Function at 0x1003a160
Capabilities:
Check for time delay via gettickcount
Check if file exists
Create pipe
Delete file
Get common file path
Read file on windows
Terminate process

Disassembly:
sub esp, 0xac4
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0xabc], eax
mov eax, dword [esp + 0xacc]
push ebx
push ebp
mov ebp, dword [esp + 0xad0]
push esi
push edi
xor ebx, ebx
push 0x40
mov dword [esp + 0x28], eax
xor eax, eax
lea ecx, [esp + 0x50]
push ebx
push ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x54], ebx
call fcn.100d4cc0
add esp, 0xc
push 0x103
xor eax, eax
lea edx, [esp + 0x1dd]
push ebx
push edx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov byte [esp + 0x1e4], bl
call fcn.100d4cc0
add esp, 0xc
push 0x103
lea eax, [esp + 0xd5]
push ebx
push eax
mov byte [esp + 0xdc], bl
call fcn.100d4cc0
add esp, 0xc
push 0x3ff
lea ecx, [esp + 0x6cd]
push ebx
push ecx
mov byte [esp + 0x6d4], bl
call fcn.100d4cc0
add esp, 0xc
push 0x104
lea edx, [esp + 0xd4]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0xd0]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003a240
sub eax, edx
je 0x1003a41e
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0xd0]
push eax
call esi
call fcn.1003a000
lea edi, [esp + 0x14]
mov ecx, 0x104
lea edx, [esp + 0xd0]
test eax, eax
je 0x1003a29f
call fcn.10004070
test eax, eax
jl 0x1003a2fe
mov eax, dword [esp + 0x14]
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax + 0xd0]
mov eax, str.yafu_x64.exe
call fcn.100040d0
jmp 0x1003a2fe
call fcn.10004070
test eax, eax
jl 0x1003a2c4
mov eax, dword [esp + 0x14]
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax + 0xd0]
mov eax, str.yafu_x32.exe
call fcn.100040d0
lea ecx, [esp + 0xd0]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1003a2fe
lea edx, [esp + 0xd0]
push edx
call esi
push str.yafu_x86.exe
mov esi, 0x104
lea ebx, [esp + 0xd4]
call fcn.10004120
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
xor ebx, ebx
push ebp
push str._factor__s_
mov ecx, 0x400
lea edi, [esp + 0x6d0]
call fcn.1001ef80
add esp, 8
push ebx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x3c], 0xc
mov dword [esp + 0x44], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1003a41e
lea eax, [esp + 0x1d8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x14]
mov ecx, 0x104
lea edx, [esp + 0x1d8]
call fcn.10004070
test eax, eax
jl 0x1003a38e
mov eax, dword [esp + 0x14]
mov edx, 0x104
sub edx, eax
lea ecx, [esp + eax + 0x1d8]
mov eax, str.siqs.dat
call fcn.100040d0
lea ecx, [esp + 0x1d8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x1d8]
push edx
call esi
lea eax, [esp + 0x48]
push eax
mov dword [esp + 0x4c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x18]
xor ecx, ecx
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x88], eax
lea eax, [esp + 0x4c]
mov word [esp + 0x7c], cx
push eax
lea ecx, [esp + 0x1e0]
push ecx
lea edx, [esp + 0x6d4]
push edx
lea esi, [esp + 0xe0]
mov dword [esp + 0x84], 0x101
call fcn.1003a050
add esp, 0x10
test eax, eax
jne 0x1003a425
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x1c]
push ecx
call esi
xor eax, eax
jmp 0x1003a633
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x1003a43d
mov dword [0x101dd51c], eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov ecx, dword [0x1012efb4]
mov edx, dword [0x1012efb8]
mov esi, eax
mov eax, dword [str.factors_found]
mov dword [esp + 0x90], eax
mov eax, dword [0x1012efbc]
mov dword [esp + 0x9c], eax
xor eax, eax
mov dword [esp + 0x94], ecx
mov ecx, dword [0x1012efc0]
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov ax, word [0x1012efc8]
push 0x3e7
mov dword [esp + 0xa4], ecx
mov dword [esp + 0x9c], edx
mov edx, dword [str.ans_]
mov word [esp + 0xb8], ax
xor eax, eax
lea ecx, [esp + 0x2e5]
push ebx
push ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0xbc], edx
mov dword [esp + 0xc2], eax
mov dword [esp + 0xc6], eax
mov dword [esp + 0xca], eax
mov dword [esp + 0xce], eax
mov dword [esp + 0xd2], eax
mov dword [esp + 0xd6], eax
mov word [esp + 0xda], ax
mov byte [esp + 0x2ec], bl
call fcn.100d4cc0
add esp, 0xc
call ebp
sub eax, esi
cmp eax, dword [0x101dd38c]
ja 0x1003a5f0
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push 0x3e8
lea edx, [esp + 0x2e4]
push ebx
push edx
call fcn.100d4cc0
mov edx, dword [esp + 0x28]
add esp, 0xc
push ebx
lea eax, [esp + 0x24]
push eax
push 0x3e8
lea ecx, [esp + 0x2ec]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1003a5f0
push 0x1012ef44
lea eax, [esp + 0x2e4]
push eax
call edi
cmp eax, ebx
je 0x1003a5d8
lea ecx, [esp + 0x2e0]
sub ecx, eax
add dword [esp + 0x20], ecx
lea ecx, [esp + 0x90]
lea esi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x1003a590
sub ecx, esi
cmp dword [esp + 0x20], ecx
jbe 0x1003a5d4
lea edx, [esp + 0x90]
push edx
push eax
call edi
cmp eax, ebx
je 0x1003a5d4
lea ecx, [esp + 0x90]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x1003a5b8
sub ecx, esi
lea esi, [eax + ecx + 4]
lea eax, [esp + 0xb0]
push eax
push esi
call edi
cmp eax, ebx
jne 0x1003a64c
mov esi, dword [esp + 0x14]
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebp
sub eax, esi
cmp eax, dword [0x101dd38c]
jbe 0x1003a523
mov edx, dword [esp + 0x38]
push 0xffffffffffffffff
push edx
mov dword [0x101dd51c], ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._siqs.dat
mov esi, 0x104
lea ebx, [esp + 0x1dc]
call fcn.10004120
mov ecx, ebx
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, edi
mov ecx, dword [esp + 0xacc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0xac4
ret
sub eax, esi
cmp eax, 0x1000
jae 0x1003a5f0
mov ecx, dword [esp + 0x24]
push eax
push esi
push ecx
call fcn.100d4950
add esp, 0xc
mov edi, 1
jmp 0x1003a607