Function at 0x100f8b50
Capabilities:
Allocate thread local storage
Check os version
Get system information on windows
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10126658
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x1016e750]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x110
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x130], 0x114
push 0
push eax
call fcn.101078f0
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x120], 2
jne 0x100f8bcb
mov eax, dword [ebp - 0x12c]
cmp eax, 6
jne 0x100f8c2a
cmp dword [ebp - 0x128], 2
jae 0x100f8c2c
xor ecx, ecx
test ecx, ecx
mov edx, str.kernel32.dll
mov eax, str.kernelbase.dll
lea ecx, [ebp - 0x13c]
cmove eax, edx
push eax
call fcn.1004a590
push ecx
mov dword [ebp - 4], 0
mov esi, esp
mov ecx, dword [0x101751d0]
add ecx, 0xfffffff0
call fcn.10024750
add eax, 0x10
mov dword [esi], eax
call fcn.10042490
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 4
push 0x1013a6ac
call edi
mov esi, eax
test esi, esi
jne 0x100f8c33
mov ecx, str.ntdll.dll_not_found
call fcn.100f8500
jbe 0x100f8bcb
mov ecx, 1
jmp 0x100f8bcd
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10148710
push esi
call ebx
push 0x1015449c
push esi
mov dword [0x10173448], eax
call ebx
push str.NtQueryInformationProcess
push esi
mov dword [0x101746b8], eax
call ebx
push 0x1013e6c8
push esi
mov dword [0x10174f0c], eax
call ebx
push 0x10154144
push esi
mov dword [0x1017365c], eax
call ebx
push str.NtClose
push esi
mov dword [0x10173e94], eax
call ebx
push str.NtMapViewOfSection
push esi
mov dword [0x10174f34], eax
call ebx
push str.NtWriteVirtualMemory
push esi
mov dword [0x10174f00], eax
call ebx
push str.NtProtectVirtualMemory
push esi
mov dword [0x10174ef8], eax
call ebx
push str.NtAllocateVirtualMemory
push esi
mov dword [0x10173654], eax
call ebx
push str.NtUnmapViewOfSection
push esi
mov dword [0x101746bc], eax
call ebx
push str.NtQueryVirtualMemory
push esi
mov dword [0x10174f04], eax
call ebx
mov dword [0x10173e90], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1016f5d0], eax
cmp eax, 0xffffffff
jne 0x100f8cef
mov ecx, str.TlsAlloc_out_of_index
call fcn.100f8500
push 0x10174f10
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x1017511c], 0
jne 0x100f8d35
push str.RegLoadAppKeyW
push str.ADVAPI32.DLL
call edi
push eax
call ebx
test eax, eax
je 0x100f8d35
push ecx
mov ecx, esp
push 0x1012ec60
call fcn.10023fc0
mov ecx, 0x10175070
call fcn.1002c4c0
add esp, 4
mov dword [0x10172218], eax
call fcn.10028930
call fcn.100d93b0
call fcn.100e4e80
test eax, eax
jne 0x100f8d76
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov edx, dword [ebp - 0x13c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100f8d6f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
jmp 0x100f9c4c
push 0x10174f40
mov dword [0x10174f40], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push ecx
mov eax, esp
push dword [0x10174f4c]
push dword [0x10174f48]
push dword [0x10174f44]
push str.Version.MajorVer_d__MinorVer_d__Build_d
push eax
call fcn.10044f30
add esp, 0x14
call fcn.100f5890
mov ecx, esp
lea esi, [ebp - 0x148]
push str.InstallHooks
call fcn.10023fc0
mov edx, esi
lea ecx, [ebp - 0x140]
call fcn.1004a240
add esp, 4
call fcn.10022690
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x100f8df1
push 0x80004005
call fcn.100223c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x138], eax
push 0
push 0
push 0
push ecx
mov byte [ebp - 4], 1
lea esi, [ebp - 0x138]
mov ecx, esp
mov dword [ebp - 0x144], esp
push str.FilePathName
call fcn.10023fc0
push ecx
mov ecx, esp
mov byte [ebp - 4], 2
push str.SoftwareCitrixCtxHookAppInit_DllsSfrHook
call fcn.10023fc0
mov edx, esi
mov byte [ebp - 4], 1
mov ecx, SysFreeString
call fcn.10045b00
add esp, 0x14
test eax, eax
je 0x100f8e7c
mov eax, dword [ebp - 0x138]
cmp dword [eax - 0xc], 0
je 0x100f8e7c
push ecx
mov ecx, esp
push eax
push str._CitrixMode:_turning_on___s_
push ecx
call fcn.10044f30
add esp, 0xc
call fcn.100f5890
add esp, 4
mov dword [0x10173444], 1
push 0
push 0
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x134], esp
push str.PRODUCTVERSION
lea esi, [ebp - 0x138]
call fcn.10023fc0
push ecx
mov ecx, esp
mov byte [ebp - 4], 3
push str.SoftwareSymantecSymantec_Endpoint_ProtectionCurrentVersion
call fcn.10023fc0
mov edx, esi
mov byte [ebp - 4], 1
mov ecx, SysFreeString
call fcn.10045b00
mov esi, dword [ebp - 0x138]
add esp, 0x14
test eax, eax
je 0x100f9068
cmp dword [esi - 0xc], 0
je 0x100f9068
push ecx
mov eax, esp
push esi
push str._SEPMODE:_turning_on___s_
push eax
call fcn.10044f30
add esp, 0xc
call fcn.100f5890
add esp, 4
mov dword [0x10173650], 1
lea esi, [ebp - 0x138]
push 1
push 0
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x134], esp
push str.szAppName
call fcn.10023fc0
push ecx
mov ecx, esp
mov byte [ebp - 4], 4
push str.SoftwareMcAfeeManagedServicesAgent
call fcn.10023fc0
mov edx, esi
mov byte [ebp - 4], 1
mov ecx, SysFreeString
call fcn.10045b00
add esp, 0x14
test eax, eax
je 0x100f8f84
push ecx
mov ecx, esp
mov dword [ebp - 0x134], esp
push str.SECURITY_AS_A_SERVICE
call fcn.10023fc0
mov byte [ebp - 4], 5
mov esi, dword [ebp - 0x138]
push ecx
mov edi, esp
lea ecx, [esi - 0x10]
call fcn.10024750
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 1
call fcn.10047b50
add esp, 8
cmp eax, 0xffffffff
jne 0x100f9009
push 0
push 0
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x134], esp
push str.szAppName
lea esi, [ebp - 0x138]
call fcn.10023fc0
push ecx
mov ecx, esp
mov byte [ebp - 4], 6
push str.SoftwareWow6432NodeMcAfeeManagedServicesAgent
call fcn.10023fc0
mov edx, esi
mov byte [ebp - 4], 1
mov ecx, SysFreeString
call fcn.10045b00
add esp, 0x14
test eax, eax
je 0x100f902f
push ecx
mov ecx, esp
mov dword [ebp - 0x134], esp
push str.SECURITY_AS_A_SERVICE
call fcn.10023fc0
mov byte [ebp - 4], 7
mov esi, dword [ebp - 0x138]
push ecx
mov edi, esp
lea ecx, [esi - 0x10]
call fcn.10024750
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 1
call fcn.10047b50
add esp, 8
cmp eax, 0xffffffff
je 0x100f9035
push ecx
mov eax, esp
push esi
push str._SEPMODE:_turning_off_because_of_MSAS___s_
push eax
call fcn.10044f30
add esp, 0xc
call fcn.100f5890
add esp, 4
mov dword [0x10173650], 0
jmp 0x100f9035
mov esi, dword [ebp - 0x138]
cmp dword [0x10173444], 0
je 0x100f9062
push ecx
mov eax, esp
push esi
push str._SEPMODE:_turning_off_because_of_Citrix___s_
push eax
call fcn.10044f30
add esp, 0xc
call fcn.100f5890
add esp, 4
mov dword [0x10173650], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.100188ec
push 1
push ecx
push 0x101728c4
push 0x100db130
mov edx, str.NtSetInformationFile
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtQueryDirectoryFile
push 1
push ecx
push 0x101728e0
push 0x100dea60
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtCreateFile
push 1
push ecx
push 0x101728dc
push 0x100dbd60
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, 0x10148704
push 1
push ecx
push 0x101728cc
push 0x100dbf80
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtQueryFullAttributesFile
push 1
push ecx
push 0x101728d8
push 0x100dc180
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtQueryAttributesFile
push 1
push ecx
push 0x101728d0
push 0x100dc380
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtDeleteFile
push 1
push ecx
push 0x101728c8
push 0x100daa10
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, 0x10154144
push 1
push ecx
push 0x10173370
push 0x100e74b0
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtOpenKeyEx
push 1
push ecx
push 0x10173378
push 0x100e7480
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, 0x101541dc
push 1
push ecx
push 0x10173374
push 0x100e74e0
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
push 1
push ecx
push 0x10172940
push fcn.100e5600
mov edx, str.NtEnumerateKey
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtEnumerateValueKey
push 1
push ecx
push 0x10172944
push fcn.100e6400
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, 0x1013e6c8
push 1
push ecx
push 0x10173380
push 0x100e7b30
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, 0x1015449c
push 1
push ecx
push 0x10173394
push 0x100e7d20
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtSetValueKey
push 1
push ecx
push 0x1017338c
push 0x100e80e0
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtDeleteValueKey
push 1
push ecx
push 0x10173390
push 0x100e8380
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtDeleteKey
push 1
push ecx
push 0x10173388
push 0x100e81a0
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtFlushKey
push 1
push ecx
push 0x10172930
push 0x100e4200
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtLockRegistryKey
push 1
push ecx
push 0x10172938
push 0x100e4220
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtCompressKey
push 1
push ecx
push 0x1017293c
push 0x100e4240
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
push 1
push ecx
push 0x10172934
push 0x100e4260
mov edx, str.NtCompactKeys
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtQueryOpenSubKeys
push 1
push ecx
push 0x1017337c
push 0x100e7c70
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtQueryOpenSubKeysEx
push 1
push ecx
push 0x10173384
push 0x100e7c90
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtDuplicateObject
push 1
push ecx
push 0x10173430
push 0x100f4010
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtLoadDriver
push 1
push ecx
push 0x10172900
push 0x100e1fe0
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
cmp byte [0x10174f38], 0
jne 0x100f938c
mov eax, dword [0x10175170]
cmp dword [eax - 0xc], 0
je 0x100f94ec
push 1
push ecx
push 0x101728e4
push 0x100e0cd0
mov edx, 0x10148710
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtCreateSection
push 1
push ecx
push 0x10172884
push 0x100d5120
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtOpenSection
push 1
push ecx
push 0x10172870
push 0x100d6c50
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtQuerySection
push 1
push ecx
push 0x1017287c
push 0x100d6ef0
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtMapViewOfSection
push 1
push ecx
push 0x10172888
push 0x100d5c90
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtUnmapViewOfSection
push 1
push ecx
push 0x10172880
push 0x100d67c0
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtQueryVirtualMemory
push 1
push ecx
push 0x10172878
push 0x100d6900
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtProtectVirtualMemory
push 1
push ecx
push 0x10172874
push 0x100d72b0
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtReadFile
push 1
push ecx
push 0x10172854
push 0x100c9640
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.NtReadFileScatter
push 1
push ecx
push 0x10172858
push 0x100c9cb0
mov ecx, str.ntdll.dll
call fcn.100f8600
mov eax, dword [0x10175170]
add esp, 0x10
cmp dword [eax - 0xc], 0
je 0x100f94ec
push 1
push ecx
push 0x1017285c
push 0x100c9de0
mov edx, str.NtWriteFile
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
cmp dword [0x10173444], 0
je 0x100f95ea
push ecx
mov eax, esp
push str.CitrixMode:_installing_Citrix_GetModuleHandle_hooks
push eax
call fcn.10044f30
add esp, 8
call fcn.100f5890
add esp, 4
mov edx, 0x1015bbc8
push 1
push ecx
mov ecx, dword [ebp - 0x13c]
push 0x101733dc
push fcn.100f2350
call fcn.100f8600
add esp, 0x10
mov edx, 0x1015bbb4
push 1
push ecx
mov ecx, dword [ebp - 0x13c]
push 0x101733e8
push 0x100f2600
call fcn.100f8600
add esp, 0x10
mov edx, 0x1015bbf0
push 1
push ecx
mov ecx, dword [ebp - 0x13c]
push 0x10173414
push fcn.100f2660
call fcn.100f8600
add esp, 0x10
mov edx, str.GetModuleHandleExA
push 1
push ecx
mov ecx, dword [ebp - 0x13c]
push 0x101733f4
push 0x100f2930
call fcn.100f8600
add esp, 0xc
mov eax, esp
push str.CitrixMode:_installing_Citrix_SetCurrentDirectory_hooks
push eax
call fcn.10044f30
add esp, 8
call fcn.100f5890
add esp, 4
mov edx, 0x1015bc04
push 1
push ecx
mov ecx, dword [ebp - 0x13c]
push 0x10173418
push fcn.100f1bd0
call fcn.100f8600
add esp, 0x10
mov edx, str.SetCurrentDirectoryA
push 1
push ecx
mov ecx, dword [ebp - 0x13c]
push 0x101733ec
push 0x100f1f20
call fcn.100f8600
add esp, 0x10
cmp dword [0x101746d4], 0
je 0x100f9631
push 1
push ecx
push 0x10173418
push fcn.100f1bd0
mov edx, 0x1015bc04
mov ecx, str.kernel32.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.SetCurrentDirectoryA
push 1
push ecx
push 0x101733ec
push 0x100f1f20
mov ecx, str.kernel32.dll
call fcn.100f8600
add esp, 0x10
push 1
push ecx
push 0x10172864
push fcn.100cc990
mov edx, 0x1014987c
mov ecx, str.Kernel32.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.CreateActCtxA
push 1
push ecx
push 0x10172860
push 0x100ccfc0
mov ecx, str.Kernel32.dll
call fcn.100f8600
add esp, 0x10
mov eax, 0x100dd610
cmp byte [0x10174f38], 0
mov edx, str.LdrLoadDll
push 1
push ecx
mov ecx, 0x100dd200
cmovne eax, ecx
mov ecx, str.ntdll.dll
push 0x101728d4
push eax
call fcn.100f8600
add esp, 0x10
call fcn.1004a520
test eax, eax
jne 0x100f96ba
push str.CreateProcessAsUserW
push 0x1013a6dc
call edi
push eax
call ebx
test eax, eax
je 0x100f96bf
mov eax, 1
push 0
push ecx
test eax, eax
mov ecx, str.Kernel32.dll
push 0x101733d4
mov edi, str.Advapi32.dll
mov edx, str.CreateProcessAsUserW
push fcn.100ef880
cmove ecx, edi
call fcn.100f8600
add esp, 0x10
mov edx, 0x1015bcd4
push 0
push ecx
push 0x101733d0
push 0x100ef0d0
mov ecx, str.Kernel32.dll
call fcn.100f8600
add esp, 0x10
mov edx, 0x1015bd14
push 0
push ecx
push 0x101733cc
push 0x100ef1b0
mov ecx, str.Kernel32.dll
call fcn.100f8600
add esp, 0x10
mov edx, 0x1015bcfc
push 1
push ecx
push 0x101733fc
push fcn.100f19e0
mov ecx, str.Kernel32.dll
call fcn.100f8600
add esp, 0x10
mov edx, 0x1015bd38
push 1
push ecx
push 0x101733f8
push 0x100f1ae0
mov ecx, str.Kernel32.dll
call fcn.100f8600
add esp, 0x10
mov edx, 0x1015bd24
push 1
push ecx
push 0x10173424
push fcn.100f2010
mov ecx, str.Kernel32.dll
call fcn.100f8600
add esp, 0x10
mov edx, 0x1015bd60
push 1
push ecx
push 0x10173408
push 0x100f22f0
mov ecx, str.Kernel32.dll
call fcn.100f8600
add esp, 0x10
mov edx, 0x1015bd50
push 1
push ecx
push 0x10173428
push fcn.100f29b0
mov ecx, str.Kernel32.dll
call fcn.100f8600
add esp, 0x10
mov edx, 0x1015bd88
push 1
push ecx
push 0x1017341c
push 0x100f2b70
mov ecx, str.Kernel32.dll
call fcn.100f8600
add esp, 0x10
cmp dword [0x10175120], 0
jne 0x100f97f2
cmp dword [0x101751d4], 0
je 0x100f9830
push 0
push ecx
push 0x101733bc
push 0x100ed6f0
mov edx, 0x1015bd74
mov ecx, str.Ole32.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.CoCreateInstanceEx
push 1
push ecx
push 0x101733c0
push 0x100ed980
mov ecx, str.Ole32.dll
call fcn.100f8600
add esp, 0x10
push 1
push ecx
push 0x101733b8
push 0x100edbe0
mov edx, str.CoGetClassObject
mov ecx, str.Ole32.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.CoGetObject
push 1
push ecx
push 0x101733b4
push 0x100eddc0
mov ecx, str.Ole32.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.CoGetInstanceFromFile
push 1
push ecx
push 0x101733c8
push 0x100ee0f0
mov ecx, str.Ole32.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.CoGetInstanceFromIStorage
push 1
push ecx
push 0x101733c4
push 0x100ee500
mov ecx, str.Ole32.dll
call fcn.100f8600
add esp, 0x10
mov edx, 0x1015be18
push 1
push ecx
push 0x10173440
push 0x100f45e0
mov ecx, str.Shell32.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.ShellExecuteExA
push 1
push ecx
push 0x1017343c
push 0x100f49f0
mov ecx, str.Shell32.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.ShellExecuteA
push 1
push ecx
push 0x10173438
push 0x100f5050
mov ecx, str.Shell32.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.ShellExecuteW
push 1
push ecx
push 0x10173434
push 0x100f4d10
mov ecx, str.Shell32.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.OpenSCManagerW
push 1
push ecx
push 0x10172918
push 0x100e2110
mov ecx, edi
call fcn.100f8600
add esp, 0x10
mov edx, str.OpenServiceW
push 1
push ecx
push 0x101728fc
push fcn.100e2250
mov ecx, edi
call fcn.100f8600
add esp, 0x10
push 1
push ecx
push 0x1017292c
push 0x100e25d0
mov edx, str.OpenServiceA
mov ecx, edi
call fcn.100f8600
add esp, 0x10
mov edx, str.CreateServiceW
push 1
push ecx
push 0x101728f8
push fcn.100e2750
mov ecx, edi
call fcn.100f8600
add esp, 0x10
mov edx, str.CreateServiceA
push 1
push ecx
push 0x101728e8
push 0x100e2c80
mov ecx, edi
call fcn.100f8600
add esp, 0x10
mov edx, str.DeleteService
push 1
push ecx
push 0x1017291c
push 0x100e30b0
mov ecx, edi
call fcn.100f8600
add esp, 0x10
mov edx, str.EnumServicesStatusA
push 1
push ecx
push 0x101728ec
push 0x100e36a0
mov ecx, edi
call fcn.100f8600
add esp, 0x10
mov edx, str.EnumServicesStatusW
push 1
push ecx
push 0x10172910
push 0x100e3820
mov ecx, edi
call fcn.100f8600
add esp, 0x10
mov edx, str.EnumServicesStatusExA
push 1
push ecx
push 0x10172928
push 0x100e39a0
mov ecx, edi
call fcn.100f8600
add esp, 0x10
mov edx, str.EnumServicesStatusExW
push 1
push ecx
push 0x1017290c
push 0x100e3b30
mov ecx, edi
call fcn.100f8600
mov eax, dword [0x10175134]
add esp, 0x10
cmp dword [eax - 0xc], 0
je 0x100f9a89
push 1
push ecx
push 0x101733e0
push 0x100f16d0
mov edx, str.GetComputerNameA
mov ecx, str.Kernel32.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.GetComputerNameW
push 1
push ecx
push 0x101733f0
push 0x100f15e0
mov ecx, str.Kernel32.dll
call fcn.100f8600
add esp, 0x10
mov eax, dword [0x10175138]
cmp dword [eax - 0xc], 0
je 0x100f9acc
push 1
push ecx
push 0x10173420
push 0x100f18d0
mov edx, str.GetUserNameA
mov ecx, edi
call fcn.100f8600
add esp, 0x10
mov edx, str.GetUserNameW
push 1
push ecx
push 0x1017340c
push 0x100f17e0
mov ecx, edi
call fcn.100f8600
add esp, 0x10
cmp dword [0x101751cc], 0
je 0x100f9af4
push 1
push ecx
push 0x101733e4
push 0x100f2f60
mov edx, str.DdeCreateDataHandle
mov ecx, str.User32.dll
call fcn.100f8600
add esp, 0x10
cmp dword [0x101751d4], 0
je 0x100f9b3b
push 0
push ecx
push 0x10172868
push 0x100d2e30
mov edx, str.GetSaveFileNameW
mov ecx, str.Comdlg32.dll
call fcn.100f8600
add esp, 0x10
mov edx, str.GetOpenFileNameW
push 0
push ecx
push 0x1017286c
push 0x100d30c0
mov ecx, str.Comdlg32.dll
call fcn.100f8600
add esp, 0x10
push 1
push ecx
push 0x1017342c
push 0x100f3ee0
mov edx, str.NtClose
mov ecx, str.ntdll.dll
call fcn.100f8600
add esp, 0x10
cmp dword [0x10173444], 0
je 0x100f9b83
push 1
push ecx
mov ecx, dword [ebp - 0x13c]
mov edx, 0x1015bf9c
push 0x101733d8
push 0x100d1170
call fcn.100f8600
add esp, 0x10
call fcn.100188f4
mov edx, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x140]
call fcn.1004a450
cmp byte [0x10174f38], 0
je 0x100f9ba7
call fcn.100f7a10
cmp dword [0x101728c0], 0
je 0x100f9bb5
call fcn.100cd1d0
cmp byte [0x10174f38], 0
je 0x100f9c03
mov eax, dword [0x10175444]
cmp dword [eax - 0xc], 0
je 0x100f9c03
mov byte [ebp - 4], 8
call fcn.100f5d20
mov dword [ebp - 4], 1
jmp 0x100f9c03
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0
or esi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x100f9c23
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x13c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x100f9c47
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10103392
mov esp, ebp
pop ebp
ret