Function at 0x1000b720
Capabilities:
Connect pipe
Encode data using xor
Get common file path

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x18]
lea ecx, [eax + 0x171]
add eax, 0xc7
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x24]
add ebx, 0x439
mov dword [esp + 0x10], eax
add ebp, 0xffffff7f
mov eax, dword [esp + 0x28]
push esi
push edi
lea edx, [ecx - 0x2e55]
mov dword [esp + 0x10], ebx
lea esi, [eax + 0xe4]
mov dword [esp + 0x30], edx
add eax, 0xfffffc0d
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], eax
lea edi, [ecx + 7]
lea eax, [ebx - 0x381]
mov dword [esp + 0x34], edi
cmp ebp, eax
jle 0x1000b971
sub esi, 0x388
xor edi, edi
mov dword [esp + 0x28], esi
mov esi, dword [esp + 0x24]
mov ecx, dword [0x100f26ac]
mov eax, dword [ecx + 0xf0]
sub dword [0x101414b4], eax
mov eax, dword [0x101414c0]
mov edx, dword [edi + eax]
add edi, 4
mov eax, dword [ecx + 0xb8]
xor eax, 1
imul eax, dword [esi + 0x11c]
mov dword [esi + 0x11c], eax
mov eax, dword [0x100f26ac]
mov ebx, dword [eax + 0x60]
mov ecx, dword [eax + 0xac]
mov eax, dword [eax + 0x7c]
imul ebx, edx
mov edx, ebx
shr edx, 0x18
mov byte [ecx + eax], dl
mov edx, ebx
mov eax, dword [0x100f26ac]
shr edx, 0x10
inc dword [eax + 0x7c]
mov eax, dword [0x100f26ac]
mov ecx, dword [eax + 0xac]
mov eax, dword [esi + 0x7c]
mov byte [ecx + eax], dl
mov edx, ebx
inc dword [esi + 0x7c]
mov ecx, dword [0x100f26ac]
mov eax, dword [esi + 0x40]
sub eax, 0xf7a2d
shr edx, 8
imul eax, dword [ecx + 0x78]
mov dword [ecx + 0x78], eax
mov eax, dword [esi + 0xd8]
sub eax, dword [esi + 0x100]
sub eax, 0x197520
add dword [esi + 0x78], eax
mov ecx, dword [0x100f26ac]
mov eax, dword [esi + 0xc0]
sub eax, 8
xor dword [ecx + 0x90], eax
mov eax, dword [0x100f26ac]
mov ecx, dword [eax + 0xac]
mov eax, dword [esi + 0x7c]
mov byte [ecx + eax], dl
inc dword [esi + 0x7c]
mov eax, dword [0x100f26ac]
mov ecx, dword [esi + 0x7c]
mov eax, dword [eax + 0xac]
mov byte [ecx + eax], bl
inc dword [esi + 0x7c]
cmp edi, 0x4ca4c
jl 0x1000b7a0
mov ebx, dword [esp + 0x28]
mov eax, ebp
mov ecx, dword [esp + 0x10]
xor eax, 0xc03
push esi
push eax
mov eax, ebx
xor eax, 0x6da
push eax
mov eax, ecx
xor eax, 0x481
push eax
lea eax, [ecx - 0x4d0]
push eax
mov eax, ebp
xor eax, 0x706
push eax
call fcn.1000fdb0
mov edi, dword [esp + 0x4c]
add eax, 0x2bb
push eax
push ebx
mov ebx, dword [esp + 0x50]
push edi
push esi
lea eax, [ebx + 0x2c0e]
push eax
mov eax, ebp
xor eax, 0x6b
push eax
call fcn.100012b0
mov ecx, ebx
xor edi, 0x7a9
xor ecx, 0x2d78
xor ebx, 0x27f1
add ecx, 0xf2
sub ebx, 0x27f1
add esp, 0x30
sub edi, 0x29f5
lea eax, [ecx - 0x2a6]
cmp ebx, eax
jge 0x1000b950
xor ecx, 0x4be
cmp edi, ecx
jge 0x1000b92b
mov eax, dword [0x1014148c]
add eax, 0xfffc7949
mov dword [esi + 0x60], eax
jmp 0x1000b950
mov eax, dword [0x100f26ac]
mov eax, dword [eax + 0x78]
xor eax, edi
sub dword [esi + 0x50], eax
mov eax, dword [0x10141484]
and eax, 0x2b9b
push eax
imul eax, edi, 0x29f5
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
add dword [esi + 0x60], 0xfffff85e
xor dword [0x10141478], 0xc83bd
xor ebp, 0x710
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
mov esi, dword [esp + 0x24]
mov eax, dword [esi + 0x9c]
or eax, dword [0x1014142c]
xor eax, edi
cmp ebx, eax
jbe 0x1000ba3a
mov eax, dword [esi + 0x5c]
imul eax, dword [0x101414b4]
or eax, dword [esi + 0x40]
cmp ebx, eax
ja 0x1000ba3a
mov edx, dword [0x100f26ac]
imul eax, dword [esi + 0xf0], 0x2e6a
push esi
and eax, dword [edx + 0xc4]
push eax
mov eax, dword [0x1014148c]
imul eax, edi
mov edi, dword [esp + 0x34]
push eax
mov eax, dword [0x1014141c]
add eax, 0xffffd465
add eax, dword [edx + 0xa0]
push eax
mov eax, dword [edx + 0x100]
imul eax, edi
and eax, dword [esp + 0x24]
push eax
mov eax, dword [edx + 0x110]
or eax, dword [esp + 0x2c]
push eax
call fcn.10006540
mov eax, dword [esi + 0x110]
add esp, 0x18
xor eax, dword [0x101414e4]
sub eax, dword [esp + 0x18]
push eax
mov eax, dword [0x100f26ac]
mov ecx, dword [eax + 0x1c]
or ecx, dword [eax + 0x14]
or ecx, edi
push ecx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ecx, dword [0x1014147c]
add ecx, dword [esp + 0x28]
xor ecx, dword [0x1014141c]
push ecx
lea ecx, [edi - 0x4d7]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
pop edi
xor ebp, 0x710
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret