Function at 0x100fb2f8
Capabilities:
Parse pe header
Persist via appinit_dlls registry key
Persist via ginadll registry key
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push 0x890
mov eax, 0x10178aae
call fcn.1012b71c
mov ebx, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x88c], ecx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x87c], eax
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x890], edx
xor edi, edi
inc edi
mov dword [ebx + 0x28], edi
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], ecx
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0x38], eax
lea ecx, [ebx + 0x3c]
call fcn.100902e4
mov esi, dword [ebp + 8]
cmp dword [ebp + 0x28], 0
jne 0x100fb374
push esi
call fcn.100c5102
mov ecx, eax
call fcn.100c937c
test eax, eax
je 0x100fb374
mov eax, edi
jmp 0x10100e46
mov ecx, dword [ebx + 4]
xor edi, edi
test ecx, ecx
je 0x100fb383
push edi
call fcn.100688fc
cmp dword [ebp + 0x28], 0
jne 0x100fb3da
push esi
call fcn.10067024
pop ecx
test al, al
je 0x100fb3da
mov ecx, edi
cmp dword [ebx + 4], 0
je 0x100fb3ce
push ebx
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp - 0x890]
push dword [ebp - 0x87c]
push dword [ebp - 0x88c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
mov ecx, dword [ebx + 4]
call fcn.10067efd
mov ecx, eax
cmp ecx, 1
jne 0x100fb3ce
mov dword [ebx + 0x28], edi
xor eax, eax
test ecx, ecx
sete al
jmp 0x10100e46
cmp esi, 0x469
ja 0x10100c09
cmp esi, 0x468
jae case.0x100fb402.85
lea eax, [esi - 1]
mov ecx, 0xf6
cmp eax, ecx
ja case.0x100fb402.5
jmp dword [eax*4 + 0x10100e50]
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], edi
push 0x10181720
push str.StartupPrograms
push str.SystemCurrentControlSetControlTerminal_ServerWds_rdpwd
push reloc.OLEAUT32.dll_SysReAllocString
push 1
mov dword [esi], 2
mov ecx, ebx
call fcn.100f7091
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x888]
test eax, eax
je 0x100fb458
mov dword [eax], edi
mov ecx, dword [ebp - 0x880]
test ecx, ecx
je case.0x100fb402.11
mov eax, dword [ebp - 0x884]
mov dword [ecx], eax
jmp case.0x100fb402.11
lea eax, [ebx + 0x9c]
push eax
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 1
push 2
pop esi
mov dword [ebx + 0x9c], esi
push 0x101817a4
push 0x10181724
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
push esi
mov ecx, ebx
call fcn.100f7091
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x888]
test eax, eax
je 0x100fb4c8
mov dword [eax], edi
mov ecx, dword [ebp - 0x880]
test ecx, ecx
je 0x100fb4da
mov eax, dword [ebp - 0x884]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov dword [ebp - 0x888], edi
lea ecx, [ebx + 0x9c]
test ecx, ecx
je 0x100fb51a
mov edi, ecx
mov dword [ebp - 0x880], edi
mov eax, dword [ecx]
mov dword [ebp - 0x884], eax
jmp 0x100fb526
mov edi, dword [ebp - 0x880]
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], esi
xor eax, eax
inc eax
mov dword [ecx], eax
push 0x101817a4
push 0x10181724
push str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
push 2
mov esi, dword [ebx + 0xa0]
mov dword [ebx + 0xa0], eax
mov ecx, ebx
call fcn.100f7091
mov dword [ebx + 0xa0], esi
or dword [ebp - 4], 0xffffffff
test edi, edi
je case.0x100fb402.11
mov eax, dword [ebp - 0x87c]
mov dword [edi], eax
jmp case.0x100fb402.11
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
push 3
pop eax
mov dword [ebp - 4], eax
mov dword [esi], 2
push str.Startup
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsStartup
push reloc.OLEAUT32.dll_SysReAllocString
push eax
mov ecx, ebx
call fcn.100f978b
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x888]
test eax, eax
je 0x100fb5c8
mov dword [eax], edi
mov ecx, dword [ebp - 0x880]
test ecx, ecx
je 0x100fb5da
mov eax, dword [ebp - 0x884]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov dword [ebp - 0x888], edi
test esi, esi
je 0x100fb614
mov edi, esi
mov dword [ebp - 0x880], edi
mov eax, dword [esi]
mov dword [ebp - 0x884], eax
jmp 0x100fb620
mov edi, dword [ebp - 0x880]
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 4
push str.Startup
push str.SoftwareWow6432NodePoliciesMicrosoftWindowsSystemScriptsStartup
push reloc.OLEAUT32.dll_SysReAllocString
push 3
xor eax, eax
inc eax
mov esi, dword [ebx + 0xa0]
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
mov ecx, ebx
call fcn.100f978b
jmp 0x100fb55d
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 5
mov dword [esi], 2
push str.Logon
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogon
push SysReAllocStringLen
push 4
mov ecx, ebx
call fcn.100f978b
jmp 0x100fb448
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
push 6
pop eax
mov dword [ebp - 4], eax
mov dword [esi], 2
push str.Logon
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogon
push reloc.OLEAUT32.dll_SysReAllocString
push eax
mov ecx, ebx
call fcn.100f978b
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x888]
test eax, eax
je 0x100fb6ee
mov dword [eax], edi
mov ecx, dword [ebp - 0x880]
test ecx, ecx
je 0x100fb700
mov eax, dword [ebp - 0x884]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov dword [ebp - 0x888], edi
test esi, esi
je 0x100fb73a
mov edi, esi
mov dword [ebp - 0x880], edi
mov eax, dword [esi]
mov dword [ebp - 0x884], eax
jmp 0x100fb746
mov edi, dword [ebp - 0x880]
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 7
push str.Logon
push str.SoftwareWow6432NodePoliciesMicrosoftWindowsSystemScriptsLogon
push reloc.OLEAUT32.dll_SysReAllocString
push 6
jmp 0x100fb63e
lea ecx, [ebx + 0x104]
call fcn.10069cce
test eax, eax
je 0x100fb7a3
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp - 0x890]
push dword [ebp - 0x87c]
push dword [ebp - 0x88c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
mov ecx, ebx
call fcn.10104fc0
jmp case.0x100fb402.11
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 8
mov dword [esi], 2
push 0x10181720
push str.Userinit
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
push 0x6e
mov ecx, ebx
call fcn.100f7091
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x888]
test eax, eax
je 0x100fb7f6
mov dword [eax], edi
mov ecx, dword [ebp - 0x880]
test ecx, ecx
je 0x100fb808
mov eax, dword [ebp - 0x884]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov dword [ebp - 0x888], edi
test esi, esi
je 0x100fb842
mov edi, esi
mov dword [ebp - 0x880], edi
mov eax, dword [esi]
mov dword [ebp - 0x884], eax
jmp 0x100fb84e
mov edi, dword [ebp - 0x880]
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 9
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
push 0x10181720
push str.Userinit
push str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
push 0x6e
jmp 0x100fb54a
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 0xa
push 0x10181720
push 0x101818cc
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push SysReAllocStringLen
push 7
jmp 0x100fb43b
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 0xb
push 0x10181720
push 0x101818cc
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
push 8
jmp 0x100fb43b
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 0xc
mov dword [esi], 2
push 0x10181720
push 0x101818cc
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
push 9
mov ecx, ebx
call fcn.100f7091
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x888]
test eax, eax
je 0x100fb948
mov dword [eax], edi
mov ecx, dword [ebp - 0x880]
test ecx, ecx
je 0x100fb95a
mov eax, dword [ebp - 0x884]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov dword [ebp - 0x888], edi
test esi, esi
je 0x100fb994
mov edi, esi
mov dword [ebp - 0x880], edi
mov eax, dword [esi]
mov dword [ebp - 0x884], eax
jmp 0x100fb9a0
mov edi, dword [ebp - 0x880]
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0xd
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
push 0x10181720
push 0x101818cc
push str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
push 9
jmp 0x100fb54a
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 0xe
push 0x10181720
push 0x101818cc
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push SysReAllocStringLen
push 0xa
jmp 0x100fb43b
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 0xf
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonce
push reloc.OLEAUT32.dll_SysReAllocString
push 0xc
mov dword [esi], 2
mov ecx, ebx
call fcn.100f0395
jmp 0x100fb448
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 0x10
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonce
push SysReAllocStringLen
push 0xd
jmp 0x100fba38
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 0x11
push 0x10183278
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonceEx
push reloc.OLEAUT32.dll_SysReAllocString
push 0xe
mov dword [esi], 2
mov ecx, ebx
call fcn.100f0494
jmp 0x100fb448
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 0x12
push 0x10183278
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonceEx
push SysReAllocStringLen
push 0xf
jmp 0x100fbaa9
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 0x13
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
push 0x10
jmp 0x100fba38
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 0x14
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocStringLen
push 0x11
jmp 0x100fba38
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 0x15
mov dword [esi], 2
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
push 0x12
mov ecx, ebx
call fcn.100f0395
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x888]
test eax, eax
je 0x100fbb99
mov dword [eax], edi
mov ecx, dword [ebp - 0x880]
test ecx, ecx
je 0x100fbbab
mov eax, dword [ebp - 0x884]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov dword [ebp - 0x888], edi
test esi, esi
je 0x100fbbe5
mov edi, esi
mov dword [ebp - 0x880], edi
mov eax, dword [esi]
mov dword [ebp - 0x884], eax
jmp 0x100fbbf1
mov edi, dword [ebp - 0x880]
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0x16
push str.SOFTWAREWow6432nodeMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
push 0x12
xor eax, eax
mov esi, dword [ebx + 0xa0]
inc eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0x9c], eax
mov ecx, ebx
call fcn.100f0395
jmp 0x100fb55d
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 0x17
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocStringLen
push 0x13
jmp 0x100fba38
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 0x18
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push SysReAllocStringLen
push 0x14
jmp 0x100fba38
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 0x19
mov dword [esi], 2
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
push 0x15
mov ecx, ebx
call fcn.100f0395
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x888]
test eax, eax
je 0x100fbcd6
mov dword [eax], edi
mov ecx, dword [ebp - 0x880]
test ecx, ecx
je 0x100fbce8
mov eax, dword [ebp - 0x884]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov dword [ebp - 0x888], edi
test esi, esi
je 0x100fbd22
mov edi, esi
mov dword [ebp - 0x880], edi
mov eax, dword [esi]
mov dword [ebp - 0x884], eax
jmp 0x100fbd2e
mov edi, dword [ebp - 0x880]
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0x1a
push str.SoftwareWow6432nodeMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
push 0x15
jmp 0x100fbc0a
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 0x1b
mov dword [esi], 2
push 0x10183278
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
push reloc.OLEAUT32.dll_SysReAllocString
push 0x16
mov ecx, ebx
call fcn.100f0494
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x888]
test eax, eax
je 0x100fbd9a
mov dword [eax], edi
mov ecx, dword [ebp - 0x880]
test ecx, ecx
je 0x100fbdac
mov eax, dword [ebp - 0x884]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov dword [ebp - 0x888], edi
test esi, esi
je 0x100fbde6
mov edi, esi
mov dword [ebp - 0x880], edi
mov eax, dword [esi]
mov dword [ebp - 0x884], eax
jmp 0x100fbdf2
mov edi, dword [ebp - 0x880]
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0x1c
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push 0x10183278
push str.SOFTWAREWow6432nodeMicrosoftWindowsCurrentVersionRunOnceEx
push reloc.OLEAUT32.dll_SysReAllocString
push 0x16
mov ecx, ebx
call fcn.100f0494
jmp 0x100fb55d
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x888]
call fcn.1005b243
mov dword [ebp - 4], 0x1d
push 0x10183278
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
push SysReAllocStringLen
push 0x17
jmp 0x100fbaa9
mov dword [ebp - 0x888], edi
mov dword [ebp - 0x884], edi
mov dword [ebp - 0x880], edi
mov dword [ebp - 4], 0x1e
push edi
lea eax, [ebp - 0x888]
push eax
mov ecx, ebx
call fcn.100f8ae6
mov dword [ebp - 0x88c], edi
mov eax, dword [ebp - 0x884]
sub eax, dword [ebp - 0x888]
sar eax, 2
test eax, eax
je 0x100fbfb4
lea eax, [ebx + 0x9c]
lea ecx, [ebx + 0x98]
push 2
pop esi
push eax
push ecx
lea ecx, [ebp - 0x89c]
call fcn.1005b243
mov byte [ebp - 4], 0x1f
mov dword [ebx + 0x9c], esi
mov eax, dword [ebp - 0x888]
push edi
mov ecx, dword [ebp - 0x88c]
push dword [eax + ecx*4]
push 0x18
mov ecx, ebx
call fcn.100eac84
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp - 0x89c]
test eax, eax
je 0x100fbefb
mov dword [eax], edi
mov ecx, dword [ebp - 0x894]
test ecx, ecx
je 0x100fbf0d
mov eax, dword [ebp - 0x898]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x100fbfb4
lea eax, [ebx + 0x9c]
push eax
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov byte [ebp - 4], 0x20
mov dword [ebx + 0x9c], esi
mov eax, dword [ebp - 0x888]
mov ecx, dword [ebp - 0x88c]
push dword [eax + ecx*4]
push 0x18
mov ecx, ebx
call fcn.100f895b
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp - 0x878]
test eax, eax
je 0x100fbf67
mov dword [eax], edi
mov ecx, dword [ebp - 0x870]
test ecx, ecx
je 0x100fbf79
mov eax, dword [ebp - 0x874]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x100fbfb4
mov ecx, dword [ebp - 0x88c]
inc ecx
mov dword [ebp - 0x88c], ecx
mov eax, dword [ebp - 0x884]
sub eax, dword [ebp - 0x888]
sar eax, 2
cmp ecx, eax
lea eax, [ebx + 0x9c]
lea ecx, [ebx + 0x98]
jb 0x100fbebb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x888]
call fcn.10008abd
jmp case.0x100fb402.11
mov dword [ebp - 0x888], edi
mov dword [ebp - 0x884], edi
mov dword [ebp - 0x880], edi
mov dword [ebp - 4], 0x21
push 1
lea eax, [ebp - 0x888]
push eax
mov ecx, ebx
call fcn.100f8ae6
mov dword [ebp - 0x88c], edi
mov eax, dword [ebp - 0x884]
sub eax, dword [ebp - 0x888]
sar eax, 2
test eax, eax
je 0x100fbfb4
lea eax, [ebx + 0x9c]
lea ecx, [ebx + 0x98]
push 2
pop esi
push eax
push ecx
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov byte [ebp - 4], 0x22
mov dword [ebx + 0x9c], esi
mov eax, dword [ebp - 0x888]
push edi
mov ecx, dword [ebp - 0x88c]
push dword [eax + ecx*4]
push 0x19
mov ecx, ebx
call fcn.100eac84
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x878]
test eax, eax
je 0x100fc059
mov dword [eax], edi
mov ecx, dword [ebp - 0x870]
test ecx, ecx
je 0x100fc06b
mov eax, dword [ebp - 0x874]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x100fbfb4
lea eax, [ebx + 0x9c]
push eax
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x89c]
call fcn.1005b243
mov byte [ebp - 4], 0x23
mov dword [ebx + 0x9c], esi
mov eax, dword [ebp - 0x888]
mov ecx, dword [ebp - 0x88c]
push dword [eax + ecx*4]
push 0x19
mov ecx, ebx
call fcn.100f895b
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x89c]
test eax, eax
je 0x100fc0c5
mov dword [eax], edi
mov ecx, dword [ebp - 0x894]
test ecx, ecx
je 0x100fc0d7
mov eax, dword [ebp - 0x898]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x100fbfb4
mov ecx, dword [ebp - 0x88c]
inc ecx
mov dword [ebp - 0x88c], ecx
mov eax, dword [ebp - 0x884]
sub eax, dword [ebp - 0x888]
sar eax, 2
cmp ecx, eax
lea eax, [ebx + 0x9c]
lea ecx, [ebx + 0x98]
jb 0x100fc019
jmp 0x100fbfb4
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x24
push 0x101817a4
push str.Load
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push SysReAllocStringLen
push 0x1a
mov dword [esi], 2
mov ecx, ebx
call fcn.100f7091
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x878]
test eax, eax
je 0x100fc16e
mov dword [eax], edi
mov ecx, dword [ebp - 0x870]
test ecx, ecx
je case.0x100fb402.11
mov eax, dword [ebp - 0x874]
jmp 0x100fb46c
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x25
push 0x101817a4
push 0x10181c64
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push SysReAllocStringLen
push 0x1b
jmp 0x100fc151
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x26
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
push reloc.OLEAUT32.dll_SysReAllocString
push 0x1c
mov dword [esi], 2
mov ecx, ebx
call fcn.100f0395
jmp 0x100fc15e
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x27
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
push SysReAllocStringLen
push 0x1d
jmp 0x100fc1eb
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x28
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push SysReAllocStringLen
push 0x1e
jmp 0x100fc1eb
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x29
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.OLEAUT32.dll_SysReAllocString
push 0x1f
jmp 0x100fc1eb
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x2a
push str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
push SysReAllocStringLen
push 0x20
jmp 0x100fc1eb
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x2b
push str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
push reloc.OLEAUT32.dll_SysReAllocString
push 0x21
jmp 0x100fc1eb
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x2c
mov dword [esi], 2
push str.Logoff
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogoff
push SysReAllocStringLen
push 0x22
mov ecx, ebx
call fcn.100f978b
jmp 0x100fc15e
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x2d
mov dword [esi], 2
push str.Shutdown
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsShutdown
push reloc.OLEAUT32.dll_SysReAllocString
push 0x23
mov ecx, ebx
call fcn.100f978b
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x878]
test eax, eax
je 0x100fc37d
mov dword [eax], edi
mov ecx, dword [ebp - 0x870]
test ecx, ecx
je 0x100fc38f
mov eax, dword [ebp - 0x874]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov dword [ebp - 0x888], edi
test esi, esi
je 0x100fc3c9
mov edi, esi
mov dword [ebp - 0x880], edi
mov eax, dword [esi]
mov dword [ebp - 0x884], eax
jmp 0x100fc3d5
mov edi, dword [ebp - 0x880]
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0x2e
push str.Shutdown
push str.SoftwareWow6432NodePoliciesMicrosoftWindowsSystemScriptsShutdown
jmp 0x100fb637
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x2f
push 0x101811c0
push str.SOFTWAREClassesProtocolsFilter
push reloc.OLEAUT32.dll_SysReAllocString
push 0x24
mov dword [esi], 2
mov ecx, ebx
call fcn.100eddef
jmp 0x100fc15e
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x30
push 0x101811c0
push str.SOFTWAREClassesProtocolsHandler
push reloc.OLEAUT32.dll_SysReAllocString
push 0x25
jmp 0x100fc422
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x31
mov dword [esi], 2
push str.SOFTWAREMicrosoftActive_SetupInstalled_Components
push reloc.OLEAUT32.dll_SysReAllocString
push 0x26
mov ecx, ebx
call fcn.100f5239
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x878]
test eax, eax
je 0x100fc4b0
mov dword [eax], edi
mov ecx, dword [ebp - 0x870]
test ecx, ecx
je 0x100fc4c2
mov eax, dword [ebp - 0x874]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov dword [ebp - 0x888], edi
test esi, esi
je 0x100fc4fc
mov edi, esi
mov dword [ebp - 0x880], edi
mov eax, dword [esi]
mov dword [ebp - 0x884], eax
jmp 0x100fc508
mov edi, dword [ebp - 0x880]
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0x32
push str.SOFTWAREWow6432nodeMicrosoftActive_SetupInstalled_Components
push reloc.OLEAUT32.dll_SysReAllocString
push 0x26
xor eax, eax
mov esi, dword [ebx + 0xa0]
inc eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0x9c], eax
mov ecx, ebx
call fcn.100f5239
jmp 0x100fb55d
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x33
mov dword [esi], 2
push str.SOFTWAREMicrosoftActive_SetupInstalled_Components
push SysReAllocStringLen
push 0x6f
mov ecx, ebx
call fcn.100f5239
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x878]
test eax, eax
je 0x100fc58b
mov dword [eax], edi
mov ecx, dword [ebp - 0x870]
test ecx, ecx
je 0x100fc59d
mov eax, dword [ebp - 0x874]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov dword [ebp - 0x888], edi
test esi, esi
je 0x100fc5d7
mov edi, esi
mov dword [ebp - 0x880], edi
mov eax, dword [esi]
mov dword [ebp - 0x884], eax
jmp 0x100fc5e3
mov edi, dword [ebp - 0x880]
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0x34
push str.SOFTWAREWow6432NodeMicrosoftActive_SetupInstalled_Components
push SysReAllocStringLen
push 0x6f
jmp 0x100fc521
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x35
mov dword [esi], 2
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
push reloc.OLEAUT32.dll_SysReAllocString
push 0x27
mov ecx, ebx
call fcn.100f1854
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x878]
test eax, eax
je 0x100fc64a
mov dword [eax], edi
mov ecx, dword [ebp - 0x870]
test ecx, ecx
je 0x100fc65c
mov eax, dword [ebp - 0x874]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov dword [ebp - 0x888], edi
test esi, esi
je 0x100fc696
mov edi, esi
mov dword [ebp - 0x880], edi
mov eax, dword [esi]
mov dword [ebp - 0x884], eax
jmp 0x100fc6a2
mov edi, dword [ebp - 0x880]
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0x36
push str.SOFTWAREWow6432nodeMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
push reloc.OLEAUT32.dll_SysReAllocString
push 0x27
xor eax, eax
mov esi, dword [ebx + 0xa0]
inc eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0x9c], eax
mov ecx, ebx
call fcn.100f1854
jmp 0x100fb55d
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x37
mov dword [esi], 2
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push reloc.OLEAUT32.dll_SysReAllocString
push 0x28
mov ecx, ebx
call fcn.100f16a5
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x878]
test eax, eax
je 0x100fc725
mov dword [eax], edi
mov ecx, dword [ebp - 0x870]
test ecx, ecx
je 0x100fc737
mov eax, dword [ebp - 0x874]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov dword [ebp - 0x888], edi
test esi, esi
je 0x100fc771
mov edi, esi
mov dword [ebp - 0x880], edi
mov eax, dword [esi]
mov dword [ebp - 0x884], eax
jmp 0x100fc77d
mov edi, dword [ebp - 0x880]
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0x38
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push str.SOFTWAREWow6432nodeMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push reloc.OLEAUT32.dll_SysReAllocString
push 0x28
mov ecx, ebx
call fcn.100f16a5
jmp 0x100fb55d
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x39
mov dword [esi], 2
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push SysReAllocStringLen
push 0x29
mov ecx, ebx
call fcn.100f16a5
jmp 0x100fc15e
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x3a
mov dword [esi], 2
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
push reloc.OLEAUT32.dll_SysReAllocString
push 0x2a
mov ecx, ebx
call fcn.100f1854
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x878]
test eax, eax
je 0x100fc83e
mov dword [eax], edi
mov ecx, dword [ebp - 0x870]
test ecx, ecx
je 0x100fc850
mov eax, dword [ebp - 0x874]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov dword [ebp - 0x888], edi
test esi, esi
je 0x100fc88a
mov edi, esi
mov dword [ebp - 0x880], edi
mov eax, dword [esi]
mov dword [ebp - 0x884], eax
jmp 0x100fc896
mov edi, dword [ebp - 0x880]
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0x3b
push str.SoftwareWow6432nodeMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
push reloc.OLEAUT32.dll_SysReAllocString
push 0x2a
jmp 0x100fc6bb
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x3c
push str.SoftwareClassesShellExContextMenuHandlers
push SysReAllocStringLen
push 0x2b
mov dword [esi], 2
mov ecx, ebx
call fcn.100edf1c
jmp 0x100fc15e
push str.SoftwareClassesShellExContextMenuHandlers
push reloc.OLEAUT32.dll_SysReAllocString
push 0x2c
mov ecx, ebx
call fcn.100ee221
jmp case.0x100fb402.11
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x3d
push str.SoftwareClassesAllFileSystemObjectsShellExContextMenuHandlers
push SysReAllocStringLen
push 0x2d
jmp 0x100fc8e0
push str.SoftwareClassesAllFileSystemObjectsShellExContextMenuHandlers
push reloc.OLEAUT32.dll_SysReAllocString
push 0x2e
jmp 0x100fc8fe
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x3e
push str.SoftwareClassesDirectoryShellExContextMenuHandlers
push SysReAllocStringLen
push 0x2f
jmp 0x100fc8e0
push str.SoftwareClassesDirectoryShellExContextMenuHandlers
push reloc.OLEAUT32.dll_SysReAllocString
push 0x30
jmp 0x100fc8fe
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x3f
push str.SoftwareClassesDirectoryShellexDragDropHandlers
push SysReAllocStringLen
push 0x31
jmp 0x100fc8e0
push str.SoftwareClassesDirectoryShellexDragDropHandlers
push reloc.OLEAUT32.dll_SysReAllocString
push 0x32
jmp 0x100fc8fe
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x40
push str.SoftwareClassesDirectoryShellexPropertySheetHandlers
push SysReAllocStringLen
push 0x33
jmp 0x100fc8e0
push str.SoftwareClassesDirectoryShellexPropertySheetHandlers
push reloc.OLEAUT32.dll_SysReAllocString
push 0x34
jmp 0x100fc8fe
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x41
push str.SoftwareClassesDirectoryShellexCopyHookHandlers
push SysReAllocStringLen
push 0x35
jmp 0x100fc8e0
push str.SoftwareClassesDirectoryShellexCopyHookHandlers
push reloc.OLEAUT32.dll_SysReAllocString
push 0x36
jmp 0x100fc8fe
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x42
push str.SoftwareClassesFolderShellexColumnHandlers
push SysReAllocStringLen
push 0x37
mov dword [esi], 2
mov ecx, ebx
call fcn.100ee5dd
jmp 0x100fc15e
push str.SoftwareClassesFolderShellexColumnHandlers
push reloc.OLEAUT32.dll_SysReAllocString
push 0x38
mov ecx, ebx
call fcn.100ee7bf
jmp case.0x100fb402.11
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x43
push str.SoftwareClassesFolderShellExContextMenuHandlers
push SysReAllocStringLen
push 0x39
jmp 0x100fc8e0
push str.SoftwareClassesFolderShellExContextMenuHandlers
push reloc.OLEAUT32.dll_SysReAllocString
push 0x3a
jmp 0x100fc8fe
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x44
push str.SoftwareClassesDirectoryBackgroundShellExContextMenuHandlers
push SysReAllocStringLen
push 0x3b
jmp 0x100fc8e0
push str.SoftwareClassesDirectoryBackgroundShellExContextMenuHandlers
push reloc.OLEAUT32.dll_SysReAllocString
push 0x3c
jmp 0x100fc8fe
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x45
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
push SysReAllocStringLen
push 0x3d
jmp 0x100fc8e0
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x46
mov dword [esi], 2
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
push reloc.OLEAUT32.dll_SysReAllocString
push 0x3e
mov ecx, ebx
call fcn.100edf1c
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x878]
test eax, eax
je 0x100fcba2
mov dword [eax], edi
mov ecx, dword [ebp - 0x870]
test ecx, ecx
je 0x100fcbb4
mov eax, dword [ebp - 0x874]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov dword [ebp - 0x888], edi
test esi, esi
je 0x100fcbee
mov edi, esi
mov dword [ebp - 0x880], edi
mov eax, dword [esi]
mov dword [ebp - 0x884], eax
jmp 0x100fcbfa
mov edi, dword [ebp - 0x880]
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0x47
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
push reloc.OLEAUT32.dll_SysReAllocString
push 0x3e
mov ecx, ebx
call fcn.100edf1c
jmp 0x100fb55d
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x48
push str.SoftwareMicrosoftCtfLangBarAddin
push SysReAllocStringLen
push 0x3f
jmp 0x100fca7a
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x49
mov dword [esi], 2
push str.SoftwareMicrosoftCtfLangBarAddin
push reloc.OLEAUT32.dll_SysReAllocString
push 0x40
mov ecx, ebx
call fcn.100ee5dd
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x878]
test eax, eax
je 0x100fccae
mov dword [eax], edi
mov ecx, dword [ebp - 0x870]
test ecx, ecx
je 0x100fccc0
mov eax, dword [ebp - 0x874]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov dword [ebp - 0x888], edi
test esi, esi
je 0x100fccfa
mov edi, esi
mov dword [ebp - 0x880], edi
mov eax, dword [esi]
mov dword [ebp - 0x884], eax
jmp 0x100fcd06
mov edi, dword [ebp - 0x880]
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0x4a
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push str.SoftwareWow6432NodeMicrosoftCtfLangBarAddin
push reloc.OLEAUT32.dll_SysReAllocString
push 0x40
mov ecx, ebx
call fcn.100ee5dd
jmp 0x100fb55d
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x4b
mov dword [esi], 2
push str.SOFTWAREMicrosoftWindowsCurrentVersionExtPreApproved
push reloc.OLEAUT32.dll_SysReAllocString
push 0x41
mov ecx, ebx
call fcn.100ee5dd
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x878]
test eax, eax
je 0x100fcd89
mov dword [eax], edi
mov ecx, dword [ebp - 0x870]
test ecx, ecx
je 0x100fcd9b
mov eax, dword [ebp - 0x874]
mov dword [ecx], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov dword [ebp - 0x878], edi
test esi, esi
je 0x100fcdd1
mov dword [ebp - 0x870], esi
mov eax, dword [esi]
mov dword [ebp - 0x874], eax
mov dword [ebp - 4], 0x4c
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionExtPreApproved
push reloc.OLEAUT32.dll_SysReAllocString
push 0x41
xor eax, eax
inc eax
mov esi, dword [ebx + 0xa0]
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
mov ecx, ebx
call fcn.100ee5dd
mov dword [ebx + 0xa0], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
jmp case.0x100fb402.11
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x4d
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push SysReAllocStringLen
push 0x42
mov dword [esi], 2
mov ecx, ebx
call fcn.100f1854
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x4e
mov dword [esi], 2
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
push 0x43
mov ecx, ebx
call fcn.100f1854
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x4f
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
push 0x43
xor eax, eax
mov esi, dword [ebx + 0xa0]
inc eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0x9c], eax
mov ecx, ebx
call fcn.100f1854
jmp 0x100fce00
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x50
mov dword [esi], 2
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push reloc.OLEAUT32.dll_SysReAllocString
push 0x44
mov ecx, ebx
call fcn.100ee5dd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x51
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push reloc.OLEAUT32.dll_SysReAllocString
push 0x44
jmp 0x100fcde4
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x52
push str.SoftwareMicrosoftInternet_ExplorerUrlSearchHooks
push SysReAllocStringLen
push 0x45
jmp 0x100fce46
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x53
mov dword [esi], 2
push str.SoftwareMicrosoftInternet_ExplorerToolbar
push reloc.OLEAUT32.dll_SysReAllocString
push 0x46
mov ecx, ebx
call fcn.100f1854
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x54
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerToolbar
push reloc.OLEAUT32.dll_SysReAllocString
push 0x46
jmp 0x100fcedb
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x55
mov dword [esi], 2
push str.SoftwareMicrosoftInternet_ExplorerExplorer_Bars
push SysReAllocStringLen
push 0x47
mov ecx, ebx
call fcn.100ee5dd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x56
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExplorer_Bars
push SysReAllocStringLen
push 0x47
jmp 0x100fcde4
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x57
mov dword [esi], 2
push str.SoftwareMicrosoftInternet_ExplorerExplorer_Bars
push reloc.OLEAUT32.dll_SysReAllocString
push 0x48
mov ecx, ebx
call fcn.100ee5dd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x58
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExplorer_Bars
push reloc.OLEAUT32.dll_SysReAllocString
push 0x48
jmp 0x100fcde4
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x59
mov dword [esi], 2
push str.DownloadUI
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
push 0x70
mov ecx, ebx
call fcn.100f6b9d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x5a
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push str.DownloadUI
push str.SOFTWAREWow6432NodeMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
push 0x70
mov ecx, ebx
call fcn.100f6b9d
jmp 0x100fce00
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x5b
mov dword [esi], 2
push str.SoftwareMicrosoftInternet_ExplorerExtensions
push SysReAllocStringLen
push 0x49
mov ecx, ebx
call fcn.100f49f7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x5c
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExtensions
push SysReAllocStringLen
push 0x49
xor eax, eax
mov esi, dword [ebx + 0xa0]
inc eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0x9c], eax
mov ecx, ebx
call fcn.100f49f7
jmp 0x100fce00
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x5d
mov dword [esi], 2
push str.SoftwareMicrosoftInternet_ExplorerExtensions
push reloc.OLEAUT32.dll_SysReAllocString
push 0x4a
mov ecx, ebx
call fcn.100f49f7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x5e
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExtensions
push reloc.OLEAUT32.dll_SysReAllocString
push 0x4a
jmp 0x100fd290
call fcn.10051785
push 0x4b
mov ecx, ebx
test eax, eax
je 0x100fd353
call fcn.100f0dda
jmp case.0x100fb402.11
call fcn.100f0bd9
jmp case.0x100fb402.11
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x5f
push 1
push 0x4c
mov dword [esi], 2
mov ecx, ebx
call fcn.100f0732
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x60
push edi
push 0x4d
jmp 0x100fd381
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x61
mov dword [esi], 2
push 0x4e
mov ecx, ebx
call fcn.100e877a
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x62
push str.SetupExecute
push str.SystemCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
push 0x4f
mov dword [esi], 2
mov ecx, ebx
call fcn.100f5823
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x63
push str.Execute
push str.SystemCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
push 0x50
jmp 0x100fd41d
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x64
mov dword [esi], 2
push str.Debugger
push str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
push reloc.OLEAUT32.dll_SysReAllocString
push 0x52
mov ecx, ebx
call fcn.100eeba0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x65
push str.Debugger
push str.SoftwareWow6432NodeMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
push reloc.OLEAUT32.dll_SysReAllocString
push 0x52
xor eax, eax
inc eax
mov esi, dword [ebx + 0xa0]
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
mov ecx, ebx
call fcn.100eeba0
jmp 0x100fce00
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x66
mov dword [esi], 2
push edi
push edi
push edi
push str.Autorun
push str.SoftwareMicrosoftCommand_Processor
push reloc.OLEAUT32.dll_SysReAllocString
push 0x53
mov ecx, ebx
call fcn.100f6d2f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x67
push edi
push edi
push edi
push str.Autorun
push str.SoftwareWow6432NodeMicrosoftCommand_Processor
push reloc.OLEAUT32.dll_SysReAllocString
push 0x53
xor eax, eax
mov esi, dword [ebx + 0xa0]
inc eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0x9c], eax
mov ecx, ebx
call fcn.100f6d2f
jmp 0x100fce00
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x68
push edi
push edi
push edi
push str.Autorun
push str.SoftwareMicrosoftCommand_Processor
push SysReAllocStringLen
push 0x54
mov dword [esi], 2
mov ecx, ebx
call fcn.100f6d2f
jmp 0x100fce06
lea edi, [ebx + 0x9c]
lea eax, [ebx + 0x98]
push edi
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x6b
push 2
pop esi
mov dword [edi], esi
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, dword [ebp + 8]
push edi
mov ecx, ebx
call fcn.100f2e63
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
lea eax, [ebx + 0x9c]
push eax
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x6c
mov dword [ebx + 0x9c], esi
push SysReAllocStringLen
push edi
mov ecx, ebx
call fcn.100f2e63
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x6d
mov dword [esi], 2
push 0x101817a4
push str.Appinit_Dlls
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push reloc.OLEAUT32.dll_SysReAllocString
push 0x56
mov ecx, ebx
call fcn.100f7091
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x6e
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push 0x101817a4
push str.Appinit_Dlls
push str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWindows
push reloc.OLEAUT32.dll_SysReAllocString
push 0x56
mov ecx, ebx
call fcn.100f7091
jmp 0x100fce00
lea edi, [ebx + 0x9c]
lea eax, [ebx + 0x98]
push edi
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x6f
push 2
pop esi
mov dword [edi], esi
push str.DllDirectory
push 0x57
mov ecx, ebx
call fcn.100eeca4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
push edi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x70
mov dword [edi], esi
push str.DllDirectory32
push 0x57
mov ecx, ebx
call fcn.100eeca4
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x71
push 0x10181720
push 0x10182c64
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
push 0x58
mov dword [esi], 2
mov ecx, ebx
call fcn.100f7091
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x72
push 0x10181720
push str.UIHost
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
push 0x59
jmp 0x100fd81b
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x73
push str.DllName
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify
push reloc.OLEAUT32.dll_SysReAllocString
push 0x5a
mov dword [esi], 2
mov ecx, ebx
call fcn.100eeba0
jmp 0x100fce06
call fcn.10051785
test eax, eax
jne case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], edi
jne case.0x100fb402.11
push 0x10181720
push str.GinaDLL
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
push 0x5b
mov ecx, ebx
call fcn.100f7091
jmp case.0x100fb402.11
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x74
push 0x10181720
push str.Taskman
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
push 0x5c
jmp 0x100fd81b
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x75
push edi
push edi
push edi
push str.Scrnsave.exe
push str.Control_PanelDesktop
push SysReAllocStringLen
push 0x5d
jmp 0x100fd5fe
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x76
push 0x10181720
push 0x1018125c
push str.SystemCurrentControlSetControlBootVerificationProgram
push reloc.OLEAUT32.dll_SysReAllocString
push 0x5e
jmp 0x100fd81b
mov esi, dword [ebx + 0x9c]
mov eax, dword [ebx + 0xa0]
mov dword [ebp - 0x87c], eax
call fcn.1012998f
cmp dword [eax + 4], edi
jne 0x100fd9db
call fcn.1005172b
test eax, eax
je 0x100fd9db
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push str.SystemCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push reloc.OLEAUT32.dll_SysReAllocString
push 0x5f
mov ecx, ebx
call fcn.100ef0d0
mov dword [ebx + 0x9c], esi
mov eax, dword [ebp - 0x87c]
mov dword [ebx + 0xa0], eax
jmp case.0x100fb402.11
mov esi, dword [ebx + 0x9c]
mov eax, dword [ebx + 0xa0]
mov dword [ebp - 0x87c], eax
call fcn.1012998f
cmp dword [eax + 4], edi
je 0x100fda32
call fcn.1005172f
test eax, eax
jne 0x100fda32
call fcn.100516d5
test eax, eax
jne 0x100fda32
call fcn.10051618
test eax, eax
jne 0x100fda32
call fcn.10051524
test eax, eax
je 0x100fda59
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push 0x10189610
push str.SystemCurrentControlSetServicesWinSock2ParametersNameSpace_Catalog5Catalog_Entries
push reloc.OLEAUT32.dll_SysReAllocString
push 0x60
mov ecx, ebx
call fcn.100eeba0
call fcn.1012998f
cmp dword [eax + 4], edi
je 0x100fd9db
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x100fd9db
call fcn.1005172f
test eax, eax
jne 0x100fda9e
call fcn.100516d5
test eax, eax
jne 0x100fda9e
call fcn.10051618
test eax, eax
jne 0x100fda9e
call fcn.10051524
test eax, eax
je 0x100fd9db
mov dword [ebx + 0x9c], 2
mov dword [ebx + 0xa0], edi
push 0x10189610
push str.SystemCurrentControlSetServicesWinSock2ParametersNameSpace_Catalog5Catalog_Entries64
push reloc.OLEAUT32.dll_SysReAllocString
push 0x60
mov ecx, ebx
call fcn.100eeba0
jmp 0x100fd9db
mov esi, dword [ebx + 0x9c]
mov eax, dword [ebx + 0xa0]
mov dword [ebp - 0x87c], eax
call fcn.1012998f
cmp dword [eax + 4], edi
je 0x100fd9db
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x100fd9db
call fcn.10051524
test eax, eax
jne 0x100fdb22
call fcn.1005172f
test eax, eax
jne 0x100fdb22
call fcn.100516d5
test eax, eax
jne 0x100fdb22
call fcn.10051618
test eax, eax
je 0x100fd9db
mov dword [ebx + 0x9c], 1
mov dword [ebx + 0xa0], edi
push str.SystemCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push reloc.OLEAUT32.dll_SysReAllocString
push 0xd6
jmp 0x100fd9d4
mov esi, dword [ebx + 0x9c]
mov eax, dword [ebx + 0xa0]
mov dword [ebp - 0x87c], eax
call fcn.1012998f
cmp dword [eax + 4], edi
je 0x100fd9db
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x100fd9db
call fcn.10051524
test eax, eax
jne 0x100fdb9d
call fcn.1005172f
test eax, eax
jne 0x100fdb9d
call fcn.100516d5
test eax, eax
jne 0x100fdb9d
call fcn.10051618
test eax, eax
je 0x100fd9db
mov dword [ebx + 0x9c], 2
mov dword [ebx + 0xa0], edi
push str.SystemCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries64
push reloc.OLEAUT32.dll_SysReAllocString
push 0xd7
jmp 0x100fd9d4
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x77
push str.Driver
push str.SYSTEMCurrentControlSetControlPrintMonitors
push reloc.OLEAUT32.dll_SysReAllocString
push 0x61
jmp 0x100fd896
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x78
mov dword [esi], 2
push 0xb1
mov ecx, ebx
call fcn.10104113
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x79
push 0x101817a4
push str.SecurityProviders
push str.SYSTEMCurrentControlSetControlSecurityProviders
push reloc.OLEAUT32.dll_SysReAllocString
push 0x62
jmp 0x100fd81b
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x7a
push str.Authentication_Packages
push str.SYSTEMCurrentControlSetControlLsa
push reloc.OLEAUT32.dll_SysReAllocString
push 0x63
jmp 0x100fd41d
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x7b
push str.Notification_Packages
push str.SYSTEMCurrentControlSetControlLsa
push reloc.OLEAUT32.dll_SysReAllocString
push 0x64
jmp 0x100fd41d
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x7c
push str.Security_Packages
push str.SYSTEMCurrentControlSetControlLsa
push reloc.OLEAUT32.dll_SysReAllocString
push 0x65
jmp 0x100fd41d
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x7d
push str.Security_Packages
push str.SYSTEMCurrentControlSetControlLsa
push reloc.OLEAUT32.dll_SysReAllocString
push 0xe2
jmp 0x100fd41d
call fcn.1012998f
cmp dword [eax + 4], edi
jne case.0x100fb402.11
push edi
push edi
push edi
push str.cmdline
push str.SYSTEMCurrentControlSetControlWOW
push reloc.OLEAUT32.dll_SysReAllocString
push 0x67
mov ecx, ebx
call fcn.100f6d2f
jmp case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], edi
jne case.0x100fb402.11
push edi
push edi
push edi
push str.wowcmdline
push str.SYSTEMCurrentControlSetControlWOW
push reloc.OLEAUT32.dll_SysReAllocString
push 0x68
jmp 0x100fdd66
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x7e
mov dword [esi], 2
push str.SOFTWAREMicrosoftCode_Store_DatabaseDistribution_Units
push reloc.OLEAUT32.dll_SysReAllocString
push 0x69
mov ecx, ebx
call fcn.100edf1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x7f
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push str.SOFTWAREWow6432NodeMicrosoftCode_Store_DatabaseDistribution_Units
push reloc.OLEAUT32.dll_SysReAllocString
push 0x69
mov ecx, ebx
call fcn.100edf1c
jmp 0x100fce00
call fcn.1012998f
cmp dword [eax + 4], edi
jne case.0x100fb402.11
push str.command
push str.SOFTWAREMicrosoftShared_ToolsMSConfig_startupreg
push reloc.OLEAUT32.dll_SysReAllocString
push 0x6a
mov ecx, ebx
call fcn.100eeba0
jmp case.0x100fb402.11
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x80
mov dword [esi], 2
push str.SOFTWAREMicrosoftRpcClientProtocols
push reloc.OLEAUT32.dll_SysReAllocString
push 0x6b
mov ecx, ebx
call fcn.100f0395
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x81
push str.SOFTWAREWow6432NodeMicrosoftRpcClientProtocols
push reloc.OLEAUT32.dll_SysReAllocString
push 0x6b
xor eax, eax
mov esi, dword [ebx + 0xa0]
inc eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0x9c], eax
mov ecx, ebx
call fcn.100f0395
jmp 0x100fce00
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x82
mov dword [esi], 2
push str.SOFTWAREMicrosoftRpcSecurityService
push reloc.OLEAUT32.dll_SysReAllocString
push 0x6c
mov ecx, ebx
call fcn.100f0395
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x83
push str.SOFTWAREWow6432NodeMicrosoftRpcSecurityService
push reloc.OLEAUT32.dll_SysReAllocString
push 0x6c
jmp 0x100fdeee
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x84
push edi
push edi
push edi
push str.ComSpec
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
push reloc.OLEAUT32.dll_SysReAllocString
push 0x6d
jmp 0x100fd5fe
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x85
mov dword [esi], 2
push 0x82
mov ecx, ebx
call fcn.100f3beb
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x86
mov dword [esi], 2
push str.SoftwareMicrosoftWindowsCurrentVersionExtStats
push SysReAllocStringLen
push 0x83
mov ecx, ebx
call fcn.100ee5dd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x87
push str.SoftwareMicrosoftWindowsCurrentVersionExtStats
push SysReAllocStringLen
push 0x83
jmp 0x100fcde4
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x88
mov dword [esi], 2
push 0x101bd7f8
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
push reloc.OLEAUT32.dll_SysReAllocString
push 0x84
mov ecx, ebx
call fcn.100eeba0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x89
push 0x101bd7f8
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionApp_Paths
push reloc.OLEAUT32.dll_SysReAllocString
push 0x84
jmp 0x100fd4f2
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x8a
push str.Startup
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsStartup
mov dword [esi], 2
push SysReAllocStringLen
push 0x85
mov ecx, ebx
call fcn.100f978b
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x8b
mov dword [esi], 2
push str.Logoff
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogoff
push reloc.OLEAUT32.dll_SysReAllocString
push 0x85
mov ecx, ebx
call fcn.100f978b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x8c
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push str.Shutdown
push str.SoftwareWow6432NodePoliciesMicrosoftWindowsSystemScriptsShutdown
push reloc.OLEAUT32.dll_SysReAllocString
push 3
mov ecx, ebx
call fcn.100f978b
jmp 0x100fce00
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x8d
push str.Shutdown
push str.SoftwarePoliciesMicrosoftWindowsSystemScriptsShutdown
jmp 0x100fe160
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x8e
mov dword [esi], 2
push 0x88
mov ecx, ebx
call fcn.100f4bb6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x8f
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push 0x88
mov ecx, ebx
call fcn.100f4bb6
jmp 0x100fce00
mov esi, 0x208
push esi
push edi
lea eax, [ebp - 0x62c]
push eax
call fcn.1012db70
add esp, 0xc
push edi
push 0x10
lea eax, [ebp - 0x62c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.0x100fb402.11
push 0x400
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.1012db70
push 0x200
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.1004a2e3
add esp, 0x18
test eax, eax
je 0x100fe36c
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x62c]
push eax
call fcn.100100b8
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x90
push edi
lea eax, [ebp - 0x62c]
push eax
push 0x9e
push 0x89
mov dword [esi], 2
mov ecx, ebx
call fcn.100ebac9
jmp 0x100fce06
mov esi, 0x208
push esi
push edi
lea eax, [ebp - 0x62c]
push eax
call fcn.1012db70
add esp, 0xc
push edi
push 0x19
lea eax, [ebp - 0x62c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.0x100fb402.11
push 0x400
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.1012db70
push 0x200
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.1004a2e3
add esp, 0x18
test eax, eax
je 0x100fe424
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x62c]
push eax
call fcn.100100b8
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x91
push edi
lea eax, [ebp - 0x62c]
push eax
push 0x9f
push 0x8a
jmp 0x100fe39e
mov esi, 0x208
push esi
push edi
lea eax, [ebp - 0x62c]
push eax
call fcn.1012db70
push 0x400
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.1012db70
add esp, 0x18
push edi
push 7
lea eax, [ebp - 0x62c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100fe4cb
push 0x200
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.1004a2e3
add esp, 0xc
test eax, eax
je 0x100fe4cb
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x62c]
push eax
call fcn.100100b8
push esi
push edi
lea eax, [ebp - 0x850]
push eax
call fcn.1012db70
add esp, 0xc
push edi
push 0xb
lea eax, [ebp - 0x850]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.0x100fb402.11
push 0x400
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.1012db70
push 0x200
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x850]
push eax
call fcn.1004a2e3
add esp, 0x18
test eax, eax
je 0x100fe53a
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x850]
push eax
call fcn.100100b8
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x92
lea eax, [ebp - 0x62c]
push eax
push 1
lea eax, [ebp - 0x850]
push eax
push 0xa0
push 0x8b
mov dword [esi], 2
mov ecx, ebx
call fcn.100efa35
jmp 0x100fce06
mov esi, 0x208
push esi
push edi
lea eax, [ebp - 0x850]
push eax
call fcn.1012db70
push 0x400
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.1012db70
add esp, 0x18
push edi
push 0x18
lea eax, [ebp - 0x850]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100fe5f6
push 0x200
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x850]
push eax
call fcn.1004a2e3
add esp, 0xc
test eax, eax
je 0x100fe5f6
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x850]
push eax
call fcn.100100b8
push esi
push edi
lea eax, [ebp - 0x62c]
push eax
call fcn.1012db70
add esp, 0xc
push edi
push 0x16
lea eax, [ebp - 0x62c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.0x100fb402.11
push 0x400
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.1012db70
push 0x200
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.1004a2e3
add esp, 0x18
test eax, eax
je 0x100fe665
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x62c]
push eax
call fcn.100100b8
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x93
lea eax, [ebp - 0x850]
push eax
push 1
lea eax, [ebp - 0x62c]
push eax
push 0xa1
push 0x8c
jmp 0x100fe574
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x94
mov dword [esi], 2
push str.SOFTWAREClassesCLSID
push 0x8d
mov ecx, ebx
call fcn.100f93aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x95
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push str.SOFTWAREClassesWow6432NodeCLSID
push 0x8d
mov ecx, ebx
call fcn.100f93aa
jmp 0x100fce00
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x96
mov dword [esi], 2
push 0x8e
mov ecx, ebx
call fcn.100f69f0
jmp 0x100fce06
call fcn.10051486
test eax, eax
jne case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je 0x100fe7b0
call fcn.10051618
test eax, eax
jne 0x100fe7b0
call fcn.10051524
test eax, eax
jne 0x100fe7b0
lea esi, [ebx + 0x9c]
jmp 0x100fe7f8
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x97
mov dword [esi], 2
push 1
push str.SOFTWAREClassesCLSID
push 0x8f
mov ecx, ebx
call fcn.100f964a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
call fcn.10051618
test eax, eax
jne 0x100fe80e
call fcn.10051524
test eax, eax
je case.0x100fb402.11
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x98
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push edi
push str.SOFTWAREClassesWow6432NodeCLSID
push 0x8f
mov ecx, ebx
call fcn.100f964a
jmp 0x100fce00
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x99
mov dword [esi], 2
push edi
push str.SOFTWAREClassesCLSID
push 0xe7
mov ecx, ebx
call fcn.100f2776
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x9a
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push eax
push str.SOFTWAREClassesWow6432NodeCLSID
push 0xe7
mov ecx, ebx
call fcn.100f2776
jmp 0x100fce00
push 0xe9
push 0xe8
mov ecx, ebx
call fcn.101037a9
jmp case.0x100fb402.11
mov esi, 0x208
push esi
push edi
lea eax, [ebp - 0x62c]
push eax
call fcn.1012db70
add esp, 0xc
push edi
push 0x1a
lea eax, [ebp - 0x62c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.0x100fb402.11
push 0x410
push edi
lea eax, [ebp - 0x424]
push eax
call fcn.1012db70
push esi
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.1004a2e3
add esp, 0x18
test eax, eax
je 0x100fe997
lea eax, [ebp - 0x424]
push eax
push esi
lea eax, [ebp - 0x62c]
push eax
call fcn.100100b8
push 0x1018cff8
push esi
lea eax, [ebp - 0x62c]
push eax
call fcn.10035b0a
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x9b
push edi
lea eax, [ebp - 0x62c]
push eax
push 0xa2
push 0x90
jmp 0x100fe39e
mov esi, 0x208
push esi
push edi
lea eax, [ebp - 0x62c]
push eax
call fcn.1012db70
add esp, 0xc
push edi
push 0x23
lea eax, [ebp - 0x62c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.0x100fb402.11
push 0x410
push edi
lea eax, [ebp - 0x424]
push eax
call fcn.1012db70
push esi
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.1004a2e3
add esp, 0x18
test eax, eax
je 0x100fea50
lea eax, [ebp - 0x424]
push eax
push esi
lea eax, [ebp - 0x62c]
push eax
call fcn.100100b8
push 0x1018cff8
push esi
lea eax, [ebp - 0x62c]
push eax
call fcn.10035b0a
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x9c
push edi
lea eax, [ebp - 0x62c]
push eax
push 0xa3
push 0x91
jmp 0x100fe39e
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x9d
mov dword [esi], 2
push edi
push edi
push edi
push 0x101bd7f8
push str.SoftwareMicrosoftInternet_ExplorerView_Source_EditorEditor_Name
push reloc.OLEAUT32.dll_SysReAllocString
push 0x92
mov ecx, ebx
call fcn.100f6d2f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x9e
push edi
push edi
push edi
push 0x101bd7f8
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerView_Source_EditorEditor_Name
push reloc.OLEAUT32.dll_SysReAllocString
push 0x92
jmp 0x100fd5a9
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x9f
mov dword [esi], 2
push 0x101bd7f8
push str.SoftwareMicrosoftInternet_ExplorerPluginsExtension
push reloc.OLEAUT32.dll_SysReAllocString
push 0x93
mov ecx, ebx
call fcn.100eeba0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xa0
push 0x101bd7f8
push str.SoftwareWow6432NodeMicrosoftInternet_ExplorerPluginsExtension
push reloc.OLEAUT32.dll_SysReAllocString
push 0x93
jmp 0x100fd4f2
lea eax, [ebx + 0x9c]
lea ecx, [ebx + 0x98]
push eax
push ecx
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xa1
push 2
pop esi
mov dword [ebx + 0x9c], esi
push edi
push edi
push edi
push 0x101bd7f8
push str.SOFTWAREClasseshttp_shellopencommand
push reloc.OLEAUT32.dll_SysReAllocString
push 0x94
mov ecx, ebx
call fcn.100f6d2f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
lea eax, [ebx + 0x9c]
push eax
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xa2
mov dword [ebx + 0x9c], esi
push edi
push edi
push edi
push 0x101bd7f8
push str.SOFTWAREClasseshttp_shellopencommand
push SysReAllocStringLen
push 0x94
jmp 0x100fd604
lea eax, [ebx + 0x9c]
lea ecx, [ebx + 0x98]
push eax
push ecx
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xa3
push 2
pop esi
mov dword [ebx + 0x9c], esi
push edi
push edi
push edi
push 0x101bd7f8
push str.SOFTWAREClasseshttps_shellopencommand
push reloc.OLEAUT32.dll_SysReAllocString
push 0x95
mov ecx, ebx
call fcn.100f6d2f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
lea eax, [ebx + 0x9c]
push eax
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xa4
mov dword [ebx + 0x9c], esi
push edi
push edi
push edi
push 0x101bd7f8
push str.SOFTWAREClasseshttps_shellopencommand
push SysReAllocStringLen
push 0x95
jmp 0x100fd604
lea eax, [ebx + 0x9c]
lea ecx, [ebx + 0x98]
push eax
push ecx
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xa5
push 2
pop esi
mov dword [ebx + 0x9c], esi
push edi
push edi
push edi
push 0x101bd7f8
push str.SOFTWAREClasses_ftp_shellopencommand
push reloc.OLEAUT32.dll_SysReAllocString
push 0x96
mov ecx, ebx
call fcn.100f6d2f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
lea eax, [ebx + 0x9c]
push eax
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xa6
mov dword [ebx + 0x9c], esi
push edi
push edi
push edi
push 0x101bd7f8
push str.SOFTWAREClasses_ftp_shellopencommand
push SysReAllocStringLen
push 0x96
jmp 0x100fd604
lea ecx, [ebp - 0x88c]
call fcn.10008950
mov dword [ebp - 4], 0xa7
push edi
push 1
call fcn.1004f276
pop ecx
pop ecx
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerDesktopNameSpace
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
lea ecx, [ebp - 0x648]
call fcn.1007192a
mov byte [ebp - 4], 0xa8
mov dword [ebp - 0x890], edi
lea eax, [ebp - 0x87c]
push eax
push edi
jmp 0x100feeb6
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x100feecf
lea eax, [ebp - 0x644]
push eax
call fcn.100570b9
pop ecx
test eax, eax
je 0x100feea1
lea eax, [ebp - 0x644]
push eax
push str.SoftwareClassesCLSID_sShellOpenCommand
lea eax, [ebp - 0x88c]
push eax
call fcn.10014838
add esp, 0xc
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov byte [ebp - 4], 0xa9
mov dword [esi], 2
push edi
push edi
push edi
push 0x101bd7f8
push dword [ebp - 0x88c]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
push 0x97
mov ecx, ebx
call fcn.100f6d2f
mov byte [ebp - 4], 0xa8
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebp - 0x890]
inc eax
mov dword [ebp - 0x890], eax
lea ecx, [ebp - 0x87c]
push ecx
push eax
mov dword [ebp - 0x87c], edi
lea ecx, [ebp - 0x648]
call fcn.10071a4e
test eax, eax
jne 0x100fee14
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x100ff00a
call fcn.1012998f
cmp dword [eax + 4], 0
je 0x100ff00a
push edi
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerDesktopNameSpace
push esi
lea ecx, [ebp - 0x86c]
call fcn.1007192a
mov byte [ebp - 4], 0xaa
mov esi, edi
mov dword [ebp - 0x890], edi
lea eax, [ebp - 0x87c]
push eax
push edi
jmp 0x100fefe2
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x100feffb
lea eax, [ebp - 0x868]
push eax
call fcn.100570b9
pop ecx
test eax, eax
je 0x100fefd3
lea eax, [ebp - 0x868]
push eax
push str.SoftwareClassesWow6432NodeCLSID_sShellOpenCommand
lea eax, [ebp - 0x88c]
push eax
call fcn.10014838
add esp, 0xc
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x100fefd3
call fcn.1012998f
cmp dword [eax + 4], 0
je 0x100fefd3
lea esi, [ebx + 0x9c]
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov byte [ebp - 4], 0xab
mov edi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [esi], eax
mov dword [ebx + 0xa0], eax
xor eax, eax
push eax
push eax
push eax
push 0x101bd7f8
push dword [ebp - 0x88c]
push reloc.OLEAUT32.dll_SysReAllocString
push 0x97
mov ecx, ebx
call fcn.100f6d2f
mov dword [ebx + 0xa0], edi
mov byte [ebp - 4], 0xaa
lea ecx, [ebp - 0x878]
call fcn.1005b73c
xor edi, edi
mov esi, dword [ebp - 0x890]
inc esi
mov dword [ebp - 0x890], esi
lea eax, [ebp - 0x87c]
push eax
push esi
mov dword [ebp - 0x87c], edi
lea ecx, [ebp - 0x86c]
call fcn.10071a4e
test eax, eax
jne 0x100fef18
mov byte [ebp - 4], 0xa8
lea ecx, [ebp - 0x86c]
call fcn.100719ae
mov byte [ebp - 4], 0xa7
lea ecx, [ebp - 0x648]
call fcn.100719ae
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x88c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
jmp case.0x100fb402.11
lea edi, [ebx + 0x9c]
lea esi, [ebx + 0x98]
push edi
push esi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xae
mov dword [edi], 2
push 1
push 0x9c
mov ecx, ebx
call fcn.100f5dcb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
push edi
push esi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xaf
push 2
pop eax
mov dword [edi], eax
push eax
push 0x9c
mov ecx, ebx
call fcn.100f5dcb
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xb0
mov dword [esi], 2
push 0x9d
mov ecx, ebx
call fcn.100f76f4
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xb1
mov dword [esi], 2
push 0xa4
mov ecx, ebx
call fcn.100ed366
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xb2
mov dword [esi], 2
push edi
push str.Startup
push 1
push 0xa6
mov ecx, ebx
call fcn.100f9e72
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xb3
xor eax, eax
inc eax
push eax
push str.Startup
push eax
push 0xa6
mov esi, dword [ebx + 0xa0]
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0x9c], eax
mov ecx, ebx
call fcn.100f9e72
jmp 0x100fce00
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xb4
mov dword [esi], 2
push edi
push str.Startup
push edi
push 0xa7
mov ecx, ebx
call fcn.100f9e72
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xb5
xor eax, eax
inc eax
push eax
push str.Startup
push edi
push 0xa7
jmp 0x100ff196
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xb6
mov dword [esi], 2
push edi
push str.Logon
push 1
push 0xa8
mov ecx, ebx
call fcn.100f9e72
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xb7
xor eax, eax
inc eax
push eax
push str.Logon
push eax
push 0xa8
jmp 0x100ff196
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xb8
mov dword [esi], 2
push edi
push str.Logon
push edi
push 0xa9
mov ecx, ebx
call fcn.100f9e72
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xb9
xor eax, eax
inc eax
push eax
push str.Logon
push edi
push 0xa9
jmp 0x100ff196
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xba
mov dword [esi], 2
push edi
push str.Logoff
push 1
push 0xaa
mov ecx, ebx
call fcn.100f9e72
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xbb
xor eax, eax
inc eax
push eax
push str.Logoff
push eax
push 0xaa
jmp 0x100ff196
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xbc
mov dword [esi], 2
push edi
push str.Logoff
push edi
push 0xab
mov ecx, ebx
call fcn.100f9e72
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xbd
xor eax, eax
inc eax
push eax
push str.Logoff
push edi
push 0xab
jmp 0x100ff196
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xbe
mov dword [esi], 2
push edi
push str.Shutdown
push 1
push 0xac
mov ecx, ebx
call fcn.100f9e72
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xbf
xor eax, eax
inc eax
push eax
push str.Shutdown
push eax
push 0xac
jmp 0x100ff196
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xc0
mov dword [esi], 2
push edi
push str.Shutdown
push edi
push 0xad
mov ecx, ebx
call fcn.100f9e72
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xc1
xor eax, eax
inc eax
push eax
push str.Shutdown
push edi
push 0xad
jmp 0x100ff196
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xc2
push 0x101811c0
push str.SOFTWAREClassesProtocolsFilter
push SysReAllocStringLen
push 0xae
mov dword [esi], 2
mov ecx, ebx
call fcn.100eddef
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xc3
push 0x101811c0
push str.SOFTWAREClassesProtocolsHandler
push SysReAllocStringLen
push 0xaf
jmp 0x100ff5cd
call fcn.1012998f
cmp dword [eax + 4], edi
jne case.0x100fb402.11
push 0xb0
mov ecx, ebx
call fcn.100f622e
jmp case.0x100fb402.11
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xc4
mov dword [esi], 2
push edi
push str.Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionGroup_PolicyState
push SysReAllocStringLen
push 0xb2
mov ecx, ebx
call fcn.100f9d14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xc5
xor eax, eax
inc eax
push eax
push str.Startup
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionGroup_PolicyState
push SysReAllocStringLen
push 0xb2
mov esi, dword [ebx + 0xa0]
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0x9c], eax
mov ecx, ebx
call fcn.100f9d14
jmp 0x100fce00
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xc6
mov dword [esi], 2
push edi
push str.Startup
push str.SOFTWAREMicrosoftWindowsCurrentVersionGroup_PolicyState
push reloc.OLEAUT32.dll_SysReAllocString
push 0xb3
mov ecx, ebx
call fcn.100f9d14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xc7
xor eax, eax
inc eax
push eax
push str.Startup
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionGroup_PolicyState
push reloc.OLEAUT32.dll_SysReAllocString
push 0xb3
jmp 0x100ff6cf
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xc8
mov dword [esi], 2
push edi
push str.Shutdown
push str.SOFTWAREMicrosoftWindowsCurrentVersionGroup_PolicyState
push SysReAllocStringLen
push 0xb4
mov ecx, ebx
call fcn.100f9d14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xc9
xor eax, eax
inc eax
push eax
push str.Shutdown
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionGroup_PolicyState
push SysReAllocStringLen
push 0xb4
jmp 0x100ff6cf
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xca
mov dword [esi], 2
push edi
push str.Shutdown
push str.SOFTWAREMicrosoftWindowsCurrentVersionGroup_PolicyState
push reloc.OLEAUT32.dll_SysReAllocString
push 0xb5
mov ecx, ebx
call fcn.100f9d14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xcb
xor eax, eax
inc eax
push eax
push str.Shutdown
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionGroup_PolicyState
push reloc.OLEAUT32.dll_SysReAllocString
push 0xb5
jmp 0x100ff6cf
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xcc
mov dword [esi], 2
push edi
push str.LogOn
push str.SOFTWAREMicrosoftWindowsCurrentVersionGroup_PolicyState
push reloc.OLEAUT32.dll_SysReAllocString
push 0xb6
mov ecx, ebx
call fcn.100f9d14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xcd
xor eax, eax
inc eax
push eax
push str.LogOn
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionGroup_PolicyState
push reloc.OLEAUT32.dll_SysReAllocString
push 0xb6
jmp 0x100ff6cf
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xce
mov dword [esi], 2
push edi
push str.LogOn
push str.SOFTWAREMicrosoftWindowsCurrentVersionGroup_PolicyState
push SysReAllocStringLen
push 0xb7
mov ecx, ebx
call fcn.100f9d14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xcf
xor eax, eax
inc eax
push eax
push str.LogOn
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionGroup_PolicyState
push SysReAllocStringLen
push 0xb7
jmp 0x100ff6cf
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xd0
mov dword [esi], 2
push edi
push str.LogOff
push str.SOFTWAREMicrosoftWindowsCurrentVersionGroup_PolicyState
push reloc.OLEAUT32.dll_SysReAllocString
push 0xb8
mov ecx, ebx
call fcn.100f9d14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xd1
xor eax, eax
inc eax
push eax
push str.LogOff
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionGroup_PolicyState
push reloc.OLEAUT32.dll_SysReAllocString
push 0xb8
jmp 0x100ff6cf
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xd2
mov dword [esi], 2
push edi
push str.LogOff
push str.SOFTWAREMicrosoftWindowsCurrentVersionGroup_PolicyState
push SysReAllocStringLen
push 0xb9
mov ecx, ebx
call fcn.100f9d14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xd3
xor eax, eax
inc eax
push eax
push str.LogOff
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionGroup_PolicyState
push SysReAllocStringLen
push 0xb9
jmp 0x100ff6cf
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xd4
push 0xbb
push SysReAllocStringLen
push 0xba
mov dword [esi], 2
mov ecx, ebx
call fcn.100f47b3
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xd5
push 0xbd
push SysReAllocStringLen
push 0xbc
jmp 0x100ffb7c
lea edi, [ebx + 0x9c]
lea eax, [ebx + 0x98]
push edi
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xd6
push 2
pop esi
mov dword [edi], esi
push 0xca
push reloc.OLEAUT32.dll_SysReAllocString
push 0xc9
mov ecx, ebx
call fcn.100f3d10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
push edi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xd7
mov dword [edi], esi
push 0xca
push SysReAllocStringLen
push 0xc9
mov ecx, ebx
call fcn.100f3d10
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xd8
mov dword [esi], 2
push 0xcb
mov ecx, ebx
call fcn.100ec7f4
jmp 0x100fce06
lea eax, [ebx + 0x9c]
lea ecx, [ebx + 0x98]
push eax
push ecx
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xd9
push 2
pop esi
mov dword [ebx + 0x9c], esi
push str.00021494_0000_0000_C000_000000000046
push str.SOFTWAREClassesCLSID
push reloc.OLEAUT32.dll_SysReAllocString
push 0xcc
mov ecx, ebx
call fcn.100f3ea2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x100ffd34
lea eax, [ebx + 0x9c]
push eax
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xda
mov dword [ebx + 0x9c], esi
push str.00021494_0000_0000_C000_000000000046
push str.SOFTWAREClassesCLSID
push SysReAllocStringLen
push 0xcc
mov ecx, ebx
call fcn.100f3ea2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x100ffda9
call fcn.1012998f
cmp dword [eax + 4], 0
je 0x100ffda9
lea eax, [ebx + 0x9c]
push eax
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xdb
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push str.00021494_0000_0000_C000_000000000046
push str.SOFTWAREClassesWow6432NodeCLSID
push SysReAllocStringLen
push 0xcc
mov ecx, ebx
call fcn.100f3ea2
mov dword [ebx + 0xa0], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
lea eax, [ebx + 0x9c]
push eax
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xdc
push str.00021494_0000_0000_C000_000000000046
push str.SOFTWAREClassesWow6432NodeCLSID
push reloc.OLEAUT32.dll_SysReAllocString
push 0xcc
xor eax, eax
inc eax
mov esi, dword [ebx + 0xa0]
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
mov ecx, ebx
call fcn.100f3ea2
jmp 0x100fce00
lea eax, [ebx + 0x9c]
lea ecx, [ebx + 0x98]
push eax
push ecx
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xdd
push 2
pop esi
mov dword [ebx + 0x9c], esi
push str.00021493_0000_0000_C000_000000000046
push str.SOFTWAREClassesCLSID
push reloc.OLEAUT32.dll_SysReAllocString
push 0xcd
mov ecx, ebx
call fcn.100f3ea2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x100ffec4
lea eax, [ebx + 0x9c]
push eax
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xde
mov dword [ebx + 0x9c], esi
push str.00021493_0000_0000_C000_000000000046
push str.SOFTWAREClassesCLSID
push SysReAllocStringLen
push 0xcd
mov ecx, ebx
call fcn.100f3ea2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x100fff39
call fcn.1012998f
cmp dword [eax + 4], 0
je 0x100fff39
lea eax, [ebx + 0x9c]
push eax
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xdf
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push str.00021493_0000_0000_C000_000000000046
push str.SOFTWAREClassesWow6432NodeCLSID
push SysReAllocStringLen
push 0xcd
mov ecx, ebx
call fcn.100f3ea2
mov dword [ebx + 0xa0], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
lea eax, [ebx + 0x9c]
push eax
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xe0
push str.00021493_0000_0000_C000_000000000046
push str.SOFTWAREClassesWow6432NodeCLSID
push reloc.OLEAUT32.dll_SysReAllocString
push 0xcd
jmp 0x100ffdf5
lea eax, [ebx + 0x9c]
lea ecx, [ebx + 0x98]
push eax
push ecx
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xe1
push 2
pop esi
mov dword [ebx + 0x9c], esi
push str.00021492_0000_0000_C000_000000000046
push str.SOFTWAREClassesCLSID
push reloc.OLEAUT32.dll_SysReAllocString
push 0xce
mov ecx, ebx
call fcn.100f3ea2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x10100038
lea eax, [ebx + 0x9c]
push eax
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xe2
mov dword [ebx + 0x9c], esi
push str.00021492_0000_0000_C000_000000000046
push str.SOFTWAREClassesCLSID
push SysReAllocStringLen
push 0xce
mov ecx, ebx
call fcn.100f3ea2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x101000ad
call fcn.1012998f
cmp dword [eax + 4], 0
je 0x101000ad
lea eax, [ebx + 0x9c]
push eax
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xe3
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push str.00021492_0000_0000_C000_000000000046
push str.SOFTWAREClassesWow6432NodeCLSID
push SysReAllocStringLen
push 0xce
mov ecx, ebx
call fcn.100f3ea2
mov dword [ebx + 0xa0], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
lea eax, [ebx + 0x9c]
push eax
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xe4
push str.00021492_0000_0000_C000_000000000046
push str.SOFTWAREClassesWow6432NodeCLSID
push reloc.OLEAUT32.dll_SysReAllocString
push 0xce
jmp 0x100ffdf5
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xe5
mov dword [esi], 2
push 0xbf
push SysReAllocStringLen
push 0xbe
mov ecx, ebx
call fcn.100f41b9
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xe6
mov dword [esi], 2
push 0xc0
mov ecx, ebx
call fcn.100f44f9
jmp 0x100fce06
lea eax, [ebx + 0x9c]
lea ecx, [ebx + 0x98]
push eax
push ecx
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xe7
push 2
pop esi
mov dword [ebx + 0x9c], esi
push edi
push edi
push edi
push 0x101bd7f8
push str.SOFTWAREClassesCLSID275C23E2_3747_11D0_9FEA_00AA003F8646InProcServer32
push reloc.OLEAUT32.dll_SysReAllocString
push 0xcf
mov ecx, ebx
call fcn.100f6d2f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x1010022a
lea eax, [ebx + 0x9c]
push eax
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xe8
mov dword [ebx + 0x9c], esi
push edi
push edi
push edi
push 0x101bd7f8
push str.SOFTWAREClassesCLSID275C23E2_3747_11D0_9FEA_00AA003F8646InProcServer32
push SysReAllocStringLen
push 0xcf
mov ecx, ebx
call fcn.100f6d2f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je 0x101002a2
call fcn.1012998f
cmp dword [eax + 4], 0
je 0x101002a2
lea eax, [ebx + 0x9c]
push eax
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xe9
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push edi
push edi
push edi
push 0x101bd7f8
push str.SOFTWAREClassesWow6432NodeCLSID275C23E2_3747_11D0_9FEA_00AA003F8646InProcServer32
push SysReAllocStringLen
push 0xcf
mov ecx, ebx
call fcn.100f6d2f
mov dword [ebx + 0xa0], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
lea eax, [ebx + 0x9c]
push eax
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xea
push edi
push edi
push edi
push 0x101bd7f8
push str.SOFTWAREClassesWow6432NodeCLSID275C23E2_3747_11D0_9FEA_00AA003F8646InProcServer32
push reloc.OLEAUT32.dll_SysReAllocString
push 0xcf
jmp 0x100fd5a9
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xeb
mov dword [esi], 2
push 0xd0
mov ecx, ebx
call fcn.100ecaf7
jmp 0x100fce06
mov dword [ebp - 4], 0xec
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov byte [ebp - 4], 0xed
mov dword [esi], 2
push 0xd1
mov ecx, ebx
call fcn.100f1a03
mov byte [ebp - 4], 0xec
lea ecx, [ebp - 0x878]
call fcn.1005b73c
or dword [ebp - 4], 0xffffffff
jmp case.0x100fb402.11
cmp dword [ebx + 0xa4], edi
je case.0x100fb402.11
lea edi, [ebx + 0x9c]
lea eax, [ebx + 0x98]
push edi
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xef
push 2
pop esi
mov dword [edi], esi
push str.SOFTWAREClassesDirectory_shell
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, dword [ebp + 8]
push edi
mov ecx, ebx
call fcn.100f46a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
lea eax, [ebx + 0x9c]
push eax
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xf0
push str.SOFTWAREClassesDirectory_shell
mov dword [ebx + 0x9c], esi
push SysReAllocStringLen
push edi
mov ecx, ebx
call fcn.100f46a6
jmp 0x100fce06
cmp dword [ebx + 0xa4], edi
je case.0x100fb402.11
lea edi, [ebx + 0x9c]
lea eax, [ebx + 0x98]
push edi
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xf1
push 2
pop esi
mov dword [edi], esi
push str.SOFTWAREClassesFolder_shell
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, dword [ebp + 8]
push edi
mov ecx, ebx
call fcn.100f46a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
lea eax, [ebx + 0x9c]
push eax
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xf2
push str.SOFTWAREClassesFolder_shell
jmp 0x1010040a
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xf3
mov dword [esi], 2
mov edi, dword [ebp + 8]
push edi
mov ecx, ebx
call fcn.100f4e04
jmp 0x100fce06
lea edi, [ebx + 0x9c]
lea eax, [ebx + 0x98]
push edi
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xf4
push 2
pop esi
mov dword [edi], esi
mov edi, str.SOFTWAREClassesCLSID
push edi
push reloc.OLEAUT32.dll_SysReAllocString
push 0xd2
mov ecx, ebx
call fcn.100f2c94
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
lea eax, [ebx + 0x9c]
push eax
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xf5
mov dword [ebx + 0x9c], esi
push edi
push SysReAllocStringLen
push 0xd2
mov ecx, ebx
call fcn.100f2c94
jmp 0x100fce06
lea edi, [ebx + 0x9c]
lea eax, [ebx + 0x98]
push edi
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xf6
push 2
pop esi
mov dword [edi], esi
push reloc.OLEAUT32.dll_SysReAllocString
push 0xda
mov ecx, ebx
call fcn.100f29ff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
push edi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xf7
mov dword [edi], esi
push SysReAllocStringLen
push 0xda
mov ecx, ebx
call fcn.100f29ff
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xf8
mov dword [esi], 2
push edi
push str.SOFTWAREMicrosoftMSDTCMTxOCI
push reloc.OLEAUT32.dll_SysReAllocString
push 0xdb
mov ecx, ebx
call fcn.10103ec6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xf9
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push eax
push str.SOFTWAREWow6432NodeMicrosoftMSDTCMTxOCI
push reloc.OLEAUT32.dll_SysReAllocString
push 0xdb
mov ecx, ebx
call fcn.10103ec6
jmp 0x100fce00
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xfa
mov dword [esi], 2
push edi
push str.SOFTWAREMicrosoftMSDTCXADLL
push reloc.OLEAUT32.dll_SysReAllocString
push 0xde
mov ecx, ebx
call fcn.10104056
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xfb
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push eax
push str.SOFTWAREWow6432NodeMicrosoftMSDTCXADLL
push reloc.OLEAUT32.dll_SysReAllocString
push 0xde
mov ecx, ebx
call fcn.10104056
jmp 0x100fce00
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xfc
push edi
push edi
push edi
push str.IsolatedCommand
push str.SOFTWAREClassesexefile_shell_runascommand
push reloc.OLEAUT32.dll_SysReAllocString
push 0xdc
jmp 0x100fd5fe
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xfd
push edi
push edi
push edi
push str.IsolatedCommand
push str.SOFTWAREClassesexefile_shell_runascommand
push SysReAllocStringLen
push 0xdd
jmp 0x100fd5fe
push 0xdf
mov ecx, ebx
call fcn.10105205
jmp case.0x100fb402.11
push 0xe0
mov ecx, ebx
call fcn.10103203
jmp case.0x100fb402.11
push 0xe3
mov ecx, ebx
call fcn.101046c9
jmp case.0x100fb402.11
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xfe
push edi
push edi
push edi
push str.UserInitMprLogonScript
push 0x1018d2a4
push SysReAllocStringLen
push 0xe4
jmp 0x100fd5fe
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0xff
mov dword [esi], 2
push edi
push str.SOFTWAREMicrosoftNetSh
push reloc.OLEAUT32.dll_SysReAllocString
push 0xe6
mov ecx, ebx
call fcn.100ed2aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x100
mov esi, dword [ebx + 0xa0]
xor eax, eax
inc eax
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
push eax
push str.SOFTWAREWOW6432NodeMicrosoftNetSh
push reloc.OLEAUT32.dll_SysReAllocString
push 0xe6
mov ecx, ebx
call fcn.100ed2aa
jmp 0x100fce00
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x101
mov dword [esi], 2
push edi
push str.SOFTWAREMicrosoftHtmlHelp_Author
push SysReAllocStringLen
push 0xea
mov ecx, ebx
call fcn.100ed2aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
jmp case.0x100fb402.11
push 0xeb
mov ecx, ebx
call fcn.10104547
jmp case.0x100fb402.11
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x102
mov dword [esi], 2
push 0xec
mov ecx, ebx
call fcn.100efb59
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x103
mov dword [esi], 2
push 0xed
mov ecx, ebx
call fcn.100ed0d5
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x104
mov dword [esi], 2
push 0xef
mov ecx, ebx
call fcn.100efbec
jmp 0x100fce06
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x105
mov dword [esi], 2
push edi
push edi
push edi
push 0x101bd7f8
push str.SOFTWAREClassesCLSIDECD4FC4D_521C_11D0_B792_00A0C90312E1InProcServer32
push reloc.OLEAUT32.dll_SysReAllocString
push 0xf0
mov ecx, ebx
call fcn.100f6d2f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
call fcn.1012998f
cmp dword [eax + 4], 0
je case.0x100fb402.11
push esi
push edi
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x106
push edi
push edi
push edi
push 0x101bd7f8
push str.SOFTWAREWOW6432NODEClassesCLSIDECD4FC4D_521C_11D0_B792_00A0C90312E1InProcServer32
push reloc.OLEAUT32.dll_SysReAllocString
push 0xf0
jmp 0x100fd5a9
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x107
mov dword [esi], 2
push 0xf1
mov ecx, ebx
call fcn.100eeebb
jmp 0x100fce06
push 0xf5
mov ecx, ebx
call fcn.10103d7e
jmp case.0x100fb402.11
push ecx
mov ecx, ebx
call fcn.10103e11
jmp case.0x100fb402.11
call fcn.10051524
test eax, eax
je case.0x100fb402.5
lea esi, [ebx + 0x9c]
push esi
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x108
mov dword [esi], 2
push edi
push edi
push edi
push 0x101bd7f8
push str.SOFTWAREClassesAppX82a6gwre4fdg3bt635tn5ctqjf8msdd2Shellopencommand
push SysReAllocStringLen
push 0xf7
mov ecx, ebx
call fcn.100f6d2f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
jmp case.0x100fb402.5
lea edi, [ebx + 0x9c]
lea eax, [ebx + 0x98]
push edi
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x69
push 2
pop esi
mov dword [edi], esi
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, dword [ebp + 8]
push edi
mov ecx, ebx
call fcn.100f453b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1005b73c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
test eax, eax
je case.0x100fb402.11
lea eax, [ebx + 0x9c]
push eax
lea eax, [ebx + 0x98]
push eax
lea ecx, [ebp - 0x878]
call fcn.1005b243
mov dword [ebp - 4], 0x6a
mov dword [ebx + 0x9c], esi
push SysReAllocStringLen
push edi
mov ecx, ebx
call fcn.100f453b
jmp 0x100fce06
mov eax, 0x2712
cmp esi, eax
ja 0x10100d27
je 0x10100cd0
mov eax, 0x2328
sub esi, eax
je 0x10100cbd
sub esi, 0x3e6
je 0x10100ca9
sub esi, 1
je 0x10100c95
dec esi
sub esi, 1
jne case.0x100fb402.5
mov ecx, dword [ebx + 0x90]
test ecx, ecx
je 0x100fb36d
lea eax, [ebx + 0x2c]
push eax
push dword [ebp - 0x890]
push dword [ebp - 0x87c]
push dword [ebp - 0x88c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.1011ee3d
push dword [ebp + 0x20]
push 0x2711
mov ecx, dword [ebx + 0x90]
call fcn.1011d7b0
mov edi, eax
mov eax, dword [ebx + 0x90]
mov eax, dword [eax + 0x48]
mov dword [ebx + 0x28], eax
jmp 0x100fb36d
push dword [ebp + 0x10]
push 0x270f
mov ecx, ebx
call fcn.100f2dd7
jmp case.0x100fb402.11
push dword [ebp + 0x10]
push 0x270e
mov ecx, ebx
call fcn.100f29ce
jmp case.0x100fb402.11
push dword [ebx + 0x120]
push eax
mov ecx, ebx
call fcn.10104950
jmp case.0x100fb402.11
mov ecx, dword [ebx + 0x90]
test ecx, ecx
je 0x100fb36d
lea eax, [ebx + 0x2c]
push eax
push dword [ebp - 0x890]
push dword [ebp - 0x87c]
push dword [ebp - 0x88c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.1011ee3d
push edi
push edi
push dword [ebp + 0x20]
push 0x2712
mov ecx, dword [ebx + 0x90]
call fcn.1011ddbd
mov edi, eax
mov ecx, dword [ebx + 0x90]
mov ecx, dword [ecx + 0x48]
mov dword [ebx + 0x28], ecx
jmp 0x100fb36d
mov eax, esi
mov ecx, 0x2713
sub eax, ecx
je 0x10100d47
sub eax, 1
je case.0x100fb402.11
sub eax, 1
je 0x10100d47
xor eax, eax
jmp 0x10100e46
cmp esi, ecx
jne 0x10100d56
xor eax, eax
cmp dword [ebp + 0x10], eax
setne al
mov dword [ebx + 0x1c], eax
cmp dword [ebp - 0x88c], 0
je case.0x100fb402.11
mov esi, 0x208
push esi
push edi
lea eax, [ebp - 0x850]
push eax
call fcn.1012db70
push esi
push edi
lea eax, [ebp - 0x62c]
push eax
call fcn.1012db70
add esp, 0x18
push dword [ebp - 0x88c]
push esi
lea eax, [ebp - 0x850]
push eax
call fcn.100100b8
push 0x5c
push edi
lea eax, [ebp - 0x850]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
test eax, eax
je 0x10100dd0
add eax, 2
mov dword [ebp - 0x87c], eax
push eax
push esi
lea eax, [ebp - 0x62c]
push eax
call fcn.100100b8
xor ecx, ecx
mov eax, dword [ebp - 0x87c]
mov word [eax], cx
push 0x410
push edi
lea eax, [ebp - 0x424]
push eax
call fcn.1012db70
push esi
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x850]
push eax
call fcn.1004a2e3
add esp, 0x18
test eax, eax
jne 0x10100e15
lea eax, [ebp - 0x850]
push eax
push 0x410
lea eax, [ebp - 0x424]
push eax
call fcn.100100b8
push edi
mov ecx, ebx
cmp word [ebp - 0x62c], 0
je 0x10100e2b
lea eax, [ebp - 0x62c]
push eax
jmp 0x10100e2c
push edi
mov eax, dword [ebx + 0x1c]
and eax, 1
push eax
lea eax, [ebp - 0x424]
push eax
mov edi, dword [ebp + 8]
push edi
call fcn.100f0271
xor eax, eax
inc eax
call fcn.1012b669
ret 0x24