Function at 0x1001953a
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x118
mov eax, dword [0x100c51b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x100c6048]
mov dword [ebp - 0x108], eax
mov eax, 0x69e27419
mov esi, 0xa2757472
mov edi, 0xe37193c5
cmp eax, 0xa785d5f0
jle 0x10019597
cmp eax, 0xa785d5f1
je 0x100195a7
cmp eax, 0xe37193c5
je 0x100195c3
cmp eax, 0x69e27419
jne 0x1001956a
cmp dword [ebp - 0x108], 0
mov eax, 0xa785d5f1
cmove eax, edi
jmp 0x1001956a
cmp eax, 0xa181b4b4
je 0x100195e6
cmp eax, 0xa2757472
jne 0x1001956a
jmp 0x100195fa
mov eax, dword [0x100c6048]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
mov eax, 0xa181b4b4
cmove eax, esi
jmp 0x1001956a
push 0x100be4a0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.Wow64EnableWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100c6048], eax
mov eax, 0xa785d5f1
jmp 0x1001956a
mov eax, dword [ebp - 0x104]
push 0
call eax
mov eax, 0xa2757472
jmp 0x1001956a
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x110], ecx
mov eax, dword [ebp - 0x110]
mov byte [ecx], 1
mov byte [ecx + 1], 0xc
lea eax, [ebp - 0x3e]
mov byte [eax], 0x67
mov byte [eax + 1], 0x1d
mov byte [eax + 2], 0x7a
mov byte [eax + 3], 0x76
mov byte [eax + 4], 0x69
mov dl, 0x6d
mov byte [eax + 5], dl
mov byte [eax + 6], 0x66
mov byte [eax + 7], 0x62
mov byte [eax + 8], 0x7b
mov byte [eax + 9], 0x7c
mov dh, 0x72
mov byte [eax + 0xa], dh
mov byte [eax + 0xb], 0x5a
mov byte [eax + 0xc], 0x51
mov byte [eax + 0xd], 0x58
mov byte [eax + 0xe], 0x5e
mov byte [eax + 0xf], 0x50
mov bl, 0x59
mov byte [eax + 0x10], bl
mov bh, 4
mov byte [eax + 0x11], bh
mov byte [eax + 0x12], bh
mov byte [eax + 0x13], dl
mov byte [eax + 0x14], 0x54
mov byte [eax + 0x15], 0x41
mov byte [eax + 0x16], 0x5b
mov byte [eax + 0x17], 0x4b
mov byte [eax + 0x18], bl
mov dl, 0x4d
mov byte [eax + 0x19], dl
mov byte [eax + 0x1a], dl
mov byte [eax + 0x1b], 0x65
mov byte [eax + 0x1c], 0x6e
mov byte [eax + 0x1d], 0x79
mov byte [eax + 0x1e], 0x55
mov byte [eax + 0x1f], 0x7d
mov byte [eax + 0x20], 0x43
mov byte [eax + 0x21], dh
mov byte [eax + 0x22], 0x63
mov byte [eax + 0x23], dh
mov dl, 0x74
mov byte [eax + 0x24], dl
mov byte [eax + 0x25], 0x2d
mov byte [eax + 0x26], 0x71
mov byte [eax + 0x27], dl
mov byte [eax + 0x28], 0x7f
lea edx, [ebp - 0x15]
lea esi, [ebp - 0x13]
mov dword [ebp - 0x104], esi
mov edi, 0x14cf0488
mov esi, 0x2518aae
cmp edi, 0x2518aae
je 0x100196ef
cmp edi, 0x14cf0488
jne 0x100196cb
mov byte [edx], 0
inc edx
cmp edx, dword [ebp - 0x104]
mov edi, 0x14cf0488
cmove edi, esi
jmp 0x100196cb
mov dword [ebp - 0x108], ecx
mov ecx, dword [ebp - 0x108]
mov cl, byte [ecx]
mov byte [ebp - 0xfd], cl
mov esi, 0xc3ed7687
lea ebx, [ebp - 0xfc]
mov edi, 0xd0801592
mov edx, 0x728cc76c
cmp esi, 0xec49e85a
jg 0x10019741
cmp esi, 0xbcdbb00d
je 0x1001979d
cmp esi, 0xc3ed7687
je 0x100197bd
cmp esi, 0xd0801592
jne 0x10019718
jmp 0x10019808
cmp esi, 0xec49e85b
je 0x100197d1
cmp esi, 0x467d444
je 0x100197f2
cmp esi, 0x728cc76c
jne 0x10019718
mov esi, dword [ebp - 0xfc]
mov cl, byte [ebp + esi - 0x3e]
mov ebx, dword [ebp - 0xfc]
mov ch, byte [ebp - 0x3f]
inc bl
xor bl, ch
xor bl, cl
xor bl, 0x29
mov ecx, dword [ebp - 0xfc]
mov byte [ebp + ecx - 0x3e], bl
lea ebx, [ebp - 0xfc]
inc dword [ebp - 0xfc]
mov esi, 0x467d444
jmp 0x10019718
mov dword [ebp - 0x104], ebx
mov esi, dword [ebp - 0x104]
mov dword [ebp - 0xfc], 0
mov esi, 0x467d444
jmp 0x10019718
test byte [ebp - 0xfd], 1
mov esi, 0xbcdbb00d
cmove esi, edi
jmp 0x10019718
mov esi, dword [ebp - 0x104]
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], 0
mov esi, dword [ebp - 0x108]
mov byte [esi], 0
mov esi, 0xd0801592
jmp 0x10019718
mov esi, dword [ebp - 0xfc]
cmp esi, 0x29
mov esi, 0xec49e85b
cmovb esi, edx
jmp 0x10019718
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
setne byte [ebp - 0x109]
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
lea eax, [ebp - 0xc8]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
lea eax, [ebp - 0xf8]
mov dword [ebp - 0x120], eax
push eax
mov esi, esp
mov dword [esi], 0xe16fce3c
push eax
mov dword [ebp - 0x124], esp
mov eax, 0xe16fce3c
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 0xf22b795a
jg 0x10019a10
cmp eax, 0xd741c781
jle 0x10019a41
cmp eax, 0xd741c782
je 0x10019b48
cmp eax, 0xe16fce3c
je 0x10019b76
cmp eax, 0xe7807db4
jne 0x1001a369
mov byte [ebp - 0xc8], 1
mov byte [ebp - 0xc7], 0xc
mov byte [ebp - 0xc6], 0x66
mov byte [ebp - 0xc5], 0x1c
mov byte [ebp - 0xc4], 0x7b
mov byte [ebp - 0xc3], 0x77
mov byte [ebp - 0xc2], 0x68
mov al, 0x6c
mov byte [ebp - 0xc1], al
mov byte [ebp - 0xc0], 0x67
mov cl, 0x63
mov byte [ebp - 0xbf], cl
mov dl, 0x7a
mov byte [ebp - 0xbe], dl
mov byte [ebp - 0xbd], 0x7d
mov byte [ebp - 0xbc], 0x73
mov byte [ebp - 0xbb], 0x5b
mov byte [ebp - 0xba], 0x50
mov byte [ebp - 0xb9], 0x59
mov byte [ebp - 0xb8], 0x5f
mov byte [ebp - 0xb7], 0x51
mov byte [ebp - 0xb6], 0x58
mov ah, 5
mov byte [ebp - 0xb5], ah
mov byte [ebp - 0xb4], ah
mov byte [ebp - 0xb3], al
mov byte [ebp - 0xb2], 0x75
mov byte [ebp - 0xb1], 0x60
mov byte [ebp - 0xb0], dl
mov byte [ebp - 0xaf], 0x6a
mov ah, pe_nt_image_headers32
mov byte [ebp - 0xae], ah
mov byte [ebp - 0xad], al
mov byte [ebp - 0xac], al
mov byte [ebp - 0xab], 0x64
mov byte [ebp - 0xaa], 0x6f
mov byte [ebp - 0xa9], ah
mov byte [ebp - 0xa8], 0x54
mov byte [ebp - 0xa7], 0x7c
mov byte [ebp - 0xa6], 0x52
mov byte [ebp - 0xa5], 0x62
mov byte [ebp - 0xa4], cl
mov byte [ebp - 0xa3], 0x6d
mov byte [ebp - 0xa2], 0x2f
mov byte [ebp - 0xa1], 0x71
mov byte [ebp - 0xa0], dl
mov byte [ebp - 0x9f], 0x7f
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x104], eax
mov ecx, 0x4ced1638
lea eax, [ebp - 0x9e]
cmp ecx, 0x31cf28a5
je 0x10019b97
cmp ecx, 0x4ced1638
jne 0x100199e3
mov byte [eax], 0
inc eax
cmp eax, dword [ebp - 0x104]
mov ecx, 0x4ced1638
mov edx, 0x31cf28a5
cmove ecx, edx
jmp 0x100199e3
cmp eax, 0x469922a4
jle 0x10019b32
cmp eax, 0x469922a5
je 0x10019cc6
cmp eax, 0x5f6297d7
je 0x10019b48
cmp eax, 0x6d680243
je 0x10019b48
jmp 0x1001a369
cmp eax, 0x808fc5bf
je 0x10019cdf
cmp eax, 0xb4d25f3f
jne 0x1001a362
mov byte [ebp - 0x6c], 1
mov byte [ebp - 0x6b], 0xc
mov byte [ebp - 0x6a], 0x68
mov byte [ebp - 0x69], 0x12
mov byte [ebp - 0x68], 0x75
mov byte [ebp - 0x67], 0x79
mov byte [ebp - 0x66], 0x66
mov al, 0x62
mov byte [ebp - 0x65], al
mov byte [ebp - 0x64], 0x69
mov byte [ebp - 0x63], 0x6d
mov cl, 0x74
mov byte [ebp - 0x62], cl
mov byte [ebp - 0x61], 0x73
mov dl, 0x7d
mov byte [ebp - 0x60], dl
mov byte [ebp - 0x5f], 0x55
mov byte [ebp - 0x5e], 0x5e
mov byte [ebp - 0x5d], 0x57
mov byte [ebp - 0x5c], 0x51
mov byte [ebp - 0x5b], 0x5f
mov byte [ebp - 0x5a], 0x56
mov ah, 0xb
mov byte [ebp - 0x59], ah
mov byte [ebp - 0x58], ah
mov byte [ebp - 0x57], al
mov byte [ebp - 0x56], 0x7b
mov byte [ebp - 0x55], 0x6e
mov byte [ebp - 0x54], cl
mov byte [ebp - 0x53], 0x64
mov cl, 0x76
mov byte [ebp - 0x52], cl
mov byte [ebp - 0x51], al
mov byte [ebp - 0x50], al
mov byte [ebp - 0x4f], 0x6a
mov byte [ebp - 0x4e], 0x61
mov byte [ebp - 0x4d], cl
mov byte [ebp - 0x4c], 0x5a
mov byte [ebp - 0x4b], 0x72
mov byte [ebp - 0x4a], 0x58
mov byte [ebp - 0x49], 0x4e
mov byte [ebp - 0x48], 0x27
mov byte [ebp - 0x47], dl
mov byte [ebp - 0x46], cl
mov byte [ebp - 0x45], 0x7f
lea eax, [ebp - 0x42]
mov dword [ebp - 0x104], eax
mov ecx, 0xd8c9895a
lea eax, [ebp - 0x44]
cmp ecx, 0xb1c42818
je 0x10019e4e
cmp ecx, 0xd8c9895a
jne 0x10019b05
mov byte [eax], 0
inc eax
cmp eax, dword [ebp - 0x104]
mov ecx, 0xd8c9895a
mov edx, 0xb1c42818
cmove ecx, edx
jmp 0x10019b05
cmp eax, 0xf22b795b
je 0x10019f68
cmp eax, 0x24cb3e5b
jne 0x1001a369
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x110]
mov dword [esi], 0x469922a5
mov eax, 0x469922a5
jmp 0x10019872
mov eax, dword [ebp - 0x120]
cmp byte [ebp - 0x109], 0
mov eax, 0xb4d25f3f
mov ecx, 0x24cb3e5b
cmovne eax, ecx
mov dword [esi], eax
jmp 0x10019872
lea eax, [ebp - 0xc8]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
mov al, byte [eax]
mov byte [ebp - 0xfd], al
mov eax, 0x923dd411
cmp eax, 0xf9e41db5
jg 0x10019c32
cmp eax, 0x923dd411
je 0x10019c66
cmp eax, 0xf19b1ce9
je 0x1001a0a4
cmp eax, 0xf7b3623a
jne 0x10019bb6
mov eax, dword [ebp - 0xfc]
mov cl, byte [ebp + eax - 0xc6]
mov edx, dword [ebp - 0xfc]
mov al, byte [ebp - 0xc7]
movzx edi, al
lea ebx, [edx + 1]
mov eax, 0xfe
sub eax, edx
and eax, edi
not edi
and edi, ebx
lea ebx, [ebp - 0xfc]
or eax, edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
xor al, cl
xor al, 0x28
mov ecx, dword [ebp - 0xfc]
mov byte [ebp + ecx - 0xc6], al
inc dword [ebp - 0xfc]
mov eax, 0x5b89a4bc
jmp 0x10019bb6
cmp eax, 0xf9e41db6
je 0x10019c7f
cmp eax, 0x59083059
je 0x10019c9f
cmp eax, 0x5b89a4bc
jne 0x10019bb6
mov eax, dword [ebp - 0xfc]
cmp eax, 0x28
mov eax, 0x59083059
mov ecx, 0xf7b3623a
cmovb eax, ecx
jmp 0x10019bb6
test byte [ebp - 0xfd], 1
mov eax, 0xf9e41db6
mov ecx, 0xf19b1ce9
cmove eax, ecx
jmp 0x10019bb6
mov dword [ebp - 0x104], ebx
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xfc], 0
mov eax, 0x5b89a4bc
jmp 0x10019bb6
mov eax, dword [ebp - 0x104]
mov byte [ebp - 0x9e], 0
mov byte [ebp - 0x9d], 0
mov eax, dword [ebp - 0x108]
mov byte [eax], 0
mov eax, 0xf19b1ce9
jmp 0x10019bb6
mov dword [esi], 0x81ec1f73
mov eax, dword [ebp - 0x124]
mov byte [eax], 1
mov eax, 0x81ec1f73
jmp 0x10019872
mov byte [ebp - 0xf8], 1
mov byte [ebp - 0xf7], 0xc
mov byte [ebp - 0xf6], 0x67
mov byte [ebp - 0xf5], 0x1d
mov byte [ebp - 0xf4], 0x7a
mov byte [ebp - 0xf3], 0x76
mov byte [ebp - 0xf2], 0x69
mov al, 0x6d
mov byte [ebp - 0xf1], al
mov byte [ebp - 0xf0], 0x66
mov cl, 0x62
mov byte [ebp - 0xef], cl
mov dl, 0x7b
mov byte [ebp - 0xee], dl
mov byte [ebp - 0xed], 0x7c
mov byte [ebp - 0xec], 0x72
mov byte [ebp - 0xeb], 0x5a
mov byte [ebp - 0xea], 0x51
mov byte [ebp - 0xe9], 0x58
mov byte [ebp - 0xe8], 0x5e
mov byte [ebp - 0xe7], 0x50
mov byte [ebp - 0xe6], 0x59
mov ah, 4
mov byte [ebp - 0xe5], ah
mov byte [ebp - 0xe4], ah
mov byte [ebp - 0xe3], al
mov ah, 0x74
mov byte [ebp - 0xe2], ah
mov byte [ebp - 0xe1], 0x61
mov byte [ebp - 0xe0], dl
mov byte [ebp - 0xdf], 0x6b
mov dl, 0x79
mov byte [ebp - 0xde], dl
mov byte [ebp - 0xdd], al
mov byte [ebp - 0xdc], al
mov byte [ebp - 0xdb], 0x65
mov al, 0x6e
mov byte [ebp - 0xda], al
mov byte [ebp - 0xd9], dl
mov byte [ebp - 0xd8], 0x55
mov byte [ebp - 0xd7], 0x7d
mov byte [ebp - 0xd6], 0x52
mov byte [ebp - 0xd5], al
mov byte [ebp - 0xd4], cl
mov byte [ebp - 0xd3], 0x64
mov byte [ebp - 0xd2], 0x6f
mov byte [ebp - 0xd1], 0x2d
mov byte [ebp - 0xd0], 0x71
mov byte [ebp - 0xcf], ah
mov byte [ebp - 0xce], 0x7f
lea eax, [ebp - 0xcb]
mov dword [ebp - 0x104], eax
mov ecx, 0x14cf0488
lea eax, [ebp - 0xcd]
cmp ecx, 0x2518aae
je 0x1001a0be
cmp ecx, 0x14cf0488
jne 0x10019e21
mov byte [eax], 0
inc eax
cmp eax, dword [ebp - 0x104]
mov ecx, 0x14cf0488
mov edx, 0x2518aae
cmove ecx, edx
jmp 0x10019e21
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
mov al, byte [eax]
mov byte [ebp - 0xfd], al
mov eax, 0x6ee68a7d
cmp eax, 0x53da1416
jg 0x10019ed6
cmp eax, 0x96f770b8
je 0x10019f0c
cmp eax, 0xe5e810c4
je 0x10019f2c
cmp eax, 0x2de97b51
jne 0x10019e6a
mov eax, dword [ebp - 0xfc]
mov cl, byte [ebp + eax - 0x6a]
mov eax, dword [ebp - 0xfc]
mov dl, byte [ebp - 0x6b]
mov edi, 0x7e
sub edi, eax
and edi, 0x4f
inc eax
and eax, 0xb0
or eax, edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
xor al, dl
xor al, cl
xor al, 0x69
mov ecx, dword [ebp - 0xfc]
mov byte [ebp + ecx - 0x6a], al
inc dword [ebp - 0xfc]
mov eax, 0x731e6744
jmp 0x10019e6a
cmp eax, 0x53da1417
je 0x1001a1d5
cmp eax, 0x731e6744
je 0x10019f4d
cmp eax, 0x6ee68a7d
jne 0x10019e6a
test byte [ebp - 0xfd], 1
mov eax, 0x96f770b8
mov ecx, 0x53da1417
cmove eax, ecx
jmp 0x10019e6a
mov dword [ebp - 0x104], ebx
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xfc], 0
mov eax, 0x731e6744
jmp 0x10019e6a
mov eax, dword [ebp - 0x104]
mov byte [ebp - 0x44], 0
mov byte [ebp - 0x43], 0
mov eax, dword [ebp - 0x108]
mov byte [eax], 0
mov eax, 0x53da1417
jmp 0x10019e6a
mov eax, dword [ebp - 0xfc]
cmp eax, 0x26
mov eax, 0xe5e810c4
mov ecx, 0x2de97b51
cmovb eax, ecx
jmp 0x10019e6a
mov byte [ebp - 0x9c], 1
mov byte [ebp - 0x9b], 0xc
mov byte [ebp - 0x9a], 0x67
mov byte [ebp - 0x99], 0x1d
mov byte [ebp - 0x98], 0x7a
mov byte [ebp - 0x97], 0x76
mov byte [ebp - 0x96], 0x69
mov al, 0x6d
mov byte [ebp - 0x95], al
mov byte [ebp - 0x94], 0x66
mov byte [ebp - 0x93], 0x62
mov cl, 0x7b
mov byte [ebp - 0x92], cl
mov byte [ebp - 0x91], 0x7c
mov ah, 0x72
mov byte [ebp - 0x90], ah
mov byte [ebp - 0x8f], 0x5a
mov byte [ebp - 0x8e], 0x51
mov byte [ebp - 0x8d], 0x58
mov byte [ebp - 0x8c], 0x5e
mov byte [ebp - 0x8b], 0x50
mov byte [ebp - 0x8a], 0x59
mov dl, 4
mov byte [ebp - 0x89], dl
mov byte [ebp - 0x88], dl
mov byte [ebp - 0x87], al
mov dl, 0x74
mov byte [ebp - 0x86], dl
mov byte [ebp - 0x85], 0x61
mov byte [ebp - 0x84], cl
mov byte [ebp - 0x83], 0x6b
mov cl, 0x79
mov byte [ebp - 0x82], cl
mov byte [ebp - 0x81], al
mov byte [ebp - 0x80], al
mov al, 0x65
mov byte [ebp - 0x7f], al
mov byte [ebp - 0x7e], 0x6e
mov byte [ebp - 0x7d], cl
mov byte [ebp - 0x7c], 0x55
mov byte [ebp - 0x7b], 0x7d
mov byte [ebp - 0x7a], 0x49
mov byte [ebp - 0x79], 0x68
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], ah
mov byte [ebp - 0x76], al
mov byte [ebp - 0x75], 0x2d
mov byte [ebp - 0x74], 0x71
mov byte [ebp - 0x73], dl
mov byte [ebp - 0x72], 0x7f
lea eax, [ebp - 0x6f]
mov dword [ebp - 0x104], eax
mov ecx, 0x14cf0488
lea eax, [ebp - 0x71]
cmp ecx, 0x2518aae
je 0x1001a1ec
cmp ecx, 0x14cf0488
jne 0x1001a077
mov byte [eax], 0
inc eax
cmp eax, dword [ebp - 0x104]
mov ecx, 0x14cf0488
mov edx, 0x2518aae
cmove ecx, edx
jmp 0x1001a077
lea eax, [ebp - 0xc6]
push eax
call edi
test eax, eax
mov eax, 0x5f6297d7
mov ecx, 0x808fc5bf
jmp 0x1001a358
lea eax, [ebp - 0xf8]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
mov al, byte [eax]
mov byte [ebp - 0xfd], al
mov eax, 0xc3ed7687
cmp eax, 0xec49e85a
jg 0x1001a102
cmp eax, 0xbcdbb00d
je 0x1001a15a
cmp eax, 0xc3ed7687
je 0x1001a17a
cmp eax, 0xd0801592
jne 0x1001a0dd
jmp 0x1001a2fd
cmp eax, 0xec49e85b
je 0x1001a193
cmp eax, 0x467d444
je 0x1001a1ba
cmp eax, 0x728cc76c
jne 0x1001a0dd
mov eax, dword [ebp - 0xfc]
mov cl, byte [ebp + eax - 0xf6]
mov eax, dword [ebp - 0xfc]
mov dl, byte [ebp - 0xf7]
inc al
xor al, dl
xor al, cl
xor al, 0x29
mov ecx, dword [ebp - 0xfc]
mov byte [ebp + ecx - 0xf6], al
inc dword [ebp - 0xfc]
mov eax, 0x467d444
jmp 0x1001a0dd
mov dword [ebp - 0x104], ebx
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xfc], 0
mov eax, 0x467d444
jmp 0x1001a0dd
test byte [ebp - 0xfd], 1
mov eax, 0xbcdbb00d
mov ecx, 0xd0801592
cmove eax, ecx
jmp 0x1001a0dd
mov eax, dword [ebp - 0x104]
mov byte [ebp - 0xcd], 0
mov byte [ebp - 0xcc], 0
mov eax, dword [ebp - 0x108]
mov byte [eax], 0
mov eax, 0xd0801592
jmp 0x1001a0dd
mov eax, dword [ebp - 0xfc]
cmp eax, 0x29
mov eax, 0xec49e85b
mov ecx, 0x728cc76c
cmovb eax, ecx
jmp 0x1001a0dd
lea eax, [ebp - 0x6a]
push eax
call edi
test eax, eax
mov eax, 0xd741c782
mov ecx, 0xf22b795b
jmp 0x1001a358
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
mov al, byte [eax]
mov byte [ebp - 0xfd], al
mov eax, 0xc3ed7687
cmp eax, 0xec49e85a
jg 0x1001a230
cmp eax, 0xbcdbb00d
je 0x1001a288
cmp eax, 0xc3ed7687
je 0x1001a2a8
cmp eax, 0xd0801592
jne 0x1001a20b
jmp 0x1001a343
cmp eax, 0xec49e85b
je 0x1001a2c1
cmp eax, 0x467d444
je 0x1001a2e2
cmp eax, 0x728cc76c
jne 0x1001a20b
mov eax, dword [ebp - 0xfc]
mov cl, byte [ebp + eax - 0x9a]
mov eax, dword [ebp - 0xfc]
mov dl, byte [ebp - 0x9b]
inc al
xor al, dl
xor al, cl
xor al, 0x29
mov ecx, dword [ebp - 0xfc]
mov byte [ebp + ecx - 0x9a], al
inc dword [ebp - 0xfc]
mov eax, 0x467d444
jmp 0x1001a20b
mov dword [ebp - 0x104], ebx
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xfc], 0
mov eax, 0x467d444
jmp 0x1001a20b
test byte [ebp - 0xfd], 1
mov eax, 0xbcdbb00d
mov ecx, 0xd0801592
cmove eax, ecx
jmp 0x1001a20b
mov eax, dword [ebp - 0x104]
mov byte [ebp - 0x71], 0
mov byte [ebp - 0x70], 0
mov eax, dword [ebp - 0x108]
mov byte [eax], 0
mov eax, 0xd0801592
jmp 0x1001a20b
mov eax, dword [ebp - 0xfc]
cmp eax, 0x29
mov eax, 0xec49e85b
mov ecx, 0x728cc76c
cmovb eax, ecx
jmp 0x1001a20b
lea eax, [ebp - 0xf6]
push eax
call edi
test eax, eax
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x110]
mov eax, 0x469922a5
mov ecx, 0x81ec1f73
cmove eax, ecx
mov dword [esi], eax
mov ecx, dword [ebp - 0x124]
mov byte [ecx], 0
jmp 0x10019872
lea eax, [ebp - 0x9a]
push eax
call edi
test eax, eax
mov eax, 0x6d680243
mov ecx, 0xe7807db4
cmove eax, ecx
mov dword [esi], eax
jmp 0x10019872
cmp eax, 0x81ec1f73
je 0x1001a370
mov eax, dword [esi]
jmp 0x10019872
mov eax, dword [ebp - 0x124]
mov bl, byte [eax]
mov eax, dword [0x100c6048]
mov dword [ebp - 0x108], eax
mov eax, 0x69e27419
mov esi, 0xa2757472
mov edi, 0xe37193c5
cmp eax, 0xa785d5f0
jle 0x1001a3bf
cmp eax, 0xa785d5f1
je 0x1001a3cf
cmp eax, 0xe37193c5
je 0x1001a3eb
cmp eax, 0x69e27419
jne 0x1001a392
cmp dword [ebp - 0x108], 0
mov eax, 0xa785d5f1
cmove eax, edi
jmp 0x1001a392
cmp eax, 0xa181b4b4
je 0x1001a40e
cmp eax, 0xa2757472
jne 0x1001a392
jmp 0x1001a422
mov eax, dword [0x100c6048]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
mov eax, 0xa181b4b4
cmove eax, esi
jmp 0x1001a392
push 0x100be4a0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.Wow64EnableWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100c6048], eax
mov eax, 0xa785d5f1
jmp 0x1001a392
mov eax, dword [ebp - 0x104]
push 1
call eax
mov eax, 0xa2757472
jmp 0x1001a392
and bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100879aa
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret