Function at 0x1001a391
Capabilities:
Check os version
Create process on windows
Delete registry key
Extract resource via kernel32 functions
Get common file path

Disassembly:
mov eax, 0x100845a4
call fcn.10083cb8
sub esp, 0x1d4
push ebx
push esi
push edi
mov dword [ebp - 0x54], ecx
lea eax, [ebp - 0x1a8]
push dword [ebp - 0x54]
xor ebx, ebx
mov dword [ebp - 0x68], edx
push eax
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x24], 0xfe1f230
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0xbec3a435
mov dword [ebp - 0x30], 0x6770d28c
lea ecx, [ebp - 0xd0]
push ebx
movdqu xmmword [ebp - 0x1b8], xmm0
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], ebx
call fcn.1001902b
push 3
pop esi
push 4
mov dword [ebp - 0x1c], ebx
pop edi
jmp 0x1001a410
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x50], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001a406
mov dword [ebp - 0x4c], 0xffffffef
cmp dword [ebp - 0x4c], 0x11
jne 0x1001a541
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x30], 0xe0c23782
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x34], 0xeacb2d50
mov dword [ebp - 0x1c], ebx
jmp 0x1001a45b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a8], 0x7933
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001a44a
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, 0xc9f1
mov eax, dword [ebp - 0x50]
setne cl
add eax, ecx
cmp eax, dword [ebp - 0x50]
jne 0x1001a47a
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
test eax, eax
setle cl
imul ecx, dword [ebp - 0x28]
add ecx, 0x3a7e
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x30]
cmp eax, 0x14faf141
mov eax, dword [ebp - 0x4c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1a8]
mov esi, dword [ebp - 0x4c]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
imul eax, ecx, 0x4cf2
mov ecx, dword [ebp - 0x48]
sub esi, eax
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, esi
setl al
xor edx, edx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setge dl
xor eax, eax
cmp edx, 0xfffffffa
setge al
xor edx, edx
cmp eax, 0x694a
mov eax, dword [ebp - 0x1a8]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ebx
jne 0x1001a51c
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x34], 0xfffffffe
jne 0x1001a52c
cmp dword [ebp - 0x20], ebx
je 0x1001a52c
xor eax, eax
inc eax
jmp 0x1001a52e
mov eax, ebx
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0x11
je 0x1001a426
push 3
pop esi
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
cmp eax, 0x389d
mov eax, dword [ebp - 0x4c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
imul eax, edx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
cmp eax, 0xcbf7
setge cl
cmp ecx, dword [ebp - 0x18]
jne 0x1001a588
cmp dword [ebp - 0x4c], ebx
jne 0x1001a588
mov eax, ebx
jmp 0x1001a58b
xor eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
add eax, esi
cmp eax, dword [ebp - 0x18]
jl 0x1001a59b
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0xffffffff
setl al
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x18]
jne 0x1001a5c7
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub eax, 0xffff0224
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x18]
jg 0x1001a5e3
cmp dword [ebp - 0x4c], ebx
je 0x1001a5e3
xor ecx, ecx
inc ecx
jmp 0x1001a5e5
mov ecx, ebx
mov eax, dword [ebp - 0x18]
add ecx, 0xfffffffb
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xd0]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0xd0]
call fcn.100182da
mov dword [ebp - 0x1c], ebx
xor edx, edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], 0xb2ab76d6
mov dword [ebp - 0x14], 0x46c3
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, 0x6525
setge al
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x30]
setl cl
imul ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x14]
jg 0x1001a6b0
cmp dword [ebp - 0x24], ebx
jne 0x1001a6b0
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1001a68c
push ebx
push 0x1f73
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov dword [ebp - 0x18], 0xa
jmp 0x1001a6a8
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1001a6a5
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 7
jne 0x1001a695
jmp 0x1001a6f1
mov dword [ebp - 0x1c], ebx
jmp 0x1001a6c6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1d0], 0x7b2415fb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001a6b5
mov dword [ebp - 0x14], ebx
jmp 0x1001a6ec
mov dword [ebp - 0x24], ebx
jmp 0x1001a6e4
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x1d0], ebx
jne 0x1001a6e9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x1001a6d5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1001a6d0
mov dword [ebp - 0x64], 0xffffffff
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x20], 0x4432
mov dword [ebp - 0x18], 0xfffe
mov dword [ebp - 0x2c], 0xb0a3531f
push 2
call fcn.10017abd
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1001a733
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1c0], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001a722
mov dword [ebp - 0x14], ebx
jmp 0x1001a751
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x188]
mov dword [eax + ecx*4], 0x459c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001a73e
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x20], ebx
je 0x1001a7ba
mov dword [ebp - 0x18], ebx
jmp 0x1001a7af
mov dword [ebp - 0x2c], ebx
jmp 0x1001a795
cmp byte [ebp - 0xd], 0
je 0x1001a792
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 1
mov byte [ebp - 0xd], bl
jle 0x1001a784
cmp byte [ebp - 0xd], 0
je 0x1001a7ac
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jle 0x1001a77f
jmp 0x1001a89d
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0x30
jl 0x1001a89d
push 2
lea ecx, [ebp - 0xe8]
call fcn.10017abd
mov dword [ebp - 0x30], 0x49f7fae0
mov dword [ebp - 0x30], 0x6354d184
mov dword [ebp - 0x1c], ebx
jmp 0x1001a801
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xe8]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1001a7f1
mov dword [ebp - 0x2c], 0xffffffe8
cmp dword [ebp - 0x2c], 0xf
jl 0x1001a882
mov esi, dword [ebp - 0xe8]
xor ecx, ecx
mov dword [ebp - 0x20], 0x9002fce4
mov eax, dword [ebp - 0x34]
cmp dword [esi + 4], eax
mov eax, dword [ebp - 0xe8]
setne cl
xor edx, edx
cmp ecx, 0xe85dc32c
setne dl
xor ecx, ecx
cmp edx, dword [eax]
mov eax, 0xf8d36fbc
setne cl
add ecx, 0xffff
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
imul eax, dword [ebp - 0x20], 0x39bb
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
je 0x1001a869
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], 0xa7fcf623
inc dword [ebp - 0x3c]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xf
jge 0x1001a81a
lea ecx, [ebp - 0xe8]
call fcn.100182da
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x30
jge 0x1001a7d1
push 3
pop esi
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001a8b2
push ebx
push 0x257e
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x188]
call fcn.100182da
mov dword [ebp - 0x24], 0xa8360e56
mov dword [ebp - 0x28], 0xb9f9b31
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x28], 6
jmp 0x1001aa0a
mov dword [ebp - 0x2c], 0xc6f1bf50
lea ecx, [ebp - 0xf4]
call fcn.10017abd
mov dword [ebp - 0x1c], ebx
jmp 0x1001a924
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf4]
mov dword [eax + ecx*4], 0x1d686a37
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1001a911
mov dword [ebp - 0x2c], 0x10
jmp 0x1001a9e7
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x130], edi
mov dword [ebp - 0x12c], edi
mov dword [ebp - 0x128], edi
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001a962
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], esi
jg 0x1001a9e4
mov ecx, dword [ebp - 0xf4]
xor edx, edx
inc edx
mov dword [ebp - 0x1c], ebx
jmp 0x1001a989
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd8], 0x233fd52
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1001a978
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa0], 0x3e38693
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xa0]
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xa0]
mov dword [ebp - 0xd8], edx
mov eax, dword [ebp - 0x2c]
mov dword [ecx + 4], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1001a973
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x18
je 0x1001a936
mov eax, dword [ebp - 0xf4]
lea ecx, [ebp - 0xf4]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
call fcn.100182da
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xc
push 2
jg 0x1001a8fa
mov dword [ebp - 0x30], 1
lea ecx, [ebp - 0x14c]
call fcn.10017abd
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x1001aa55
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14c]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1001aa45
mov dword [ebp - 0xa8], ebx
jmp 0x1001aa7a
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001aa74
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
inc dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], 1
jle 0x1001aa63
lea ecx, [ebp - 0x14c]
call fcn.100182da
mov eax, 0xf112
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], eax
push 2
mov dword [ebp - 0x18c], eax
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0x8d38
mov dword [ebp - 0x1c], ebx
jmp 0x1001aac7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5c], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1001aabd
mov dword [ebp - 0x58], esi
cmp dword [ebp - 0x58], ebx
jl 0x1001aaf8
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001aaf3
push 0x25a
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
dec dword [ebp - 0x58]
jns 0x1001aad4
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x58]
push 9
mov dword [ebp - 0x34], eax
pop edi
je 0x1001ab15
mov dword [ebp - 0x30], 0xe1dfe009
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x30], eax
jmp 0x1001ab85
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 0x1c], ebx
jmp 0x1001ab3c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6c], 0xafca8629
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x1001ab2e
inc dword [ebp - 0x30]
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], ebx
jl 0x1001ab85
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x5c], ebx
je 0x1001ab6b
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001ab80
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x1001ab80
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
mov edx, dword [ebp - 0x6c]
inc ecx
sub ecx, eax
mov eax, dword [ebp - 0x14]
imul edx, ecx
mov dword [ebp + eax*4 - 0x5c], edx
dec dword [ebp - 0x14]
jns 0x1001ab51
mov dword [ebp - 0x1c], ebx
jmp 0x1001ab9b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x90], 1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001ab8a
mov dword [ebp - 0x1c], ebx
jmp 0x1001af49
push esi
lea ecx, [ebp - 0x158]
call fcn.10017abd
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x30], ebx
push 2
call fcn.10017abd
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0xd4], 0xbdd4
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x20], 0x4752e4a6
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x40], 0xe67b33df
mov dword [ebp - 0x34], 0xa3a768fb
mov dword [ebp - 0x18], ebx
jmp 0x1001ac24
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xbc]
mov dword [eax + ecx*4], 0xde57
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001ac11
mov dword [ebp - 0x18], ebx
jmp 0x1001ac40
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x164], 0x1b167519
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001ac2f
mov dword [ebp - 0x18], ebx
jmp 0x1001ac57
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc0], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1001ac4a
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0xbc]
cmp eax, dword [esi + 4]
mov eax, dword [ebp - 0xd4]
setle cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setl cl
sub ecx, dword [ebp - 0x30]
add ecx, 0x5900
cmp ecx, 0xfffa
sbb eax, eax
neg eax
sub eax, 0xd65121ac
neg eax
sbb eax, eax
xor edx, edx
inc eax
add eax, dword [esi + 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setle dl
sub edx, 7
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setge cl
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x14], ebx
je 0x1001adad
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xbc]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x40]
dec dword [ebp - 0x40]
cmp ecx, eax
jle 0x1001ad19
cmp dword [ebp - 0x14], ebx
je 0x1001ad15
cmp dword [ebp - 0x164], ebx
jne 0x1001ad19
mov ecx, ebx
jmp 0x1001ad1c
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x3c]
imul eax, ecx
test eax, eax
jne 0x1001ad2f
cmp dword [ebp - 0x38], ebx
jne 0x1001ad2f
mov edx, ebx
jmp 0x1001ad32
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
sete cl
xor edx, edx
cmp ecx, 0xfffffffe
setle dl
sub edx, 0xfffffffb
neg edx
sbb edx, edx
lea ecx, [edx + 1]
xor edx, edx
add ecx, dword [esi + 4]
mov dword [ebp - 0x164], ecx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0xbc]
sete dl
xor ecx, ecx
cmp edx, dword [eax]
setne cl
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], ebx
jne 0x1001ad7b
cmp dword [ebp - 0x2c], ebx
je 0x1001ad85
cmp dword [esi + 4], ebx
je 0x1001ad85
xor edx, edx
inc edx
jmp 0x1001ad87
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
sub eax, 0xb2a93f04
neg eax
sbb eax, eax
inc eax
cmp eax, 0xfff9
jb 0x1001adad
xor eax, eax
inc eax
jmp 0x1001adaf
mov eax, ebx
mov ecx, 0xbc4638b1
cmp ecx, eax
push 0xfffffffffffffffb
sbb eax, eax
xor edx, edx
neg eax
add eax, dword [esi + 4]
pop esi
cmp eax, esi
mov eax, dword [ebp - 0xc0]
setl dl
sub edx, eax
mov eax, dword [ebp - 0x2c]
sub edx, 0x559c
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
sete cl
xor edx, edx
sub ecx, 0x1c31
cmp ecx, eax
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
sub edx, 0x24235991
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0xbc]
call fcn.100182da
mov dword [ebp - 0x38], 0x263d
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x38], esi
push 3
pop esi
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x38], 0x451f1e28
mov dword [ebp - 0x38], 0xb4cf22a1
push esi
call fcn.10017abd
mov dword [ebp - 0x14], 0xb457102d
mov dword [ebp - 0x28], ebx
jmp 0x1001ae62
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], 0xc692beaa
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1001ae4f
mov dword [ebp - 0x14], ebx
jmp 0x1001ae7f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], 0x9febb674
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001ae6c
