Function at 0x10025612
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10089219
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c0
push esi
push edi
push 2
lea ecx, [ebp - 0x2fc]
call fcn.10017107
and dword [ebp - 4], 0
mov dword [ebp - 0x58], 0xfffffffb
mov dword [ebp - 0x6c], 0
jmp 0x1002565a
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10025676
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x2fc]
call fcn.100171a5
mov dword [eax], 0x5b57
jmp 0x10025653
mov dword [ebp - 0x58], 0
jmp 0x10025686
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jg 0x10025711
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x228], 0xef9d7865
mov dword [ebp - 0x74], 1
jmp 0x100256b1
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x1002570c
push dword [ebp - 0x58]
lea ecx, [ebp - 0x2fc]
call fcn.100171a5
cmp dword [eax], 0xcf09
je 0x100256d9
mov dword [ebp - 0x124], 1
jmp 0x100256e0
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x228], eax
mov byte [ebp - 0x42], 0
movzx eax, byte [ebp - 0x42]
test eax, eax
je 0x1002570a
push 0x7b8
push 0
push 0x238e
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x100256aa
jmp 0x1002567f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.10017189
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10025c4f
push 1
lea ecx, [ebp - 0xb4]
call fcn.10017107
mov dword [ebp - 4], 1
mov dword [ebp - 0xd8], 0xffffffff
push 4
lea ecx, [ebp - 0x200]
call fcn.10017107
mov byte [ebp - 4], 2
mov dword [ebp - 0x1e0], 0xc4ce10b4
mov dword [ebp - 0x25c], 0x5d8d3410
mov dword [ebp - 0x20], 0
jmp 0x1002577f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1002579b
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb4]
call fcn.100171a5
mov dword [eax], 7
jmp 0x10025778
mov dword [ebp - 0x20], 0
jmp 0x100257ab
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x100257c7
push dword [ebp - 0x20]
lea ecx, [ebp - 0x200]
call fcn.100171a5
mov dword [eax], 0xffff
jmp 0x100257a4
push 0
lea ecx, [ebp - 0xb4]
call fcn.100171a5
cmp dword [eax], 0
jne 0x10025a10
push 0
lea ecx, [ebp - 0xb4]
call fcn.100171a5
cmp dword [eax], 0
jne 0x10025874
push 0
lea ecx, [ebp - 0xb4]
call fcn.100171a5
push 0
lea ecx, [ebp - 0xb4]
call fcn.100171a5
push 0
lea ecx, [ebp - 0xb4]
call fcn.100171a5
cmp dword [eax], 0x8cb6
jge 0x1002582e
mov dword [ebp - 0x214], 1
jmp 0x10025835
and dword [ebp - 0x214], 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.100171a5
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [eax]
jg 0x10025858
mov dword [ebp - 0x21c], 1
jmp 0x1002585f
and dword [ebp - 0x21c], 0
cmp dword [ebp - 0x21c], 0xfffa
jb 0x10025874
and dword [ebp - 0x224], 0
jmp 0x1002587e
mov dword [ebp - 0x224], 1
push 0
lea ecx, [ebp - 0xb4]
call fcn.100171a5
mov ecx, dword [ebp - 0x224]
cmp ecx, dword [eax]
je 0x100258a1
mov dword [ebp - 0xf4], 1
jmp 0x100258a8
and dword [ebp - 0xf4], 0
cmp dword [ebp - 0xf4], 0x2c51
jl 0x100258c0
mov dword [ebp - 0x204], 1
jmp 0x100258c7
and dword [ebp - 0x204], 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.100171a5
mov ecx, dword [ebp - 0x204]
sub ecx, dword [eax]
cmp ecx, 0x4151
jle 0x100258f0
mov dword [ebp - 0x20c], 1
jmp 0x100258f7
and dword [ebp - 0x20c], 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.100171a5
mov ecx, dword [ebp - 0x20c]
cmp ecx, dword [eax]
jle 0x1002591a
mov dword [ebp - 0x100], 1
jmp 0x10025921
and dword [ebp - 0x100], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x100], eax
jne 0x1002593b
mov dword [ebp - 0x190], 1
jmp 0x10025942
and dword [ebp - 0x190], 0
push 1
lea ecx, [ebp - 0x200]
call fcn.100171a5
mov ecx, dword [ebp - 0x190]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0xd8]
jle 0x1002596b
mov dword [ebp - 0x108], 1
jmp 0x10025972
and dword [ebp - 0x108], 0
push 1
lea ecx, [ebp - 0x200]
call fcn.100171a5
mov ecx, dword [ebp - 0x108]
cmp ecx, dword [eax]
jne 0x10025995
mov dword [ebp - 0x1d8], 1
jmp 0x1002599c
and dword [ebp - 0x1d8], 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.100171a5
mov ecx, dword [ebp - 0x1d8]
cmp ecx, dword [eax]
je 0x100259bf
mov dword [ebp - 0x110], 1
jmp 0x100259c6
and dword [ebp - 0x110], 0
push 3
lea ecx, [ebp - 0x200]
call fcn.100171a5
mov ecx, dword [ebp - 0x110]
cmp ecx, dword [eax]
jg 0x100259e9
mov dword [ebp - 0x198], 1
jmp 0x100259f0
and dword [ebp - 0x198], 0
push 0
lea ecx, [ebp - 0x200]
call fcn.100171a5
mov ecx, dword [ebp - 0x198]
cmp ecx, dword [eax]
jne 0x10025a10
and dword [ebp - 0x118], 0
jmp 0x10025a1a
mov dword [ebp - 0x118], 1
cmp dword [ebp - 0x118], 0xc4185a1f
jb 0x10025a32
mov dword [ebp - 0x220], 1
jmp 0x10025a39
and dword [ebp - 0x220], 0
cmp dword [ebp - 0x220], 0xa296
jge 0x10025a51
mov dword [ebp - 0x120], 1
jmp 0x10025a58
and dword [ebp - 0x120], 0
cmp dword [ebp - 0x120], 1
jl 0x10025a6d
mov dword [ebp - 0x1a0], 1
jmp 0x10025a74
and dword [ebp - 0x1a0], 0
push 0
lea ecx, [ebp - 0xb4]
call fcn.100171a5
mov ecx, dword [ebp - 0x1a0]
cmp ecx, dword [eax]
je 0x10025a97
mov dword [ebp - 0x128], 1
jmp 0x10025a9e
and dword [ebp - 0x128], 0
mov esi, dword [ebp - 0x128]
add esi, 0xa9
push 1
lea ecx, [ebp - 0x200]
call fcn.100171a5
imul esi, dword [eax]
sub esi, dword [ebp - 0xd8]
mov dword [ebp - 0x1e0], esi
mov esi, dword [ebp - 0x1e0]
push 1
lea ecx, [ebp - 0x200]
call fcn.100171a5
cmp esi, dword [eax]
jne 0x10025ae9
mov dword [ebp - 0x130], 1
jmp 0x10025af0
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x200]
call fcn.10017189
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb4]
call fcn.10017189
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x2d8], 3
mov dword [ebp - 0x2d4], 3
mov dword [ebp - 0x2d0], 3
mov dword [ebp - 0x2cc], 3
lea ecx, [ebp - 0xd9]
call fcn.10009433
push eax
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x2d8]
push eax
lea ecx, [ebp - 0x3a8]
call fcn.100171b4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x37c]
call fcn.10017163
mov dword [ebp - 0xa0], 0x9000d4e7
mov dword [ebp - 0xa0], 3
jmp 0x10025ba3
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x10025bd0
mov byte [ebp - 0x41], 0
movzx eax, byte [ebp - 0x41]
test eax, eax
je 0x10025bce
push 0
push 0
push 0x436
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x10025b96
lea ecx, [ebp - 0x37c]
call fcn.10017189
mov dword [ebp - 0x334], 1
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x10025c07
push 0x22b3
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 0x43], 0
movzx eax, byte [ebp - 0x43]
test eax, eax
je 0x10025c1b
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x26c]
movzx eax, byte [eax]
test eax, eax
je 0x10025c4a
push 0x22b3
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x10026f0d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x294], eax
mov dword [ebp - 0x94], 9
mov dword [ebp - 0x368], 7
mov dword [ebp - 0x370], 4
mov dword [ebp - 0x33c], 0xffffffff
mov dword [ebp - 0x304], 0
mov dword [ebp - 0x30c], 0xc660f7e7
mov dword [ebp - 0x314], 0x711e7bff
mov dword [ebp - 0x31c], 0xfffffffb
mov dword [ebp - 0x324], 0x9a278c00
mov dword [ebp - 0x28], 0
jmp 0x10025cc2
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10025cd8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x3c0], 0x89f42c60
jmp 0x10025cbb
mov dword [ebp - 0x28], 0
jmp 0x10025ce8
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10025cfe
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x3cc], 0x5f4e
jmp 0x10025ce1
mov dword [ebp - 0x94], 0
jmp 0x10025d17
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xf
jg 0x10025dff
mov dword [ebp - 0x32c], 0x7a3a
mov dword [ebp - 0x2c4], 0xa912
mov dword [ebp - 0x2c0], 0xa912
mov dword [ebp - 0x2bc], 0xa912
mov dword [ebp - 0x2b8], 0xa912
lea ecx, [ebp - 0xd1]
call fcn.10009433
push eax
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2c4]
push eax
lea ecx, [ebp - 0x3b0]
call fcn.100171b4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x348]
call fcn.10017163
mov dword [ebp - 4], 3
mov dword [ebp - 0x84], 0
jmp 0x10025dab
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x10025dc7
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x3b8], 0x1ad67a4b
jmp 0x10025d9e
push 0
lea ecx, [ebp - 0x348]
call fcn.100171a5
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1a8]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x348]
call fcn.10017189
jmp 0x10025d0a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x280], eax
push 3
lea ecx, [ebp - 0xe8]
call fcn.10017107
mov dword [ebp - 4], 4
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x290], 0
mov dword [ebp - 0xa4], 0
jmp 0x10025e46
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x10025e68
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xe8]
call fcn.100171a5
mov dword [eax], 0x2fd41e55
jmp 0x10025e39
mov dword [ebp - 0x18], 0
jmp 0x10025e78
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x10026015
mov dword [ebp - 0x4c], 0x5c62e089
mov dword [ebp - 0x208], 0xffffffff
mov dword [ebp - 0x4c], 0
jmp 0x10025ea3
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jg 0x10025ede
mov dword [ebp - 0x50], 0x5ed9a924
mov dword [ebp - 0x50], 0
jmp 0x10025ec0
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x10025edc
push dword [ebp - 0x50]
lea ecx, [ebp - 0xe8]
call fcn.100171a5
mov dword [eax], 0x11151c
jmp 0x10025eb9
jmp 0x10025e9c
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe8]
call fcn.100171a5
cmp dword [eax], 0
jne 0x10025efd
mov dword [ebp - 0x138], 1
jmp 0x10025f04
and dword [ebp - 0x138], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe8]
call fcn.100171a5
mov eax, dword [eax]
cmp eax, dword [ebp - 0x138]
je 0x10025f28
mov dword [ebp - 0x140], 1
jmp 0x10025f2f
and dword [ebp - 0x140], 0
mov dword [ebp - 0x208], 1
mov eax, dword [ebp - 0x208]
sub eax, 0x856d
jne 0x10025f52
xor eax, eax
inc eax
jne 0x10025f52
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x10025f67
mov eax, 0xfffa
test eax, eax
je 0x10025f67
mov dword [ebp - 0x1b0], 1
jmp 0x10025f6e
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x140]
cmp eax, dword [ebp - 0x1b0]
jle 0x10025f88
mov dword [ebp - 0x148], 1
jmp 0x10025f8f
and dword [ebp - 0x148], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe8]
call fcn.100171a5
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x148]
jle 0x10025fbb
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe8]
call fcn.100171a5
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe8]
call fcn.100171a5
mov esi, eax
push 2
lea ecx, [ebp - 0xe8]
call fcn.100171a5
mov edi, eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe8]
call fcn.100171a5
mov ecx, dword [edi]
imul ecx, dword [eax]
cmp dword [esi], ecx
jl 0x10025ffd
mov dword [ebp - 0x1e8], 1
jmp 0x10026004
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x290], eax
jmp 0x10025e71
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.10017189
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 0xfcf33f23
mov dword [ebp - 0x9c], 0xb9e9d60a
mov dword [ebp - 0x234], 0xffffffff
push 1
lea ecx, [ebp - 0x2e4]
call fcn.10017107
mov dword [ebp - 4], 5
mov dword [ebp - 0x8c], 0
jmp 0x1002607c
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1002609e
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x2e4]
call fcn.100171a5
mov dword [eax], 0xfffffff8
jmp 0x1002606f
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x2c], 0
je 0x100260c2
mov eax, 0x5d9b
test eax, eax
je 0x100260c2
mov dword [ebp - 0x150], 1
jmp 0x100260c9
and dword [ebp - 0x150], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xe973
je 0x100260f4
mov dword [ebp - 0x248], 1
jmp 0x100260fb
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x150], eax
jl 0x10026115
mov dword [ebp - 0x1b8], 1
jmp 0x1002611c
and dword [ebp - 0x1b8], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x1b8]
cmp eax, dword [ebp - 0x2c]
jle 0x10026136
mov dword [ebp - 0x158], 1
jmp 0x1002613d
and dword [ebp - 0x158], 0
cmp dword [ebp - 0x158], 0x5f88
jl 0x10026155
mov dword [ebp - 0x218], 1
jmp 0x1002615c
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x218], eax
jle 0x10026173
mov dword [ebp - 0x160], 1
jmp 0x1002617a
and dword [ebp - 0x160], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x160]
jne 0x1002618c
cmp dword [ebp - 0x9c], 0
cmp dword [ebp - 0x34], 0
jne 0x100261a4
mov eax, 0x6038
test eax, eax
jne 0x100261a4
and dword [ebp - 0x1c0], 0
jmp 0x100261ae
mov dword [ebp - 0x1c0], 1
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x34], 0
jmp 0x100261ca
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x100261e6
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2e4]
call fcn.100171a5
mov dword [eax], 0xfffffff8
jmp 0x100261c3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2e4]
call fcn.10017189
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0x338], 0xa927213e
mov dword [ebp - 0x364], 0x7d50f82b
mov dword [ebp - 0x300], 0x9edca8fe
mov dword [ebp - 0x308], 1
mov dword [ebp - 0x23c], 0xffffffff
mov dword [ebp - 0x78], 0x515466bc
mov dword [ebp - 0x24c], 0xb6f9b691
mov dword [ebp - 0xc0], 8
push 1
lea ecx, [ebp - 0x2a0]
call fcn.10017107
mov dword [ebp - 4], 6
mov dword [ebp - 0x54], 0x4668
mov dword [ebp - 0x244], 0x67d
mov dword [ebp - 0x1c], 0
jmp 0x10026287
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1002629d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x254], 3
jmp 0x10026280
mov dword [ebp - 0x1c], 0
jmp 0x100262ad
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x100262c9
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2a0]
call fcn.100171a5
mov dword [eax], 0xf7c2f5a2
jmp 0x100262a6
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0x288], 0xfffffffb
jl 0x100262f7
mov dword [ebp - 0x1f0], 1
jmp 0x100262fe
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x54]
dec ecx
mov dword [ebp - 0x54], ecx
test eax, eax
je 0x1002640e
push 0
lea ecx, [ebp - 0x2a0]
call fcn.100171a5
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x36c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x254], 0
jg 0x10026345
mov dword [ebp - 0xd0], 1
jmp 0x1002634c
and dword [ebp - 0xd0], 0
push 0
lea ecx, [ebp - 0x2a0]
call fcn.100171a5
mov ecx, dword [ebp - 0xd0]
mov dword [eax], ecx
cmp dword [ebp - 0xd0], 0
jne 0x10026378
xor eax, eax
inc eax
jne 0x10026378
and dword [ebp - 0x2a4], 0
jmp 0x10026382
mov dword [ebp - 0x2a4], 1
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x318], eax
push 0
lea ecx, [ebp - 0x2a0]
call fcn.100171a5
cmp dword [eax], 0
jne 0x100263c1
cmp dword [ebp - 0x54], 0
jne 0x100263c1
and dword [ebp - 0x168], 0
jmp 0x100263cb
mov dword [ebp - 0x168], 1
mov eax, dword [ebp - 0x168]
sub eax, dword [ebp - 0x80]
je 0x100263e8
cmp dword [ebp - 0x78], 0
je 0x100263e8
mov dword [ebp - 0x284], 1
jmp 0x100263ef
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x360], eax
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x1002640e
mov dword [ebp - 0x170], 1
jmp 0x10026415
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x1f0]
add eax, dword [ebp - 0x170]
cmp eax, dword [ebp - 0x78]
jne 0x10026432
mov dword [ebp - 0x1c8], 1
jmp 0x10026439
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x1c8], eax
je 0x10026450
mov dword [ebp - 0x178], 1
jmp 0x10026457
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x80]
imul eax, dword [ebp - 0x178]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x254]
jl 0x1002647c
mov dword [ebp - 0x210], 1
jmp 0x10026483
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x210]
shl eax, 2
cmp eax, 0xffffffff
je 0x100264a2
or eax, 0xffffffff
je 0x100264a2
mov dword [ebp - 0x180], 1
jmp 0x100264a9
and dword [ebp - 0x180], 0
mov eax, dword [ebp - 0x80]
add eax, dword [ebp - 0x180]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x254]
jne 0x100264cd
mov dword [ebp - 0x1d0], 1
jmp 0x100264d4
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x80], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a0]
call fcn.10017189
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x3c], 0xc74a
mov dword [ebp - 0x30], 0xffffffff
push 2
lea ecx, [ebp - 0x68]
call fcn.10017107
mov dword [ebp - 4], 7
mov dword [ebp - 0x10], 0xd9cd4431
mov dword [ebp - 0x154], 0x762969fb
mov dword [ebp - 0xb8], 0x8a1b
mov dword [ebp - 0x1ac], 0xfffffffa
mov dword [ebp - 0x268], 1
mov dword [ebp - 0x88], 0
jmp 0x1002655f
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x1002657e
push dword [ebp - 0x88]
lea ecx, [ebp - 0x68]
call fcn.100171a5
mov dword [eax], 0xfa51669
jmp 0x10026552
mov byte [ebp - 0x46], 0
movzx eax, byte [ebp - 0x46]
test eax, eax
je 0x1002659d
push 0
push 0
push 0x1b4c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, 0xffffc794
test eax, eax
je 0x1002662e
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xf47a6dee
jae 0x100265c5
mov dword [ebp - 0xc8], 1
jmp 0x100265cc
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0x3c]
add eax, 3
cmp eax, dword [ebp - 0x3c]
jge 0x100265e3
mov dword [ebp - 0x188], 1
jmp 0x100265ea
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x3c]
test eax, eax
jne 0x10026605
cmp dword [ebp - 0x10], 0
push 1
lea ecx, [ebp - 0x68]
call fcn.100171a5
mov ecx, dword [ebp - 0xc8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
sub eax, dword [ebp - 0x3c]
je 0x1002662e
mov dword [ebp - 0xf8], 1
jmp 0x10026635
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0xf8]
add eax, 0x5fe8887
jne 0x10026655
push 1
lea ecx, [ebp - 0x68]
call fcn.100171a5
cmp dword [eax], 0
je 0x1002681c
mov dword [ebp - 0x5c], 5
mov dword [ebp - 0x28c], 0xffffffff
mov dword [ebp - 0x13c], 0
push 2
lea ecx, [ebp - 0x2f0]
call fcn.10017107
mov byte [ebp - 4], 8
mov dword [ebp - 0x90], 0
jmp 0x1002669a
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x100266bc
push dword [ebp - 0x90]
lea ecx, [ebp - 0x2f0]
call fcn.100171a5
mov dword [eax], 0x767dbf12
jmp 0x1002668d
mov eax, dword [ebp - 0x5c]
neg eax
jne 0x100267f6
cmp dword [ebp - 0x5c], 0
je 0x10026760
cmp dword [ebp - 0x5c], 0xffffffff
jne 0x100266e3
mov dword [ebp - 0xfc], 1
jmp 0x100266ea
and dword [ebp - 0xfc], 0
imul eax, dword [ebp - 0xfc], 9
cmp eax, dword [ebp - 0x30]
jne 0x10026702
mov dword [ebp - 0x104], 1
jmp 0x10026709
and dword [ebp - 0x104], 0
cmp dword [ebp - 0x104], 0xe2499e68
je 0x10026721
mov dword [ebp - 0x10c], 1
jmp 0x10026728
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x10c], eax
je 0x1002673f
mov dword [ebp - 0x114], 1
jmp 0x10026746
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x114]
test eax, eax
je 0x10026760
mov dword [ebp - 0x258], 1
jmp 0x10026767
and dword [ebp - 0x258], 0
cmp dword [ebp - 0x30], 0xffff
jb 0x1002677c
mov dword [ebp - 0x11c], 1
jmp 0x10026783
and dword [ebp - 0x11c], 0
cmp dword [ebp - 0x11c], 0x89d68482
jae 0x1002679b
mov dword [ebp - 0xec], 1
jmp 0x100267a2
and dword [ebp - 0xec], 0
mov eax, dword [ebp - 0x28c]
cmp dword [ebp - 0xec], eax
jl 0x100267bc
mov dword [ebp - 0x12c], 1
jmp 0x100267c3
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x12c], eax
jne 0x100267da
mov dword [ebp - 0x134], 1
jmp 0x100267e1
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x13c], eax
mov esi, dword [ebp - 0x30]
push 1
lea ecx, [ebp - 0x2f0]
call fcn.100171a5
mov dword [eax], esi
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2f0]
call fcn.10017189
jmp 0x10026bc1
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x98], 0x1b5b3a04
mov dword [ebp - 0x19c], 0x25a44896
mov dword [ebp - 0x24], 0
jmp 0x10026847
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002685d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x3a0], 1
jmp 0x10026840
mov dword [ebp - 0x24], 0
jmp 0x1002686d
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10026883
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x394], 0xec372b4d
jmp 0x10026866
mov dword [ebp - 0x10], 0
jmp 0x10026893
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jg 0x10026bc1
mov dword [ebp - 0x1a4], 0x373e763f
mov esi, dword [ebp - 0x40]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x68]
call fcn.100171a5
cmp esi, dword [eax]
jg 0x100268c5
mov dword [ebp - 0x144], 1
jmp 0x100268cc
and dword [ebp - 0x144], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x68]
call fcn.100171a5
mov eax, dword [eax]
cmp eax, dword [ebp - 0x144]
jne 0x100268ed
mov dword [ebp - 0x14c], 1
jmp 0x100268f4
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x14c], eax
jle 0x10026a69
push dword [ebp - 0x10]
lea ecx, [ebp - 0x68]
call fcn.100171a5
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0x5834d56b
jne 0x10026936
mov dword [ebp - 0x15c], 1
jmp 0x1002693d
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x15c], eax
jg 0x10026957
mov dword [ebp - 0x164], 1
jmp 0x1002695e
and dword [ebp - 0x164], 0
cmp dword [ebp - 0x164], 6
jne 0x10026973
mov dword [ebp - 0x16c], 1
jmp 0x1002697a
and dword [ebp - 0x16c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x16c], eax
jg 0x10026991
mov dword [ebp - 0x174], 1
jmp 0x10026998
and dword [ebp - 0x174], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x68]
call fcn.100171a5
mov ecx, dword [ebp - 0x174]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x40]
jge 0x100269c2
mov eax, 0x3e26
test eax, eax
jne 0x100269c2
and dword [ebp - 0x17c], 0
jmp 0x100269cc
mov dword [ebp - 0x17c], 1
cmp dword [ebp - 0x17c], 0xb3df
jge 0x100269e4
mov dword [ebp - 0x184], 1
jmp 0x100269eb
and dword [ebp - 0x184], 0
imul eax, dword [ebp - 0x184], 6
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x10026a1d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x68]
call fcn.100171a5
cmp dword [eax], 0
je 0x10026a1d
mov dword [ebp - 0x260], 1
jmp 0x10026a24
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x1ac], 0
je 0x10026a49
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x10026a49
mov dword [ebp - 0x18c], 1
jmp 0x10026a50
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x18c]
neg eax
cmp eax, 0xffffffff
jg 0x10026a69
mov dword [ebp - 0x270], 1
jmp 0x10026a70
and dword [ebp - 0x270], 0
push 1
lea ecx, [ebp - 0x68]
call fcn.100171a5
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x35c], eax
push 1
lea ecx, [ebp - 0x68]
call fcn.100171a5
mov esi, eax
push 0
lea ecx, [ebp - 0x68]
call fcn.100171a5
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x98], eax
je 0x10026ac9
mov dword [ebp - 0x194], 1
jmp 0x10026ad0
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
jne 0x10026b0c
mov eax, 0x13c5
test eax, eax
jne 0x10026b0c
cmp dword [ebp - 0x1ac], 0
jne 0x10026b0c
and dword [ebp - 0x1b4], 0
jmp 0x10026b16
mov dword [ebp - 0x1b4], 1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x68]
call fcn.100171a5
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1b4]
jl 0x10026b37
mov dword [ebp - 0x1bc], 1
jmp 0x10026b3e
and dword [ebp - 0x1bc], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x68]
call fcn.100171a5
mov esi, eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x68]
call fcn.100171a5
mov eax, dword [eax]
imul eax, dword [ebp - 0x1bc]
sub eax, dword [ebp - 0x40]
cmp dword [esi], eax
jge 0x10026b72
mov dword [ebp - 0x1c4], 1
jmp 0x10026b79
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1c4], eax
jge 0x10026b90
mov dword [ebp - 0xbc], 1
jmp 0x10026b97
and dword [ebp - 0xbc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xbc]
mov dword [ebp + eax - 0x3a0], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbc]
mov dword [ebp + eax - 0x394], ecx
jmp 0x1002688c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10017189
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0xc4], eax
push 2
lea ecx, [ebp - 0x358]
call fcn.10017107
mov dword [ebp - 4], 9
push 1
lea ecx, [ebp - 0x27c]
call fcn.10017107
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x14], 0
jmp 0x10026c23
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10026c3f
push dword [ebp - 0x14]
lea ecx, [ebp - 0x358]
call fcn.100171a5
mov dword [eax], 1
jmp 0x10026c1c
mov dword [ebp - 0x14], 0
jmp 0x10026c4f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10026c6b
push dword [ebp - 0x14]
lea ecx, [ebp - 0x27c]
call fcn.100171a5
mov dword [eax], 0xfb871c7b
jmp 0x10026c48
mov dword [ebp - 0x14], 0
jmp 0x10026c7b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10026c91
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x388], 0xffffffff
jmp 0x10026c74
push 0
lea ecx, [ebp - 0x27c]
call fcn.100171a5
mov dword [eax], 1
jmp 0x10026cca
push 0
lea ecx, [ebp - 0x27c]
call fcn.100171a5
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1cc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x27c]
call fcn.100171a5
cmp dword [eax], 0
jl 0x10026dc6
mov dword [ebp - 0xa8], 0x2086bd08
mov dword [ebp - 0x70], 0
jmp 0x10026cfa
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x10026d10
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x2b0], 0xfffffffb
jmp 0x10026cf3
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2b0], 0
jmp 0x10026d3b
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2b0]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2b0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2b0], 1
jg 0x10026d75
mov byte [ebp - 0x45], 0
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x10026d73
push 0
push 0
push 0
push 0
push 0x1c0c
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x10026d22
mov dword [ebp - 0xa8], 1
jmp 0x10026d8e
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x10026dc1
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2b0], 0xfffffff9
mov byte [ebp - 0x44], 0
movzx eax, byte [ebp - 0x44]
test eax, eax
je 0x10026dbf
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
jmp 0x10026d81
jmp 0x10026ca6
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x388], 0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x27c]
call fcn.10017189
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x358]
call fcn.10017189
mov eax, dword [ebp - 0x7c]
cmp dword [eax], 0
jge 0x10026e09
mov dword [ebp - 0x1d4], 1
jmp 0x10026e10
and dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
sub eax, dword [ebp - 0x1d4]
cmp eax, 0xc64e
jge 0x10026e31
mov dword [ebp - 0x1dc], 1
jmp 0x10026e38
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
cmp dword [ebp - 0x1dc], eax
je 0x10026e51
mov dword [ebp - 0x1e4], 1
jmp 0x10026e58
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x1e4]
sub ecx, dword [eax]
cmp ecx, 0x7dd7d552
jl 0x10026e7a
mov dword [ebp - 0x238], 1
jmp 0x10026e81
and dword [ebp - 0x238], 0
xor eax, eax
add eax, 0x45329433
je 0x10026e92
mov eax, dword [ebp - 0x7c]
cmp dword [eax], 0
jne 0x10026ea6
mov eax, dword [ebp - 0xc4]
cmp dword [eax], 0
jne 0x10026ea6
and dword [ebp - 0x1f4], 0
jmp 0x10026eb0
mov dword [ebp - 0x1f4], 1
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x1ec], eax
push 1
mov ecx, dword [ebp - 0x240]
call fcn.100171a5
mov ecx, dword [ebp - 0x1ec]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1ec]
cmp eax, dword [ebp - 0x1f4]
je 0x10026eed
mov dword [ebp - 0xcc], 1
jmp 0x10026ef4
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0xcc]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret