Function at 0x1000c850
Capabilities:
Get common file path
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe64
mov eax, dword [0x1005a014]
xor eax, esp
mov dword [esp + 0xe60], eax
push ebx
push esi
push edi
push 0xc00
lea eax, [esp + 0x6c]
mov ebx, ecx
push 0
push eax
call fcn.1002ea90
add esp, 0xc
mov dword [esp + 0xc], 0
cmp word [0x1005b838], 0
mov dword [esp + 0x24], 0
jne 0x1000dd7f
push 0x100
push 0x1008a178
push 0x1004fd98
call dword [0x100898b0]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test eax, eax
jne 0x1000c8da
call esi
push eax
push 0x1004fda4
push 0x100
push 0x1008a178
call fcn.1001be70
add esp, 0x10
push 0xa
push 0
push 0x1008a178
call fcn.100366a7
add esp, 0xc
push eax
push str.vtapp__u
push 0x20
push 0x1008a278
call fcn.1001be70
xorps xmm0, xmm0
push 0x3a
push 0x1008a178
movlpd qword [0x10089678], xmm0
call fcn.1002e030
add esp, 0x18
test eax, eax
je 0x1000ca15
inc eax
push 0x3a
push eax
call fcn.1002e030
add esp, 8
test eax, eax
je 0x1000ca15
push 0x10
lea esi, [eax + 1]
push 0
push esi
call fcn.100366ed
or dword [0x10089678], eax
add esp, 0xc
or dword [0x1008967c], edx
push 0x3a
push esi
call fcn.1002e030
add esp, 8
test eax, eax
je 0x1000ca0f
lea edx, [eax + 1]
mov esi, edx
lea ecx, [esi + 1]
nop word [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000c970
sub esi, ecx
test esi, esi
jle 0x1000c9b4
cmp esi, 0x104
jge 0x1000c99d
push esi
push edx
push 0x10089680
call fcn.1002e510
add esp, 0xc
mov byte [esi + 0x10089680], 0
jmp 0x1000c9bb
mov ecx, 0x41
mov esi, edx
mov edi, 0x10089680
rep movsd dword es:[edi], dword [esi]
mov byte [0x10089783], 0
jmp 0x1000c9bb
mov byte [0x10089680], 0
push 0x1004fdb4
push 0x10089680
call fcn.1002ddc0
add esp, 8
test eax, eax
je 0x1000ca0f
cmp eax, 0x10089680
jbe 0x1000c9f9
cmp byte [eax - 1], 0x3a
je 0x1000c9f5
add eax, 2
push 0x1004fdb4
push eax
call fcn.1002ddc0
add esp, 8
test eax, eax
jne 0x1000c9d1
jmp 0x1000ca0f
test eax, eax
je 0x1000ca0f
push 0xa
add eax, 2
push 0
push eax
call fcn.10036661
add esp, 0xc
add dword [0x10064fdc], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x600
push 0x100612f8
push ebx
call dword [0x10089890]
push 0x5c
push 0x100612f8
call fcn.1002dc4e
add esp, 8
test eax, eax
je 0x1000ca3e
xor ecx, ecx
mov word [eax], cx
push 0
push 0x23
push 0x10061ef8
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1000ca76
push 0
push 0
push 0x600
push 0x10061ef8
push 0xffffffffffffffff
push 0x100612f8
push 0
push 0
call edi
jmp 0x1000cabb
push str.LSZY
push 0x600
push 0x10061ef8
call fcn.10037488
add esp, 0xc
push str.WiseService
push 0x600
push 0x10061ef8
call fcn.10037488
add esp, 0xc
push str.VtApp
push 0x600
push 0x10061ef8
call fcn.10037488
add esp, 0xc
push 0x600
push 0x1005ca38
push 0
call dword [0x10089890]
push 0x5c
push 0x1005ca38
call fcn.1002dc4e
add esp, 8
test eax, eax
je 0x1000cb26
add eax, 2
push eax
push 0x40
push 0x10061238
call fcn.1003088f
add esp, 0xc
push 0
push 0
push 0x40
push 0x100612b8
push 0xffffffffffffffff
push 0x10061238
push 0
push 0
call edi
push 0
push 0
push 0x600
push 0x1005d638
push 0xffffffffffffffff
push 0x1005ca38
push 0
push 0
call edi
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
push 0x28
push 0x1005b838
push 0
call ebx
test eax, eax
je 0x1000cb58
push 0
push 0
push 0x600
push 0x1005c438
push 0xffffffffffffffff
push 0x1005b838
push 0
push 0
call edi
push 0
push 0x24
push 0x1005dc38
push 0
call ebx
test eax, eax
je 0x1000cb84
push 0
push 0
push 0x600
push 0x1005e838
push 0xffffffffffffffff
push 0x1005dc38
push 0
push 0
call edi
mov dword [0x10064fd4], 0
call esi
push 0x10064fe0
push eax
mov dword [0x10064fd8], eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
call fcn.1000fc10
xorps xmm0, xmm0
mov dword [0x10089420], eax
push 0x10089430
movups xmmword [0x10089424], xmm0
mov dword [0x10089444], 0
movups xmmword [0x10089434], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x10]
push eax
push 5
push 0xffffffffffffffff
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
test eax, eax
je 0x1000cbfe
push dword [esp + 0xc]
push 0x40
push 0x100630f8
call fcn.100374eb
add esp, 0xc
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1000cc0d
push eax
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
push 0x100630f8
push 0x100612b8
push 0x10061ef8
push str._s_s__s.log
push 0x600
push 0x10089a68
call fcn.1001be10
add esp, 0x18
cmp byte [0x10089a68], 0
je 0x1000cc5b
push 0x1004fc44
push 0x10089a68
call fcn.1003687c
add esp, 8
test eax, eax
je 0x1000cc5b
push eax
call fcn.1003703b
add esp, 4
push 0x100612f8
push str._s_vthook.cfg
lea eax, [esp + 0x70]
push 0x600
push eax
call fcn.1001bcb0
add esp, 0x10
lea ecx, [esp + 0x68]
call fcn.1000bcb0
mov eax, dword [0x10089678]
and eax, 0x6007f03
or eax, 0
je 0x1000cef8
cmp word [0x10060038], 0
jne 0x1000ccbe
push str.LSZY_vtapp
push 0x10061ef8
push str._S_s
push 0x600
push 0x10060038
call fcn.1001bcb0
add esp, 0x14
push 0x10060038
call dword [0x100898ec]
cmp eax, 0xffffffff
je 0x1000ccd2
test al, 0x10
jne 0x1000cd0a
cmp dword [0x10063138], 0
jne 0x1000ccf3
xor eax, eax
mov word [0x10060038], ax
mov byte [0x10060c38], al
mov word [0x100624f8], ax
jmp 0x1000cdcc
mov ecx, 0x10060038
call fcn.1000e600
push 0
push 0x10060038
call dword [0x100898d4]
cmp word [0x10060038], 0
jne 0x1000cd28
xor eax, eax
mov byte [0x10060c38], 0
mov word [0x100624f8], ax
jmp 0x1000cdcc
push 0
push 0
push 0x600
push 0x10060c38
push 0xffffffffffffffff
push 0x10060038
push 0
push 0
call edi
push str.LSZY_vtreg
push 0x10061ef8
push str._S_s
push 0x600
push 0x100624f8
call fcn.1001bcb0
add esp, 0x14
cmp word [0x10060038], 0
je 0x1000cdcc
mov edx, 0x10060038
mov ecx, 0x1005ca38
call fcn.1000c730
mov edx, eax
test edx, edx
je 0x1000cdcc
cmp word [edx], 0x5c
jne 0x1000cdcc
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000cd90
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 0x1005ca38
call fcn.1002e510
mov ax, word [0x1005ca3a]
add esp, 0xc
mov word [0x1005ca38], ax
mov eax, 0x3a
mov word [0x1005ca3a], ax
cmp dword [0x10063138], 0
je 0x1000ce87
cmp word [0x1005ca3a], 0x3a
jne 0x1000ce87
cmp word [0x1005ca3c], 0x5c
jne 0x1000ce87
push 0x10060038
lea eax, [esp + 0x6c]
push 0x600
push eax
call fcn.1003088f
lea esi, [esp + 0x74]
add esp, 0xc
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1000ce13
sub esi, ecx
sar esi, 1
cmp esi, 0x5fd
jge 0x1000ce87
push 0x1005ca38
lea eax, [esp + 0x6c]
push 0x600
push eax
call fcn.10037545
mov eax, 0x5c
add esp, 0xc
mov word [esp + esi*2 + 0x68], ax
mov ax, word [0x1005ca38]
mov word [esp + esi*2 + 0x6a], ax
lea eax, [esp + 0x68]
push eax
call dword [0x100898ec]
cmp eax, 0xffffffff
jne 0x1000ce87
lea ecx, [esp + 0x68]
call fcn.1000e600
push 1
push 0
push 0
push 0
lea eax, [esp + 0x78]
push eax
push 0x1005ca38
call dword [0x100898fc]
cmp word [0x1005ee38], 0
jne 0x1000cef8
push 0
push 0x1c
push 0x1005ee38
push 0
call ebx
test eax, eax
je 0x1000cef8
push 0x1004fe10
push 0x600
push 0x1005ee38
call fcn.10037545
add esp, 0xc
push str.LSZY_vtapp
push 0x600
push 0x1005ee38
call fcn.10037545
add esp, 0xc
push 0
push 0x1005ee38
call dword [0x100898d4]
push 0
push 0
push 0x600
push 0x1005fa38
push 0xffffffffffffffff
push 0x1005ee38
push 0
push 0
call edi
push 0x5c
push 0x1005ca38
call fcn.1002dc4e
add esp, 8
test eax, eax
je 0x1000cf1d
xor ecx, ecx
mov word [eax], cx
sub eax, 0x1005ca38
sar eax, 1
mov byte [eax + 0x1005d638], cl
mov ecx, dword [0x1008967c]
xor eax, eax
and ecx, 1
or eax, ecx
je 0x1000d217
push 0x100612f8
push 0x1004fe14
lea eax, [esp + 0x70]
push 0x600
push eax
call fcn.1001bcb0
add esp, 0x10
lea eax, [esp + 0x68]
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push eax
call dword [0x100897a8]
mov esi, eax
mov ebx, 0x104
cmp esi, 0xffffffff
je 0x1000d0ac
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0x3f
lea eax, [esp + 0x34]
push eax
push esi
call dword [0x10089948]
push esi
test eax, eax
jne 0x1000cfa6
call dword [0x100897b4]
jmp 0x1000d0ac
mov eax, dword [esp + 0x14]
mov byte [esp + eax + 0x2c], 0
call dword [0x100897b4]
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x1000d0ac
xor esi, esi
test eax, eax
jle 0x1000cfd3
cmp byte [esp + esi + 0x28], 0x3a
je 0x1000cfd3
inc esi
cmp esi, eax
jl 0x1000cfc7
mov edi, 0x10089680
lea ecx, [edi + 1]
nop dword [eax + eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x1000cfe0
sub edi, ecx
mov eax, ebx
sub eax, edi
mov dword [esp + 0x10], eax
lea ecx, [edi + 0x10089680]
cmp eax, 0xd
jle 0x1000d023
movq xmm0, qword [str.:f:LicenseDB:]
mov eax, dword [0x1004fe3c]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
mov al, byte [0x1004fe40]
mov byte [ecx + 0xc], al
mov eax, 0xd
mov byte [ecx + 0xd], 0
jmp 0x1000d047
test eax, eax
jle 0x1000d045
push eax
push str.:f:LicenseDB:
push ecx
call fcn.1002e510
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov byte [eax + edi + 0x1008967f], 0
dec eax
jmp 0x1000d047
xor eax, eax
add edi, eax
sub ebx, edi
lea edi, [edi + 0x10089680]
test esi, esi
jns 0x1000d06b
lea esi, [esp + 0x28]
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000d060
sub esi, ecx
test esi, esi
jle 0x1000d0a0
cmp esi, ebx
jge 0x1000d086
push esi
lea eax, [esp + 0x2c]
push eax
push edi
call fcn.1002e510
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x1000d0a7
test ebx, ebx
jle 0x1000d0a7
push ebx
lea eax, [esp + 0x2c]
push eax
push edi
call fcn.1002e510
add esp, 0xc
mov byte [ebx + edi - 1], 0
jmp 0x1000d0a7
test ebx, ebx
jle 0x1000d0a7
mov byte [edi], 0
mov ebx, 0x104
push 0x100612f8
push str._sLicenseRT.1
lea eax, [esp + 0x70]
push 0x600
push eax
call fcn.1001bcb0
add esp, 0x10
lea eax, [esp + 0x68]
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push eax
call dword [0x100897a8]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000d217
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0x3f
lea eax, [esp + 0x34]
push eax
push esi
call dword [0x10089948]
push esi
test eax, eax
jne 0x1000d11d
call dword [0x100897b4]
jmp 0x1000d217
mov eax, dword [esp + 0x14]
mov byte [esp + eax + 0x2c], 0
call dword [0x100897b4]
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x1000d217
xor esi, esi
test eax, eax
jle 0x1000d14c
nop
cmp byte [esp + esi + 0x28], 0x3a
je 0x1000d14c
inc esi
cmp esi, eax
jl 0x1000d140
mov edi, 0x10089680
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x1000d154
sub edi, ecx
mov eax, ebx
sub eax, edi
mov dword [esp + 0x10], eax
lea ecx, [edi + 0x10089680]
cmp eax, 0xd
jle 0x1000d197
movq xmm0, qword [str.:f:LicenseRT:]
mov eax, dword [0x1004fe6c]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
mov al, byte [0x1004fe70]
mov byte [ecx + 0xc], al
mov eax, 0xd
mov byte [ecx + 0xd], 0
jmp 0x1000d1bb
test eax, eax
jle 0x1000d1b9
push eax
push str.:f:LicenseRT:
push ecx
call fcn.1002e510
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov byte [edi + eax + 0x1008967f], 0
dec eax
jmp 0x1000d1bb
xor eax, eax
add edi, eax
sub ebx, edi
lea edi, [edi + 0x10089680]
test esi, esi
jns 0x1000d1db
lea esi, [esp + 0x28]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000d1d0
sub esi, ecx
test esi, esi
jle 0x1000d210
cmp esi, ebx
jge 0x1000d1f6
push esi
lea eax, [esp + 0x2c]
push eax
push edi
call fcn.1002e510
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x1000d217
test ebx, ebx
jle 0x1000d217
push ebx
lea eax, [esp + 0x2c]
push eax
push edi
call fcn.1002e510
add esp, 0xc
mov byte [edi + ebx - 1], 0
jmp 0x1000d217
test ebx, ebx
jle 0x1000d217
mov byte [edi], 0
mov eax, dword [0x10089678]
and eax, 0x6007f03
or eax, 0
je 0x1000dd7f
mov eax, dword [0x10064fdc]
test eax, eax
jne 0x1000d249
push eax
push 0x10064fe4
push eax
push 0xf003f
push eax
push eax
push eax
push str.LSZY_vtreg
jmp 0x1000d285
push eax
push str.LSZY_vtreg
push str._s__u
lea eax, [esp + 0xc74]
push 0x100
push eax
call fcn.1001bcf0
add esp, 0x14
lea eax, [esp + 0xc68]
push 0
push 0x10064fe4
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push closesocket
call dword [0x1008997c]
cmp word [0x100624f8], 0
jne 0x1000d2a6
mov dword [0x10064fe8], 0
jmp 0x1000d2f3
push 0
push 0x10064fe8
push 0
push 0xf003f
push 0
push 0
push 0
push str.LSZY_vtreg
push reloc.WS2_32.dll_closesocket
call dword [0x1008997c]
push 0x100624f8
call dword [0x100898ec]
cmp eax, 0xffffffff
je 0x1000d2f3
test al, 0x10
jne 0x1000d2f3
push 0x100624f8
push str.LSZY_vtreg
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
push 0xc200
push 0
push 0x10064ff0
call fcn.1002ea90
add esp, 0xc
push 0x100711f0
call dword [0x100897c8]
push 0x18200
push 0
push 0x10071208
call fcn.1002ea90
add esp, 0xc
push 0x10089408
call dword [0x100897c8]
cmp byte [0x10089a68], 0
je 0x1000d862
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov edi, eax
add esp, 8
test edi, edi
je 0x1000d3bb
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
call fcn.10036b8c
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add esp, 4
mov esi, eax
call ebx
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u_vthook_initialized:__n
push edi
call fcn.1001bf20
add esp, 0x24
push edi
call fcn.10036ec3
add esp, 4
push edi
call fcn.1003703b
add esp, 4
jmp 0x1000d3c1
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp byte [0x10089a68], 0
je 0x1000d862
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov edi, eax
add esp, 8
test edi, edi
je 0x1000d445
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
call fcn.10036b8c
add esp, 4
mov esi, eax
push 0x1005b838
call ebx
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u________usr_home:__S_n
push edi
call fcn.1001bf20
push edi
call fcn.10036ec3
add esp, 0x2c
push edi
call fcn.1003703b
add esp, 4
cmp byte [0x10089a68], 0
je 0x1000d862
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov edi, eax
add esp, 8
test edi, edi
je 0x1000d4c9
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
call fcn.10036b8c
add esp, 4
mov esi, eax
push 0x1005ca38
call ebx
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u________app_path:__S_n
push edi
call fcn.1001bf20
push edi
call fcn.10036ec3
add esp, 0x2c
push edi
call fcn.1003703b
add esp, 4
cmp byte [0x10089a68], 0
je 0x1000d862
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov edi, eax
add esp, 8
test edi, edi
je 0x1000d54d
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
call fcn.10036b8c
add esp, 4
mov esi, eax
push 0x10061238
call ebx
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u________app_name:__S_n
push edi
call fcn.1001bf20
push edi
call fcn.10036ec3
add esp, 0x2c
push edi
call fcn.1003703b
add esp, 4
cmp byte [0x10089a68], 0
je 0x1000d862
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov edi, eax
add esp, 8
test edi, edi
je 0x1000d5d1
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
call fcn.10036b8c
add esp, 4
mov esi, eax
push 0x100612f8
call ebx
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u________dll_path:__S_n
push edi
call fcn.1001bf20
push edi
call fcn.10036ec3
add esp, 0x2c
push edi
call fcn.1003703b
add esp, 4
cmp byte [0x10089a68], 0
je 0x1000d862
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov edi, eax
add esp, 8
test edi, edi
je 0x1000d655
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
call fcn.10036b8c
add esp, 4
mov esi, eax
push 0x1005dc38
call ebx
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u________sys_path:__S_n
push edi
call fcn.1001bf20
push edi
call fcn.10036ec3
add esp, 0x2c
push edi
call fcn.1003703b
add esp, 4
cmp byte [0x10089a68], 0
je 0x1000d862
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov edi, eax
add esp, 8
test edi, edi
je 0x1000d6d9
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
call fcn.10036b8c
add esp, 4
mov esi, eax
push 0x1005ee38
call ebx
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u________usr_path:__S_n
push edi
call fcn.1001bf20
push edi
call fcn.10036ec3
add esp, 0x2c
push edi
call fcn.1003703b
add esp, 4
cmp byte [0x10089a68], 0
je 0x1000d862
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov edi, eax
add esp, 8
test edi, edi
je 0x1000d75d
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
call fcn.10036b8c
add esp, 4
mov esi, eax
push 0x10060038
call ebx
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u________box_path:__S_n
push edi
call fcn.1001bf20
push edi
call fcn.10036ec3
add esp, 0x2c
push edi
call fcn.1003703b
add esp, 4
cmp byte [0x10089a68], 0
je 0x1000d862
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov edi, eax
add esp, 8
test edi, edi
je 0x1000d7e1
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
call fcn.10036b8c
add esp, 4
mov esi, eax
push 0x100624f8
call ebx
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u________reg_path:__S_n
push edi
call fcn.1001bf20
push edi
call fcn.10036ec3
add esp, 0x2c
push edi
call fcn.1003703b
add esp, 4
cmp byte [0x10089a68], 0
je 0x1000d862
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov edi, eax
add esp, 8
test edi, edi
je 0x1000d862
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
push eax
call fcn.10036b8c
add esp, 4
mov esi, eax
push dword [0x10063138]
call ebx
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u________box_create:__d_n
push edi
call fcn.1001bf20
push edi
call fcn.10036ec3
add esp, 0x2c
push edi
call fcn.1003703b
add esp, 4
xor esi, esi
mov edi, 0x1006313c
mov dword [esp + 0x10], esi
nop dword [eax]
cmp byte [0x10089a68], 0
je 0x1000d8ff
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1000d8ff
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], edx
push eax
call fcn.10036b8c
add esp, 4
mov esi, eax
push edi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u________box_rdev:___d__S_n
push ebx
call fcn.1001bf20
add esp, 0x2c
push ebx
call fcn.10036ec3
add esp, 4
push ebx
call fcn.1003703b
mov esi, dword [esp + 0x14]
add esp, 4
inc esi
add edi, 0x208
mov dword [esp + 0x10], esi
cmp edi, 0x10063754
jl 0x1000d870
xor esi, esi
mov edi, 0x1006376c
mov dword [esp + 0x10], esi
cmp byte [0x10089a68], 0
je 0x1000d9b0
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1000d9b0
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], edx
push eax
call fcn.10036b8c
add esp, 4
mov esi, eax
push edi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u________ext_path:___d__S_n
push ebx
call fcn.1001bf20
add esp, 0x2c
push ebx
call fcn.10036ec3
add esp, 4
push ebx
call fcn.1003703b
mov esi, dword [esp + 0x14]
add esp, 4
inc esi
add edi, 0x208
mov dword [esp + 0x10], esi
cmp edi, 0x100647ac
jl 0x1000d921
cmp byte [0x10089a68], 0
je 0x1000dd7f
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov edi, eax
add esp, 8
test edi, edi
je 0x1000da53
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], edx
push eax
call fcn.10036b8c
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add esp, 4
mov esi, eax
push 0x100630f8
call ebx
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u________usr_name:__s_n
push edi
call fcn.1001bf20
push edi
call fcn.10036ec3
add esp, 0x2c
push edi
call fcn.1003703b
add esp, 4
jmp 0x1000da59
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp byte [0x10089a68], 0
je 0x1000dd7f
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov edi, eax
add esp, 8
test edi, edi
je 0x1000dade
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], edx
push eax
call fcn.10036b8c
add esp, 4
mov esi, eax
push dword [0x10064fd8]
call ebx
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u________proc_id:__u_n
push edi
call fcn.1001bf20
push edi
call fcn.10036ec3
add esp, 0x2c
push edi
call fcn.1003703b
add esp, 4
cmp byte [0x10089a68], 0
je 0x1000dd7f
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov edi, eax
add esp, 8
test edi, edi
je 0x1000db63
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], edx
push eax
call fcn.10036b8c
add esp, 4
mov esi, eax
push dword [0x10064fe0]
call ebx
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u________sess_id:__u_n
push edi
call fcn.1001bf20
push edi
call fcn.10036ec3
add esp, 0x2c
push edi
call fcn.1003703b
add esp, 4
cmp byte [0x10089a68], 0
je 0x1000dd7f
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov edi, eax
add esp, 8
test edi, edi
je 0x1000dbe8
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], edx
push eax
call fcn.10036b8c
add esp, 4
mov esi, eax
push dword [0x10064fe8]
call ebx
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u________box_hkey:__p_n
push edi
call fcn.1001bf20
push edi
call fcn.10036ec3
add esp, 0x2c
push edi
call fcn.1003703b
add esp, 4
cmp byte [0x10089a68], 0
je 0x1000dd7f
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov edi, eax
add esp, 8
test edi, edi
je 0x1000dc6d
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], edx
push eax
call fcn.10036b8c
add esp, 4
mov esi, eax
push dword [0x10064fe4]
call ebx
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u________usr_hkey:__p_n
push edi
call fcn.1001bf20
push edi
call fcn.10036ec3
add esp, 0x2c
push edi
call fcn.1003703b
add esp, 4
cmp byte [0x10089a68], 0
je 0x1000dd7f
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov edi, eax
add esp, 8
test edi, edi
je 0x1000dcfb
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], edx
push eax
call fcn.10036b8c
add esp, 4
mov esi, eax
push dword [0x1008967c]
push dword [0x10089678]
call ebx
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u________use_mask:__llx_n
push edi
call fcn.1001bf20
add esp, 0x2c
push edi
call fcn.10036ec3
add esp, 4
push edi
call fcn.1003703b
add esp, 4
cmp byte [0x10089a68], 0
je 0x1000dd7f
push 0x1004fc48
push 0x10089a68
call fcn.1003687c
mov edi, eax
add esp, 8
test edi, edi
je 0x1000dd7f
push 0
call fcn.10036893
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], edx
push eax
call fcn.10036b8c
add esp, 4
mov esi, eax
push 0x10089680
call ebx
push eax
push dword [esi]
mov eax, dword [esi + 0x10]
push dword [esi + 4]
inc eax
push dword [esi + 8]
push dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x14]
add eax, 0x76c
push eax
push str.__04d__02d__02d__02d:_02d:_02d___u________use_opt:__s_n
push edi
call fcn.1001bf20
push edi
call fcn.10036ec3
add esp, 0x2c
push edi
call fcn.1003703b
add esp, 4
mov ecx, dword [esp + 0xe6c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002bcfe
mov esp, ebp
pop ebp
ret