mov dword [ebp - 0x14], 0x14
jmp 0x1001aecd
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x28], 0xfffffff8
jmp 0x1001aeb2
cmp byte [ebp - 0xd], 0
je 0x1001aeaf
push ebx
push ebx
push 0x20
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe5
mov byte [ebp - 0xd], bl
je 0x1001ae9d
cmp byte [ebp - 0xd], 0
je 0x1001aeca
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffff
jle 0x1001ae8d
lea ecx, [ebp - 0x100]
call fcn.100182da
push 2
lea ecx, [ebp - 0x17c]
call fcn.10017abd
lea eax, [ebp - 0x158]
mov byte [ebp - 4], 2
push eax
push 0x7cf
xor dl, dl
lea ecx, [ebp - 0xdc]
call fcn.10019953
push 0x5105
push ebx
push 0x4b57
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x17c]
push eax
call fcn.100251fd
add esp, 0x1c
lea ecx, [ebp - 0x17c]
inc dword [ebp - 0x24]
call fcn.100182da
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x158]
call fcn.100182da
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1001aba8
mov dword [ebp - 0x18], 0xaeb9ae77
mov eax, 0xbdec7e1
mov dword [ebp - 0x2c], 0x55595070
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x30], 0x44fe
mov dword [ebp - 0x20], 0x949e3b93
mov dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
sub edx, eax
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x18]
je 0x1001b0ce
mov dword [ebp - 0x34], 0xfff6
lea ecx, [ebp - 0x118]
push 2
mov dword [ebp - 0x3c], 0xb94d0f4f
pop eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x28], 0x89276496
push eax
call fcn.10017abd
mov dword [ebp - 0x14], ebx
jmp 0x1001affd
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x118]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001afea
mov eax, dword [ebp - 0x34]
xor edx, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setg dl
cmp edx, 4
jae 0x1001b027
cmp dword [ebp - 0x40], ebx
jne 0x1001b027
mov eax, ebx
jmp 0x1001b02a
xor eax, eax
inc eax
inc dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xa1d2daff
sbb eax, eax
neg eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x34]
inc ecx
sub ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
je 0x1001b061
cmp dword [ebp - 0x28], ebx
je 0x1001b061
xor eax, eax
inc eax
jmp 0x1001b063
mov eax, ebx
mov ecx, dword [ebp - 0x18]
imul ecx, eax
mov eax, dword [ebp - 0x118]
mov dword [eax + 4], ecx
mov dword [ebp - 0x28], 0xffffffe3
jmp 0x1001b0b8
mov dword [ebp - 0x38], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0xffffffe5
jmp 0x1001b0af
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001b0a7
push ebx
push 0x1da3
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
cmp dword [ebp - 0x38], ebx
jne 0x1001b0b5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff9
jne 0x1001b091
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x16
jge 0x1001b07b
lea ecx, [ebp - 0x118]
call fcn.100182da
jmp 0x1001b194
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x18], 0xffffffe8
jmp 0x1001b18a
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1001b0f6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1001b0e9
mov dword [ebp - 0x14], ebx
jmp 0x1001b10e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1e0], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001b101
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
test eax, eax
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x34]
setne cl
xor edx, edx
cmp ecx, eax
setg dl
xor ecx, ecx
mov dword [ebp - 0xc4], edx
mov eax, dword [ebp - 0x34]
cmp edx, eax
mov eax, dword [ebp - 0x28]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
sub ecx, 0x567d043c
cmp ecx, 0x58f2
setle al
mov dword [ebp - 0x1d4], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x15
je 0x1001b0dd
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x20]
mov dword [ebp - 0x34], 0xa51e29af
mov eax, dword [ebp - 0x34]
sub edi, eax
mov eax, dword [ebp - 0x30]
cmp edi, eax
setge cl
add ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x78]
imul ecx, eax
mov eax, dword [ebp - 0x18]
add eax, ecx
cmp eax, dword [ebp - 0x78]
jle 0x1001b1ce
cmp dword [ebp - 0x20], ebx
jne 0x1001b1ce
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 1
mov eax, dword [ebp - 0x80]
setle cl
xor edx, edx
imul ecx, ecx, 0x18bf
sub ecx, eax
mov dword [ebp - 0x78], ecx
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x64]
jg 0x1001b293
mov dword [ebp - 0x20], 0xe510b2d4
mov dword [ebp - 0x64], ebx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x24], 8
jl 0x1001b223
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x8c], 0xfffffffc
jne 0x1001b236
cmp dword [ebp - 0x24], ebx
je 0x1001b236
xor eax, eax
inc eax
jmp 0x1001b238
mov eax, ebx
mov dword [ebp - 0x30], eax
xor edx, edx
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x88]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xdd50170a
setne cl
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, eax
mov eax, dword [ebp - 0x20]
cmp edx, eax
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp eax, 0xfffffffe
setne cl
xor eax, eax
cmp ecx, edx
setne al
mov dword [ebp - 0x64], eax
jmp 0x1001b2be
mov dword [ebp - 0x24], ebx
jmp 0x1001b2a9
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x90], 2
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1001b298
cmp dword [ebp - 0x24], 0xfffd
sbb eax, eax
inc eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x64], 1
inc dword [ebp - 0x24]
mov dword [ebp - 0x24], ebx
jmp 0x1001b2e3
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001b2e0
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xa
je 0x1001b2d0
mov esi, dword [ebp - 0x54]
cmp dword [esi + 0x10], ebx
jne 0x1001b2f8
xor al, al
jmp 0x1001b5cb
lea eax, [ebp - 0x68]
mov dl, 1
push 0x22a1
push eax
mov ecx, 0x7f1d
call fcn.10019953
pop ecx
pop ecx
push 3
pop edi
mov dword [ebp - 0x1c], 0xfffffffa
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x30], 0xffffffff
push edi
call fcn.10017abd
mov dword [ebp - 4], edi
mov dword [ebp - 0x20], ebx
jmp 0x1001b347
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x124]
mov dword [eax + ecx*4], 0x9786
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1001b334
push 4
mov dword [ebp - 0x1c], 0xfffffff9
pop edi
cmp dword [ebp - 0x1c], 5
jge 0x1001b441
mov dword [ebp - 0x24], 0x9807
lea ecx, [ebp - 0x140]
push edi
call fcn.10017abd
push 6
pop eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], ebx
jmp 0x1001b391
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x140]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1001b381
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], edi
jmp 0x1001b424
mov dword [ebp - 0x20], 0xd4a0d461
cmp dword [ebp - 0x20], ebx
jne 0x1001b3d8
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
setle cl
xor eax, eax
cmp ecx, 0xdf7b
setne al
cmp eax, dword [ebp - 0x20]
je 0x1001b3d8
mov edx, ebx
jmp 0x1001b3db
xor edx, edx
inc edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setge cl
imul ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x30]
jle 0x1001b41e
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001b405
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001b421
push ebx
push 0x1eb
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
jmp 0x1001b421
inc dword [ebp - 0x34]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xe
jl 0x1001b3a4
lea ecx, [ebp - 0x140]
call fcn.100182da
inc dword [ebp - 0x1c]
jmp 0x1001b356
mov eax, dword [ebp - 0x124]
lea ecx, [ebp - 0x124]
inc dword [eax + 8]
or dword [ebp - 4], 0xffffffff
call fcn.100182da
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], ebx
jge 0x1001b4a0
mov dword [ebp - 0x20], ebx
jmp 0x1001b477
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x74], 0x2443250e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1001b469
cmp dword [ebp - 0x74], ebx
jne 0x1001b494
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x74], 1
inc dword [ebp - 0x24]
js 0x1001b464
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001b4b4
push 0xb07
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
cmp dword [esi + 0x14], 0x10
jb 0x1001b4be
mov ecx, dword [esi]
jmp 0x1001b4c0
mov ecx, esi
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x60], ecx
jb 0x1001b4cd
mov edx, dword [esi]
jmp 0x1001b4cf
mov edx, esi
mov eax, dword [esi + 0x10]
add eax, edx
cmp ecx, eax
je 0x1001b5c9
mov dword [ebp - 0x54], 0xd6f2
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x54], 0x20f89b5
push 2
call fcn.10017abd
mov dword [ebp - 4], edi
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x20], ebx
jmp 0x1001b519
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x170]
mov dword [eax + ecx*4], 0xb8c3ad3b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1001b506
lea eax, [ebp - 0x41]
mov byte [ebp - 0x41], bl
push eax
push ebx
call fcn.1001e7cf
inc dword [ebp - 0x30]
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x170]
call fcn.100182da
mov eax, dword [ebp - 0x60]
mov al, byte [eax]
cmp al, 0x30
jl 0x1001b56e
cmp al, 0x39
jg 0x1001b56e
lea eax, [ebp - 0x60]
push eax
push 0x6e42
push ebx
lea eax, [ebp - 0x68]
push 0x53
push eax
call fcn.1001e018
mov ecx, dword [ebp - 0x60]
add esp, 0x14
inc ecx
jmp 0x1001b4c0
push 1
lea ecx, [ebp - 0x10c]
call fcn.10017abd
mov dword [ebp - 0x20], ebx
jmp 0x1001b590
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10c]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x1001b580
mov eax, dword [ebp - 0x10c]
mov dword [eax], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001b5b4
push ebx
push 0x1725
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
lea ecx, [ebp - 0x10c]
call fcn.100182da
mov eax, dword [ebp - 0x68]
mov dword [eax], ebx
jmp 0x1001b2f1
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret