Function at 0x1000f890
Capabilities:
Delete file
Get common file path
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10025499
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3ac
mov eax, dword [0x1004054c]
push ebx
push esi
push edi
cmp eax, 0x38
mov dword [ebp - 0x10], esp
je 0x1000f8ca
push 0x1000e0e0
call fcn.1000e160
jmp 0x1000f8d1
push 0
call fcn.10016c70
mov eax, dword [ebp + 0xc]
add esp, 4
xor ebx, ebx
push eax
mov dword [0x1004052c], ebx
mov dword [0x10040548], ebx
call fcn.10010ec0
add esp, 4
test eax, eax
jne 0x1000f911
push 0x30
push 0x1003a4c4
push 0x1003a488
push ebx
call dword [sym.imp.USER32.DLL_MessageBoxA]
mov dword [0x1004052c], 1
jmp 0x1000f91b
mov dword [0x10040548], 1
mov eax, dword [0x10039080]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], eax
mov ecx, dword [eax - 8]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x1000f966
cmp dword [eax - 0xc], ebx
jl 0x1000f940
lea ecx, [ebp - 0x14]
call fcn.10001900
jmp 0x1000f966
mov ecx, 0x1003d5c0
test ecx, ecx
jne 0x1000f94d
xor eax, eax
jmp 0x1000f958
push 0x1003d5c0
call dword [sym.imp.kernel32.dll_lstrlen]
push 0x1003d5c0
push eax
lea ecx, [ebp - 0x14]
call fcn.10001a10
lea edx, [ebp - 0x3b8]
push 0x104
push edx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
push 0x1003a47c
lea eax, [ebp - 0x3b8]
push 0x1003a478
push eax
lea ecx, [ebp - 0x14]
push 0x1003a470
push ecx
call fcn.100084e0
mov edx, dword [ebp - 0x14]
add esp, 0x14
push ebx
push 0x90
push 2
push ebx
push 3
push 0xc0000000
push edx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
or esi, 0xffffffff
cmp edi, esi
jne 0x1000fbcc
mov eax, dword [ebp - 0x14]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x1000f9ee
add eax, 0xfffffff4
push eax
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jg 0x1000f9ee
mov edx, dword [ebp - 0x14]
lea eax, [edx - 0xc]
push eax
call fcn.1001a644
add esp, 4
mov dword [ebp - 4], esi
call fcn.10008470
test eax, eax
je 0x1000fa57
call fcn.10005c70
cmp eax, ebx
je 0x1000fa57
push 0x1003ebc4
lea ecx, [ebp - 0x18]
call fcn.10019630
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xd
call fcn.10019ff0
lea ecx, [ebp - 0x18]
call fcn.10019f10
mov eax, dword [ebp - 0x18]
push 0x1003d5c0
push eax
call fcn.1001bd6c
add esp, 8
test eax, eax
je 0x1000fa4c
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.10018bf0
add esp, 4
cmp eax, ebx
je 0x1000fa6c
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x18]
call fcn.100019e0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x32
call fcn.1001a636
mov ebx, eax
mov ecx, 0xc
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
add esp, 4
lea edx, [ebp - 0x1b0]
stosw word es:[edi], ax
push 0x104
push edx
call fcn.1000e180
push eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
push 8
call fcn.1001a636
add esp, 4
mov dword [ebp + 0xc], eax
test eax, eax
mov byte [ebp - 4], 0xe
je 0x1000fabd
mov ecx, eax
call fcn.10004970
mov edi, eax
jmp 0x1000fabf
xor edi, edi
mov ecx, edi
mov byte [ebp - 4], 0xd
call fcn.100049b0
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x1b0]
push eax
push ecx
mov ecx, edi
call fcn.10004d20
mov ecx, edi
mov esi, eax
call fcn.10004a00
test edi, edi
je 0x1000faf1
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx]
test esi, esi
jne 0x1000fbbb
mov eax, dword [0x10039080]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xf
call fcn.10019470
mov ecx, dword [ebp - 0x28]
lea edx, [ebp - 0x2c]
push ecx
push 0x100391e8
push edx
call fcn.100084e0
mov edi, dword [ebp - 0x2c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 4], 0xd
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2c]
call fcn.100019e0
push 0x1f4
call fcn.1001a636
add esp, 4
mov esi, eax
mov ecx, 0x7d
xor eax, eax
mov edi, esi
push esi
push ebx
push 0x1003ebc4
rep stosd dword es:[edi], eax
call fcn.10016f50
mov ecx, dword [ebp + 8]
mov edx, dword [0x10040534]
push ecx
push edx
push esi
call fcn.100171e0
push esi
call fcn.1001a644
push ebx
call fcn.1001a644
add esp, 8
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.100019e0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push ebx
call fcn.1001a644
add esp, 4
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
lea eax, [ebp - 0x34]
push ebx
push eax
push 0x8800
push 0x1002c0ec
push edi
mov dword [ebp - 0x34], ebx
call dword [sym.imp.kernel32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
cmp esi, ebx
jne 0x1000fc15
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x1000fa57
add eax, 0xfffffff4
push eax
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
jmp 0x10010a38
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push 0xc8
mov esi, eax
call fcn.1001a636
mov ebx, eax
add esp, 4
mov ecx, 0x32
xor eax, eax
mov edi, ebx
mov dword [ebp - 0x18], ebx
test esi, esi
rep stosd dword es:[edi], eax
jne 0x1000fc72
push ebx
call fcn.1001a644
add esp, 4
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, dword [ebp - 0x14]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x1000fa57
add eax, 0xfffffff4
push eax
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
jmp 0x10010a38
push 0x1003a46c
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x1000fc89
push ebx
call eax
mov edi, eax
jmp 0x1000fc8c
mov edi, dword [ebp + 8]
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
cmp edi, 1
jne 0x1000fe9d
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.kernel32.dll_GetSystemTime]
mov edx, dword [ebp - 0x3a]
and edx, 0xffff
push edx
call fcn.1001af05
add esp, 4
call fcn.1001af12
cdq
mov ecx, 0x14
idiv ecx
cmp edx, 0x11
jne 0x1000fcf3
mov eax, dword [0x10040548]
test eax, eax
je 0x1000fcf3
mov edx, dword [ebp + 0xc]
push edx
call fcn.100114a0
add esp, 4
test eax, eax
jne 0x1000fcf3
push ebx
jmp 0x1001020a
push 0x32
call fcn.1001a636
mov ebx, eax
mov ecx, 0xc
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
add esp, 4
stosw word es:[edi], ax
lea eax, [ebp - 0x1b0]
push 0x104
push eax
call fcn.1000e180
push eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
push 8
call fcn.1001a636
mov ecx, eax
add esp, 4
mov dword [ebp + 0xc], ecx
test ecx, ecx
mov byte [ebp - 4], 2
je 0x1000fd44
call fcn.10004970
mov edi, eax
jmp 0x1000fd46
xor edi, edi
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.100049b0
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x1b0]
push ecx
push edx
mov ecx, edi
call fcn.10004d20
mov ecx, edi
mov esi, eax
call fcn.10004a00
test edi, edi
je 0x1000fd78
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
test esi, esi
jne 0x1000fe83
mov eax, dword [0x10039080]
mov dword [ebp + 0xc], eax
mov ecx, dword [eax - 8]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x1000fdca
mov ecx, dword [eax - 0xc]
test ecx, ecx
jl 0x1000fda4
lea ecx, [ebp + 0xc]
call fcn.10001900
jmp 0x1000fdca
mov ecx, 0x1003d5c0
test ecx, ecx
jne 0x1000fdb1
xor eax, eax
jmp 0x1000fdbc
push 0x1003d5c0
call dword [sym.imp.kernel32.dll_lstrlen]
push 0x1003d5c0
push eax
lea ecx, [ebp + 0xc]
call fcn.10001a10
mov edx, dword [ebp - 0x28]
lea eax, [ebp + 0xc]
push edx
push 0x100391e8
push eax
call fcn.100084e0
mov edx, dword [ebp + 0xc]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
mov byte [ebp - 4], 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x10039084]
lea ecx, [edx - 0xc]
cmp ecx, eax
je 0x1000fe2e
add edx, 0xfffffff4
push edx
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jg 0x1000fe2e
mov edx, dword [ebp + 0xc]
lea eax, [edx - 0xc]
push eax
call fcn.1001a644
add esp, 4
push 0x1f4
call fcn.1001a636
mov esi, eax
add esp, 4
mov ecx, 0x7d
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x18]
push ebx
push eax
call fcn.10016f50
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.1001a644
mov edx, dword [ebp + 8]
mov eax, dword [0x10040534]
add esp, 4
push edx
push eax
push esi
call fcn.10017850
push esi
call fcn.1001a644
push ebx
call fcn.1001a644
add esp, 8
jmp 0x10010212
mov eax, dword [ebp - 0x18]
push eax
call fcn.1001a644
push ebx
call fcn.1001a644
add esp, 8
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
call fcn.10008470
test eax, eax
je 0x1001027f
call fcn.10005c70
test eax, eax
je 0x10010271
mov ecx, dword [0x10039080]
mov edx, 0x1003ebc4
test edx, edx
mov dword [ebp + 0xc], ecx
je 0x1000ff18
mov eax, edx
shr eax, 0x10
jne 0x1000fee2
xor eax, eax
mov ecx, edx
mov ax, cx
lea ecx, [ebp + 0xc]
push eax
call fcn.100038f0
jmp 0x1000ff18
push 0x1003ebc4
call dword [sym.imp.kernel32.dll_lstrlen]
mov edi, eax
test edi, edi
je 0x1000ff18
push edi
lea ecx, [ebp + 0xc]
call fcn.100018a0
test eax, eax
je 0x1000ff18
mov ecx, edi
mov edi, dword [ebp + 0xc]
mov edx, ecx
mov esi, 0x1003ebc4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 4
call fcn.10019590
mov esi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.USER32.DLL_CharNextA]
movsx eax, byte [esi]
push eax
call fcn.1001bcdd
add esp, 4
test eax, eax
je 0x1000ff44
push esi
call ebx
mov esi, eax
jmp 0x1000ff2d
mov eax, dword [ebp + 0xc]
mov edi, dword [eax - 8]
sub edi, esi
add edi, eax
lea ecx, [edi + 1]
push ecx
push esi
push eax
call fcn.1001abd0
mov edx, dword [ebp + 0xc]
add esp, 0xc
lea ecx, [ebp + 0xc]
mov dword [edx - 8], edi
call fcn.10019590
mov edi, dword [ebp + 0xc]
xor esi, esi
mov al, byte [edi]
test al, al
je 0x1000ff9b
movsx eax, al
push eax
call fcn.1001bcdd
add esp, 4
test eax, eax
je 0x1000ff92
test esi, esi
jne 0x1000ff94
push edi
mov esi, edi
call ebx
mov edi, eax
jmp 0x1000ff6f
xor esi, esi
push edi
call ebx
mov edi, eax
jmp 0x1000ff6f
test esi, esi
je 0x1000ffaa
mov byte [esi], 0
mov eax, dword [ebp + 0xc]
sub esi, eax
mov dword [eax - 8], esi
mov ecx, dword [ebp + 0xc]
push 0x1003d5c0
push ecx
call fcn.1001bd6c
add esp, 8
test eax, eax
jne 0x10010005
mov edx, dword [ebp - 0x18]
push edx
call fcn.1001a644
mov eax, dword [ebp + 0xc]
mov edx, dword [0x10039084]
add esp, 4
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x1000fc4f
add eax, 0xfffffff4
push eax
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jg 0x1000fc4f
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
jmp 0x1000fc4f
mov eax, dword [ebp + 0xc]
push eax
call fcn.10018bf0
add esp, 4
test eax, eax
je 0x1001005b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.1001a644
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x10039084]
add esp, 4
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x1000fc4f
add eax, 0xfffffff4
push eax
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jg 0x1000fc4f
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff4
push eax
call fcn.1001a644
add esp, 4
jmp 0x1000fc4f
push 0x32
call fcn.1001a636
mov ebx, eax
mov ecx, 0xc
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
add esp, 4
stosw word es:[edi], ax
lea eax, [ebp - 0x1b0]
push 0x104
push eax
call fcn.1000e180
push eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
push 8
call fcn.1001a636
mov ecx, eax
add esp, 4
mov dword [ebp - 0x30], ecx
test ecx, ecx
mov byte [ebp - 4], 5
je 0x100100ac
call fcn.10004970
mov esi, eax
jmp 0x100100ae
xor esi, esi
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.100049b0
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x1b0]
push ecx
push edx
mov ecx, esi
call fcn.10004d20
mov ecx, esi
mov edi, eax
call fcn.10004a00
test esi, esi
je 0x100100e0
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
test edi, edi
jne 0x10010257
mov eax, dword [0x10039080]
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax - 8]
mov byte [ebp - 4], 6
test ecx, ecx
je 0x10010132
mov ecx, dword [eax - 0xc]
test ecx, ecx
jl 0x1001010c
lea ecx, [ebp - 0x1c]
call fcn.10001900
jmp 0x10010132
mov ecx, 0x1003d5c0
test ecx, ecx
jne 0x10010119
xor eax, eax
jmp 0x10010124
push 0x1003d5c0
call dword [sym.imp.kernel32.dll_lstrlen]
push 0x1003d5c0
push eax
lea ecx, [ebp - 0x1c]
call fcn.10001a10
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
push edx
push 0x100391e8
push eax
call fcn.100084e0
mov edx, dword [ebp - 0x1c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
mov byte [ebp - 4], 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x10039084]
lea ecx, [edx - 0xc]
cmp ecx, eax
je 0x10010196
add edx, 0xfffffff4
push edx
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jg 0x10010196
mov edx, dword [ebp - 0x1c]
lea eax, [edx - 0xc]
push eax
call fcn.1001a644
add esp, 4
push 0x1f4
call fcn.1001a636
add esp, 4
mov esi, eax
mov ecx, 0x7d
xor eax, eax
mov edi, esi
push esi
push ebx
push 0x1003ebc4
rep stosd dword es:[edi], eax
call fcn.10016f50
mov eax, dword [ebp + 8]
mov ecx, dword [0x10040534]
push eax
push ecx
push esi
call fcn.100171e0
mov edx, dword [ebp - 0x18]
push edx
call fcn.1001a644
push esi
call fcn.1001a644
push ebx
call fcn.1001a644
mov eax, dword [ebp + 0xc]
mov edx, dword [0x10039084]
add esp, 0xc
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x10010212
add eax, 0xfffffff4
push eax
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jg 0x10010212
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
mov eax, dword [ebp - 0x14]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x1001023f
add eax, 0xfffffff4
push eax
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jg 0x1001023f
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x18]
push eax
call fcn.1001a644
push ebx
call fcn.1001a644
add esp, 8
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
push ebx
call fcn.1001a644
add esp, 4
jmp 0x1000fc4f
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.10010ec0
add esp, 4
test eax, eax
jne 0x100102a7
push 0x30
push 0x1003a4c4
push 0x1003a44c
push eax
call dword [sym.imp.USER32.DLL_MessageBoxA]
jmp 0x1000fc4f
mov eax, dword [0x10040528]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x100102ea
mov ecx, dword [eax - 0xc]
test ecx, ecx
jl 0x100102c6
mov ecx, 0x10040528
call fcn.10001900
jmp 0x100102ea
mov eax, 0x1003d5c0
test eax, eax
je 0x100102da
push 0x1003d5c0
call dword [sym.imp.kernel32.dll_lstrlen]
push 0x1003d5c0
push eax
mov ecx, 0x10040528
call fcn.10001a10
lea ecx, [ebp - 0x2b4]
push 0x104
push ecx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
push 0x1003a440
lea edx, [ebp - 0x2b4]
push 0x1003a478
push edx
push 0x1003a470
push 0x10040528
call fcn.100084e0
mov eax, dword [0x10039080]
add esp, 0x14
mov dword [ebp - 0x20], eax
push 0x1003a434
lea ecx, [ebp - 0x2b4]
push 0x1003a478
push ecx
lea edx, [ebp - 0x20]
push 0x1003a470
push edx
mov byte [ebp - 4], 7
call fcn.100084e0
mov eax, dword [ebp - 0x20]
add esp, 0x14
push 0
push 0x90
push 2
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100103b6
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.1001a644
mov eax, dword [ebp - 0x20]
mov ecx, dword [0x10039084]
add esp, 4
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x1000fc4f
add eax, 0xfffffff4
push eax
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jg 0x1000fc4f
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff4
push eax
call fcn.1001a644
add esp, 4
jmp 0x1000fc4f
lea eax, [ebp - 0x30]
push 0
push eax
push 0x1288
push 0x100348ec
push edi
mov dword [ebp - 0x30], 0
call dword [sym.imp.kernel32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.kernel32.dll_CloseHandle]
test esi, esi
jne 0x10010427
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.1001a644
mov eax, dword [ebp - 0x20]
mov ecx, dword [0x10039084]
add esp, 4
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x1000fc4f
add eax, 0xfffffff4
push eax
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jg 0x1000fc4f
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff4
push eax
call fcn.1001a644
add esp, 4
jmp 0x1000fc4f
mov eax, dword [0x10039080]
test ebx, ebx
mov dword [ebp - 0x24], eax
je 0x1001047c
mov ecx, ebx
shr ecx, 0x10
jne 0x1001044d
and ebx, 0xffff
lea ecx, [ebp - 0x24]
mov eax, ebx
push eax
call fcn.100038f0
jmp 0x1001047c
push ebx
call dword [sym.imp.kernel32.dll_lstrlen]
mov edi, eax
test edi, edi
je 0x1001047c
push edi
lea ecx, [ebp - 0x24]
call fcn.100018a0
test eax, eax
je 0x1001047c
mov ecx, edi
mov edi, dword [ebp - 0x24]
mov edx, ecx
mov esi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x10039080]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x24]
mov bl, 9
mov byte [ebp - 4], bl
mov edx, dword [ecx - 8]
test edx, edx
jne 0x10010553
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x100104c5
mov esi, dword [sym.imp.kernel32.dll_InterlockedDecrement]
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x100104cb
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
jmp 0x100104cb
mov esi, dword [sym.imp.kernel32.dll_InterlockedDecrement]
mov eax, dword [ebp - 0x24]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x100104f4
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x100104f4
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
mov eax, dword [ebp - 0x20]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x1001051d
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x1001051d
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
mov eax, dword [ebp - 0x14]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x1000fa57
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x1000fa57
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
jmp 0x1000fa57
push 0x1003a430
push ecx
call fcn.1001bc48
add esp, 8
test eax, eax
je 0x10010571
sub eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
jne 0x10010630
mov eax, dword [ebp - 0x1c]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x100105a2
mov esi, dword [sym.imp.kernel32.dll_InterlockedDecrement]
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x100105a8
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
jmp 0x100105a8
mov esi, dword [sym.imp.kernel32.dll_InterlockedDecrement]
mov eax, dword [ebp - 0x24]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x100105d1
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x100105d1
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
mov eax, dword [ebp - 0x20]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x100105fa
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x100105fa
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
mov eax, dword [ebp - 0x14]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x1000fa57
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x1000fa57
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
jmp 0x1000fa57
inc eax
push 0x20
push eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x24]
call fcn.10019b00
mov esi, eax
mov eax, dword [esi]
mov ecx, dword [ebp - 0x1c]
cmp ecx, eax
mov byte [ebp - 4], 0xa
je 0x10010690
mov edx, dword [ecx - 0xc]
test edx, edx
jge 0x10010663
mov edx, dword [0x10039084]
add ecx, 0xfffffff4
cmp ecx, edx
jne 0x1001066a
mov ecx, dword [eax - 0xc]
test ecx, ecx
jge 0x10010679
mov ecx, dword [eax - 8]
push eax
push ecx
lea ecx, [ebp - 0x1c]
call fcn.10001a10
jmp 0x10010690
lea ecx, [ebp - 0x1c]
call fcn.10001900
mov eax, dword [esi]
mov dword [ebp - 0x1c], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.kernel32.dll_InterlockedIncrement]
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x10039084]
mov byte [ebp - 4], bl
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x100106c0
add eax, 0xfffffff4
push eax
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jg 0x100106c0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff4
push eax
call fcn.1001a644
add esp, 4
mov edx, dword [ebp - 0x1c]
mov ecx, 0x19
xor eax, eax
lea edi, [ebp - 0xac]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0xac]
push ecx
push 0x1003a440
push edx
call fcn.10019170
mov ecx, dword [0x10040528]
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0xac]
push eax
push ecx
push edx
call fcn.10019050
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [0x10040528]
push ecx
push 0x1003a428
push 0x1003a420
push 0x10040524
call fcn.100084e0
add esp, 0x10
call fcn.10005c60
test eax, eax
je 0x10010b26
mov edx, dword [0x10039080]
mov eax, 0x1003ebc4
test eax, eax
mov dword [ebp + 0xc], edx
je 0x10010794
mov ecx, eax
shr ecx, 0x10
jne 0x1001075e
xor eax, eax
mov edx, 0x1003ebc4
mov ax, dx
lea ecx, [ebp + 0xc]
push eax
call fcn.100038f0
jmp 0x10010794
push 0x1003ebc4
call dword [sym.imp.kernel32.dll_lstrlen]
mov edi, eax
test edi, edi
je 0x10010794
push edi
lea ecx, [ebp + 0xc]
call fcn.100018a0
test eax, eax
je 0x10010794
mov ecx, edi
mov edi, dword [ebp + 0xc]
mov eax, ecx
mov esi, 0x1003ebc4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0xb
call fcn.10019590
mov esi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.USER32.DLL_CharNextA]
movsx ecx, byte [esi]
push ecx
call fcn.1001bcdd
add esp, 4
test eax, eax
je 0x100107c0
push esi
call ebx
mov esi, eax
jmp 0x100107a9
mov eax, dword [ebp + 0xc]
mov edi, dword [eax - 8]
sub edi, esi
add edi, eax
lea edx, [edi + 1]
push edx
push esi
push eax
call fcn.1001abd0
mov eax, dword [ebp + 0xc]
add esp, 0xc
lea ecx, [ebp + 0xc]
mov dword [eax - 8], edi
call fcn.10019590
mov edi, dword [ebp + 0xc]
xor esi, esi
mov al, byte [edi]
test al, al
je 0x10010817
movsx ecx, al
push ecx
call fcn.1001bcdd
add esp, 4
test eax, eax
je 0x1001080e
test esi, esi
jne 0x10010810
push edi
mov esi, edi
call ebx
mov edi, eax
jmp 0x100107eb
xor esi, esi
push edi
call ebx
mov edi, eax
jmp 0x100107eb
test esi, esi
je 0x10010826
mov byte [esi], 0
mov eax, dword [ebp + 0xc]
sub esi, eax
mov dword [eax - 8], esi
mov edx, dword [ebp + 0xc]
push 0x1003d5c0
push edx
call fcn.1001bd6c
add esp, 8
test eax, eax
jne 0x1001093f
mov eax, dword [0x10040528]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.1001a644
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x10039084]
add esp, 4
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x10010888
mov esi, dword [sym.imp.kernel32.dll_InterlockedDecrement]
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x1001088e
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff4
push eax
call fcn.1001a644
add esp, 4
jmp 0x1001088e
mov esi, dword [sym.imp.kernel32.dll_InterlockedDecrement]
mov eax, dword [ebp - 0x1c]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x100108b7
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x100108b7
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
mov eax, dword [ebp - 0x24]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x100108e0
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x100108e0
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
mov eax, dword [ebp - 0x20]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x10010909
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x10010909
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
mov eax, dword [ebp - 0x14]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x1000fa57
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x1000fa57
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
jmp 0x1000fa57
mov eax, dword [ebp + 0xc]
push eax
call fcn.10018bf0
add esp, 4
test eax, eax
je 0x10010a54
mov ecx, dword [0x10040528]
push ecx
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov edx, dword [ebp - 0x18]
push edx
call fcn.1001a644
mov eax, dword [ebp + 0xc]
mov edx, dword [0x10039084]
add esp, 4
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x1001099d
mov esi, dword [sym.imp.kernel32.dll_InterlockedDecrement]
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x100109a3
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
jmp 0x100109a3
mov esi, dword [sym.imp.kernel32.dll_InterlockedDecrement]
mov eax, dword [ebp - 0x1c]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x100109cc
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x100109cc
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
mov eax, dword [ebp - 0x24]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x100109f5
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x100109f5
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
mov eax, dword [ebp - 0x20]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x10010a1e
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x10010a1e
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
mov eax, dword [ebp - 0x14]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x1000fa57
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x1000fa57
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff4
push edx
call fcn.1001a644
add esp, 4
jmp 0x1000fa57
mov edi, 0x1003ebc4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x10040528]
push ecx
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov edx, dword [ebp - 0x18]
push edx
call fcn.1001a644
mov eax, dword [ebp + 0xc]
mov edx, dword [0x10039084]
add esp, 4
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x10010abd
add eax, 0xfffffff4
push eax
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jg 0x10010abd
mov edx, dword [ebp + 0xc]
lea eax, [edx - 0xc]
push eax
call fcn.1001a644
add esp, 4
mov eax, dword [ebp - 0x1c]
mov edx, dword [0x10039084]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x10010aea
add eax, 0xfffffff4
push eax
call dword [sym.imp.kernel32.dll_InterlockedDecrement]
test eax, eax
jg 0x10010aea
mov edx, dword [ebp - 0x1c]
lea eax, [edx - 0xc]
push eax
call fcn.1001a644
add esp, 4
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 7
call fcn.100019e0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.100019e0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.100019e0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 8
call fcn.100019e0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 7
call fcn.100019e0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.100019e0
mov eax, dword [ebp - 0x18]
push eax
call fcn.1001a644
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
jmp 0x1000fa52