Function at 0x100050c0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
mov edx, 0x19
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x100050c7
call fcn.1001c480
mov edx, dword [0x10024160]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
mov edx, dword [0x10023eec]
push edx
call fcn.1001c320
push 0x10024044
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
mov edx, dword [0x10024044]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
lea edx, [0x10021670]
push edx
call fcn.1001c320
call fcn.10016182
add dword [esp], edx
call fcn.1000ab9e
call fcn.100161a0
and eax, eax
je 0x10005170
mov edx, dword [0x10024044]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
lea edx, [0x10021670]
push edx
call fcn.1001c320
push 0x10024044
call fcn.1001c380
jmp 0x100052af
push edx
call fcn.1001c2e0
pop edx
push eax
mov edx, dword [0x10024044]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
lea edx, str..ini
push edx
call fcn.1001c320
call fcn.10016182
add dword [esp], edx
call fcn.1000ab9e
call fcn.100161a0
and eax, eax
je 0x100051dd
mov edx, dword [0x10024044]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
lea edx, str..ini
push edx
call fcn.1001c320
push 0x10024044
call fcn.1001c380
jmp 0x100052af
push edx
call fcn.1001c2e0
pop edx
push eax
mov edx, dword [0x10024160]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
lea edx, str.PurePort.prefs
push edx
call fcn.1001c320
call fcn.10016182
add dword [esp], edx
call fcn.1000ab9e
call fcn.100161a0
and eax, eax
je 0x10005247
mov edx, dword [0x10024160]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
lea edx, str.PurePort.prefs
push edx
call fcn.1001c320
push 0x10024044
call fcn.1001c380
jmp 0x100052af
push edx
call fcn.1001c2e0
pop edx
push eax
mov edx, dword [0x10024160]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
lea edx, str.PurePort.ini
push edx
call fcn.1001c320
call fcn.10016182
add dword [esp], edx
call fcn.1000ab9e
call fcn.100161a0
and eax, eax
je 0x100052af
mov edx, dword [0x10024160]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
lea edx, str.PurePort.ini
push edx
call fcn.1001c320
push 0x10024044
call fcn.1001c380
push 1
push dword [0x10024044]
call fcn.10019224
mov ebx, eax
and ebx, ebx
jne 0x100052f7
push 0x10
lea eax, str.PurePortable
push eax
lea eax, str.Config_file_not_found_
push eax
push 0
call sub.USER32.dll_MessageBoxW
push 0
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_TerminateProcess
jmp 0x10006cbc
lea eax, str.Portable
push eax
call fcn.100195b4
mov ebx, eax
and ebx, ebx
jne 0x1000533d
push 0x10
lea eax, str.PurePortable
push eax
lea eax, str.Section__Portable__not_found_
push eax
push 0
call sub.USER32.dll_MessageBoxW
push 0
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_TerminateProcess
jmp 0x10006cbc
push 0
lea eax, str.MultiConfig
push eax
call fcn.100196a8
and eax, eax
je 0x10005364
mov edx, dword [esp + 8]
xor ecx, ecx
call fcn.10016130
jne 0x10005364
call fcn.100196dd
mov dword [esp + 0x38], 1
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push dword [0x10024140]
call fcn.100186e0
call fcn.1001c410
lea edx, str.rundll32
call fcn.10016120
mov ecx, eax
call fcn.10016130
je 0x100053aa
mov dword [esp + 0x34], 2
jmp 0x100053cf
lea eax, str.Portable
push eax
call fcn.100195b4
and eax, eax
je 0x100053cf
push 1
lea eax, str.ValidateProgram
push eax
call fcn.100196a8
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
je 0x100053ed
lea eax, str.ValidateProgram
push eax
call fcn.100195b4
and eax, eax
je 0x100053ed
mov eax, 1
jmp 0x100053ef
xor eax, eax
and eax, eax
je 0x10005566
call fcn.100196ef
call fcn.10019719
and eax, eax
je 0x10005566
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
call fcn.10019769
lea eax, [esp + 0x14]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
call fcn.100197ca
lea eax, [esp + 0x18]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push dword [esp + 0x18]
call fcn.100186e0
call fcn.1001c410
lea edx, str.programname
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
jne 0x10005497
lea edx, str.programfilename
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x100054d4
push 1
push dword [esp + 0x1c]
push dword [0x10024140]
call fcn.100142db
and eax, eax
je 0x100054c7
mov dword [esp + 0x38], 0
push dword [esp]
call fcn.100161a0
add esp, 4
jmp 0x10005566
mov dword [esp + 0x38], 1
jmp 0x1000555c
lea edx, str.reaction
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x100054fc
push dword [esp + 0x18]
call fcn.10018750
mov dword [esp + 0x3c], eax
jmp 0x1000555c
push edx
call fcn.1001c2e0
pop edx
push eax
push 1
push dword [esp + 0x20]
push edx
call fcn.1001c2e0
pop edx
push eax
push 0x1001f028
push dword [esp + 0x28]
push dword [0x1002406c]
call fcn.10007d1b
call fcn.10016182
add dword [esp], edx
call fcn.100142db
call fcn.100161a0
and eax, eax
je 0x10005554
mov dword [esp + 0x38], 0
push dword [esp]
call fcn.100161a0
add esp, 4
jmp 0x10005566
mov dword [esp + 0x38], 1
call fcn.100161a0
jmp 0x100053fc
cmp dword [esp + 0x30], 0
je 0x1000557d
mov ebx, dword [esp + 0x34]
cmp ebx, 1
jne 0x1000557d
mov eax, 1
jmp 0x1000557f
xor eax, eax
and eax, eax
je 0x100056d7
mov ebx, dword [esp + 0x38]
cmp ebx, 3
jne 0x100055f2
push edx
call fcn.1001c2e0
pop edx
push eax
push 0x10
lea eax, str.PurePortable
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
lea edx, str.Invalid_program
push edx
call fcn.1001c320
mov edx, dword [0x10024140]
push edx
call fcn.1001c320
lea edx, [0x1001f222]
push edx
call fcn.1001c320
call fcn.1001c410
push 0
call fcn.10016182
add dword [esp + 4], edx
call sub.USER32.dll_MessageBoxW
call fcn.100161a0
jmp 0x100056a1
mov ebx, dword [esp + 0x38]
cmp ebx, 1
je 0x10005606
mov ebx, dword [esp + 0x38]
cmp ebx, 2
je 0x10005606
jmp 0x1000560d
mov eax, 1
jmp 0x1000560f
xor eax, eax
and eax, eax
je 0x100056a1
mov dword [esp + 0x3c], 0x14
mov ebx, dword [esp + 0x38]
cmp ebx, 2
jne 0x10005630
add dword [esp + 0x3c], 0x100
push edx
call fcn.1001c2e0
pop edx
push eax
push dword [esp + 0x40]
lea eax, str.PurePortable
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
lea edx, str.Invalid_program
push edx
call fcn.1001c320
mov edx, dword [0x10024140]
push edx
call fcn.1001c320
lea edx, str.__rContinue_the_program_execution_
push edx
call fcn.1001c320
call fcn.1001c410
push 0
call fcn.10016182
add dword [esp + 4], edx
call sub.USER32.dll_MessageBoxW
call fcn.100161a0
mov dword [esp + 0x2c], eax
mov ebx, dword [esp + 0x2c]
cmp ebx, 6
je 0x100056a1
mov dword [esp + 0x38], 4
mov ebx, dword [esp + 0x38]
cmp ebx, 3
je 0x100056b5
mov ebx, dword [esp + 0x38]
cmp ebx, 4
je 0x100056b5
jmp 0x100056bc
mov eax, 1
jmp 0x100056be
xor eax, eax
and eax, eax
je 0x100056d2
push 0
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_TerminateProcess
jmp 0x10006cbc
push dword [0x1002406c]
lea eax, str.PP_PrgPath
push eax
call fcn.10019153
push dword [0x10023f50]
lea eax, str.PP_PrgDir
push eax
call fcn.10019153
push dword [0x10024140]
lea eax, str.PP_PrgName
push eax
call fcn.10019153
lea eax, str.EnvironmentVariables
push eax
call fcn.100195b4
and eax, eax
je 0x10005790
call fcn.100196ef
call fcn.10019719
and eax, eax
je 0x10005790
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
call fcn.10019769
lea eax, [esp + 0x14]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
call fcn.100197ca
lea eax, [esp + 0x1c]
push eax
call fcn.1001c380
mov edx, dword [esp + 0x18]
xor ecx, ecx
call fcn.10016130
jne 0x10005785
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.10019153
jmp 0x1000578e
push dword [esp + 0x10]
call fcn.1001913d
jmp 0x10005722
lea eax, str.EnvironmentVariables.SetPaths
push eax
call fcn.100195b4
and eax, eax
je 0x1000580a
call fcn.100196ef
call fcn.10019719
and eax, eax
je 0x1000580a
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
call fcn.10019769
lea eax, [esp + 0x14]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push 0x1001f028
push 0x1001f028
call fcn.10012366
lea eax, [esp + 0x1c]
push eax
call fcn.1001c380
mov edx, dword [esp + 0x18]
xor ecx, ecx
call fcn.10016130
jne 0x10005808
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.10019153
jmp 0x100057a5
lea eax, str.Portable
push eax
call fcn.100195b4
and eax, eax
je 0x10005b38
push 0
lea eax, str.Registry
push eax
call fcn.100196a8
mov dword [0x100240d8], eax
cmp dword [0x100240d8], 0
je 0x10005853
push 1
lea eax, str.RegistryShlwapi
push eax
call fcn.100196a8
mov dword [0x10024154], eax
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
lea eax, [0x1001f028]
push eax
lea eax, str.DataFile
push eax
call fcn.10019891
lea eax, [esp + 0x1c]
push eax
call fcn.1001c380
mov edx, dword [esp + 0x18]
xor ecx, ecx
call fcn.10016130
jne 0x100058ad
push edx
call fcn.1001c2e0
pop edx
push eax
push 0x1001f028
push dword [esp + 0x20]
call fcn.10012366
push 0x1002402c
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push dword [0x1002402c]
call fcn.10019e27
call fcn.1001c410
lea edx, [0x1001f028]
call fcn.10016120
mov ecx, eax
call fcn.10016130
je 0x1000590b
mov edx, dword [0x1002402c]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
lea edx, str..pport
push edx
call fcn.1001c320
push 0x1002402c
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
lea eax, [0x1001f028]
push eax
lea eax, str.InitFile
push eax
call fcn.10019891
lea eax, [esp + 0x1c]
push eax
call fcn.1001c380
mov edx, dword [esp + 0x18]
xor ecx, ecx
call fcn.10016130
jne 0x10005965
push edx
call fcn.1001c2e0
pop edx
push eax
push 0x1001f028
push dword [esp + 0x20]
call fcn.10012366
push 0x10023e88
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push dword [0x10023e88]
call fcn.10019e27
call fcn.1001c410
lea edx, [0x1001f028]
call fcn.10016120
mov ecx, eax
call fcn.10016130
je 0x100059c3
mov edx, dword [0x10023e88]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
lea edx, str..pport
push edx
call fcn.1001c320
push 0x10023e88
call fcn.1001c380
push 0
lea eax, str.RegistryDll
push eax
call fcn.100196a8
mov ebx, eax
cmp ebx, 1
jne 0x100059ec
lea edx, str.kernelbase
lea ecx, [0x10023ff4]
call fcn.10016008
push 0
lea eax, str.SpecialFolders
push eax
call fcn.100196a8
mov dword [0x10023ea4], eax
push 0
lea eax, str.EnvironmentVariables
push eax
call fcn.100196a8
mov dword [0x10024050], eax
push 0
lea eax, str.ProxyErrorMode
push eax
call fcn.100196a8
mov dword [0x100241f0], eax
push 0
lea eax, str.MinHookErrorMode
push eax
call fcn.100196a8
mov dword [0x100240cc], eax
push 0
lea eax, str.VolumeSerialNumber
push eax
call fcn.100196a8
mov dword [0x10023f9c], eax
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
lea eax, [0x1001f028]
push eax
lea eax, str.SpoofDate
push eax
call fcn.10019891
lea eax, [esp + 0x44]
push eax
call fcn.1001c380
push 0
lea eax, str.BlockWinInet
push eax
call fcn.100196a8
mov dword [0x100240b0], eax
push 0
lea eax, str.BlockWinHttp
push eax
call fcn.100196a8
mov dword [0x10023f00], eax
push 0
lea eax, str.BlockWinSocks
push eax
call fcn.100196a8
mov dword [0x10023fe8], eax
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
lea eax, [0x1001f028]
push eax
lea eax, str.CurrentDirectory
push eax
call fcn.10019891
lea eax, [esp + 0x1c]
push eax
call fcn.1001c380
push dword [esp + 0x18]
lea edx, [0x1001f028]
pop ecx
call fcn.10016130
jne 0x10005b38
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push 0x1001f028
push dword [esp + 0x24]
call fcn.10012366
call fcn.10016182
add dword [esp], edx
call fcn.10019eaa
call fcn.100161a0
mov dword [0x100241b8], 0
mov dword [0x10024214], 0
mov dword [0x10024158], 0
mov dword [0x10024030], 0
lea eax, str.Debug
push eax
call fcn.100195b4
and eax, eax
je 0x10005bc8
push 0
lea eax, str.Registry
push eax
call fcn.100196a8
mov dword [0x100241b8], eax
push 0
lea eax, str.SpecialFolders
push eax
call fcn.100196a8
mov dword [0x10024214], eax
push 0
lea eax, str.EnvironmentVariables
push eax
call fcn.100196a8
mov dword [0x10024158], eax
push 0
lea eax, str.Attach
push eax
call fcn.100196a8
mov dword [0x10024030], eax
mov ebx, dword [esp + 0x34]
cmp ebx, 2
jne 0x10005bd6
jmp 0x10006cbc
cmp dword [0x100240d8], 0
je 0x10005bf6
lea eax, str.Registry
push eax
call fcn.100195b4
and eax, eax
je 0x10005bf6
mov eax, 1
jmp 0x10005bf8
xor eax, eax
and eax, eax
je 0x10005d24
call fcn.100196ef
call fcn.10019719
and eax, eax
je 0x10005d24
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
call fcn.10019769
call fcn.10016182
add dword [esp], edx
call fcn.100186e0
lea eax, [esp + 0x14]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
call fcn.100197ca
call fcn.10016182
add dword [esp], edx
call fcn.100186e0
lea eax, [esp + 0x18]
push eax
call fcn.1001c380
mov edx, dword [esp + 0x14]
xor ecx, ecx
call fcn.10016130
jne 0x10005ca6
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.1000a61c
jmp 0x10005d1f
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push 9
push dword [esp + 0x1c]
call fcn.10018540
call fcn.1001c410
lea edx, str.software_
call fcn.10016120
mov ecx, eax
call fcn.10016130
je 0x10005d1f
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push 0xa
push dword [esp + 0x1c]
call fcn.10018690
lea eax, [esp + 0x18]
push eax
call fcn.1001c380
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.1000a61c
push dword [esp + 0x14]
push dword [esp + 0x18]
call fcn.1000a61c
jmp 0x10005c05
cmp dword [0x10023ea4], 0
jne 0x10005d38
cmp dword [0x10024050], 0
jne 0x10005d38
jmp 0x10005d3f
mov eax, 1
jmp 0x10005d41
xor eax, eax
and eax, eax
je 0x10005d5c
lea eax, str.SpecialFolders
push eax
call fcn.100195b4
and eax, eax
je 0x10005d5c
mov eax, 1
jmp 0x10005d5e
xor eax, eax
and eax, eax
je 0x100062b0
push edx
call fcn.1001c2e0
pop edx
push eax
push 0x1001f028
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
lea eax, [0x1001f028]
push eax
lea eax, str.AllDirs
push eax
call fcn.10019891
call fcn.10016182
add dword [esp], edx
call fcn.10012366
lea eax, [esp + 0x1c]
push eax
call fcn.1001c380
mov edx, dword [esp + 0x18]
xor ecx, ecx
call fcn.10016130
jne 0x10005e53
mov edx, dword [esp + 0x18]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
push 0x10023f4c
call fcn.1001c380
mov edx, dword [esp + 0x18]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
push 0x10023e78
call fcn.1001c380
mov edx, dword [esp + 0x18]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
push 0x10023e58
call fcn.1001c380
mov edx, dword [esp + 0x18]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
push 0x10024134
call fcn.1001c380
mov edx, dword [esp + 0x18]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
push 0x10023fa0
call fcn.1001c380
push dword [esp + 0x18]
call fcn.1000e169
call fcn.100196ef
call fcn.10019719
and eax, eax
je 0x100062b0
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
call fcn.10019769
lea eax, [esp + 0x14]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
call fcn.100197ca
lea eax, [esp + 0x18]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push 0x1001f028
push 0x1001f028
call fcn.10012366
lea eax, [esp + 0x1c]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push dword [esp + 0x18]
call fcn.100186e0
call fcn.1001c410
lea edx, str.profile
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x10005f25
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
push 0x10023f4c
call fcn.1001c380
push dword [esp + 0x1c]
call fcn.1000e169
jmp 0x100062a6
lea edx, str.appdata
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x10005f68
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
push 0x10023e78
call fcn.1001c380
push dword [esp + 0x1c]
call fcn.1000e169
jmp 0x100062a6
lea edx, str.localappdata
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x10005fab
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
push 0x10023e58
call fcn.1001c380
push dword [esp + 0x1c]
call fcn.1000e169
jmp 0x100062a6
lea edx, str.localappdatalow
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x10005fee
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
push 0x10024134
call fcn.1001c380
push dword [esp + 0x1c]
call fcn.1000e169
jmp 0x100062a6
lea edx, str.commonappdata
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x10006031
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
push 0x10023fa0
call fcn.1001c380
push dword [esp + 0x1c]
call fcn.1000e169
jmp 0x100062a6
lea edx, str.documents
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x10006074
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
push 0x10023f60
call fcn.1001c380
push dword [esp + 0x1c]
call fcn.1000e169
jmp 0x100062a6
lea edx, str.commondocuments
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x100060b7
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
push 0x10023f20
call fcn.1001c380
push dword [esp + 0x1c]
call fcn.1000e169
jmp 0x100062a6
mov edx, dword [esp + 0x14]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
lea eax, [esp + 0x4c]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push 1
push dword [esp + 0x20]
call fcn.10018540
call fcn.1001c410
lea edx, [0x1001f8fc]
call fcn.10016120
mov ecx, eax
call fcn.10016130
je 0x10006132
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push 2
push dword [esp + 0x54]
call fcn.10018690
lea eax, [esp + 0x4c]
push eax
call fcn.1001c380
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x4c]
call fcn.1000e991
and eax, eax
je 0x100061b9
inc dword [0x10023e8c]
mov eax, dword [0x10023e8c]
inc eax
push 0x10024288
push eax
call fcn.1001b9e1
push 0x10
mov ebx, dword [0x10023e8c]
mov ebp, dword [0x10024288]
imul ebx, ebx, 0x14
add ebp, ebx
lea eax, [ebp]
push eax
lea eax, [esp + 0x54]
push eax
call fcn.1001bcf0
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
mov ebx, dword [0x10023e8c]
mov ebp, dword [0x10024288]
imul ebx, ebx, 0x14
add ebp, ebx
lea eax, [ebp + 0x10]
push eax
call fcn.1001c380
push dword [esp + 0x1c]
call fcn.1000e169
jmp 0x100062a6
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push 2
push dword [esp + 0x20]
call fcn.10018540
call fcn.1001c410
lea edx, [0x1001f4a4]
call fcn.10016120
mov ecx, eax
call fcn.10016130
je 0x1000622d
push edx
call fcn.1001c2e0
pop edx
push eax
lea edx, [0x1001f252]
push edx
call fcn.1001c320
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push 3
push dword [esp + 0x24]
call fcn.10018690
pop eax
lea eax, [esp + 0x18]
push eax
call fcn.1001c380
push dword [esp + 0x14]
call fcn.10018750
mov dword [esp + 0x5c], eax
cmp dword [esp + 0x5c], 0
je 0x100062a6
inc dword [0x10023f28]
mov eax, dword [0x10023f28]
inc eax
push 0x10024290
push eax
call fcn.1001b9e1
push dword [esp + 0x5c]
mov ebx, dword [0x10023f28]
mov ebp, dword [0x10024290]
shl ebx, 3
add ebp, ebx
pop eax
mov dword [ebp], eax
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
mov ebx, dword [0x10023f28]
mov ebp, dword [0x10024290]
shl ebx, 3
add ebp, ebx
lea eax, [ebp + 4]
push eax
call fcn.1001c380
push dword [esp + 0x1c]
call fcn.1000e169
call fcn.100161a0
jmp 0x10005e58
cmp dword [0x10024050], 0
je 0x100062d0
lea eax, str.EnvironmentVariables
push eax
call fcn.100195b4
and eax, eax
je 0x100062d0
mov eax, 1
jmp 0x100062d2
xor eax, eax
and eax, eax
je 0x100064f4
call fcn.100196ef
call fcn.10019719
and eax, eax
je 0x100064f4
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
call fcn.10019769
lea eax, [esp + 0x14]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
call fcn.100197ca
lea eax, [esp + 0x18]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push 0x1001f028
push 0x1001f028
call fcn.10012366
lea eax, [esp + 0x1c]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push dword [esp + 0x18]
call fcn.100186e0
call fcn.1001c410
lea edx, str.userprofile
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x100063b7
push dword [esp + 0x1c]
lea edx, [0x1001f028]
pop ecx
call fcn.10016130
je 0x100063b2
mov edx, dword [0x10023f4c]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
lea eax, [esp + 0x20]
push eax
call fcn.1001c380
jmp 0x100064d0
lea edx, str.allusersprofile
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
jne 0x100063e9
lea edx, str.programdata
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x1000641e
push dword [esp + 0x1c]
lea edx, [0x1001f028]
pop ecx
call fcn.10016130
je 0x10006419
mov edx, dword [0x10023fa0]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
lea eax, [esp + 0x20]
push eax
call fcn.1001c380
jmp 0x100064d0
lea edx, str.appdata
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x10006469
push dword [esp + 0x1c]
lea edx, [0x1001f028]
pop ecx
call fcn.10016130
je 0x10006467
mov edx, dword [0x10023e78]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
lea eax, [esp + 0x20]
push eax
call fcn.1001c380
jmp 0x100064d0
lea edx, str.localappdata
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x100064b4
push dword [esp + 0x1c]
lea edx, [0x1001f028]
pop ecx
call fcn.10016130
je 0x100064b2
mov edx, dword [0x10023e78]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
lea eax, [esp + 0x20]
push eax
call fcn.1001c380
jmp 0x100064d0
mov edx, dword [esp + 0x18]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
lea eax, [esp + 0x20]
push eax
call fcn.1001c380
call fcn.100161a0
mov edx, dword [esp + 0x18]
xor ecx, ecx
call fcn.10016130
jne 0x100064ef
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.10019153
jmp 0x100062df
call fcn.1000ad2d
cmp dword [0x100240d8], 0
je 0x10006945
lea eax, str.Registry.SetData
push eax
call fcn.100195b4
and eax, eax
je 0x100066d2
call fcn.100196ef
call fcn.10019719
and eax, eax
je 0x100066d2
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
call fcn.10019769
lea eax, [esp + 0x14]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
call fcn.100197ca
lea eax, [esp + 0x1c]
push eax
call fcn.1001c380
lea eax, [0x1001f95a]
push eax
push dword [esp + 0x14]
call fcn.10018520
mov dword [esp], eax
cmp dword [esp], 0
je 0x100066cd
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
mov ebx, dword [esp + 8]
inc ebx
push ebx
push dword [esp + 0x1c]
call fcn.10018690
lea eax, [esp + 0x18]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
mov ebx, dword [esp + 8]
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.10018540
lea eax, [esp + 0x14]
push eax
call fcn.1001c380
lea eax, [0x1001f3fa]
push eax
push dword [esp + 0x1c]
call fcn.10018520
mov dword [esp], eax
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
mov ebx, dword [esp + 0x10]
dec ebx
push ebx
push dword [esp + 0x2c]
call fcn.10018540
call fcn.10016182
add dword [esp], edx
call fcn.100186e0
lea eax, [esp + 0x28]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
mov ebx, dword [esp + 8]
inc ebx
push ebx
push dword [esp + 0x24]
call fcn.10018690
lea eax, [esp + 0x1c]
push eax
call fcn.1001c380
push dword [esp + 0x24]
lea edx, [0x1001f89e]
mov ecx, dword [esp]
call fcn.10016130
je 0x10006682
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.1001378a
jmp 0x100066cc
lea edx, [0x1001f6a6]
mov ecx, dword [esp]
call fcn.10016130
je 0x100066ab
push dword [esp + 0x1c]
call fcn.10018750
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.10013257
jmp 0x100066cc
lea edx, [0x1001f648]
mov ecx, dword [esp]
call fcn.10016130
je 0x100066cc
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.100130ee
pop eax
jmp 0x1000651f
lea eax, str.Registry.SetPaths
push eax
call fcn.100195b4
and eax, eax
je 0x100067bb
call fcn.100196ef
call fcn.10019719
and eax, eax
je 0x100067bb
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
call fcn.10019769
lea eax, [esp + 0x14]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push 0x1001f028
push 0x1001f028
call fcn.10012366
lea eax, [esp + 0x1c]
push eax
call fcn.1001c380
lea eax, [0x1001f95a]
push eax
push dword [esp + 0x14]
call fcn.10018520
mov dword [esp], eax
cmp dword [esp], 0
je 0x100067b6
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
mov ebx, dword [esp + 8]
inc ebx
push ebx
push dword [esp + 0x1c]
call fcn.10018690
lea eax, [esp + 0x18]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
mov ebx, dword [esp + 8]
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.10018540
lea eax, [esp + 0x14]
push eax
call fcn.1001c380
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.1001378a
jmp 0x100067b6
jmp 0x100066eb
lea eax, str.Registry.CorrectPaths
push eax
call fcn.100195b4
and eax, eax
je 0x10006945
call fcn.100196ef
call fcn.10019719
and eax, eax
je 0x10006945
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
call fcn.10019769
lea eax, [esp + 0x14]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push 0x1001f028
push 0x1001f028
call fcn.10012366
lea eax, [esp + 0x1c]
push eax
call fcn.1001c380
lea eax, [0x1001f95a]
push eax
push dword [esp + 0x14]
call fcn.10018520
mov dword [esp], eax
cmp dword [esp], 0
je 0x10006940
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
mov ebx, dword [esp + 8]
inc ebx
push ebx
push dword [esp + 0x1c]
call fcn.10018690
lea eax, [esp + 0x18]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
mov ebx, dword [esp + 8]
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.10018540
lea eax, [esp + 0x14]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.1000947a
lea eax, [esp + 0x24]
push eax
call fcn.1001c380
push dword [esp + 0x18]
lea edx, [0x1001f028]
pop ecx
call fcn.10016130
je 0x100068df
mov edx, dword [0x10023f50]
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c320
lea eax, [esp + 0x1c]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push 0
push dword [esp + 0x20]
push dword [esp + 0x2c]
call fcn.10011550
lea eax, [esp + 0x20]
push eax
call fcn.1001c380
mov edx, dword [esp + 0x1c]
xor ecx, ecx
call fcn.10016130
jne 0x10006927
push dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
pop ecx
call fcn.10016130
jne 0x10006927
mov eax, 1
jmp 0x10006929
xor eax, eax
and eax, eax
je 0x1000693e
push dword [esp + 0x1c]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.1001378a
jmp 0x10006940
jmp 0x100067d4
cmp dword [0x10023f9c], 0
je 0x100069c9
push 0
push 0x10024100
push 0x100240d0
lea eax, [0x1000e0ff]
push eax
lea eax, str.GetVolumeInformationA
push eax
lea eax, str.kernel32
push eax
call fcn.1000c26b
push 0
push 0x10024120
push 0x100240ec
lea eax, [0x1000e4db]
push eax
lea eax, str.GetVolumeInformationW
push eax
lea eax, str.kernel32
push eax
call fcn.1000c26b
push 0
push 0x1002400c
push 0x10024010
lea eax, [0x1000b9f6]
push eax
lea eax, str.GetFileInformationByHandle
push eax
lea eax, str.kernel32
push eax
call fcn.1000c26b
mov edx, dword [esp + 0x40]
xor ecx, ecx
call fcn.10016130
jne 0x10006bc8
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
lea eax, [0x1001f30c]
push eax
lea eax, [0x1001f310]
push eax
push dword [esp + 0x50]
call fcn.10018bd0
lea eax, [esp + 0x44]
push eax
call fcn.1001c380
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
lea eax, [0x1001f30c]
push eax
lea eax, [0x1001f348]
push eax
push dword [esp + 0x50]
call fcn.10018bd0
lea eax, [esp + 0x44]
push eax
call fcn.1001c380
lea eax, [0x1001f30c]
push eax
push dword [esp + 0x44]
call fcn.10018520
mov dword [esp], eax
cmp dword [esp], 0
je 0x10006bc8
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
mov ebx, dword [esp + 0xc]
dec ebx
push ebx
push dword [esp + 0x50]
call fcn.10018540
call fcn.10016182
add dword [esp], edx
call fcn.10018750
call fcn.100161a0
push eax
lea ebp, [0x10024238]
pop eax
mov word [ebp], ax
mov ebx, dword [esp]
inc ebx
push ebx
lea eax, [0x1001f30c]
push eax
push dword [esp + 0x48]
call fcn.10018460
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x10006bc8
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
mov ebx, dword [esp + 0x10]
sub ebx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x10]
inc ebx
push ebx
push dword [esp + 0x54]
call fcn.10018600
call fcn.10016182
add dword [esp], edx
call fcn.10018750
call fcn.100161a0
push eax
lea ebp, [0x10024238]
pop eax
mov word [ebp + 2], ax
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
mov ebx, dword [esp + 0x10]
inc ebx
push ebx
push dword [esp + 0x50]
call fcn.10018690
call fcn.10016182
add dword [esp], edx
call fcn.10018750
call fcn.100161a0
mov word [ebp + 6], ax
push 0
push 0x10023f34
push 0x10023f54
lea eax, [0x1000366e]
push eax
lea eax, str.GetLocalTime
push eax
lea eax, str.kernel32
push eax
call fcn.1000c26b
push 0
push 0x10024078
push 0x10024054
lea eax, [0x10015533]
push eax
lea eax, str.GetSystemTime
push eax
lea eax, str.kernel32
push eax
call fcn.1000c26b
push 0
push 0x100240e4
push 0x100240b4
lea eax, [0x10010f8e]
push eax
lea eax, str.GetSystemTimeAsFileTime
push eax
lea eax, str.kernel32
push eax
call fcn.1000c26b
lea eax, str.LoadLibrary
push eax
call fcn.100195b4
and eax, eax
je 0x10006c2f
call fcn.100196ef
call fcn.10019719
and eax, eax
je 0x10006c2f
push edx
call fcn.1001c2e0
pop edx
push eax
push 0x1001f028
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
call fcn.10019769
call fcn.10016182
add dword [esp], edx
call fcn.10012366
lea eax, [esp + 0x60]
push eax
call fcn.1001c380
mov eax, dword [esp + 0x5c]
push eax
call sub.KERNEL32.dll_LoadLibraryW
mov dword [esp + 0x60], eax
jmp 0x10006bdd
cmp dword [0x10023fdc], 0
je 0x10006c4f
lea eax, str.RunFromAttachProcess
push eax
call fcn.100195b4
and eax, eax
je 0x10006c4f
mov eax, 1
jmp 0x10006c51
xor eax, eax
and eax, eax
je 0x10006cb7
call fcn.100196ef
call fcn.10019719
and eax, eax
je 0x10006cb7
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
call fcn.100197ca
call fcn.1001c410
push edx
call fcn.1001c2e0
pop edx
push eax
push edx
call fcn.1001c2e0
pop edx
push eax
call fcn.10019769
call fcn.10016182
add dword [esp], edx
call fcn.10016182
add dword [esp + 4], edx
call fcn.10008c05
call fcn.100161a0
jmp 0x10006c5a
call fcn.1000ba2b
call fcn.100196dd
xor eax, eax
push dword [esp + 0x40]
call fcn.1001c4e0
push dword [esp + 0x44]
call fcn.1001c4e0
push dword [esp + 0x10]
call fcn.1001c4e0
push dword [esp + 0x1c]
call fcn.1001c4e0
push dword [esp + 0x20]
call fcn.1001c4e0
push dword [esp + 0x18]
call fcn.1001c4e0
push dword [esp + 0x24]
call fcn.1001c4e0
push dword [esp + 0x14]
call fcn.1001c4e0
push dword [esp + 0x5c]
call fcn.1001c4e0
push dword [esp + 8]
call fcn.1001c4e0
add esp, 0x64
pop ebx
pop ebp
ret 4