Function at 0x1001c152
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x10068722
call fcn.100575f8
push ecx
mov eax, 0x1898
call fcn.10056840
mov eax, dword [0x10084500]
push ebx
push esi
push edi
xor ebx, ebx
cmp byte [ebp + 0x14], bl
mov edi, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x17b0], edi
je 0x1001c190
mov dword [0x10085998], 0x4eec
jmp 0x1001c19a
mov dword [edi + 0xb8], 0x4eee
lea eax, [edi + 4]
cmp dword [eax], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x17bc], eax
jne 0x1001c2ce
lea esi, [edi + 8]
cmp dword [esi], ebx
je 0x1001c2ce
cmp byte [ebp + 0x14], bl
je 0x1001c1ca
mov dword [0x10085998], 0x4efc
jmp 0x1001c1d4
mov dword [edi + 0xb8], 0x4efe
mov ecx, esi
call fcn.1000d6fe
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
cmp byte [ebp + 0x14], bl
je 0x1001c1f2
mov dword [0x10085998], 0x4f03
jmp 0x1001c1fc
mov dword [edi + 0xb8], 0x4f05
mov ecx, esi
call fcn.1000d6fe
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [ebp + 0x14], bl
je 0x1001c21a
mov dword [0x10085998], 0x4f0a
jmp 0x1001c224
mov dword [edi + 0xb8], 0x4f0c
mov ecx, esi
call fcn.1000d6fe
mov edx, dword [eax]
push ebx
push ebx
xor ecx, ecx
push ecx
push ecx
push eax
call dword [edx + 0x14]
cmp byte [ebp + 0x14], bl
je 0x1001c248
mov dword [0x10085998], 0x4f12
jmp 0x1001c252
mov dword [edi + 0xb8], 0x4f14
mov ecx, dword [ebp - 0x17bc]
mov edi, dword [esi]
call fcn.10016460
push eax
push 0x1006e36c
push edi
call dword [sym.imp.ole32.dll_CoUnmarshalInterface]
cmp eax, ebx
jge 0x1001c2c2
push 0x4f19
push dword [esi]
push eax
lea eax, [ebp - 0x1e0]
push 0x100869a8
push eax
call fcn.10057e98
push ecx
push ecx
lea eax, [ebp - 0x1e0]
mov ecx, esp
mov dword [ebp - 0x17d0], esp
push eax
call fcn.10001636
call fcn.10010461
add esp, 0x1c
jmp 0x1001e362
push ebx
mov ecx, esi
call fcn.10016794
jmp 0x1001c2ce
mov esi, dword [ebp - 0x17b0]
or dword [ebp - 4], 0xffffffff
cmp dword [esi + 4], ebx
je 0x1001e362
push dword [ebp + 0xc]
lea ecx, [ebp - 0x17c4]
call fcn.10001e42
cmp byte [ebp + 0x14], bl
mov dword [ebp - 4], 2
je 0x1001c307
mov dword [0x10085998], 0x4f28
jmp 0x1001c311
mov dword [esi + 0xb8], 0x4f2a
mov edi, dword [ebp - 0x17c4]
cmp edi, ebx
je 0x1001c31f
mov eax, dword [edi]
jmp 0x1001c321
xor eax, eax
push eax
call fcn.100585de
inc eax
push eax
call fcn.100556e2
cmp byte [ebp + 0x14], bl
pop ecx
pop ecx
mov dword [ebp - 0x17b8], eax
je 0x1001c347
mov dword [0x10085998], 0x4f30
jmp 0x1001c351
mov dword [esi + 0xb8], 0x4f32
cmp edi, ebx
je 0x1001c359
mov eax, dword [edi]
jmp 0x1001c35b
xor eax, eax
cmp edi, ebx
je 0x1001c369
mov ecx, dword [ebp - 0x17c4]
mov edi, dword [ecx]
jmp 0x1001c36b
xor edi, edi
push eax
call fcn.100585de
push eax
push edi
push dword [ebp - 0x17b8]
call fcn.100585b3
add esp, 0x10
cmp byte [ebp + 0x14], bl
je 0x1001c392
mov dword [0x10085998], 0x4f37
jmp 0x1001c39c
mov dword [esi + 0xb8], 0x4f39
mov eax, dword [ebp - 0x17c4]
cmp eax, ebx
je 0x1001c3aa
mov eax, dword [eax]
jmp 0x1001c3ac
xor eax, eax
push eax
call fcn.100585de
mov edi, dword [ebp - 0x17b8]
pop ecx
push edi
lea ecx, [ebp - 0x30]
mov byte [eax + edi], bl
call fcn.10001636
push edi
call fcn.10057617
cmp byte [ebp + 0x14], bl
pop ecx
je 0x1001c3dd
mov dword [0x10085998], 0x4f40
jmp 0x1001c3e7
mov dword [esi + 0xb8], 0x4f42
push 0xf
pop edi
push ebx
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0xa4], edi
call fcn.1000125d
push ebx
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x6c], edi
call fcn.1000125d
cmp dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 5
jne 0x1001c438
push ebx
push 1
lea ecx, [ebp - 0x84]
call fcn.10001293
push ebx
push 1
lea ecx, [ebp - 0xbc]
call fcn.10001293
push ebx
push 1
jmp 0x1001e34b
lea ecx, [esi + 4]
mov dword [ebp - 0x17e8], ebx
call fcn.1000d6fe
mov ecx, dword [eax]
lea edx, [ebp - 0x17e8]
push edx
push eax
call dword [ecx + 0x94]
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1818], 0x800
jae 0x1001c46c
lea eax, [ebp - 0x2c]
mov edi, 0x10000000
push edi
lea ecx, [ebp - 0x1818]
push ecx
lea ecx, [ebp - 0x13ac]
push ecx
push eax
call dword [0x10085df0]
push 0x3c
lea eax, [ebp - 0x18a8]
push ebx
push eax
call fcn.10056960
push 0x104
mov dword [ebp - 0x18a8], 0x3c
call fcn.100556e2
mov dword [ebp - 0x1898], eax
add esp, 0x10
lea eax, [ebp - 0x18a8]
push eax
lea eax, [ebp - 0x13ac]
push edi
push eax
mov dword [ebp - 0x1894], 0x104
call fcn.10056d60
pop ecx
push eax
lea eax, [ebp - 0x13ac]
push eax
call dword [0x10085df8]
cmp byte [ebp + 0x14], bl
je 0x1001c4f1
mov dword [0x10085998], 0x4f59
jmp 0x1001c4fb
mov dword [esi + 0xb8], 0x4f5b
push dword [ebp - 0x1898]
lea ecx, [ebp - 0x17c]
call fcn.10001636
cmp byte [ebp + 0x14], bl
mov byte [ebp - 4], 6
je 0x1001c521
mov dword [0x10085998], 0x4f60
jmp 0x1001c52b
mov dword [esi + 0xb8], 0x4f62
cmp dword [0x10085fcc], ebx
je 0x1001c56a
sub esp, 0x1c
lea eax, [ebp - 0x17c]
mov ecx, esp
mov dword [ebp - 0x17d0], esp
push eax
call fcn.100015f3
mov ecx, dword [0x10085fcc]
mov eax, dword [ecx]
call dword [eax + 0x38]
cmp al, bl
je 0x1001c56a
push dword [ebp - 0x1898]
call fcn.10057617
pop ecx
jmp 0x1001e31f
push dword [ebp - 0x1898]
call fcn.10057617
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
pop ecx
jae 0x1001c582
lea eax, [ebp - 0x2c]
push eax
push dword [esi + 0xc0]
push 0x7d
push 4
push 3
call fcn.10004566
add esp, 0x14
cmp dword [0x10085fcc], ebx
je 0x1001c7df
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e8
push dword [0x10089c2c]
call edi
cmp eax, 0x102
je 0x1001c7df
lea ecx, [ebp - 0x1c0]
call fcn.10016a26
push dword [ebp + 8]
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], 7
call fcn.10016794
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.100014f5
mov ecx, dword [0x10085fcc]
lea eax, [esi + 0xc]
mov dword [ebp - 0x1a0], eax
xor eax, eax
cmp dword [esi + 0xc0], ebx
lea edx, [ebp - 0x1c0]
setne al
push edx
push 2
mov dword [ebp - 0x180], eax
mov eax, dword [ecx]
call dword [eax + 0x34]
cmp al, bl
je 0x1001c7c4
push 0xffffffffffffffff
push dword [0x10089c4c]
call edi
mov dword [ebp - 0x17f4], ebx
mov dword [ebp - 0x17f0], ebx
mov dword [ebp - 0x17ec], ebx
mov ecx, dword [0x10085fcc]
mov eax, dword [ecx]
lea edx, [ebp - 0x17f8]
push edx
mov byte [ebp - 4], 8
call dword [eax + 0x40]
mov eax, dword [ebp - 0x17f4]
cmp eax, dword [ebp - 0x17f0]
je 0x1001c766
lea edi, [eax + 0x3c]
cmp byte [edi - 0x3c], bl
jne 0x1001c754
lea ecx, [ebp - 0x160]
call fcn.1000de71
push ebx
mov byte [ebp - 4], 9
call fcn.10057f09
pop ecx
push 0xffffffffffffffff
mov dword [ebp - 0xe0], eax
push ebx
lea eax, [edi - 0x38]
push eax
lea ecx, [ebp - 0x160]
mov dword [ebp - 0xdc], edx
call fcn.100014f5
push 0xffffffffffffffff
push ebx
push edi
lea ecx, [ebp - 0x128]
call fcn.100014f5
push 0xffffffffffffffff
push ebx
lea eax, [edi - 0x1c]
push eax
lea ecx, [ebp - 0x10c]
call fcn.100014f5
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x144]
call fcn.100014f5
cmp dword [ebp - 0xf8], ebx
jne 0x1001c715
push str.No_kws
lea ecx, [ebp - 0x128]
call fcn.10001619
push str.script
lea ecx, [ebp - 0x10c]
call fcn.10001619
push str.No_url
lea ecx, [ebp - 0x144]
call fcn.10001619
mov eax, dword [0x100836fc]
inc dword [0x100836fc]
mov dword [ebp - 0x17bc], eax
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x17bc]
push eax
mov ecx, 0x10089c40
call fcn.100103ac
mov ecx, eax
call fcn.1000ea06
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 8
call fcn.10006159
add edi, 0x58
lea eax, [edi - 0x3c]
cmp eax, dword [ebp - 0x17f0]
jne 0x1001c66d
call fcn.10022103
push dword [0x10089c4c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [0x10085fcc]
lea edx, [ebp - 0x17b8]
push edx
lea edx, [ebp - 0x17c0]
mov dword [ebp - 0x17c0], ebx
mov dword [ebp - 0x17b8], ebx
mov eax, dword [ecx]
push edx
call dword [eax + 0x14]
test al, al
je 0x1001c7b9
push dword [ebp - 0x17b8]
mov ecx, dword [0x10085fc8]
push dword [ebp - 0x17c0]
push 6
call fcn.1000acf9
lea ecx, [ebp - 0x17f8]
call fcn.1000ffba
push dword [0x10089c2c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], 6
call fcn.10016a8f
cmp dword [esi + 0xc0], ebx
jne 0x1001e21b
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x10084058
call fcn.100014f5
push ebx
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x50], 0xf
call fcn.1000125d
lea eax, [ebp - 0x17c9]
push eax
lea eax, [ebp - 0x17fc]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x17e8]
lea edi, [esi + 0xc]
mov ecx, edi
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x17fc], ebx
call fcn.10014682
cmp al, 1
jne 0x1001c97e
push 0xffffffffffffffff
push ebx
push edi
mov ecx, 0x100840ac
call fcn.100014f5
cmp byte [ebp - 0x17c9], bl
je 0x1001c902
lea eax, [ebp - 0x180c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push ebx
sub esp, 0x1c
lea eax, [ebp - 0x68]
mov ecx, esp
mov dword [ebp - 0x17d0], esp
push eax
mov byte [ebp - 4], 0xb
call fcn.100015f3
lea eax, [ebp - 0xf4]
push eax
call fcn.1000ea79
add esp, 0x24
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0xc
call fcn.100014f5
push ebx
push 1
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 0xb
call fcn.10001293
cmp dword [ebp - 0x50], 0x10
mov eax, dword [ebp - 0x64]
jae 0x1001c8c1
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x180c]
call fcn.1000d90a
mov ecx, dword [ebp + 8]
mov eax, 0x10084368
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x180c]
push eax
call fcn.1000d5bc
lea eax, [ebp - 0x180c]
push eax
mov byte [ebp - 4], 0xa
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp eax, ebx
jge 0x1001c967
push eax
call fcn.10054fa0
jmp 0x1001c967
lea ecx, [ebp - 0x3ac]
call fcn.1000fae3
mov esi, 0x1006cd39
push esi
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x37c], ebx
call fcn.10001636
lea eax, [ebp - 0x3ac]
push eax
push esi
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x68]
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 0xe
call fcn.1005187a
add esp, 0x14
push ebx
push 1
lea ecx, [ebp - 0xf4]
call fcn.10001293
lea ecx, [ebp - 0x3ac]
mov byte [ebp - 4], 0xa
call fcn.1000e9e3
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x17fc]
mov ecx, edi
call fcn.100150d0
jmp 0x1001c9d2
mov ecx, edi
call fcn.10015dcc
lea eax, [ebp - 0x1814]
push eax
call fcn.10057f09
mov edi, dword [0x100856c8]
mov eax, dword [ebp - 0x1810]
mov edx, dword [0x100856cc]
pop ecx
mov ecx, dword [ebp - 0x1814]
sub ecx, edi
sbb eax, edx
cmp eax, dword [0x10083604]
jg 0x1001c9da
jl 0x1001c9c0
cmp ecx, dword [0x10083600]
jae 0x1001c9da
cmp dword [ebp - 0x1810], edx
jl 0x1001c9da
jg 0x1001c9d2
cmp dword [ebp - 0x1814], edi
jbe 0x1001c9da
xor esi, esi
inc esi
jmp 0x1001cefb
lea eax, [ebp - 0x1830]
push eax
mov byte [ebp + 0xf], bl
call fcn.10057f09
lea eax, [ebp - 0x1830]
push eax
call fcn.10057f50
pop ecx
xor edi, edi
cmp eax, ebx
pop ecx
je 0x1001ca00
mov edi, dword [eax + 0xc]
cmp byte [ebp + 0x14], bl
je 0x1001ca11
mov dword [0x10085998], 0x4fca
jmp 0x1001ca1b
mov dword [esi + 0xb8], 0x4fcc
mov eax, dword [0x10085994]
cmp eax, ebx
je 0x1001ca57
add eax, 0x40
push eax
call fcn.10057f50
cmp dword [eax + 0xc], edi
pop ecx
je 0x1001ca46
mov eax, dword [0x10085994]
mov dword [eax + 0x30], ebx
mov ecx, dword [0x10085994]
call fcn.1002130c
mov eax, dword [0x10085994]
mov ecx, dword [eax + 0x30]
cmp ecx, dword [eax + 0x2c]
jge 0x1001ca57
mov byte [ebp + 0xf], 1
cmp byte [ebp + 0x14], bl
je 0x1001ca68
mov dword [0x10085998], 0x4fdd
jmp 0x1001ca72
mov dword [esi + 0xb8], 0x4fdf
cmp dword [0x10085fcc], ebx
je 0x1001e20b
cmp byte [ebp + 0xf], bl
je 0x1001e20b
cmp byte [ebp + 0x14], bl
je 0x1001ca98
mov dword [0x10085998], 0x4fe3
jmp 0x1001caa2
mov dword [esi + 0xb8], 0x4fe5
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0xd8]
call fcn.100015f3
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0xf
jae 0x1001cac1
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x17b8], eax
jae 0x1001cad3
lea edi, [ebp - 0x2c]
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x30]
call fcn.10005c44
push fcn.100592a5
push dword [ebp - 0x17b8]
push dword [eax]
lea eax, [ebp + 0x10]
push edi
push eax
call fcn.1004aad3
add esp, 0x14
cmp byte [ebp + 0x14], bl
je 0x1001cb0a
mov dword [0x10085998], 0x4feb
jmp 0x1001cb14
mov dword [esi + 0xb8], 0x4fed
push 0x3e8
push dword [0x10089c2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1001e1fd
mov eax, dword [0x10085994]
push ebx
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.1000d490
add esp, 0xc
test eax, eax
jne 0x1001e1f1
cmp byte [ebp + 0x14], bl
je 0x1001cb5d
mov dword [0x10085998], 0x4ff5
jmp 0x1001cb67
mov dword [esi + 0xb8], 0x4ff7
push ebx
push str.shdoclc.dll
lea ecx, [ebp - 0x30]
call fcn.1000dbd3
cmp eax, 0xffffffff
je 0x1001cba5
mov ecx, dword [0x10085fcc]
mov eax, dword [ecx]
lea edx, [esi + 0x128]
push edx
add esi, 0x10c
push esi
push ebx
call dword [eax + 0x24]
push dword [0x10089c2c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x1001ceeb
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x30]
push eax
lea ecx, [esi + 0x9c]
call fcn.100014f5
cmp byte [ebp + 0x14], bl
je 0x1001cbc8
mov dword [0x10085998], 0x5003
jmp 0x1001cbd2
mov dword [esi + 0xb8], 0x5005
push dword [ebp - 0x17e8]
call fcn.10001997
cmp eax, ebx
pop ecx
mov dword [ebp - 0x17b4], eax
je 0x1001cc74
mov edi, 0x10088b04
push edi
push eax
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je 0x1001cc20
push edi
push dword [ebp - 0x17b4]
mov byte [esi + 0xc8], bl
call dword [sym.imp.USER32.dll_RemovePropA]
push 0x1006cd39
lea ecx, [esi + 0xe8]
call fcn.10001619
mov edi, 0x10086e48
push edi
push dword [ebp - 0x17b4]
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je 0x1001cc4a
push edi
push dword [ebp - 0x17b4]
mov byte [esi + 0x87], 1
call dword [sym.imp.USER32.dll_RemovePropA]
mov edi, 0x10089248
push edi
push dword [ebp - 0x17b4]
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je 0x1001cc74
push edi
push dword [ebp - 0x17b4]
mov byte [esi + 0x87], 1
call dword [sym.imp.USER32.dll_RemovePropA]
lea ecx, [ebp - 0x2d4]
call fcn.1000fae3
cmp byte [ebp + 0x14], bl
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x17ec], ebx
je 0x1001cc9a
mov dword [0x10085998], 0x502c
jmp 0x1001cca4
mov dword [esi + 0xb8], 0x502e
mov eax, dword [esi + 4]
push 0x3c
mov dword [ebp - 0x17f4], eax
mov al, byte [esi + 0xc8]
pop edi
push edi
mov byte [ebp - 0x17f0], al
lea eax, [ebp - 0x186c]
push ebx
push eax
call fcn.10056960
mov dword [ebp - 0x186c], edi
mov edi, 0x104
push edi
call fcn.100556e2
mov dword [ebp - 0x185c], eax
mov eax, dword [ebp - 0x1c]
add eax, 0x100
push eax
mov dword [ebp - 0x1858], edi
mov dword [ebp - 0x17c8], eax
call fcn.100556e2
add esp, 0x14
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x17b4], eax
mov eax, dword [ebp - 0x2c]
jae 0x1001cd10
lea eax, [ebp - 0x2c]
mov edi, 0x10000000
push edi
lea ecx, [ebp - 0x17c8]
push ecx
push dword [ebp - 0x17b4]
push eax
call dword [0x10085df0]
lea eax, [ebp - 0x186c]
push eax
push edi
push dword [ebp - 0x17b4]
call fcn.10056d60
pop ecx
push eax
push dword [ebp - 0x17b4]
call dword [0x10085df8]
cmp byte [ebp + 0x14], bl
je 0x1001cd5c
mov dword [0x10085998], 0x5040
jmp 0x1001cd66
mov dword [esi + 0xb8], 0x5042
cmp byte [esi + 0xc8], bl
mov byte [ebp + 0xf], 1
je 0x1001cd92
push dword [ebp - 0x185c]
lea ecx, [esi + 0xe8]
call fcn.10006396
test eax, eax
jne 0x1001cd92
cmp dword [esi + 0xfc], ebx
je 0x1001cd92
mov byte [ebp + 0xf], bl
lea eax, [esi + 0x87]
cmp byte [eax], bl
je 0x1001cda1
mov byte [eax], bl
mov byte [ebp + 0xf], bl
cmp dword [ebp - 0x1860], 5
je 0x1001cdbc
cmp dword [ebp - 0x1860], 6
je 0x1001cdbc
cmp dword [ebp - 0x1860], 7
jne 0x1001cdbf
mov byte [ebp + 0xf], bl
push 0x10087150
lea ecx, [ebp - 0x17b8]
call fcn.10001dee
mov word [ebp - 0x180c], 2
mov word [ebp - 0x1804], bx
push ecx
lea eax, [ebp - 0x17b8]
mov ecx, esp
mov dword [ebp - 0x17d0], esp
push eax
call fcn.10016843
lea eax, [ebp - 0x40]
push eax
lea ecx, [esi + 4]
mov byte [ebp - 4], 0x12
call fcn.1000d6fe
mov ecx, eax
call fcn.100170db
push eax
lea ecx, [ebp - 0x180c]
mov byte [ebp - 4], 0x14
call fcn.100160a3
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x12
call edi
cmp eax, ebx
jge 0x1001ce35
push eax
call fcn.10054fa0
or word [ebp - 0x17dc], 0xffff
lea eax, [ebp - 0x17e4]
push eax
lea ecx, [ebp - 0x180c]
mov word [ebp - 0x17e4], 2
call fcn.100160c1
mov byte [ebp + 0x13], al
lea eax, [ebp - 0x17e4]
push eax
call edi
cmp eax, ebx
jge 0x1001ce6e
push eax
call fcn.10054fa0
cmp byte [ebp + 0x13], bl
je 0x1001ce76
mov byte [ebp + 0xf], bl
push dword [ebp - 0x185c]
call fcn.10057617
push dword [ebp - 0x17b4]
call fcn.10057617
cmp byte [ebp + 0x14], bl
pop ecx
pop ecx
je 0x1001ce9f
mov dword [0x10085998], 0x505c
jmp 0x1001cea9
mov dword [esi + 0xb8], 0x505e
cmp byte [ebp + 0xf], bl
jne 0x1001cf0a
push dword [0x10089c2c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 0x180c]
push eax
mov byte [ebp - 4], 0x11
call edi
cmp eax, ebx
jge 0x1001ced1
push eax
call fcn.10054fa0
mov ecx, dword [ebp - 0x17b8]
cmp ecx, ebx
je 0x1001cee0
call fcn.10002036
lea ecx, [ebp - 0x2d4]
call fcn.1000e9e3
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0xd8]
call fcn.10001293
push ebx
push esi
lea ecx, [ebp - 0x68]
call fcn.10001293
jmp 0x1001e322
push 0xffffffffffffffff
push dword [0x10089c08]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x10085fcc], ebx
je 0x1001cff3
push 0xf
pop edi
push ebx
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x34], edi
call fcn.1000125d
push ebx
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x88], edi
call fcn.1000125d
mov ecx, dword [0x10085fcc]
mov eax, dword [ecx]
lea edx, [ebp - 0xa0]
push edx
lea edx, [ebp - 0x4c]
push edx
lea edx, [ebp - 0x30]
push edx
mov byte [ebp - 4], 0x16
call dword [eax + 0x1c]
test al, al
je 0x1001cfd6
push ebx
lea ecx, [ebp - 0x110]
mov dword [ebp - 0xf8], edi
call fcn.1000125d
lea ecx, [ebp - 0xf4]
call fcn.10002e22
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 0x17
call fcn.100014f5
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x110]
call fcn.100014f5
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x110]
push eax
mov ecx, 0x10089c0c
call fcn.1001c0c5
mov ecx, eax
call fcn.100124c8
lea ecx, [ebp - 0x110]
call fcn.100062bd
push ebx
push 1
lea ecx, [ebp - 0xa0]
call fcn.10001293
push ebx
push 1
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x12
call fcn.10001293
push dword [0x10089c08]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [0x10085fcc]
mov eax, dword [ecx]
lea edx, [ebp - 0xd8]
push edx
call dword [eax + 0x28]
cmp byte [ebp + 0x14], bl
mov byte [ebp - 0x17ca], al
je 0x1001d028
mov dword [0x10085998], 0x5078
jmp 0x1001d032
mov dword [esi + 0xb8], 0x507a
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1001d03e
lea eax, [ebp - 0x2c]
mov ecx, dword [0x10085fcc]
mov edx, dword [ecx]
lea esi, [ebp - 0x2d4]
push esi
push 0x100840ac
push ebx
lea esi, [ebp - 0x84]
push esi
lea esi, [ebp - 0xbc]
push esi
sub esp, 0xc
mov edi, esp
lea esi, [ebp - 0x17f4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [edx]
test eax, eax
jl 0x1001d8b6
cmp dword [ebp - 0x6c], 0x10
mov eax, dword [ebp - 0x80]
jae 0x1001d086
lea eax, [ebp - 0x80]
push str.default
push eax
call fcn.10065dcd
test eax, eax
pop ecx
pop ecx
je 0x1001d8b6
mov edi, dword [ebp - 0x17b0]
push dword [edi + 0x108]
lea ecx, [ebp - 0x40]
call fcn.10001d19
lea eax, [ebp - 0x40]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x17d0], esp
push dword [edi + 0x104]
mov byte [ebp - 4], 0x18
call fcn.10001e42
mov ecx, dword [ebp + 8]
call fcn.10017074
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x12
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp eax, ebx
jge 0x1001d0eb
push eax
call fcn.10054fa0
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0xbc]
push eax
mov ecx, 0x10084074
call fcn.100014f5
cmp dword [0x1008408c], 0x10
mov eax, dword [0x10084078]
jae 0x1001d112
mov eax, 0x10084078
push eax
lea eax, [ebp - 0x17ac]
push str.33333____s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x84]
push eax
mov ecx, 0x10084090
call fcn.100014f5
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x2a4], 1
mov dword [0x10085978], eax
setne al
cmp byte [ebp + 0x14], bl
mov byte [0x10083ea8], al
je 0x1001d167
mov dword [0x10085998], 0x508d
jmp 0x1001d171
mov dword [edi + 0xb8], 0x508f
lea esi, [edi + 4]
mov ecx, esi
call fcn.1000d6fe
mov ecx, dword [eax]
push 0x10083ed4
push eax
call dword [ecx + 0x54]
mov ecx, esi
call fcn.1000d6fe
mov ecx, dword [eax]
push 0x10083ed0
push eax
call dword [ecx + 0x5c]
mov ecx, esi
call fcn.1000d6fe
mov ecx, dword [eax]
push 0x10083ecc
push eax
call dword [ecx + 0x64]
mov ecx, esi
call fcn.1000d6fe
mov ecx, dword [eax]
push 0x10083ec8
push eax
call dword [ecx + 0x6c]
mov ecx, esi
call fcn.1000d6fe
mov ecx, dword [eax]
push 0x10083ec4
push eax
call dword [ecx + 0x10c]
mov ecx, esi
call fcn.1000d6fe
mov ecx, dword [eax]
push 0x10083ec0
push eax
call dword [ecx + 0xc0]
mov ecx, esi
call fcn.1000d6fe
mov ecx, dword [eax]
push 0x10083ebc
push eax
call dword [ecx + 0xa8]
mov ecx, esi
call fcn.1000d6fe
mov ecx, dword [eax]
push 0x10083eb8
push eax
call dword [ecx + 0xb8]
cmp byte [ebp + 0x14], bl
je 0x1001d221
mov dword [0x10085998], 0x509d
jmp 0x1001d22b
mov dword [edi + 0xb8], 0x509f
mov ecx, dword [0x10085fcc]
cmp ecx, ebx
mov dword [ebp - 0x17bc], ebx
mov dword [ebp + 0xc], ebx
je 0x1001d268
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
lea edx, [ebp - 0x17bc]
push edx
call dword [eax + 0x14]
test al, al
je 0x1001d268
push dword [ebp + 0xc]
mov ecx, dword [0x10085fc8]
push dword [ebp - 0x17bc]
push 6
call fcn.1000acf9
cmp byte [ebp + 0x14], bl
je 0x1001d279
mov dword [0x10085998], 0x50a8
jmp 0x1001d283
mov dword [edi + 0xb8], 0x50aa
push 0xffffffffffffffff
push dword [0x10089c5c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x10089c54]
mov dword [ebp + 0x10], eax
push 0x10084090
lea eax, [ebp - 0x17d0]
mov edi, 0x10089c50
push eax
mov ecx, edi
call fcn.100173d1
mov ecx, dword [ebp + 0x10]
cmp dword [eax], ecx
je 0x1001d2df
push 0x10084090
mov ecx, edi
call fcn.10010315
cmp dword [eax], 1
jne 0x1001d2df
push 0x10084090
mov ecx, edi
call fcn.10010315
mov edi, eax
mov dword [ebp - 0x17b4], edi
jmp 0x1001d335
lea ecx, [ebp - 0x158]
call fcn.1000de21
lea eax, [ebp - 0x158]
push eax
push 0x10084090
mov ecx, edi
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x158], 1
call fcn.10010315
mov ecx, eax
call fcn.10017b2c
push 0x10084090
mov ecx, edi
call fcn.10010315
mov edi, eax
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x17b4], edi
mov byte [ebp - 4], 0x12
call fcn.1000dea0
cmp byte [ebp + 0x14], bl
je 0x1001d346
mov dword [0x10085998], 0x50bd
jmp 0x1001d356
mov eax, dword [ebp - 0x17b0]
mov dword [eax + 0xb8], 0x50bf
cmp dword [ebp - 0x2a4], 2
jne 0x1001d3f2
mov dword [edi], ebx
push dword [ebp - 0x17f4]
add edi, 4
mov ecx, edi
call fcn.10016794
push dword [edi]
call fcn.1001734d
lea ecx, [ebp + 0x10]
mov dword [esp], 0x10087150
call fcn.10001dee
or word [ebp - 0x17dc], 0xffff
mov word [ebp - 0x17e4], 2
lea eax, [ebp - 0x17e4]
push eax
push ecx
lea eax, [ebp + 0x10]
mov ecx, esp
mov dword [ebp - 0x17d0], esp
push eax
call fcn.10016843
mov ecx, edi
mov byte [ebp - 4], 0x1b
call fcn.1000d6fe
mov ecx, eax
call fcn.10017074
lea eax, [ebp - 0x17e4]
push eax
mov byte [ebp - 4], 0x1a
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp eax, ebx
jge 0x1001d3e2
push eax
call fcn.10054fa0
mov ecx, dword [ebp + 0x10]
cmp ecx, ebx
mov byte [ebp - 4], 0x12
je 0x1001d3f2
call fcn.10002036
cmp byte [ebp + 0x14], bl
mov edi, dword [ebp - 0x17b0]
je 0x1001d409
mov dword [0x10085998], 0x50ce
jmp 0x1001d413
mov dword [edi + 0xb8], 0x50d0
lea eax, [ebp - 0x17c8]
push eax
lea eax, [ebp - 0x17c0]
push eax
push ebx
push 1
push ebx
push ebx
push ebx
push 0x10087748
push 0x80000001
mov byte [ebp - 0xbac], bl
mov dword [ebp - 0x17c8], ebx
mov dword [ebp - 0x17c0], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1001d494
lea eax, [ebp - 0x17c8]
push eax
lea eax, [ebp - 0xbac]
push eax
lea eax, [ebp - 0x17c8]
push eax
push ebx
push 0x10088774
push dword [ebp - 0x17c0]
mov dword [ebp - 0x17c8], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1001d488
mov byte [ebp - 0xbac], bl
push dword [ebp - 0x17c0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp + 0x14], bl
je 0x1001d4a5
mov dword [0x10085998], 0x50e1
jmp 0x1001d4af
mov dword [edi + 0xb8], 0x50e3
lea eax, [ebp - 0xbac]
push eax
call fcn.10056d60
test eax, eax
pop ecx
je 0x1001d5f2
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1001d4d0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xbac]
push eax
call fcn.10057d10
test eax, eax
pop ecx
pop ecx
jne 0x1001d506
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1001d4ef
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0xbac]
push ecx
push eax
call fcn.10057d10
test eax, eax
pop ecx
pop ecx
je 0x1001d5f2
cmp byte [ebp + 0x14], bl
je 0x1001d517
mov dword [0x10085998], 0x50e9
jmp 0x1001d521
mov dword [edi + 0xb8], 0x50eb
push ebx
lea ecx, [ebp - 0x114]
mov dword [ebp - 0xfc], 0xf
call fcn.1000125d
lea ecx, [ebp - 0xf8]
call fcn.10002e22
mov eax, dword [ebp - 0x2a4]
push 0xffffffffffffffff
push ebx
push 0x10084090
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0xdc], eax
call fcn.100014f5
push 0xffffffffffffffff
push ebx
push 0x10084074
lea ecx, [ebp - 0x114]
call fcn.100014f5
lea eax, [ebp - 0x114]
push eax
mov ecx, 0x10089c60
call fcn.1001975f
cmp byte [ebp + 0x14], bl
je 0x1001d59a
mov dword [0x10085998], 0x50f5
jmp 0x1001d5a4
mov dword [edi + 0xb8], 0x50f7
or dword [ebp - 0x17d8], 0xffffffff
push 0x10087850
push ebx
push ebx
mov dword [ebp - 0x17dc], 0x4d2fa200
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push 1
push ebx
push ebx
mov esi, eax
push ebx
lea eax, [ebp - 0x17dc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0x12
call fcn.100062bd
jmp 0x1001d76e
cmp byte [ebp + 0x14], bl
je 0x1001d603
mov dword [0x10085998], 0x5106
jmp 0x1001d60d
mov dword [edi + 0xb8], 0x5108
cmp dword [ebp - 0x2a4], 2
je 0x1001d6a6
cmp byte [ebp + 0x14], bl
je 0x1001d62b
mov dword [0x10085998], 0x510f
jmp 0x1001d635
mov dword [edi + 0xb8], 0x5111
mov edi, 0x100836fc
push edi
mov ecx, 0x10089c40
call fcn.100103ac
add eax, 0x70
push eax
push dword [ebp + 8]
push 0x1006e36c
call dword [sym.imp.ole32.dll_CoMarshalInterThreadInterfaceInStream]
cmp eax, ebx
jge 0x1001d692
push 0x5116
push dword [esi]
push eax
lea eax, [ebp - 0x13c]
push 0x10087958
push eax
call fcn.10057e98
push ecx
push ecx
lea eax, [ebp - 0x13c]
mov ecx, esp
mov dword [ebp - 0x17d0], esp
push eax
call fcn.10001636
call fcn.10010461
add esp, 0x1c
push edi
mov ecx, 0x10089c40
call fcn.100103ac
mov edi, dword [ebp - 0x17b0]
mov dword [eax + 0x70], ebx
cmp byte [ebp + 0x14], bl
je 0x1001d6b7
mov dword [0x10085998], 0x511d
jmp 0x1001d6c1
mov dword [edi + 0xb8], 0x511f
push 0x100856c8
call fcn.10057f09
mov ecx, dword [ebp - 0x24c]
mov eax, dword [ebp - 0x17b4]
mov dword [eax + 0x48], ecx
mov ecx, dword [ebp - 0x288]
mov dword [eax + 0x68], ecx
lea edi, [eax + 0x70]
lea esi, [ebp - 0x234]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x17b0]
lea eax, [ebp - 0x284]
push eax
push ebx
add esi, 0xb8
push esi
push dword [ebp - 0x240]
push dword [ebp - 0x244]
push ebx
push dword [ebp - 0x2a4]
push dword [ebp - 0x17b4]
call fcn.10010a70
add esp, 0x24
cmp byte [ebp + 0x14], bl
je 0x1001d737
mov dword [0x10085998], 0x5128
jmp 0x1001d73d
mov dword [esi], 0x512a
push dword [0x10089c68]
lea eax, [ebp + 0x10]
push dword [0x10089c64]
mov ecx, 0x10089c60
push eax
call fcn.10019429
cmp byte [ebp + 0x14], bl
je 0x1001d768
mov dword [0x10085998], 0x5132
jmp 0x1001d76e
mov dword [esi], 0x5134
push dword [0x10089c5c]
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call esi
push 0xffffffffffffffff
push dword [0x10089c18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, 0x10089c1c
mov ecx, edi
call fcn.10004f1c
test eax, eax
je 0x1001d7b2
mov ecx, edi
call fcn.10004f1c
mov ecx, dword [0x10089c20]
dec eax
lea eax, [eax + eax*2]
lea eax, [ecx + eax*8]
mov byte [eax + 0x10], 1
push dword [0x10089c18]
call esi
cmp byte [ebp + 0x14], bl
mov esi, dword [ebp - 0x17b0]
je 0x1001d7d1
mov dword [0x10085998], 0x513e
jmp 0x1001d7db
mov dword [esi + 0xb8], 0x5140
push 0x3c
lea eax, [ebp - 0x1b8]
push ebx
push eax
call fcn.10056960
push 0x104
mov dword [ebp - 0x1b8], 0x3c
call fcn.100556e2
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1c]
push eax
mov dword [ebp - 0x1a4], 0x104
mov dword [ebp - 0x17c8], eax
call fcn.100556e2
add esp, 0x14
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x17b4], eax
mov eax, dword [ebp - 0x2c]
jae 0x1001d832
lea eax, [ebp - 0x2c]
push 0x10000000
lea ecx, [ebp - 0x17c8]
push ecx
push dword [ebp - 0x17b4]
push eax
call dword [0x10085df0]
lea eax, [ebp - 0x1b8]
push eax
push 0x10000000
push dword [ebp - 0x17b4]
call fcn.10056d60
pop ecx
push eax
push dword [ebp - 0x17b4]
call dword [0x10085df8]
push dword [ebp - 0x1a8]
lea ecx, [esi + 0xe8]
call fcn.10001619
push dword [ebp - 0x1a8]
call fcn.10057617
push dword [ebp - 0x17b4]
call fcn.10057617
cmp byte [ebp + 0x14], bl
pop ecx
pop ecx
je 0x1001d8aa
mov dword [0x10085998], 0x5151
jmp 0x1001d8bb
mov dword [esi + 0xb8], 0x5153
jmp 0x1001d8bb
mov edi, 0x10089c1c
cmp byte [ebp + 0x14], bl
je 0x1001d8cc
mov dword [0x10085998], 0x5157
jmp 0x1001d8dc
mov eax, dword [ebp - 0x17b0]
mov dword [eax + 0xb8], 0x5159
push 0xffffffffffffffff
push dword [0x10089c18]
mov byte [ebp + 0x13], bl
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, edi
call fcn.10004f1c
test eax, eax
je 0x1001d9ec
lea eax, [ebp - 0x17d4]
push eax
call fcn.10057f09
lea eax, [ebp - 0x17d4]
push eax
call fcn.10057f50
mov esi, dword [eax + 0x1c]
mov eax, dword [0x10085994]
pop ecx
add eax, 0x40
pop ecx
mov ecx, dword [eax]
or ecx, dword [eax + 4]
mov byte [ebp + 0xf], 1
je 0x1001d93f
push eax
mov byte [ebp + 0xf], bl
call fcn.10057f50
cmp dword [eax + 0x1c], esi
pop ecx
je 0x1001d93f
mov byte [ebp + 0xf], 1
mov eax, dword [0x10085fa8]
or eax, dword [0x10085fac]
je 0x1001d96d
cmp byte [ebp + 0xf], bl
je 0x1001d9ec
push 0x10085fa8
call fcn.10057f50
cmp esi, dword [eax + 0x1c]
pop ecx
je 0x1001d9ec
mov byte [ebp + 0xf], 1
cmp byte [ebp + 0xf], bl
je 0x1001d9ec
lea eax, [ebp - 0x17dc]
push eax
call fcn.10057f09
pop ecx
mov ecx, edi
call fcn.10004f1c
mov esi, dword [0x10089c20]
mov edx, dword [ebp - 0x17d8]
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax*8]
mov ecx, dword [eax]
sub ecx, dword [0x10089c90]
mov eax, dword [eax + 4]
sbb eax, dword [0x10089c94]
add ecx, dword [0x10083eb0]
adc eax, dword [0x10083eb4]
cmp edx, eax
jl 0x1001d9ec
jg 0x1001d9c6
mov eax, dword [ebp - 0x17dc]
cmp eax, ecx
jbe 0x1001d9ec
mov ecx, edi
mov byte [ebp + 0x13], 1
call fcn.10004f1c
dec eax
lea eax, [eax + eax*2]
lea esi, [esi + eax*8]
push 0x10085fa8
mov byte [esi + 0x10], 1
call fcn.10057f09
pop ecx
call fcn.10022d28
push dword [0x10089c18]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp byte [ebp + 0x14], bl
je 0x1001da09
mov dword [0x10085998], 0x5189
jmp 0x1001da19
mov eax, dword [ebp - 0x17b0]
mov dword [eax + 0xb8], 0x518b
cmp byte [ebp + 0x13], bl
je 0x1001e046
push 0xf
pop esi
push ebx
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x88], esi
call fcn.1000125d
push ebx
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0xdc], esi
call fcn.1000125d
lea ecx, [ebp - 0x3ac]
mov byte [ebp - 4], 0x1f
call fcn.1000fae3
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x20
jae 0x1001da68
lea eax, [ebp - 0x2c]
mov ecx, dword [0x10085fcc]
mov edx, dword [ecx]
push eax
lea eax, [ebp - 0x17f4]
push eax
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0xa0]
push eax
call dword [edx + 0x30]
test al, al
je 0x1001e010
cmp byte [ebp + 0x14], bl
je 0x1001daa9
mov dword [0x10085998], 0x5195
jmp 0x1001dab9
mov eax, dword [ebp - 0x17b0]
mov dword [eax + 0xb8], 0x5197
push 0x10087150
lea ecx, [ebp - 0x17b4]
call fcn.10001dee
cmp dword [ebp - 0x88], 0x10
mov eax, dword [ebp - 0x9c]
mov byte [ebp - 4], 0x21
jae 0x1001dae2
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x17d0]
call fcn.10001dee
or word [ebp - 0x38], 0xffff
mov word [ebp - 0x40], 2
lea eax, [ebp - 0x40]
push eax
push ecx
lea eax, [ebp - 0x17b4]
mov ecx, esp
mov dword [ebp - 0x17c0], esp
push eax
call fcn.10016843
mov edi, dword [ebp - 0x17b0]
lea esi, [edi + 4]
mov ecx, esi
mov byte [ebp - 4], 0x23
call fcn.1000d6fe
mov ecx, eax
call fcn.10017074
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0xa0]
push eax
mov ecx, 0x10084074
call fcn.100014f5
cmp dword [0x1008408c], 0x10
mov eax, dword [0x10084078]
jae 0x1001db54
mov eax, 0x10084078
push eax
lea eax, [ebp - 0x17ac]
push str.44444____s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0xf4]
push eax
mov ecx, 0x10084090
call fcn.100014f5
mov eax, dword [ebp - 0x3ac]
cmp dword [ebp - 0x37c], 1
mov dword [0x10085978], eax
setne al
push 0xffffffffffffffff
mov byte [0x10083ea8], al
push ebx
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x10084058
call fcn.100014f5
cmp byte [ebp + 0x14], bl
je 0x1001dbba
mov dword [0x10085998], 0x51aa
jmp 0x1001dbc4
mov dword [edi + 0xb8], 0x51ac
mov ecx, esi
call fcn.1000d6fe
mov ecx, dword [eax]
push 0x10083ed4
push eax
call dword [ecx + 0x54]
mov ecx, esi
call fcn.1000d6fe
mov ecx, dword [eax]
push 0x10083ed0
push eax
call dword [ecx + 0x5c]
mov ecx, esi
call fcn.1000d6fe
mov ecx, dword [eax]
push 0x10083ecc
push eax
call dword [ecx + 0x64]
mov ecx, esi
call fcn.1000d6fe
mov ecx, dword [eax]
push 0x10083ec8
push eax
call dword [ecx + 0x6c]
mov ecx, esi
call fcn.1000d6fe
mov ecx, dword [eax]
push 0x10083ec4
push eax
call dword [ecx + 0x10c]
mov ecx, esi
call fcn.1000d6fe
mov ecx, dword [eax]
push 0x10083ec0
push eax
call dword [ecx + 0xc0]
mov ecx, esi
call fcn.1000d6fe
mov ecx, dword [eax]
push 0x10083ebc
push eax
call dword [ecx + 0xa8]
mov ecx, esi
call fcn.1000d6fe
mov ecx, dword [eax]
push 0x10083eb8
push eax
call dword [ecx + 0xb8]
cmp byte [ebp + 0x14], bl
je 0x1001dc71
mov dword [0x10085998], 0x51ba
jmp 0x1001dc7b
mov dword [edi + 0xb8], 0x51bc
mov ecx, dword [0x10085fcc]
cmp ecx, ebx
mov dword [ebp - 0x17bc], ebx
mov dword [ebp + 0xc], ebx
je 0x1001dcb8
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
lea edx, [ebp - 0x17bc]
push edx
call dword [eax + 0x14]
test al, al
je 0x1001dcb8
push dword [ebp + 0xc]
mov ecx, dword [0x10085fc8]
push dword [ebp - 0x17bc]
push 6
call fcn.1000acf9
cmp byte [ebp + 0x14], bl
je 0x1001dcc9
mov dword [0x10085998], 0x51c6
jmp 0x1001dcd3
mov dword [edi + 0xb8], 0x51c8
push 0xffffffffffffffff
push dword [0x10089c5c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x10089c54]
mov dword [ebp + 0x10], eax
push 0x10084090
lea eax, [ebp - 0x17c0]
mov edi, 0x10089c50
push eax
mov ecx, edi
call fcn.100173d1
mov ecx, dword [ebp + 0x10]
cmp dword [eax], ecx
je 0x1001dd2f
push 0x10084090
mov ecx, edi
call fcn.10010315
cmp dword [eax], 1
jne 0x1001dd2f
push 0x10084090
mov ecx, edi
call fcn.10010315
mov edi, eax
mov dword [ebp - 0x17c0], edi
jmp 0x1001dd85
lea ecx, [ebp - 0x1fc]
call fcn.1000de21
lea eax, [ebp - 0x1fc]
push eax
push 0x10084090
mov ecx, edi
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x1fc], 1
call fcn.10010315
mov ecx, eax
call fcn.10017b2c
push 0x10084090
mov ecx, edi
call fcn.10010315
mov edi, eax
lea ecx, [ebp - 0x1fc]
mov dword [ebp - 0x17c0], edi
mov byte [ebp - 4], 0x23
call fcn.1000dea0
cmp byte [ebp + 0x14], bl
je 0x1001dd96
mov dword [0x10085998], 0x51da
jmp 0x1001dda6
mov eax, dword [ebp - 0x17b0]
mov dword [eax + 0xb8], 0x51dc
cmp dword [ebp - 0x37c], 2
jne 0x1001de42
mov dword [edi], ebx
push dword [ebp - 0x17f4]
add edi, 4
mov ecx, edi
call fcn.10016794
push dword [edi]
call fcn.1001734d
lea ecx, [ebp + 0x10]
mov dword [esp], 0x10087150
call fcn.10001dee
or word [ebp - 0x1820], 0xffff
mov word [ebp - 0x1828], 2
lea eax, [ebp - 0x1828]
push eax
push ecx
lea eax, [ebp + 0x10]
mov ecx, esp
mov dword [ebp - 0x17d8], esp
push eax
call fcn.10016843
mov ecx, edi
mov byte [ebp - 4], 0x27
call fcn.1000d6fe
mov ecx, eax
call fcn.10017074
lea eax, [ebp - 0x1828]
push eax
mov byte [ebp - 4], 0x26
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp eax, ebx
jge 0x1001de32
push eax
call fcn.10054fa0
mov ecx, dword [ebp + 0x10]
cmp ecx, ebx
mov byte [ebp - 4], 0x23
je 0x1001de42
call fcn.10002036
cmp byte [ebp + 0x14], bl
je 0x1001de53
mov dword [0x10085998], 0x51ec
jmp 0x1001de63
mov eax, dword [ebp - 0x17b0]
mov dword [eax + 0xb8], 0x51ee
cmp dword [ebp - 0x37c], 2
je 0x1001defe
cmp byte [ebp + 0x14], bl
je 0x1001de81
mov dword [0x10085998], 0x51f5
jmp 0x1001de91
mov eax, dword [ebp - 0x17b0]
mov dword [eax + 0xb8], 0x51f7
mov edi, 0x10089c40
push 0x100836fc
mov ecx, edi
call fcn.100103ac
add eax, 0x70
push eax
push dword [ebp + 8]
push 0x1006e36c
call dword [sym.imp.ole32.dll_CoMarshalInterThreadInterfaceInStream]
cmp eax, ebx
jge 0x1001deef
push 0x51fc
push dword [esi]
push eax
lea eax, [ebp - 0x1e0]
push 0x10087958
push eax
call fcn.10057e98
push ecx
push ecx
lea eax, [ebp - 0x1e0]
mov ecx, esp
mov dword [ebp - 0x17d8], esp
push eax
call fcn.10001636
call fcn.10010461
add esp, 0x1c
push 0x100836fc
mov ecx, edi
call fcn.100103ac
mov dword [eax + 0x70], ebx
cmp byte [ebp + 0x14], bl
je 0x1001df0f
mov dword [0x10085998], 0x5203
jmp 0x1001df1f
mov eax, dword [ebp - 0x17b0]
mov dword [eax + 0xb8], 0x5205
push 0x100856c8
call fcn.10057f09
mov ecx, dword [ebp - 0x24c]
mov eax, dword [ebp - 0x17c0]
mov dword [eax + 0x48], ecx
mov ecx, dword [ebp - 0x360]
mov dword [eax + 0x68], ecx
lea edi, [eax + 0x70]
lea esi, [ebp - 0x30c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x17b0]
lea eax, [ebp - 0x284]
push eax
push ebx
add esi, 0xb8
push esi
push dword [ebp - 0x318]
push dword [ebp - 0x31c]
push ebx
push dword [ebp - 0x37c]
push dword [ebp - 0x17c0]
call fcn.10010a70
add esp, 0x24
cmp byte [ebp + 0x14], bl
je 0x1001df95
mov dword [0x10085998], 0x520e
jmp 0x1001df9b
mov dword [esi], 0x5210
push dword [0x10089c68]
lea eax, [ebp + 8]
push dword [0x10089c64]
mov ecx, 0x10089c60
push eax
call fcn.10019429
push dword [0x10089c5c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp byte [ebp + 0x14], bl
je 0x1001dfd2
mov dword [0x10085998], 0x5219
jmp 0x1001dfd8
mov dword [esi], 0x521b
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x22
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp eax, ebx
jge 0x1001dff0
push eax
call fcn.10054fa0
mov ecx, dword [ebp - 0x17d0]
cmp ecx, ebx
je 0x1001dfff
call fcn.10002036
mov ecx, dword [ebp - 0x17b4]
cmp ecx, ebx
je 0x1001e01b
call fcn.10002036
jmp 0x1001e01b
push 0x10085fa8
call fcn.10057f09
pop ecx
lea ecx, [ebp - 0x3ac]
call fcn.1000e9e3
push ebx
push 1
lea ecx, [ebp - 0xf4]
call fcn.10001293
push ebx
push 1
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x12
call fcn.10001293
cmp byte [ebp + 0x14], bl
je 0x1001e057
mov dword [0x10085998], 0x5223
jmp 0x1001e067
mov eax, dword [ebp - 0x17b0]
mov dword [eax + 0xb8], 0x5225
cmp byte [ebp - 0x17ca], bl
je 0x1001e195
push ebx
sub esp, 0x1c
lea eax, [ebp - 0xd8]
mov ecx, esp
mov dword [ebp - 0x17d8], esp
push eax
call fcn.100015f3
lea eax, [ebp - 0xf4]
push eax
call fcn.1000ea79
add esp, 0x24
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x29
call fcn.100014f5
push ebx
push 1
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 0x12
call fcn.10001293
push 0x10087150
lea ecx, [ebp + 0xc]
call fcn.10001dee
cmp dword [ebp - 0xc0], 0x10
mov eax, dword [ebp - 0xd4]
mov byte [ebp - 4], 0x2a
jae 0x1001e0e5
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp + 8]
call fcn.10001dee
or word [ebp - 0x38], 0xffff
mov word [ebp - 0x40], 2
lea eax, [ebp - 0x40]
push eax
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x17d8], esp
push eax
call fcn.10016843
mov edi, dword [ebp - 0x17b0]
add edi, 4
mov ecx, edi
mov byte [ebp - 4], 0x2c
call fcn.1000d6fe
mov ecx, eax
call fcn.10017074
mov ecx, edi
call fcn.1000d6fe
mov ecx, eax
call fcn.10016229
mov eax, 0x10084368
push eax
push eax
push eax
push eax
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x17d8], esp
push eax
call fcn.10016843
mov ecx, edi
mov byte [ebp - 4], 0x2c
call fcn.1000d6fe
mov ecx, eax
call fcn.10017014
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x2b
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp eax, ebx
jge 0x1001e17d
push eax
call fcn.10054fa0
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x1001e189
call fcn.10002036
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x1001e195
call fcn.10002036
cmp byte [ebp + 0x14], bl
je 0x1001e1a6
mov dword [0x10085998], 0x5236
jmp 0x1001e1b6
mov eax, dword [ebp - 0x17b0]
mov dword [eax + 0xb8], 0x5238
lea eax, [ebp - 0x180c]
push eax
mov byte [ebp - 4], 0x11
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp eax, ebx
jge 0x1001e1d1
push eax
call fcn.10054fa0
mov ecx, dword [ebp - 0x17b8]
cmp ecx, ebx
je 0x1001e1e0
call fcn.10002036
lea ecx, [ebp - 0x2d4]
call fcn.1000e9e3
mov esi, dword [ebp - 0x17b0]
push dword [0x10089c2c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
push 1
lea ecx, [ebp - 0xd8]
call fcn.10001293
push ebx
push 1
lea ecx, [ebp - 0x68]
call fcn.10001293
jmp 0x1001e304
push ebx
push str.shdoclc.dll
lea ecx, [ebp - 0x30]
call fcn.1000dbd3
cmp eax, 0xffffffff
je 0x1001e23e
push 0x1006d10c
lea ecx, [esi + 0x10c]
call fcn.10001619
cmp byte [esi + 0x84], bl
je 0x1001e263
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x30]
push eax
lea ecx, [esi + 0xcc]
call fcn.100014f5
mov byte [esi + 0x84], bl
jmp 0x1001e304
lea ecx, [esi + 4]
mov dword [ebp - 0x17b8], ebx
call fcn.1000d6fe
mov ecx, dword [eax]
lea edx, [ebp - 0x17b8]
push edx
push eax
call dword [ecx + 0x94]
push dword [ebp - 0x17b8]
call fcn.10001997
cmp eax, ebx
pop ecx
je 0x1001e304
push 0x10088b04
push eax
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je 0x1001e304
mov byte [esi + 0xc8], bl
mov byte [esi + 0x84], bl
mov edi, dword [0x10089c54]
mov eax, dword [edi]
mov dword [ebp - 0x17bc], eax
jmp 0x1001e2d9
mov ecx, dword [eax + 0x38]
cmp ecx, dword [ebp - 0x17b8]
je 0x1001e2df
lea ecx, [ebp - 0x17bc]
call fcn.1000da8f
mov eax, dword [ebp - 0x17bc]
cmp eax, edi
jne 0x1001e2bd
jmp 0x1001e2f1
push eax
lea eax, [ebp - 0x17d8]
push eax
mov ecx, 0x10089c50
call fcn.100183aa
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001c152
cmp byte [ebp + 0x14], bl
je 0x1001e315
mov dword [0x10085998], 0x526a
jmp 0x1001e31f
mov dword [esi + 0xb8], 0x526c
xor esi, esi
inc esi
push ebx
lea ecx, [ebp - 0x17c]
push esi
call fcn.10001293
push ebx
lea ecx, [ebp - 0x84]
push esi
call fcn.10001293
push ebx
lea ecx, [ebp - 0xbc]
push esi
call fcn.10001293
push ebx
push esi
lea ecx, [ebp - 0x30]
call fcn.10001293
mov ecx, dword [ebp - 0x17c4]
cmp ecx, ebx
je 0x1001e362
call fcn.10002036
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.100568ae
pop edi
pop esi
pop ebx
leave
ret 0x10