Function at 0x10005264
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
mov edx, 0x16
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x1000526b
call fcn.1001c490
mov edx, dword [0x10024090]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
mov edx, dword [0x10023e20]
push edx
call fcn.1001c330
push 0x10023f74
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
mov edx, dword [0x10023f74]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
lea edx, str..prefs
push edx
call fcn.1001c330
call fcn.10016182
add dword [esp], edx
call fcn.1000aa9a
call fcn.100161a0
and eax, eax
je 0x10005314
mov edx, dword [0x10023f74]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
lea edx, str..prefs
push edx
call fcn.1001c330
push 0x10023f74
call fcn.1001c390
jmp 0x10005453
push edx
call fcn.1001c2f0
pop edx
push eax
mov edx, dword [0x10023f74]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
lea edx, str..ini
push edx
call fcn.1001c330
call fcn.10016182
add dword [esp], edx
call fcn.1000aa9a
call fcn.100161a0
and eax, eax
je 0x10005381
mov edx, dword [0x10023f74]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
lea edx, str..ini
push edx
call fcn.1001c330
push 0x10023f74
call fcn.1001c390
jmp 0x10005453
push edx
call fcn.1001c2f0
pop edx
push eax
mov edx, dword [0x10024090]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
lea edx, str.PurePort.prefs
push edx
call fcn.1001c330
call fcn.10016182
add dword [esp], edx
call fcn.1000aa9a
call fcn.100161a0
and eax, eax
je 0x100053eb
mov edx, dword [0x10024090]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
lea edx, str.PurePort.prefs
push edx
call fcn.1001c330
push 0x10023f74
call fcn.1001c390
jmp 0x10005453
push edx
call fcn.1001c2f0
pop edx
push eax
mov edx, dword [0x10024090]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
lea edx, str.PurePort.ini
push edx
call fcn.1001c330
call fcn.10016182
add dword [esp], edx
call fcn.1000aa9a
call fcn.100161a0
and eax, eax
je 0x10005453
mov edx, dword [0x10024090]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
lea edx, str.PurePort.ini
push edx
call fcn.1001c330
push 0x10023f74
call fcn.1001c390
push 1
push dword [0x10023f74]
call fcn.10019234
mov ebx, eax
and ebx, ebx
jne 0x1000549b
push 0x10
lea eax, str.PurePortable
push eax
lea eax, str.Config_file_not_found_
push eax
push 0
call sub.USER32.dll_MessageBoxW
push 0
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_TerminateProcess
jmp 0x10006bd7
lea eax, str.Portable
push eax
call fcn.100195c4
mov ebx, eax
and ebx, ebx
jne 0x100054df
push 0x10
lea eax, str.PurePortable
push eax
lea eax, str.Section__Portable__not_found_
push eax
push 0
call sub.USER32.dll_MessageBoxW
push 0
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_TerminateProcess
jmp 0x10006bd7
mov dword [esp + 0x2c], 1
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push dword [0x10024070]
call fcn.100187e0
call fcn.1001c420
lea edx, str.rundll32
call fcn.10016120
mov ecx, eax
call fcn.10016130
je 0x10005525
mov dword [esp + 0x28], 2
jmp 0x1000554a
lea eax, str.Portable
push eax
call fcn.100195c4
and eax, eax
je 0x1000554a
push 1
lea eax, str.ValidateProgram
push eax
call fcn.100196b8
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], 0
je 0x10005568
lea eax, str.ValidateProgram
push eax
call fcn.100195c4
and eax, eax
je 0x10005568
mov eax, 1
jmp 0x1000556a
xor eax, eax
and eax, eax
je 0x100056e1
call fcn.100196ed
call fcn.10019717
and eax, eax
