Function at 0x1001916b
Capabilities:
Create directory
Create pipe
Create process on windows
Delete directory
Delete registry value
Get common file path
Get geographical location
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push ebx
mov dword [ebp - 0x28], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x28], 0xa8e97eed
push esi
mov dword [ebp - 0x28], 0xffffffff
push edi
mov dword [ebp - 0xb4], edx
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 4], ebx
jmp 0x100191b0
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x188], 0xdd03248c
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1001919f
push 4
mov dword [ebp - 4], ebx
pop ecx
jmp 0x100191cf
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x12c], 8
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x100191be
dec dword [ebp - 0x120]
mov edi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 4], 0x1c77dcd
mov dword [ebp - 0x20], 0xbf118c84
mov dword [ebp - 0x10], 0x3ae35568
mov dword [ebp - 0x10], 0xa
cmp dword [ebp - 0x10], 7
push 1
pop esi
jne 0x1001926e
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0xc], ebx
jmp 0x10019225
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x144], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x10019214
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setne cl
mov dword [ebp - 0x20], ecx
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x10019262
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x24d7
push 0x1735
push 0x95c
push ebx
call edi
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 7
je 0x10019205
push 4
pop ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], ebx
jmp 0x10019287
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xa8], 0x841b3c69
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x10019276
mov dword [ebp - 0xa0], ebx
jmp 0x100192be
mov dword [ebp - 0x20], 0x43046b6e
mov dword [ebp - 0x1c], 0x464f16ef
mov eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0x20]
sub eax, 0xb9dd952e
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0xa0]
cmp dword [ebp - 0xa0], 0xffffffe4
jne 0x10019294
mov eax, dword [ebp - 0xa0]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], 0x89afca86
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0xc], ebx
jmp 0x100192fd
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x54], 0xaf11
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x100192ef
mov dword [ebp - 4], ebx
jmp 0x10019403
mov dword [ebp - 0x14], 0xe0091df8
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x24], 0x2e6c0b33
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x20], 0xf47f28a9
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x54], esi
je 0x100193d4
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0x10b42b8f
mov dword [ebp - 0xc], ebx
jmp 0x1001937c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jle 0x10019373
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x100193e4
mov dword [ebp - 0x10], ebx
jmp 0x100193c8
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x100193a4
push 0x386
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x100193c5
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x24d7
push 0x1735
push 0x95c
push ebx
call edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001938e
dec dword [ebp - 0x14]
jns 0x10019389
jmp 0x100193e4
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x100193e4
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x10], ebx
jmp 0x100193fb
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x100193f8
push ebx
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x100193e9
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jle 0x1001930a
mov dword [ebp - 4], ebx
jmp 0x1001941f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x34], 0xc03342eb
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x10019411
mov dword [ebp - 4], ebx
jmp 0x10019437
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x38], 0xfffffff8
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x10019429
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], 0xffffffeb
jg 0x10019a1e
mov eax, 0x598aaf0a
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x10], 0x68108531
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], eax
mov esi, dword [ebp - 0x70]
sub esi, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp eax, 0x4320e32c
mov eax, dword [ebp - 0x70]
setl cl
xor edx, edx
cmp esi, ecx
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x74]
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor ebx, ebx
cmp ecx, 0xb963
jl 0x100194c2
cmp dword [ebp - 0x70], ebx
jne 0x100194c2
xor esi, esi
mov ecx, ebx
inc esi
jmp 0x100194c7
xor esi, esi
inc esi
mov ecx, esi
xor eax, eax
cmp ecx, 0xec3203b
setg al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x10], 0xffffffe3
jmp 0x10019508
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x20], 0xf4039ee4
mov dword [ebp - 0xc], ebx
jmp 0x100194ff
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffc
jle 0x100194f6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1b
jge 0x100194e7
mov dword [ebp - 0xc], 0xfffffff8
mov dword [ebp - 4], 4
mov dword [ebp - 0x1c], 0xffffffff
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x10019534
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 4], 0xffffffef
jmp 0x100195d3
mov dword [ebp - 0x14], 0xffff
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], 0xee91b76e
mov dword [ebp - 0x10], ebx
jmp 0x10019567
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbc], 0x2c9bf5e4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10019556
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
sub eax, 0x3ca3691f
imul eax, dword [ebp - 4]
sub eax, 5
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xdd97
mov eax, dword [ebp - 4]
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x14]
imul edx, dword [ebp - 0x14]
neg edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xbc], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xc
jl 0x10019540
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x30], 0xffff
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x2c], 0xfffffffb
push 2
mov dword [ebp - 0x20], 0xa2ca335c
mov dword [ebp - 4], ebx
pop ecx
jmp 0x10019619
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe4], 0xcf8
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10019608
mov dword [ebp - 4], ebx
jmp 0x10019634
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x110], 0x95e0e2bf
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10019623
cmp dword [ebp - 0x30], ebx
je 0x100196ae
xor ecx, ecx
mov dword [ebp - 0x2c], 0x5059b8bc
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
cmp eax, 0x60a421e0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
setne cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0xe4]
setg cl
imul edx, ecx, 0x4d39
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x63069be5
setg al
add eax, 0x4cbed562
cmp dword [ebp - 0x2c], eax
jl 0x100196a0
mov ecx, esi
cmp dword [ebp - 0x20], ebx
jne 0x100196a2
mov ecx, ebx
mov eax, dword [ebp - 0xe4]
sub ecx, eax
mov eax, esi
jne 0x100196b0
mov eax, ebx
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x4c], 0x34bf8f0a
mov dword [ebp - 0x2c], 0x307d7c11
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x10], 0x320e32cf
mov dword [ebp - 0x18], 0x49aaed6b
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 0x47c914a3
mov dword [ebp - 0x28], 5
mov dword [ebp - 4], ebx
jmp 0x1001971c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xc0], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001970f
cmp dword [ebp - 0x2c], ebx
jne 0x10019760
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setle dl
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x80]
imul edx, edx, 0x5bb0
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov edx, ebx
setge cl
cmp dword [ebp - 0x18], ecx
jg 0x10019762
mov edx, esi
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, 0xffffffff
je 0x10019774
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ebx
jne 0x1001978e
cmp dword [ebp - 0x80], ebx
jne 0x1001978e
mov edx, ebx
cmp dword [ebp - 0x18], ebx
je 0x10019790
mov edx, esi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, 6
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
je 0x100197b8
mov edx, esi
cmp dword [ebp - 0x14], ebx
jne 0x100197ba
mov edx, ebx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x80]
cmp ecx, 0x9afff74b
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0xc0]
sub eax, dword [ebp - 0x28]
cmp eax, 8
mov eax, dword [ebp - 0x10]
setl cl
sub ecx, eax
imul eax, ecx, 0x963e
xor ecx, ecx
cmp eax, 0xb100
mov eax, dword [ebp - 0x14]
setg cl
cmp ecx, 0xcc425f8e
sbb ecx, ecx
neg ecx
sub ecx, eax
mov dword [ebp - 0x80], ecx
mov eax, dword [ebp - 0x18]
sub ecx, eax
cmp ecx, dword [ebp - 0x24]
jg 0x1001982f
mov ecx, ebx
cmp dword [ebp - 0x4c], ebx
je 0x10019831
mov ecx, esi
mov eax, dword [ebp - 0x24]
add ecx, 0xffff39a0
xor edx, edx
cmp ecx, eax
push 3
setge dl
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], ebx
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ebx
jmp 0x1001985f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xcc], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10019852
mov dword [ebp - 4], ebx
jmp 0x1001987a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xb0], 0x97736eae
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10019869
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jne 0x10019898
dec dword [ebp - 0x24]
mov ecx, ebx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x1c]
je 0x1001989a
mov ecx, esi
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
mov edx, 0x36d0
sete cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0xc4], ecx
neg ecx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, dword [ebp - 0x38]
jg 0x100198e3
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], ebx
mov esi, dword [ebp - 0xc]
neg esi
sbb esi, esi
neg esi
sub esi, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xc]
neg esi
mov eax, dword [ebp - 0xc]
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, eax
setne dl
add edx, esi
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0xc8], eax
jg 0x10019955
mov ecx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0xfffffffc
jae 0x10019955
xor esi, esi
inc esi
mov ecx, esi
jmp 0x1001995a
xor esi, esi
mov ecx, ebx
inc esi
mov eax, dword [ebp - 0xc]
add eax, ecx
je 0x10019968
mov eax, esi
cmp dword [ebp - 4], ebx
jne 0x1001996a
mov eax, ebx
xor edx, edx
cmp eax, 0xe20
mov eax, dword [ebp - 0x2c]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, 0xf2ec
cmp ecx, dword [ebp - 0x14]
jne 0x10019990
mov edx, ebx
cmp dword [ebp - 4], ebx
je 0x10019992
mov edx, esi
mov eax, dword [ebp - 0xac]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0xc8]
setg cl
sub eax, ecx
cmp eax, dword [ebp - 0x38]
jg 0x100199f8
cmp dword [ebp - 0x38], ebx
je 0x100199f8
mov dword [ebp - 4], 0xfffffff2
jmp 0x100199f0
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x100199ed
push 0x94e
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff1
jle 0x100199ce
jmp 0x10019a0c
mov dword [ebp - 0x14], ebx
jmp 0x10019a07
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x38], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100199fd
dec dword [ebp - 0x34]
mov eax, 0x598aaf0a
cmp dword [ebp - 0x34], 0xffffffeb
jle 0x1001944e
mov eax, 0x76820624
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x98], ebx
jmp 0x10019a92
mov dword [ebp - 0x24], 0xa986
mov dword [ebp - 0x28], 0x49968cb6
cmp dword [ebp - 0x24], ebx
jne 0x10019a6e
mov eax, dword [ebp - 0x24]
mov edx, ebx
mov eax, dword [ebp - 0x24]
jmp 0x10019a70
mov edx, esi
mov eax, dword [ebp - 0x98]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
inc dword [ebp - 0x98]
cmp dword [ebp - 0x98], 0x17
jl 0x10019a51
mov dword [ebp - 0xc], ebx
jmp 0x10019abe
mov dword [ebp - 0x10], ebx
jmp 0x10019ab3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x50], 0x512dc6d0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10019aa5
inc dword [ebp - 0x50]
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff7
jle 0x10019aa0
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x10019adb
push ebx
push 0x1bba
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [ebp - 0x14], 0x7c20
mov dword [ebp - 0xc], 0x95a97963
mov dword [ebp - 0x10], 8
mov dword [ebp - 4], 0x5336de01
mov dword [ebp - 0x18], ebx
jmp 0x10019b0a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x60], 0x23aa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10019afc
mov eax, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x10]
cmp eax, 0x5ed9a924
setge dl
dec edx
add edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
cmp edx, eax
setg cl
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ebx
jmp 0x10019c30
mov dword [ebp - 0x24], 0x25c7e4dd
mov dword [ebp - 0xc], ebx
jmp 0x10019be8
mov dword [ebp - 0x20], 0xf8169c14
mov dword [ebp - 0x2c], 0xf093d7f2
mov dword [ebp - 4], ebx
jmp 0x10019be0
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x28], 0xedbec151
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x60]
cmp dword [ebp - 0x20], 0xa14a9c79
sbb eax, eax
neg eax
cmp eax, 0xb5cfda6c
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x60]
cmp dword [ebp - 0x1c], eax
jg 0x10019ba8
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x28], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jle 0x10019b6a
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jle 0x10019b57
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], ebx
jl 0x10019c2d
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x10019c28
push ebx
push 0xa0
push 0x3e4
push 0x9d0
push 0xf1d
push 0x19bf
push 0x19e5
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
dec dword [ebp - 0x10]
jns 0x10019bf9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jge 0x10019b48
mov dword [ebp - 0x30], 0xe0a8eac8
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 4], ebx
jmp 0x10019c6e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x68], 0x5b57
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10019c60
mov dword [ebp - 4], ebx
jmp 0x10019c87
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x48], 0xc184c506
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x10019c79
mov dword [ebp - 0x48], esi
cmp dword [ebp - 0x48], ebx
jl 0x10019cf2
mov dword [ebp - 0xc], esi
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], ebx
jl 0x10019ced
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0x68], ecx
jg 0x10019ccb
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x68], ecx
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x10019ce2
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x10019ce2
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x10019ce2
push ebx
push ebx
push 0x2000
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov eax, dword [ebp - 0xec]
dec dword [ebp - 0xc]
jns 0x10019c9f
dec dword [ebp - 0x48]
jns 0x10019c94
mov dword [ebp - 0x18], 0xd29be1d9
mov dword [ebp - 0x18], ebx
jmp 0x10019d0f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x138], 0x648261f9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10019cfe
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x10019d2d
push ebx
push ebx
push 0x1def
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x10019d4a
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x138], ebx
jne 0x10019d4a
dec dword [ebp - 0x18]
jns 0x10019d39
mov byte [ebp - 0x39], bl
mov dword [ebp - 4], 0xe83c773
mov dword [ebp - 0x18], ebx
jmp 0x10019d6a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x194], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10019d59
mov dword [ebp - 4], ebx
jmp 0x10019d8f
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x10019d8c
push esi
push 0x24d1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jle 0x10019d75
mov dword [ebp - 4], ebx
jmp 0x10019dad
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x10019daa
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jle 0x10019d9a
lea eax, [ebp - 0x39]
push eax
push ebx
push 0x1b33
call fcn.1001c9b8
mov dword [ebp - 0x28], 0xffffffff
add esp, 0xc
mov dword [ebp - 0x1c], 0xedcad208
mov dword [ebp - 0x20], 0xc9e53e58
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x14], 0xc8ddac0f
mov dword [ebp - 0x1c], 0xa1434a93
push 2
mov dword [ebp - 0x2c], 7
mov dword [ebp - 4], ebx
pop ecx
jmp 0x10019e12
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xdc], 0x7d2703d9
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10019e01
mov dword [ebp - 4], ebx
jmp 0x10019e2d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x118], 0xab72b21a
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10019e1c
mov dword [ebp - 4], ebx
jmp 0x10019e48
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x14c], 0xfffffff6
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10019e37
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
test eax, eax
mov eax, dword [ebp - 0x1c]
cmove esi, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 6
mov eax, dword [ebp - 0xdc]
setne cl
xor edx, edx
cmp ecx, 0x52a2
setg dl
xor ecx, ecx
cmp esi, eax
mov eax, dword [ebp - 0x114]
sete cl
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xd8]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor esi, esi
mov dword [ebp - 0x1c], ecx
inc esi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0x21
jl 0x10019f6d
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x10019eda
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x17c], 0x9cbadbef
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10019ec9
mov ecx, dword [ebp - 0x2c]
xor ebx, ebx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl bl
xor edx, edx
imul ebx, eax
mov dword [ebp - 0x170], ebx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
inc edx
imul edx, ebx
xor ebx, ebx
test edx, edx
jle 0x10019f5f
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], 0xe85dc32c
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x7655
mov dword [ebp - 0x18], ebx
jmp 0x10019f55
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x108], 0xc0f4fd1a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10019f44
dec dword [ebp - 0x1c]
jmp 0x10019f65
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x14]
jmp 0x10019ea9
mov dword [ebp - 0x30], ebx
jmp 0x1001a1e5
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1001a063
mov dword [ebp - 0xc], 0xeede0b40
mov dword [ebp - 0x18], ebx
jmp 0x10019f9d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x16c], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10019f8c
mov dword [ebp - 0xc], ebx
jmp 0x1001a056
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], ebx
jmp 0x1001a049
mov dword [ebp - 4], 0xc1188e17
mov dword [ebp - 0x18], ebx
jmp 0x10019fd4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x44], 0x121f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10019fc6
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
jl 0x1001a046
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x44], ebx
je 0x1001a002
mov eax, dword [ebp - 4]
mov ecx, esi
mov eax, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x44], ebx
jne 0x1001a004
mov ecx, ebx
mov eax, dword [ebp - 0x44]
sub ecx, eax
mov edx, dword [ebp - 4]
add edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setg cl
xor edx, edx
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 4]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x44]
cmp eax, edx
setg cl
mov dword [ebp - 0x160], ecx
dec dword [ebp - 4]
jns 0x10019fe1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 7
jne 0x10019fba
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x16
jne 0x10019fab
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x16
jne 0x10019f80
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x20], 0xcc321a0
mov dword [ebp - 4], ebx
jmp 0x1001a098
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1a4], 0xb9b5
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x1001a087
mov dword [ebp - 4], ebx
jmp 0x1001a0b1
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x40], 0x532fe223
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001a0a3
mov dword [ebp - 4], ebx
jmp 0x1001a0cc
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x11c], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001a0bb
push 3
pop ecx
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], ebx
jl 0x1001a1df
mov dword [ebp - 0xc], 0xfffffffe
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x20], 0x6b34c266
mov dword [ebp - 0x2c], 0x4ce34aaf
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x40], ebx
je 0x1001a10a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], ebx
jmp 0x1001a1cd
mov dword [ebp - 0x1c], 0xfe9a5a16
mov dword [ebp - 0xc], ebx
jmp 0x1001a1c1
mov dword [ebp - 0x10], 0xa0cd95ff
mov dword [ebp - 0x28], 0xd4a79744
mov dword [ebp - 0x28], 0xbe3d0e72
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x18], ebx
jmp 0x1001a156
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001a145
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
je 0x1001a171
mov edx, esi
cmp dword [ebp - 0x40], ebx
jne 0x1001a173
mov edx, ebx
mov eax, dword [ebp - 0xd4]
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, edx
setg cl
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], ebx
je 0x1001a19f
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
jmp 0x1001a1bb
mov dword [ebp - 0x10], ebx
jmp 0x1001a1b5
cmp dword [ebp - 0xc], ecx
jle 0x1001a124
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x1001a115
dec dword [ebp - 0x40]
jns 0x1001a0e0
inc dword [ebp - 0x24]
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffeb
jne 0x10019f75
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x28], 0x89afca86
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x30], ebx
jmp 0x1001a217
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x58], 0xaf11
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x1001a209
mov dword [ebp - 4], ebx
jmp 0x1001a321
mov dword [ebp - 0x14], 0xe0091df8
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x1c], 0x2e6c0b33
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x28], 0xf47f28a9
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x58], esi
je 0x1001a2f0
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], 0x10b42b8f
mov dword [ebp - 0xc], ebx
jmp 0x1001a296
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jle 0x1001a28d
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1001a301
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001a301
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x10], ebx
jmp 0x1001a319
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001a316
cmp dword [ebp - 0x10], ebx
jle 0x1001a306
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jle 0x1001a224
push 2
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 4], ebx
pop ecx
jmp 0x1001a346
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x15c], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x1001a339
mov dword [ebp - 4], ebx
jmp 0x1001a361
cmp dword [ebp - 4], ecx
jl 0x1001a350