Function at 0x1001da3a
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
mov ecx, dword [0x10098e5c]
mov eax, dword [0x10098e60]
lea edx, [ecx + 1]
imul edx, ecx
mov ecx, edx
not ecx
and edx, 0x7b6b9167
mov esi, ecx
and esi, 0x84946e98
or esi, edx
xor esi, 0x84946e99
and ecx, 0xfffffffe
or ecx, esi
cmp ecx, 0xffffffff
sete byte [ebp - 0x29]
cmp eax, 0xa
setl byte [ebp - 0x2a]
mov ecx, 0xa9eb14a5
cmp ecx, 0xf9b67597
jle 0x1001daf1
cmp ecx, 0x3ef0ab25
jle 0x1001db67
cmp ecx, 0x6070db4e
jle 0x1001dc3a
cmp ecx, 0x6cdc3012
jle 0x1001de52
cmp ecx, 0x74787448
jle 0x1001e242
cmp ecx, 0x7ccbbb92
jg 0x1001e8cc
cmp ecx, 0x74787449
je 0x1001f38e
cmp ecx, 0x749b0774
je 0x1001f3eb
cmp ecx, 0x7661473c
jne 0x1001da86
mov ecx, 0xeda7966c
jmp 0x1001da86
cmp ecx, 0xc3c0accf
jle 0x1001dbd0
cmp ecx, 0xe0ed5410
jle 0x1001dced
cmp ecx, 0xeda1a920
jle 0x1001dee1
cmp ecx, 0xf11d4872
jle 0x1001e27c
cmp ecx, 0xf70f6d26
jg 0x1001e8fd
cmp ecx, 0xf11d4873
je 0x1001f3f5
cmp ecx, 0xf17c919e
je 0x1001f448
cmp ecx, 0xf612f8b1
jne 0x1001da86
cmp dword [ebp - 0x74], 0
mov ecx, 0x4907a3cb
mov eax, 0x8fd98cdb
cmove ecx, eax
jmp 0x1001da86
cmp ecx, 0x1ee158e5
jle 0x1001dd4b
cmp ecx, 0x2f2c9459
jg 0x1001df7c
cmp ecx, 0x2515f0e3
jle 0x1001e2b6
cmp ecx, 0x294e1eaa
jle 0x1001e98f
cmp ecx, 0x294e1eab
je 0x1001f452
cmp ecx, 0x2ddc91f1
je 0x1001f464
cmp ecx, 0x2e26b251
jne 0x1001da86
mov eax, dword [ebp - 0x10]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x18dad44b
jmp 0x1001da86
cmp ecx, 0xa82ea4ed
jg 0x1001dde4
cmp ecx, 0x91ffff49
jg 0x1001dfc2
cmp ecx, 0x8d9318fe
jg 0x1001e32c
cmp ecx, 0x81c9a8d6
jle 0x1001ea15
cmp ecx, 0x81c9a8d7
je 0x1001f4cb
cmp ecx, 0x88a4d946
je 0x1001f4d5
cmp ecx, 0x8d7a22ab
jne 0x1001da86
cmp byte [ebp - 0x2d], 0
mov ecx, 0xea59e86
mov eax, 0xed75d211
cmovne ecx, eax
jmp 0x1001da86
cmp ecx, 0x4ce80e71
jg 0x1001e05d
cmp ecx, 0x480510e1
jg 0x1001e366
cmp ecx, 0x41572c67
jle 0x1001ea37
cmp ecx, 0x41572c68
je 0x1001f520
cmp ecx, 0x455db317
je 0x1001f581
cmp ecx, 0x47a6a3c2
jne 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xf58b6393
mov edx, eax
and edx, 0xa749c6c
or edx, ecx
xor edx, 0xa749c6d
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e60], 0xa
setge dl
setl ah
mov dh, ah
xor dh, cl
and dh, ah
and dl, al
and ah, cl
or ah, dl
mov al, dh
xor al, ah
test ah, ah
mov ecx, 0xf17c919e
mov edi, 0xdcf65f25
cmovne ecx, edi
test dh, dh
mov edx, 0xf17c919e
jmp 0x1001fd80
cmp ecx, 0xced33e28
jg 0x1001e11d
cmp ecx, 0xcae296cf
jg 0x1001e400
cmp ecx, 0xc54fdaa2
jle 0x1001eaae
cmp ecx, 0xc54fdaa3
je 0x1001f600
cmp ecx, 0xc7a6050a
je 0x1001f652
cmp ecx, 0xc9dcec27
jne 0x1001da86
cmp byte [ebp - 0x2f], 0
mov ecx, 0xdc583528
mov eax, 0x623c7734
cmovne ecx, eax
jmp 0x1001da86
cmp ecx, 0xedf0f89
jg 0x1001e1aa
cmp ecx, 0x86eaa01
jg 0x1001e483
cmp ecx, 0xfc2c9496
jle 0x1001ead0
cmp ecx, 0xfc2c9497
je 0x1001f69e
cmp ecx, 0x38ce238
je 0x1001f6a8
cmp ecx, 0x48f3917
jne 0x1001da86
mov eax, dword [ebp - 0x10]
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
setne al
cmp dword [0x10098e60], 0xa
setge cl
mov edx, eax
xor dl, cl
or cl, al
mov eax, ecx
xor al, dl
mov eax, 0xeda7966c
mov edi, 0x7661473c
cmovne eax, edi
test cl, cl
mov ecx, 0xeda7966c
jmp 0x10020684
cmp ecx, 0xb662bb31
jg 0x1001e1f0
cmp ecx, 0xad9d8d4b
jg 0x1001e50f
cmp ecx, 0xa9eb14a4
jle 0x1001eb4d
cmp ecx, 0xa9eb14a5
je 0x1001f6b2
cmp ecx, 0xab3db9f5
je 0x1001f6f4
cmp ecx, 0xac1fc9c5
jne 0x1001da86
push dword [ebp - 0x38]
push str.SoftwareMicrosoftWindowsCurrentVersion_
push str._s_s
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0x18]
mov ecx, 0x7fe7307b
jmp 0x1001da86
cmp ecx, 0x64ffd46d
jg 0x1001e555
cmp ecx, 0x62032f13
jle 0x1001ebe2
cmp ecx, 0x62032f14
je 0x1001f6fe
cmp ecx, 0x623c7734
je 0x1001f708
cmp ecx, 0x62414f6e
jne 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
sete cl
setne dl
cmp dword [0x10098e60], 0xa
setge ah
setl ch
mov al, ch
xor al, dl
and al, ch
and ah, cl
and ch, dl
or ch, ah
mov cl, al
xor cl, ch
mov edx, 0x4a4ddc78
mov edi, 0xe067acd6
jmp 0x1001fe6d
cmp ecx, 0xe4c1f11f
jg 0x1001e5dd
cmp ecx, 0xe19493c4
jle 0x1001ec04
cmp ecx, 0xe19493c5
je 0x1001f722
cmp ecx, 0xe1f733eb
je 0x1001f78c
cmp ecx, 0xe33fd46e
jne 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e60], 0xa
setge dl
setl ah
mov dh, ah
xor dh, cl
and dh, ah
and dl, al
and ah, cl
or ah, dl
mov al, ah
xor al, dh
test ah, ah
mov ecx, 0x38ce238
mov edi, 0x4d6213ee
cmovne ecx, edi
test dh, dh
mov edx, 0x38ce238
jmp 0x1001fd80
cmp ecx, 0x38443ce1
jg 0x1001e63a
cmp ecx, 0x351b5d01
jle 0x1001ec26
cmp ecx, 0x351b5d02
je 0x1001f7d7
cmp ecx, 0x35ca64e4
je 0x1001f7e1
cmp ecx, 0x35f517a5
jne 0x1001da86
mov ecx, 0xfb7edbe6
jmp 0x1001da86
cmp ecx, 0x9f24c2f6
jg 0x1001e68f
cmp ecx, 0x94c23828
jle 0x1001ec48
cmp ecx, 0x94c23829
je 0x1001f7f3
cmp ecx, 0x9cdef17f
je 0x1001f860
cmp ecx, 0x9dd623df
jne 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x73c5812f
and eax, 0x8c3a7ed0
or eax, edx
xor eax, 0x73c5812e
or eax, ecx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e60], 0xa
setl dl
setge ah
or ah, cl
xor dl, al
mov al, ah
xor al, dl
mov edi, 0x1ee158e6
mov ecx, 0x71f80d3d
cmovne edi, ecx
test dl, dl
mov ecx, edi
mov edx, 0x1ee158e6
jmp 0x1001fca9
cmp ecx, 0x5adf197e
jg 0x1001e724
cmp ecx, 0x4f486635
jle 0x1001ecc7
cmp ecx, 0x4f486636
je 0x1001f8c9
cmp ecx, 0x53073d6e
je 0x1001f8d6
cmp ecx, 0x5a23f48e
jne 0x1001da86
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
push dword [ebp - 0x24]
push dword [eax]
push dword [ebp - 0x28]
push 0
push dword [ecx]
push dword [edx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [0x10098e5c]
lea ecx, [edx + 1]
imul ecx, edx
mov edx, ecx
not edx
mov edi, edx
and edi, 0x2024e8ee
and ecx, 0xdfdb1711
or ecx, edi
xor ecx, 0xdfdb1710
xor edx, ecx
test edx, ecx
setne cl
cmp dword [0x10098e60], 0xa
setge dl
mov dh, dl
or dh, cl
xor dl, cl
mov cl, dh
xor cl, dl
mov edi, 0xbb32a84d
mov ecx, 0x1156f930
cmovne edi, ecx
test dl, dl
mov ecx, edi
mov ebx, 0xbb32a84d
cmovne ecx, ebx
mov dword [ebp - 0x54], eax
test dh, dh
cmovne ecx, edi
jmp 0x1001da86
cmp ecx, 0xdc583527
jg 0x1001e75e
cmp ecx, 0xd88f8a58
jle 0x1001ed27
cmp ecx, 0xd88f8a59
je 0x1001f8e0
cmp ecx, 0xda5948f3
je 0x1001f945
cmp ecx, 0xdbb55950
jne 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx - 0x59fad63d]
imul eax, ecx
test al, 1
sete cl
cmp dword [0x10098e60], 0xa
setl dl
setge dh
and cl, dh
or dh, al
and dl, al
or dl, cl
mov eax, edx
xor al, dh
test dl, dl
mov ecx, 0x9fd020f6
mov edi, 0x701e49d1
cmovne ecx, edi
test dh, 1
mov edx, 0x9fd020f6
cmovne ecx, edx
test al, 1
cmove ecx, edi
jmp 0x1001da86
cmp ecx, 0x18dad44a
jg 0x1001e7ed
cmp ecx, 0x13b28c40
jle 0x1001edba
cmp ecx, 0x13b28c41
je 0x1001f994
cmp ecx, 0x17f67d94
je 0x1001fa08
cmp ecx, 0x18d01af2
jne 0x1001da86
mov ecx, 0xbc3408cb
jmp 0x1001da86
cmp ecx, 0xbb32a84c
jg 0x1001e889
cmp ecx, 0xb7a945de
jle 0x1001edf9
cmp ecx, 0xb7a945df
je 0x1001fa1b
cmp ecx, 0xb8d11147
je 0x1001fa31
cmp ecx, 0xb9b90e04
jne 0x1001da86
cmp byte [ebp - 0x2c], 0
mov ecx, 0x5bfaf41b
mov eax, 0x88a4d946
cmovne ecx, eax
jmp 0x1001da86
cmp ecx, 0x71f80d3c
jle 0x1001ee52
cmp ecx, 0x71f80d3d
je 0x1001fa3b
cmp ecx, 0x73093a6d
je 0x1001fa45
cmp ecx, 0x7309f674
jne 0x1001da86
mov ecx, 0xedf0f8a
jmp 0x1001da86
cmp ecx, 0xee7c8c23
jle 0x1001ee74
cmp ecx, 0xee7c8c24
je 0x1001fa5b
cmp ecx, 0xef651c09
je 0x1001fabd
cmp ecx, 0xf0a5ca21
jne 0x1001da86
mov ecx, 0xae9a5e00
jmp 0x1001da86
cmp ecx, 0x2020a6d8
jle 0x1001eef4
cmp ecx, 0x2020a6d9
je 0x1001fb90
cmp ecx, 0x206f306f
je 0x1001fbde
cmp ecx, 0x2117eded
jne 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x10098e60], 0xa
setl dl
xor al, dl
mov ecx, eax
xor cl, 1
and dl, cl
xor cl, dl
mov edi, 0x8f0e6780
mov ecx, 0x6648a32d
cmovne edi, ecx
test al, al
mov ecx, edi
mov eax, 0x8f0e6780
jmp 0x100201a1
cmp ecx, 0x8fd98cda
jle 0x1001ef32
cmp ecx, 0x8fd98cdb
je 0x1001fbe8
cmp ecx, 0x906e3e59
je 0x1001fc4c
cmp ecx, 0x90b978bb
jne 0x1001da86
mov ecx, 0x4907a3cb
jmp 0x1001da86
cmp ecx, 0x49b4fbfb
jle 0x1001ef8e
cmp ecx, 0x49b4fbfc
je 0x1001fcb6
cmp ecx, 0x4a4ddc78
je 0x1001fd14
cmp ecx, 0x4cc8fe2f
jne 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x87b458b5
mov edx, eax
and edx, 0x784ba74a
or edx, ecx
xor edx, 0x784ba74b
and eax, 0xfffffffe
or eax, edx
xor eax, 0xdb0bd6c8
cmp eax, 0x24f42937
sete al
cmp dword [0x10098e60], 0xa
setl dl
xor al, dl
mov ah, al
mov edi, 0x71f80d3d
mov ebx, 0x9dd623df
cmovne edi, ebx
not ah
test ah, dl
cmovne edi, ebx
test al, al
mov ecx, edi
cmovne ecx, ebx
test ah, dl
cmove ecx, edi
jmp 0x1001da86
cmp ecx, 0xccb0a4d6
jle 0x1001efb0
cmp ecx, 0xccb0a4d7
je 0x1001fd1e
cmp ecx, 0xccc75ae5
je 0x1001fd88
cmp ecx, 0xce334c1e
jne 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
cmp eax, 0xffffffff
setne al
cmp dword [0x10098e60], 0xa
setge cl
mov edx, ecx
or dl, al
xor cl, al
mov eax, edx
xor al, cl
test cl, cl
mov ecx, 0xf9b67598
mov edi, 0xeaa25700
cmovne ecx, edi
test dl, dl
mov edx, 0xf9b67598
jmp 0x1001ffaa
cmp ecx, 0xbafed40
jle 0x1001f028
cmp ecx, 0xbafed41
je 0x1001fdf5
cmp ecx, 0xbf4f2ec
je 0x1001fe0b
cmp ecx, 0xea59e86
jne 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
cmp eax, 0xffffffff
setne al
cmp dword [0x10098e60], 0xa
setge cl
setl dl
xor dl, al
or cl, al
mov eax, edx
xor al, cl
test cl, cl
mov ecx, 0x455db317
mov edi, 0xad9d8d4c
cmovne ecx, edi
test dl, dl
cmovne ecx, edi
test al, al
mov eax, 0x455db317
cmovne ecx, eax
jmp 0x1001da86
cmp ecx, 0xb01cc3de
jle 0x1001f094
cmp ecx, 0xb01cc3df
je 0x1001fe18
cmp ecx, 0xb1221858
je 0x1001fe22
cmp ecx, 0xb5a017f5
jne 0x1001da86
cmp byte [ebp - 0x30], 0
mov ecx, 0xf11d4873
mov eax, 0xcae296d0
cmovne ecx, eax
jmp 0x1001da86
cmp ecx, 0x6648a32c
jle 0x1001f10c
cmp ecx, 0x6648a32d
je 0x1001fe79
cmp ecx, 0x6878a204
je 0x1001fe83
cmp ecx, 0x6a9039ee
jne 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xa231dc87
and eax, 0x5dce2378
or eax, edx
xor eax, 0x5dce2379
xor ecx, eax
test ecx, eax
setne al
cmp dword [0x10098e60], 0xa
setge cl
mov edx, ecx
xor dl, al
or cl, al
mov eax, ecx
xor al, dl
mov eax, 0xccb0a4d7
mov edi, 0x64ffd46e
cmovne eax, edi
test cl, cl
mov ecx, 0xccb0a4d7
jmp 0x10020684
cmp ecx, 0xeaa256ff
jle 0x1001f187
cmp ecx, 0xeaa25700
je 0x1001fed8
cmp ecx, 0xead8a801
je 0x1001fee2
cmp ecx, 0xed75d211
jne 0x1001da86
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
lea edi, [eax + eax]
add edi, 2
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov ecx, 0xb1221858
jmp 0x1001da86
cmp ecx, 0x39be622b
jle 0x1001f1e9
cmp ecx, 0x39be622c
je 0x1001feec
cmp ecx, 0x3c1c7b74
je 0x1001ff5f
cmp ecx, 0x3e9ec579
jne 0x1001da86
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push dword [ebp - 0x68]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov ecx, 0xf70f6d27
jmp 0x1001da86
cmp ecx, 0xa23b8304
jle 0x1001f20b
cmp ecx, 0xa23b8305
je 0x1001ffb7
cmp ecx, 0xa6f564ed
je 0x1001ffc1
cmp ecx, 0xa7a06f5e
jne 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x9bd5db5d
mov edx, eax
and edx, 0x642a24a2
or edx, ecx
xor edx, 0x642a24a3
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e60], 0xa
setge dl
setl ah
and ah, cl
and al, dl
or al, ah
or dl, cl
mov ecx, edx
xor cl, al
mov edi, 0x74787449
mov ecx, 0xb8d11147
cmovne edi, ecx
test dl, dl
mov ecx, 0x74787449
jmp 0x1001fc44
cmp ecx, 0x5c9adcec
jle 0x1001f286
cmp ecx, 0x5c9adced
je 0x1001ffcb
cmp ecx, 0x5e13664b
je 0x10020055
cmp ecx, 0x6063f90b
jne 0x1001da86
mov ecx, 0xcc70bb8a
jmp 0x1001da86
cmp ecx, 0xde387b40
jle 0x1001f2ae
cmp ecx, 0xde387b41
je 0x10020075
cmp ecx, 0xdf972dd0
je 0x100200c1
cmp ecx, 0xe067acd6
jne 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x8711add0
mov edx, eax
and edx, 0x78ee522f
or edx, ecx
xor edx, 0x78ee522e
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete cl
setne dl
cmp dword [0x10098e60], 0xa
setge ah
setl ch
mov al, ch
xor al, dl
and al, ch
and ah, cl
and ch, dl
or ch, ah
mov cl, al
xor cl, ch
mov edx, 0xe4c1f120
mov edi, 0x49b4fbfc
jmp 0x1001fe6d
cmp ecx, 0x1c617e6a
jle 0x1001f2d0
cmp ecx, 0x1c617e6b
je 0x10020108
cmp ecx, 0x1cb4f34d
je 0x10020112
cmp ecx, 0x1e9f5269
jne 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
setne al
sete dl
cmp dword [0x10098e60], 0xa
setl cl
setge ah
and ah, dl
and al, cl
or al, ah
mov ah, cl
xor ah, dl
or cl, dl
xor cl, 1
or cl, ah
mov edx, ecx
xor dl, al
test cl, cl
mov ecx, 0x47a6a3c2
mov edi, 0xf17c919e
cmovne ecx, edi
test al, al
cmove ecx, edi
test dl, dl
mov eax, 0x47a6a3c2
cmove ecx, eax
jmp 0x1001da86
cmp ecx, 0xbefa1c79
jle 0x1001f300
cmp ecx, 0xbefa1c7a
je 0x1002015c
cmp ecx, 0xbfb5606c
je 0x100201ae
cmp ecx, 0xc27bf2a7
jne 0x1001da86
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
mov ecx, 0xe19493c5
jmp 0x1001da86
cmp ecx, 0x7ccbbb93
je 0x100201b8
cmp ecx, 0x7fe7307b
je 0x100201c5
cmp ecx, 0x7ff96957
jne 0x1001da86
mov eax, dword [ebp - 0x1c]
mov ecx, 0x654cfba4
jmp 0x1001da86
cmp ecx, 0xf70f6d27
je 0x10020253
cmp ecx, 0xf84a0c9e
je 0x100202d5
cmp ecx, 0xf87b1606
jne 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x2ea6989f
mov edx, eax
and edx, 0xd1596760
or edx, ecx
xor edx, 0xd1596761
and eax, 0xfffffffe
or eax, edx
xor eax, 0x9988a78b
xor eax, 0x66775874
sete al
setne cl
cmp dword [0x10098e60], 0xa
setl dl
setge ah
and al, ah
or ah, cl
and dl, cl
or dl, al
mov al, ah
xor al, dl
test dl, dl
mov ecx, 0x351b5d02
mov edx, 0x8d7a22ab
cmovne ecx, edx
test ah, ah
mov edi, 0x351b5d02
jmp 0x100203a9
cmp ecx, 0x25552ec8
je 0x100202df
cmp ecx, 0x272740b4
jne 0x100208af
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xa0197400
mov edx, eax
and edx, 0x5fe68bff
or edx, ecx
xor edx, 0x5fe68bfe
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete dl
setne ah
cmp dword [0x10098e60], 0xa
setge al
setl cl
and ah, cl
and al, dl
or al, ah
mov ah, cl
xor ah, dl
or cl, dl
xor cl, 1
or cl, ah
mov edx, ecx
xor dl, al
mov edx, 0x924a8a00
mov edi, 0xbfb5606c
cmovne edx, edi
test cl, cl
mov ecx, 0x924a8a00
jmp 0x1001fa00
cmp ecx, 0x80a52b1d
je 0x1002034f
cmp ecx, 0x80d6be4c
jne 0x1001da86
mov ecx, 0x8d9318ff
jmp 0x1001da86
cmp ecx, 0x3ef0ab26
je 0x100203b6
cmp ecx, 0x4112d0fd
jne 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x5b736f01
mov edx, eax
and edx, 0xa48c90fe
or edx, ecx
xor edx, 0xa48c90ff
and eax, 0xfffffffe
or eax, edx
cmp eax, 0xffffffff
setne al
cmp dword [0x10098e60], 0xa
setge cl
mov edx, ecx
or dl, al
xor cl, al
mov eax, edx
xor al, cl
mov eax, 0xa7a06f5e
mov edi, 0x749b0774
cmovne eax, edi
test cl, cl
mov ecx, eax
mov edi, 0xa7a06f5e
jmp 0x1001f518
cmp ecx, 0xc3c0acd0
je 0x100203c0
cmp ecx, 0xc525ff35
jne 0x1001da86
mov ecx, 0x6878a204
jmp 0x1001da86
cmp ecx, 0xf9b67598
je 0x100203ca
cmp ecx, 0xfb7edbe6
jne 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xe06a0681
and eax, 0x1f95f97e
or eax, edx
xor eax, 0x1f95f97f
xor ecx, eax
test ecx, eax
sete al
cmp dword [0x10098e60], 0xa
setl cl
xor al, cl
mov edx, eax
xor dl, 1
and cl, dl
xor dl, cl
mov edx, 0x18dad44b
mov edi, 0x2e26b251
cmovne edx, edi
test al, al
mov eax, edx
mov edi, 0x18dad44b
cmovne eax, edi
test cl, cl
cmove eax, edx
mov ecx, eax
jmp 0x1001da86
cmp ecx, 0xa82ea4ee
je 0x100203d4
cmp ecx, 0xa9a91326
jne 0x1001da86
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push 1
push 0
push dword [ebp - 0x60]
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x5ef9f9fc
mov edx, eax
and edx, 0xa1060603
or edx, ecx
xor edx, 0xa1060602
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e60], 0xa
setl dl
setge ah
and al, ah
or ah, cl
and dl, cl
or dl, al
mov al, dl
xor al, ah
test dl, dl
mov ecx, 0x5e13664b
mov edx, 0xab3db9f5
cmovne ecx, edx
test ah, ah
mov edi, 0x5e13664b
jmp 0x100203a9
cmp ecx, 0x6070db4f
je 0x100203ea
cmp ecx, 0x613b1ca5
jne 0x1001da86
mov ecx, 0x2117eded
jmp 0x1001da86
cmp ecx, 0xe0ed5411
je 0x100203f7
cmp ecx, 0xe181ece3
jne 0x1001da86
mov ecx, 0xf612f8b1
jmp 0x1001da86
cmp ecx, 0x2f2c945a
je 0x1002045d
cmp ecx, 0x327001b7
jne 0x1001da86
mov ecx, 0x39be622c
jmp 0x1001da86
cmp ecx, 0x91ffff4a
je 0x1002046a
cmp ecx, 0x924a8a00
jne 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x5ecbeefe
mov edx, eax
and edx, 0xa1341101
or edx, ecx
xor edx, 0xa1341100
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e60], 0xa
setl dl
setge ah
and al, ah
or ah, cl
and dl, cl
or dl, al
mov al, dl
xor al, ah
test dl, dl
mov ecx, 0x73093a6d
mov edx, 0x906e3e59
cmovne ecx, edx
test ah, ah
mov edi, 0x73093a6d
jmp 0x100203a9
cmp ecx, 0x4ce80e72
je 0x100204b7
cmp ecx, 0x4d6213ee
jne 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
sete dl
cmp dword [0x10098e60], 0xa
setl ah
setge al
and dl, al
or al, cl
and ah, cl
or ah, dl
mov ecx, eax
xor cl, ah
test cl, 1
mov edx, 0x3c1c7b74
mov ecx, 0x38ce238
cmovne edx, ecx
test ah, ah
mov ecx, edx
mov edi, 0x3c1c7b74
jmp 0x1001f6e7
cmp ecx, 0xced33e29
je 0x10020500
cmp ecx, 0xceeca1ea
jne 0x1001da86
mov eax, dword [ebp - 0x20]
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x2dfc4a08
mov edx, eax
and edx, 0xd203b5f7
or edx, ecx
xor edx, 0xd203b5f6
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete dl
setne ah
cmp dword [0x10098e60], 0xa
setge al
setl cl
and ah, cl
and al, dl
or al, ah
mov ah, cl
xor ah, dl
or cl, dl
xor cl, 1
or cl, ah
mov edx, ecx
xor dl, al
test cl, cl
mov ecx, 0xdbb55950
mov edi, 0x9fd020f6
cmovne ecx, edi
test al, al
cmove ecx, edi
test dl, dl
mov eax, 0xdbb55950
cmove ecx, eax
jmp 0x1001da86
cmp ecx, 0xedf0f8a
je 0x10020577
cmp ecx, 0x1156f930
jne 0x1001da86
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
push dword [ebp - 0x24]
push dword [eax]
push dword [ebp - 0x28]
push 0
push dword [ecx]
push dword [edx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, 0x5a23f48e
jmp 0x1001da86
cmp ecx, 0xb662bb32
je 0x100205bd
cmp ecx, 0xb669bdbf
jne 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
and al, 1
cmp dword [0x10098e60], 0xa
setge cl
setl dl
xor dl, al
mov ch, dl
xor ch, 1
and cl, al
or cl, ch
xor ch, cl
mov eax, 0x86eaa02
mov edi, 0xad9d8d4c
cmovne eax, edi
test cl, cl
mov ecx, 0x86eaa02
jmp 0x100200b4
cmp ecx, 0x6cdc3013
je 0x10020619
cmp ecx, 0x701e49d1
jne 0x1001da86
mov ecx, 0xc27bf2a7
jmp 0x1001da86
cmp ecx, 0xeda1a921
je 0x10020623
cmp ecx, 0xeda7966c
jne 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x740addd
mov edx, eax
and edx, 0xf8bf5222
or edx, ecx
xor edx, 0xf8bf5223
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
setne al
sete cl
cmp dword [0x10098e60], 0xa
setge dl
xor cl, dl
or al, dl
mov edx, ecx
xor dl, al
mov edx, 0x7661473c
mov edi, 0x327001b7
cmovne edx, edi
test al, al
mov eax, 0x327001b7
cmovne eax, edx
test cl, cl
cmovne eax, edx
mov ecx, eax
jmp 0x1001da86
cmp ecx, 0x1ee158e6
je 0x1002062d
cmp ecx, 0x1fe95704
jne 0x1001da86
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x20a
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
mov ecx, 0x41572c68
jmp 0x1001da86
cmp ecx, 0x8d9318ff
je 0x10020643
cmp ecx, 0x8f0e6780
jne 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx - 1]
imul eax, ecx
not al
or al, 0xfe
cmp al, 0xff
setne al
cmp dword [0x10098e60], 0xa
setge cl
mov edx, ecx
or dl, al
xor cl, al
mov eax, edx
xor al, cl
test cl, cl
mov ecx, 0x6648a32d
mov edi, 0xc9dcec27
cmovne ecx, edi
test dl, dl
mov edx, 0x6648a32d
jmp 0x1001ffaa
cmp ecx, 0x480510e2
je 0x10020691
cmp ecx, 0x4907a3cb
jne 0x1001da86
mov ecx, 0xdc583528
jmp 0x1001da86
cmp ecx, 0xcae296d0
je 0x100206ea
cmp ecx, 0xcc70bb8a
jne 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x4696993
mov edx, eax
and edx, 0xfb96966c
or edx, ecx
xor edx, 0xfb96966d
and eax, 0xfffffffe
or eax, edx
cmp eax, 0xffffffff
sete al
cmp dword [0x10098e60], 0xa
setl cl
xor al, cl
mov edx, eax
mov edi, 0xf0a5ca21
mov ebx, 0xae9a5e00
cmovne edi, ebx
not dl
test dl, cl
cmovne edi, ebx
test al, al
mov eax, edi
cmovne eax, ebx
test dl, cl
jmp 0x1002089b
cmp ecx, 0x86eaa02
je 0x10020731
cmp ecx, 0xa754ad8
jne 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xe88050a2
mov edx, eax
and edx, 0x177faf5d
or edx, ecx
xor edx, 0x177faf5c
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
setne al
sete dl
cmp dword [0x10098e60], 0xa
setge cl
xor dl, cl
or al, cl
mov ecx, edx
xor cl, al
mov edi, 0x62032f14
mov ecx, 0xd88f8a59
jmp 0x1001fec6
cmp ecx, 0xad9d8d4c
je 0x1002073b
cmp ecx, 0xae9a5e00
jne 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
sete al
setne cl
cmp dword [0x10098e60], 0xa
setge dl
setl ah
and ah, cl
and al, dl
or al, ah
or dl, cl
mov ecx, edx
xor cl, al
mov ecx, 0x4ce80e72
mov edi, 0xf0a5ca21
cmovne ecx, edi
test dl, dl
mov edx, 0x4ce80e72
cmovne edx, ecx
test al, al
cmove edx, ecx
mov ecx, edx
jmp 0x1001da86
cmp ecx, 0x64ffd46e
je 0x10020748
cmp ecx, 0x654cfba4
jne 0x1001da86
mov eax, dword [ebp - 0x1c]
mov edx, dword [0x10098e5c]
lea ecx, [edx + 1]
imul ecx, edx
mov edx, ecx
not edx
mov edi, edx
and edi, 0xfffffffe
and ecx, 1
or ecx, edi
mov eax, dword [eax]
xor edx, ecx
test edx, ecx
sete cl
cmp dword [0x10098e60], 0xa
setl ch
setge dl
xor dl, cl
mov dh, ch
xor dh, cl
or ch, cl
xor ch, 1
or ch, dh
mov cl, dl
xor cl, ch
mov edi, 0x7ff96957
mov ebx, 0xc525ff35
cmovne edi, ebx
test ch, ch
mov ecx, 0xc525ff35
cmovne ecx, edi
mov dword [ebp - 0x50], eax
jmp 0x1001fece
cmp ecx, 0xe4c1f120
je 0x10020752
cmp ecx, 0xe9eb1331
jne 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx - 1]
imul eax, ecx
and eax, 1
sete cl
cmp dword [0x10098e60], 0xa
setge dl
setl ch
mov dh, ch
xor dh, al
and dh, ch
and dl, cl
and ch, al
or ch, dl
mov al, ch
xor al, dh
test ch, ch
mov ecx, 0x6063f90b
mov edi, 0xcc70bb8a
cmovne ecx, edi
test dh, dh
mov edx, 0x6063f90b
jmp 0x1001fd80
cmp ecx, 0x38443ce2
je 0x1002075f
cmp ecx, 0x38627545
jne 0x1001da86
mov ecx, 0x2020a6d9
jmp 0x1001da86
cmp ecx, 0x9f24c2f7
je 0x100207b9
cmp ecx, 0x9fd020f6
jne 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x9235bca3
and eax, 0x6dca435c
or eax, edx
xor eax, 0x6dca435d
xor ecx, eax
test ecx, eax
sete al
cmp dword [0x10098e60], 0xa
setl cl
xor al, cl
mov edx, eax
mov edi, 0xf9b67598
mov ebx, 0xce334c1e
cmovne edi, ebx
not dl
test dl, cl
mov esi, 0xf9b67598
cmove edi, esi
test al, al
cmovne edi, ebx
test dl, cl
cmovne edi, ebx
mov ecx, edi
jmp 0x1001da86
cmp ecx, 0x5adf197f
je 0x10020800
cmp ecx, 0x5bfaf41b
jne 0x1001da86
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov ecx, 0xe9eb1331
jmp 0x1001da86
cmp ecx, 0xdc583528
je 0x1002080a
cmp ecx, 0xdcf65f25
jne 0x1001da86
mov ecx, 0xb662bb32
jmp 0x1001da86
cmp ecx, 0x18dad44b
je 0x10020829
cmp ecx, 0x1bce3ecf
jne 0x1001da86
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x70]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, 0xa23b8305
jmp 0x1001da86
cmp ecx, 0xbb32a84d
je 0x100208a5
cmp ecx, 0xbc3408cb
jne 0x1001da86
mov eax, dword [ebp - 0x1c]
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xa33d0df8
mov edx, eax
and edx, 0x5cc2f207
or edx, ecx
xor edx, 0x5cc2f206
and eax, 0xfffffffe
or eax, edx
xor eax, 0x89aaf132
cmp eax, 0x76550ecd
sete al
cmp dword [0x10098e60], 0xa
setl cl
mov edx, ecx
xor dl, al
or cl, al
xor cl, 1
or cl, dl
mov eax, ecx
xor al, dl
test cl, cl
mov ecx, 0xa754ad8
mov edi, 0x62032f14
cmovne ecx, edi
test dl, dl
cmove ecx, edi
test al, al
mov eax, 0xa754ad8
cmove ecx, eax
jmp 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x52999034
mov edx, eax
and edx, 0xad666fcb
or edx, ecx
xor edx, 0xad666fca
and eax, 0xfffffffe
or eax, edx
cmp eax, 0xffffffff
sete cl
cmp dword [0x10098e60], 0xa
setl dl
setge al
xor al, cl
mov ah, dl
xor ah, cl
or dl, cl
xor dl, 1
or dl, ah
mov ecx, eax
xor cl, dl
mov edi, 0x64ffd46e
mov ecx, 0x6a9039ee
jmp 0x1001f7cd
mov ecx, 0x4112d0fd
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
sete al
cmp dword [0x10098e60], 0xa
setl cl
mov edx, ecx
xor dl, al
or cl, al
xor cl, 1
or cl, dl
mov eax, ecx
xor al, dl
mov eax, 0x62414f6e
mov edi, 0x4a4ddc78
cmovne eax, edi
test cl, cl
mov ecx, 0x62414f6e
jmp 0x10020684
mov ecx, 0x47a6a3c2
jmp 0x1001da86
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
mov ecx, 0x1bce3ecf
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x6728309
and eax, 0xf98d7cf6
or eax, edx
xor eax, 0x6728308
or eax, ecx
xor eax, 0xffffffff
setne al
sete cl
cmp dword [0x10098e60], 0xa
setge dl
setl ah
xor ah, cl
or dl, al
mov al, dl
xor al, ah
test dl, dl
mov ecx, 0xf87b1606
mov edx, 0x351b5d02
cmovne ecx, edx
test ah, ah
cmove ecx, edx
test al, al
mov eax, 0xf87b1606
cmove ecx, eax
jmp 0x1001da86
mov ecx, 0x90b978bb
jmp 0x1001da86
mov eax, dword [ebp - 0x34]
mov eax, dword [0x10098e5c]
lea ecx, [eax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
setne al
cmp dword [0x10098e60], 0xa
setge cl
mov edx, ecx
or dl, al
xor cl, al
mov eax, edx
xor al, cl
mov eax, 0x4112d0fd
mov edi, 0x749b0774
cmovne eax, edi
test cl, cl
mov ecx, eax
mov edi, 0x4112d0fd
cmovne ecx, edi
jmp 0x100200b7
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x20a
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
setne byte [ebp - 0x2c]
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x10098e60], 0xa
setl dl
setge al
xor al, cl
mov ah, dl
xor ah, cl
or dl, cl
xor dl, 1
or dl, ah
mov ecx, eax
xor cl, dl
mov edi, 0x1fe95704
mov ecx, 0xb9b90e04
jmp 0x1001f7cd
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xf920d170
mov edx, eax
and edx, 0x6df2e8f
or edx, ecx
xor edx, 0x6df2e8e
and eax, 0xfffffffe
or eax, edx
xor eax, 0xf7520c40
xor eax, 0x8adf3bf
setne al
sete dl
cmp dword [0x10098e60], 0xa
setl cl
setge ah
and ah, dl
and al, cl
or al, ah
mov ah, cl
xor ah, dl
or cl, dl
xor cl, 1
or cl, ah
mov edx, ecx
xor dl, al
test cl, cl
mov ecx, 0xccc75ae5
mov edi, 0x7ccbbb93
cmovne ecx, edi
test al, al
cmove ecx, edi
test dl, dl
mov eax, 0xccc75ae5
cmove ecx, eax
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete cl
cmp dword [0x10098e60], 0xa
setl dl
xor al, dl
mov ch, dl
xor ch, cl
or dl, cl
xor dl, 1
or dl, ch
mov dh, al
xor dh, dl
test dl, dl
mov ecx, 0x13b28c41
mov edi, 0xf84a0c9e
cmovne ecx, edi
test al, 1
cmovne ecx, edi
not dh
test dh, 1
mov eax, 0x13b28c41
cmove ecx, eax
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete cl
cmp dword [0x10098e60], 0xa
setl dl
setge dh
or dh, al
xor dl, cl
mov al, dh
xor al, dl
test al, 1
mov eax, 0x9cdef17f
mov ecx, 0x2f2c945a
cmovne eax, ecx
test dl, dl
mov ecx, eax
mov edi, 0x9cdef17f
cmovne ecx, edi
test dh, 1
cmovne ecx, eax
jmp 0x1001da86
mov ecx, 0xdf972dd0
jmp 0x1001da86
mov ecx, 0x4d6213ee
jmp 0x1001da86
mov cl, byte [ebp - 0x29]
mov dl, byte [ebp - 0x2a]
mov eax, ecx
xor al, 1
mov ah, dl
xor ah, 1
and dl, al
or al, ah
and ah, cl
or ah, dl
mov ecx, eax
xor cl, ah
test cl, 1
mov edx, 0xef651c09
mov ecx, 0x53073d6e
cmovne edx, ecx
test ah, 1
mov ecx, edx
mov edi, 0xef651c09
cmovne ecx, edi
test al, 1
cmovne ecx, edx
jmp 0x1001da86
mov ecx, 0xf11d4873
jmp 0x1001da86
mov ecx, 0xa754ad8
jmp 0x1001da86
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov ecx, 0xbefa1c7a
jmp 0x1001da86
mov eax, dword [ebp - 0x14]
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xa370172c
mov edx, eax
and edx, 0x5c8fe8d3
or edx, ecx
xor edx, 0x5c8fe8d2
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e60], 0xa
setl dl
setge ah
and al, ah
or ah, cl
and dl, cl
or dl, al
mov al, ah
xor al, dl
mov edi, 0x41572c68
mov ecx, 0x1fe95704
cmovne edi, ecx
test dl, dl
mov ecx, edi
mov edx, 0x41572c68
jmp 0x1001fca9
cmp dword [ebp - 0x54], 0
sete byte [ebp - 0x2f]
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x10098e60], 0xa
setl dl
setge al
xor al, cl
mov ah, dl
xor ah, cl
or dl, cl
xor dl, 1
or dl, ah
mov ecx, eax
xor cl, dl
mov edi, 0x4f486636
mov ecx, 0x613b1ca5
cmovne edi, ecx
test dl, dl
jmp 0x1002014f
mov ecx, 0xf87b1606
jmp 0x1001da86
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov ecx, 0xc7a6050a
jmp 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xaf18790f
mov edx, eax
and edx, 0x50e786f0
or edx, ecx
xor edx, 0x50e786f1
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e60], 0xa
setl dl
setge ah
or ah, cl
xor dl, al
mov al, ah
xor al, dl
mov ecx, 0xf70f6d27
mov edi, 0x3e9ec579
cmovne ecx, edi
test dl, dl
mov edx, ecx
mov edi, 0xf70f6d27
cmovne edx, edi
test ah, ah
cmovne edx, ecx
mov ecx, edx
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
setne al
sete dl
cmp dword [0x10098e60], 0xa
setl cl
setge ah
and ah, dl
and al, cl
or al, ah
mov ah, cl
xor ah, dl
or cl, dl
xor cl, 1
or cl, ah
mov edx, ecx
xor dl, al
test cl, cl
mov ecx, 0x80a52b1d
mov edi, 0xbf4f2ec
cmovne ecx, edi
test al, al
cmove ecx, edi
test dl, dl
mov eax, 0x80a52b1d
cmove ecx, eax
jmp 0x1001da86
mov eax, dword [ebp - 0x54]
mov ecx, 0xe1f733eb
jmp 0x1001da86
mov ecx, 0xef651c09
jmp 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x11cb6e3d
mov edx, eax
and edx, 0xee3491c2
or edx, ecx
xor edx, 0xee3491c3
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e60], 0xa
setge dl
setl ah
and ah, cl
and al, dl
or al, ah
or dl, cl
mov ecx, edx
xor cl, al
mov edi, 0x1cb4f34d
mov ecx, 0xa6f564ed
cmovne edi, ecx
test dl, dl
mov ecx, 0x1cb4f34d
jmp 0x1001fc44
mov eax, dword [ebp - 0x20]
mov dword [eax], 1
mov ecx, dword [0x10098e5c]
lea eax, [ecx - 1]
imul eax, ecx
and eax, 1
sete cl
cmp dword [0x10098e60], 0xa
setl dl
setge dh
and cl, dh
or dh, al
and dl, al
or dl, cl
mov eax, edx
xor al, dh
test dl, dl
mov ecx, 0x17f67d94
mov edi, 0x81c9a8d7
cmovne ecx, edi
test dh, dh
mov edx, 0x17f67d94
jmp 0x1001ffaa
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x37b25c6c
mov edx, eax
and edx, 0xc84da393
or edx, ecx
xor edx, 0xc84da392
and eax, 0xfffffffe
or eax, edx
xor eax, 0xf3c0781b
xor eax, 0xc3f87e4
sete dl
setne ah
cmp dword [0x10098e60], 0xa
setl cl
xor ah, cl
mov al, cl
xor al, dl
xor ah, 1
or cl, dl
xor cl, 1
or cl, ah
mov edx, ecx
xor dl, al
mov edx, 0x5c9adced
mov edi, 0xb7a945df
cmovne edx, edi
test cl, cl
mov ecx, 0x5c9adced
cmovne ecx, edx
jmp 0x100203ac
mov eax, dword [ebp - 0x20]
mov dword [eax], 1
mov ecx, 0xda5948f3
jmp 0x1001da86
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov ecx, 0x5c9adced
jmp 0x1001da86
mov ecx, 0x74787449
jmp 0x1001da86
mov ecx, 0x9dd623df
jmp 0x1001da86
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ecx, 0x906e3e59
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x7c8c35df
and eax, 0x8373ca20
or eax, edx
xor eax, 0x8373ca21
xor ecx, eax
test ecx, eax
setne al
cmp dword [0x10098e60], 0xa
setge cl
mov edx, eax
xor dl, cl
or cl, al
mov eax, ecx
xor al, dl
test cl, cl
mov ecx, 0x9f24c2f7
mov edi, 0x1c617e6b
cmovne ecx, edi
test dl, dl
cmove ecx, edi
test al, al
mov eax, 0x9f24c2f7
cmove ecx, eax
jmp 0x1001da86
push eax
mov eax, esp
mov dword [ebp - 0x4c], eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x38], eax
sub esp, 0x20c
mov eax, esp
mov dword [ebp - 0x3c], eax
push eax
mov eax, esp
mov dword [ebp - 0x18], eax
push eax
mov eax, esp
mov dword [ebp - 0x10], eax
push eax
mov eax, esp
mov dword [ebp - 0x20], eax
push eax
mov eax, esp
mov dword [ebp - 0x14], eax
push eax
mov eax, esp
mov dword [ebp - 0x34], eax
push eax
mov eax, esp
mov dword [ebp - 0x24], eax
push eax
mov eax, esp
mov dword [ebp - 0x28], eax
push eax
mov eax, esp
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
movups xmm0, xmmword [str.RunOnce]
movups xmmword [eax], xmm0
mov eax, dword [ebp - 0x3c]
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x9242e9b8
mov edx, eax
and edx, 0x6dbd1647
or edx, ecx
xor edx, 0x6dbd1646
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
setne al
sete cl
cmp dword [0x10098e60], 0xa
setl dl
setge ah
and cl, ah
and dl, al
or dl, cl
or ah, al
mov al, ah
xor al, dl
test ah, ah
mov ecx, 0x80d6be4c
mov edi, 0x53073d6e
cmovne ecx, edi
test dl, dl
cmove ecx, edi
test al, al
mov eax, 0x80d6be4c
cmove ecx, eax
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
mov eax, ecx
not eax
imul eax, ecx
not al
or al, 0xfe
cmp al, 0xff
sete al
cmp dword [0x10098e60], 0xa
setl dl
xor al, dl
mov ah, al
xor ah, 1
and dl, ah
xor ah, dl
test al, al
mov ecx, 0x38627545
mov edi, 0xb5a017f5
cmovne ecx, edi
test dl, dl
mov edx, 0x38627545
cmove ecx, edx
test ah, ah
cmove ecx, edi
jmp 0x1001da86
mov ecx, 0x5adf197f
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfeaab56e
and eax, 0x1554a91
or eax, edx
xor eax, 0xfeaab56f
or eax, ecx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e60], 0xa
setge dl
setl ah
and ah, cl
and al, dl
or al, ah
or dl, cl
mov ecx, edx
xor cl, al
mov edi, 0xda5948f3
mov ecx, 0x17f67d94
cmovne edi, ecx
test dl, dl
mov ecx, 0xda5948f3
cmovne ecx, edi
jmp 0x1001ffad
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x5474f4fa
and eax, 0xab8b0b05
or eax, edx
xor eax, 0xab8b0b04
xor ecx, eax
test ecx, eax
sete al
setne cl
cmp dword [0x10098e60], 0xa
setl dl
setge ah
and al, ah
or ah, cl
and dl, cl
or dl, al
mov al, ah
xor al, dl
mov edi, 0xced33e29
mov ecx, 0xa82ea4ee
cmovne edi, ecx
test dl, dl
mov ecx, edi
mov edx, 0xced33e29
cmovne ecx, edx
test ah, ah
cmovne ecx, edi
jmp 0x1001da86
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [0x10098e5c]
lea ecx, [edx + 1]
imul ecx, edx
not cl
or cl, 0xfe
cmp cl, 0xff
setne cl
cmp dword [0x10098e60], 0xa
setge dl
setl ch
xor ch, cl
mov dh, ch
xor dh, 1
and dl, cl
or dl, dh
xor dh, dl
test dl, dl
mov edi, 0xc3c0acd0
mov ebx, 0xe4c1f120
cmovne edi, ebx
mov dword [ebp - 0x68], eax
test ch, ch
cmovne edi, ebx
test dh, dh
mov eax, 0xc3c0acd0
cmove edi, eax
mov ecx, edi
jmp 0x1001da86
mov ecx, 0x62414f6e
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xe56432a1
and eax, 0x1a9bcd5e
or eax, edx
xor eax, 0xe56432a0
or eax, ecx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e60], 0xa
setge dl
setl ah
mov dh, ah
xor dh, cl
and dh, ah
and dl, al
and ah, cl
or ah, dl
mov al, dh
xor al, ah
test ah, ah
mov ecx, 0xb8d11147
mov edi, 0x1e9f5269
cmovne ecx, edi
test dh, dh
mov edx, 0xb8d11147
cmove ecx, edx
jmp 0x10020152
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0
sete byte [ebp - 0x30]
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
setne al
sete cl
cmp dword [0x10098e60], 0xa
setl dl
setge ah
and cl, ah
and dl, al
or dl, cl
or ah, al
mov al, ah
xor al, dl
test ah, ah
mov ecx, 0xb669bdbf
mov edi, 0x7ccbbb93
cmovne ecx, edi
test dl, dl
cmove ecx, edi
test al, al
mov eax, 0xb669bdbf
cmove ecx, eax
jmp 0x1001da86
cmp byte [ebp - 0x2e], 0
mov ecx, 0xbc3408cb
mov eax, 0x91ffff4a
cmovne ecx, eax
jmp 0x1001da86
mov eax, dword [ebp - 0x40]
mov ecx, 0x80a52b1d
jmp 0x1001da86
mov ecx, 0x48f3917
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
sete cl
setne dl
cmp dword [0x10098e60], 0xa
setge ah
setl ch
mov al, ch
xor al, dl
and al, ch
and ah, cl
and ch, dl
or ch, ah
mov cl, al
xor cl, ch
mov edx, 0x7ff96957
mov edi, 0x654cfba4
cmovne edx, edi
test ch, ch
mov ecx, edx
jmp 0x100203a9
mov ecx, 0x8f0e6780
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
setne al
sete dl
cmp dword [0x10098e60], 0xa
setge cl
xor dl, cl
or al, cl
mov ecx, edx
xor cl, al
mov edi, 0x6070db4f
mov ecx, 0x38443ce2
cmovne edi, ecx
test al, al
cmovne ecx, edi
test dl, dl
cmovne ecx, edi
jmp 0x1001da86
mov ecx, 0xdbb55950
jmp 0x1001da86
mov ecx, 0x5bfaf41b
jmp 0x1001da86
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xb71eafd7
and eax, 0x48e15028
or eax, edx
xor eax, 0x48e15029
xor ecx, eax
test ecx, eax
setne al
sete cl
cmp dword [0x10098e60], 0xa
setl dl
setge ah
and cl, ah
and dl, al
or dl, cl
or ah, al
mov al, ah
xor al, dl
test ah, ah
mov ecx, 0xde387b41
mov edi, 0x3ef0ab26
cmovne ecx, edi
test dl, dl
cmove ecx, edi
test al, al
mov eax, 0xde387b41
cmove ecx, eax
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
setne al
cmp dword [0x10098e60], 0xa
setge cl
mov edx, ecx
or dl, al
xor cl, al
mov eax, edx
xor al, cl
test cl, cl
mov ecx, 0x4f486636
mov edi, 0xe1f733eb
cmovne ecx, edi
test dl, dl
mov edx, 0x4f486636
cmovne ecx, edx
test al, al
cmove ecx, edi
jmp 0x1001da86
mov ecx, 0xfb7edbe6
jmp 0x1001da86
mov ecx, 0x1cb4f34d
jmp 0x1001da86
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
add eax, eax
add eax, 2
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [0x10098e5c]
lea ecx, [edx + 1]
imul ecx, edx
mov edx, ecx
not edx
mov edi, edx
and edi, 0x9caeee99
and ecx, 0x63511166
or ecx, edi
xor ecx, 0x9caeee98
or ecx, edx
cmp ecx, 0xffffffff
setne cl
cmp dword [0x10098e60], 0xa
setge dl
mov dh, dl
or dh, cl
xor dl, cl
mov bl, dh
xor bl, dl
test dl, dl
mov ecx, 0xb7a945df
mov edi, 0x7309f674
cmovne ecx, edi
mov eax, dword [eax]
test dh, dh
mov edx, 0xb7a945df
cmovne ecx, edx
mov dword [ebp - 0x64], eax
test bl, bl
cmove ecx, edi
jmp 0x1001da86
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push 1
push 0
push dword [ebp - 0x60]
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 0xa9a91326
jmp 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
setne al
cmp dword [0x10098e60], 0xa
setge cl
setl dl
xor dl, al
or cl, al
mov eax, edx
xor al, cl
mov eax, 0x3ef0ab26
mov edi, 0x2515f0e4
cmovne eax, edi
test cl, cl
mov ecx, 0x2515f0e4
cmovne ecx, eax
test dl, dl
cmovne ecx, eax
jmp 0x1001da86
push dword [ebp - 0x6c]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov dword [eax], ecx
push ecx
push dword [ebp - 0x10]
push ecx
push 0xf023f
push ecx
push ecx
push ecx
push dword [ebp - 0x3c]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov ecx, 0x48f3917
mov eax, 0x35ca64e4
cmove ecx, eax
jmp 0x1001da86
mov ecx, 0x9f24c2f7
jmp 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x10098e60], 0xa
setl dl
xor al, dl
mov ah, al
not ah
mov ecx, 0xa6f564ed
mov edi, 0x206f306f
cmovne ecx, edi
test ah, dl
mov edx, 0xa6f564ed
cmove ecx, edx
cmovne ecx, edi
test al, al
cmovne ecx, edi
jmp 0x1001da86
mov eax, dword [0x10098e5c]
mov ecx, 0x953a7c47
sub ecx, eax
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x10098e60], 0xa
setl dl
xor al, dl
mov ecx, eax
xor cl, 1
and dl, cl
xor cl, dl
mov edi, 0x272740b4
mov ecx, 0xbfb5606c
cmovne edi, ecx
test al, al
mov ecx, edi
mov eax, 0x272740b4
cmovne ecx, eax
test dl, dl
cmove ecx, edi
jmp 0x1001da86
mov ecx, 0x272740b4
jmp 0x1001da86
mov eax, dword [ebp - 0x20]
mov ecx, 0xccc75ae5
jmp 0x1001da86
push dword [ebp - 0x38]
push str.SoftwareMicrosoftWindowsCurrentVersion_
push str._s_s
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0x18]
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov edx, ecx
not edx
mov eax, edx
and eax, 0x8ee9414a
and ecx, 0x7116beb5
or ecx, eax
mov eax, dword [0x10098b68]
xor ecx, 0x8ee9414b
or ecx, edx
xor ecx, 0xffffffff
sete cl
setne ch
cmp dword [0x10098e60], 0xa
setge dh
setl dl
mov ebx, edx
xor bl, ch
and bl, dl
and dh, cl
and dl, ch
or dl, dh
mov ecx, ebx
xor cl, dl
mov edi, 0xac1fc9c5
mov esi, 0xfc2c9497
cmovne edi, esi
test dl, dl
mov ecx, edi
cmovne ecx, esi
mov dword [ebp - 0x6c], eax
test bl, bl
cmove ecx, edi
jmp 0x1001da86
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push dword [ebp - 0x68]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x8967b7f0
mov edx, eax
and edx, 0x7698480f
or edx, ecx
xor edx, 0x7698480e
and eax, 0xfffffffe
or eax, edx
cmp eax, 0xffffffff
setne al
cmp dword [0x10098e60], 0xa
setge cl
mov edx, ecx
xor dl, al
or cl, al
mov eax, ecx
xor al, dl
test cl, cl
mov ecx, 0xead8a801
mov edi, 0x3e9ec579
cmovne ecx, edi
test dl, dl
cmove ecx, edi
test al, al
mov eax, 0xead8a801
cmove ecx, eax
jmp 0x1001da86
mov ecx, 0xc54fdaa3
jmp 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x339c235c
mov edx, eax
and edx, 0xcc63dca3
or edx, ecx
xor edx, 0xcc63dca2
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e60], 0xa
setge dl
mov ah, dl
inc ah
and ah, cl
and al, dl
or al, ah
or dl, cl
mov ah, dl
xor ah, al
test dl, dl
mov ecx, 0xeda1a921
mov edx, 0x2f2c945a
cmovne ecx, edx
test al, al
cmove ecx, edx
test ah, ah
mov eax, 0xeda1a921
cmove ecx, eax
jmp 0x1001da86
cmp dword [ebp - 0x40], 0
setne byte [ebp - 0x2b]
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e60], 0xa
setl dl
setge ah
or ah, cl
xor dl, al
mov al, ah
xor al, dl
test dl, dl
mov ecx, 0xbf4f2ec
mov edx, 0x25552ec8
cmovne ecx, edx
test ah, ah
mov edi, 0xbf4f2ec
cmovne ecx, edi
test al, al
cmove ecx, edx
jmp 0x1001da86
mov ecx, 0xde387b41
jmp 0x1001da86
mov ecx, 0x94c23829
jmp 0x1001da86
mov ecx, 0xce334c1e
jmp 0x1001da86
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ecx, 0xced33e29
jmp 0x1001da86
mov eax, dword [ebp - 0x50]
mov ecx, 0x38443ce2
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x86971896
and eax, 0x7968e769
or eax, edx
xor eax, 0x7968e768
xor ecx, eax
test ecx, eax
sete al
setne cl
cmp dword [0x10098e60], 0xa
setl dl
setge ah
or ah, cl
xor dl, al
mov al, ah
xor al, dl
mov edi, 0x2020a6d9
mov ecx, 0x38627545
cmovne edi, ecx
test dl, dl
mov ecx, edi
mov edx, 0x2020a6d9
cmovne ecx, edx
test ah, ah
cmovne ecx, edi
jmp 0x1001da86
mov eax, dword [ebp - 0x40]
mov ecx, 0x9cdef17f
jmp 0x1001da86
mov eax, dword [0x10098e5c]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x10098e60], 0xa
setl cl
mov edx, ecx
xor dl, al
or cl, al
xor cl, 1
or cl, dl
mov eax, ecx
xor al, dl
test cl, cl
mov ecx, 0x5a23f48e
mov edi, 0x1156f930
cmovne ecx, edi
test dl, dl
cmove ecx, edi
test al, al
mov eax, 0x5a23f48e
cmove ecx, eax
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
and eax, 1
sete cl
cmp dword [0x10098e60], 0xa
setge dl
xor cl, dl
or al, dl
mov edx, ecx
xor dl, al
test al, al
mov eax, 0x35f517a5
mov edi, 0x6063f90b
cmovne eax, edi
test cl, cl
cmovne eax, edi
test dl, dl
mov ecx, 0x35f517a5
cmovne eax, ecx
mov ecx, eax
jmp 0x1001da86
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov edx, dword [0x10098e5c]
lea ecx, [edx + 1]
imul ecx, edx
mov edx, ecx
not edx
mov edi, edx
and edi, 0x6c50b7b4
and ecx, 0x93af484b
or ecx, edi
xor ecx, 0x93af484a
xor edx, ecx
test edx, ecx
setne cl
sete dl
cmp dword [0x10098e60], 0xa
setge ch
setl dh
xor dh, dl
or ch, cl
mov dl, ch
xor dl, dh
test ch, ch
mov ecx, 0x480510e2
mov edi, 0xa82ea4ee
cmovne ecx, edi
test dh, dh
cmove ecx, edi
mov dword [ebp - 0x74], eax
test dl, dl
mov eax, 0x480510e2
cmove ecx, eax
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete cl
cmp dword [0x10098e60], 0xa
setl dl
setge ch
and cl, ch
and dl, al
or dl, cl
or ch, al
mov al, ch
xor al, dl
test al, 1
mov eax, 0xa9a91326
mov edi, 0x5e13664b
cmovne eax, edi
test ch, 1
mov ecx, 0xa9a91326
jmp 0x10020684
mov eax, dword [ebp - 0x14]
push dword [0x10098b68]
push str.__s__w_5
push dword [eax]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [eax], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
push dword [ebp - 0x24]
push edx
push dword [ebp - 0x28]
push edx
push dword [eax]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete byte [ebp - 0x2d]
mov ecx, 0x2ddc91f1
jmp 0x1001da86
mov ecx, 0xb01cc3df
jmp 0x1001da86
mov ecx, 0x4cc8fe2f
jmp 0x1001da86
cmp byte [ebp - 0x2b], 0
mov ecx, 0xceeca1ea
mov eax, 0x294e1eab
cmovne ecx, eax
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete cl
cmp dword [0x10098e60], 0xa
setl dl
setge ch
and cl, ch
and dl, al
or dl, cl
or ch, al
mov al, ch
xor al, dl
test al, 1
mov eax, 0x7fe7307b
mov edi, 0xac1fc9c5
cmovne eax, edi
test ch, 1
mov ecx, 0x7fe7307b
cmovne ecx, eax
test dl, dl
cmove ecx, eax
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
setne al
cmp dword [0x10098e60], 0xa
setge cl
setl dl
xor dl, al
or cl, al
mov eax, edx
xor al, cl
test cl, cl
mov ecx, 0xee7c8c24
mov edi, 0x73093a6d
cmovne ecx, edi
test dl, dl
cmovne ecx, edi
test al, al
mov eax, 0xee7c8c24
cmovne ecx, eax
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx - 0x45989a8a]
not eax
imul eax, ecx
test al, 1
sete dl
cmp dword [0x10098e60], 0xa
setge cl
xor dl, cl
or al, cl
mov ecx, edx
xor cl, al
test cl, 1
mov edi, 0xf84a0c9e
mov ecx, 0xc54fdaa3
cmovne edi, ecx
test al, 1
cmovne ecx, edi
test dl, dl
cmovne ecx, edi
jmp 0x1001da86
mov ecx, 0xe0ed5411
jmp 0x1001da86
mov eax, dword [ebp - 0x20]
mov ecx, 0x455db317
jmp 0x1001da86
mov ecx, 0x6a9039ee
jmp 0x1001da86
mov eax, dword [ebp - 0x14]
mov ecx, 0x49b4fbfc
jmp 0x1001da86
cmp dword [ebp - 0x50], 0
setne byte [ebp - 0x2e]
mov ecx, dword [0x10098e5c]
mov eax, 0x792e6a23
sub eax, ecx
imul eax, ecx
test al, 1
sete dl
cmp dword [0x10098e60], 0xa
setge cl
setl ch
and ch, al
and dl, cl
or dl, ch
or cl, al
mov eax, ecx
xor al, dl
test cl, 1
mov ecx, 0xbafed41
mov edi, 0x6070db4f
cmovne ecx, edi
test dl, dl
cmove ecx, edi
test al, 1
mov eax, 0xbafed41
cmove ecx, eax
jmp 0x1001da86
mov ecx, dword [0x10098e5c]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete cl
cmp dword [0x10098e60], 0xa
setge ch
setl dh
mov dl, dh
xor dl, al
and dl, dh
and ch, cl
and dh, al
or dh, ch
mov eax, edx
xor al, dh
mov eax, 0x1c617e6b
mov edi, 0xe181ece3
cmovne eax, edi
test dh, dh
mov ecx, eax
cmovne ecx, edi
jmp 0x10020687
mov ecx, 0xea59e86
jmp 0x1001da86
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0x18d01af2
jmp 0x1001da86
mov eax, dword [ebp - 0x10]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x10098e5c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xf54b6ad2
mov edx, eax
and edx, 0xab4952d
or edx, ecx
xor edx, 0xab4952c
and eax, 0xfffffffe
or eax, edx
xor eax, 0xbaa10e55
cmp eax, 0x455ef1aa
sete al
cmp dword [0x10098e60], 0xa
setl cl
xor al, cl
mov edx, eax
xor dl, 1
and cl, dl
xor dl, cl
test al, al
mov eax, 0x2e26b251
mov edi, 0x6cdc3013
cmovne eax, edi
test cl, cl
mov ecx, 0x2e26b251
cmove eax, ecx
test dl, dl
cmove eax, edi
mov ecx, eax
jmp 0x1001da86
mov ecx, 0xe33fd46e
jmp 0x1001da86
cmp ecx, 0x2515f0e4
jne 0x1001da86
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret