Function at 0x100b4570
Capabilities:
Create process on windows
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102fb9a6
mov eax, dword fs:[0]
push eax
sub esp, 0x4b0
mov eax, dword [case.0x100be6e1.80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x450], esi
call fcn.100c32b9
mov ecx, eax
test ecx, ecx
je 0x100b579f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x428], eax
mov dword [ebp - 4], 1
call fcn.100c32b9
mov ecx, eax
test ecx, ecx
je 0x100b57a9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x480], eax
mov byte [ebp - 4], 3
mov edi, 0xffffffff
mov eax, dword [ebp + 8]
sub eax, 2
je 0x100b52c1
sub eax, 0x327a
jne 0x100b572a
call fcn.100bbc80
push 0
push 0
push 0x1004
push dword [esi + 0x2e8]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
dec eax
lea ecx, [esi + 0x2c8]
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.100d83ab
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x428]
push eax
call fcn.1000c7b0
mov byte [ebp - 4], 3
or edi, edi
mov edx, dword [ebp - 0x444]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b466a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x428]
cmp dword [eax - 0xc], 0
jl 0x100b52b7
push str._kill
push eax
call fcn.102bc5fc
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x428]
test ecx, ecx
je 0x100b46ac
sub ecx, eax
js 0x100b46ac
mov dword [0x103c9f98], 0
mov esi, 1
jmp 0x100b573c
cmp dword [eax - 0xc], 0
jl 0x100b52b7
push str.__OLEDINFO_OPEN_OK_
push eax
call fcn.102bc5fc
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x428]
test ecx, ecx
je 0x100b46e8
sub ecx, eax
js 0x100b46e8
mov dword [0x103c9f98], 0
mov esi, 1
jmp 0x100b573c
cmp dword [eax - 0xc], 0
jl 0x100b52b7
push str.__share
push eax
call fcn.102bc5fc
add esp, 8
test eax, eax
je 0x100b52b7
mov ecx, dword [ebp - 0x428]
sub eax, ecx
js 0x100b52b7
push 0x5d
push ecx
call fcn.102a1020
add esp, 8
test eax, eax
jne 0x100b472a
or eax, 0xffffffff
jmp 0x100b4730
sub eax, dword [ebp - 0x428]
lea ecx, [ebp - 0x43c]
lea esi, [eax - 2]
call fcn.100032e0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x444]
push esi
push 2
push eax
lea ecx, [ebp - 0x428]
call fcn.1000a3c0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x43c]
push eax
call fcn.1000c7b0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x444]
call fcn.10002aa0
lea ecx, [ebp - 0x440]
call fcn.100032e0
mov byte [ebp - 4], 8
lea eax, [ebp - 0x440]
push 0x2c
push 1
push dword [ebp - 0x43c]
push eax
call fcn.100ceba1
push dword [ebp - 0x440]
call fcn.102bcab8
add esp, 4
lea ecx, [ebp - 0x464]
mov ebx, eax
mov dword [ebp - 0x444], ebx
call fcn.100032e0
mov byte [ebp - 4], 9
lea ecx, [ebx + 1]
push 0x2c
lea ecx, [ebx + ecx*2]
push ecx
push dword [ebp - 0x43c]
lea eax, [ebp - 0x464]
push eax
call fcn.100ceba1
push dword [ebp - 0x464]
call fcn.102bcab8
push 0x2c
push dword [ebp - 0x428]
mov bh, al
call fcn.102a1020
add esp, 0xc
test eax, eax
jne 0x100b4801
or eax, 0xffffffff
jmp 0x100b4807
sub eax, dword [ebp - 0x428]
lea esi, [eax - 1]
push esi
push 2
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x428]
call fcn.1000a3c0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x43c]
push eax
call fcn.1000c7b0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x454]
call fcn.10002aa0
xor bl, bl
xor edx, edx
test esi, esi
jle 0x100b4869
mov eax, dword [ebp - 0x43c]
nop dword [eax]
test edx, edx
js 0x100b57b3
cmp edx, dword [eax - 0xc]
jg 0x100b57b3
add bl, byte [edx + eax]
inc edx
cmp edx, esi
jl 0x100b4850
cmp bh, bl
je 0x100b48b4
mov byte [ebp - 4], 8
mov eax, edi
mov edx, dword [ebp - 0x464]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b488e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 6
mov eax, edi
mov edx, dword [ebp - 0x440]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b48af
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x100b5296
lea ecx, [ebp - 0x42c]
call fcn.100032e0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x470]
call fcn.100032e0
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x444]
cmp eax, 3
jne 0x100b48e9
mov dword [0x103ca018], 1
jmp 0x100b48fb
mov dword [0x103ca018], 0
test eax, eax
jle 0x100b5212
mov ebx, 3
xor esi, esi
mov dword [ebp - 0x468], ebx
mov dword [ebp - 0x460], esi
nop
call fcn.100c32b9
mov ecx, eax
test ecx, ecx
je 0x100b579f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x430], eax
mov byte [ebp - 4], 0x11
call fcn.100c32b9
mov ecx, eax
test ecx, ecx
je 0x100b579f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x46c], eax
mov byte [ebp - 4], 0x13
call fcn.100c32b9
mov ecx, eax
test ecx, ecx
je 0x100b579f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x44c], eax
mov byte [ebp - 4], 0x15
lea eax, [ebx - 1]
push 0x2c
push eax
push dword [ebp - 0x43c]
lea eax, [ebp - 0x430]
push eax
call fcn.100ceba1
push 0x2c
push ebx
push dword [ebp - 0x43c]
lea eax, [ebp - 0x46c]
push eax
call fcn.100ceba1
push 0x2c
lea eax, [ebx + 1]
push eax
push dword [ebp - 0x43c]
lea eax, [ebp - 0x44c]
push eax
call fcn.100ceba1
call fcn.100c32b9
mov ecx, eax
test ecx, ecx
je 0x100b579f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x438], eax
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x438]
push 0x103c91c8
push str._swlan
push eax
call fcn.10002d90
mov eax, dword [ebp - 0x430]
add esp, 0xc
cmp dword [eax - 0xc], 0
jl 0x100b50e9
push str.ssid
push eax
call fcn.102bc5fc
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x430]
test ecx, ecx
je 0x100b4a80
sub ecx, eax
jne 0x100b4a80
lea eax, [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x42c]
call fcn.1000c7b0
mov eax, dword [ebp - 0x42c]
mov edx, 0x103c98fc
sub edx, eax
nop
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x100b4a40
cmp dword [0x103ca014], 0
mov eax, dword [0x103ca018]
mov dword [0x103c9784], eax
je 0x100b4a70
mov ecx, dword [0x103c911c]
call fcn.1009a330
jmp 0x100b50e9
mov ecx, dword [0x103c9140]
call fcn.100aec10
jmp 0x100b50e9
cmp dword [eax - 0xc], 0
jl 0x100b50e9
push 0x10320ce8
push eax
call fcn.102bc5fc
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x430]
test ecx, ecx
je 0x100b4d07
sub ecx, eax
jne 0x100b4d07
mov eax, dword [ebp - 0x44c]
test eax, eax
je 0x100b579f
push eax
push dword [ebp - 0x480]
call fcn.102b2edb
add esp, 8
test eax, eax
je 0x100b51d6
lea eax, [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x470]
call fcn.1000c7b0
cmp dword [0x103ca018], 0
je 0x100b50e9
push 0x10320cec
push dword [ebp - 0x438]
call fcn.102be73d
add esp, 8
lea ecx, [ebp - 0x448]
mov esi, eax
push str.__xml_version_1.0____WLANProfile_xmlns_http:__www.microsoft.com_networking_WLAN_profile_v1___name_
call fcn.10008de0
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x448]
push esi
push dword [ecx - 0xc]
push 1
push ecx
call fcn.102bec6b
mov eax, dword [ebp - 0x42c]
push esi
push dword [eax - 0xc]
push 1
push eax
call fcn.102bec6b
add esp, 0x20
lea ecx, [ebp - 0x448]
push 0x1f
push str.__name__SSIDConfig__SSID__name_
call fcn.1000aa00
mov eax, dword [ebp - 0x448]
push esi
push dword [eax - 0xc]
push 1
push eax
call fcn.102bec6b
mov eax, dword [ebp - 0x42c]
push esi
push dword [eax - 0xc]
push 1
push eax
call fcn.102bec6b
add esp, 0x20
lea ecx, [ebp - 0x448]
push 0x141
push str.__name___SSID___SSIDConfig__connectionType_ESS__connectionType__connectionMode_auto__connectionMode__MSM__security__authEncryption__authentication_WPA2PSK__authentication__encryption_AES__encryption__useOneX_false__useOneX___authEncryption__sharedKey__keyType_passPhrase__keyType__protected_false__protected__keyMaterial_
call fcn.1000aa00
mov eax, dword [ebp - 0x448]
push esi
push dword [eax - 0xc]
push 1
push eax
call fcn.102bec6b
mov eax, dword [ebp - 0x470]
push esi
push dword [eax - 0xc]
push 1
push eax
call fcn.102bec6b
add esp, 0x20
lea ecx, [ebp - 0x448]
push 0x39
push str.__keyMaterial___sharedKey___security___MSM___WLANProfile_
call fcn.1000aa00
mov eax, dword [ebp - 0x448]
push esi
push dword [eax - 0xc]
push 1
push eax
call fcn.102bec6b
add esp, 0x10
lea ecx, [ebp - 0x434]
call fcn.100032e0
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x4bc]
push 0x3c
push 0
push eax
call fcn.10296750
push dword [ebp - 0x438]
lea eax, [ebp - 0x434]
push str.wlan_add_profile_filename_s
push eax
call fcn.10002d90
mov eax, dword [ebp - 0x434]
add esp, 0x18
mov dword [ebp - 0x4a8], eax
lea eax, [ebp - 0x4bc]
mov dword [ebp - 0x4bc], 0x3c
mov dword [ebp - 0x4b0], str.open
push eax
mov dword [ebp - 0x4ac], str.netsh.exe
mov dword [ebp - 0x4a0], 0
mov dword [ebp - 0x4b8], 0x140
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push 0x3c
lea eax, [ebp - 0x4bc]
push 0
push eax
call fcn.10296750
mov eax, dword [ebp - 0x42c]
push eax
push eax
lea eax, [ebp - 0x434]
push str.wlan_connect_name_s_ssid_s
push eax
call fcn.10002d90
mov eax, dword [ebp - 0x434]
add esp, 0x1c
mov dword [ebp - 0x4a8], eax
lea eax, [ebp - 0x4bc]
mov dword [ebp - 0x4bc], 0x3c
mov dword [ebp - 0x4b0], str.open
push eax
mov dword [ebp - 0x4ac], str.netsh.exe
mov dword [ebp - 0x4a0], 0
mov dword [ebp - 0x4b8], 0x140
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push esi
call fcn.102bdded
add esp, 4
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x434]
call fcn.10002aa0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x448]
call fcn.10002aa0
jmp 0x100b50e3
cmp dword [eax - 0xc], 0
jl 0x100b50e9
push 0x10320f44
push eax
call fcn.102bc5fc
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x430]
test ecx, ecx
je 0x100b518e
sub ecx, eax
jne 0x100b518e
mov eax, dword [ebp - 0x450]
push ecx
push ecx
push 0x1004
push dword [eax + 0xcd0]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, eax
lea ecx, [ebp - 0x45c]
mov dword [ebp - 0x424], ebx
call fcn.100032e0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x458]
call fcn.100032e0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x454]
call fcn.100032e0
mov byte [ebp - 4], 0x1c
xor esi, esi
test ebx, ebx
jle 0x100b507a
mov ebx, dword [ebp - 0x450]
add ebx, 0xcb0
nop dword [eax + eax]
push 0
push esi
lea eax, [ebp - 0x474]
mov ecx, ebx
push eax
call fcn.100d83ab
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x45c]
push eax
call fcn.1000c7b0
mov byte [ebp - 4], 0x1c
mov eax, edi
mov edx, dword [ebp - 0x474]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b4de2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 2
push esi
lea eax, [ebp - 0x478]
mov ecx, ebx
push eax
call fcn.100d83ab
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x458]
push eax
call fcn.1000c7b0
mov byte [ebp - 4], 0x1c
mov eax, edi
mov edx, dword [ebp - 0x478]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b4e24
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 4
push esi
lea eax, [ebp - 0x47c]
mov ecx, ebx
push eax
call fcn.100d83ab
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x454]
push eax
call fcn.1000c7b0
mov byte [ebp - 4], 0x1c
mov eax, edi
mov edx, dword [ebp - 0x47c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b4e66
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x45c]
test eax, eax
je 0x100b579f
push eax
push dword [ebp - 0x44c]
call fcn.102b2edb
add esp, 8
test eax, eax
je 0x100b4e99
inc esi
cmp esi, dword [ebp - 0x424]
jl 0x100b4da0
jmp 0x100b507a
push dword [ebp - 0x458]
mov dword [0x103c9f98], 1
push 0x1031f534
push 0x103c9f9c
call fcn.100029e0
mov eax, dword [ebp - 0x458]
mov edx, 0x103c94c8
add esp, 0xc
sub edx, eax
nop dword [eax + eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x100b4ed0
cmp dword [0x103ca014], 0
mov ecx, dword [0x103c911c]
push 0x103c94c8
push 0x12ad
jne 0x100b4efc
mov ecx, dword [0x103c9140]
call fcn.100cdaf4
push 0x103c94c8
call fcn.100be9f0
add esp, 4
mov ebx, eax
call fcn.100c3b5c
push 0x100
mov ecx, dword [eax + 8]
lea eax, [ebp - 0x120]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x120]
push 0x2e
push eax
call fcn.102a1020
mov byte [eax], 0
mov eax, ebx
shr eax, 0x18
push eax
shr ebx, 0x10
movzx eax, bl
push eax
lea eax, [ebp - 0x320]
push str.__2.2d__2.2d
push eax
call fcn.100029e0
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x220]
push str.Load_Setting_File_:__s_s.ini
push eax
call fcn.100029e0
add esp, 0x28
lea eax, [ebp - 0x220]
push eax
call sym.VADAV.dll_VD_LogMsg
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x420]
push str._s_s.ini
push eax
call fcn.100029e0
add esp, 0x10
lea eax, [ebp - 0x420]
mov ecx, 0x103c8f10
push eax
call fcn.10008060
push 0x1031f298
mov ecx, 0x103c8f10
call fcn.10008160
push 0x103c94c8
push str.IPAddr
mov ecx, 0x103c8f10
call fcn.10008140
push 1
push 1
lea eax, [ebp - 0x420]
mov ecx, 0x103c8e30
push eax
call fcn.1002c7c0
cmp dword [0x103ca014], 0
je 0x100b500f
mov ecx, dword [0x103c911c]
call fcn.1009a330
mov ecx, dword [0x103c911c]
jmp 0x100b5020
mov ecx, dword [0x103c9140]
call fcn.100aec10
mov ecx, dword [0x103c9140]
push 0
push dword [0x103c9a24]
push 0x14e
push 0xfa5
call fcn.100cda2f
push 0x103c94c8
push dword [ebp - 0x45c]
lea eax, [ebp - 0x120]
push str.Register_:__s__s_
push eax
call fcn.100029e0
mov ecx, dword [ebp - 0x450]
lea eax, [ebp - 0x120]
add esp, 0x10
push eax
push 0x2721
call fcn.100cdaf4
mov ecx, dword [ebp - 0x450]
push 0
call fcn.100ca535
mov byte [ebp - 4], 0x1b
mov eax, edi
mov edx, dword [ebp - 0x454]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b509b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x1a
mov eax, edi
mov edx, dword [ebp - 0x458]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b50bc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x17
mov eax, edi
mov edx, dword [ebp - 0x45c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b50dd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x468]
mov esi, dword [ebp - 0x460]
mov byte [ebp - 4], 0x15
mov eax, edi
mov edx, dword [ebp - 0x438]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b510a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x13
mov eax, edi
mov edx, dword [ebp - 0x44c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b512b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x11
mov eax, edi
mov edx, dword [ebp - 0x46c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b514c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xf
mov eax, edi
mov edx, dword [ebp - 0x430]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b516d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
inc esi
add ebx, 3
mov dword [ebp - 0x460], esi
mov dword [ebp - 0x468], ebx
cmp esi, dword [ebp - 0x444]
jl 0x100b4910
jmp 0x100b5212
cmp dword [eax - 0xc], 0
jl 0x100b50e9
push str.crcok
push eax
call fcn.102bc5fc
add esp, 8
test eax, eax
je 0x100b50e9
sub eax, dword [ebp - 0x430]
jne 0x100b50e9
push str.CRCOK_Checked
call fcn.10025e80
add esp, 4
mov dword [0x103c9f98], 0
jmp 0x100b50e9
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x438]
call fcn.10002aa0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x44c]
call fcn.10002aa0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x46c]
call fcn.10002aa0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x430]
call fcn.10002aa0
mov byte [ebp - 4], 0xe
mov eax, edi
mov edx, dword [ebp - 0x470]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b5233
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 9
mov eax, edi
mov edx, dword [ebp - 0x42c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b5254
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 8
mov eax, edi
mov edx, dword [ebp - 0x464]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b5275
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 6
mov eax, edi
mov edx, dword [ebp - 0x440]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b5296
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov eax, edi
mov edx, dword [ebp - 0x43c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b52b7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x100b573c
call fcn.100c3b5c
push 0x100
lea ecx, [ebp - 0x120]
push ecx
mov eax, dword [eax + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x120]
push 0x5c
push eax
call fcn.102a1020
lea ecx, [ebp - 0x120]
add esp, 8
lea edx, [ecx + 1]
mov byte [eax], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100b5300
mov ax, word [0x10320aec]
lea ebx, [esi + 0xc4]
movq xmm0, qword [str.SHARE.INI]
sub ecx, edx
movq qword [ebp + ecx - 0x120], xmm0
mov word [ebp + ecx - 0x118], ax
mov al, byte [0x10320aee]
mov byte [ebp + ecx - 0x116], al
lea eax, [ebp - 0x120]
push eax
mov ecx, ebx
call fcn.10008060
push 0x10320af0
mov ecx, ebx
call fcn.10008160
push 0
push 0
push 0x1004
push dword [esi + 0xcd0]
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 0x10320af8
mov ecx, ebx
mov dword [ebp - 0x444], eax
call fcn.100080f0
push 0x103c9fc4
push 0x1031f318
mov ecx, ebx
call fcn.10008140
push 0x103c9fec
push 0x10320b04
mov ecx, ebx
call fcn.10008140
push dword [0x103ca01c]
mov ecx, ebx
push 0x10320afc
call fcn.100080f0
call fcn.100c32b9
mov ecx, eax
test ecx, ecx
je 0x100b57bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x42c], eax
mov byte [ebp - 4], 0x30
call fcn.100c32b9
mov ecx, eax
test ecx, ecx
je 0x100b57c7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x434], eax
mov byte [ebp - 4], 0x32
call fcn.100c32b9
mov ecx, eax
test ecx, ecx
je 0x100b57d1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x438], eax
mov byte [ebp - 4], 0x34
xor esi, esi
cmp dword [ebp - 0x444], esi
jle 0x100b56b2
mov eax, dword [ebp - 0x450]
add eax, 0xcb0
mov dword [ebp - 0x440], eax
push 0
push esi
lea ecx, [ebp - 0x47c]
push ecx
mov ecx, eax
call fcn.100d83ab
mov byte [ebp - 4], 0x35
mov ecx, dword [eax]
mov ebx, dword [ebp - 0x42c]
add ebx, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, ebx
je 0x100b54aa
cmp dword [ebx + 0xc], 0
jl 0x100b549b
mov eax, dword [edx]
cmp eax, dword [ebx]
jne 0x100b549b
push edx
call fcn.100092d0
add esp, 4
mov dword [ebp - 0x424], eax
mov ecx, edi
lea edx, [ebx + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100b5490
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x424]
add eax, 0x10
mov dword [ebp - 0x42c], eax
jmp 0x100b54aa
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x42c]
call fcn.1000aa00
mov byte [ebp - 4], 0x34
mov eax, edi
mov edx, dword [ebp - 0x47c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b54cb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x440]
lea eax, [ebp - 0x478]
push 2
push esi
push eax
call fcn.100d83ab
mov byte [ebp - 4], 0x37
mov ecx, dword [eax]
mov ebx, dword [ebp - 0x434]
add ebx, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, ebx
je 0x100b5547
cmp dword [ebx + 0xc], 0
jl 0x100b5538
mov eax, dword [edx]
cmp eax, dword [ebx]
jne 0x100b5538
push edx
call fcn.100092d0
add esp, 4
mov dword [ebp - 0x424], eax
mov ecx, edi
lea edx, [ebx + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100b552d
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x424]
add eax, 0x10
mov dword [ebp - 0x434], eax
jmp 0x100b5547
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x434]
call fcn.1000aa00
mov byte [ebp - 4], 0x34
mov eax, edi
mov edx, dword [ebp - 0x478]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b5568
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x440]
lea eax, [ebp - 0x474]
push 4
push esi
push eax
call fcn.100d83ab
mov byte [ebp - 4], 0x39
mov ecx, dword [eax]
mov ebx, dword [ebp - 0x438]
add ebx, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, ebx
je 0x100b55e4
cmp dword [ebx + 0xc], 0
jl 0x100b55d5
mov eax, dword [edx]
cmp eax, dword [ebx]
jne 0x100b55d5
push edx
call fcn.100092d0
add esp, 4
mov dword [ebp - 0x424], eax
mov ecx, edi
lea edx, [ebx + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100b55ca
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x424]
add eax, 0x10
mov dword [ebp - 0x438], eax
jmp 0x100b55e4
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x438]
call fcn.1000aa00
mov byte [ebp - 4], 0x34
mov eax, edi
mov edx, dword [ebp - 0x474]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b5605
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x440]
lea eax, [ebp - 0x454]
push 6
push esi
push eax
call fcn.100d83ab
mov byte [ebp - 4], 0x3b
push dword [eax]
call fcn.102bcab8
add esp, 4
mov ebx, eax
mov byte [ebp - 4], 0x34
mov ecx, edi
mov edx, dword [ebp - 0x454]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x100b564b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
inc esi
lea eax, [ebp - 0x20]
push esi
push str.Reg_d
push eax
call fcn.100029e0
push ebx
push dword [ebp - 0x438]
lea eax, [ebp - 0x220]
push dword [ebp - 0x434]
push dword [ebp - 0x42c]
push str._s__s__s__d
push eax
call fcn.100029e0
mov ebx, dword [ebp - 0x450]
lea eax, [ebp - 0x220]
add esp, 0x24
add ebx, 0xc4
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10008140
mov eax, dword [ebp - 0x440]
cmp esi, dword [ebp - 0x444]
jl 0x100b5432
mov esi, dword [ebp - 0x450]
push ebx
push 0xfa1
push esi
call fcn.100be280
add esp, 0xc
mov byte [ebp - 4], 0x32
mov eax, edi
mov edx, dword [ebp - 0x438]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b56e8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x30
mov eax, edi
mov edx, dword [ebp - 0x434]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b5709
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov eax, edi
mov edx, dword [ebp - 0x42c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b572a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100ca82c
mov esi, eax
mov byte [ebp - 4], 1
mov ecx, edi
mov edx, dword [ebp - 0x480]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x100b575d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x428]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x100b577f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10291e04
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10002bc0
push 0x80004005
call fcn.10002bc0
push 0x80070057
call fcn.10002bc0
push 0x80004005
call fcn.10002bc0
push 0x80004005
call fcn.10002bc0
push 0x80004005
call fcn.10002bc0
int3