Function at 0x10004ab6
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
mov edx, 0x16
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x10004abd
call fcn.10018130
mov edx, dword [0x1002a5b4]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
mov edx, dword [0x10029ca0]
push edx
call fcn.10017fd0
push 0x1002a1ac
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
mov edx, dword [0x1002a1ac]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
lea edx, str..prefs
push edx
call fcn.10017fd0
call fcn.10012202
add dword [esp], edx
call fcn.1000895c
call fcn.10012220
and eax, eax
je 0x10004b66
mov edx, dword [0x1002a1ac]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
lea edx, str..prefs
push edx
call fcn.10017fd0
push 0x1002a1ac
call fcn.10018030
jmp 0x10004ca5
push edx
call fcn.10017f90
pop edx
push eax
mov edx, dword [0x1002a1ac]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
lea edx, str..ini
push edx
call fcn.10017fd0
call fcn.10012202
add dword [esp], edx
call fcn.1000895c
call fcn.10012220
and eax, eax
je 0x10004bd3
mov edx, dword [0x1002a1ac]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
lea edx, str..ini
push edx
call fcn.10017fd0
push 0x1002a1ac
call fcn.10018030
jmp 0x10004ca5
push edx
call fcn.10017f90
pop edx
push eax
mov edx, dword [0x1002a5b4]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
lea edx, str.PurePort.prefs
push edx
call fcn.10017fd0
call fcn.10012202
add dword [esp], edx
call fcn.1000895c
call fcn.10012220
and eax, eax
je 0x10004c3d
mov edx, dword [0x1002a5b4]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
lea edx, str.PurePort.prefs
push edx
call fcn.10017fd0
push 0x1002a1ac
call fcn.10018030
jmp 0x10004ca5
push edx
call fcn.10017f90
pop edx
push eax
mov edx, dword [0x1002a5b4]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
lea edx, str.PurePort.ini
push edx
call fcn.10017fd0
call fcn.10012202
add dword [esp], edx
call fcn.1000895c
call fcn.10012220
and eax, eax
je 0x10004ca5
mov edx, dword [0x1002a5b4]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
lea edx, str.PurePort.ini
push edx
call fcn.10017fd0
push 0x1002a1ac
call fcn.10018030
push 1
push dword [0x1002a1ac]
call fcn.10015314
mov ebx, eax
and ebx, ebx
jne 0x10004ced
push 0x10
lea eax, str.PurePortable
push eax
lea eax, str.Config_file_not_found_
push eax
push 0
call sub.USER32.dll_MessageBoxW
push 0
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_TerminateProcess
jmp 0x100063e5
mov dword [esp + 0x2c], 1
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push dword [0x1002a57c]
call fcn.10014460
call fcn.100180c0
lea edx, str.rundll32
call fcn.100121a0
mov ecx, eax
call fcn.100121b0
je 0x10004d33
mov dword [esp + 0x28], 2
jmp 0x10004d58
lea eax, str.Portable
push eax
call fcn.100156a4
and eax, eax
je 0x10004d58
push 1
lea eax, str.ValidateProgram
push eax
call fcn.10015798
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], 0
je 0x10004d76
lea eax, str.ValidateProgram
push eax
call fcn.100156a4
and eax, eax
je 0x10004d76
mov eax, 1
jmp 0x10004d78
xor eax, eax
and eax, eax
je 0x10004eef
call fcn.100157cd
call fcn.100157f7
and eax, eax
je 0x10004eef
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
call fcn.10015847
lea eax, [esp + 0xc]
push eax
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
call fcn.100158a8
lea eax, [esp + 0x10]
push eax
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push dword [esp + 0x10]
call fcn.10014460
call fcn.100180c0
lea edx, str.programname
mov ecx, dword [esp]
push ecx
call fcn.100121f0
pop ecx
add ecx, eax
call fcn.100121b0
jne 0x10004e20
lea edx, str.programfilename
mov ecx, dword [esp]
push ecx
call fcn.100121f0
pop ecx
add ecx, eax
call fcn.100121b0
je 0x10004e5d
push 1
push dword [esp + 0x14]
push dword [0x1002a57c]
call fcn.1000ef53
and eax, eax
je 0x10004e50
mov dword [esp + 0x2c], 0
push dword [esp]
call fcn.10012220
add esp, 4
jmp 0x10004eef
mov dword [esp + 0x2c], 1
jmp 0x10004ee5
lea edx, str.reaction
mov ecx, dword [esp]
push ecx
call fcn.100121f0
pop ecx
add ecx, eax
call fcn.100121b0
je 0x10004e85
push dword [esp + 0x10]
call fcn.100145b0
mov dword [esp + 0x30], eax
jmp 0x10004ee5
push edx
call fcn.10017f90
pop edx
push eax
push 1
push dword [esp + 0x18]
push edx
call fcn.10017f90
pop edx
push eax
push 0x10020028
push dword [esp + 0x20]
push dword [0x1002a238]
call fcn.10006896
call fcn.10012202
add dword [esp], edx
call fcn.1000ef53
call fcn.10012220
and eax, eax
je 0x10004edd
mov dword [esp + 0x2c], 0
push dword [esp]
call fcn.10012220
add esp, 4
jmp 0x10004eef
mov dword [esp + 0x2c], 1
call fcn.10012220
jmp 0x10004d85
cmp dword [esp + 0x24], 0
je 0x10004f06
mov ebx, dword [esp + 0x28]
cmp ebx, 1
jne 0x10004f06
mov eax, 1
jmp 0x10004f08
xor eax, eax
and eax, eax
je 0x10005060
mov ebx, dword [esp + 0x2c]
cmp ebx, 3
jne 0x10004f7b
push edx
call fcn.10017f90
pop edx
push eax
push 0x10
lea eax, str.PurePortable
push eax
push edx
call fcn.10017f90
pop edx
push eax
lea edx, str.Invalid_program
push edx
call fcn.10017fd0
mov edx, dword [0x1002a57c]
push edx
call fcn.10017fd0
lea edx, [0x1002018e]
push edx
call fcn.10017fd0
call fcn.100180c0
push 0
call fcn.10012202
add dword [esp + 4], edx
call sub.USER32.dll_MessageBoxW
call fcn.10012220
jmp 0x1000502a
mov ebx, dword [esp + 0x2c]
cmp ebx, 1
je 0x10004f8f
mov ebx, dword [esp + 0x2c]
cmp ebx, 2
je 0x10004f8f
jmp 0x10004f96
mov eax, 1
jmp 0x10004f98
xor eax, eax
and eax, eax
je 0x1000502a
mov dword [esp + 0x30], 0x14
mov ebx, dword [esp + 0x2c]
cmp ebx, 2
jne 0x10004fb9
add dword [esp + 0x30], 0x100
push edx
call fcn.10017f90
pop edx
push eax
push dword [esp + 0x34]
lea eax, str.PurePortable
push eax
push edx
call fcn.10017f90
pop edx
push eax
lea edx, str.Invalid_program
push edx
call fcn.10017fd0
mov edx, dword [0x1002a57c]
push edx
call fcn.10017fd0
lea edx, str.__rContinue_the_program_execution_
push edx
call fcn.10017fd0
call fcn.100180c0
push 0
call fcn.10012202
add dword [esp + 4], edx
call sub.USER32.dll_MessageBoxW
call fcn.10012220
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x20]
cmp ebx, 6
je 0x1000502a
mov dword [esp + 0x2c], 4
mov ebx, dword [esp + 0x2c]
cmp ebx, 3
je 0x1000503e
mov ebx, dword [esp + 0x2c]
cmp ebx, 4
je 0x1000503e
jmp 0x10005045
mov eax, 1
jmp 0x10005047
xor eax, eax
and eax, eax
je 0x1000505b
push 0
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_TerminateProcess
jmp 0x100063e5
push dword [0x1002a238]
lea eax, str.PP_PrgPath
push eax
call fcn.10015243
push dword [0x10029dec]
lea eax, str.PP_PrgDir
push eax
call fcn.10015243
lea eax, str.EnvironmentVariables
push eax
call fcn.100156a4
and eax, eax
je 0x10005109
call fcn.100157cd
call fcn.100157f7
and eax, eax
je 0x10005109
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
call fcn.10015847
lea eax, [esp + 0xc]
push eax
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push 0x10020028
push 0x10020028
call fcn.1000d16a
lea eax, [esp + 0x14]
push eax
call fcn.10018030
mov edx, dword [esp + 0x10]
xor ecx, ecx
call fcn.100121b0
jne 0x100050fe
push dword [esp + 0x10]
push dword [esp + 0xc]
call fcn.10015243
jmp 0x10005107
push dword [esp + 8]
call fcn.1001522d
jmp 0x10005099
lea eax, str.Portable
push eax
call fcn.100156a4
and eax, eax
je 0x1000540e
push 0
lea eax, str.Registry
push eax
call fcn.10015798
mov dword [0x1002a3f8], eax
cmp dword [0x1002a3f8], 0
je 0x10005152
push 1
lea eax, str.RegistryShlwapi
push eax
call fcn.10015798
mov dword [0x1002a5a8], eax
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
lea eax, [0x10020028]
push eax
lea eax, [0x1002047c]
push eax
call fcn.1001596f
lea eax, [esp + 0x14]
push eax
call fcn.10018030
mov edx, dword [esp + 0x10]
xor ecx, ecx
call fcn.100121b0
jne 0x100051ac
push edx
call fcn.10017f90
pop edx
push eax
push 0x10020028
push dword [esp + 0x18]
call fcn.1000d16a
push 0x1002a154
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push dword [0x1002a154]
call fcn.10015f17
call fcn.100180c0
lea edx, [0x10020028]
call fcn.100121a0
mov ecx, eax
call fcn.100121b0
je 0x1000520a
mov edx, dword [0x1002a154]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
lea edx, str..pphiv
push edx
call fcn.10017fd0
push 0x1002a154
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
lea eax, [0x10020028]
push eax
lea eax, str.InitFile
push eax
call fcn.1001596f
lea eax, [esp + 0x14]
push eax
call fcn.10018030
mov edx, dword [esp + 0x10]
xor ecx, ecx
call fcn.100121b0
jne 0x10005264
push edx
call fcn.10017f90
pop edx
push eax
push 0x10020028
push dword [esp + 0x18]
call fcn.1000d16a
push 0x10029b78
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push dword [0x10029b78]
call fcn.10015f17
call fcn.100180c0
lea edx, [0x10020028]
call fcn.100121a0
mov ecx, eax
call fcn.100121b0
je 0x100052c2
mov edx, dword [0x10029b78]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
lea edx, str..pport
push edx
call fcn.10017fd0
push 0x10029b78
call fcn.10018030
push 0
lea eax, str.SpecialFolders
push eax
call fcn.10015798
mov dword [0x10029bbc], eax
push 0
lea eax, str.EnvironmentVariables
push eax
call fcn.10015798
mov dword [0x1002a1cc], eax
push 0
lea eax, str.ProxyErrorMode
push eax
call fcn.10015798
mov dword [0x1002a798], eax
push 0
lea eax, str.MinHookErrorMode
push eax
call fcn.10015798
mov dword [0x1002a3e4], eax
push 0
lea eax, str.VolumeSerialNumber
push eax
call fcn.10015798
mov dword [0x10029f2c], eax
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
lea eax, [0x10020028]
push eax
lea eax, str.SpoofDate
push eax
call fcn.1001596f
lea eax, [esp + 0x38]
push eax
call fcn.10018030
push 0
lea eax, str.BlockWinInet
push eax
call fcn.10015798
mov dword [0x1002a390], eax
push 0
lea eax, str.BlockWinHttp
push eax
call fcn.10015798
mov dword [0x10029cdc], eax
push 0
lea eax, [0x100203e4]
push eax
call fcn.10015798
mov dword [0x1002a030], eax
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
lea eax, [0x10020028]
push eax
lea eax, str.CurrentDirectory
push eax
call fcn.1001596f
lea eax, [esp + 0x14]
push eax
call fcn.10018030
push dword [esp + 0x10]
lea edx, [0x10020028]
pop ecx
call fcn.100121b0
jne 0x1000540e
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push 0x10020028
push dword [esp + 0x1c]
call fcn.1000d16a
call fcn.10012202
add dword [esp], edx
call fcn.10015f9a
call fcn.10012220
mov dword [0x1002a6e4], 0
mov dword [0x1002a808], 0
mov dword [0x1002a5ac], 0
mov dword [0x1002a16c], 0
lea eax, str.Debug
push eax
call fcn.100156a4
and eax, eax
je 0x1000549e
push 0
lea eax, str.Registry
push eax
call fcn.10015798
mov dword [0x1002a6e4], eax
push 0
lea eax, str.SpecialFolders
push eax
call fcn.10015798
mov dword [0x1002a808], eax
push 0
lea eax, str.EnvironmentVariables
push eax
call fcn.10015798
mov dword [0x1002a5ac], eax
push 0
lea eax, str.Attach
push eax
call fcn.10015798
mov dword [0x1002a16c], eax
mov ebx, dword [esp + 0x28]
cmp ebx, 2
jne 0x100054ac
jmp 0x100063e5
cmp dword [0x1002a3f8], 0
je 0x100054cc
lea eax, str.Registry
push eax
call fcn.100156a4
and eax, eax
je 0x100054cc
mov eax, 1
jmp 0x100054ce
xor eax, eax
and eax, eax
je 0x100055fa
call fcn.100157cd
call fcn.100157f7
and eax, eax
je 0x100055fa
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
call fcn.10015847
call fcn.10012202
add dword [esp], edx
call fcn.10014460
lea eax, [esp + 0xc]
push eax
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
call fcn.100158a8
call fcn.10012202
add dword [esp], edx
call fcn.10014460
lea eax, [esp + 0x10]
push eax
call fcn.10018030
mov edx, dword [esp + 0xc]
xor ecx, ecx
call fcn.100121b0
jne 0x1000557c
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.100085fe
jmp 0x100055f5
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push 9
push dword [esp + 0x14]
call fcn.100143f0
call fcn.100180c0
lea edx, str.software_
call fcn.100121a0
mov ecx, eax
call fcn.100121b0
je 0x100055f5
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push 0xa
push dword [esp + 0x14]
call fcn.10014560
lea eax, [esp + 0x10]
push eax
call fcn.10018030
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.100085fe
push dword [esp + 0xc]
push dword [esp + 0x10]
call fcn.100085fe
jmp 0x100054db
cmp dword [0x10029bbc], 0
jne 0x1000560e
cmp dword [0x1002a1cc], 0
jne 0x1000560e
jmp 0x10005615
mov eax, 1
jmp 0x10005617
xor eax, eax
and eax, eax
je 0x10005632
lea eax, str.SpecialFolders
push eax
call fcn.100156a4
and eax, eax
je 0x10005632
mov eax, 1
jmp 0x10005634
xor eax, eax
and eax, eax
je 0x10005b86
push edx
call fcn.10017f90
pop edx
push eax
push 0x10020028
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
lea eax, [0x10020028]
push eax
lea eax, str.AllDirs
push eax
call fcn.1001596f
call fcn.10012202
add dword [esp], edx
call fcn.1000d16a
lea eax, [esp + 0x14]
push eax
call fcn.10018030
mov edx, dword [esp + 0x10]
xor ecx, ecx
call fcn.100121b0
jne 0x10005729
mov edx, dword [esp + 0x10]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
push 0x10029de0
call fcn.10018030
mov edx, dword [esp + 0x10]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
push 0x10029b10
call fcn.10018030
mov edx, dword [esp + 0x10]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
push 0x10029a88
call fcn.10018030
mov edx, dword [esp + 0x10]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
push 0x1002a564
call fcn.10018030
mov edx, dword [esp + 0x10]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
push 0x10029f30
call fcn.10018030
push dword [esp + 0x10]
call fcn.1000ae59
call fcn.100157cd
call fcn.100157f7
and eax, eax
je 0x10005b86
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
call fcn.10015847
lea eax, [esp + 0xc]
push eax
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
call fcn.100158a8
lea eax, [esp + 0x10]
push eax
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push 0x10020028
push 0x10020028
call fcn.1000d16a
lea eax, [esp + 0x14]
push eax
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push dword [esp + 0x10]
call fcn.10014460
call fcn.100180c0
lea edx, str.profile
mov ecx, dword [esp]
push ecx
call fcn.100121f0
pop ecx
add ecx, eax
call fcn.100121b0
je 0x100057fb
mov edx, dword [esp + 0x14]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
push 0x10029de0
call fcn.10018030
push dword [esp + 0x14]
call fcn.1000ae59
jmp 0x10005b7c
lea edx, str.appdata
mov ecx, dword [esp]
push ecx
call fcn.100121f0
pop ecx
add ecx, eax
call fcn.100121b0
je 0x1000583e
mov edx, dword [esp + 0x14]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
push 0x10029b10
call fcn.10018030
push dword [esp + 0x14]
call fcn.1000ae59
jmp 0x10005b7c
lea edx, str.localappdata
mov ecx, dword [esp]
push ecx
call fcn.100121f0
pop ecx
add ecx, eax
call fcn.100121b0
je 0x10005881
mov edx, dword [esp + 0x14]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
push 0x10029a88
call fcn.10018030
push dword [esp + 0x14]
call fcn.1000ae59
jmp 0x10005b7c
lea edx, str.localappdatalow
mov ecx, dword [esp]
push ecx
call fcn.100121f0
pop ecx
add ecx, eax
call fcn.100121b0
je 0x100058c4
mov edx, dword [esp + 0x14]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
push 0x1002a564
call fcn.10018030
push dword [esp + 0x14]
call fcn.1000ae59
jmp 0x10005b7c
lea edx, str.commonappdata
mov ecx, dword [esp]
push ecx
call fcn.100121f0
pop ecx
add ecx, eax
call fcn.100121b0
je 0x10005907
mov edx, dword [esp + 0x14]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
push 0x10029f30
call fcn.10018030
push dword [esp + 0x14]
call fcn.1000ae59
jmp 0x10005b7c
lea edx, str.documents
mov ecx, dword [esp]
push ecx
call fcn.100121f0
pop ecx
add ecx, eax
call fcn.100121b0
je 0x1000594a
mov edx, dword [esp + 0x14]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
push 0x10029e24
call fcn.10018030
push dword [esp + 0x14]
call fcn.1000ae59
jmp 0x10005b7c
lea edx, str.commondocuments
mov ecx, dword [esp]
push ecx
call fcn.100121f0
pop ecx
add ecx, eax
call fcn.100121b0
je 0x1000598d
mov edx, dword [esp + 0x14]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
push 0x10029d4c
call fcn.10018030
push dword [esp + 0x14]
call fcn.1000ae59
jmp 0x10005b7c
mov edx, dword [esp + 0xc]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
lea eax, [esp + 0x40]
push eax
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push 1
push dword [esp + 0x18]
call fcn.100143f0
call fcn.100180c0
lea edx, [0x1002067e]
call fcn.100121a0
mov ecx, eax
call fcn.100121b0
je 0x10005a08
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push 2
push dword [esp + 0x48]
call fcn.10014560
lea eax, [esp + 0x40]
push eax
call fcn.10018030
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x40]
call fcn.1000b55b
and eax, eax
je 0x10005a8f
inc dword [0x10029b8c]
mov eax, dword [0x10029b8c]
inc eax
push 0x1002a86c
push eax
call fcn.10017691
push 0x10
mov ebx, dword [0x10029b8c]
mov ebp, dword [0x1002a86c]
imul ebx, ebx, 0x14
add ebp, ebx
lea eax, [ebp]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.10017b70
mov edx, dword [esp + 0x14]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
mov ebx, dword [0x10029b8c]
mov ebp, dword [0x1002a86c]
imul ebx, ebx, 0x14
add ebp, ebx
lea eax, [ebp + 0x10]
push eax
call fcn.10018030
push dword [esp + 0x14]
call fcn.1000ae59
jmp 0x10005b7c
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push 2
push dword [esp + 0x18]
call fcn.100143f0
call fcn.100180c0
lea edx, [0x10020310]
call fcn.100121a0
mov ecx, eax
call fcn.100121b0
je 0x10005b03
push edx
call fcn.10017f90
pop edx
push eax
lea edx, [0x100201be]
push edx
call fcn.10017fd0
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push 3
push dword [esp + 0x1c]
call fcn.10014560
pop eax
lea eax, [esp + 0x10]
push eax
call fcn.10018030
push dword [esp + 0xc]
call fcn.100145b0
mov dword [esp + 0x50], eax
cmp dword [esp + 0x50], 0
je 0x10005b7c
inc dword [0x10029d64]
mov eax, dword [0x10029d64]
inc eax
push 0x1002a874
push eax
call fcn.10017691
push dword [esp + 0x50]
mov ebx, dword [0x10029d64]
mov ebp, dword [0x1002a874]
shl ebx, 3
add ebp, ebx
pop eax
mov dword [ebp], eax
mov edx, dword [esp + 0x14]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
mov ebx, dword [0x10029d64]
mov ebp, dword [0x1002a874]
shl ebx, 3
add ebp, ebx
lea eax, [ebp + 4]
push eax
call fcn.10018030
push dword [esp + 0x14]
call fcn.1000ae59
call fcn.10012220
jmp 0x1000572e
cmp dword [0x1002a1cc], 0
je 0x10005ba6
lea eax, str.EnvironmentVariables
push eax
call fcn.100156a4
and eax, eax
je 0x10005ba6
mov eax, 1
jmp 0x10005ba8
xor eax, eax
and eax, eax
je 0x10005dca
call fcn.100157cd
call fcn.100157f7
and eax, eax
je 0x10005dca
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
call fcn.10015847
lea eax, [esp + 0xc]
push eax
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
call fcn.100158a8
lea eax, [esp + 0x10]
push eax
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push 0x10020028
push 0x10020028
call fcn.1000d16a
lea eax, [esp + 0x14]
push eax
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push dword [esp + 0x10]
call fcn.10014460
call fcn.100180c0
lea edx, str.userprofile
mov ecx, dword [esp]
push ecx
call fcn.100121f0
pop ecx
add ecx, eax
call fcn.100121b0
je 0x10005c8d
push dword [esp + 0x14]
lea edx, [0x10020028]
pop ecx
call fcn.100121b0
je 0x10005c88
mov edx, dword [0x10029de0]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
lea eax, [esp + 0x18]
push eax
call fcn.10018030
jmp 0x10005da6
lea edx, str.allusersprofile
mov ecx, dword [esp]
push ecx
call fcn.100121f0
pop ecx
add ecx, eax
call fcn.100121b0
jne 0x10005cbf
lea edx, str.programdata
mov ecx, dword [esp]
push ecx
call fcn.100121f0
pop ecx
add ecx, eax
call fcn.100121b0
je 0x10005cf4
push dword [esp + 0x14]
lea edx, [0x10020028]
pop ecx
call fcn.100121b0
je 0x10005cef
mov edx, dword [0x10029f30]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
lea eax, [esp + 0x18]
push eax
call fcn.10018030
jmp 0x10005da6
lea edx, str.appdata
mov ecx, dword [esp]
push ecx
call fcn.100121f0
pop ecx
add ecx, eax
call fcn.100121b0
je 0x10005d3f
push dword [esp + 0x14]
lea edx, [0x10020028]
pop ecx
call fcn.100121b0
je 0x10005d3d
mov edx, dword [0x10029b10]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
lea eax, [esp + 0x18]
push eax
call fcn.10018030
jmp 0x10005da6
lea edx, str.localappdata
mov ecx, dword [esp]
push ecx
call fcn.100121f0
pop ecx
add ecx, eax
call fcn.100121b0
je 0x10005d8a
push dword [esp + 0x14]
lea edx, [0x10020028]
pop ecx
call fcn.100121b0
je 0x10005d88
mov edx, dword [0x10029b10]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
lea eax, [esp + 0x18]
push eax
call fcn.10018030
jmp 0x10005da6
mov edx, dword [esp + 0x10]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
lea eax, [esp + 0x18]
push eax
call fcn.10018030
call fcn.10012220
mov edx, dword [esp + 0x10]
xor ecx, ecx
call fcn.100121b0
jne 0x10005dc5
push dword [esp + 0x10]
push dword [esp + 0xc]
call fcn.10015243
jmp 0x10005bb5
call fcn.10008a17
cmp dword [0x1002a3f8], 0
je 0x10005def
lea eax, str.Registry.SetPaths
push eax
call fcn.100156a4
and eax, eax
je 0x10005def
mov eax, 1
jmp 0x10005df1
xor eax, eax
and eax, eax
je 0x10005ece
call fcn.100157cd
call fcn.100157f7
and eax, eax
je 0x10005ece
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
call fcn.10015847
lea eax, [esp + 0xc]
push eax
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push 0x10020028
push 0x10020028
call fcn.1000d16a
lea eax, [esp + 0x14]
push eax
call fcn.10018030
lea eax, [0x10020682]
push eax
push dword [esp + 0xc]
call fcn.10014990
mov dword [esp], eax
cmp dword [esp], 0
je 0x10005ec9
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
mov ebx, dword [esp + 8]
inc ebx
push ebx
push dword [esp + 0x14]
call fcn.10014560
lea eax, [esp + 0x10]
push eax
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
mov ebx, dword [esp + 8]
dec ebx
push ebx
push dword [esp + 0x14]
call fcn.100143f0
lea eax, [esp + 0xc]
push eax
call fcn.10018030
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.1000de9e
jmp 0x10005ec9
jmp 0x10005dfe
cmp dword [0x1002a3f8], 0
je 0x10005eee
lea eax, str.Registry.CorrectPaths
push eax
call fcn.100156a4
and eax, eax
je 0x10005eee
mov eax, 1
jmp 0x10005ef0
xor eax, eax
and eax, eax
je 0x1000606e
call fcn.100157cd
call fcn.100157f7
and eax, eax
je 0x1000606e
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
call fcn.10015847
lea eax, [esp + 0xc]
push eax
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push 0x10020028
push 0x10020028
call fcn.1000d16a
lea eax, [esp + 0x14]
push eax
call fcn.10018030
lea eax, [0x10020682]
push eax
push dword [esp + 0xc]
call fcn.10014990
mov dword [esp], eax
cmp dword [esp], 0
je 0x10006069
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
mov ebx, dword [esp + 8]
inc ebx
push ebx
push dword [esp + 0x14]
call fcn.10014560
lea eax, [esp + 0x10]
push eax
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
mov ebx, dword [esp + 8]
dec ebx
push ebx
push dword [esp + 0x14]
call fcn.100143f0
lea eax, [esp + 0xc]
push eax
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.10007412
lea eax, [esp + 0x1c]
push eax
call fcn.10018030
push dword [esp + 0x10]
lea edx, [0x10020028]
pop ecx
call fcn.100121b0
je 0x10006008
mov edx, dword [0x10029dec]
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017fd0
lea eax, [esp + 0x14]
push eax
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x24]
call fcn.1000c39a
lea eax, [esp + 0x18]
push eax
call fcn.10018030
mov edx, dword [esp + 0x14]
xor ecx, ecx
call fcn.100121b0
jne 0x10006050
push dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
pop ecx
call fcn.100121b0
jne 0x10006050
mov eax, 1
jmp 0x10006052
xor eax, eax
and eax, eax
je 0x10006067
push dword [esp + 0x14]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.1000de9e
jmp 0x10006069
jmp 0x10005efd
cmp dword [0x10029f2c], 0
je 0x100060f2
push 0
push 0x1002a4c4
push 0x1002a3e8
lea eax, [0x1000addf]
push eax
lea eax, str.GetVolumeInformationA
push eax
lea eax, str.kernel32
push eax
call fcn.1000905f
push 0
push 0x1002a534
push 0x1002a458
lea eax, [0x1000b140]
push eax
lea eax, str.GetVolumeInformationW
push eax
lea eax, str.kernel32
push eax
call fcn.1000905f
push 0
push 0x1002a08c
push 0x1002a0d0
lea eax, [0x10008d89]
push eax
lea eax, str.GetFileInformationByHandle
push eax
lea eax, str.kernel32
push eax
call fcn.1000905f
mov edx, dword [esp + 0x34]
xor ecx, ecx
call fcn.100121b0
jne 0x100062f1
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
lea eax, [0x1002021c]
push eax
lea eax, [0x10020220]
push eax
push dword [esp + 0x44]
call fcn.10014cf0
lea eax, [esp + 0x38]
push eax
call fcn.10018030
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
lea eax, [0x1002021c]
push eax
lea eax, [0x1002028c]
push eax
push dword [esp + 0x44]
call fcn.10014cf0
lea eax, [esp + 0x38]
push eax
call fcn.10018030
lea eax, [0x1002021c]
push eax
push dword [esp + 0x38]
call fcn.10014990
mov dword [esp], eax
cmp dword [esp], 0
je 0x100062f1
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
mov ebx, dword [esp + 0xc]
dec ebx
push ebx
push dword [esp + 0x44]
call fcn.100143f0
call fcn.10012202
add dword [esp], edx
call fcn.100145b0
call fcn.10012220
push eax
lea ebp, [0x1002a82c]
pop eax
mov word [ebp], ax
mov ebx, dword [esp]
inc ebx
push ebx
lea eax, [0x1002021c]
push eax
push dword [esp + 0x3c]
call fcn.100148d0
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x100062f1
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
mov ebx, dword [esp + 0x10]
sub ebx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x10]
inc ebx
push ebx
push dword [esp + 0x48]
call fcn.100144d0
call fcn.10012202
add dword [esp], edx
call fcn.100145b0
call fcn.10012220
push eax
lea ebp, [0x1002a82c]
pop eax
mov word [ebp + 2], ax
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
mov ebx, dword [esp + 0x10]
inc ebx
push ebx
push dword [esp + 0x44]
call fcn.10014560
call fcn.10012202
add dword [esp], edx
call fcn.100145b0
call fcn.10012220
mov word [ebp + 6], ax
push 0
push 0x10029d9c
push 0x10029e0c
lea eax, [0x10002dc4]
push eax
lea eax, str.GetLocalTime
push eax
lea eax, str.kernel32
push eax
call fcn.1000905f
push 0
push 0x1002a268
push 0x1002a1e0
lea eax, [0x10010070]
push eax
lea eax, str.GetSystemTime
push eax
lea eax, str.kernel32
push eax
call fcn.1000905f
push 0
push 0x1002a410
push 0x1002a394
lea eax, [0x1000c2d4]
push eax
lea eax, str.GetSystemTimeAsFileTime
push eax
lea eax, str.kernel32
push eax
call fcn.1000905f
lea eax, str.LoadLibrary
push eax
call fcn.100156a4
and eax, eax
je 0x10006358
call fcn.100157cd
call fcn.100157f7
and eax, eax
je 0x10006358
push edx
call fcn.10017f90
pop edx
push eax
push 0x10020028
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
call fcn.10015847
call fcn.10012202
add dword [esp], edx
call fcn.1000d16a
lea eax, [esp + 0x54]
push eax
call fcn.10018030
mov eax, dword [esp + 0x50]
push eax
call sub.KERNEL32.dll_LoadLibraryW
mov dword [esp + 0x54], eax
jmp 0x10006306
cmp dword [0x1002a010], 0
je 0x10006378
lea eax, str.RunOnAttach
push eax
call fcn.100156a4
and eax, eax
je 0x10006378
mov eax, 1
jmp 0x1000637a
xor eax, eax
and eax, eax
je 0x100063e0
call fcn.100157cd
call fcn.100157f7
and eax, eax
je 0x100063e0
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
call fcn.100158a8
call fcn.100180c0
push edx
call fcn.10017f90
pop edx
push eax
push edx
call fcn.10017f90
pop edx
push eax
call fcn.10015847
call fcn.10012202
add dword [esp], edx
call fcn.10012202
add dword [esp + 4], edx
call fcn.1000cbc8
call fcn.10012220
jmp 0x10006383
call fcn.10008dbe
call fcn.10015a63
xor eax, eax
push dword [esp + 0x34]
call fcn.10018190
push dword [esp + 0x38]
call fcn.10018190
push dword [esp + 8]
call fcn.10018190
push dword [esp + 0x14]
call fcn.10018190
push dword [esp + 0x18]
call fcn.10018190
push dword [esp + 0x10]
call fcn.10018190
push dword [esp + 0xc]
call fcn.10018190
push dword [esp + 0x50]
call fcn.10018190
add esp, 0x58
pop ebx
pop ebp
ret 4