Function at 0x1000546e
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
mov edx, 0x19
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x10005475
call fcn.1001f500
mov edx, dword [0x100321a8]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
mov edx, dword [0x10031830]
push edx
call fcn.1001f3a0
push 0x10031d70
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
mov edx, dword [0x10031d70]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
lea edx, [0x10029670]
push edx
call fcn.1001f3a0
call fcn.10019202
add dword [esp], edx
call fcn.1000b48c
call fcn.10019220
and eax, eax
je 0x1000551e
mov edx, dword [0x10031d70]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
lea edx, [0x10029670]
push edx
call fcn.1001f3a0
push 0x10031d70
call fcn.1001f400
jmp 0x1000565d
push edx
call fcn.1001f360
pop edx
push eax
mov edx, dword [0x10031d70]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
lea edx, str..ini
push edx
call fcn.1001f3a0
call fcn.10019202
add dword [esp], edx
call fcn.1000b48c
call fcn.10019220
and eax, eax
je 0x1000558b
mov edx, dword [0x10031d70]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
lea edx, str..ini
push edx
call fcn.1001f3a0
push 0x10031d70
call fcn.1001f400
jmp 0x1000565d
push edx
call fcn.1001f360
pop edx
push eax
mov edx, dword [0x100321a8]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
lea edx, str.PurePort.prefs
push edx
call fcn.1001f3a0
call fcn.10019202
add dword [esp], edx
call fcn.1000b48c
call fcn.10019220
and eax, eax
je 0x100055f5
mov edx, dword [0x100321a8]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
lea edx, str.PurePort.prefs
push edx
call fcn.1001f3a0
push 0x10031d70
call fcn.1001f400
jmp 0x1000565d
push edx
call fcn.1001f360
pop edx
push eax
mov edx, dword [0x100321a8]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
lea edx, str.PurePort.ini
push edx
call fcn.1001f3a0
call fcn.10019202
add dword [esp], edx
call fcn.1000b48c
call fcn.10019220
and eax, eax
je 0x1000565d
mov edx, dword [0x100321a8]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
lea edx, str.PurePort.ini
push edx
call fcn.1001f3a0
push 0x10031d70
call fcn.1001f400
push 1
push dword [0x10031d70]
call fcn.1001c2a4
mov ebx, eax
and ebx, ebx
jne 0x100056a5
push 0x10
lea eax, str.PurePortable
push eax
lea eax, str.Config_file_not_found_
push eax
push 0
call sub.USER32.dll_MessageBoxW
push 0
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_TerminateProcess
jmp 0x1000706a
lea eax, str.Portable
push eax
call fcn.1001c634
mov ebx, eax
and ebx, ebx
jne 0x100056eb
push 0x10
lea eax, str.PurePortable
push eax
lea eax, str.Section__Portable__not_found_
push eax
push 0
call sub.USER32.dll_MessageBoxW
push 0
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_TerminateProcess
jmp 0x1000706a
push 0
lea eax, str.MultiConfig
push eax
call fcn.1001c728
and eax, eax
je 0x10005712
mov edx, dword [esp + 8]
xor ecx, ecx
call fcn.100191b0
jne 0x10005712
call fcn.1001c75d
mov dword [esp + 0x38], 1
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push dword [0x1003216c]
call fcn.1001b760
call fcn.1001f490
lea edx, str.rundll32
call fcn.100191a0
mov ecx, eax
call fcn.100191b0
je 0x10005758
mov dword [esp + 0x34], 2
jmp 0x1000577d
lea eax, str.Portable
push eax
call fcn.1001c634
and eax, eax
je 0x1000577d
push 1
lea eax, str.ValidateProgram
push eax
call fcn.1001c728
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
je 0x1000579b
lea eax, str.ValidateProgram
push eax
call fcn.1001c634
and eax, eax
je 0x1000579b
mov eax, 1
jmp 0x1000579d
xor eax, eax
and eax, eax
je 0x10005914
call fcn.1001c76f
call fcn.1001c799
and eax, eax
je 0x10005914
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
call fcn.1001c7e9
lea eax, [esp + 0x14]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
call fcn.1001c84a
lea eax, [esp + 0x18]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push dword [esp + 0x18]
call fcn.1001b760
call fcn.1001f490
lea edx, str.programname
mov ecx, dword [esp]
push ecx
call fcn.100191f0
pop ecx
add ecx, eax
call fcn.100191b0
jne 0x10005845
lea edx, str.programfilename
mov ecx, dword [esp]
push ecx
call fcn.100191f0
pop ecx
add ecx, eax
call fcn.100191b0
je 0x10005882
push 1
push dword [esp + 0x1c]
push dword [0x1003216c]
call fcn.10015651
and eax, eax
je 0x10005875
mov dword [esp + 0x38], 0
push dword [esp]
call fcn.10019220
add esp, 4
jmp 0x10005914
mov dword [esp + 0x38], 1
jmp 0x1000590a
lea edx, str.reaction
mov ecx, dword [esp]
push ecx
call fcn.100191f0
pop ecx
add ecx, eax
call fcn.100191b0
je 0x100058aa
push dword [esp + 0x18]
call fcn.1001b7d0
mov dword [esp + 0x3c], eax
jmp 0x1000590a
push edx
call fcn.1001f360
pop edx
push eax
push 1
push dword [esp + 0x20]
push edx
call fcn.1001f360
pop edx
push eax
push 0x10027028
push dword [esp + 0x28]
push dword [0x10031e04]
call fcn.100081e1
call fcn.10019202
add dword [esp], edx
call fcn.10015651
call fcn.10019220
and eax, eax
je 0x10005902
mov dword [esp + 0x38], 0
push dword [esp]
call fcn.10019220
add esp, 4
jmp 0x10005914
mov dword [esp + 0x38], 1
call fcn.10019220
jmp 0x100057aa
cmp dword [esp + 0x30], 0
je 0x1000592b
mov ebx, dword [esp + 0x34]
cmp ebx, 1
jne 0x1000592b
mov eax, 1
jmp 0x1000592d
xor eax, eax
and eax, eax
je 0x10005a85
mov ebx, dword [esp + 0x38]
cmp ebx, 3
jne 0x100059a0
push edx
call fcn.1001f360
pop edx
push eax
push 0x10
lea eax, str.PurePortable
push eax
push edx
call fcn.1001f360
pop edx
push eax
lea edx, str.Invalid_program
push edx
call fcn.1001f3a0
mov edx, dword [0x1003216c]
push edx
call fcn.1001f3a0
lea edx, [0x10027222]
push edx
call fcn.1001f3a0
call fcn.1001f490
push 0
call fcn.10019202
add dword [esp + 4], edx
call sub.USER32.dll_MessageBoxW
call fcn.10019220
jmp 0x10005a4f
mov ebx, dword [esp + 0x38]
cmp ebx, 1
je 0x100059b4
mov ebx, dword [esp + 0x38]
cmp ebx, 2
je 0x100059b4
jmp 0x100059bb
mov eax, 1
jmp 0x100059bd
xor eax, eax
and eax, eax
je 0x10005a4f
mov dword [esp + 0x3c], 0x14
mov ebx, dword [esp + 0x38]
cmp ebx, 2
jne 0x100059de
add dword [esp + 0x3c], 0x100
push edx
call fcn.1001f360
pop edx
push eax
push dword [esp + 0x40]
lea eax, str.PurePortable
push eax
push edx
call fcn.1001f360
pop edx
push eax
lea edx, str.Invalid_program
push edx
call fcn.1001f3a0
mov edx, dword [0x1003216c]
push edx
call fcn.1001f3a0
lea edx, str.__rContinue_the_program_execution_
push edx
call fcn.1001f3a0
call fcn.1001f490
push 0
call fcn.10019202
add dword [esp + 4], edx
call sub.USER32.dll_MessageBoxW
call fcn.10019220
mov dword [esp + 0x2c], eax
mov ebx, dword [esp + 0x2c]
cmp ebx, 6
je 0x10005a4f
mov dword [esp + 0x38], 4
mov ebx, dword [esp + 0x38]
cmp ebx, 3
je 0x10005a63
mov ebx, dword [esp + 0x38]
cmp ebx, 4
je 0x10005a63
jmp 0x10005a6a
mov eax, 1
jmp 0x10005a6c
xor eax, eax
and eax, eax
je 0x10005a80
push 0
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_TerminateProcess
jmp 0x1000706a
push dword [0x10031e04]
lea eax, str.PP_PrgPath
push eax
call fcn.1001c1d3
push dword [0x10031980]
lea eax, str.PP_PrgDir
push eax
call fcn.1001c1d3
push dword [0x1003216c]
lea eax, str.PP_PrgName
push eax
call fcn.1001c1d3
lea eax, str.EnvironmentVariables
push eax
call fcn.1001c634
and eax, eax
je 0x10005b3e
call fcn.1001c76f
call fcn.1001c799
and eax, eax
je 0x10005b3e
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
call fcn.1001c7e9
lea eax, [esp + 0x14]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
call fcn.1001c84a
lea eax, [esp + 0x1c]
push eax
call fcn.1001f400
mov edx, dword [esp + 0x18]
xor ecx, ecx
call fcn.100191b0
jne 0x10005b33
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.1001c1d3
jmp 0x10005b3c
push dword [esp + 0x10]
call fcn.1001c1bd
jmp 0x10005ad0
lea eax, str.EnvironmentVariables.SetPaths
push eax
call fcn.1001c634
and eax, eax
je 0x10005bb8
call fcn.1001c76f
call fcn.1001c799
and eax, eax
je 0x10005bb8
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
call fcn.1001c7e9
lea eax, [esp + 0x14]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push 0x10027028
push 0x10027028
call fcn.10013354
lea eax, [esp + 0x1c]
push eax
call fcn.1001f400
mov edx, dword [esp + 0x18]
xor ecx, ecx
call fcn.100191b0
jne 0x10005bb6
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.1001c1d3
jmp 0x10005b53
lea eax, str.Portable
push eax
call fcn.1001c634
and eax, eax
je 0x10005ee6
push 0
lea eax, str.Registry
push eax
call fcn.1001c728
mov dword [0x10031fe0], eax
cmp dword [0x10031fe0], 0
je 0x10005c01
push 1
lea eax, str.RegistryShlwapi
push eax
call fcn.1001c728
mov dword [0x1003219c], eax
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
lea eax, [0x10027028]
push eax
lea eax, str.DataFile
push eax
call fcn.1001c911
lea eax, [esp + 0x1c]
push eax
call fcn.1001f400
mov edx, dword [esp + 0x18]
xor ecx, ecx
call fcn.100191b0
jne 0x10005c5b
push edx
call fcn.1001f360
pop edx
push eax
push 0x10027028
push dword [esp + 0x20]
call fcn.10013354
push 0x10031d14
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push dword [0x10031d14]
call fcn.1001cea7
call fcn.1001f490
lea edx, [0x10027028]
call fcn.100191a0
mov ecx, eax
call fcn.100191b0
je 0x10005cb9
mov edx, dword [0x10031d14]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
lea edx, str..pport
push edx
call fcn.1001f3a0
push 0x10031d14
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
lea eax, [0x10027028]
push eax
lea eax, str.InitFile
push eax
call fcn.1001c911
lea eax, [esp + 0x1c]
push eax
call fcn.1001f400
mov edx, dword [esp + 0x18]
xor ecx, ecx
call fcn.100191b0
jne 0x10005d13
push edx
call fcn.1001f360
pop edx
push eax
push 0x10027028
push dword [esp + 0x20]
call fcn.10013354
push 0x100316ec
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push dword [0x100316ec]
call fcn.1001cea7
call fcn.1001f490
lea edx, [0x10027028]
call fcn.100191a0
mov ecx, eax
call fcn.100191b0
je 0x10005d71
mov edx, dword [0x100316ec]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
lea edx, str..pport
push edx
call fcn.1001f3a0
push 0x100316ec
call fcn.1001f400
push 0
lea eax, str.RegistryDll
push eax
call fcn.1001c728
mov ebx, eax
cmp ebx, 1
jne 0x10005d9a
lea edx, str.kernelbase
lea ecx, [0x10031c04]
call fcn.10018008
push 0
lea eax, str.SpecialFolders
push eax
call fcn.1001c728
mov dword [0x10031738], eax
push 0
lea eax, str.EnvironmentVariables
push eax
call fcn.1001c728
mov dword [0x10031d94], eax
push 0
lea eax, str.ProxyErrorMode
push eax
call fcn.1001c728
mov dword [0x10032398], eax
push 0
lea eax, str.MinHookErrorMode
push eax
call fcn.1001c728
mov dword [0x10031fcc], eax
push 0
lea eax, str.VolumeSerialNumber
push eax
call fcn.1001c728
mov dword [0x10031acc], eax
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
lea eax, [0x10027028]
push eax
lea eax, str.SpoofDate
push eax
call fcn.1001c911
lea eax, [esp + 0x44]
push eax
call fcn.1001f400
push 0
lea eax, str.BlockWinInet
push eax
call fcn.1001c728
mov dword [0x10031f70], eax
push 0
lea eax, str.BlockWinHttp
push eax
call fcn.1001c728
mov dword [0x1003186c], eax
push 0
lea eax, str.BlockWinSocks
push eax
call fcn.1001c728
mov dword [0x10031be0], eax
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
lea eax, [0x10027028]
push eax
lea eax, str.CurrentDirectory
push eax
call fcn.1001c911
lea eax, [esp + 0x1c]
push eax
call fcn.1001f400
push dword [esp + 0x18]
lea edx, [0x10027028]
pop ecx
call fcn.100191b0
jne 0x10005ee6
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push 0x10027028
push dword [esp + 0x24]
call fcn.10013354
call fcn.10019202
add dword [esp], edx
call fcn.1001cf2a
call fcn.10019220
mov dword [0x100322ec], 0
mov dword [0x1003240c], 0
mov dword [0x100321a0], 0
mov dword [0x10031d2c], 0
lea eax, str.Debug
push eax
call fcn.1001c634
and eax, eax
je 0x10005f76
push 0
lea eax, str.Registry
push eax
call fcn.1001c728
mov dword [0x100322ec], eax
push 0
lea eax, str.SpecialFolders
push eax
call fcn.1001c728
mov dword [0x1003240c], eax
push 0
lea eax, str.EnvironmentVariables
push eax
call fcn.1001c728
mov dword [0x100321a0], eax
push 0
lea eax, str.Attach
push eax
call fcn.1001c728
mov dword [0x10031d2c], eax
mov ebx, dword [esp + 0x34]
cmp ebx, 2
jne 0x10005f84
jmp 0x1000706a
cmp dword [0x10031fe0], 0
je 0x10005fa4
lea eax, str.Registry
push eax
call fcn.1001c634
and eax, eax
je 0x10005fa4
mov eax, 1
jmp 0x10005fa6
xor eax, eax
and eax, eax
je 0x100060d2
call fcn.1001c76f
call fcn.1001c799
and eax, eax
je 0x100060d2
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
call fcn.1001c7e9
call fcn.10019202
add dword [esp], edx
call fcn.1001b760
lea eax, [esp + 0x14]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
call fcn.1001c84a
call fcn.10019202
add dword [esp], edx
call fcn.1001b760
lea eax, [esp + 0x18]
push eax
call fcn.1001f400
mov edx, dword [esp + 0x14]
xor ecx, ecx
call fcn.100191b0
jne 0x10006054
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.1000aeaa
jmp 0x100060cd
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push 9
push dword [esp + 0x1c]
call fcn.1001b5c0
call fcn.1001f490
lea edx, str.software_
call fcn.100191a0
mov ecx, eax
call fcn.100191b0
je 0x100060cd
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push 0xa
push dword [esp + 0x1c]
call fcn.1001b710
lea eax, [esp + 0x18]
push eax
call fcn.1001f400
push dword [esp + 0x14]
push dword [esp + 0x14]
call fcn.1000aeaa
push dword [esp + 0x14]
push dword [esp + 0x18]
call fcn.1000aeaa
jmp 0x10005fb3
cmp dword [0x10031738], 0
jne 0x100060e6
cmp dword [0x10031d94], 0
jne 0x100060e6
jmp 0x100060ed
mov eax, 1
jmp 0x100060ef
xor eax, eax
and eax, eax
je 0x1000610a
lea eax, str.SpecialFolders
push eax
call fcn.1001c634
and eax, eax
je 0x1000610a
mov eax, 1
jmp 0x1000610c
xor eax, eax
and eax, eax
je 0x1000665e
push edx
call fcn.1001f360
pop edx
push eax
push 0x10027028
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
lea eax, [0x10027028]
push eax
lea eax, str.AllDirs
push eax
call fcn.1001c911
call fcn.10019202
add dword [esp], edx
call fcn.10013354
lea eax, [esp + 0x1c]
push eax
call fcn.1001f400
mov edx, dword [esp + 0x18]
xor ecx, ecx
call fcn.100191b0
jne 0x10006201
mov edx, dword [esp + 0x18]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
push 0x10031974
call fcn.1001f400
mov edx, dword [esp + 0x18]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
push 0x10031680
call fcn.1001f400
mov edx, dword [esp + 0x18]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
push 0x100315f0
call fcn.1001f400
mov edx, dword [esp + 0x18]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
push 0x10032154
call fcn.1001f400
mov edx, dword [esp + 0x18]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
push 0x10031ad0
call fcn.1001f400
push dword [esp + 0x18]
call fcn.1000ee6f
call fcn.1001c76f
call fcn.1001c799
and eax, eax
je 0x1000665e
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
call fcn.1001c7e9
lea eax, [esp + 0x14]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
call fcn.1001c84a
lea eax, [esp + 0x18]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push 0x10027028
push 0x10027028
call fcn.10013354
lea eax, [esp + 0x1c]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push dword [esp + 0x18]
call fcn.1001b760
call fcn.1001f490
lea edx, str.profile
mov ecx, dword [esp]
push ecx
call fcn.100191f0
pop ecx
add ecx, eax
call fcn.100191b0
je 0x100062d3
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
push 0x10031974
call fcn.1001f400
push dword [esp + 0x1c]
call fcn.1000ee6f
jmp 0x10006654
lea edx, str.appdata
mov ecx, dword [esp]
push ecx
call fcn.100191f0
pop ecx
add ecx, eax
call fcn.100191b0
je 0x10006316
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
push 0x10031680
call fcn.1001f400
push dword [esp + 0x1c]
call fcn.1000ee6f
jmp 0x10006654
lea edx, str.localappdata
mov ecx, dword [esp]
push ecx
call fcn.100191f0
pop ecx
add ecx, eax
call fcn.100191b0
je 0x10006359
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
push 0x100315f0
call fcn.1001f400
push dword [esp + 0x1c]
call fcn.1000ee6f
jmp 0x10006654
lea edx, str.localappdatalow
mov ecx, dword [esp]
push ecx
call fcn.100191f0
pop ecx
add ecx, eax
call fcn.100191b0
je 0x1000639c
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
push 0x10032154
call fcn.1001f400
push dword [esp + 0x1c]
call fcn.1000ee6f
jmp 0x10006654
lea edx, str.commonappdata
mov ecx, dword [esp]
push ecx
call fcn.100191f0
pop ecx
add ecx, eax
call fcn.100191b0
je 0x100063df
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
push 0x10031ad0
call fcn.1001f400
push dword [esp + 0x1c]
call fcn.1000ee6f
jmp 0x10006654
lea edx, str.documents
mov ecx, dword [esp]
push ecx
call fcn.100191f0
pop ecx
add ecx, eax
call fcn.100191b0
je 0x10006422
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
push 0x100319b8
call fcn.1001f400
push dword [esp + 0x1c]
call fcn.1000ee6f
jmp 0x10006654
lea edx, str.commondocuments
mov ecx, dword [esp]
push ecx
call fcn.100191f0
pop ecx
add ecx, eax
call fcn.100191b0
je 0x10006465
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
push 0x100318dc
call fcn.1001f400
push dword [esp + 0x1c]
call fcn.1000ee6f
jmp 0x10006654
mov edx, dword [esp + 0x14]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
lea eax, [esp + 0x4c]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push 1
push dword [esp + 0x20]
call fcn.1001b5c0
call fcn.1001f490
lea edx, [0x100278fc]
call fcn.100191a0
mov ecx, eax
call fcn.100191b0
je 0x100064e0
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push 2
push dword [esp + 0x54]
call fcn.1001b710
lea eax, [esp + 0x4c]
push eax
call fcn.1001f400
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x4c]
call fcn.1000f747
and eax, eax
je 0x10006567
inc dword [0x10031700]
mov eax, dword [0x10031700]
inc eax
push 0x10032484
push eax
call fcn.1001ea61
push 0x10
mov ebx, dword [0x10031700]
mov ebp, dword [0x10032484]
imul ebx, ebx, 0x14
add ebp, ebx
lea eax, [ebp]
push eax
lea eax, [esp + 0x54]
push eax
call fcn.1001ed70
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
mov ebx, dword [0x10031700]
mov ebp, dword [0x10032484]
imul ebx, ebx, 0x14
add ebp, ebx
lea eax, [ebp + 0x10]
push eax
call fcn.1001f400
push dword [esp + 0x1c]
call fcn.1000ee6f
jmp 0x10006654
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push 2
push dword [esp + 0x20]
call fcn.1001b5c0
call fcn.1001f490
lea edx, [0x100274a4]
call fcn.100191a0
mov ecx, eax
call fcn.100191b0
je 0x100065db
push edx
call fcn.1001f360
pop edx
push eax
lea edx, [0x10027252]
push edx
call fcn.1001f3a0
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push 3
push dword [esp + 0x24]
call fcn.1001b710
pop eax
lea eax, [esp + 0x18]
push eax
call fcn.1001f400
push dword [esp + 0x14]
call fcn.1001b7d0
mov dword [esp + 0x5c], eax
cmp dword [esp + 0x5c], 0
je 0x10006654
inc dword [0x100318f4]
mov eax, dword [0x100318f4]
inc eax
push 0x1003248c
push eax
call fcn.1001ea61
push dword [esp + 0x5c]
mov ebx, dword [0x100318f4]
mov ebp, dword [0x1003248c]
shl ebx, 3
add ebp, ebx
pop eax
mov dword [ebp], eax
mov edx, dword [esp + 0x1c]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
mov ebx, dword [0x100318f4]
mov ebp, dword [0x1003248c]
shl ebx, 3
add ebp, ebx
lea eax, [ebp + 4]
push eax
call fcn.1001f400
push dword [esp + 0x1c]
call fcn.1000ee6f
call fcn.10019220
jmp 0x10006206
cmp dword [0x10031d94], 0
je 0x1000667e
lea eax, str.EnvironmentVariables
push eax
call fcn.1001c634
and eax, eax
je 0x1000667e
mov eax, 1
jmp 0x10006680
xor eax, eax
and eax, eax
je 0x100068a2
call fcn.1001c76f
call fcn.1001c799
and eax, eax
je 0x100068a2
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
call fcn.1001c7e9
lea eax, [esp + 0x14]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
call fcn.1001c84a
lea eax, [esp + 0x18]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push 0x10027028
push 0x10027028
call fcn.10013354
lea eax, [esp + 0x1c]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push dword [esp + 0x18]
call fcn.1001b760
call fcn.1001f490
lea edx, str.userprofile
mov ecx, dword [esp]
push ecx
call fcn.100191f0
pop ecx
add ecx, eax
call fcn.100191b0
je 0x10006765
push dword [esp + 0x1c]
lea edx, [0x10027028]
pop ecx
call fcn.100191b0
je 0x10006760
mov edx, dword [0x10031974]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
lea eax, [esp + 0x20]
push eax
call fcn.1001f400
jmp 0x1000687e
lea edx, str.allusersprofile
mov ecx, dword [esp]
push ecx
call fcn.100191f0
pop ecx
add ecx, eax
call fcn.100191b0
jne 0x10006797
lea edx, str.programdata
mov ecx, dword [esp]
push ecx
call fcn.100191f0
pop ecx
add ecx, eax
call fcn.100191b0
je 0x100067cc
push dword [esp + 0x1c]
lea edx, [0x10027028]
pop ecx
call fcn.100191b0
je 0x100067c7
mov edx, dword [0x10031ad0]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
lea eax, [esp + 0x20]
push eax
call fcn.1001f400
jmp 0x1000687e
lea edx, str.appdata
mov ecx, dword [esp]
push ecx
call fcn.100191f0
pop ecx
add ecx, eax
call fcn.100191b0
je 0x10006817
push dword [esp + 0x1c]
lea edx, [0x10027028]
pop ecx
call fcn.100191b0
je 0x10006815
mov edx, dword [0x10031680]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
lea eax, [esp + 0x20]
push eax
call fcn.1001f400
jmp 0x1000687e
lea edx, str.localappdata
mov ecx, dword [esp]
push ecx
call fcn.100191f0
pop ecx
add ecx, eax
call fcn.100191b0
je 0x10006862
push dword [esp + 0x1c]
lea edx, [0x10027028]
pop ecx
call fcn.100191b0
je 0x10006860
mov edx, dword [0x10031680]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
lea eax, [esp + 0x20]
push eax
call fcn.1001f400
jmp 0x1000687e
mov edx, dword [esp + 0x18]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
lea eax, [esp + 0x20]
push eax
call fcn.1001f400
call fcn.10019220
mov edx, dword [esp + 0x18]
xor ecx, ecx
call fcn.100191b0
jne 0x1000689d
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.1001c1d3
jmp 0x1000668d
call fcn.1000b693
cmp dword [0x10031fe0], 0
je 0x10006cf3
lea eax, str.Registry.SetData
push eax
call fcn.1001c634
and eax, eax
je 0x10006a80
call fcn.1001c76f
call fcn.1001c799
and eax, eax
je 0x10006a80
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
call fcn.1001c7e9
lea eax, [esp + 0x14]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
call fcn.1001c84a
lea eax, [esp + 0x1c]
push eax
call fcn.1001f400
lea eax, [0x1002795a]
push eax
push dword [esp + 0x14]
call fcn.1001b5a0
mov dword [esp], eax
cmp dword [esp], 0
je 0x10006a7b
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
mov ebx, dword [esp + 8]
inc ebx
push ebx
push dword [esp + 0x1c]
call fcn.1001b710
lea eax, [esp + 0x18]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
mov ebx, dword [esp + 8]
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.1001b5c0
lea eax, [esp + 0x14]
push eax
call fcn.1001f400
lea eax, [0x100273fa]
push eax
push dword [esp + 0x1c]
call fcn.1001b5a0
mov dword [esp], eax
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
mov ebx, dword [esp + 0x10]
dec ebx
push ebx
push dword [esp + 0x2c]
call fcn.1001b5c0
call fcn.10019202
add dword [esp], edx
call fcn.1001b760
lea eax, [esp + 0x28]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
mov ebx, dword [esp + 8]
inc ebx
push ebx
push dword [esp + 0x24]
call fcn.1001b710
lea eax, [esp + 0x1c]
push eax
call fcn.1001f400
push dword [esp + 0x24]
lea edx, [0x1002789e]
mov ecx, dword [esp]
call fcn.100191b0
je 0x10006a30
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.10014978
jmp 0x10006a7a
lea edx, [0x100276a6]
mov ecx, dword [esp]
call fcn.100191b0
je 0x10006a59
push dword [esp + 0x1c]
call fcn.1001b7d0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.100143e5
jmp 0x10006a7a
lea edx, [0x10027648]
mov ecx, dword [esp]
call fcn.100191b0
je 0x10006a7a
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.10014264
pop eax
jmp 0x100068cd
lea eax, str.Registry.SetPaths
push eax
call fcn.1001c634
and eax, eax
je 0x10006b69
call fcn.1001c76f
call fcn.1001c799
and eax, eax
je 0x10006b69
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
call fcn.1001c7e9
lea eax, [esp + 0x14]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push 0x10027028
push 0x10027028
call fcn.10013354
lea eax, [esp + 0x1c]
push eax
call fcn.1001f400
lea eax, [0x1002795a]
push eax
push dword [esp + 0x14]
call fcn.1001b5a0
mov dword [esp], eax
cmp dword [esp], 0
je 0x10006b64
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
mov ebx, dword [esp + 8]
inc ebx
push ebx
push dword [esp + 0x1c]
call fcn.1001b710
lea eax, [esp + 0x18]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
mov ebx, dword [esp + 8]
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.1001b5c0
lea eax, [esp + 0x14]
push eax
call fcn.1001f400
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.10014978
jmp 0x10006b64
jmp 0x10006a99
lea eax, str.Registry.CorrectPaths
push eax
call fcn.1001c634
and eax, eax
je 0x10006cf3
call fcn.1001c76f
call fcn.1001c799
and eax, eax
je 0x10006cf3
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
call fcn.1001c7e9
lea eax, [esp + 0x14]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push 0x10027028
push 0x10027028
call fcn.10013354
lea eax, [esp + 0x1c]
push eax
call fcn.1001f400
lea eax, [0x1002795a]
push eax
push dword [esp + 0x14]
call fcn.1001b5a0
mov dword [esp], eax
cmp dword [esp], 0
je 0x10006cee
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
mov ebx, dword [esp + 8]
inc ebx
push ebx
push dword [esp + 0x1c]
call fcn.1001b710
lea eax, [esp + 0x18]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
mov ebx, dword [esp + 8]
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.1001b5c0
lea eax, [esp + 0x14]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.10009bb0
lea eax, [esp + 0x24]
push eax
call fcn.1001f400
push dword [esp + 0x18]
lea edx, [0x10027028]
pop ecx
call fcn.100191b0
je 0x10006c8d
mov edx, dword [0x10031980]
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f3a0
lea eax, [esp + 0x1c]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push 0
push dword [esp + 0x20]
push dword [esp + 0x2c]
call fcn.1001249e
lea eax, [esp + 0x20]
push eax
call fcn.1001f400
mov edx, dword [esp + 0x1c]
xor ecx, ecx
call fcn.100191b0
jne 0x10006cd5
push dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
pop ecx
call fcn.100191b0
jne 0x10006cd5
mov eax, 1
jmp 0x10006cd7
xor eax, eax
and eax, eax
je 0x10006cec
push dword [esp + 0x1c]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.10014978
jmp 0x10006cee
jmp 0x10006b82
cmp dword [0x10031acc], 0
je 0x10006d77
push 0
push 0x100320b0
push 0x10031fd0
lea eax, [0x1000edf5]
push eax
lea eax, str.GetVolumeInformationA
push eax
lea eax, str.kernel32
push eax
call fcn.1000cc71
push 0
push 0x10032120
push 0x10032044
lea eax, [0x1000f231]
push eax
lea eax, str.GetVolumeInformationW
push eax
lea eax, str.kernel32
push eax
call fcn.1000cc71
push 0
push 0x10031c48
push 0x10031c8c
lea eax, [0x1000c3c4]
push eax
lea eax, str.GetFileInformationByHandle
push eax
lea eax, str.kernel32
push eax
call fcn.1000cc71
mov edx, dword [esp + 0x40]
xor ecx, ecx
call fcn.100191b0
jne 0x10006f76
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
lea eax, [0x1002730c]
push eax
lea eax, [0x10027310]
push eax
push dword [esp + 0x50]
call fcn.1001bc50
lea eax, [esp + 0x44]
push eax
call fcn.1001f400
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
lea eax, [0x1002730c]
push eax
lea eax, [0x10027348]
push eax
push dword [esp + 0x50]
call fcn.1001bc50
lea eax, [esp + 0x44]
push eax
call fcn.1001f400
lea eax, [0x1002730c]
push eax
push dword [esp + 0x44]
call fcn.1001b5a0
mov dword [esp], eax
cmp dword [esp], 0
je 0x10006f76
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
mov ebx, dword [esp + 0xc]
dec ebx
push ebx
push dword [esp + 0x50]
call fcn.1001b5c0
call fcn.10019202
add dword [esp], edx
call fcn.1001b7d0
call fcn.10019220
push eax
lea ebp, [0x10032434]
pop eax
mov word [ebp], ax
mov ebx, dword [esp]
inc ebx
push ebx
lea eax, [0x1002730c]
push eax
push dword [esp + 0x48]
call fcn.1001b4e0
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x10006f76
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
mov ebx, dword [esp + 0x10]
sub ebx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x10]
inc ebx
push ebx
push dword [esp + 0x54]
call fcn.1001b680
call fcn.10019202
add dword [esp], edx
call fcn.1001b7d0
call fcn.10019220
push eax
lea ebp, [0x10032434]
pop eax
mov word [ebp + 2], ax
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
mov ebx, dword [esp + 0x10]
inc ebx
push ebx
push dword [esp + 0x50]
call fcn.1001b710
call fcn.10019202
add dword [esp], edx
call fcn.1001b7d0
call fcn.10019220
mov word [ebp + 6], ax
push 0
push 0x1003192c
push 0x100319a0
lea eax, [0x100037d4]
push eax
lea eax, str.GetLocalTime
push eax
lea eax, str.kernel32
push eax
call fcn.1000cc71
push 0
push 0x10031e34
push 0x10031da8
lea eax, [0x10016a21]
push eax
lea eax, str.GetSystemTime
push eax
lea eax, str.kernel32
push eax
call fcn.1000cc71
push 0
push 0x10031ffc
push 0x10031f74
lea eax, [0x10011eb4]
push eax
lea eax, str.GetSystemTimeAsFileTime
push eax
lea eax, str.kernel32
push eax
call fcn.1000cc71
lea eax, str.LoadLibrary
push eax
call fcn.1001c634
and eax, eax
je 0x10006fdd
call fcn.1001c76f
call fcn.1001c799
and eax, eax
je 0x10006fdd
push edx
call fcn.1001f360
pop edx
push eax
push 0x10027028
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
call fcn.1001c7e9
call fcn.10019202
add dword [esp], edx
call fcn.10013354
lea eax, [esp + 0x60]
push eax
call fcn.1001f400
mov eax, dword [esp + 0x5c]
push eax
call sub.KERNEL32.dll_LoadLibraryW
mov dword [esp + 0x60], eax
jmp 0x10006f8b
cmp dword [0x10031bbc], 0
je 0x10006ffd
lea eax, str.RunFromAttachProcess
push eax
call fcn.1001c634
and eax, eax
je 0x10006ffd
mov eax, 1
jmp 0x10006fff
xor eax, eax
and eax, eax
je 0x10007065
call fcn.1001c76f
call fcn.1001c799
and eax, eax
je 0x10007065
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
call fcn.1001c84a
call fcn.1001f490
push edx
call fcn.1001f360
pop edx
push eax
push edx
call fcn.1001f360
pop edx
push eax
call fcn.1001c7e9
call fcn.10019202
add dword [esp], edx
call fcn.10019202
add dword [esp + 4], edx
call fcn.1000918b
call fcn.10019220
jmp 0x10007008
call fcn.1000c3f9
call fcn.1001c75d
xor eax, eax
push dword [esp + 0x40]
call fcn.1001f560
push dword [esp + 0x44]
call fcn.1001f560
push dword [esp + 0x10]
call fcn.1001f560
push dword [esp + 0x1c]
call fcn.1001f560
push dword [esp + 0x20]
call fcn.1001f560
push dword [esp + 0x18]
call fcn.1001f560
push dword [esp + 0x24]
call fcn.1001f560
push dword [esp + 0x14]
call fcn.1001f560
push dword [esp + 0x5c]
call fcn.1001f560
push dword [esp + 8]
call fcn.1001f560
add esp, 0x64
pop ebx
pop ebp
ret 4