Function at 0x1005adf9
Capabilities:
Accept command line arguments

Disassembly:
push ebp
sub esp, 0x5c
mov eax, 0x100a4174
call fcn.1007c8b4
sub esp, 0x258
mov eax, dword [ebp + 0x6c]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
push edi
mov dword [ebp - 0x10], esp
sub eax, ebx
je 0x1005b59a
sub eax, 1
jne 0x1005b583
push 0x104
mov edi, 0x100d3010
mov byte [ebp - 4], 1
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1005afde
push edi
lea ecx, [ebp - 0x58]
call fcn.100789d3
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
call fcn.1005a1a3
pop ecx
test al, al
jne 0x1005afb9
lea eax, [ebp - 0x58]
push eax
call fcn.10059f25
pop ecx
test al, al
jne 0x1005afb9
lea eax, [ebp - 0x58]
push eax
call fcn.10059d95
pop ecx
test al, al
jne 0x1005afb9
lea eax, [ebp - 0x58]
push eax
call fcn.10059c87
pop ecx
test al, al
jne 0x1005afb9
push str.jnwnzvagreargraunaprefreivpr
mov byte [ebp + 0x6c], bl
lea ecx, [ebp + 0x48]
push dword [ebp + 0x6c]
mov dword [ebp + 0x48], ebx
push 0x1c
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x5c], 0xf
mov byte [ebp + 0x48], bl
call fcn.10002f18
cmp dword [ebp + 0x5c], 0x10
lea ecx, [ebp + 0x48]
mov eax, dword [ebp + 0x58]
lea edi, [ebp + 0x48]
cmovae ecx, dword [ebp + 0x48]
lea esi, [ebp + 0x48]
cmovae edi, dword [ebp + 0x48]
add eax, ecx
cmp dword [ebp + 0x5c], 0x10
mov byte [ebp - 4], 3
cmovae esi, dword [ebp + 0x48]
mov dword [ebp + 0x6c], eax
cmp esi, eax
je 0x1005af04
movzx eax, byte [esi]
push eax
call fcn.100767ae
mov byte [edi], al
inc esi
mov eax, dword [ebp + 0x6c]
inc edi
pop ecx
jmp 0x1005aeed
push str..exe
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x30]
push eax
call fcn.1000b41f
add esp, 0xc
mov esi, eax
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x58]
call fcn.10007d4b
cmp dword [esi + 0x14], 0x10
jb 0x1005af33
mov esi, dword [esi]
cmp dword [eax + 0x14], 0x10
jb 0x1005af3b
mov eax, dword [eax]
push esi
push eax
call fcn.10085427
pop ecx
pop ecx
lea ecx, [ebp + 0x10]
mov esi, eax
call fcn.100028b5
lea ecx, [ebp + 0x30]
call fcn.100028b5
movzx ecx, byte [0x100d2fdd]
test esi, esi
push 1
pop eax
cmove ecx, eax
mov eax, dword [ebp + 0x5c]
mov byte [0x100d2fdd], cl
cmp eax, 0x10
jb 0x1005afa2
mov ecx, dword [ebp + 0x48]
inc eax
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x44], ecx
cmp eax, 0x1000
jb 0x1005af99
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x44]
push eax
call fcn.10001c26
mov eax, dword [ebp + 0x6c]
pop ecx
pop ecx
mov ecx, dword [ebp + 0x44]
push eax
push ecx
call fcn.1007c382
pop ecx
pop ecx
lea ecx, [ebp - 0x58]
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x5c], 0xf
mov byte [ebp + 0x48], bl
call fcn.10008b9f
jmp 0x1005afd9
xor ebx, ebx
lea ecx, [ebp - 0x58]
inc ebx
mov byte [0x100d321d], bl
call fcn.10008b9f
mov eax, ebx
jmp 0x1005b586
mov edi, 0x100d3010
mov dword [ebp - 4], ebx
call fcn.1007282a
call fcn.10049c5b
mov byte [ebp + 0x44], al
test al, al
jne 0x1005affd
call fcn.1007938a
test al, al
mov al, bl
je 0x1005afff
mov al, 1
mov byte [0x100d3117], al
call fcn.10049c98
test al, al
je 0x1005b024
call fcn.100784b1
test al, al
je 0x1005b024
call fcn.1007a7eb
test al, al
jne 0x1005b024
call fcn.10059a6e
cmp byte [0x100d3117], 0
je 0x1005b110
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
call esi
push str.__type
push eax
call fcn.1007dce0
pop ecx
pop ecx
test eax, eax
jne 0x1005b053
mov byte [0x100d3115], 1
jmp 0x1005b089
call esi
push 0x100a9f64
push eax
call fcn.1007dce0
pop ecx
pop ecx
test eax, eax
jne 0x1005b082
call fcn.10079371
test al, al
je 0x1005b089
call esi
push str.__typeutility
push eax
call fcn.1007dce0
pop ecx
pop ecx
test eax, eax
je 0x1005b089
mov byte [0x100d3116], 1
lea eax, [ebp + 0x48]
push edi
push eax
call fcn.1005960f
pop ecx
pop ecx
mov ecx, 0x100ccab4
cmp eax, ecx
je 0x1005b0aa
mov byte [ebp + 0x6c], bl
push dword [ebp + 0x6c]
push eax
call fcn.10005e62
lea ecx, [ebp + 0x48]
call fcn.100028b5
cmp byte [0x100d3115], 0
jne 0x1005b0c4
cmp byte [0x100d3116], 0
je 0x1005b110
call fcn.10079371
test al, al
jne 0x1005b102
push dword [ebp + 0x44]
movzx eax, byte [0x100d3116]
push eax
lea eax, [ebp + 0x48]
push edi
push eax
call fcn.10058c63
mov ecx, 0x100cca9c
add esp, 0x10
cmp eax, ecx
je 0x1005b0fa
mov byte [ebp + 0x6c], bl
push dword [ebp + 0x6c]
push eax
call fcn.10005e62
lea ecx, [ebp + 0x48]
call fcn.100028b5
call fcn.1007a7eb
test al, al
jne 0x1005b110
call fcn.10059a6e
mov ecx, ebx
mov al, byte [ecx + 0x100d3010]
mov byte [ebp + ecx - 0x160], al
inc ecx
test al, al
jne 0x1005b112
lea eax, [ebp - 0x160]
push eax
call fcn.100821a7
xor eax, eax
mov edi, 0x100d2ff0
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x100d2ff0], eax
mov dword [0x100d2ff4], 1
call fcn.10076cfc
mov dword [0x100d3000], eax
call fcn.10076cfc
mov dword [0x100d3004], eax
call fcn.10076cfc
mov dword [0x100d3008], eax
call fcn.10049eca
test al, al
jne 0x1005b181
call fcn.10049f0d
test al, al
je 0x1005b18c
call fcn.10071a1a
or dword [0x100d2ffc], eax
mov esi, dword [ebp + 0x68]
mov edi, 0x100d3118
push 0x105
push edi
push esi
mov dword [0x100d2fe8], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x100d3494
push edi
push 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
push 3
lea eax, [ebp - 0x260]
push edi
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x264], eax
call fcn.100599a6
push dword [ebp - 0x264]
push 0x105
push 0x100d3220
call fcn.1008adf2
lea eax, [ebp - 0x260]
add esp, 0xc
cmp dword [ebp - 0x264], eax
je 0x1005b201
push dword [ebp - 0x264]
call fcn.1008582f
pop ecx
call fcn.1005a151
test al, al
je 0x1005b240
call fcn.1005910b
cmp dword [0x100ccae0], 0x10
mov eax, 0x100ccacc
cmovae eax, dword [0x100ccacc]
push eax
push 0x100d3010
call fcn.10085619
test eax, eax
pop ecx
sete byte [0x100d2fdf]
pop ecx
test eax, eax
je 0x1005b583
call fcn.10068678
push 0x100d3010
call fcn.1006a7d2
pop ecx
push esi
lea ecx, [ebp + 8]
mov byte [0x100d2fde], al
call fcn.1007a517
lea ecx, [ebp + 0x48]
mov byte [ebp - 4], 6
push ecx
mov ecx, eax
call fcn.1007a5ec
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 7
jb 0x1005b279
mov eax, dword [eax]
push eax
lea ecx, [ebp + 0x28]
call fcn.10078f92
lea ecx, [ebp + 0x48]
call fcn.100028b5
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xa
call fcn.1007a587
lea eax, [ebp]
push eax
lea ecx, [ebp + 0x28]
call fcn.100790d0
call fcn.10050730
mov edi, eax
lea ecx, [ebp]
push 4
lea eax, [ebp + 0x10]
push eax
mov dword [edi + 4], esi
call fcn.1007a128
push eax
lea ecx, [edi + 0x50]
call fcn.10005e08
lea ecx, [ebp + 0x10]
call fcn.100028b5
lea eax, [ebp - 0x160]
push str.firefox.exe
push eax
call fcn.1007dce0
pop ecx
pop ecx
test eax, eax
jne 0x1005b370
lea eax, [ebp - 0x160]
push str.iexplore.exe
push eax
call fcn.1007dce0
pop ecx
pop ecx
test eax, eax
jne 0x1005b370
lea eax, [ebp - 0x160]
push str.waol.exe
push eax
call fcn.1007dce0
pop ecx
pop ecx
test eax, eax
jne 0x1005b370
lea eax, [ebp - 0x160]
push str.aolbrowser.exe
push eax
call fcn.1007dce0
pop ecx
pop ecx
test eax, eax
jne 0x1005b370
lea eax, [ebp - 0x160]
push str.aoldesktop.exe
push eax
call fcn.1007dce0
pop ecx
pop ecx
test eax, eax
jne 0x1005b370
lea eax, [ebp - 0x160]
push str.aolhelix.exe
push eax
call fcn.1007dce0
pop ecx
pop ecx
test eax, eax
jne 0x1005b370
lea eax, [ebp - 0x160]
push str.msn.exe
push eax
call fcn.1007dce0
pop ecx
pop ecx
test eax, eax
je 0x1005b37a
mov dword [0x100d2fec], 1
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x100d300c], eax
call fcn.1003b56b
test al, al
jne 0x1005b3a6
call fcn.1003b493
test al, al
jne 0x1005b3a6
call fcn.1003b643
test al, al
mov al, bl
je 0x1005b3a8
mov al, 1
mov byte [0x100d2fdc], al
call fcn.100784b1
test al, al
jne 0x1005b43f
call fcn.10049e5d
test al, al
je 0x1005b43f
call fcn.100546f9
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
call fcn.100546f9
push 1
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
mov al, byte [0x100d2da8]
test al, al
je 0x1005b417
call fcn.10050730
lea edi, [eax + 0x50]
cmp dword [edi + 0x14], 0x10
jb 0x1005b3f5
mov edi, dword [edi]
lea ecx, [ebp + 0x6f]
call fcn.100574be
mov esi, eax
mov ecx, esi
call fcn.10055394
push edi
push esi
push 4
call fcn.100546cc
mov al, byte [0x100d2da8]
add esp, 0xc
cmp byte [0x100d2fde], 0
je 0x1005b43f
test al, al
je 0x1005b43f
lea ecx, [ebp + 0x6f]
call fcn.100576c7
mov esi, eax
mov ecx, esi
call fcn.100500d0
push esi
push 4
call fcn.100546cc
pop ecx
pop ecx
call fcn.10049c98
test al, al
je 0x1005b497
mov esi, 0x100cca84
push 0x100d3220
mov ecx, esi
call fcn.10004f55
push 1
mov byte [ebp - 4], 0xb
call fcn.1007b313
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x40]
mov byte [ebp - 4], 0xc
push eax
push esi
call fcn.1005700b
add esp, 0xc
mov byte [ebp - 4], 0xa
lea ecx, [ebp + 0x40]
call fcn.1000a591
push str.system32
push str.syswow64
push esi
call fcn.10056f88
add esp, 0xc
call fcn.10049c5b
test al, al
jne 0x1005b4c2
call fcn.10049eca
test al, al
jne 0x1005b4c2
call fcn.10049c98
test al, al
jne 0x1005b4c2
call fcn.1007938a
test al, al
jne 0x1005b4c2
mov esi, 0x100d3430
jmp 0x1005b4e9
xor ecx, ecx
mov esi, 0x100d3430
inc ecx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x1005b4e9
lea eax, [ebp + 0x6c]
push eax
push ebx
push ebx
push 0x1005a393
push ebx
push ebx
call fcn.10085aee
add esp, 0x18
cmp byte [0x100d2fdd], 0
jne 0x1005b50c
call fcn.10049c46
test al, al
jne 0x1005b50c
call fcn.10049e87
test al, al
jne 0x1005b50c
cmp byte [0x100d2fde], al
je 0x1005b53e
call fcn.1007a7eb
test al, al
jne 0x1005b51c
call fcn.10059a6e
jmp 0x1005b53e
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x1005b53e
lea eax, [ebp + 0x6c]
push eax
push ebx
push ebx
push 0x1005a393
push ebx
push ebx
call fcn.10085aee
add esp, 0x18
call fcn.10059c37
test al, al
jne 0x1005b550
call fcn.1007a7eb
test al, al
je 0x1005b555
call fcn.1005870c
call fcn.10049c98
test al, al
je 0x1005b57b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.1006626d
mov dword [0x100d342c], eax
pop ecx
test eax, eax
je 0x1005b57b
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea ecx, [ebp + 0x28]
call fcn.10004ea7
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add ebp, 0x60
leave
ret 0xc
cmp byte [0x100d2fdf], bl
jne 0x1005b583
mov eax, dword [0x100d342c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1005b5b4
push eax
call esi
cmp byte [0x100d321d], bl
jne 0x1005b583
cmp dword [0x100d2cf0], ebx
je 0x1005b5de
call fcn.10053e1c
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x1388
push dword [0x100d2cf4]
call edi
jmp 0x1005b5e4
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x100d300c]
test eax, eax
je 0x1005b5f0
push eax
call esi
xorps xmm0, xmm0
movlpd qword [ebp + 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x1c], ebx
call fcn.1004a587
call fcn.100398e2
call fcn.10049c98
test al, al
je 0x1005b625
cmp byte [0x100d34c1], bl
jne 0x1005b625
push ebx
call fcn.1004b51f
call fcn.1004af76
lea ecx, [ebp + 0x38]
call fcn.10035ef3
push 0x53b
lea ecx, [ebp + 0x38]
mov byte [ebp - 4], 0xd
call fcn.100364ff
push ebx
push 0x10
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp + 0x38]
call fcn.1003640d
call fcn.1003b2ce
push 0x3e8
lea ecx, [ebp + 0x38]
push ecx
mov ecx, eax
call fcn.1005ee31
call fcn.1005abea
push 0x9c4
push dword [eax + 4]
call edi
push ebx
mov ecx, 0x100d2cec
call fcn.1005077d
push ebx
mov ecx, 0x100d344c
call fcn.1005adb1
call fcn.1005a95c
push ebx
mov ecx, 0x100d14e0
call fcn.1003b31b
lea ecx, [ebp + 0x38]
call fcn.10015fd0
jmp 0x1005b583