je 0x100056e1
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
call fcn.10019767
lea eax, [esp + 0xc]
push eax
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
call fcn.100197c8
lea eax, [esp + 0x10]
push eax
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push dword [esp + 0x10]
call fcn.100187e0
call fcn.1001c420
lea edx, str.programname
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
jne 0x10005612
lea edx, str.programfilename
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x1000564f
push 1
push dword [esp + 0x14]
push dword [0x10024070]
call fcn.10013ef9
and eax, eax
je 0x10005642
mov dword [esp + 0x2c], 0
push dword [esp]
call fcn.100161a0
add esp, 4
jmp 0x100056e1
mov dword [esp + 0x2c], 1
jmp 0x100056d7
lea edx, str.reaction
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x10005677
push dword [esp + 0x10]
call fcn.10018850
mov dword [esp + 0x30], eax
jmp 0x100056d7
push edx
call fcn.1001c2f0
pop edx
push eax
push 1
push dword [esp + 0x18]
push edx
call fcn.1001c2f0
pop edx
push eax
push 0x1001f028
push dword [esp + 0x20]
push dword [0x10023f9c]
call fcn.10007c3a
call fcn.10016182
add dword [esp], edx
call fcn.10013ef9
call fcn.100161a0
and eax, eax
je 0x100056cf
mov dword [esp + 0x2c], 0
push dword [esp]
call fcn.100161a0
add esp, 4
jmp 0x100056e1
mov dword [esp + 0x2c], 1
call fcn.100161a0
jmp 0x10005577
cmp dword [esp + 0x24], 0
je 0x100056f8
mov ebx, dword [esp + 0x28]
cmp ebx, 1
jne 0x100056f8
mov eax, 1
jmp 0x100056fa
xor eax, eax
and eax, eax
je 0x10005852
mov ebx, dword [esp + 0x2c]
cmp ebx, 3
jne 0x1000576d
push edx
call fcn.1001c2f0
pop edx
push eax
push 0x10
lea eax, str.PurePortable
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
lea edx, str.Invalid_program
push edx
call fcn.1001c330
mov edx, dword [0x10024070]
push edx
call fcn.1001c330
lea edx, [0x1001f222]
push edx
call fcn.1001c330
call fcn.1001c420
push 0
call fcn.10016182
add dword [esp + 4], edx
call sub.USER32.dll_MessageBoxW
call fcn.100161a0
jmp 0x1000581c
mov ebx, dword [esp + 0x2c]
cmp ebx, 1
je 0x10005781
mov ebx, dword [esp + 0x2c]
cmp ebx, 2
je 0x10005781
jmp 0x10005788
mov eax, 1
jmp 0x1000578a
xor eax, eax
and eax, eax
je 0x1000581c
mov dword [esp + 0x30], 0x14
mov ebx, dword [esp + 0x2c]
cmp ebx, 2
jne 0x100057ab
add dword [esp + 0x30], 0x100
push edx
call fcn.1001c2f0
pop edx
push eax
push dword [esp + 0x34]
lea eax, str.PurePortable
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
lea edx, str.Invalid_program
push edx
call fcn.1001c330
mov edx, dword [0x10024070]
push edx
call fcn.1001c330
lea edx, str.__rContinue_the_program_execution_
push edx
call fcn.1001c330
call fcn.1001c420
push 0
call fcn.10016182
add dword [esp + 4], edx
call sub.USER32.dll_MessageBoxW
call fcn.100161a0
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x20]
cmp ebx, 6
je 0x1000581c
mov dword [esp + 0x2c], 4
mov ebx, dword [esp + 0x2c]
cmp ebx, 3
je 0x10005830
mov ebx, dword [esp + 0x2c]
cmp ebx, 4
je 0x10005830
jmp 0x10005837
mov eax, 1
jmp 0x10005839
xor eax, eax
and eax, eax
je 0x1000584d
push 0
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_TerminateProcess
jmp 0x10006bd7
push dword [0x10023f9c]
lea eax, str.PP_PrgPath
push eax
call fcn.10019163
push dword [0x10023e84]
lea eax, str.PP_PrgDir
push eax
call fcn.10019163
lea eax, str.EnvironmentVariables
push eax
call fcn.100195c4
and eax, eax
je 0x100058fb
call fcn.100196ed
call fcn.10019717
and eax, eax
je 0x100058fb
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
call fcn.10019767
lea eax, [esp + 0xc]
push eax
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push 0x1001f028
push 0x1001f028
call fcn.100121b7
lea eax, [esp + 0x14]
push eax
call fcn.1001c390
mov edx, dword [esp + 0x10]
xor ecx, ecx
call fcn.10016130
jne 0x100058f0
push dword [esp + 0x10]
push dword [esp + 0xc]
call fcn.10019163
jmp 0x100058f9
push dword [esp + 8]
call fcn.1001914d
jmp 0x1000588b
lea eax, str.Portable
push eax
call fcn.100195c4
and eax, eax
je 0x10005c00
push 0
lea eax, str.Registry
push eax
call fcn.100196b8
mov dword [0x10024008], eax
cmp dword [0x10024008], 0
je 0x10005944
push 1
lea eax, str.RegistryShlwapi
push eax
call fcn.100196b8
mov dword [0x10024084], eax
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
lea eax, [0x1001f028]
push eax
lea eax, str.DataFile
push eax
call fcn.1001988f
lea eax, [esp + 0x14]
push eax
call fcn.1001c390
mov edx, dword [esp + 0x10]
xor ecx, ecx
call fcn.10016130
jne 0x1000599e
push edx
call fcn.1001c2f0
pop edx
push eax
push 0x1001f028
push dword [esp + 0x18]
call fcn.100121b7
push 0x10023f5c
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push dword [0x10023f5c]
call fcn.10019e37
call fcn.1001c420
lea edx, [0x1001f028]
call fcn.10016120
mov ecx, eax
call fcn.10016130
je 0x100059fc
mov edx, dword [0x10023f5c]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
lea edx, str..pport
push edx
call fcn.1001c330
push 0x10023f5c
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
lea eax, [0x1001f028]
push eax
lea eax, str.InitFile
push eax
call fcn.1001988f
lea eax, [esp + 0x14]
push eax
call fcn.1001c390
mov edx, dword [esp + 0x10]
xor ecx, ecx
call fcn.10016130
jne 0x10005a56
push edx
call fcn.1001c2f0
pop edx
push eax
push 0x1001f028
push dword [esp + 0x18]
call fcn.100121b7
push 0x10023dbc
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push dword [0x10023dbc]
call fcn.10019e37
call fcn.1001c420
lea edx, [0x1001f028]
call fcn.10016120
mov ecx, eax
call fcn.10016130
je 0x10005ab4
mov edx, dword [0x10023dbc]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
lea edx, str..pport
push edx
call fcn.1001c330
push 0x10023dbc
call fcn.1001c390
push 0
lea eax, str.SpecialFolders
push eax
call fcn.100196b8
mov dword [0x10023dd8], eax
push 0
lea eax, str.EnvironmentVariables
push eax
call fcn.100196b8
mov dword [0x10023f80], eax
push 0
lea eax, str.ProxyErrorMode
push eax
call fcn.100196b8
mov dword [0x10024120], eax
push 0
lea eax, str.MinHookErrorMode
push eax
call fcn.100196b8
mov dword [0x10023ffc], eax
push 0
lea eax, str.VolumeSerialNumber
push eax
call fcn.100196b8
mov dword [0x10023ed0], eax
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
lea eax, [0x1001f028]
push eax
lea eax, str.SpoofDate
push eax
call fcn.1001988f
lea eax, [esp + 0x38]
push eax
call fcn.1001c390
push 0
lea eax, str.BlockWinInet
push eax
call fcn.100196b8
mov dword [0x10023fe0], eax
push 0
lea eax, str.BlockWinHttp
push eax
call fcn.100196b8
mov dword [0x10023e34], eax
push 0
lea eax, str.BlockWinSocks
push eax
call fcn.100196b8
mov dword [0x10023f1c], eax
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
lea eax, [0x1001f028]
push eax
lea eax, str.CurrentDirectory
push eax
call fcn.1001988f
lea eax, [esp + 0x14]
push eax
call fcn.1001c390
push dword [esp + 0x10]
lea edx, [0x1001f028]
pop ecx
call fcn.10016130
jne 0x10005c00
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push 0x1001f028
push dword [esp + 0x1c]
call fcn.100121b7
call fcn.10016182
add dword [esp], edx
call fcn.10019eba
call fcn.100161a0
mov dword [0x100240e8], 0
mov dword [0x10024144], 0
mov dword [0x10024088], 0
mov dword [0x10023f60], 0
lea eax, str.Debug
push eax
call fcn.100195c4
and eax, eax
je 0x10005c90
push 0
lea eax, str.Registry
push eax
call fcn.100196b8
mov dword [0x100240e8], eax
push 0
lea eax, str.SpecialFolders
push eax
call fcn.100196b8
mov dword [0x10024144], eax
push 0
lea eax, str.EnvironmentVariables
push eax
call fcn.100196b8
mov dword [0x10024088], eax
push 0
lea eax, str.Attach
push eax
call fcn.100196b8
mov dword [0x10023f60], eax
mov ebx, dword [esp + 0x28]
cmp ebx, 2
jne 0x10005c9e
jmp 0x10006bd7
cmp dword [0x10024008], 0
je 0x10005cbe
lea eax, str.Registry
push eax
call fcn.100195c4
and eax, eax
je 0x10005cbe
mov eax, 1
jmp 0x10005cc0
xor eax, eax
and eax, eax
je 0x10005dec
call fcn.100196ed
call fcn.10019717
and eax, eax
je 0x10005dec
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
call fcn.10019767
call fcn.10016182
add dword [esp], edx
call fcn.100187e0
lea eax, [esp + 0xc]
push eax
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
call fcn.100197c8
call fcn.10016182
add dword [esp], edx
call fcn.100187e0
lea eax, [esp + 0x10]
push eax
call fcn.1001c390
mov edx, dword [esp + 0xc]
xor ecx, ecx
call fcn.10016130
jne 0x10005d6e
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.1000a518
jmp 0x10005de7
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push 9
push dword [esp + 0x14]
call fcn.10018550
call fcn.1001c420
lea edx, str.software_
call fcn.10016120
mov ecx, eax
call fcn.10016130
je 0x10005de7
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push 0xa
push dword [esp + 0x14]
call fcn.10018790
lea eax, [esp + 0x10]
push eax
call fcn.1001c390
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.1000a518
push dword [esp + 0xc]
push dword [esp + 0x10]
call fcn.1000a518
jmp 0x10005ccd
cmp dword [0x10023dd8], 0
jne 0x10005e00
cmp dword [0x10023f80], 0
jne 0x10005e00
jmp 0x10005e07
mov eax, 1
jmp 0x10005e09
xor eax, eax
and eax, eax
je 0x10005e24
lea eax, str.SpecialFolders
push eax
call fcn.100195c4
and eax, eax
je 0x10005e24
mov eax, 1
jmp 0x10005e26
xor eax, eax
and eax, eax
je 0x10006378
push edx
call fcn.1001c2f0
pop edx
push eax
push 0x1001f028
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
lea eax, [0x1001f028]
push eax
lea eax, str.AllDirs
push eax
call fcn.1001988f
call fcn.10016182
add dword [esp], edx
call fcn.100121b7
lea eax, [esp + 0x14]
push eax
call fcn.1001c390
mov edx, dword [esp + 0x10]
xor ecx, ecx
call fcn.10016130
jne 0x10005f1b
mov edx, dword [esp + 0x10]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
push 0x10023e80
call fcn.1001c390
mov edx, dword [esp + 0x10]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
push 0x10023dac
call fcn.1001c390
mov edx, dword [esp + 0x10]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
push 0x10023d8c
call fcn.1001c390
mov edx, dword [esp + 0x10]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
push 0x10024064
call fcn.1001c390
mov edx, dword [esp + 0x10]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
push 0x10023ed4
call fcn.1001c390
push dword [esp + 0x10]
call fcn.1000e766
call fcn.100196ed
call fcn.10019717
and eax, eax
je 0x10006378
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
call fcn.10019767
lea eax, [esp + 0xc]
push eax
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
call fcn.100197c8
lea eax, [esp + 0x10]
push eax
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push 0x1001f028
push 0x1001f028
call fcn.100121b7
lea eax, [esp + 0x14]
push eax
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push dword [esp + 0x10]
call fcn.100187e0
call fcn.1001c420
lea edx, str.profile
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x10005fed
mov edx, dword [esp + 0x14]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
push 0x10023e80
call fcn.1001c390
push dword [esp + 0x14]
call fcn.1000e766
jmp 0x1000636e
lea edx, str.appdata
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x10006030
mov edx, dword [esp + 0x14]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
push 0x10023dac
call fcn.1001c390
push dword [esp + 0x14]
call fcn.1000e766
jmp 0x1000636e
lea edx, str.localappdata
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x10006073
mov edx, dword [esp + 0x14]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
push 0x10023d8c
call fcn.1001c390
push dword [esp + 0x14]
call fcn.1000e766
jmp 0x1000636e
lea edx, str.localappdatalow
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x100060b6
mov edx, dword [esp + 0x14]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
push 0x10024064
call fcn.1001c390
push dword [esp + 0x14]
call fcn.1000e766
jmp 0x1000636e
lea edx, str.commonappdata
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x100060f9
mov edx, dword [esp + 0x14]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
push 0x10023ed4
call fcn.1001c390
push dword [esp + 0x14]
call fcn.1000e766
jmp 0x1000636e
lea edx, str.documents
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x1000613c
mov edx, dword [esp + 0x14]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
push 0x10023e94
call fcn.1001c390
push dword [esp + 0x14]
call fcn.1000e766
jmp 0x1000636e
lea edx, str.commondocuments
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x1000617f
mov edx, dword [esp + 0x14]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
push 0x10023e54
call fcn.1001c390
push dword [esp + 0x14]
call fcn.1000e766
jmp 0x1000636e
mov edx, dword [esp + 0xc]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
lea eax, [esp + 0x40]
push eax
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push 1
push dword [esp + 0x18]
call fcn.10018550
call fcn.1001c420
lea edx, [0x1001f8da]
call fcn.10016120
mov ecx, eax
call fcn.10016130
je 0x100061fa
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push 2
push dword [esp + 0x48]
call fcn.10018790
lea eax, [esp + 0x40]
push eax
call fcn.1001c390
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x40]
call fcn.1000ef8e
and eax, eax
je 0x10006281
inc dword [0x10023dc0]
mov eax, dword [0x10023dc0]
inc eax
push 0x100241b8
push eax
call fcn.1001b9f1
push 0x10
mov ebx, dword [0x10023dc0]
mov ebp, dword [0x100241b8]
imul ebx, ebx, 0x14
add ebp, ebx
lea eax, [ebp]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.1001bd00
mov edx, dword [esp + 0x14]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
mov ebx, dword [0x10023dc0]
mov ebp, dword [0x100241b8]
imul ebx, ebx, 0x14
add ebp, ebx
lea eax, [ebp + 0x10]
push eax
call fcn.1001c390
push dword [esp + 0x14]
call fcn.1000e766
jmp 0x1000636e
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push 2
push dword [esp + 0x18]
call fcn.10018550
call fcn.1001c420
lea edx, [0x1001f4a4]
call fcn.10016120
mov ecx, eax
call fcn.10016130
je 0x100062f5
push edx
call fcn.1001c2f0
pop edx
push eax
lea edx, [0x1001f252]
push edx
call fcn.1001c330
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push 3
push dword [esp + 0x1c]
call fcn.10018790
pop eax
lea eax, [esp + 0x10]
push eax
call fcn.1001c390
push dword [esp + 0xc]
call fcn.10018850
mov dword [esp + 0x50], eax
cmp dword [esp + 0x50], 0
je 0x1000636e
inc dword [0x10023e5c]
mov eax, dword [0x10023e5c]
inc eax
push 0x100241c0
push eax
call fcn.1001b9f1
push dword [esp + 0x50]
mov ebx, dword [0x10023e5c]
mov ebp, dword [0x100241c0]
shl ebx, 3
add ebp, ebx
pop eax
mov dword [ebp], eax
mov edx, dword [esp + 0x14]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
mov ebx, dword [0x10023e5c]
mov ebp, dword [0x100241c0]
shl ebx, 3
add ebp, ebx
lea eax, [ebp + 4]
push eax
call fcn.1001c390
push dword [esp + 0x14]
call fcn.1000e766
call fcn.100161a0
jmp 0x10005f20
cmp dword [0x10023f80], 0
je 0x10006398
lea eax, str.EnvironmentVariables
push eax
call fcn.100195c4
and eax, eax
je 0x10006398
mov eax, 1
jmp 0x1000639a
xor eax, eax
and eax, eax
je 0x100065bc
call fcn.100196ed
call fcn.10019717
and eax, eax
je 0x100065bc
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
call fcn.10019767
lea eax, [esp + 0xc]
push eax
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
call fcn.100197c8
lea eax, [esp + 0x10]
push eax
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push 0x1001f028
push 0x1001f028
call fcn.100121b7
lea eax, [esp + 0x14]
push eax
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push dword [esp + 0x10]
call fcn.100187e0
call fcn.1001c420
lea edx, str.userprofile
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x1000647f
push dword [esp + 0x14]
lea edx, [0x1001f028]
pop ecx
call fcn.10016130
je 0x1000647a
mov edx, dword [0x10023e80]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
lea eax, [esp + 0x18]
push eax
call fcn.1001c390
jmp 0x10006598
lea edx, str.allusersprofile
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
jne 0x100064b1
lea edx, str.programdata
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x100064e6
push dword [esp + 0x14]
lea edx, [0x1001f028]
pop ecx
call fcn.10016130
je 0x100064e1
mov edx, dword [0x10023ed4]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
lea eax, [esp + 0x18]
push eax
call fcn.1001c390
jmp 0x10006598
lea edx, str.appdata
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x10006531
push dword [esp + 0x14]
lea edx, [0x1001f028]
pop ecx
call fcn.10016130
je 0x1000652f
mov edx, dword [0x10023dac]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
lea eax, [esp + 0x18]
push eax
call fcn.1001c390
jmp 0x10006598
lea edx, str.localappdata
mov ecx, dword [esp]
push ecx
call fcn.10016170
pop ecx
add ecx, eax
call fcn.10016130
je 0x1000657c
push dword [esp + 0x14]
lea edx, [0x1001f028]
pop ecx
call fcn.10016130
je 0x1000657a
mov edx, dword [0x10023dac]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
lea eax, [esp + 0x18]
push eax
call fcn.1001c390
jmp 0x10006598
mov edx, dword [esp + 0x10]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
lea eax, [esp + 0x18]
push eax
call fcn.1001c390
call fcn.100161a0
mov edx, dword [esp + 0x10]
xor ecx, ecx
call fcn.10016130
jne 0x100065b7
push dword [esp + 0x10]
push dword [esp + 0xc]
call fcn.10019163
jmp 0x100063a7
call fcn.1000b03b
cmp dword [0x10024008], 0
je 0x100065e1
lea eax, [0x1001f93c]
push eax
call fcn.100195c4
and eax, eax
je 0x100065e1
mov eax, 1
jmp 0x100065e3
xor eax, eax
and eax, eax
je 0x100066c0
call fcn.100196ed
call fcn.10019717
and eax, eax
je 0x100066c0
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
call fcn.10019767
lea eax, [esp + 0xc]
push eax
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push 0x1001f028
push 0x1001f028
call fcn.100121b7
lea eax, [esp + 0x14]
push eax
call fcn.1001c390
lea eax, [0x1001f938]
push eax
push dword [esp + 0xc]
call fcn.10018530
mov dword [esp], eax
cmp dword [esp], 0
je 0x100066bb
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
mov ebx, dword [esp + 8]
inc ebx
push ebx
push dword [esp + 0x14]
call fcn.10018790
lea eax, [esp + 0x10]
push eax
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
mov ebx, dword [esp + 8]
dec ebx
push ebx
push dword [esp + 0x14]
call fcn.10018550
lea eax, [esp + 0xc]
push eax
call fcn.1001c390
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.100133ef
jmp 0x100066bb
jmp 0x100065f0
cmp dword [0x10024008], 0
je 0x100066e0
lea eax, str.Registry.CorrectPaths
push eax
call fcn.100195c4
and eax, eax
je 0x100066e0
mov eax, 1
jmp 0x100066e2
xor eax, eax
and eax, eax
je 0x10006860
call fcn.100196ed
call fcn.10019717
and eax, eax
je 0x10006860
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
call fcn.10019767
lea eax, [esp + 0xc]
push eax
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push 0x1001f028
push 0x1001f028
call fcn.100121b7
lea eax, [esp + 0x14]
push eax
call fcn.1001c390
lea eax, [0x1001f938]
push eax
push dword [esp + 0xc]
call fcn.10018530
mov dword [esp], eax
cmp dword [esp], 0
je 0x1000685b
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
mov ebx, dword [esp + 8]
inc ebx
push ebx
push dword [esp + 0x14]
call fcn.10018790
lea eax, [esp + 0x10]
push eax
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
mov ebx, dword [esp + 8]
dec ebx
push ebx
push dword [esp + 0x14]
call fcn.10018550
lea eax, [esp + 0xc]
push eax
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.10009376
lea eax, [esp + 0x1c]
push eax
call fcn.1001c390
push dword [esp + 0x10]
lea edx, [0x1001f028]
pop ecx
call fcn.10016130
je 0x100067fa
mov edx, dword [0x10023e84]
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c330
lea eax, [esp + 0x14]
push eax
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x24]
call fcn.1001141d
lea eax, [esp + 0x18]
push eax
call fcn.1001c390
mov edx, dword [esp + 0x14]
xor ecx, ecx
call fcn.10016130
jne 0x10006842
push dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
pop ecx
call fcn.10016130
jne 0x10006842
mov eax, 1
jmp 0x10006844
xor eax, eax
and eax, eax
je 0x10006859
push dword [esp + 0x14]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.100133ef
jmp 0x1000685b
jmp 0x100066ef
cmp dword [0x10023ed0], 0
je 0x100068e4
push 0
push 0x10024030
push 0x10024000
lea eax, [0x1000e6fc]
push eax
lea eax, str.GetVolumeInformationA
push eax
lea eax, str.kernel32
push eax
call fcn.1000c3be
push 0
push 0x10024050
push 0x1002401c
lea eax, [0x1000ead8]
push eax
lea eax, str.GetVolumeInformationW
push eax
lea eax, str.kernel32
push eax
call fcn.1000c3be
push 0
push 0x10023f3c
push 0x10023f40
lea eax, [0x1000bb1c]
push eax
lea eax, str.GetFileInformationByHandle
push eax
lea eax, str.kernel32
push eax
call fcn.1000c3be
mov edx, dword [esp + 0x34]
xor ecx, ecx
call fcn.10016130
jne 0x10006ae3
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
lea eax, [0x1001f30c]
push eax
lea eax, [0x1001f310]
push eax
push dword [esp + 0x44]
call fcn.10018cd0
lea eax, [esp + 0x38]
push eax
call fcn.1001c390
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
lea eax, [0x1001f30c]
push eax
lea eax, [0x1001f348]
push eax
push dword [esp + 0x44]
call fcn.10018cd0
lea eax, [esp + 0x38]
push eax
call fcn.1001c390
lea eax, [0x1001f30c]
push eax
push dword [esp + 0x38]
call fcn.10018530
mov dword [esp], eax
cmp dword [esp], 0
je 0x10006ae3
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
mov ebx, dword [esp + 0xc]
dec ebx
push ebx
push dword [esp + 0x44]
call fcn.10018550
call fcn.10016182
add dword [esp], edx
call fcn.10018850
call fcn.100161a0
push eax
lea ebp, [0x10024168]
pop eax
mov word [ebp], ax
mov ebx, dword [esp]
inc ebx
push ebx
lea eax, [0x1001f30c]
push eax
push dword [esp + 0x3c]
call fcn.10018470
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x10006ae3
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
mov ebx, dword [esp + 0x10]
sub ebx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x10]
inc ebx
push ebx
push dword [esp + 0x48]
call fcn.10018700
call fcn.10016182
add dword [esp], edx
call fcn.10018850
call fcn.100161a0
push eax
lea ebp, [0x10024168]
pop eax
mov word [ebp + 2], ax
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
mov ebx, dword [esp + 0x10]
inc ebx
push ebx
push dword [esp + 0x44]
call fcn.10018790
call fcn.10016182
add dword [esp], edx
call fcn.10018850
call fcn.100161a0
mov word [ebp + 6], ax
push 0
push 0x10023e68
push 0x10023e88
lea eax, [0x10003812]
push eax
lea eax, str.GetLocalTime
push eax
lea eax, str.kernel32
push eax
call fcn.1000c3be
push 0
push 0x10023fa8
push 0x10023f84
lea eax, [0x10015151]
push eax
lea eax, str.GetSystemTime
push eax
lea eax, str.kernel32
push eax
call fcn.1000c3be
push 0
push 0x10024014
push 0x10023fe4
lea eax, [0x10010e5b]
push eax
lea eax, str.GetSystemTimeAsFileTime
push eax
lea eax, str.kernel32
push eax
call fcn.1000c3be
lea eax, str.LoadLibrary
push eax
call fcn.100195c4
and eax, eax
je 0x10006b4a
call fcn.100196ed
call fcn.10019717
and eax, eax
je 0x10006b4a
push edx
call fcn.1001c2f0
pop edx
push eax
push 0x1001f028
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
call fcn.10019767
call fcn.10016182
add dword [esp], edx
call fcn.100121b7
lea eax, [esp + 0x54]
push eax
call fcn.1001c390
mov eax, dword [esp + 0x50]
push eax
call sub.KERNEL32.dll_LoadLibraryW
mov dword [esp + 0x54], eax
jmp 0x10006af8
cmp dword [0x10023f10], 0
je 0x10006b6a
lea eax, str.RunFromAttachProcess
push eax
call fcn.100195c4
and eax, eax
je 0x10006b6a
mov eax, 1
jmp 0x10006b6c
xor eax, eax
and eax, eax
je 0x10006bd2
call fcn.100196ed
call fcn.10019717
and eax, eax
je 0x10006bd2
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
call fcn.100197c8
call fcn.1001c420
push edx
call fcn.1001c2f0
pop edx
push eax
push edx
call fcn.1001c2f0
pop edx
push eax
call fcn.10019767
call fcn.10016182
add dword [esp], edx
call fcn.10016182
add dword [esp + 4], edx
call fcn.10008b13
call fcn.100161a0
jmp 0x10006b75
call fcn.1000bb51
call fcn.10019983
xor eax, eax
push dword [esp + 0x34]
call fcn.1001c4f0
push dword [esp + 0x38]
call fcn.1001c4f0
push dword [esp + 8]
call fcn.1001c4f0
push dword [esp + 0x14]
call fcn.1001c4f0
push dword [esp + 0x18]
call fcn.1001c4f0
push dword [esp + 0x10]
call fcn.1001c4f0
push dword [esp + 0xc]
call fcn.1001c4f0
push dword [esp + 0x50]
call fcn.1001c4f0
add esp, 0x58
pop ebx
pop ebp
ret 4