Function at 0x1000a5c9
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Connect pipe
Create a process with modified i/o handles and window
Create directory
Create pipe
Create process on windows
Encode data using base64
Execute shell command and capture output
Get common file path
Parse credit card information
Persist via run registry key
Query environment variable
Read file on windows
Resume thread
Self delete
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
lea ebp, [esp - 0x5c]
sub esp, 0x5fc
mov eax, dword [ebp + 0x6c]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
push 0x20
mov dword [ebp + 0x4c], ecx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0x128], ebx
mov byte [ebp + 0x12], bl
mov byte [ebp - 0x25], bl
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x134], ebx
pop edi
je 0x1000a861
lea eax, [ebp + 0x6c]
push eax
call fcn.1003f9c4
pop ecx
mov ecx, dword [ebp + 0x6c]
cmp ecx, ebx
je 0x1000a861
cmp word [ecx], 0x2f
jne 0x1000a861
mov dx, word [ecx + 2]
or dx, di
cmp dx, 0x69
push 0x73
pop esi
jne 0x1000a708
mov ax, word [ecx + 4]
or ax, di
cmp ax, 0x6e
jne 0x1000a708
mov ax, word [ecx + 6]
or ax, di
cmp ax, si
jne 0x1000a708
mov ax, word [ecx + 8]
or ax, di
cmp ax, 0x74
jne 0x1000a708
mov ax, word [ecx + 0xa]
or ax, di
cmp ax, 0x61
jne 0x1000a708
mov ax, word [ecx + 0xc]
or ax, di
cmp ax, 0x6c
jne 0x1000a708
mov ax, word [ecx + 0xe]
or ax, di
cmp ax, 0x6c
jne 0x1000a708
mov ax, word [ecx + 0x10]
or ax, di
cmp ax, si
jne 0x1000a708
mov ax, word [ecx + 0x12]
or ax, di
cmp ax, 0x65
jne 0x1000a708
mov ax, word [ecx + 0x14]
or ax, di
cmp ax, 0x72
jne 0x1000a708
mov ax, word [ecx + 0x16]
or ax, di
cmp ax, 0x76
jne 0x1000a708
mov ax, word [ecx + 0x18]
or ax, di
cmp ax, dx
jne 0x1000a708
mov ax, word [ecx + 0x1a]
or ax, di
cmp ax, 0x63
jne 0x1000a708
mov ax, word [ecx + 0x1c]
or ax, di
cmp ax, 0x65
jne 0x1000a708
mov ax, word [ecx + 0x1e]
call fcn.10002df6
test al, al
jne 0x1000a835
cmp dx, si
jne 0x1000a76c
mov ax, word [ecx + 4]
or ax, di
cmp ax, 0x65
jne 0x1000a76c
mov ax, word [ecx + 6]
or ax, di
cmp ax, 0x72
jne 0x1000a76c
mov ax, word [ecx + 8]
or ax, di
cmp ax, 0x76
jne 0x1000a76c
mov ax, word [ecx + 0xa]
or ax, di
cmp ax, 0x69
jne 0x1000a76c
mov ax, word [ecx + 0xc]
or ax, di
cmp ax, 0x63
jne 0x1000a76c
mov ax, word [ecx + 0xe]
or ax, di
cmp ax, 0x65
jne 0x1000a76c
mov ax, word [ecx + 0x10]
call fcn.10002df6
test al, al
jne 0x1000a835
cmp dx, 0x72
jne 0x1000a861
mov dx, word [ecx + 4]
push 0x65
or dx, di
pop eax
cmp dx, ax
jne 0x1000a861
mov dx, word [ecx + 6]
or dx, di
cmp dx, 0x6d
jne 0x1000a861
mov dx, word [ecx + 8]
or dx, di
cmp dx, 0x6f
jne 0x1000a861
mov dx, word [ecx + 0xa]
or dx, di
cmp dx, 0x76
jne 0x1000a861
mov dx, word [ecx + 0xc]
or dx, di
cmp dx, ax
jne 0x1000a861
mov dx, word [ecx + 0xe]
or dx, di
cmp dx, si
jne 0x1000a861
mov dx, word [ecx + 0x10]
or dx, di
cmp dx, ax
jne 0x1000a861
mov dx, word [ecx + 0x12]
or dx, di
cmp dx, 0x72
jne 0x1000a861
mov dx, word [ecx + 0x14]
or dx, di
cmp dx, 0x76
jne 0x1000a861
mov dx, word [ecx + 0x16]
or dx, di
cmp dx, 0x69
jne 0x1000a861
mov dx, word [ecx + 0x18]
or dx, di
cmp dx, 0x63
jne 0x1000a861
mov dx, word [ecx + 0x1a]
or dx, di
cmp dx, ax
jne 0x1000a861
mov ax, word [ecx + 0x1c]
call fcn.10002df6
test al, al
je 0x1000a861
mov edi, 0x100e2c8c
push str.PECMD_EXEC
mov ecx, edi
call fcn.100502c8
push dword [ebp + 0x6c]
mov ecx, edi
call fcn.1004618f
mov eax, dword [ebp + 0x4c]
mov word [eax + 0x88], 2
jmp 0x1000f217
mov eax, dword [ebp + 0x70]
and eax, 1
mov dword [ebp + 0x20], eax
mov eax, dword [ebp + 0x70]
shr eax, 1
and eax, 1
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x70]
shr eax, 2
and al, 1
lea ecx, [ebp - 0x15c]
mov dword [ebp - 0x100], ebx
mov byte [ebp + 0x1b], bl
mov byte [ebp + 0x13], bl
mov byte [ebp + 0x73], al
mov byte [ebp + 0x30], bl
call fcn.10046123
cmp dword [ebp + 0x64], ebx
je 0x1000a8c0
push dword [ebp + 0x64]
lea ecx, [ebp - 0x15c]
call fcn.100502c8
mov eax, dword [ebp - 0x15c]
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x64]
push eax
call fcn.1003f9c4
pop ecx
lea ecx, [ebp - 0x154]
call fcn.10046123
mov eax, dword [ebp + 0x6c]
cmp eax, ebx
je 0x1000a8e7
push eax
lea ecx, [ebp - 0x154]
call fcn.100502c8
mov eax, dword [ebp - 0x154]
mov dword [ebp + 0x6c], eax
cmp dword [ebp + 0x74], ebx
jne 0x1000a8f5
lea ecx, [ebp - 0x144]
mov dword [ebp + 0x74], ecx
mov ecx, dword [ebp + 0x64]
cmp ecx, ebx
push 0x5e
pop esi
mov dword [ebp + 0x38], ecx
mov dword [ebp - 0x1c0], esi
jne 0x1000a938
cmp eax, ebx
mov dword [ebp + 0x64], eax
je 0x1000a938
push 5
push eax
push str._shel
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000a938
lea eax, [ebp - 0x1c0]
mov dword [ebp + 0x6c], eax
xor eax, eax
inc eax
mov dword [ebp + 0x20], eax
mov dword [ebp - 0x4c], eax
mov byte [ebp + 0x73], al
lea ecx, [ebp - 0x140]
mov dword [ebp + 0x34], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
mov byte [ebp + 0x32], bl
mov byte [ebp - 0x39], 1
mov byte [ebp - 0x51], bl
mov byte [ebp + 0x1f], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], bl
mov byte [ebp - 0x2e], bl
mov byte [ebp + 0x47], bl
mov byte [ebp - 0x71], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x61], bl
call fcn.10046123
mov al, byte [0x100e2be0]
neg al
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0x190], ebx
mov byte [ebp - 0x69], bl
mov byte [ebp + 0x33], bl
mov byte [ebp - 0x26], bl
sbb eax, eax
and eax, 0x10000
mov byte [ebp - 0x2d], bl
mov byte [ebp - 0x41], 1
mov byte [ebp - 0x59], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp + 0x24], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], ebx
call fcn.10046123
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x94], ebx
mov byte [ebp + 0x46], bl
call fcn.10046123
lea ecx, [ebp - 0xbc]
call fcn.10046123
lea ecx, [ebp - 0xb8]
call fcn.10046123
or dword [ebp - 0x9c], 0xffffffff
lea ecx, [ebp - 0x198]
mov byte [ebp - 9], bl
mov byte [ebp - 0x2f], bl
mov byte [ebp + 0x2f], bl
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x108], ebx
call fcn.10046123
xor eax, eax
push 0x10
pop ecx
mov dword [ebp - 0x270], 0x44
mov dword [ebp - 0x26c], ebx
lea edi, [ebp - 0x268]
rep stosd dword es:[edi], eax
push 0x12
mov dword [ebp - 0x18c], ebx
pop ecx
lea edi, [ebp - 0x228]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x188]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x17c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x6c]
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x1cc], ebx
mov dword [ebp - 0x1c8], ebx
mov dword [ebp - 0x1c4], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x78], ebx
cmp eax, ebx
jne 0x1000aa7a
mov byte [ebp + 0x2f], 1
jmp 0x1000aad4
cmp word [eax], 0x23
jne 0x1000aa90
cmp eax, dword [ebp + 0x64]
jne 0x1000aa89
add dword [ebp + 0x64], 2
inc eax
inc eax
mov dword [ebp + 0x6c], eax
jmp 0x1000aa9d
test byte [0x100e6003], 3
je 0x1000aa9d
mov byte [ebp + 0x2f], 3
cmp eax, ebx
je 0x1000aad4
cmp word [eax], si
jne 0x1000aab8
cmp eax, dword [ebp + 0x64]
jne 0x1000aaaf
add dword [ebp + 0x64], 2
inc eax
inc eax
mov dword [ebp + 0x6c], eax
mov byte [ebp + 0x73], 1
cmp eax, ebx
je 0x1000aad4
cmp word [eax], 0x24
jne 0x1000aad4
cmp eax, dword [ebp + 0x64]
jne 0x1000aacb
add dword [ebp + 0x64], 2
inc eax
inc eax
mov dword [ebp + 0x6c], eax
mov byte [ebp + 0x47], 1
cmp eax, ebx
mov dword [ebp + 0x40], ebx
je 0x1000aaf6
cmp word [eax], 0x7c
jne 0x1000aaf6
cmp eax, dword [ebp + 0x64]
jne 0x1000aaea
add dword [ebp + 0x64], 2
inc eax
inc eax
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x40], 1
mov eax, dword [ebp - 0x8c]
cmp eax, ebx
je 0x1000abe1
cmp word [eax], 0x2a
jne 0x1000abe1
add dword [ebp + 0x64], 2
mov eax, dword [ebp + 0x64]
mov ax, word [eax]
cmp ax, bx
mov dword [ebp + 0x34], 0x10
je 0x1000abd7
push 2
xor esi, esi
pop edi
inc esi
cmp ax, 0x7c
jne 0x1000ab3c
mov dword [ebp + 0x40], esi
jmp 0x1000abc5
cmp ax, 0x30
jb 0x1000ab99
cmp ax, 0x39
ja 0x1000ab99
or dword [ebp + 0x34], esi
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.10049485
cmp dword [ebp - 0x138], ebx
pop ecx
pop ecx
jg 0x1000ab7b
jl 0x1000ab6f
cmp dword [ebp - 0x13c], ebx
ja 0x1000ab7b
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x138], ebx
mov eax, dword [ebp + 0x64]
mov ax, word [eax]
cmp ax, 0x24
jne 0x1000ab8d
or byte [ebp + 0x35], 1
jmp 0x1000abc5
cmp ax, 0x5e
jne 0x1000abc8
or byte [ebp + 0x35], 2
jmp 0x1000abc5
mov ecx, eax
or ecx, 0x20
cmp cx, 0x6e
jne 0x1000abac
add dword [ebp + 0x64], edi
or dword [ebp + 0x34], edi
jmp 0x1000abc8
cmp ax, 0x2d
jne 0x1000abbb
add dword [ebp + 0x64], edi
or dword [ebp + 0x34], 4
jmp 0x1000abc8
cmp ax, 0x23
jne 0x1000abd7
mov byte [ebp + 0x12], 1
add dword [ebp + 0x64], edi
mov eax, dword [ebp + 0x64]
mov ax, word [eax]
cmp ax, bx
jne 0x1000ab2e
lea eax, [ebp + 0x64]
push eax
call fcn.10005b74
pop ecx
lea eax, [ebp + 0x64]
push eax
call fcn.1003f9c4
cmp word [ebp + 0x34], bx
pop ecx
jne 0x1000ac8c
lea eax, [ebp + 0x64]
push eax
call fcn.1003f9c4
cmp dword [ebp - 0xcc], ebx
mov eax, dword [ebp + 0x64]
pop ecx
mov dword [ebp + 0x48], eax
je 0x1000ac17
cmp word [ebp + 0x34], bx
jne 0x1000ad6a
push 2
pop esi
cmp word [eax], 0x2d
mov edi, eax
jne 0x1000ac2e
add eax, 2
cmp word [eax], 0x2d
jne 0x1000ac2e
mov dword [ebp + 0x48], eax
push 1
lea eax, [ebp + 0x48]
push eax
push 0x100c8014
call fcn.10048195
add esp, 0xc
test al, al
jne 0x1000ad6a
mov eax, dword [ebp + 0x48]
mov ax, word [eax]
cmp ax, 0x2d
je 0x1000ac5f
cmp ax, 0x2f
jne 0x1000ad6a
add dword [ebp + 0x48], esi
push 5
lea eax, [ebp + 0x48]
push eax
push 0x100c800c
call fcn.1004820a
add esp, 0xc
test al, al
je 0x1000ad0a
mov al, byte [ebp + 0x34]
or dword [ebp + 0x34], 0x10
cmp al, bl
jne 0x1000af3d
mov esi, dword [ebp + 0x64]
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
inc ecx
cmp ax, bx
mov dword [ebp + 0x20], ecx
mov edi, esi
je 0x1000afe0
push 2
pop edx
cmp ax, 0x3d
je 0x1000acb8
add edi, edx
mov ax, word [edi]
cmp ax, bx
jne 0x1000aca8
cmp edi, esi
je 0x1000afe0
cmp word [edi], 0x3d
jne 0x1000afe0
sub edi, edx
cmp word [edi], 0x2b
jne 0x1000acd9
mov al, byte [edi]
mov byte [ebp - 0x69], al
sub edi, edx
cmp edi, esi
mov ecx, edi
jbe 0x1000acf1
mov ax, word [ecx]
call fcn.10002df6
test al, al
je 0x1000acf1
sub ecx, edx
cmp ecx, esi
ja 0x1000acdf
mov ax, word [ecx]
call fcn.10002df6
test al, al
jne 0x1000afd8
mov edx, ecx
inc ecx
inc ecx
jmp 0x1000af6a
push 4
push dword [ebp + 0x48]
push str.cmd:
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000aead
add dword [ebp + 0x48], 8
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp + 0x48]
push eax
push dword [ebp + 0x4c]
call fcn.100082e1
add esp, 0x14
mov dword [ebp - 0xcc], eax
jmp 0x1000ad5b
mov word [edi], 0x20
add edi, esi
cmp edi, dword [ebp + 0x48]
jb 0x1000ad54
cmp word [ebp + 0x34], bx
je 0x1000af3d
lea eax, [ebp + 0x64]
push eax
call fcn.1003f9c4
mov eax, dword [ebp - 0xcc]
cmp eax, ebx
pop ecx
je 0x1000ad89
cmp word [eax], bx
jne 0x1000ad89
mov dword [ebp - 0xcc], ebx
cmp dword [ebp + 0x40], ebx
jne 0x1000ad96
cmp dword [ebp + 0x78], ebx
mov byte [ebp + 0x57], bl
je 0x1000ad9a
mov byte [ebp + 0x57], 1
or dword [ebp - 0x114], 0xffffffff
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x130], ebx
call fcn.10046123
lea ecx, [ebp - 0x16c]
call fcn.10046123
cmp byte [ebp + 0x57], bl
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x10c], ebx
mov byte [ebp + 0x31], bl
mov dword [ebp - 0x68], ebx
jne 0x1000ae15
cmp dword [ebp + 0x38], ebx
jne 0x1000ae15
mov ecx, dword [ebp + 0x4c]
push 1
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0x64]
call fcn.10058f7c
mov eax, dword [ebp - 0x10c]
mov dword [ebp + 0x64], eax
mov eax, dword [ebp + 0x64]
cmp word [eax], 0x2d
mov dword [ebp - 0x8c], eax
jne 0x1000ae30
add eax, 2
cmp word [eax], 0x2d
jne 0x1000ae30
mov dword [ebp + 0x64], eax
xor esi, esi
inc esi
push esi
lea eax, [ebp + 0x64]
push eax
push 0x100c8014
call fcn.10048195
add esp, 0xc
test al, al
jne 0x1000be0b
mov eax, dword [ebp + 0x64]
mov ax, word [eax]
cmp ax, 0x2d
je 0x1000ae63
cmp ax, 0x2f
jne 0x1000be0b
push 2
pop edi
add dword [ebp + 0x64], edi
push 5
lea eax, [ebp + 0x64]
push eax
push 0x100c800c
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000afe7
mov dword [ebp + 0x34], 0x10
push edi
lea eax, [ebp + 0x64]
push eax
push 0x100c8000
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b031
mov dword [ebp - 4], esi
jmp 0x1000ae15
push 3
push dword [ebp + 0x48]
push 0x100c7ffc
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000aed7
add dword [ebp + 0x48], 6
jmp 0x1000aecc
add dword [ebp + 0x48], esi
mov eax, dword [ebp + 0x48]
cmp word [eax], 0x2a
je 0x1000aec9
jmp 0x1000af1b
push 4
push dword [ebp + 0x48]
push 0x100c7ff4
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000af01
add dword [ebp + 0x48], 8
jmp 0x1000aef6
add dword [ebp + 0x48], esi
mov eax, dword [ebp + 0x48]
cmp word [eax], 0x2a
je 0x1000aef3
jmp 0x1000af1b
push 5
push dword [ebp + 0x48]
push str.logs:
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000af3d
add dword [ebp + 0x48], 0xa
mov eax, dword [ebp + 0x48]
cmp word [eax], 0x22
jne 0x1000af3d
add dword [ebp + 0x48], esi
jmp 0x1000af32
add dword [ebp + 0x48], esi
cmp ax, 0x22
je 0x1000af3d
mov eax, dword [ebp + 0x48]
mov ax, word [eax]
cmp ax, bx
jne 0x1000af29
lea eax, [ebp + 0x48]
push eax
call fcn.10008e60
mov eax, dword [ebp + 0x48]
pop ecx
jmp 0x1000ac1a
lea eax, [edx - 2]
mov dword [ebp - 0x8c], eax
mov ax, word [eax]
call fcn.10002df6
test al, al
jne 0x1000af6e
mov edx, dword [ebp - 0x8c]
cmp edx, esi
ja 0x1000af4f
sub ecx, edx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x60]
call fcn.10046247
mov esi, dword [ebp + 0x4c]
push ebx
lea eax, [ebp - 0x60]
push eax
mov ecx, esi
call fcn.10002f54
cmp byte [esi + 0x92], bl
jne 0x1000af99
test byte [esi + 9], 0xf
je 0x1000afaf
push ebx
lea eax, [ebp - 0x60]
push eax
mov ecx, esi
call fcn.10002f54
jmp 0x1000afaf
cmp ax, 0x3d
je 0x1000afbd
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x1000afa7
cmp ax, 0x3d
jne 0x1000afd8
lea eax, [ebp - 0x14c]
add edi, 2
push eax
mov dword [ebp - 0x14c], edi
call fcn.1003f9c4
pop ecx
jmp 0x1000abf5
xor ebx, ebx
inc ebx
jmp 0x1000f1b7
mov ebx, ecx
jmp 0x1000f1b7
push 6
push dword [ebp + 0x64]
push str.clone:
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000ae8b
add dword [ebp + 0x64], 0xc
mov esi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
call fcn.10005b74
mov eax, dword [ebp + 0x64]
cmp word [eax], bx
pop ecx
je 0x1000b020
mov word [eax], bx
add dword [ebp + 0x64], edi
cmp word [esi], bx
je 0x1000b104
mov dword [ebp - 0x70], esi
jmp 0x1000b104
push 4
lea eax, [ebp + 0x64]
push eax
push str.shel
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b05b
or byte [ebp + 0x73], 2
and byte [ebp + 0x2f], 0xfe
mov dword [ebp - 0x4c], esi
mov dword [ebp + 0x20], esi
jmp 0x1000ae15
push 5
push dword [ebp + 0x64]
push str.shel:
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000b0c9
add dword [ebp + 0x64], 0xa
mov eax, dword [ebp + 0x64]
or byte [ebp + 0x73], 2
and byte [ebp + 0x2f], 0xfe
mov dword [ebp - 0x98], eax
push 5
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x4c], esi
mov dword [ebp + 0x20], esi
mov dword [ebp + 0x40], ebx
call fcn.1001a65a
add esp, 0xc
cmp dword [ebp + 0x40], ebx
mov dword [ebp + 0x64], eax
jle 0x1000ae15
push dword [ebp + 0x40]
lea ecx, [ebp - 0x134]
push dword [ebp - 0x98]
call fcn.10046247
jmp 0x1000ae15
push 9
push dword [ebp + 0x64]
push str.runrmenu:
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000b112
add dword [ebp + 0x64], 0x12
mov edi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
call fcn.10005b74
mov eax, dword [ebp + 0x64]
pop ecx
lea ecx, [ebp - 0x140]
sub eax, edi
sar eax, 1
push eax
push edi
call fcn.10046247
lea eax, [ebp + 0x64]
push eax
call fcn.1003f9c4
jmp 0x1000be02
push 8
push dword [ebp + 0x64]
push str.poprmenu
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000b1c2
add dword [ebp + 0x64], 0x10
mov eax, dword [ebp + 0x64]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x64]
push eax
call fcn.10005b74
mov eax, dword [ebp + 0x64]
cmp word [eax], bx
pop ecx
je 0x1000b14b
add dword [ebp + 0x64], edi
lea eax, [ebp + 0x64]
push eax
call fcn.1003f9c4
pop ecx
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x18]
mov ax, word [eax]
cmp ax, bx
mov byte [ebp - 0x71], 1
je 0x1000b180
cmp ax, 0x30
jb 0x1000b17d
cmp ax, 0x39
jbe 0x1000b180
add dword [ebp - 0x18], edi
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10053a89
mov eax, dword [ebp - 0x18]
mov ax, word [eax]
cmp ax, bx
pop ecx
pop ecx
je 0x1000b1ac
cmp ax, 0x30
jb 0x1000b1a9
cmp ax, 0x39
jbe 0x1000b1ac
add dword [ebp - 0x18], edi
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10053a89
pop ecx
jmp 0x1000be02
push 4
push dword [ebp + 0x64]
push str.pid:
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000b23c
add dword [ebp + 0x64], 8
mov edi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
mov dword [ebp - 0x8c], edi
call fcn.10005b74
mov ax, word [edi]
cmp ax, 0x28
pop ecx
je 0x1000b222
cmp ax, 0x30
jne 0x1000b20c
mov ax, word [edi + 2]
or ax, 0x20
cmp ax, 0x78
je 0x1000b222
mov eax, dword [ebp + 0x64]
cmp edi, eax
je 0x1000b104
lea ecx, [ebp - 0x130]
jmp 0x1000b0f9
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.10042554
pop ecx
pop ecx
jmp 0x1000b104
push 5
push dword [ebp + 0x64]
push str.hpid:
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000b279
add dword [ebp + 0x64], 0xa
mov esi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
call fcn.10005b74
mov eax, dword [ebp + 0x64]
cmp esi, eax
pop ecx
je 0x1000b104
lea ecx, [ebp - 0x164]
jmp 0x1000bc84
push 5
push dword [ebp + 0x64]
push str.ppid:
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000b2f0
add dword [ebp + 0x64], 0xa
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp + 0x64]
push eax
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
call fcn.10049610
cmp dword [ebp - 0xac], ebx
pop ecx
pop ecx
jg 0x1000b2e2
jl 0x1000b2c3
cmp dword [ebp - 0xb0], ebx
jae 0x1000b2e2
push dword [ebp - 0xac]
push dword [ebp - 0xb0]
call fcn.10008415
pop ecx
pop ecx
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], edx
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x78], eax
jmp 0x1000ae15
push 4
push dword [ebp + 0x64]
push 0x100c7ff4
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000b405
mov eax, dword [ebp + 0x64]
add eax, 8
mov dword [ebp + 0x64], eax
mov cx, word [eax]
xor edx, edx
cmp cx, 0x23
mov edi, eax
mov dword [ebp], ebx
jne 0x1000b326
mov dword [ebp - 0x68], esi
cmp cx, 0x22
jne 0x1000b39d
lea esi, [eax + 2]
mov edi, eax
mov ecx, esi
jmp 0x1000b35b
cmp ax, 0x22
jne 0x1000b359
inc edx
test dl, 1
je 0x1000b359
xor eax, eax
mov ax, word [ecx + 2]
cmp ax, bx
je 0x1000b366
call fcn.10002df6
test al, al
jne 0x1000b366
or dword [ebp - 0x68], 2
inc ecx
inc ecx
mov dword [ebp + 0x64], ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x1000b335
push 0x22
pop edx
cmp word [ecx], dx
jne 0x1000b3aa
or dword [ebp], 0xffffffff
inc ecx
inc ecx
mov dword [ebp + 0x64], ecx
cmp word [ecx - 4], dx
mov edi, esi
mov byte [ebp + 0x31], 2
je 0x1000b391
mov ax, word [edi]
cmp ax, dx
jne 0x1000b3aa
cmp word [edi + 2], dx
jne 0x1000b396
mov byte [ebp + 0x31], bl
jmp 0x1000b3aa
cmp ax, dx
jne 0x1000b3aa
jmp 0x1000b391
lea eax, [ebp + 0x64]
push eax
call fcn.10005b74
pop ecx
mov ecx, dword [ebp + 0x64]
sub ecx, edi
sar ecx, 1
add dword [ebp], ecx
cmp dword [ebp], ebx
jle 0x1000b104
add edi, 0xfffffff6
push edi
lea ecx, [ebp - 0xe8]
call fcn.100502c8
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp]
add eax, 0xa
mov word [eax + ecx*2], bx
cmp word [eax], 0x2a
mov dword [ebp + 0x28], eax
jne 0x1000b104
cmp word [eax + 2], bx
jne 0x1000b104
lea eax, [ebp - 0xe8]
push eax
call fcn.100047c7
pop ecx
mov dword [ebp + 0x28], eax
jmp 0x1000b104
push 3
push dword [ebp + 0x64]
push 0x100c7ffc
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000b532
mov eax, dword [ebp + 0x64]
xor edi, edi
add eax, 6
jmp 0x1000b42c
inc edi
inc eax
inc eax
mov dword [ebp + 0x64], eax
cmp word [eax], 0x2a
je 0x1000b429
cmp edi, 2
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x48], ebx
jge 0x1000b4d8
movzx eax, word [eax]
cmp ax, bx
je 0x1000b491
call fcn.10002df6
test al, al
jne 0x1000b491
push esi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.1001a65a
add esp, 0xc
cmp dword [ebp - 0x48], ebx
mov dword [ebp + 0x64], eax
jle 0x1000b491
push dword [ebp - 0x48]
lea ecx, [ebp - 0x88]
push dword [ebp - 0x84]
call fcn.10046247
mov eax, dword [ebp - 0x88]
mov dword [ebp + 0x50], eax
cmp edi, esi
jne 0x1000b51e
cmp dword [ebp - 0x48], ebx
jle 0x1000b526
mov eax, dword [ebp - 0x88]
push esi
lea ecx, [ebp - 0x88]
push ecx
push eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x88], ebx
call fcn.1009e76f
add esp, 0xc
lea ecx, [ebp - 0x150]
mov dword [ebp + 0x50], eax
call fcn.1003f96c
jmp 0x1000b104
push 0x105
lea ecx, [ebp - 0x88]
call fcn.10046168
push 0x104
push dword [ebp - 0x88]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push ebx
push dword [ebp - 0x88]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
je 0x1000b510
mov word [eax], bx
mov eax, dword [ebp - 0x88]
mov dword [ebp + 0x50], eax
jmp 0x1000b104
cmp edi, ebx
jle 0x1000b104
mov dword [ebp + 0x50], 0x100c7fa0
jmp 0x1000b104
push 5
push dword [ebp + 0x64]
push str.logs:
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000b5ab
mov eax, dword [ebp + 0x64]
add eax, 0xa
xor ecx, ecx
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x40], eax
cmp word [eax], 0x3f
sete cl
mov edi, ecx
cmp edi, ebx
je 0x1000b569
add eax, 2
mov dword [ebp + 0x40], eax
mov esi, dword [ebp + 0x40]
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x40]
push eax
mov dword [ebp + 8], ebx
call fcn.1001a65a
add esp, 0xc
cmp dword [ebp + 8], ebx
mov dword [ebp + 0x64], eax
jle 0x1000b104
cmp edi, ebx
je 0x1000b59d
cmp dword [0x100e2cf8], ebx
je 0x1000b104
push dword [ebp + 8]
lea ecx, [ebp - 0x158]
jmp 0x1000bc89
push edi
lea eax, [ebp + 0x64]
push eax
push 0x100c7f9c
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b5ca
mov byte [ebp - 0x61], 1
jmp 0x1000ae15
push 5
lea eax, [ebp + 0x64]
push eax
push str.nowin
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b5ea
mov byte [ebp - 0x31], 1
jmp 0x1000ae15
push 4
pop edi
push edi
lea eax, [ebp + 0x64]
push eax
push 0x100c7f8c
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b60f
mov dword [ebp - 0x14], 0x10000000
jmp 0x1000ae15
push edi
lea eax, [ebp + 0x64]
push eax
push 0x100c7f84
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b633
inc dword [ebp - 0x100]
mov dword [ebp + 0x20], esi
jmp 0x1000ae15
push 5
lea eax, [ebp + 0x64]
push eax
push str.waiti
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b653
mov byte [ebp + 0x30], 1
jmp 0x1000ae15
push 3
pop esi
push esi
lea eax, [ebp + 0x64]
push eax
push 0x100c7f78
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b675
or byte [ebp + 0x32], 1
jmp 0x1000ae15
push esi
lea eax, [ebp + 0x64]
push eax
push 0x100c7f74
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b694
mov byte [ebp - 0x25], 1
jmp 0x1000ae15
push esi
lea eax, [ebp + 0x64]
push eax
push 0x100c7f70
call fcn.10048195
add esp, 0xc
test al, al
jne 0x1000ae15
push edi
lea eax, [ebp + 0x64]
push eax
push str.err
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b6cd
or byte [ebp + 0x32], 3
jmp 0x1000ae15
push 5
lea eax, [ebp + 0x64]
push eax
push str.limit
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b6ed
mov byte [ebp - 0x6a], 1
jmp 0x1000ae15
push esi
lea eax, [ebp + 0x64]
push eax
push 0x100c7f5c
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b70c
mov byte [ebp - 0x2e], 1
jmp 0x1000ae15
push edi
lea eax, [ebp + 0x64]
push eax
push str.hook
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b72e
mov dword [ebp - 0x4c], 1
jmp 0x1000ae15
push esi
lea eax, [ebp + 0x64]
push eax
push 0x100c7f50
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b750
mov dword [ebp - 0x14], 6
jmp 0x1000ae15
push esi
lea eax, [ebp + 0x64]
push eax
push 0x100c7f4c
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b76e
mov dword [ebp - 0x14], esi
jmp 0x1000ae15
push edi
lea eax, [ebp + 0x64]
push eax
push 0x100c7f44
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b790
mov dword [ebp - 0x14], 1
jmp 0x1000ae15
push edi
lea eax, [ebp + 0x64]
push eax
push 0x100c7f3c
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b7af
mov byte [ebp - 0x6b], 1
jmp 0x1000ae15
push 2
pop edi
push edi
lea eax, [ebp + 0x64]
push eax
push 0x100c7f38
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b7d1
mov byte [ebp - 0x39], 1
jmp 0x1000ae15
push 4
lea eax, [ebp + 0x64]
push eax
push 0x100c7f30
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b7f0
mov byte [ebp - 0x39], bl
jmp 0x1000ae15
push 3
lea eax, [ebp + 0x64]
push eax
push 0x100c7f2c
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b810
mov byte [ebp - 0x51], 1
jmp 0x1000ae15
push edi
lea eax, [ebp + 0x64]
push eax
push 0x100c7f28
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b82f
mov byte [ebp + 0x1f], 1
jmp 0x1000ae15
push 5
lea eax, [ebp + 0x64]
push eax
push str.incmd
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b84f
mov byte [ebp - 0x2d], 1
jmp 0x1000ae15
push 3
lea eax, [ebp + 0x64]
push eax
push str.svr_
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b86e
mov dword [ebp - 0x10], ebx
jmp 0x1000ae15
push 6
lea eax, [ebp + 0x64]
push eax
push str.svrsys
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b891
mov dword [ebp - 0x10], 0x20000
jmp 0x1000ae15
push 7
pop esi
push esi
lea eax, [ebp + 0x64]
push eax
push str.svrsys_
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b8ba
mov al, byte [0x100e2be0]
neg al
sbb eax, eax
and eax, 0x20000
jmp 0x1000b8fb
push 6
lea eax, [ebp + 0x64]
push eax
push str.svrusr
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b8da
or dword [ebp - 0x10], 1
jmp 0x1000ae15
push esi
lea eax, [ebp + 0x64]
push eax
push str.svrusr_
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b903
xor eax, eax
cmp byte [0x100e2be0], bl
setne al
mov dword [ebp - 0x10], eax
jmp 0x1000ae15
push esi
lea eax, [ebp + 0x64]
push eax
push str.hidecmd
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b922
mov byte [ebp - 0x41], 1
jmp 0x1000ae15
push 8
lea eax, [ebp + 0x64]
push eax
push str.hidecmd_
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b941
mov byte [ebp - 0x41], bl
jmp 0x1000ae15
push 3
lea eax, [ebp + 0x64]
push eax
push 0x100c7ee0
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000b964
mov dword [ebp + 0x24], 1
jmp 0x1000ae15
push 3
push dword [ebp + 0x64]
push 0x100c7edc
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000b987
add dword [ebp + 0x64], 6
mov dword [ebp + 0x24], pe_nt_image_headers32
jmp 0x1000b9a7
push edi
push dword [ebp + 0x64]
push 0x100c7ed8
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000b9fe
add dword [ebp + 0x64], 4
mov dword [ebp + 0x24], 8
xor ecx, ecx
jmp 0x1000b9ee
mov eax, ecx
call fcn.10002df6
test al, al
jne 0x1000bdf9
or ecx, 0x20
cmp cx, 0x61
jne 0x1000b9c9
or dword [ebp + 0x24], 0x40
jmp 0x1000b9eb
cmp cx, 0x65
jne 0x1000b9d5
or byte [ebp + 0x24], 0x80
jmp 0x1000b9eb
cmp cx, 0x63
jne 0x1000b9e1
or byte [ebp + 0x25], 1
jmp 0x1000b9eb
cmp cx, 0x64
jne 0x1000b9eb
or byte [ebp + 0x25], 2
add dword [ebp + 0x64], edi
mov eax, dword [ebp + 0x64]
mov cx, word [eax]
cmp cx, bx
jne 0x1000b9ab
jmp 0x1000bdf9
push 3
push dword [ebp + 0x64]
push 0x100c7ed4
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000ba4f
add dword [ebp + 0x64], 6
mov eax, dword [ebp + 0x64]
cmp word [eax], 0x3a
mov byte [ebp + 0x47], 1
jne 0x1000b104
add dword [ebp + 0x64], edi
mov esi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
call fcn.10005b74
mov eax, dword [ebp + 0x64]
cmp esi, eax
pop ecx
je 0x1000b104
lea ecx, [ebp - 0x110]
jmp 0x1000bc84
push 5
push dword [ebp + 0x64]
push str.code:
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000bb10
add dword [ebp + 0x64], 0xa
mov eax, dword [ebp + 0x64]
mov dword [ebp - 0x40], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
push str.UTF8
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000ba9d
mov byte [ebp + 0x46], 1
mov dword [ebp - 0x94], 0xfde9
jmp 0x1000bdf9
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
push str.ANSI
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000bac3
mov byte [ebp + 0x46], 1
mov dword [ebp - 0x94], ebx
jmp 0x1000bdf9
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
push 0x100c7eb8
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000baed
mov byte [ebp + 0x46], 2
mov dword [ebp - 0x94], 0x4b0
jmp 0x1000bdf9
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10042554
test eax, eax
pop ecx
pop ecx
jle 0x1000bdf9
mov byte [ebp + 0x46], 1
jmp 0x1000bdf9
push esi
lea eax, [ebp + 0x64]
push eax
push str.timeout:
call fcn.10048248
add esp, 0xc
test al, al
je 0x1000bbbd
mov eax, dword [ebp + 0x64]
mov dword [ebp + 0x3c], eax
mov cx, word [eax]
cmp cx, 0x23
mov byte [ebp - 0x30], bl
jne 0x1000bb42
mov byte [ebp - 0x30], 1
jmp 0x1000bb4c
cmp cx, 0x2a
jne 0x1000bb52
mov byte [ebp - 0x30], 2
add eax, 2
mov dword [ebp + 0x3c], eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp + 0x3c]
push eax
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
call fcn.100935c9
test eax, eax
pop ecx
pop ecx
jle 0x1000bdf9
mov eax, dword [ebp - 0x148]
cmp eax, ebx
jle 0x1000bdf9
or dword [ebp + 0x20], 0x10
mov dword [ebp - 0xec], eax
mov al, byte [ebp - 0x30]
mov byte [ebp + 0x12], al
mov eax, dword [ebp + 0x3c]
cmp word [eax], 0x3a
jne 0x1000bdf9
add dword [ebp + 0x3c], edi
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.10042554
pop ecx
pop ecx
jmp 0x1000bdf9
push 5
push dword [ebp + 0x64]
push str.user:
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000bc1e
add dword [ebp + 0x64], 0xa
mov edi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
call fcn.10005b74
mov eax, dword [ebp + 0x64]
cmp edi, eax
pop ecx
je 0x1000b104
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0xbc]
call fcn.10046247
cmp word [edi], 0x23
jne 0x1000bc16
cmp word [edi + 2], 0x23
jne 0x1000bc16
mov byte [ebp - 0x2f], 1
jmp 0x1000b104
mov byte [ebp - 0x2f], bl
jmp 0x1000b104
push esi
push dword [ebp + 0x64]
push str.passwd:
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000bc49
mov eax, dword [ebp + 0x64]
cmp word [eax + 0xe], 0x23
jne 0x1000bc44
cmp word [eax + 0x10], 0x23
je 0x1000bc5e
mov byte [ebp - 9], bl
jmp 0x1000bc62
push esi
push dword [ebp + 0x64]
push str.passwd
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000bc8f
mov byte [ebp - 9], 1
add dword [ebp + 0x64], 0xe
mov esi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
call fcn.10005b74
mov eax, dword [ebp + 0x64]
cmp esi, eax
pop ecx
je 0x1000b104
lea ecx, [ebp - 0xb8]
sub eax, esi
sar eax, 1
push eax
push esi
jmp 0x1000b0ff
push 8
lea eax, [ebp + 0x64]
push eax
push str.REALTIME
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000bcb2
mov dword [ebp - 0x24], 0x100
jmp 0x1000ae15
push 4
lea eax, [ebp + 0x64]
push eax
push str.HIGH
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000bcd5
mov dword [ebp - 0x24], 0x80
jmp 0x1000ae15
push 0xb
lea eax, [ebp + 0x64]
push eax
push str.ABOVENORMAL
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000bcf8
mov dword [ebp - 0x24], 0x8000
jmp 0x1000ae15
push 6
lea eax, [ebp + 0x64]
push eax
push str.NORMAL
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000bd1b
mov dword [ebp - 0x24], 0x20
jmp 0x1000ae15
push 0xb
lea eax, [ebp + 0x64]
push eax
push str.BELOWNORMAL
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000bd3e
mov dword [ebp - 0x24], 0x4000
jmp 0x1000ae15
push 3
lea eax, [ebp + 0x64]
push eax
push 0x100c7e5c
call fcn.10048195
add esp, 0xc
test al, al
jne 0x1000bd78
mov edi, dword [ebp + 0x64]
push 0x100c7e50
push 4
pop esi
call fcn.10002e0f
cmp al, bl
pop ecx
lea eax, [ebp + 0x64]
je 0x1000bd84
add dword [ebp + 0x64], 8
push eax
call fcn.1003f9c4
pop ecx
mov dword [ebp - 0x24], 0x40
jmp 0x1000ae15
push 3
push eax
push 0x100c7e4c
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000bda1
mov byte [ebp + 0x33], 1
jmp 0x1000ae15
push 3
lea eax, [ebp + 0x64]
push eax
push 0x100c7e48
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000bdca
mov byte [ebp - 0x26], 1
mov byte [ebp + 0x46], bl
mov dword [ebp - 0x94], ebx
jmp 0x1000ae15
push 3
lea eax, [ebp + 0x64]
push eax
push 0x100c7e44
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000bdea
mov byte [ebp - 0x59], 1
jmp 0x1000ae15
mov eax, dword [ebp - 0x8c]
cmp word [eax], 0x2d
mov dword [ebp + 0x64], eax
jne 0x1000be08
lea eax, [ebp + 0x64]
push eax
call fcn.10008e60
pop ecx
jmp 0x1000ae15
xor esi, esi
inc esi
cmp dword [ebp + 0x24], ebx
je 0x1000be35
cmp byte [ebp - 0x31], bl
je 0x1000be19
or dword [ebp + 0x24], 4
cmp dword [ebp + 0x24], ebx
je 0x1000be35
cmp byte [ebp + 0x30], bl
je 0x1000be27
or dword [ebp + 0x24], 0x20
cmp dword [ebp + 0x24], ebx
je 0x1000be35
cmp byte [ebp - 0x2d], bl
je 0x1000be35
or byte [ebp + 0x25], 4
cmp dword [ebp - 0x78], ebx
je 0x1000be67
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x78]
lea ecx, [ebp - 0x1cc]
mov dword [eax], 0x48
call fcn.10004879
mov eax, dword [ebp - 0x1c8]
neg eax
sbb eax, eax
and eax, 0x80000
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x94], 0x4b0
jne 0x1000be77
mov byte [ebp + 0x46], 2
mov eax, dword [ebp - 0x14c]
cmp eax, ebx
je 0x1000bea9
cmp byte [ebp + 0x57], bl
mov dword [ebp + 0x64], eax
jne 0x1000bea9
cmp dword [ebp + 0x38], ebx
jne 0x1000bea9
push esi
push ebx
lea ecx, [ebp - 0x10c]
push ecx
mov ecx, dword [ebp + 0x4c]
push eax
call fcn.10058f7c
mov eax, dword [ebp - 0x10c]
mov dword [ebp + 0x64], eax
mov edi, dword [ebp + 0x28]
cmp edi, ebx
mov dword [ebp - 0x1bc], ebx
mov dword [ebp - 0x1b8], ebx
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 0x7c], ebx
je 0x1000bed0
cmp word [edi], bx
je 0x1000bed0
cmp word [ebp - 0x68], bx
je 0x1000bed3
mov byte [ebp + 0x33], bl
cmp edi, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp - 0x124], 0x100c7380
je 0x1000bfba
cmp word [edi], 0x2a
jne 0x1000bf02
inc edi
inc edi
inc dword [ebp - 0x20]
cmp word [edi], 0x2a
je 0x1000bef4
mov dword [ebp + 0x28], edi
cmp word [edi], 0x3f
jne 0x1000bf2e
inc edi
inc edi
mov dword [ebp + 0x28], edi
mov dword [ebp - 0x124], edi
jmp 0x1000bf20
inc edi
inc edi
cmp ax, 0x3a
mov dword [ebp + 0x28], edi
je 0x1000bf2a
mov ax, word [edi]
cmp ax, bx
jne 0x1000bf15
jmp 0x1000bf2e
mov word [edi - 2], bx
mov ax, word [edi]
push 0x20
pop ecx
or ax, cx
cmp ax, 0x63
jne 0x1000bf66
mov dx, word [edi + 2]
or dx, cx
cmp dx, 0x61
jne 0x1000bf66
mov dx, word [edi + 4]
or dx, cx
cmp dx, 0x62
jne 0x1000bf66
cmp word [edi + 6], 0x3a
jne 0x1000bf66
mov dword [ebp - 0x2c], esi
add edi, 8
jmp 0x1000bf8a
cmp ax, 0x65
jne 0x1000bf8d
mov ax, word [edi + 2]
or ax, cx
cmp ax, 0x78
jne 0x1000bf8d
cmp word [edi + 4], 0x3a
jne 0x1000bf8d
mov dword [ebp - 0x2c], 0x100
add edi, 6
mov dword [ebp + 0x28], edi
cmp edi, ebx
je 0x1000bfba
mov ax, word [edi]
or ax, cx
cmp ax, 0x75
jne 0x1000bfba
mov ax, word [edi + 2]
or ax, cx
cmp ax, 0x64
jne 0x1000bfba
cmp word [edi + 4], 0x3a
jne 0x1000bfba
add edi, 6
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x28], edi
cmp byte [ebp + 0x33], bl
je 0x1000bfff
cmp edi, ebx
je 0x1000bfff
cmp word [ebp - 0x2c], bx
jne 0x1000bfff
cmp word [ebp + 0xc], bx
jne 0x1000bfff
xor edx, edx
cmp byte [ebp + 0x31], bl
mov ecx, edi
setne dl
xor eax, eax
mov ax, word [edi]
jmp 0x1000bffa
cmp ax, 0x22
jne 0x1000bff5
inc edx
cmp edx, 2
jl 0x1000bff5
cmp word [ecx + 2], bx
je 0x1000bff5
mov byte [ebp + 0x33], bl
inc ecx
inc ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x1000bfe0
cmp word [ebp - 0x20], bx
jne 0x1000c011
cmp word [ebp - 0x2c], bx
jne 0x1000c011
cmp word [ebp + 0xc], bx
je 0x1000c014
mov byte [ebp + 0x31], bl
cmp edi, ebx
je 0x1000c030
push 0x2a
push edi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp - 0x7c], eax
je 0x1000c030
mov word [eax], bx
inc eax
inc eax
mov dword [ebp - 0x7c], eax
cmp byte [ebp + 0x33], bl
je 0x1000c05d
xor eax, eax
cmp word [ebp + 0xc], bx
sete al
xor ecx, ecx
cmp word [ebp - 0x2c], bx
sete cl
test ecx, eax
je 0x1000c05d
lea eax, [ebp - 0x1bc]
push eax
push edi
call fcn.10014f8e
pop ecx
pop ecx
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp + 0x74]
mov dword [eax], esi
xor eax, eax
cmp dword [ebp - 0x70], ebx
lea edi, [ebp - 0x1ac]
mov dword [ebp - 0x1b0], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x1e0], ebx
lea edi, [ebp - 0x1dc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 8], ebx
mov dword [ebp + 0x14], esi
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xc8], ebx
stosd dword es:[edi], eax
je 0x1000c0bf
mov dword [ebp - 4], esi
cmp byte [ebp + 0x1f], bl
mov dword [ebp - 0x1a8], 0xc
mov dword [ebp - 0x1a4], ebx
mov dword [ebp - 0x1a0], esi
mov dword [ebp - 0x168], ebx
je 0x1000c108
mov ecx, dword [0x100e134c]
lea eax, [ebp - 0x270]
or byte [eax + 0x2d], 1
mov dword [eax + 0x3c], ecx
mov ecx, dword [0x100e1350]
mov dword [eax + 0x40], ecx
mov ecx, dword [0x100e1348]
mov dword [ebp - 4], esi
mov dword [eax + 0x38], ecx
cmp byte [ebp + 0x57], bl
je 0x1000c625
mov ecx, dword [ebp + 0x64]
cmp word [ecx], 0x7c
mov dword [ebp], ebx
jne 0x1000c136
inc ecx
inc ecx
xor eax, eax
mov dword [ebp + 0x64], ecx
mov ax, word [ecx]
cmp ax, 0x7c
je 0x1000c11d
call fcn.10002df6
test al, al
jne 0x1000c11d
mov dword [ebp + 0x40], ecx
mov eax, dword [ebp + 0x64]
xor edx, edx
mov dword [ebp + 0x58], edx
cmp word [eax], bx
je 0x1000c1e1
cmp word [eax], 0x7c
jne 0x1000c166
cmp word [eax + 2], 0x7c
je 0x1000c15e
mov edx, eax
mov dword [ebp + 0x58], edx
jmp 0x1000c166
inc eax
inc eax
cmp word [eax], 0x7c
je 0x1000c15e
inc eax
inc eax
cmp word [eax], bx
jne 0x1000c14a
cmp edx, ebx
je 0x1000c1e1
lea eax, [ebp + 0x58]
mov word [edx], bx
add dword [ebp + 0x58], 2
push eax
call fcn.1003f9c4
mov edx, dword [ebp + 0x58]
xor eax, eax
mov ax, word [edx]
cmp ax, bx
pop ecx
mov edi, edx
je 0x1000c139
cmp ax, 0x7c
jne 0x1000c1c0
lea esi, [edi + 2]
cmp word [esi], ax
jne 0x1000c1c0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push esi
push edi
call fcn.100144b5
add esp, 0xc
cmp word [edi], 0x7c
jne 0x1000c1bd
inc edi
inc edi
jmp 0x1000c1b3
mov edx, dword [ebp + 0x58]
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x1000c191
cmp word [edx], bx
je 0x1000c139
mov eax, dword [ebp + 0x40]
cmp word [eax], bx
mov cl, 1
je 0x1000c1e3
mov al, cl
jmp 0x1000c1ef
xor cl, cl
xor al, al
cmp cl, bl
jne 0x1000c1ef
mov edx, dword [ebp + 0x40]
mov dword [ebp + 0x58], edx
cmp al, bl
mov dword [ebp + 0x38], edx
je 0x1000c2d4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
push ebx
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0xc8]
push eax
xor edi, edi
lea eax, [ebp - 0xc0]
inc edi
push eax
mov dword [ebp - 0xf8], 0xc
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xf0], edi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x1000c246
mov ecx, dword [ebp + 0x4c]
push ebx
push ebx
push edi
call fcn.10011621
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 3
push ebx
push ebx
lea eax, [ebp - 0xc0]
push eax
push esi
push dword [ebp - 0xc0]
push esi
call edi
cmp dword [ebp - 0xc8], ebx
mov word [ebp + 0x1e], bx
je 0x1000c29a
mov ecx, dword [ebp + 0x4c]
push ebx
push dword [ebp - 0xc8]
lea eax, [ebp + 0x1e]
push ebx
push ebx
push eax
push ecx
push dword [ebp + 0x40]
call fcn.1000a5c9
cmp dword [ebp - 0xc8], ebx
je 0x1000c29a
push dword [ebp - 0xc8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
push 1
push ebx
lea eax, [ebp - 0xc0]
push eax
push esi
push dword [ebp - 0xc0]
mov dword [ebp - 0xc8], ebx
push esi
call edi
mov ecx, dword [ebp - 0xc0]
cmp ecx, ebx
je 0x1000c2d4
lea eax, [ebp - 0x270]
or byte [eax + 0x2d], 1
mov dword [ebp - 4], 1
mov dword [eax + 0x38], ecx
mov eax, dword [ebp + 0x38]
mov dword [ebp + 0x58], eax
xor edi, edi
inc edi
mov cx, word [eax]
cmp cx, bx
je 0x1000c5c1
cmp cx, 0x3c
je 0x1000c302
cmp cx, 0x3e
je 0x1000c302
inc eax
inc eax
mov dword [ebp + 0x58], eax
mov cx, word [eax]
cmp cx, bx
jne 0x1000c2e9
mov cx, word [eax]
cmp cx, bx
je 0x1000c5c1
cmp cx, 0x3c
jne 0x1000c406
mov word [eax], bx
add dword [ebp + 0x58], 2
lea eax, [ebp + 0x58]
push eax
call fcn.1003f9c4
mov eax, dword [ebp + 0x58]
cmp word [eax], bx
pop ecx
je 0x1000c406
mov dword [ebp + 0x3c], eax
jmp 0x1000c34b
cmp cx, 0x3c
je 0x1000c353
cmp cx, 0x3e
je 0x1000c353
inc eax
inc eax
mov dword [ebp + 0x58], eax
mov cx, word [eax]
cmp cx, bx
jne 0x1000c33a
sub eax, dword [ebp + 0x3c]
lea ecx, [ebp - 0xa8]
sar eax, 1
push eax
push dword [ebp + 0x3c]
call fcn.10050208
lea ecx, [ebp + 0x40]
call fcn.10046123
mov ecx, dword [ebp + 0x4c]
push edi
push ebx
lea eax, [ebp + 0x40]
push eax
push dword [ebp + 0x3c]
call fcn.10058f7c
mov eax, dword [ebp + 0x40]
push eax
mov dword [ebp + 0x3c], eax
call fcn.10010e64
lea eax, [ebp + 0x3c]
push eax
call fcn.1003f9c4
cmp dword [ebp - 0x50], ebx
pop ecx
pop ecx
je 0x1000c3a5
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push 3
lea eax, [ebp - 0x1a8]
push eax
push 7
mov esi, 0xc0000000
push esi
push dword [ebp + 0x3c]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x50], ebx
call fcn.10005b9d
cmp dword [ebp - 0x50], ebx
jne 0x1000c3f0
push ebx
push 0x2000000
push 3
lea eax, [ebp - 0x1a8]
push eax
push 7
push esi
push dword [ebp + 0x3c]
lea ecx, [ebp - 0x50]
call fcn.10005b9d
cmp dword [ebp - 0x50], ebx
jne 0x1000c3f0
mov dword [ebp - 0x50], ebx
lea ecx, [ebp + 0x40]
call fcn.1003f96c
lea ecx, [ebp - 0xa8]
call fcn.1003f96c
mov eax, dword [ebp + 0x58]
cmp word [eax], 0x3e
jne 0x1000c2dd
mov word [eax], bx
mov eax, dword [ebp + 0x58]
xor esi, esi
cmp word [eax - 2], 0x32
mov byte [ebp + 0x57], 1
jne 0x1000c42b
mov byte [ebp + 0x57], 2
mov word [eax - 2], bx
add dword [ebp + 0x58], 2
mov eax, dword [ebp + 0x58]
cmp word [eax], 0x3e
jne 0x1000c43e
add dword [ebp + 0x58], 2
mov esi, edi
mov eax, dword [ebp + 0x58]
cmp word [eax], 0x26
jne 0x1000c44f
add dword [ebp + 0x58], 2
mov byte [ebp + 0x57], 3
lea eax, [ebp + 0x58]
push eax
call fcn.1003f9c4
mov eax, dword [ebp + 0x58]
cmp word [eax], bx
pop ecx
je 0x1000c2dd
mov dword [ebp + 4], eax
jmp 0x1000c47b
cmp cx, 0x3c
je 0x1000c483
cmp cx, 0x3e
je 0x1000c483
inc eax
inc eax
mov dword [ebp + 0x58], eax
mov cx, word [eax]
cmp cx, bx
jne 0x1000c46a
sub eax, dword [ebp + 4]
lea ecx, [ebp - 0x98]
sar eax, 1
push eax
push dword [ebp + 4]
call fcn.10050208
lea ecx, [ebp - 0x40]
call fcn.10046123
mov ecx, dword [ebp + 0x4c]
push edi
push ebx
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 4]
call fcn.10058f7c
mov eax, dword [ebp - 0x40]
push eax
mov dword [ebp + 4], eax
call fcn.10010e64
lea eax, [ebp + 4]
push eax
call fcn.1003f9c4
test byte [ebp + 0x57], 1
pop ecx
pop ecx
je 0x1000c4de
cmp dword [ebp - 0x18], ebx
je 0x1000c4db
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], ebx
test byte [ebp + 0x57], 2
je 0x1000c501
cmp dword [ebp - 0xe0], ebx
je 0x1000c4f8
push dword [ebp - 0xe0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xe0], ebx
mov dword [ebp], ebx
push ebx
push ebx
push 4
lea eax, [ebp - 0x1a8]
push eax
push 7
push 0x40000000
push dword [ebp + 4]
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x80], ebx
call fcn.10005b9d
mov edi, eax
cmp edi, ebx
jne 0x1000c596
push ebx
push 0x2000000
push 4
lea eax, [ebp - 0x1a8]
push eax
push 7
push 0x40000000
push dword [ebp + 4]
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x80], ebx
call fcn.10005b9d
mov edi, eax
cmp edi, ebx
jne 0x1000c596
push ebx
push 0x2000000
push 3
lea eax, [ebp - 0x1a8]
push eax
push 7
push 0x40000000
push dword [ebp + 4]
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x80], ebx
call fcn.10005b9d
mov edi, eax
cmp edi, ebx
jne 0x1000c596
lea ecx, [ebp - 0x40]
call fcn.1003f96c
lea ecx, [ebp - 0x98]
call fcn.1003f96c
mov eax, dword [ebp + 0x58]
jmp 0x1000c2da
cmp esi, ebx
je 0x1000c5a5
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [ebp + 0x57], 1
jne 0x1000c5b0
mov dword [ebp - 0x18], edi
jmp 0x1000c57b
cmp byte [ebp + 0x57], 3
mov dword [ebp], edi
je 0x1000c5ab
mov dword [ebp - 0xe0], edi
jmp 0x1000c57b
mov ecx, dword [ebp - 0x50]
cmp ecx, ebx
mov edx, 0x100
je 0x1000c5dc
lea eax, [ebp - 0x270]
or dword [eax + 0x2c], edx
mov dword [ebp - 4], edi
mov dword [eax + 0x38], ecx
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x1000c5f2
lea eax, [ebp - 0x270]
or dword [eax + 0x2c], edx
mov dword [ebp - 4], edi
mov dword [eax + 0x3c], ecx
mov ecx, dword [ebp]
cmp ecx, ebx
je 0x1000c608
lea eax, [ebp - 0x270]
or dword [eax + 0x2c], edx
mov dword [ebp - 4], edi
mov dword [eax + 0x40], ecx
mov ecx, dword [ebp + 0x4c]
push edi
push ebx
lea eax, [ebp - 0x168]
push eax
push dword [ebp + 0x38]
call fcn.10058f7c
mov eax, dword [ebp - 0x168]
mov dword [ebp + 0x64], eax
push 6
pop edi
mov esi, 0x10000000
mov eax, dword [ebp + 0x64]
mov ax, word [eax]
cmp ax, 0x21
je 0x1000c667
cmp ax, 0x2a
je 0x1000c667
cmp ax, 0x40
jne 0x1000c670
push str.WinSta0WinLogon
lea ecx, [ebp - 0x11c]
call fcn.100502c8
mov ecx, dword [ebp - 0x11c]
inc byte [ebp + 0x1b]
lea eax, [ebp - 0x270]
mov dword [eax + 8], ecx
mov dword [ebp - 0x14], esi
add dword [ebp + 0x64], 2
jmp 0x1000c62d
cmp ax, 0x3d
jne 0x1000c682
or dword [ebp + 0x20], 1
inc dword [ebp - 0x100]
jmp 0x1000c66a
cmp ax, 0x24
jne 0x1000c68e
mov byte [ebp + 0x47], 1
jmp 0x1000c66a
cmp ax, 0x26
jne 0x1000c69d
mov dword [ebp - 0x14], 3
jmp 0x1000c66a
cmp ax, 0x5e
jne 0x1000c6a8
mov dword [ebp - 0x14], edi
jmp 0x1000c66a
cmp ax, 0x5f
je 0x1000c6a3
cmp dword [ebp - 0x14], esi
je 0x1000c6d7
cmp byte [ebp + 0x2f], bl
je 0x1000c6d7
push str.WinSta0Default
lea ecx, [ebp - 0x11c]
call fcn.100502c8
mov ecx, dword [ebp - 0x11c]
lea eax, [ebp - 0x270]
mov dword [eax + 8], ecx
lea edi, [ebp - 0x270]
cmp dword [edi + 8], ebx
je 0x1000c6f5
test byte [ebp + 0x1b], 1
je 0x1000c6f5
call fcn.1000a4aa
cmp eax, 1
jge 0x1000c6f5
mov dword [edi + 8], ebx
mov eax, dword [ebp + 0x78]
cmp eax, ebx
je 0x1000c710
or byte [edi + 0x2d], 1
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x34], ebx
mov dword [ebp - 4], 1
mov dword [edi + 0x3c], eax
cmp dword [ebp + 0x24], ebx
je 0x1000c71e
cmp dword [ebp + 0x20], ebx
je 0x1000c71e
or dword [ebp + 0x24], 0x10
cmp byte [ebp + 0x47], bl
je 0x1000c73e
mov eax, dword [ebp - 0x110]
cmp word [eax], bx
jne 0x1000c73e
push 0x100c7df4
lea ecx, [ebp - 0x110]
call fcn.1005026c
cmp byte [ebp - 0x6b], bl
je 0x1000c78f
push 0x5c
push dword [ebp + 0x64]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
cmp edi, ebx
je 0x1000c758
inc edi
inc edi
jmp 0x1000c75b
mov edi, dword [ebp + 0x64]
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push dword [ebp + 0x64]
xor eax, eax
cmp dword [ebp + 0x20], ebx
push 1
setne al
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
add eax, 0x80000001
push eax
call fcn.10040c59
add esp, 0x18
mov ebx, eax
jmp 0x1000f0e7
lea eax, [ebp + 0x64]
push eax
call fcn.1003f9c4
cmp dword [ebp - 0x70], ebx
pop ecx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x12c], ebx
je 0x1000c848
lea ecx, [ebp - 0x40]
mov byte [ebp + 0x47], bl
call fcn.10046123
mov ecx, dword [ebp + 0x4c]
push 0xffffffffffffffff
push ebx
push dword [ebp - 0x70]
call fcn.100152b4
cmp eax, ebx
je 0x1000c836
mov ecx, dword [eax]
cmp word [ecx], bx
je 0x1000c836
push eax
lea ecx, [ebp - 0x40]
call fcn.1005029a
push dword [ebp + 0x64]
lea ecx, [ebp - 0x12c]
call fcn.100502c8
push dword [ebp - 0x158]
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0x40]
call fcn.1000808f
mov edi, eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp + 0x28], eax
mov eax, dword [ebp - 0x12c]
add esp, 0x14
lea ecx, [ebp - 0x40]
mov dword [ebp + 0x64], eax
call fcn.1003f96c
cmp edi, ebx
je 0x1000c848
mov ebx, edi
jmp 0x1000f0d1
lea ecx, [ebp - 0x40]
call fcn.1003f96c
mov ebx, 0x80070057
jmp 0x1000f0d1
mov eax, dword [ebp - 0x140]
cmp word [eax], bx
je 0x1000c8aa
push dword [ebp + 0x64]
call fcn.100132bf
pop ecx
push 0xffffffffffffffff
push str.__k:0
lea ecx, [ebp + 0x74]
mov dword [ebp + 0x64], eax
call fcn.10050221
push dword [ebp + 0x64]
lea ecx, [ebp + 0x74]
call fcn.1004618f
push 0x100c7d88
lea ecx, [ebp + 0x74]
call fcn.1004618f
push dword [ebp - 0x140]
lea ecx, [ebp + 0x74]
call fcn.1004618f
mov ecx, dword [ebp + 0x4c]
push ebx
push dword [ebp + 0x74]
call fcn.1006e798
mov ebx, eax
lea ecx, [ebp + 0x74]
jmp 0x1000f0cc
cmp byte [ebp - 0x71], bl
je 0x1000ca77
lea ecx, [ebp + 0x78]
call fcn.10046123
push dword [ebp + 0x64]
mov dword [ebp + 0x40], ebx
call fcn.100132bf
pop ecx
lea ecx, [ebp + 0x70]
mov dword [ebp + 0x64], eax
call fcn.10046123
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x70]
push eax
push dword [ebp + 0x64]
mov dword [ebp + 8], ebx
call fcn.1009e76f
mov eax, dword [ebp + 8]
add esp, 0xc
cmp eax, ebx
jne 0x1000c8ff
lea ecx, [ebp + 0x70]
call fcn.1003f96c
lea ecx, [ebp + 0x78]
jmp 0x1000c839
mov word [eax - 2], bx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push dword [ebp + 0x70]
lea ecx, [ebp - 0x48]
mov dword [ebp + 0x74], eax
call fcn.100501eb
push dword [ebp + 8]
mov edi, dword [ebp - 0x48]
lea ecx, [ebp + 0x7c]
call fcn.100501eb
push dword [ebp + 0x74]
lea eax, [ebp + 0x78]
push eax
lea eax, [ebp + 0x40]
push eax
push dword [ebp + 0x7c]
push edi
call fcn.1000a26f
add esp, 0x14
cmp dword [ebp + 0x40], ebx
mov edi, 0x100
jle 0x1000c996
mov eax, dword [ebp + 0x4c]
cmp dword [eax + 0x28], ebx
jne 0x1000c957
push ebx
push eax
call fcn.10012b49
pop ecx
pop ecx
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax + 0x28]
xor esi, esi
cmp eax, ebx
je 0x1000c966
mov esi, dword [eax + 0x18]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
push esi
push ebx
push dword [ebp - 0x190]
push dword [ebp - 0x194]
push 0x128
push dword [ebp + 0x74]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
push ebx
push ebx
push esi
mov edi, eax
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [ebp + 0x74]
call dword [sym.imp.USER32.dll_DestroyMenu]
lea eax, [edi - 0x100]
cmp eax, ebx
jl 0x1000ca57
cmp eax, dword [ebp + 0x40]
jge 0x1000ca57
cmp eax, ebx
mov ecx, dword [ebp + 0x78]
mov dword [ebp + 0x74], ecx
jle 0x1000c9fb
mov esi, eax
lea eax, [ebp + 0x74]
call fcn.10005b53
mov eax, dword [ebp + 0x74]
movzx eax, word [eax]
push eax
call fcn.1000f7ed
add esp, 4
test al, al
je 0x1000c9e1
add dword [ebp + 0x74], 2
mov eax, dword [ebp + 0x74]
movzx eax, word [eax]
push eax
call fcn.1000f7ed
add esp, 4
test al, al
je 0x1000c9f8
add dword [ebp + 0x74], 2
dec esi
jne 0x1000c9c2
mov esi, dword [ebp + 0x74]
lea eax, [ebp + 0x74]
call fcn.10005b53
mov eax, dword [ebp + 0x74]
mov word [eax], bx
cmp word [esi], bx
je 0x1000ca57
push 0xffffffffffffffff
push str.__k:0
lea ecx, [ebp + 0x68]
call fcn.10050221
push dword [ebp + 0x64]
lea ecx, [ebp + 0x68]
call fcn.1004618f
push 0x100c7d88
lea ecx, [ebp + 0x68]
call fcn.1004618f
push esi
lea ecx, [ebp + 0x68]
call fcn.1004618f
mov ecx, dword [ebp + 0x4c]
push ebx
push dword [ebp + 0x68]
call fcn.1006e798
lea ecx, [ebp + 0x68]
mov ebx, eax
call fcn.1003f96c
lea ecx, [ebp + 0x7c]
call fcn.1003f96c
lea ecx, [ebp - 0x48]
call fcn.1003f96c
lea ecx, [ebp + 0x70]
call fcn.1003f96c
lea ecx, [ebp + 0x78]
jmp 0x1000f0cc
push dword [ebp + 0x64]
lea ecx, [ebp - 0x120]
call fcn.100501eb
cmp byte [ebp - 0x2d], bl
je 0x1000cb47
push str.PECMDpecmd_cmd
lea ecx, [ebp - 0x120]
call fcn.100502c8
push 1
lea eax, [ebp + 0x64]
push ebx
push eax
call fcn.1001a65a
add esp, 0xc
push eax
lea ecx, [ebp - 0x120]
mov dword [ebp + 0x64], eax
call fcn.1004618f
lea eax, [ebp - 0xe8]
push eax
call fcn.100047c7
pop ecx
mov dword [ebp + 0x28], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10000000
mov eax, dword [ebp - 0x120]
mov dword [ebp + 0x64], eax
je 0x1000cae5
cmp byte [ebp - 0x59], bl
je 0x1000caef
lea eax, [ebp - 0x270]
or byte [eax + 0x2c], 0x80
xor edi, edi
cmp ecx, ebx
je 0x1000cb03
lea eax, [ebp - 0x270]
or dword [eax + 0x2c], 1
mov word [eax + 0x30], cx
mov al, byte [ebp + 0x1b]
and al, 3
inc edi
cmp al, 3
je 0x1000cb12
cmp byte [ebp - 0x31], bl
je 0x1000cb1c
lea eax, [ebp - 0x270]
or byte [eax + 0x2f], 8
cmp dword [ebp - 0x114], ebx
jg 0x1000e2be
lea eax, [ebp - 0x270]
cmp dword [eax + 8], ebx
je 0x1000ce01
cmp byte [ebp + 0x1b], bl
jle 0x1000ce01
mov eax, edi
jmp 0x1000ce03
cmp byte [ebp - 0x41], bl
je 0x1000cacc
cmp dword [ebp - 0x14], esi
je 0x1000cacc
mov eax, dword [ebp - 0x120]
push ebx
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x64]
push ebx
push eax
mov dword [ebp + 4], ebx
call fcn.1001a65a
mov esi, eax
mov eax, dword [ebp + 0x64]
mov dword [ebp + 4], eax
push 3
lea eax, [ebp + 4]
push eax
push 0x100c7d84
call fcn.10048195
add esp, 0x18
test al, al
jne 0x1000cc51
push 7
lea eax, [ebp + 4]
push eax
push str.cmd.exe
call fcn.10048195
add esp, 0xc
test al, al
jne 0x1000cc51
cmp dword [0x100e2cc4], ebx
jne 0x1000cbfb
push ebx
push 0x24
lea eax, [ebp - 0x5a0]
push eax
push ebx
mov word [ebp - 0x5a0], bx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x5a0]
mov edi, 0x100e2cc4
push eax
mov ecx, edi
call fcn.100502c8
push str.System32cmd.exe
mov ecx, edi
call fcn.1004618f
push dword [0x100e2cc4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [0x100e2c74], ax
movsx eax, word [0x100e2c74]
push eax
push dword [ebp + 4]
mov dword [ebp + 0x38], ebx
push dword [0x100e2cc4]
call fcn.1000f6d2
add esp, 0xc
test al, al
je 0x1000ccc6
movsx eax, word [0x100e2c74]
mov ecx, dword [ebp + 4]
lea ecx, [ecx + eax*2]
xor eax, eax
mov ax, word [ecx]
cmp ax, 0x22
je 0x1000cc44
call fcn.10002df6
test al, al
je 0x1000ccc6
lea eax, [ebp + 4]
push eax
mov dword [ebp + 4], ecx
call fcn.10008e60
pop ecx
push 2
lea eax, [ebp + 4]
push eax
push 0x100c7d54
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000ccc6
mov eax, dword [ebp + 4]
cmp word [eax], 0x22
jne 0x1000ccac
add eax, 2
mov dword [ebp + 0x78], eax
lea eax, [ebp + 0x78]
push eax
call fcn.1003f9c4
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x22
pop ecx
je 0x1000cca1
push 4
lea eax, [ebp + 0x78]
push eax
push 0x100c7d4c
call fcn.10048195
add esp, 0xc
test al, al
je 0x1000cca9
mov eax, dword [ebp + 0x78]
mov dword [ebp + 4], eax
jmp 0x1000ccac
mov eax, dword [ebp + 4]
push ebx
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x64]
push ebx
push eax
call fcn.1001a65a
add esp, 0xc
mov esi, eax
mov dword [ebp + 0x38], 1
mov eax, esi
sub eax, dword [ebp + 0x64]
and eax, 0xfffffffe
cmp eax, 8
jle 0x1000cacc
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
push 4
lea eax, [esi - 8]
push str..cmd
push eax
call edi
test eax, eax
je 0x1000cd03
push 4
push str..bat
lea eax, [esi - 8]
push eax
call edi
test eax, eax
jne 0x1000cacc
mov ax, word [esi]
push 0x64
pop ecx
push ebx
push 0x80
push 3
mov word [ebp - 0xa8], ax
xor eax, eax
push ebx
lea edi, [ebp - 0x52c]
rep stosd dword es:[edi], eax
push 7
push 0xc0000000
mov word [esi], bx
push dword [ebp + 0x64]
stosb byte es:[edi], al
lea ecx, [ebp + 0x40]
lea edi, [ebp - 0x52c]
mov byte [ebp + 0x7b], bl
mov dword [ebp + 0x40], ebx
call fcn.10005b9d
push ebx
lea eax, [ebp - 0xac]
push eax
push 0x190
mov eax, edi
push eax
push dword [ebp + 0x40]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0xb
mov eax, edi
push eax
push str.::hidecmd::
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x1000cda4
mov al, byte [ebp - 0x52c]
mov dword [ebp - 0x14], 0x10000000
jmp 0x1000cd8c
cmp al, 0xd
je 0x1000cd93
cmp al, 0xa
je 0x1000cd93
inc edi
mov al, byte [edi]
cmp al, bl
jne 0x1000cd81
jmp 0x1000cd93
inc edi
movsx ax, byte [edi]
push eax
call fcn.1000f7ed
add esp, 4
test al, al
jne 0x1000cd92
cmp dword [ebp + 0x38], ebx
jne 0x1000cdd4
cmp byte [edi], 0x3a
jne 0x1000cdb9
cmp byte [edi + 1], 0x3a
jne 0x1000cdb9
inc edi
inc edi
jmp 0x1000cdb9
inc edi
cmp byte [edi], 0x40
je 0x1000cdb8
push 7
push edi
push 0x100c7d20
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x1000cdd4
mov byte [ebp + 0x7b], 1
lea ecx, [ebp + 0x40]
call fcn.10002d56
cmp byte [ebp + 0x7b], bl
mov ax, word [ebp - 0xa8]
mov word [esi], ax
je 0x1000cacc
push dword [ebp + 0x64]
mov ecx, dword [ebp + 0x4c]
call fcn.1002335d
mov ebx, eax
jmp 0x1000f0c6
xor eax, eax
cmp eax, ebx
mov dword [ebp + 0x1c], ebx
mov dword [ebp - 0x80], ebx
je 0x1000ce17
mov dword [ebp - 0x80], edi
mov dword [ebp + 0x1c], 4
cmp byte [ebp - 0x61], bl
je 0x1000ce20
or dword [ebp + 0x1c], 0x10
push eax
lea ecx, [ebp - 0xa8]
call fcn.10014bc4
cmp byte [0x100e2e8c], bl
mov esi, dword [ebp + 0x68]
mov dword [ebp + 0x38], 0x100e3108
jne 0x1000ce59
cmp esi, ebx
je 0x1000ce47
cmp byte [esi + 8], bl
jne 0x1000ce59
cmp byte [ebp - 0x51], bl
mov byte [ebp + 0x7b], bl
je 0x1000ce5d
cmp esi, ebx
je 0x1000ce5d
mov eax, dword [esi + 0x24]
mov dword [ebp + 0x38], eax
mov byte [ebp + 0x7b], 1
push ebx
lea ecx, [ebp + 0x40]
call fcn.100501eb
cmp byte [ebp + 0x7b], bl
mov dword [ebp + 0x68], ebx
je 0x1000d0fa
push 0x100e3d7c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
lea ecx, [ebp - 0x30c]
call fcn.1001516a
cmp esi, ebx
je 0x1000ce9c
push dword [ebp + 0x38]
lea ecx, [ebp - 0x30c]
push esi
call fcn.1004232c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
push 0x106
lea ecx, [ebp]
mov dword [ebp - 0xc4], edi
call fcn.10046141
mov eax, dword [ebp]
mov dword [ebp + 0x68], eax
jmp 0x1000cf38
mov dword [ebp + 0x78], edi
jmp 0x1000ceca
cmp ax, 0x3d
je 0x1000ced4
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x1000cec4
mov esi, edi
sub esi, dword [ebp + 0x78]
sar esi, 1
cmp word [edi], bx
je 0x1000cf36
cmp word [edi + 2], bx
je 0x1000cf31
cmp esi, 0x104
jg 0x1000cf31
push esi
push dword [ebp + 0x78]
push dword [ebp + 0x68]
call fcn.10005b3b
mov eax, dword [ebp + 0x68]
add esp, 0xc
push ebx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x30c]
mov word [eax + esi*2], bx
call fcn.10010cdd
test eax, eax
jne 0x1000cf31
push 0xffffffffffffffff
push esi
lea eax, [edi + 2]
push eax
push dword [ebp + 0x78]
lea ecx, [ebp - 0x30c]
call fcn.1001520e
jmp 0x1000cf31
inc edi
inc edi
cmp word [edi], bx
jne 0x1000cf2f
inc edi
inc edi
cmp word [edi], bx
jne 0x1000cebf
push dword [ebp - 0xc4]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [ebp - 0x308]
xor esi, esi
cmp eax, ebx
mov dword [ebp + 0x3c], eax
mov dword [ebp + 0x78], ebx
jle 0x1000d002
mov eax, dword [ebp + 0x78]
mov dword [ebp - 0x90], eax
inc eax
cmp eax, dword [ebp + 0x3c]
mov dword [ebp - 0xe4], eax
mov dword [ebp + 0x68], eax
jge 0x1000cff0
mov eax, dword [ebp + 0x78]
shl eax, 2
mov dword [ebp - 0xc4], eax
mov dword [ebp + 0x38], eax
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp + 0x38]
mov ecx, dword [ecx + eax]
mov edi, dword [ebp + 0x68]
mov ecx, dword [ecx]
shl edi, 2
mov eax, dword [edi + eax]
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jge 0x1000cfb9
mov ecx, dword [ebp + 0x68]
mov dword [ebp - 0x90], ecx
mov dword [ebp + 0x38], edi
jmp 0x1000cfbf
mov ecx, dword [ebp - 0x90]
inc dword [ebp + 0x68]
mov eax, dword [ebp + 0x68]
cmp eax, dword [ebp + 0x3c]
jl 0x1000cf86
cmp ecx, dword [ebp + 0x78]
je 0x1000cff0
mov edx, dword [ebp - 0x30c]
mov eax, dword [ebp - 0xc4]
add eax, edx
mov edi, dword [eax]
shl ecx, 2
mov edx, dword [ecx + edx]
mov dword [eax], edx
mov eax, dword [ebp - 0x30c]
mov dword [ecx + eax], edi
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp + 0x3c]
mov dword [ebp + 0x78], eax
jl 0x1000cf5f
cmp dword [ebp + 0x3c], ebx
mov dword [ebp + 0x78], ebx
jle 0x1000d044
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp + 0x78]
mov eax, dword [eax + ecx*4]
push dword [eax]
call edi
mov ecx, dword [ebp + 0x78]
lea esi, [esi + eax + 1]
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + ecx*4]
push dword [eax + 4]
call edi
inc dword [ebp + 0x78]
lea esi, [esi + eax + 3]
mov eax, dword [ebp + 0x78]
cmp eax, dword [ebp + 0x3c]
jl 0x1000d010
add esi, 4
push esi
lea ecx, [ebp + 0x40]
call fcn.10046168
mov edi, dword [ebp + 0x40]
xor esi, esi
cmp dword [ebp + 0x3c], ebx
mov dword [ebp + 0x68], edi
jle 0x1000d0c6
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push eax
mov dword [ebp + 0x78], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x78]
mov dword [ebp + 8], eax
push edi
call fcn.10005b3b
mov eax, dword [ebp + 8]
lea edi, [edi + eax*2]
mov word [edi], 0x3d
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 4]
add esp, 0xc
inc edi
push eax
inc edi
mov dword [ebp + 0x78], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x78]
mov dword [ebp + 8], eax
push edi
call fcn.10005b3b
mov eax, dword [ebp + 8]
lea edi, [edi + eax*2]
add esp, 0xc
mov word [edi], bx
inc edi
inc edi
inc esi
cmp esi, dword [ebp + 0x3c]
jl 0x1000d05d
mov word [edi], bx
lea ecx, [ebp]
mov word [edi + 2], bx
call fcn.1003f96c
push ebx
lea ecx, [ebp - 0x30c]
call fcn.10036b70
lea ecx, [ebp - 0x2cc]
call fcn.1003f96c
push 0x100e3d7c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x60]
xor al, al
cmp word [ecx], 0x40
jne 0x1000d109
inc al
jmp 0x1000d113
cmp dword [ebp - 0xcc], ebx
je 0x1000d113
mov al, 2
cmp word [ebp + 0x34], bx
je 0x1000d219
or dword [ebp + 0x20], edi
or dword [ebp + 0x34], 8
neg al
sbb eax, eax
and eax, 0xfff01000
add eax, 0x100000
mov esi, eax
call fcn.1004217a
push eax
lea eax, [ebp - 0x290]
push str..pipepecmd_exec__u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
push edi
push esi
push esi
push 0xff
push 6
push 0x40000003
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, ebx
mov dword [ebp - 0x78], eax
je 0x1000d1b2
cmp eax, 0xffffffff
je 0x1000d1b2
push 0xffffffffffffffff
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp + 0x78]
call fcn.10050221
push ebx
push ebx
push 3
lea ecx, [ebp - 0x1a8]
push ecx
push 7
push 0xc0000000
push dword [eax]
lea ecx, [ebp - 0xdc]
call fcn.10005b9d
lea ecx, [ebp + 0x78]
call fcn.1003f96c
jmp 0x1000d1b9
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0xdc]
push ebx
push ebx
lea eax, [ebp - 0xc4]
push eax
push esi
mov dword [ebp - 0xc4], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1b0], eax
lea eax, [ebp - 0x270]
or byte [eax + 0x2d], 1
test byte [ebp + 0x32], 2
mov dword [ebp - 0xa0], edi
mov dword [ebp - 4], edi
jne 0x1000d20d
cmp byte [ebp + 0x32], bl
jne 0x1000d210
mov dword [eax + 0x3c], esi
test byte [ebp + 0x32], 1
je 0x1000d219
mov dword [eax + 0x40], esi
mov eax, 0x100e3d7c
push eax
mov dword [ebp - 0xac], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x68]
neg eax
sbb eax, eax
and eax, 0x400
or eax, dword [ebp - 0x24]
mov dword [ebp + 0x3c], ebx
or dword [ebp + 0x1c], eax
cmp byte [ebp - 0x2e], bl
mov dword [ebp - 0x38], ebx
mov dword [ebp], ebx
je 0x1000d252
or dword [ebp + 0x1c], 0x1000004
cmp byte [ebp - 0x39], bl
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xe4], ebx
je 0x1000d276
lea eax, [ebp - 0xc4]
push eax
call fcn.10003ea0
pop ecx
mov dword [ebp - 0xe4], eax
cmp byte [ebp + 0x47], bl
mov esi, dword [ebp + 0x28]
je 0x1000d286
cmp esi, ebx
je 0x1000e04b
cmp byte [ebp - 0x6a], bl
je 0x1000d348
cmp word [ebp - 0x2c], bx
jne 0x1000d348
cmp word [ebp + 0xc], bx
jne 0x1000d348
push dword [ebp + 0x64]
lea eax, [ebp + 0x3c]
push esi
push dword [ebp + 0x50]
push eax
call fcn.100046f3
mov edi, eax
push edi
call fcn.100047eb
add esp, 0x14
test eax, eax
jne 0x1000d562
cmp dword [ebp - 0x10], ebx
push ebx
je 0x1000d30c
movzx eax, word [ebp - 0x10]
push 0x100c7504
push ebx
or eax, 2
push eax
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp + 0x1c]
push edi
push dword [ebp + 0x68]
push eax
push dword [ebp - 4]
push ebx
push ebx
push dword [ebp + 0x64]
push esi
call fcn.10005c64
add esp, 0x38
mov dword [ebp - 8], eax
jmp 0x1000de19
call fcn.10004658
pop ecx
mov dword [ebp - 0x160], eax
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp + 0x1c]
push edi
push dword [ebp + 0x68]
push eax
push dword [ebp - 4]
push ebx
push ebx
push dword [ebp + 0x64]
push esi
push dword [ebp - 0x160]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x1000d304
mov eax, dword [ebp - 0xbc]
cmp word [eax], bx
je 0x1000d534
cmp word [ebp - 0x2c], bx
jne 0x1000d534
cmp word [ebp + 0xc], bx
jne 0x1000d534
xor edi, edi
inc edi
cmp byte [ebp - 0x2f], bl
mov dword [ebp - 8], ebx
je 0x1000d3d4
push eax
lea ecx, [ebp - 0x84]
call fcn.10002db7
lea ecx, [ebp + 0x78]
call fcn.10045faf
push dword [ebp - 0xbc]
call fcn.1003f93e
lea eax, [ebp + 0x78]
push eax
push dword [ebp - 0x84]
call fcn.1004c245
add esp, 0xc
push 0xffffffffffffffff
mov edi, eax
neg edi
push 0xffffffffffffffff
push dword [ebp + 0x78]
sbb edi, edi
lea ecx, [ebp - 0xbc]
neg edi
call fcn.100461de
lea ecx, [ebp + 0x78]
call fcn.1003f992
lea ecx, [ebp - 0x84]
call fcn.1003f992
cmp byte [ebp - 9], bl
je 0x1000d443
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x84]
call fcn.10002db7
lea ecx, [ebp + 0x78]
call fcn.10045faf
push dword [ebp - 0xb8]
call fcn.1003f93e
cmp edi, ebx
pop ecx
je 0x1000d41c
lea eax, [ebp + 0x78]
push eax
push dword [ebp - 0x84]
call fcn.1004c245
test eax, eax
pop ecx
pop ecx
je 0x1000d41c
xor edi, edi
inc edi
jmp 0x1000d41e
xor edi, edi
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x78]
lea ecx, [ebp - 0xb8]
call fcn.100461de
lea ecx, [ebp + 0x78]
call fcn.1003f992
lea ecx, [ebp - 0x84]
call fcn.1003f992
cmp edi, ebx
je 0x1000d517
mov edi, dword [ebp - 0xbc]
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x40
push edi
call esi
cmp eax, ebx
jne 0x1000d469
push 0x5c
push edi
call esi
cmp eax, ebx
je 0x1000d477
mov word [eax], bx
mov esi, dword [ebp - 0xbc]
lea edi, [eax + 2]
jmp 0x1000d47c
mov esi, 0x100c7504
push dword [ebp + 0x64]
lea eax, [ebp + 0x3c]
push dword [ebp + 0x28]
push dword [ebp + 0x50]
push eax
call fcn.100046f3
push eax
mov dword [ebp + 0x50], eax
call fcn.100047eb
add esp, 0x14
test eax, eax
jne 0x1000d562
cmp dword [ebp - 0x10], ebx
je 0x1000d4e2
push dword [ebp - 0xb8]
movzx eax, word [ebp - 0x10]
push esi
push edi
push eax
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
push dword [ebp + 0x50]
mov eax, dword [ebp - 0x1c]
push dword [ebp + 0x68]
or eax, 1
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x64]
push dword [ebp + 0x28]
call fcn.10005c64
add esp, 0x38
jmp 0x1000d514
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
push dword [ebp + 0x50]
mov eax, dword [ebp - 0x1c]
push dword [ebp + 0x68]
or eax, 1
push dword [ebp + 0x1c]
push dword [ebp + 0x64]
push dword [ebp + 0x28]
push eax
push dword [ebp - 0xb8]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [ebp - 8], eax
push dword [ebp - 0xb8]
call fcn.1003f93e
push dword [ebp - 0xbc]
call fcn.1003f93e
pop ecx
pop ecx
jmp 0x1000de19
cmp byte [ebp + 0x33], bl
je 0x1000d5b5
cmp esi, ebx
je 0x1000d543
cmp word [esi], 0x26
je 0x1000d5b5
cmp word [ebp - 0x20], bx
jne 0x1000d5b5
cmp word [ebp - 0x2c], bx
jne 0x1000d5b5
cmp word [ebp + 0xc], bx
jne 0x1000d5b5
push dword [ebp + 0x50]
call fcn.100047eb
test eax, eax
pop ecx
je 0x1000d56e
mov dword [ebp + 0x14], 3
jmp 0x1000e156
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x7c]
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
push dword [ebp + 0x50]
push dword [ebp + 0x68]
push dword [ebp + 0x1c]
push dword [ebp - 4]
push dword [ebp + 0x64]
push dword [ebp - 0x1b8]
push dword [ebp - 0x1bc]
call fcn.100a2b01
xor ecx, ecx
add esp, 0x2c
test eax, eax
setg cl
mov dword [ebp - 8], ecx
jmp 0x1000de19
lea ecx, [ebp - 0xd8]
mov dword [ebp + 0x28], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp + 0x78], esi
mov dword [ebp - 0x68], esi
call fcn.10045faf
cmp word [ebp + 0xc], bx
lea eax, [ebp - 0x90]
mov dword [ebp - 0x7c], eax
lea eax, [ebp + 0x58]
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp + 0x58], ebx
mov dword [ebp + 8], eax
je 0x1000d6a8
push 0x22
pop edi
cmp word [esi], di
jne 0x1000d611
add esi, 2
mov dword [ebp + 0x78], esi
push 0x3a
lea eax, [ebp + 0x78]
mov dword [ebp - 0xa4], esi
call fcn.100a1095
mov eax, dword [ebp + 0x78]
cmp eax, esi
pop ecx
je 0x1000d633
cmp word [eax - 2], di
jne 0x1000d633
mov word [eax - 2], bx
cmp word [eax], 0x3a
jne 0x1000d63e
mov word [eax], bx
inc eax
inc eax
cmp word [eax], di
mov esi, eax
jne 0x1000d657
lea esi, [eax + 2]
inc eax
inc eax
cmp word [eax], di
jne 0x1000d652
mov word [eax], bx
cmp word [eax], bx
jne 0x1000d648
cmp word [ebp - 0x2c], bx
je 0x1000d675
push 0x3a
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp + 0x28], eax
je 0x1000d675
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x28], eax
push ebx
push ebx
push 0x10000
push esi
lea eax, [ebp - 0xd8]
push eax
push dword [ebp - 0xa4]
call fcn.1003d5a1
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd0]
add esp, 0x18
add ecx, eax
mov dword [ebp + 0x14], ecx
jmp 0x1000d8dd
cmp esi, ebx
je 0x1000d77a
cmp word [esi], 0x26
jne 0x1000d761
mov ecx, dword [ebp + 0x4c]
push ebx
push 0xffffffffffffffff
push ebx
push esi
call fcn.10010cdd
mov esi, eax
cmp esi, ebx
jne 0x1000d728
lea ecx, [ebp + 0x58]
call fcn.1003f96c
lea ecx, [ebp - 0xd8]
call fcn.1003f96c
lea ecx, [ebp - 0x24]
call fcn.1003f96c
lea ecx, [ebp]
call fcn.1003f96c
lea ecx, [ebp - 0x38]
call fcn.1003f96c
lea ecx, [ebp + 0x3c]
call fcn.1003f96c
push 0x100e3d7c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp + 0x40]
call fcn.1003f96c
lea ecx, [ebp - 0xa8]
call fcn.10014bfa
mov ebx, 0x80070057
jmp 0x1000f0c6
mov eax, dword [esi + 0x10]
mov dword [ebp - 0xd4], eax
add eax, 0x10
push eax
lea ecx, [ebp - 0xd8]
call fcn.10045ff1
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0xd4]
inc eax
push eax
push dword [esi + 4]
push dword [ebp - 0xd8]
call fcn.100144ff
add esp, 0xc
jmp 0x1000d8dd
mov al, byte [ebp + 0x31]
neg al
sbb eax, eax
and eax, 2
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.1004e376
pop ecx
pop ecx
mov dword [ebp - 0x70], eax
mov edi, dword [ebp - 0x70]
cmp edi, ebx
mov dword [ebp - 0x19c], ebx
jne 0x1000d81d
mov eax, dword [ebp + 0x64]
cmp eax, ebx
je 0x1000d79b
cmp word [eax], 0x2a
jne 0x1000d79b
inc dword [ebp - 0x20]
cmp byte [ebp + 0x33], bl
je 0x1000d7a3
mov dword [ebp - 0x20], ebx
cmp word [ebp - 0x2c], bx
je 0x1000de32
push 0x3a
push ebx
push dword [ebp - 0x68]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov edi, eax
cmp edi, ebx
mov dword [ebp + 0x28], edi
je 0x1000d812
push 2
pop eax
mov word [edi], bx
add edi, eax
mov dword [ebp + 0x28], edi
je 0x1000d812
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x68]
cmp word [eax], 0x22
mov dword [ebp - 0x7c], ebx
mov dword [ebp + 8], ebx
jne 0x1000d802
inc eax
inc eax
mov dword [ebp - 0x68], eax
mov dword [ebp + 0x78], eax
push 0x22
lea eax, [ebp + 0x78]
call fcn.100a1095
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
pop ecx
je 0x1000d802
mov word [eax], bx
push dword [ebp - 0x68]
lea ecx, [ebp + 0x58]
call fcn.1005026c
jmp 0x1000d90f
mov edi, dword [ebp - 0x70]
cmp edi, ebx
je 0x1000de32
cmp word [ebp - 0x2c], bx
je 0x1000d83c
push 0x3a
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
mov dword [ebp + 0x28], eax
je 0x1000d83c
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x28], eax
add dword [ebp - 0x70], 2
push 0x100c7cf8
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.100578fe
mov si, word [edi]
mov dword [ebp - 0xa4], eax
mov eax, dword [0x100e2fc0]
mov word [edi], bx
mov edx, dword [ebp - 0x68]
mov dword [ebp + 0x38], 0x20
mov cx, word [edx]
add esp, 0xc
cmp cx, 0x2e
mov dword [ebp + 0x78], ebx
jne 0x1000d88c
cmp word [edx + 2], bx
jne 0x1000d88c
mov eax, dword [0x100e2c88]
jmp 0x1000d89e
cmp cx, bx
je 0x1000d89e
push 2
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp + 0x78], eax
cmp eax, ebx
mov word [edi], si
je 0x1000d8cf
lea ecx, [ebp + 0x38]
push ecx
lea ecx, [ebp - 0xd8]
push ecx
push dword [ebp - 0xa4]
mov dword [ebp + 0x38], 0x20
push dword [ebp - 0x19c]
push eax
call fcn.100155e3
add esp, 0x14
mov dword [ebp + 0x14], eax
cmp dword [ebp + 0x78], ebx
je 0x1000d8dd
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0xd4], ebx
je 0x1000ddfe
cmp dword [ebp + 0x14], ebx
je 0x1000ddfe
cmp word [ebp - 0x20], bx
mov dword [ebp - 0x118], 1
ja 0x1000d90c
cmp word [ebp - 0x2c], bx
je 0x1000dd23
mov edi, dword [ebp + 0x28]
cmp dword [ebp + 8], ebx
mov eax, dword [ebp - 0x124]
jne 0x1000d91f
mov eax, 0x100c7380
push eax
push str.exedat
push dword [ebp - 0x7c]
lea eax, [ebp - 0x58]
push dword [ebp + 8]
push eax
call fcn.10005f64
add esp, 0x14
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x38]
call fcn.1005029a
mov esi, dword [ebp - 0x90]
lea eax, [ebp + 0x58]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x90]
cmp esi, ebx
mov dword [ebp - 0x7c], eax
setne al
cmp al, bl
mov dword [ebp - 0x144], ebx
je 0x1000d98f
push ebx
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0xd4]
push dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.10043a48
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000d99c
cmp dword [ebp - 0x118], 1
jle 0x1000ddfe
cmp edi, ebx
push dword [ebp - 0x58]
mov byte [ebp + 0x7b], bl
je 0x1000dafa
mov eax, dword [ebp + 0x58]
lea ecx, [ebp + 0x58]
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x58], ebx
call fcn.100502c8
push str..ex
lea ecx, [ebp + 0x58]
call fcn.1004618f
lea eax, [ebp + 0x58]
push eax
lea ecx, [ebp - 0x38]
call fcn.1005029a
cmp word [edi], 0x5c
mov esi, edi
je 0x1000d9e4
lea esi, [edi - 2]
mov word [esi], 0x5c
push ebx
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp word [ebp - 0x2c], 1
jne 0x1000da3d
push 0x100c7cc8
lea ecx, [ebp + 0xc]
call fcn.10001000
push dword [ebp + 0x38]
lea ecx, [ebp + 0xc]
call fcn.1004618f
push 0x100c7cc0
lea ecx, [ebp + 0xc]
call fcn.1004618f
push dword [ebp + 0x58]
lea ecx, [ebp + 0xc]
call fcn.1004618f
push dword [ebp + 0xc]
mov ecx, dword [ebp + 0x4c]
call fcn.100317a4
lea ecx, [ebp + 0xc]
call fcn.1003f96c
jmp 0x1000dadb
cmp word [ebp - 0x2c], 0x100
jne 0x1000dadb
push 0xf
pop ecx
xor eax, eax
mov dword [ebp - 0x398], 0x44
mov dword [ebp - 0x394], ebx
lea edi, [ebp - 0x390]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xfc], ebx
lea edi, [ebp - 0xf8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x398]
push eax
push dword [ebp - 0x38]
mov dword [ebp - 0x36c], 0x80
push ebx
push dword [ebp - 0x1c]
push ebx
push ebx
push ebx
push 0x100c7cb8
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [ebp - 0xfc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0xfc], ebx
je 0x1000dac7
push dword [ebp - 0xfc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xf8], ebx
je 0x1000dadb
push dword [ebp - 0xf8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
lea ecx, [ebp + 0x58]
call fcn.1004618f
lea eax, [ebp + 0x58]
push eax
lea ecx, [ebp + 0x3c]
call fcn.1005029a
lea ecx, [ebp + 0x38]
call fcn.1003f96c
jmp 0x1000db02
lea ecx, [ebp - 0x38]
call fcn.100502c8
mov edx, dword [ebp + 0x64]
mov si, word [edx]
cmp si, 0x22
mov eax, edx
jne 0x1000db13
lea eax, [edx + 2]
cmp word [eax], 0x3f
jne 0x1000dba0
lea edi, [eax + 2]
mov cx, word [edi]
cmp cx, 0x3f
jne 0x1000db31
mov esi, dword [ebp + 0x58]
lea edi, [eax + 4]
jmp 0x1000db75
cmp cx, 0x5c
jne 0x1000dba0
cmp si, 0x22
je 0x1000db72
mov eax, dword [ebp - 0x38]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x38]
mov dword [ebp + 0x38], eax
mov dword [ebp - 0x38], ebx
call fcn.10046168
mov eax, dword [ebp - 0x38]
push esi
mov word [eax], bx
push dword [ebp - 0x38]
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea ecx, [ebp + 0x38]
call fcn.1003f96c
mov edx, dword [ebp + 0x64]
mov esi, dword [ebp - 0x38]
cmp word [edx], 0x22
jne 0x1000db88
push 0x100c6cf8
lea ecx, [ebp]
call fcn.100502c8
push esi
lea ecx, [ebp]
call fcn.1004618f
push edi
lea ecx, [ebp]
call fcn.1004618f
mov edx, dword [ebp]
mov dword [ebp + 0x64], edx
cmp dword [ebp + 0x28], ebx
je 0x1000dc03
cmp word [ebp - 0x20], bx
ja 0x1000dbd9
lea eax, [ebp - 0xd8]
push eax
push dword [ebp + 0x3c]
mov dword [ebp + 0x28], ebx
call fcn.10014f8e
cmp dword [ebp - 0xd4], ebx
pop ecx
pop ecx
je 0x1000dc00
mov eax, dword [ebp - 0xd8]
mov byte [ebp + 0x7b], 1
mov dword [ebp + 0x14], eax
jmp 0x1000dcf4
cmp byte [ebp + 0x47], bl
je 0x1000dc03
cmp dword [ebp + 0x50], ebx
jne 0x1000dbe9
mov eax, dword [ebp - 0x38]
mov dword [ebp + 0x50], eax
cmp word [ebp - 0x20], 2
mov dword [ebp + 0x28], ebx
mov byte [ebp + 0x7b], 2
jb 0x1000e030
jmp 0x1000dcf4
mov edx, dword [ebp + 0x64]
mov eax, dword [ebp + 0x28]
cmp eax, ebx
mov edi, dword [ebp + 0x58]
je 0x1000dc14
cmp word [eax], bx
jne 0x1000dc14
xor edi, edi
mov eax, dword [ebp + 0x50]
cmp eax, ebx
jne 0x1000dc1e
mov eax, dword [ebp - 0x38]
push edx
push dword [ebp + 0x58]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.100046f3
mov esi, eax
push esi
mov dword [ebp + 0x50], esi
call fcn.100047eb
add esp, 0x14
test eax, eax
jne 0x1000de52
cmp dword [ebp + 0x24], ebx
je 0x1000dc76
push dword [ebp + 0x24]
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp + 0x1c]
push esi
push dword [ebp + 0x68]
push eax
push dword [ebp - 4]
push ebx
push ebx
push dword [ebp + 0x64]
push edi
call fcn.100030f7
add esp, 0x2c
jmp 0x1000dcdd
cmp dword [ebp - 0x10], ebx
je 0x1000dcb3
movzx eax, word [ebp - 0x10]
push ebx
push 0x100c7504
push ebx
push eax
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp + 0x1c]
push esi
push dword [ebp + 0x68]
push eax
push dword [ebp - 4]
push ebx
push ebx
push dword [ebp + 0x64]
push edi
call fcn.10005c64
add esp, 0x38
jmp 0x1000dcdd
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp + 0x1c]
push esi
push dword [ebp + 0x68]
push eax
push dword [ebp - 4]
push ebx
push ebx
push dword [ebp + 0x64]
push edi
call fcn.100b3848
add esp, 0x28
cmp byte [ebp - 0x20], 2
mov dword [ebp - 8], eax
jl 0x1000ddfe
cmp word [ebp - 0x2c], bx
jne 0x1000ddfe
cmp byte [ebp + 0x7b], 1
jne 0x1000dcff
or eax, 0xffffffff
jmp 0x1000dd08
lea eax, [ebp - 0x18c]
mov eax, dword [eax + 8]
push eax
push dword [ebp - 0x58]
call fcn.1000399b
cmp byte [ebp + 0x7b], 1
mov eax, dword [ebp - 0x58]
pop ecx
pop ecx
mov word [eax], bx
jne 0x1000de29
mov eax, dword [ebp + 0x64]
cmp word [eax], 0x22
mov edi, eax
jne 0x1000dd31
add eax, 2
cmp word [eax], 0x3f
mov dword [ebp + 0x38], ebx
jne 0x1000dd58
cmp word [eax + 2], 0x5c
jne 0x1000dd58
lea edi, [eax + 4]
cmp word [edi], 0x22
jne 0x1000dd58
dec edi
dec edi
mov ax, word [edi]
mov word [ebp + 0x38], ax
mov word [edi], 0x22
push dword [ebp + 0x50]
call fcn.100047eb
test eax, eax
pop ecx
jne 0x1000de52
lea eax, [ebp - 0x58]
push eax
push ebx
lea esi, [ebp - 0x18c]
push esi
lea eax, [ebp - 0x270]
push eax
push dword [ebp + 0x50]
push dword [ebp + 0x68]
push dword [ebp + 0x1c]
push dword [ebp - 4]
push edi
push dword [ebp - 0xd4]
push dword [ebp + 0x14]
call fcn.100a2b01
add esp, 0x2c
cmp word [ebp + 0x38], bx
mov dword [ebp - 0xa4], eax
je 0x1000ddad
mov ax, word [ebp + 0x38]
mov word [edi], ax
cmp dword [ebp - 0xa4], ebx
jl 0x1000d90c
mov esi, dword [esi + 8]
cmp esi, ebx
je 0x1000d90c
push esi
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
je 0x1000d90c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0xa4], ebx
setg al
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x58]
cmp eax, ebx
je 0x1000ddfe
cmp word [eax], bx
jne 0x1000dcf4
lea ecx, [ebp + 0x58]
call fcn.1003f96c
lea ecx, [ebp - 0xd8]
call fcn.1003f96c
lea ecx, [ebp - 0x24]
call fcn.1003f96c
cmp dword [ebp - 8], ebx
je 0x1000e148
xor eax, eax
jmp 0x1000e14e
cmp byte [ebp + 0x7b], 2
jmp 0x1000e02a
push dword [ebp + 0x64]
lea eax, [ebp + 0x3c]
push esi
push dword [ebp + 0x50]
push eax
call fcn.100046f3
push eax
mov dword [ebp + 0x50], eax
call fcn.100047eb
add esp, 0x14
test eax, eax
je 0x1000de79
lea ecx, [ebp + 0x58]
mov dword [ebp + 0x14], 3
call fcn.1003f96c
lea ecx, [ebp - 0xd8]
call fcn.1003f96c
lea ecx, [ebp - 0x24]
call fcn.1003f96c
jmp 0x1000e156
cmp word [ebp + 0x34], bx
jne 0x1000defc
push 0x5c
push ebx
push dword [ebp + 0x64]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov edi, eax
cmp edi, ebx
je 0x1000de95
inc edi
inc edi
jmp 0x1000de98
mov edi, dword [ebp + 0x64]
push 8
push edi
push str.winpeshl
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000deca
xor eax, eax
mov ax, word [edi + 0x10]
cmp ax, bx
je 0x1000dec6
cmp ax, 0x2e
je 0x1000dec6
call fcn.10002df6
test al, al
je 0x1000deca
mov byte [ebp + 0x13], 1
push 8
push edi
push str.wpeinit
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1000defc
xor eax, eax
mov ax, word [edi + 0xe]
cmp ax, bx
je 0x1000def8
cmp ax, 0x2e
je 0x1000def8
call fcn.10002df6
test al, al
je 0x1000defc
mov byte [ebp + 0x13], 1
test byte [ebp + 0x73], 1
jne 0x1000df07
cmp dword [ebp - 0x4c], ebx
je 0x1000df2f
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push dword [ebp + 0x64]
push 1
push str.Shell.x
push str.SOFTWAREPELOGON
push 0x80000002
call fcn.10040c59
add esp, 0x18
cmp dword [ebp + 0x24], ebx
je 0x1000df65
push dword [ebp + 0x24]
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
push dword [ebp + 0x50]
mov eax, dword [ebp - 0x1c]
push dword [ebp + 0x68]
or eax, dword [ebp + 0x1c]
push eax
push dword [ebp - 4]
push ebx
push ebx
push dword [ebp + 0x64]
push esi
call fcn.100030f7
add esp, 0x2c
jmp 0x1000dfd0
cmp dword [ebp - 0x10], ebx
je 0x1000dfa4
movzx eax, word [ebp - 0x10]
push ebx
push 0x100c7504
push ebx
push eax
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
push dword [ebp + 0x50]
mov eax, dword [ebp - 0x1c]
push dword [ebp + 0x68]
or eax, dword [ebp + 0x1c]
push eax
push dword [ebp - 4]
push ebx
push ebx
push dword [ebp + 0x64]
push esi
call fcn.10005c64
add esp, 0x38
jmp 0x1000dfd0
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
push dword [ebp + 0x50]
mov eax, dword [ebp - 0x1c]
push dword [ebp + 0x68]
or eax, dword [ebp + 0x1c]
push eax
push dword [ebp - 4]
push ebx
push ebx
push dword [ebp + 0x64]
push esi
call fcn.100b3848
add esp, 0x28
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x1000dfda
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], bl
je 0x1000e005
call fcn.1001a962
test eax, eax
je 0x1000dfec
or dword [ebp + 0x20], 1
cmp dword [ebp + 0x20], ebx
jne 0x1000e005
push str.waitpeinit.pecmd
call fcn.100b3871
neg eax
sbb eax, eax
neg eax
pop ecx
mov dword [ebp + 0x20], eax
cmp dword [ebp - 8], ebx
jne 0x1000ddfe
cmp byte [ebp + 0x47], bl
jne 0x1000ddfe
cmp esi, ebx
jne 0x1000ddfe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x1000ddfe
lea ecx, [ebp + 0x58]
call fcn.1003f96c
lea ecx, [ebp - 0xd8]
call fcn.1003f96c
lea ecx, [ebp - 0x24]
call fcn.1003f96c
push 0xd
xor eax, eax
pop ecx
lea edi, [ebp - 0x2a4]
mov dword [ebp - 0x2ac], 0x3c
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x14]
cmp eax, ebx
mov dword [ebp - 0x2a8], 0x4540
jne 0x1000e076
push 5
pop eax
movzx eax, ax
mov dword [ebp - 0x290], eax
mov eax, dword [ebp + 0x50]
cmp eax, ebx
je 0x1000e091
cmp word [eax], bx
je 0x1000e091
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp + 0x64]
mov dword [ebp + 0x78], eax
mov dword [ebp - 0x29c], eax
push 1
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x68], ebx
call fcn.1001a65a
mov esi, eax
mov eax, dword [ebp + 0x78]
add esp, 0xc
cmp word [esi], bx
jne 0x1000e0cd
cmp eax, dword [ebp + 0x64]
je 0x1000e0e8
push dword [ebp + 0x68]
lea ecx, [ebp - 0x16c]
push eax
call fcn.10046247
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x29c], eax
cmp word [esi], bx
je 0x1000e0f3
mov dword [ebp - 0x298], esi
push ebx
push 0x100e2bd8
push str.Kernel32.DLL
push str.GetProcessID
call fcn.10040e9d
mov edi, dword [0x100e2bd8]
add esp, 0x10
lea eax, [ebp - 0x2ac]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp edi, ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x274]
lea esi, [ebp - 0x18c]
mov dword [esi], eax
mov dword [ebp - 0x274], ebx
je 0x1000de19
push eax
call edi
mov dword [esi + 8], eax
jmp 0x1000de19
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x74]
mov dword [ecx], eax
mov dword [ebp + 0x14], eax
lea ecx, [ebp - 0x98]
call fcn.10002d56
cmp dword [ebp - 0xe4], ebx
je 0x1000e175
push dword [ebp - 0xc4]
call fcn.10003eb1
pop ecx
lea esi, [ebp - 0xc8]
mov eax, dword [esi]
cmp eax, ebx
je 0x1000e188
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x130], ebx
mov dword [esi], ebx
je 0x1000e1ac
push dword [ebp - 0x130]
lea eax, [ebp - 0x18c]
push dword [eax + 8]
push dword [ebp + 0x4c]
call fcn.10048821
add esp, 0xc
mov edx, dword [ebp - 0x164]
cmp edx, ebx
je 0x1000e1fc
push 0x26
pop esi
cmp word [edx], si
mov ecx, edx
jne 0x1000e1cf
lea eax, [edx + 2]
jmp 0x1000e1ca
mov ecx, eax
lea eax, [ecx + 2]
cmp word [eax], si
je 0x1000e1c5
cmp word [ecx], si
mov eax, ecx
jne 0x1000e1dd
lea eax, [ecx + 2]
jmp 0x1000e1dd
inc eax
inc eax
cmp word [eax], 0x3a
je 0x1000e1db
cmp word [eax], bx
je 0x1000e1fc
push edx
lea eax, [ebp - 0x18c]
push dword [eax]
push dword [ebp + 0x4c]
call fcn.1002d145
add esp, 0xc
cmp byte [ebp - 0x2e], bl
je 0x1000e222
lea esi, [ebp - 0x18c]
cmp dword [esi], ebx
je 0x1000e222
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push dword [esi]
mov dword [ebp - 0x104], eax
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push str.__LastPID
lea edi, [ebp - 0x18c]
push dword [edi + 8]
push dword [ebp + 0x4c]
call fcn.10048821
push str.__LastTID
push dword [edi + 0xc]
push dword [ebp + 0x4c]
call fcn.10048821
add esp, 0x18
cmp dword [ebp - 0x80], ebx
je 0x1000e261
push dword [edi]
push 4
push str.SeDebugPrivilege
call fcn.10013724
add esp, 0xc
test byte [ebp + 0x1c], 4
je 0x1000e275
mov edi, dword [edi + 4]
cmp edi, ebx
je 0x1000e275
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp]
call fcn.1003f96c
lea ecx, [ebp - 0x38]
call fcn.1003f96c
lea ecx, [ebp + 0x3c]
call fcn.1003f96c
lea ecx, [ebp - 0xac]
call fcn.10002d45
lea ecx, [ebp + 0x40]
call fcn.1003f96c
lea ecx, [ebp - 0xa8]
call fcn.10014bfa
lea eax, [ebp - 0xdc]
mov eax, dword [eax]
cmp eax, ebx
je 0x1000e2be
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xdc]
lea edi, [ebp - 0xc0]
mov dword [eax], ebx
mov eax, dword [edi]
cmp eax, ebx
je 0x1000e2db
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x50]
mov eax, dword [edi]
cmp eax, ebx
je 0x1000e2e9
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x18]
mov eax, dword [edi]
cmp eax, ebx
je 0x1000e2f7
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0xe0]
mov eax, dword [edi]
cmp eax, ebx
je 0x1000e308
push eax
call esi
cmp byte [ebp + 0x73], bl
mov dword [edi], ebx
jne 0x1000e314
cmp byte [ebp + 0x30], bl
je 0x1000e367
lea edi, [ebp - 0x18c]
mov eax, dword [edi]
cmp eax, ebx
je 0x1000e32c
push 0x1388
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
cmp byte [ebp + 0x73], bl
je 0x1000e367
test byte [ebp + 0x73], 1
je 0x1000e34e
mov eax, dword [edi]
push dword [edi + 8]
neg eax
sbb eax, eax
and eax, 2
or eax, 1
push eax
call fcn.1002bb27
pop ecx
pop ecx
cmp dword [ebp - 0x134], ebx
je 0x1000e367
mov ecx, dword [ebp + 0x4c]
push ebx
push ebx
push ebx
push dword [ebp - 0x134]
call fcn.10034bed
cmp dword [ebp - 8], ebx
jne 0x1000e393
cmp dword [ebp - 0x114], ebx
jg 0x1000e393
mov eax, dword [ebp - 0x60]
cmp word [eax], bx
je 0x1000eec4
mov ecx, dword [ebp + 0x4c]
push 0x100c6a64
push eax
call fcn.100457c2
jmp 0x1000eec4
lea edi, [ebp - 0x18c]
mov eax, dword [edi]
cmp eax, ebx
jne 0x1000e3a2
mov dword [ebp + 0x20], ebx
mov ecx, dword [ebp - 0xa0]
inc dword [ebp - 0xa0]
mov dword [ebp + ecx*4 - 0x1b0], eax
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x1000e3bf
push eax
call esi
cmp dword [ebp - 0x4c], ebx
mov dword [edi + 4], ebx
je 0x1000e415
mov ecx, dword [ebp + 0x4c]
push ebx
push ebx
push 0x3e8
call fcn.10011621
mov esi, dword [edi]
cmp esi, ebx
jne 0x1000e403
cmp dword [ebp - 0x114], ebx
jle 0x1000e415
push dword [ebp - 0x114]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 0x20], ebx
je 0x1000eec4
push esi
call fcn.100122ac
cmp dword [edi], ebx
pop ecx
jne 0x1000e415
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x20], ebx
je 0x1000eec4
mov al, byte [0x100e12e4]
mov esi, 0x100000
push 0x100004
lea ecx, [ebp + 0x50]
mov byte [ebp + 0x7b], al
mov dword [ebp + 0xc], esi
xor edi, edi
call fcn.10002da5
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xf0], ebx
cmp word [eax], 0x40
lea ecx, [eax + 2]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x84], ecx
mov byte [ebp + 0x73], bl
jne 0x1000e552
mov byte [ebp + 0x73], 1
mov dword [ebp - 0x1c], ecx
cmp byte [ebp - 0x69], bl
je 0x1000e4cd
mov ecx, dword [ebp + 0x4c]
push ebx
lea eax, [ebp + 0x38]
push eax
push dword [ebp - 0x1c]
mov dword [ebp + 0x38], ebx
call fcn.1004e8ba
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x38]
lea ecx, [ebp + 0x50]
call fcn.100460ab
push dword [ebp + 0x50]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea esi, [edi + 0x3ff]
and esi, 0xfffffc00
add esi, 0x100000
lea eax, [esi + 8]
push eax
lea ecx, [ebp + 0x50]
mov dword [ebp + 0xc], esi
call fcn.10045ff1
lea ecx, [ebp + 0x38]
call fcn.1003f96c
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x9c], ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x90], eax
jg 0x1000e4ff
mov dword [ebp - 0x9c], 0x3e8
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp + 0x34]
and ax, 0x101
sub ax, 0x101
neg ax
sbb eax, eax
inc eax
test byte [ebp + 0x34], 8
mov dword [ebp - 0xa8], eax
je 0x1000ea92
mov eax, dword [ebp - 0x60]
mov ax, word [eax]
cmp ax, 0x40
je 0x1000e567
cmp byte [ebp - 0x26], bl
je 0x1000e567
cmp ax, 0x26
je 0x1000e54c
mov eax, dword [ebp + 0x4c]
test byte [eax + 9], 0xf
je 0x1000e567
mov byte [ebp + 0x6b], 1
jmp 0x1000e56a
cmp dword [ebp - 0xcc], ebx
je 0x1000e472
mov byte [ebp + 0x73], 2
jmp 0x1000e472
mov byte [ebp + 0x6b], bl
push ebx
mov dword [ebp - 0xa4], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x78]
mov esi, dword [eax]
lea eax, [ebp - 0x1e0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp byte [ebp + 0x73], bl
mov dword [ebp + 8], edi
mov dword [ebp - 0x80], 1
je 0x1000e5a0
mov eax, dword [ebp + 0xc]
sub eax, edi
jmp 0x1000e5a5
mov eax, 0x100000
lea ecx, [ebp - 0x1e0]
push ecx
lea ecx, [ebp - 0xa4]
push ecx
push eax
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x50]
add eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x48], ebx
mov byte [ebp + 0x30], bl
call fcn.10046123
mov dword [ebp - 0x20], 1
mov al, byte [0x100e12e4]
cmp al, bl
mov byte [ebp + 0x7b], al
jg 0x1000e5fb
cmp dword [ebp - 0x100], 2
jl 0x1000ea14
cmp dword [ebp - 0xec], ebx
jle 0x1000e62e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xec]
jae 0x1000ea14
mov ecx, dword [ebp - 0xec]
sub ecx, eax
cmp dword [ebp - 0x9c], ecx
jbe 0x1000e62e
mov dword [ebp - 0x9c], ecx
mov ecx, dword [ebp + 0x4c]
push 0x4ff
push dword [ebp - 0x9c]
lea eax, [ebp - 0x1b0]
push ebx
push eax
push dword [ebp - 0xa0]
call fcn.10013100
cmp eax, ebx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0xe4], ebx
jne 0x1000e6fe
lea eax, [ebp - 0x78]
mov esi, dword [eax]
push ebx
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x1e0]
push eax
push esi
mov dword [ebp - 0x4c], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp dword [ebp - 0x4c], ebx
jle 0x1000e69c
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 0x4c], eax
jle 0x1000e68e
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x80], ebx
je 0x1000e69c
add edi, dword [ebp - 0x4c]
mov eax, dword [ebp + 0x50]
mov byte [eax + edi], bl
lea eax, [edi + 0x100000]
cmp eax, dword [ebp + 0xc]
jl 0x1000e6bd
add dword [ebp + 0xc], 0x100000
mov eax, dword [ebp + 0xc]
add eax, 4
push eax
lea ecx, [ebp + 0x50]
call fcn.10045ff1
cmp byte [ebp + 0x73], bl
je 0x1000e6c9
mov eax, dword [ebp + 0xc]
sub eax, edi
jmp 0x1000e6ce
mov eax, 0x100000
cmp dword [ebp - 0xa8], ebx
mov dword [ebp + 0x14], eax
je 0x1000e6e5
mov dword [ebp - 0xe4], 1
jmp 0x1000e6fe
lea ecx, [ebp - 0x1e0]
push ecx
lea ecx, [ebp - 0x4c]
push ecx
push eax
mov eax, dword [ebp + 0x50]
add eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x108]
cmp ecx, ebx
mov dword [ebp - 0x150], eax
je 0x1000e74c
mov edx, dword [ebp - 0xac]
mov ecx, edx
sub ecx, eax
add ecx, dword [ebp - 0x90]
cmp ecx, ebx
mov dword [ebp - 0x108], ecx
jle 0x1000e733
mov dword [ebp - 0x20], ebx
jmp 0x1000e74c
mov dword [ebp - 0x20], 1
add dword [ebp - 0x90], edx
add ecx, edx
cmp ecx, ebx
jle 0x1000e73a
mov dword [ebp - 0x108], ecx
cmp byte [ebp + 0x73], bl
je 0x1000e77a
sub eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x9c]
jge 0x1000e912
cmp edi, dword [ebp - 0x48]
je 0x1000ea0b
cmp eax, 0x14
jl 0x1000ea0b
jmp 0x1000e912
cmp ecx, ebx
je 0x1000e784
mov dword [ebp - 0x9c], ecx
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x1000e7b7
dec eax
cmp eax, dword [ebp - 0x144]
jne 0x1000e7b7
cmp byte [ebp + 0x73], bl
mov byte [ebp + 0x30], cl
je 0x1000ea14
cmp edi, dword [ebp - 0x48]
je 0x1000ea14
mov dword [ebp - 0x20], ecx
jmp 0x1000e912
test byte [ebp + 0x34], 1
je 0x1000e8a4
cmp edi, dword [ebp + 8]
jle 0x1000e8a4
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x50]
mov edx, dword [ebp - 0x13c]
lea esi, [ecx + eax]
mov eax, edi
sub eax, ecx
cmp dword [ebp - 0xa8], ebx
je 0x1000e82a
lea ecx, [eax - 1]
cmp ecx, ebx
mov dword [ebp + 0x78], ecx
jl 0x1000e87a
cmp byte [ecx + esi], 0xa
jne 0x1000e7fe
dec edx
cmp edx, ebx
jle 0x1000e806
dec ecx
mov dword [ebp + 0x78], ecx
jns 0x1000e7f3
jmp 0x1000e87a
inc dword [ebp + 0x78]
sub eax, dword [ebp + 0x78]
inc eax
push eax
mov eax, dword [ebp + 0x78]
add eax, esi
push eax
push esi
call fcn.100144b5
sub edi, dword [ebp + 0x78]
add esp, 0xc
mov eax, edi
sub eax, dword [ebp + 8]
mov byte [eax + esi], bl
jmp 0x1000e87a
xor ecx, ecx
test byte [ebp + 0x35], 2
je 0x1000e862
cmp eax, ebx
jle 0x1000e87a
cmp byte [ecx + esi], 0xa
jne 0x1000e841
dec edx
cmp edx, ebx
jle 0x1000e848
inc ecx
cmp ecx, eax
jl 0x1000e836
jmp 0x1000e87a
dec ecx
cmp ecx, ebx
jle 0x1000e854
cmp byte [ecx + esi], 0xd
jne 0x1000e854
dec ecx
mov eax, dword [ebp + 8]
mov byte [ecx + esi], bl
lea edi, [eax + ecx]
mov dword [ebp - 0x80], ebx
jmp 0x1000e87a
cmp eax, ebx
jle 0x1000e87a
cmp byte [ecx + esi], 0xa
jne 0x1000e875
dec edx
cmp edx, ebx
jle 0x1000ea14
inc ecx
cmp ecx, eax
jl 0x1000e866
cmp dword [ebp - 0xe4], ebx
je 0x1000e8a4
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0xa4]
push eax
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x50]
add eax, edi
push eax
lea eax, [ebp - 0x78]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 5
pop esi
dec esi
js 0x1000e5e2
cmp byte [0x100e12e4], bl
jle 0x1000e5e2
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1000e5e2
cmp dword [ebp - 0x350], 0x12
je 0x1000e8f9
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1000e8a7
cmp byte [ebp + 0x73], bl
mov byte [ebp + 0x7b], bl
mov byte [ebp + 0x30], 1
je 0x1000e5e2
cmp edi, dword [ebp - 0x48]
je 0x1000e5e2
cmp byte [ebp + 0x6b], bl
mov eax, dword [ebp - 0x150]
mov esi, dword [ebp + 0x50]
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x118], eax
mov dword [ebp - 0xf4], edi
jne 0x1000e96c
cmp dword [ebp - 0x94], 0x4b0
je 0x1000e95f
push dword [ebp - 0x94]
lea ecx, [ebp - 0x7c]
push edi
push esi
call fcn.100461de
mov esi, dword [ebp - 0x7c]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov dword [ebp - 0xf4], eax
jmp 0x1000e96c
mov word [esi + edi + 2], bx
mov eax, dword [ebp + 0x50]
mov word [eax + edi + 2], bx
cmp byte [ebp - 0x25], bl
je 0x1000e982
lea eax, [ebp - 0xf8]
push eax
push esi
call fcn.10008472
pop ecx
pop ecx
mov esi, eax
cmp byte [ebp + 0x73], 1
jne 0x1000e99f
mov ecx, dword [ebp + 0x4c]
push esi
push esi
push 0x100c6a64
push dword [ebp - 0x1c]
push dword [ebp - 0x1c]
call fcn.10042a44
jmp 0x1000e9cb
cmp byte [ebp + 0x6b], bl
je 0x1000e9bf
push ebx
push ebx
push dword [ebp - 0xf4]
push dword [ebp + 0x50]
push dword [ebp - 0x60]
push dword [ebp + 0x4c]
call fcn.10053ed6
add esp, 0x18
jmp 0x1000e9cb
mov ecx, dword [ebp + 0x4c]
push esi
push dword [ebp - 0x1c]
call fcn.100457c2
cmp dword [ebp - 0xcc], ebx
je 0x1000ea05
cmp dword [ebp - 0x20], ebx
je 0x1000ea05
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x124]
call fcn.10001000
mov ecx, dword [ebp + 0x4c]
push ebx
push ebx
push ebx
push dword [ebp - 0x124]
call fcn.10034bed
lea ecx, [ebp - 0x124]
call fcn.1003f96c
mov ecx, dword [ebp - 0x108]
cmp byte [ebp + 0x30], bl
je 0x1000e77a
lea ecx, [ebp - 0x7c]
call fcn.1003f96c
cmp dword [ebp + 0x20], 0xffffff9c
mov eax, dword [ebp + 0x50]
mov byte [eax + edi + 2], bl
mov eax, dword [ebp + 0x50]
mov byte [eax + edi + 1], bl
mov eax, dword [ebp + 0x50]
mov byte [eax + edi], bl
mov dword [ebp - 0x10], ebx
je 0x1000ebf1
cmp byte [ebp + 0x7b], bl
jle 0x1000ebf1
cmp byte [ebp + 0x12], 1
je 0x1000ebf1
cmp byte [ebp + 0x12], 2
jne 0x1000ebc3
lea eax, [ebp - 0x18c]
push dword [eax + 8]
lea eax, [ebp - 0x2d4]
push dword [ebp - 0x128]
push str._force__exitcode_d__tree__d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 0x4c]
add esp, 0x10
lea eax, [ebp - 0x2d4]
push eax
call fcn.1002a91c
jmp 0x1000ebf1
cmp dword [ebp + 0x20], 0xffffff9c
je 0x1000ea1c
mov al, byte [0x100e12e4]
cmp al, bl
mov byte [ebp + 0x7b], al
jg 0x1000eab1
cmp dword [ebp - 0x100], 2
jl 0x1000ea1c
cmp dword [ebp - 0xec], ebx
mov dword [ebp + 0x70], 0x3e8
jle 0x1000eae8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xec]
jae 0x1000ea1c
mov ecx, dword [ebp - 0xec]
sub ecx, eax
cmp ecx, 0x3e8
jae 0x1000eae8
mov dword [ebp + 0x70], ecx
mov ecx, dword [ebp + 0x4c]
push 0x4ff
push dword [ebp + 0x70]
lea eax, [ebp - 0x1b0]
push ebx
push eax
push dword [ebp - 0xa0]
call fcn.10013100
mov ecx, dword [ebp - 0xa0]
dec ecx
cmp ecx, eax
je 0x1000ea1c
cmp dword [ebp - 0xa0], 1
jle 0x1000ebb6
cmp eax, ebx
jne 0x1000ebb6
lea eax, [edi + 0x100000]
cmp eax, esi
jl 0x1000eb46
add esi, 0x100000
lea eax, [esi + 4]
push eax
lea ecx, [ebp + 0x50]
call fcn.10045ff1
mov eax, dword [ebp + 0x50]
push ebx
lea ecx, [ebp + 0x68]
push ecx
add eax, edi
push 1
push eax
lea eax, [ebp - 0x78]
push dword [eax]
mov dword [ebp + 0x68], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000ebb6
cmp dword [ebp + 0x68], ebx
jbe 0x1000ebb6
add edi, dword [ebp + 0x68]
mov eax, dword [ebp + 0x50]
mov byte [eax + edi], bl
jmp 0x1000ebb6
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1000ea98
cmp dword [ebp - 0x288], 0x12
je 0x1000ea98
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x100e12e4], bl
jg 0x1000eb75
jmp 0x1000ea98
cmp dword [ebp - 0x104], ebx
je 0x1000ebdd
push dword [ebp - 0x128]
push dword [ebp - 0x104]
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
push dword [ebp - 0x128]
lea eax, [ebp - 0x18c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp word [ebp + 0x34], bx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x74]
mov dword [ecx], eax
je 0x1000ee5d
mov eax, dword [ebp - 0x60]
mov ax, word [eax]
xor esi, esi
cmp ax, 0x40
je 0x1000ec3d
cmp byte [ebp - 0x26], bl
je 0x1000ec3d
cmp ax, 0x26
je 0x1000ec37
mov eax, dword [ebp + 0x4c]
test byte [eax + 9], 0xf
je 0x1000ec3d
mov byte [ebp + 0x77], 1
jmp 0x1000ec40
mov byte [ebp + 0x77], bl
lea ecx, [ebp - 0xb4]
call fcn.10002de2
cmp byte [ebp + 0x77], bl
mov eax, dword [ebp + 0x50]
mov dword [ebp + 0x70], eax
mov dword [ebp - 0xf4], edi
jne 0x1000ede3
cmp byte [ebp + 0x46], 2
jne 0x1000ec78
mov dword [ebp - 0xf4], edi
mov word [eax + edi], bx
mov esi, dword [ebp + 0x50]
jmp 0x1000ed0c
cmp byte [ebp + 0x46], 1
lea ecx, [ebp - 0xb4]
jne 0x1000ecab
push dword [ebp - 0x94]
push edi
push eax
call fcn.100461de
mov eax, dword [ebp - 0xb4]
push eax
mov dword [ebp + 0x70], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov dword [ebp - 0xf4], eax
jmp 0x1000ed10
lea eax, [edi + 0x18]
push eax
call fcn.10046168
lea eax, [edi + 1]
push eax
push dword [ebp + 0x50]
mov dword [ebp - 0xac], edi
push dword [ebp - 0xb4]
mov dword [ebp - 0xb0], edi
call fcn.100144ff
mov eax, dword [ebp - 0xb4]
push 0x10
add edi, eax
push ebx
push edi
call fcn.100b40f0
lea eax, [ebp - 0xb4]
push 0x2004
push eax
call fcn.100a3193
mov eax, dword [ebp - 0xb4]
mov dword [ebp + 0x70], eax
mov eax, dword [ebp - 0xb0]
add esp, 0x20
mov dword [ebp - 0xf4], eax
cmp esi, ebx
jne 0x1000ed16
mov esi, dword [ebp - 0xb4]
test byte [ebp + 0x34], 4
je 0x1000ed4e
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2 - 2]
jmp 0x1000ed3d
mov cx, word [eax]
cmp cx, 0xd
je 0x1000ed38
cmp cx, 0xa
jne 0x1000ed41
mov word [eax], bx
dec eax
dec eax
cmp eax, esi
jae 0x1000ed29
sub eax, esi
mov dword [ebp - 0xf4], eax
jmp 0x1000ede3
test byte [ebp + 0x34], 1
je 0x1000eda3
mov edx, dword [ebp - 0x13c]
mov edi, dword [ebp - 0x138]
jmp 0x1000ed96
cmp ax, 0xd
jne 0x1000ed80
lea ecx, [esi + 2]
cmp word [ecx], 0xa
jne 0x1000ed80
cmp edi, ebx
jl 0x1000ed86
jg 0x1000ed7c
cmp edx, 1
jbe 0x1000ed86
mov esi, ecx
jmp 0x1000ed86
cmp ax, 0xa
jne 0x1000ed94
add edx, 0xffffffff
adc edi, 0xffffffff
js 0x1000ed9e
jg 0x1000ed94
cmp edx, ebx
jbe 0x1000ed9e
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x1000ed62
mov word [esi], bx
jmp 0x1000edda
test byte [ebp + 0x34], 2
je 0x1000ede3
jmp 0x1000edd2
cmp ax, 0xd
je 0x1000edbb
cmp ax, 0xa
je 0x1000edbb
inc esi
inc esi
jmp 0x1000edd2
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [esi + 2]
push eax
push esi
call fcn.100144b5
add esp, 0xc
mov ax, word [esi]
cmp ax, bx
jne 0x1000edab
sub esi, dword [ebp + 0x70]
mov dword [ebp - 0xf4], esi
cmp byte [ebp - 0x25], bl
je 0x1000edfb
lea eax, [ebp - 0xf8]
push eax
push dword [ebp + 0x70]
call fcn.10008472
pop ecx
pop ecx
jmp 0x1000edfe
mov eax, dword [ebp + 0x70]
mov ecx, dword [ebp - 0x60]
cmp word [ecx], 0x40
jne 0x1000ee24
mov ecx, dword [ebp + 0x4c]
push eax
push eax
push 0x100c6a64
push dword [ebp - 0x84]
push dword [ebp - 0x84]
call fcn.10042a44
jmp 0x1000ee4f
cmp byte [ebp + 0x77], bl
je 0x1000ee40
push ebx
push ebx
push dword [ebp - 0xf4]
push eax
push ecx
push dword [ebp + 0x4c]
call fcn.10053ed6
add esp, 0x18
jmp 0x1000ee4f
push dword [ebp - 0xb4]
push ecx
mov ecx, dword [ebp + 0x4c]
call fcn.100457c2
lea ecx, [ebp - 0xb4]
call fcn.1003f96c
mov eax, dword [ebp - 0x10]
push eax
mov dword [ebp + 0x14], eax
lea eax, [ebp - 0x394]
push 0x100c7bc8
push eax
mov word [ebp - 0x394], bx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 0x4c]
add esp, 0xc
lea eax, [ebp - 0x394]
push eax
push 0x100c7bac
call fcn.100457c2
cmp dword [ebp - 0x104], ebx
je 0x1000eeb1
cmp byte [ebp + 0x12], 1
je 0x1000eeb1
push dword [ebp - 0x128]
push dword [ebp - 0x104]
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
lea ecx, [ebp - 0xf8]
call fcn.1003f96c
lea ecx, [ebp + 0x50]
call fcn.1003f96c
mov ecx, dword [ebp + 0x7c]
cmp ecx, ebx
je 0x1000eed5
lea eax, [ebp - 0x18c]
mov eax, dword [eax]
mov dword [ecx], eax
cmp byte [ebp + 0x13], bl
lea eax, [ebp - 0x18c]
mov dword [eax], ebx
je 0x1000f019
cmp dword [eax + 8], ebx
je 0x1000f019
cmp byte [0x100e2cec], bl
jne 0x1000f019
cmp dword [ebp + 0x20], ebx
mov byte [0x100e2cec], 1
jne 0x1000efa4
push 0x1000
lea ecx, [ebp + 0x70]
call fcn.10002dd0
mov eax, dword [ebp + 0x70]
push ebx
mov dword [ebp + 0x78], ebx
mov word [eax], bx
lea eax, [ebp + 0x78]
push eax
lea eax, [ebp + 0x70]
push eax
push str.SystemStartOptions
push str.SYSTEMCurrentControlSetControl
push 0x80000002
call fcn.1004a913
mov eax, dword [ebp + 0x70]
mov dword [ebp + 0x74], eax
lea eax, [ebp + 0x74]
push eax
call fcn.1003f9c4
add esp, 0x1c
jmp 0x1000ef86
push 8
push eax
push str.PECMDHB
call fcn.1000f6d2
add esp, 0xc
test al, al
jne 0x1000ef90
push 6
push dword [ebp + 0x74]
push str.WIMHB
call fcn.1000f6d2
add esp, 0xc
test al, al
jne 0x1000ef90
lea eax, [ebp + 0x74]
push eax
call fcn.10008e60
pop ecx
mov eax, dword [ebp + 0x74]
cmp word [eax], bx
jne 0x1000ef52
jmp 0x1000ef97
mov dword [ebp + 0x20], 1
lea ecx, [ebp + 0x70]
call fcn.1003f96c
cmp dword [ebp + 0x20], ebx
je 0x1000efc5
call fcn.1001a962
test eax, eax
je 0x1000efbc
push str.exec
push dword [ebp + 0x4c]
call fcn.1001aa08
pop ecx
pop ecx
push ebx
call fcn.1001719b
pop ecx
jmp 0x1000f019
lea eax, [ebp - 0x18c]
push dword [eax + 8]
lea eax, [ebp - 0x338]
push str.__nfb__incmd_pecmd_TEAM_WAIT__InitSys__ncd__lu
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x338]
push eax
push str.DELAY_bwinpeshl____s__r_n
push dword [ebp + 0x4c]
call fcn.10011029
mov ecx, dword [ebp + 0x4c]
add esp, 0x18
push 0x100e2c10
push ebx
push ebx
push ebx
lea eax, [ebp + 0x76]
push eax
push dword [ebp + 0x4c]
lea eax, [ebp - 0x338]
push eax
mov word [ebp + 0x76], bx
call fcn.1000a5c9
mov ecx, dword [ebp - 0x58]
cmp ecx, ebx
je 0x1000f036
cmp word [ecx], bx
je 0x1000f036
lea eax, [ebp - 0x18c]
push dword [eax + 8]
push ecx
call fcn.1000399b
pop ecx
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [ebp - 0x50]
mov eax, dword [esi]
cmp eax, ebx
je 0x1000f048
push eax
call edi
mov dword [esi], ebx
lea esi, [ebp - 0x18]
mov eax, dword [esi]
cmp eax, ebx
je 0x1000f056
push eax
call edi
mov dword [esi], ebx
lea esi, [ebp - 0xe0]
cmp dword [esi], ebx
je 0x1000f065
push ebx
call edi
mov dword [esi], ebx
lea esi, [ebp - 0xdc]
mov eax, dword [esi]
cmp eax, ebx
je 0x1000f076
push eax
call edi
mov dword [esi], ebx
lea esi, [ebp - 0x78]
mov eax, dword [esi]
cmp eax, ebx
je 0x1000f084
push eax
call edi
mov dword [esi], ebx
lea esi, [ebp - 0x8c]
mov eax, dword [esi]
cmp eax, ebx
je 0x1000f095
push eax
call edi
cmp dword [ebp - 0x1d0], ebx
mov dword [esi], ebx
je 0x1000f0a7
push dword [ebp - 0x1d0]
call edi
lea esi, [ebp - 0x18c]
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x1000f0b7
push eax
call edi
mov ecx, dword [ebp + 0x4c]
push ebx
mov dword [esi + 4], ebx
call fcn.100707a5
mov ebx, dword [ebp + 0x14]
lea ecx, [ebp - 0x120]
call fcn.1003f96c
lea ecx, [ebp - 0x12c]
call fcn.1003f96c
lea ecx, [ebp - 0x98]
call fcn.10002d56
lea ecx, [ebp - 0x168]
call fcn.1003f96c
lea ecx, [ebp - 0xc8]
call fcn.10002d56
lea ecx, [ebp - 0xc0]
call fcn.10002d56
lea ecx, [ebp - 0xe0]
call fcn.10002d56
lea ecx, [ebp - 0x18]
call fcn.10002d56
lea ecx, [ebp - 0x50]
call fcn.10002d56
lea ecx, [ebp - 0x8c]
call fcn.10002d56
lea ecx, [ebp - 0xdc]
call fcn.10002d56
lea ecx, [ebp - 0x78]
call fcn.10002d56
lea ecx, [ebp - 0x58]
call fcn.1003f96c
lea ecx, [ebp - 0x1bc]
call fcn.1003f96c
lea ecx, [ebp - 0x10c]
call fcn.1003f96c
lea ecx, [ebp - 0x88]
call fcn.1003f96c
lea ecx, [ebp - 0x16c]
call fcn.1003f96c
lea ecx, [ebp - 0x110]
call fcn.1003f96c
lea ecx, [ebp - 0x130]
call fcn.1003f96c
lea ecx, [ebp - 0x164]
call fcn.1003f96c
lea ecx, [ebp - 0xe8]
call fcn.1003f96c
lea ecx, [ebp - 0x104]
call fcn.10002d56
lea ecx, [ebp - 0x160]
call fcn.10002d56
lea ecx, [ebp - 0x1cc]
call fcn.1000493c
lea ecx, [ebp - 0x198]
call fcn.1003f96c
lea ecx, [ebp - 0xb8]
call fcn.1003f96c
lea ecx, [ebp - 0xbc]
call fcn.1003f96c
lea ecx, [ebp - 0x60]
call fcn.1003f96c
lea ecx, [ebp - 0x158]
call fcn.1003f96c
lea ecx, [ebp - 0x140]
call fcn.1003f96c
lea ecx, [ebp - 0x154]
call fcn.1003f96c
lea ecx, [ebp - 0x15c]
call fcn.1003f96c
lea ecx, [ebp - 0x134]
call fcn.1003f96c
lea ecx, [ebp - 0x11c]
call fcn.1003f96c
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x5c
leave
ret 0x1c