35
lea ecx, [ebp + 0x1fc]
jne 0x10034248
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x234]
push eax
call fcn.10004260
jmp 0x10034291
push 0x100f57cc
call fcn.10003cf0
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x234]
push eax
lea ecx, [ebp + 0x1fc]
call fcn.10004260
push 0x100f5858
lea ecx, [ebp + 0x1fc]
call fcn.10003cf0
cmp dword [edi + 0x18], 8
jb 0x10034282
mov edi, dword [edi + 4]
jmp 0x10034285
add edi, 4
push edi
lea ecx, [ebp + 0x1fc]
call fcn.10003cf0
mov edi, dword [ebp - 0x2c]
cmp edi, ebx
je 0x1003449f
mov eax, dword [ebp - 0x54]
cmp eax, ebx
je 0x100342c9
cmp dword [eax + 0x18], 8
jb 0x100342ae
mov eax, dword [eax + 4]
jmp 0x100342b1
add eax, 4
push 0x100f29a8
push eax
call fcn.100782e7
test eax, eax
pop ecx
pop ecx
jne 0x100342c9
mov dword [ebp - 0x30], 1
cmp dword [edi + 0x18], 8
jb 0x100342d4
mov eax, dword [edi + 4]
jmp 0x100342d7
lea eax, [edi + 4]
push str.open_explorer
push eax
call fcn.100782e7
test eax, eax
pop ecx
pop ecx
jne 0x1003449f
call fcn.1001a5c8
test eax, eax
je 0x1003433d
mov esi, dword [ebp - 0x10]
cmp esi, ebx
je 0x1003433d
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x10034309
mov eax, dword [edi]
jmp 0x1003430b
mov eax, edi
push str.direct_open
push eax
call fcn.100782e7
test eax, eax
pop ecx
pop ecx
je 0x1003449f
cmp dword [esi + 0x18], 8
jb 0x10034328
mov edi, dword [edi]
push str.no_open
push edi
call fcn.100782e7
test eax, eax
pop ecx
pop ecx
je 0x100344dd
push 0x50
mov dword [ebp - 0x24], 1
call fcn.10054d4d
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x36
je 0x10034367
push str.PushItem
mov ecx, eax
call fcn.100b5640
mov esi, eax
jmp 0x10034369
xor esi, esi
push 0x50
mov byte [ebp - 4], 0x35
call fcn.10054d4d
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x37
je 0x10034390
push 0x100faa54
mov ecx, eax
call fcn.100b5640
mov edi, eax
jmp 0x10034392
xor edi, edi
push 0x1f3
lea eax, [ebp + 0x475]
push ebx
push eax
mov byte [ebp - 4], 0x35
mov byte [ebp + 0x474], bl
call fcn.10077be0
mov eax, dword [ebp + 0x21c]
add esp, 0xc
cmp dword [ebp + 0x230], 8
jae 0x100343c6
lea eax, [ebp + 0x21c]
lea ecx, [ebp + 0x474]
push ecx
push eax
call fcn.100195d0
push 0x30
call fcn.10054d4d
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x38
je 0x100343f8
lea ecx, [ebp + 0x474]
push ecx
mov ecx, eax
call fcn.1000550b
jmp 0x100343fa
xor eax, eax
push eax
mov ecx, edi
mov byte [ebp - 4], 0x35
call fcn.100b3ee0
push edi
mov ecx, esi
call fcn.100b3ee0
push 0x50
call fcn.10054d4d
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x39
je 0x10034431
push 0x100faa44
mov ecx, eax
call fcn.100b5640
mov edi, eax
jmp 0x10034433
xor edi, edi
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
mov byte [ebp - 4], 0x35
je 0x10034494
cmp dword [eax + 0x18], 8
jb 0x10034449
mov eax, dword [eax + 4]
jmp 0x1003444c
add eax, 4
lea ecx, [ebp + 0x474]
push ecx
push eax
call fcn.100195d0
push 0x30
call fcn.10054d4d
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov byte [ebp - 4], 0x3a
je 0x1003447e
lea ecx, [ebp + 0x474]
push ecx
mov ecx, eax
call fcn.1000550b
jmp 0x10034480
xor eax, eax
push eax
mov ecx, edi
mov byte [ebp - 4], 0x35
call fcn.100b3ee0
push edi
mov ecx, esi
call fcn.100b3ee0
mov ecx, dword [ebp - 0x18]
push esi
call fcn.100b3ee0
jmp 0x100344dd
cmp dword [ebp + 0x214], 8
mov eax, dword [ebp + 0x200]
jae 0x100344b4
lea eax, [ebp + 0x200]
push eax
call fcn.1001a8a5
cmp dword [ebp + 0x214], 8
mov eax, dword [ebp + 0x200]
pop ecx
jae 0x100344d0
lea eax, [ebp + 0x200]
push eax
push 0x100f2dd0
call fcn.1001c6e0
pop ecx
pop ecx
cmp dword [ebp - 0x14], ebx
je 0x10034501
cmp dword [ebp + 0x24c], 8
mov eax, dword [ebp + 0x238]
jae 0x100344f7
lea eax, [ebp + 0x238]
push 5
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push ebx
push 1
lea ecx, [ebp + 0x1fc]
call fcn.10001fc0
push ebx
push 1
lea ecx, [ebp + 0x218]
call fcn.10001fc0
push ebx
push 1
lea ecx, [ebp + 0x234]
call fcn.10001fc0
xor esi, esi
inc esi
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x2c
call fcn.10001c50
push ebx
push esi
lea ecx, [ebp + 0x1e0]
call fcn.10001fc0
push ebx
push esi
lea ecx, [ebp + 0x250]
mov byte [ebp - 4], 7
call fcn.10001fc0
lea ecx, [ebp - 0x3c]
call fcn.10032526
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 8]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.1004a4ca
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x3c]
call fcn.1003f8a6
test al, al
je 0x1003346f
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
call fcn.100b3ee0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x14c]
call fcn.100b3ee0
cmp dword [ebp + 0x118], 0x10
mov eax, dword [ebp + 0x104]
jae 0x100345b2
lea eax, [ebp + 0x104]
push eax
lea ecx, [ebp - 0x14c]
call fcn.100b4de0
cmp dword [ebp + 0x1a4], 8
mov eax, dword [ebp + 0x190]
mov dword [ebp - 0x18], ebx
jae 0x100345d6
lea eax, [ebp + 0x190]
push ebx
push 0x80
push 4
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100345ff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
mov esi, dword [ebp - 0x18]
inc esi
push esi
call fcn.10054d7d
push esi
push ebx
push eax
mov dword [ebp - 0x1c], eax
call fcn.10077be0
add esp, 0x10
push ebx
lea eax, [ebp - 0x4c]
push eax
push esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x4c], ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x90]
push eax
lea eax, [ebp + 0xe4]
push eax
call fcn.1001b49e
pop ecx
pop ecx
cmp dword [ebp + 0x1a4], 8
mov eax, dword [ebp + 0x190]
mov byte [ebp - 4], 0x3b
jae 0x1003465f
lea eax, [ebp + 0x190]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
push str.GUANGSU
call fcn.10076de0
pop ecx
xor ecx, ecx
xor edi, edi
cmp dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], eax
jle 0x1003469a
mov eax, dword [ebp - 0x1c]
mov dl, byte [ecx + str.GUANGSU]
add eax, edi
xor byte [eax], dl
inc ecx
cmp ecx, dword [ebp - 0x20]
jl 0x10034694
xor ecx, ecx
inc edi
cmp edi, dword [ebp - 0x18]
jl 0x1003467f
cmp dword [ebp + 0xfc], 8
mov eax, dword [ebp + 0xe8]
jae 0x100346af
lea eax, [ebp + 0xe8]
push eax
call esi
lea eax, [ebp + 0xc8]
push eax
lea eax, [ebp + 0x11c]
push eax
call fcn.1001b49e
pop ecx
pop ecx
cmp dword [ebp + 0x134], 8
mov eax, dword [ebp + 0x120]
mov byte [ebp - 4], 0x3c
jae 0x100346e0
lea eax, [ebp + 0x120]
push eax
call fcn.1001a1c9
cmp dword [ebp + 0x134], 8
mov eax, dword [ebp + 0x120]
pop ecx
jae 0x100346fc
lea eax, [ebp + 0x120]
push ebx
push 0x80
xor esi, esi
inc esi
push esi
push ebx
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10034737
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x20], ebx
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x24], ebx
je 0x10034890
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x1011e03c
push esi
lea ecx, [ebp + 0x1fc]
call fcn.10001df0
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x138]
push eax
lea ecx, [ebp + 0x1fc]
mov byte [ebp - 4], 0x3d
call fcn.10002540
push str.WnUtil32.exe
lea ecx, [ebp + 0x1fc]
call fcn.10003cf0
push esi
lea ecx, [ebp + 0x218]
call fcn.10001df0
mov edi, 0x100f57cc
push edi
lea ecx, [ebp + 0x218]
mov byte [ebp - 4], 0x3e
call fcn.10003cc0
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x1fc]
push eax
lea ecx, [ebp + 0x218]
call fcn.10004260
push str.___RunHuoRong
lea ecx, [ebp + 0x218]
call fcn.10003cf0
cmp dword [ebp - 0x30], ebx
jne 0x100347f1
cmp dword [ebp + 0x230], 8
mov eax, dword [ebp + 0x21c]
jae 0x100347e5
lea eax, [ebp + 0x21c]
push eax
call fcn.1001a8a5
pop ecx
jmp 0x10034871
push esi
lea ecx, [ebp + 0x250]
call fcn.10001df0
push edi
lea ecx, [ebp + 0x250]
mov byte [ebp - 4], 0x3f
call fcn.10003cc0
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0xac]
push eax
lea ecx, [ebp + 0x250]
call fcn.10004260
push 0x100f5858
lea ecx, [ebp + 0x250]
call fcn.10003cf0
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x1fc]
push eax
lea ecx, [ebp + 0x250]
call fcn.10004260
cmp dword [ebp + 0x268], 8
mov eax, dword [ebp + 0x254]
jae 0x1003485c
lea eax, [ebp + 0x254]
push eax
call fcn.1001a8a5
pop ecx
push ebx
push 1
lea ecx, [ebp + 0x250]
call fcn.10001fc0
push ebx
push 1
lea ecx, [ebp + 0x218]
call fcn.10001fc0
push ebx
push 1
lea ecx, [ebp + 0x1fc]
call fcn.10001fc0
xor esi, esi
inc esi
push dword [ebp - 0x1c]
call fcn.10054d78
pop ecx
push ebx
push esi
lea ecx, [ebp + 0x11c]
call fcn.10001fc0
push ebx
push esi
lea ecx, [ebp + 0xe4]
call fcn.10001fc0
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 6
call fcn.10005a2e
push ebx
push esi
lea ecx, [ebp + 0xc8]
call fcn.10001f70
push ebx
push esi
lea ecx, [ebp + 0x90]
call fcn.10001f70
push ebx
push esi
lea ecx, [ebp + 0x18c]
call fcn.10001fc0
push ebx
push esi
lea ecx, [ebp + 0x100]
call fcn.10001f70
push ebx
push esi
lea ecx, [ebp + 0xac]
call fcn.10001fc0
push ebx
push esi
lea ecx, [ebp + 0x1c4]
call fcn.10001fc0
push ebx
push esi
lea ecx, [ebp + 0x138]
call fcn.10001fc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x730]
xor ecx, ebp
call fcn.100773e8
add ebp, 0x734
leave
ret 4