Function at 0x10005350
Capabilities:
Contain obfuscated stackstrings
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101dba7d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x16a4
call fcn.100d0310
mov eax, dword [0x1025e344]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x1698], edi
mov dword [ebp - 0x16a4], edi
mov dword [ebp - 0x15d4], 0
mov dword [ebp - 0x15d0], 0
mov dword [ebp - 0x15d4], 0
mov dword [ebp - 0x15d0], 7
xor eax, eax
mov word [ebp - 0x15e4], ax
push 7
push str.DESKTOP
lea ecx, [ebp - 0x15e4]
call fcn.10007210
mov dword [ebp - 4], 0
mov dword [ebp - 0x15bc], 0
mov dword [ebp - 0x15b8], 0
mov dword [ebp - 0x15bc], 0
mov dword [ebp - 0x15b8], 7
xor eax, eax
mov word [ebp - 0x15cc], ax
push 8
push str.INTERNET
lea ecx, [ebp - 0x15cc]
call fcn.10007210
mov byte [ebp - 4], 1
mov dword [ebp - 0x15a4], 0
mov dword [ebp - 0x15a0], 0
mov dword [ebp - 0x15a4], 0
mov dword [ebp - 0x15a0], 7
xor eax, eax
mov word [ebp - 0x15b4], ax
push 8
push str.PROGRAMS
lea ecx, [ebp - 0x15b4]
call fcn.10007210
mov byte [ebp - 4], 2
mov dword [ebp - 0x158c], 0
mov dword [ebp - 0x1588], 0
mov dword [ebp - 0x158c], 0
mov dword [ebp - 0x1588], 7
xor eax, eax
mov word [ebp - 0x159c], ax
push 8
push str.CONTROLS
lea ecx, [ebp - 0x159c]
call fcn.10007210
mov byte [ebp - 4], 3
mov dword [ebp - 0x1574], 0
mov dword [ebp - 0x1570], 0
mov dword [ebp - 0x1574], 0
mov dword [ebp - 0x1570], 7
xor eax, eax
mov word [ebp - 0x1584], ax
push 8
push str.PRINTERS
lea ecx, [ebp - 0x1584]
call fcn.10007210
mov byte [ebp - 4], 4
mov dword [ebp - 0x155c], 0
mov dword [ebp - 0x1558], 0
mov dword [ebp - 0x155c], 0
mov dword [ebp - 0x1558], 7
xor eax, eax
mov word [ebp - 0x156c], ax
push 8
push str.PERSONAL
lea ecx, [ebp - 0x156c]
call fcn.10007210
mov byte [ebp - 4], 5
mov dword [ebp - 0x1544], 0
mov dword [ebp - 0x1540], 0
mov dword [ebp - 0x1544], 0
mov dword [ebp - 0x1540], 7
xor eax, eax
mov word [ebp - 0x1554], ax
push 9
push str.FAVORITES
lea ecx, [ebp - 0x1554]
call fcn.10007210
mov byte [ebp - 4], 6
mov dword [ebp - 0x152c], 0
mov dword [ebp - 0x1528], 0
mov dword [ebp - 0x152c], 0
mov dword [ebp - 0x1528], 7
xor eax, eax
mov word [ebp - 0x153c], ax
push 7
push str.STARTUP
lea ecx, [ebp - 0x153c]
call fcn.10007210
mov byte [ebp - 4], 7
mov dword [ebp - 0x1514], 0
mov dword [ebp - 0x1510], 0
mov dword [ebp - 0x1514], 0
mov dword [ebp - 0x1510], 7
xor eax, eax
mov word [ebp - 0x1524], ax
push 6
push str.RECENT
lea ecx, [ebp - 0x1524]
call fcn.10007210
mov byte [ebp - 4], 8
mov dword [ebp - 0x14fc], 0
mov dword [ebp - 0x14f8], 0
mov dword [ebp - 0x14fc], 0
mov dword [ebp - 0x14f8], 7
xor eax, eax
mov word [ebp - 0x150c], ax
push 6
push str.SENDTO
lea ecx, [ebp - 0x150c]
call fcn.10007210
mov byte [ebp - 4], 9
mov dword [ebp - 0x14e4], 0
mov dword [ebp - 0x14e0], 0
mov dword [ebp - 0x14e4], 0
mov dword [ebp - 0x14e0], 7
xor eax, eax
mov word [ebp - 0x14f4], ax
push 9
push str.BITBUCKET
lea ecx, [ebp - 0x14f4]
call fcn.10007210
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x14cc], 0
mov dword [ebp - 0x14c8], 0
mov dword [ebp - 0x14cc], 0
mov dword [ebp - 0x14c8], 7
xor eax, eax
mov word [ebp - 0x14dc], ax
push 9
push str.STARTMENU
lea ecx, [ebp - 0x14dc]
call fcn.10007210
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x14b4], 0
mov dword [ebp - 0x14b0], 0
mov dword [ebp - 0x14b4], 0
mov dword [ebp - 0x14b0], 7
xor eax, eax
mov word [ebp - 0x14c4], ax
push 0xb
push str.MYDOCUMENTS
lea ecx, [ebp - 0x14c4]
call fcn.10007210
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x149c], 0
mov dword [ebp - 0x1498], 0
mov dword [ebp - 0x149c], 0
mov dword [ebp - 0x1498], 7
xor eax, eax
mov word [ebp - 0x14ac], ax
push 7
push str.MYMUSIC
lea ecx, [ebp - 0x14ac]
call fcn.10007210
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x1484], 0
mov dword [ebp - 0x1480], 0
mov dword [ebp - 0x1484], 0
mov dword [ebp - 0x1480], 7
xor eax, eax
mov word [ebp - 0x1494], ax
push 7
push str.MYVIDEO
lea ecx, [ebp - 0x1494]
call fcn.10007210
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x146c], 0
mov dword [ebp - 0x1468], 0
mov dword [ebp - 0x146c], 0
mov dword [ebp - 0x1468], 7
xor eax, eax
mov word [ebp - 0x147c], ax
mov edx, dword [section..data]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005800
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x147c]
call fcn.10007210
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x1454], 0
mov dword [ebp - 0x1450], 0
mov dword [ebp - 0x1454], 0
mov dword [ebp - 0x1450], 7
xor eax, eax
mov word [ebp - 0x1464], ax
push 0x10
push str.DESKTOPDIRECTORY
lea ecx, [ebp - 0x1464]
call fcn.10007210
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x143c], 0
mov dword [ebp - 0x1438], 0
mov dword [ebp - 0x143c], 0
mov dword [ebp - 0x1438], 7
xor eax, eax
mov word [ebp - 0x144c], ax
push 6
push str.DRIVES
lea ecx, [ebp - 0x144c]
call fcn.10007210
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x1424], 0
mov dword [ebp - 0x1420], 0
mov dword [ebp - 0x1424], 0
mov dword [ebp - 0x1420], 7
xor eax, eax
mov word [ebp - 0x1434], ax
push 7
push str.NETWORK
lea ecx, [ebp - 0x1434]
call fcn.10007210
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x140c], 0
mov dword [ebp - 0x1408], 0
mov dword [ebp - 0x140c], 0
mov dword [ebp - 0x1408], 7
xor eax, eax
mov word [ebp - 0x141c], ax
push 7
push str.NETHOOD
lea ecx, [ebp - 0x141c]
call fcn.10007210
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x13f4], 0
mov dword [ebp - 0x13f0], 0
mov dword [ebp - 0x13f4], 0
mov dword [ebp - 0x13f0], 7
xor eax, eax
mov word [ebp - 0x1404], ax
push 5
push str.FONTS
lea ecx, [ebp - 0x1404]
call fcn.10007210
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x13dc], 0
mov dword [ebp - 0x13d8], 0
mov dword [ebp - 0x13dc], 0
mov dword [ebp - 0x13d8], 7
xor eax, eax
mov word [ebp - 0x13ec], ax
push 9
push str.TEMPLATES
lea ecx, [ebp - 0x13ec]
call fcn.10007210
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x13c4], 0
mov dword [ebp - 0x13c0], 0
mov dword [ebp - 0x13c4], 0
mov dword [ebp - 0x13c0], 7
xor eax, eax
mov word [ebp - 0x13d4], ax
push 0x10
push str.COMMON_STARTMENU
lea ecx, [ebp - 0x13d4]
call fcn.10007210
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x13ac], 0
mov dword [ebp - 0x13a8], 0
mov dword [ebp - 0x13ac], 0
mov dword [ebp - 0x13a8], 7
xor eax, eax
mov word [ebp - 0x13bc], ax
push 0xf
push str.COMMON_PROGRAMS
lea ecx, [ebp - 0x13bc]
call fcn.10007210
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x1394], 0
mov dword [ebp - 0x1390], 0
mov dword [ebp - 0x1394], 0
mov dword [ebp - 0x1390], 7
xor eax, eax
mov word [ebp - 0x13a4], ax
push 0xe
push str.COMMON_STARTUP
lea ecx, [ebp - 0x13a4]
call fcn.10007210
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x137c], 0
mov dword [ebp - 0x1378], 0
mov dword [ebp - 0x137c], 0
mov dword [ebp - 0x1378], 7
xor eax, eax
mov word [ebp - 0x138c], ax
push 0x17
push str.COMMON_DESKTOPDIRECTORY
lea ecx, [ebp - 0x138c]
call fcn.10007210
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x1364], 0
mov dword [ebp - 0x1360], 0
mov dword [ebp - 0x1364], 0
mov dword [ebp - 0x1360], 7
xor eax, eax
mov word [ebp - 0x1374], ax
push 7
push str.APPDATA
lea ecx, [ebp - 0x1374]
call fcn.10007210
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x134c], 0
mov dword [ebp - 0x1348], 0
mov dword [ebp - 0x134c], 0
mov dword [ebp - 0x1348], 7
xor eax, eax
mov word [ebp - 0x135c], ax
push 9
push str.PRINTHOOD
lea ecx, [ebp - 0x135c]
call fcn.10007210
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x1334], 0
mov dword [ebp - 0x1330], 0
mov dword [ebp - 0x1334], 0
mov dword [ebp - 0x1330], 7
xor eax, eax
mov word [ebp - 0x1344], ax
push 0xd
push str.LOCAL_APPDATA
lea ecx, [ebp - 0x1344]
call fcn.10007210
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x131c], 0
mov dword [ebp - 0x1318], 0
mov dword [ebp - 0x131c], 0
mov dword [ebp - 0x1318], 7
xor eax, eax
mov word [ebp - 0x132c], ax
push 0xa
push str.ALTSTARTUP
lea ecx, [ebp - 0x132c]
call fcn.10007210
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x1304], 0
mov dword [ebp - 0x1300], 0
mov dword [ebp - 0x1304], 0
mov dword [ebp - 0x1300], 7
xor eax, eax
mov word [ebp - 0x1314], ax
push 0x11
push str.COMMON_ALTSTARTUP
lea ecx, [ebp - 0x1314]
call fcn.10007210
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x12ec], 0
mov dword [ebp - 0x12e8], 0
mov dword [ebp - 0x12ec], 0
mov dword [ebp - 0x12e8], 7
xor eax, eax
mov word [ebp - 0x12fc], ax
push 0x10
push str.COMMON_FAVORITES
lea ecx, [ebp - 0x12fc]
call fcn.10007210
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x12d4], 0
mov dword [ebp - 0x12d0], 0
mov dword [ebp - 0x12d4], 0
mov dword [ebp - 0x12d0], 7
xor eax, eax
mov word [ebp - 0x12e4], ax
push 0xe
push str.INTERNET_CACHE
lea ecx, [ebp - 0x12e4]
call fcn.10007210
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x12bc], 0
mov dword [ebp - 0x12b8], 0
mov dword [ebp - 0x12bc], 0
mov dword [ebp - 0x12b8], 7
xor eax, eax
mov word [ebp - 0x12cc], ax
push 7
push str.COOKIES
lea ecx, [ebp - 0x12cc]
call fcn.10007210
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x12a4], 0
mov dword [ebp - 0x12a0], 0
mov dword [ebp - 0x12a4], 0
mov dword [ebp - 0x12a0], 7
xor eax, eax
mov word [ebp - 0x12b4], ax
push 7
push str.HISTORY
lea ecx, [ebp - 0x12b4]
call fcn.10007210
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x128c], 0
mov dword [ebp - 0x1288], 0
mov dword [ebp - 0x128c], 0
mov dword [ebp - 0x1288], 7
xor eax, eax
mov word [ebp - 0x129c], ax
push 0xe
push str.COMMON_APPDATA
lea ecx, [ebp - 0x129c]
call fcn.10007210
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x1274], 0
mov dword [ebp - 0x1270], 0
mov dword [ebp - 0x1274], 0
mov dword [ebp - 0x1270], 7
xor eax, eax
mov word [ebp - 0x1284], ax
push 7
push str.WINDOWS
lea ecx, [ebp - 0x1284]
call fcn.10007210
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x125c], 0
mov dword [ebp - 0x1258], 0
mov dword [ebp - 0x125c], 0
mov dword [ebp - 0x1258], 7
xor eax, eax
mov word [ebp - 0x126c], ax
push 6
push str.SYSTEM
lea ecx, [ebp - 0x126c]
call fcn.10007210
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x1244], 0
mov dword [ebp - 0x1240], 0
mov dword [ebp - 0x1244], 0
mov dword [ebp - 0x1240], 7
xor eax, eax
mov word [ebp - 0x1254], ax
push 0xd
push str.PROGRAM_FILES
lea ecx, [ebp - 0x1254]
call fcn.10007210
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x122c], 0
mov dword [ebp - 0x1228], 0
mov dword [ebp - 0x122c], 0
mov dword [ebp - 0x1228], 7
xor eax, eax
mov word [ebp - 0x123c], ax
push 0xa
push str.MYPICTURES
lea ecx, [ebp - 0x123c]
call fcn.10007210
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x1214], 0
mov dword [ebp - 0x1210], 0
mov dword [ebp - 0x1214], 0
mov dword [ebp - 0x1210], 7
xor eax, eax
mov word [ebp - 0x1224], ax
push 7
push str.PROFILE
lea ecx, [ebp - 0x1224]
call fcn.10007210
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x11fc], 0
mov dword [ebp - 0x11f8], 0
mov dword [ebp - 0x11fc], 0
mov dword [ebp - 0x11f8], 7
xor eax, eax
mov word [ebp - 0x120c], ax
push 9
push str.SYSTEMX86
lea ecx, [ebp - 0x120c]
call fcn.10007210
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x11e4], 0
mov dword [ebp - 0x11e0], 0
mov dword [ebp - 0x11e4], 0
mov dword [ebp - 0x11e0], 7
xor eax, eax
mov word [ebp - 0x11f4], ax
push 0x10
push str.PROGRAM_FILESX86
lea ecx, [ebp - 0x11f4]
call fcn.10007210
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x11cc], 0
mov dword [ebp - 0x11c8], 0
mov dword [ebp - 0x11cc], 0
mov dword [ebp - 0x11c8], 7
xor eax, eax
mov word [ebp - 0x11dc], ax
push 0x14
push str.PROGRAM_FILES_COMMON
lea ecx, [ebp - 0x11dc]
call fcn.10007210
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x11b4], 0
mov dword [ebp - 0x11b0], 0
mov dword [ebp - 0x11b4], 0
mov dword [ebp - 0x11b0], 7
xor eax, eax
mov word [ebp - 0x11c4], ax
push 0x17
push str.PROGRAM_FILES_COMMONX86
lea ecx, [ebp - 0x11c4]
call fcn.10007210
mov byte [ebp - 4], 0x2c
mov dword [ebp - 0x119c], 0
mov dword [ebp - 0x1198], 0
mov dword [ebp - 0x119c], 0
mov dword [ebp - 0x1198], 7
xor eax, eax
mov word [ebp - 0x11ac], ax
push 0x10
push str.COMMON_TEMPLATES
lea ecx, [ebp - 0x11ac]
call fcn.10007210
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0x1184], 0
mov dword [ebp - 0x1180], 0
mov dword [ebp - 0x1184], 0
mov dword [ebp - 0x1180], 7
xor eax, eax
mov word [ebp - 0x1194], ax
push 0x10
push str.COMMON_DOCUMENTS
lea ecx, [ebp - 0x1194]
call fcn.10007210
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x116c], 0
mov dword [ebp - 0x1168], 0
mov dword [ebp - 0x116c], 0
mov dword [ebp - 0x1168], 7
xor eax, eax
mov word [ebp - 0x117c], ax
push 0x11
push str.COMMON_ADMINTOOLS
lea ecx, [ebp - 0x117c]
call fcn.10007210
mov byte [ebp - 4], 0x2f
mov dword [ebp - 0x1154], 0
mov dword [ebp - 0x1150], 0
mov dword [ebp - 0x1154], 0
mov dword [ebp - 0x1150], 7
xor eax, eax
mov word [ebp - 0x1164], ax
push 0xa
push str.ADMINTOOLS
lea ecx, [ebp - 0x1164]
call fcn.10007210
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x113c], 0
mov dword [ebp - 0x1138], 0
mov dword [ebp - 0x113c], 0
mov dword [ebp - 0x1138], 7
xor eax, eax
mov word [ebp - 0x114c], ax
push 0xb
push str.CONNECTIONS
lea ecx, [ebp - 0x114c]
call fcn.10007210
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x1124], 0
mov dword [ebp - 0x1120], 0
mov dword [ebp - 0x1124], 0
mov dword [ebp - 0x1120], 7
xor eax, eax
mov word [ebp - 0x1134], ax
mov edx, dword [section..data]
mov ecx, edx
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100061d0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1134]
call fcn.10007210
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x110c], 0
mov dword [ebp - 0x1108], 0
mov dword [ebp - 0x110c], 0
mov dword [ebp - 0x1108], 7
xor eax, eax
mov word [ebp - 0x111c], ax
mov edx, dword [section..data]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006230
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x111c]
call fcn.10007210
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x10f4], 0
mov dword [ebp - 0x10f0], 0
mov dword [ebp - 0x10f4], 0
mov dword [ebp - 0x10f0], 7
xor eax, eax
mov word [ebp - 0x1104], ax
mov edx, dword [section..data]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006290
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1104]
call fcn.10007210
mov byte [ebp - 4], 0x34
mov dword [ebp - 0x10dc], 0
mov dword [ebp - 0x10d8], 0
mov dword [ebp - 0x10dc], 0
mov dword [ebp - 0x10d8], 7
xor eax, eax
mov word [ebp - 0x10ec], ax
push 0xc
push str.COMMON_MUSIC
lea ecx, [ebp - 0x10ec]
call fcn.10007210
mov byte [ebp - 4], 0x35
mov dword [ebp - 0x10c4], 0
mov dword [ebp - 0x10c0], 0
mov dword [ebp - 0x10c4], 0
mov dword [ebp - 0x10c0], 7
xor eax, eax
mov word [ebp - 0x10d4], ax
push 0xf
push str.COMMON_PICTURES
lea ecx, [ebp - 0x10d4]
call fcn.10007210
mov byte [ebp - 4], 0x36
mov dword [ebp - 0x10ac], 0
mov dword [ebp - 0x10a8], 0
mov dword [ebp - 0x10ac], 0
mov dword [ebp - 0x10a8], 7
xor eax, eax
mov word [ebp - 0x10bc], ax
push 0xc
push str.COMMON_VIDEO
lea ecx, [ebp - 0x10bc]
call fcn.10007210
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x1094], 0
mov dword [ebp - 0x1090], 0
mov dword [ebp - 0x1094], 0
mov dword [ebp - 0x1090], 7
xor eax, eax
mov word [ebp - 0x10a4], ax
push 9
push str.RESOURCES
lea ecx, [ebp - 0x10a4]
call fcn.10007210
mov byte [ebp - 4], 0x38
mov dword [ebp - 0x107c], 0
mov dword [ebp - 0x1078], 0
mov dword [ebp - 0x107c], 0
mov dword [ebp - 0x1078], 7
xor eax, eax
mov word [ebp - 0x108c], ax
push 0x13
push str.RESOURCES_LOCALIZED
lea ecx, [ebp - 0x108c]
call fcn.10007210
mov byte [ebp - 4], 0x39
mov dword [ebp - 0x1064], 0
mov dword [ebp - 0x1060], 0
mov dword [ebp - 0x1064], 0
mov dword [ebp - 0x1060], 7
xor eax, eax
mov word [ebp - 0x1074], ax
push 0x10
push str.COMMON_OEM_LINKS
lea ecx, [ebp - 0x1074]
call fcn.10007210
mov byte [ebp - 4], 0x3a
mov dword [ebp - 0x104c], 0
mov dword [ebp - 0x1048], 0
mov dword [ebp - 0x104c], 0
mov dword [ebp - 0x1048], 7
xor eax, eax
mov word [ebp - 0x105c], ax
push 0xb
push str.CDBURN_AREA
lea ecx, [ebp - 0x105c]
call fcn.10007210
mov byte [ebp - 4], 0x3b
mov dword [ebp - 0x1034], 0
mov dword [ebp - 0x1030], 0
mov dword [ebp - 0x1034], 0
mov dword [ebp - 0x1030], 7
xor eax, eax
mov word [ebp - 0x1044], ax
mov edx, dword [section..data]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100064e0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1044]
call fcn.10007210
mov byte [ebp - 4], 0x3c
mov dword [ebp - 0x101c], 0
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x101c], 0
mov dword [ebp - 0x1018], 7
xor eax, eax
mov word [ebp - 0x102c], ax
push 0xf
push str.COMPUTERSNEARME
lea ecx, [ebp - 0x102c]
call fcn.10007210
mov dword [ebp - 4], 0x3d
xor esi, esi
mov edx, SysReAllocString
mov dword [ebp - 0x16a0], esi
cmp esi, 0x3e
jae 0x1000692b
mov dword [ebp - 0x15ec], 0
mov dword [ebp - 0x15e8], 0
lea eax, [esi + esi*2]
lea ecx, [ebp - 0x15e4]
lea eax, [ecx + eax*8]
mov dword [ebp - 0x169c], eax
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x1694], ecx
cmp dword [eax + 0x14], 8
jb 0x1000659d
mov eax, dword [eax]
mov dword [ebp - 0x169c], eax
cmp ecx, 8
jae 0x100065b8
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x15fc], xmm0
mov dword [ebp - 0x15e8], 7
jmp 0x1000660a
mov edi, ecx
or edi, 7
cmp edi, 0x7ffffffe
cmova edi, edx
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x15fc]
call fcn.10007020
mov dword [ebp - 0x15fc], eax
mov ecx, dword [ebp - 0x1694]
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x169c]
push eax
call fcn.1019fdb0
add esp, 0xc
mov ecx, dword [ebp - 0x1694]
mov dword [ebp - 0x15e8], edi
mov edi, dword [ebp - 0x1698]
mov dword [ebp - 0x15ec], ecx
mov byte [ebp - 4], 0x3e
mov dword [ebp - 0x1604], 0
mov dword [ebp - 0x1600], 0
mov dword [ebp - 0x1604], 0
mov dword [ebp - 0x1600], 7
xor eax, eax
mov word [ebp - 0x1614], ax
mov byte [ebp - 4], 0x3f
test ecx, ecx
je 0x10006867
mov byte [ebp - 4], 0x40
push esi
lea eax, [ebp - 0x162c]
push eax
mov ecx, edi
call fcn.10004af0
mov byte [ebp - 4], 0x41
cmp dword [eax + 0x14], 8
jb 0x10006670
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1614]
call fcn.10003d10
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x162c]
call fcn.10003a70
cmp dword [ebp - 0x1604], 0
je 0x100066db
lea eax, [ebp - 0x1614]
push eax
lea eax, [ebp - 0x15fc]
push eax
lea ecx, [ebp - 0x165c]
call fcn.10003090
mov byte [ebp - 4], 0x42
push eax
lea eax, [ebp - 0x16ac]
push eax
mov ecx, edi
call fcn.100035d0
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x165c]
call fcn.10003b80
mov dword [ebp - 4], 0x3f
jmp 0x10006867
push str.INTERNET_CACHE
lea ecx, [ebp - 0x15fc]
call fcn.10007320
test eax, eax
jne 0x10006786
push 0x800
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.101a08b0
push 0x800
push 0
lea eax, [ebp - 0x1014]
push eax
call fcn.101a08b0
add esp, 0x18
push 0x400
lea eax, [ebp - 0x814]
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.Temporary_Internet_Files
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x15fc]
push eax
lea ecx, [ebp - 0x168c]
call fcn.100030f0
mov byte [ebp - 4], 0x43
push eax
lea eax, [ebp - 0x16b4]
push eax
mov ecx, edi
call fcn.100035d0
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x168c]
call fcn.10003b80
mov dword [ebp - 4], 0x3f
jmp 0x10006867
mov byte [ebp - 4], 0x3e
mov edx, dword [ebp - 0x1600]
cmp edx, 8
jb 0x100068ab
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x1614]
mov eax, ecx
cmp edx, 0x1000
jb 0x100068a1
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006965
push edx
push ecx
call fcn.100cff81
add esp, 8
mov dword [ebp - 0x1604], 0
mov dword [ebp - 0x1600], 7
xor eax, eax
mov word [ebp - 0x1614], ax
mov byte [ebp - 4], 0x3d
mov edx, dword [ebp - 0x15e8]
cmp edx, 8
jb 0x10006908
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x15fc]
mov eax, ecx
cmp edx, 0x1000
jb 0x100068fe
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000696a
push edx
push ecx
call fcn.100cff81
add esp, 8
mov dword [ebp - 0x15ec], 0
mov dword [ebp - 0x15e8], 7
xor eax, eax
mov word [ebp - 0x15fc], ax
inc esi
jmp 0x1000654c
mov dword [ebp - 4], 0xffffffff
push fcn.10003a70
push 0x3e
push 0x18
lea eax, [ebp - 0x15e4]
push eax
call fcn.100cfe53
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100d02f2
mov esp, ebp
pop ebp
ret 4
call fcn.101a3dde
call fcn.101a3dde
int3