Function at 0x10007949
Capabilities:
Clear file content
Delete registry value

Disassembly:
mov eax, 0x1004b693
call fcn.1004ae30
sub esp, 0x108
push ebx
push esi
xor ebx, ebx
mov byte [ebp - 0x40], dl
mov dword [ebp - 0x28], 0x7c34
xor esi, esi
push edi
inc ebx
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x28], 0x7f64
mov dword [ebp - 0x20], ecx
jle 0x100079cc
mov edi, esi
mov ecx, esi
mov dword [ebp - 0x18], esi
mov eax, edi
cdq
idiv ecx
lea ecx, [ebp - 0xcc]
mov eax, edx
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100079a0
mov eax, dword [eax]
push eax
call fcn.10036008
pop ecx
push esi
push ebx
lea ecx, [ebp - 0xcc]
call fcn.100040fa
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x61c6
jl 0x10007981
inc edi
cmp edi, 0x47de
jl 0x1000797c
cmp byte [ebp - 0x40], 0
je 0x100079ff
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, dword [ebp + 0xc]
sar ecx, 2
cmp dword [ebp - 0x28], 0x7972
mov dword [eax], ecx
jge 0x10008309
push str.vumjfgtd_bldk_liwuvabnq_rxqpznk_kgqnz_zifhbh_izmcuis
call fcn.10036008
pop ecx
jmp 0x10008309
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], 6
push 2
mov dword [ebp - 0x18], 0x2b90f998
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], esi
pop edi
jmp 0x10007a2c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x58], 0xd0188753
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10007a1e
mov eax, dword [ebp - 0x14]
add eax, 0x530d
imul eax, eax, 0x6baf
test eax, eax
je 0x10007a56
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setl dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
xor eax, eax
imul edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x14]
cmp edx, 0x20274952
setle al
xor edx, edx
test eax, eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x14]
sete dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], ebx
jg 0x10007b8c
mov dword [ebp - 0x24], 0x7ba4
cmp dword [ebp - 0x24], 0x7bc1
jle 0x10007aff
mov eax, esi
mov dword [ebp - 0x28], esi
mov edi, eax
mov dword [ebp - 0x18], 0x10a1
mov eax, edi
lea ecx, [ebp - 0xfc]
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10007ad0
mov eax, dword [eax]
push eax
call fcn.10036008
pop ecx
push esi
push ebx
lea ecx, [ebp - 0xfc]
call fcn.100040fa
dec edi
dec dword [ebp - 0x18]
jne 0x10007ab6
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x2374
jl 0x10007aad
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [ebp - 0x24], 0x7966
jge 0x10007b13
push str.wxhsdp_elkjz_urbrpxp_vexjrtr_cxezp_uzgqpu_rusxnktiy_cmecavd_caz_drun_kxkv_uvrums_kypgfdkm
call fcn.10036008
pop ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x58]
mov ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xffffffff
setge al
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x14]
sbb ecx, ecx
neg ecx
sub ecx, 0x3e73
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp + eax*4 - 0x58]
cmp ecx, 6
jbe 0x10007b54
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp eax, 0xaec
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
cmp ecx, 8
mov eax, dword [ebp + eax*4 - 0x58]
setl dl
sub eax, edx
jne 0x10007b7b
mov ecx, esi
cmp dword [ebp - 0x58], esi
je 0x10007b7d
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x58], ecx
inc dword [ebp - 0x14]
jmp 0x10007a8f
push dword [ebp + 0x20]
lea ecx, [ebp - 0xa8]
call fcn.10003b2c
push 2
pop edi
push ecx
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], edi
call fcn.1000a8ad
mov dword [ebp - 0x50], eax
cmp eax, 0xffffffff
je 0x10007caa
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x18], 0xbd13d8c5
mov dword [ebp - 0x24], 0xed99ea7
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x1c], esi
jmp 0x10007bea
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x60], 0xf9b3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10007bdc
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], esi
jl 0x10007c85
mov dword [ebp - 0x18], 0xfffffff9
cmp dword [ebp - 0x60], esi
je 0x10007c12
mov eax, dword [ebp - 0x14]
mov ecx, ebx
cmp dword [ebp + eax*4 - 0x60], esi
jne 0x10007c14
mov ecx, esi
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x60]
sete dl
imul ecx, edx, 0xdcef
xor edx, edx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0x69393dda
setle al
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jne 0x10007c5e
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + eax*4 - 0x60]
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setne cl
mov dword [ebp - 0x18], ecx
dec dword [ebp - 0x14]
jns 0x10007bfb
push esi
push esi
push 0x20cc
push 0x1efe
lea eax, [ebp - 0xa8]
mov dl, bl
push 0x6f76
push eax
lea ecx, [ebp - 0x50]
call fcn.10007762
add esp, 0x18
mov dword [ebp - 0x4c], 0x7a4a12b5
mov dword [ebp - 0x1c], esi
jmp 0x10007cc7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb4], 0x9ac7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10007cb6
mov dword [ebp - 0x4c], ebx
cmp dword [ebp - 0x4c], esi
jl 0x10007cfb
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], esi
jmp 0x10007cf1
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xb4], 0xb7ce
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10007ce0
dec dword [ebp - 0x4c]
jns 0x10007cd4
push ebx
push 0x5031
push 0x4a9a
push esi
push esi
lea eax, [ebp - 0x4c]
mov edx, 0x681e
push 0x238a
push eax
mov ecx, 0x3e21
call fcn.10006e3e
add esp, 0x14
lea eax, [ebp - 0xa8]
push eax
push dword [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x50]
call fcn.10008351
add esp, 0x14
cmp dword [ebp - 0x50], 0xffffffff
je 0x10007e97
mov dword [ebp - 0x18], 0xf606
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], 0xbacd7953
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x18], 0x5cbd9454
mov dword [ebp - 0x70], 0x6887e08a
mov dword [ebp - 0x1c], esi
jmp 0x10007d7f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xac], 0x61ab6ec7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10007d6e
mov dword [ebp - 0x3c], 0x5635
cmp dword [ebp - 0x3c], 0x584b
jle 0x10007e3c
push 0xb25
push ebx
push 0x1bdb
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x20], esi
mov edi, esi
mov dword [ebp - 0x34], esi
mov ecx, esi
mov dword [ebp - 0x28], esi
mov eax, edi
mov dword [ebp - 0x24], esi
cdq
idiv ecx
mov edi, dword [ebp - 0x20]
mov eax, esi
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0x3bd3
xor eax, edi
lea ecx, [ebp - 0xe4]
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10007de7
mov eax, dword [eax]
push eax
call fcn.10036008
pop ecx
push esi
push ebx
lea ecx, [ebp - 0xe4]
call fcn.100040fa
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x1c]
dec dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
jne 0x10007dcd
mov ecx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x34]
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0x3f8b
jl 0x10007db6
inc edi
mov dword [ebp - 0x34], edi
cmp edi, 0x3b8b
jl 0x10007db1
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x31c7
jl 0x10007dac
push 2
pop edi
push 0x1a89
push 0x517c
push 0x6ecb
push ecx
lea eax, [ebp - 0x70]
xor dl, dl
push eax
push ecx
mov ecx, 0x699a
call fcn.10006c68
add esp, 0x18
cmp dword [ebp - 0x3c], 0x5378
jge 0x10007e74
push str.djrwmia_budxl_dzcn_evpojq
call fcn.10036008
pop ecx
push esi
lea eax, [ebp - 0x50]
mov dword [ebp - 4], edi
push eax
push esi
push 0x7536
push 0x3553
lea edx, [ebp - 0xa8]
mov cl, bl
call fcn.10008b57
add esp, 0x14
mov dword [ebp - 0x3c], 0xc90a35f3
mov dword [ebp - 0x24], 0x478144ad
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x48], 0x5ef11ea
mov dword [ebp - 0x18], 0x27f9
cmp dword [ebp - 0x18], 0x2b54
jle 0x10007eee
mov edi, esi
mov ebx, esi
lea eax, [ebx + edi]
mov ecx, 0x10062a18
cdq
push edx
push eax
call fcn.10003a17
inc ebx
cmp ebx, 0x415a
jl 0x10007ec6
inc edi
cmp edi, 0x158
jl 0x10007ec4
xor ebx, ebx
push 2
inc ebx
pop edi
mov dword [ebp - 0x28], 0xd1337a3f
mov byte [ebp - 4], 5
cmp dword [ebp - 0x18], 0x2746
jge 0x10007f3b
mov edx, str.qatpirzrl_txwed_uvk_abjykp
mov ecx, 0x10062a18
call fcn.10006198
jmp 0x10007f3b
mov dword [ebp - 4], edi
push 3
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x14], esi
pop ecx
jmp 0x10007f57
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6c], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10007f49
mov dword [ebp - 0x14], esi
jmp 0x10007f72
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x90], 0xdcdf
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10007f61
cmp dword [ebp - 0x6c], esi
jne 0x10007f7f
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
neg eax
inc eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jne 0x10007f9b
mov ecx, esi
cmp dword [ebp - 0x3c], esi
je 0x10007f9d
mov ecx, ebx
mov eax, dword [ebp - 0x8c]
inc dword [ebp - 0x8c]
cmp eax, ecx
mov dword [ebp - 0x24], ebx
mov eax, ebx
mov ecx, dword [ebp - 0x24]
cmove eax, esi
imul ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
mov eax, 0x89c089ce
setg dl
cmp eax, edx
sbb eax, eax
neg eax
mov dword [ebp - 0x30], eax
je 0x10008274
mov dword [ebp - 0x14], esi
jmp 0x10007fea
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x78], 0xfaba
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10007fdc
mov dword [ebp - 0x14], esi
jmp 0x10008002
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x38], 0xc4ad1532
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10007ff4
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x30], 0xffffffed
jle 0x100082e4
mov dword [ebp - 0x1c], 0x5f32
mov dword [ebp - 0x28], 0x335b
cmp dword [ebp - 0x28], 0x3436
jle 0x10008098
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, esi
mov dword [ebp - 0x20], esi
mov edi, esi
mov eax, esi
mov dword [ebp - 0x18], esi
add eax, edi
or eax, ecx
lea ecx, [ebp - 0x114]
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000805b
mov eax, dword [eax]
push eax
call fcn.10036008
pop ecx
push esi
push ebx
lea ecx, [ebp - 0x114]
call fcn.100040fa
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x2a8c
jl 0x1000803f
inc edi
cmp edi, 0x6fae
jl 0x1000803a
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x3623
jl 0x10008038
push 2
pop edi
mov dword [ebp - 0x34], 0xf69bad97
cmp dword [ebp - 0x28], 0x3104
jge 0x100080b3
push str.zaue_tilwblmkj_pyo_dmkoxzi_alxdkct_lkxmnjis
call fcn.10036008
pop ecx
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x28], 4
cmp dword [ebp - 0x1c], esi
jne 0x100082e4
mov eax, dword [ebp - 0x74]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
cmp eax, dword [ebp - 0x68]
jle 0x10008139
mov eax, dword [ebp - 0x3c]
sub eax, 0xb5c1
cmp eax, dword [ebp - 0x1c]
jne 0x100080ef
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x74]
xor edx, edx
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x38]
inc ecx
cmp ecx, eax
sete dl
mov dword [ebp - 0x34], edx
xor edx, edx
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
lea eax, [ecx - 0x3fb446e2]
mov dword [ebp - 0x38], eax
test eax, eax
jne 0x10008139
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x20], 0xc2fcb8f7
mov dword [ebp - 0x14], esi
jmp 0x10008262
mov dword [ebp - 0x68], ebx
cmp dword [ebp - 0x38], esi
je 0x1000812a
mov dword [ebp - 0x44], 0x64ea5f72
cmp dword [ebp - 0x34], esi
jne 0x100081bb
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setle dl
cmp edx, 7
jl 0x10008166
mov ecx, esi
cmp dword [ebp - 0x44], esi
je 0x10008168
mov ecx, ebx
mov eax, dword [ebp - 0x38]
sub eax, ecx
je 0x10008176
mov ecx, ebx
cmp dword [ebp - 0x1c], esi
jne 0x10008178
mov ecx, esi
mov eax, dword [ebp - 0x48]
imul eax, ecx
mov ecx, 0xcb58b1ca
imul eax, eax, 0xfb88
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
imul eax, ecx, 0xcc8f
test eax, eax
je 0x100081aa
mov eax, ebx
cmp dword [ebp - 0x48], esi
jne 0x100081ac
mov eax, esi
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp eax, 0xd1a6
setle cl
mov dword [ebp - 0x2c], ecx
jmp 0x1000826c
mov dword [ebp - 0x18], 0x565c6936
mov dword [ebp - 0x44], 0x8a7deb65
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x20], esi
jne 0x10008228
cmp dword [ebp - 0x14], esi
jne 0x100081f7
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, 0xab384274
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x30]
mov ecx, esi
jne 0x1000822a
mov ecx, ebx
mov eax, dword [ebp - 0x34]
xor edx, edx
cmp ecx, eax
setg dl
xor ecx, ecx
add edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x2c]
jne 0x10008249
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setl dl
mov dword [ebp - 0x44], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x14
jl 0x100081d9
dec dword [ebp - 0x30]
jmp 0x1000800a
mov dword [ebp - 0x20], esi
jmp 0x1000828a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x84], 7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10008279
push ebx
push esi
push 0x77f4
push 0x24b4
push 0x6bff
push 0x7952
mov dl, bl
mov ecx, 0x3c9e
call fcn.10007762
mov ecx, dword [ebp - 0x84]
add esp, 0x18
mov eax, dword [ebp - 0x7c]
neg ecx
mov eax, dword [ebp - 0x80]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0xa8]
cmp eax, ecx
je 0x100082fc
push 0xffffffffffffffff
push esi
push ecx
mov ecx, eax
call fcn.100041cd
push esi
push ebx
lea ecx, [ebp - 0xa8]
call fcn.100042fb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret