Function at 0x1001635
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd58
mov eax, dword [0x1054064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [int.01001194]
mov dword [ebp - 0xc64], eax
mov eax, dword [ebp + 0x10]
push 0x200
mov dword [ebp - 0xc68], eax
xor ebx, ebx
lea eax, [ebp - 0x458]
push eax
xor esi, esi
push 0xd9
inc esi
push ebx
mov dword [ebp - 0xc5c], ebx
mov dword [ebp - 0xc60], ebx
mov dword [ebp - 0xcc0], esi
mov dword [ebp - 0xcbc], ebx
mov dword [ebp - 0xcb8], ebx
mov dword [ebp - 0xcb4], ebx
call edi
push eax
call dword [fcn.010013f4]
test eax, eax
je 0x102759e
mov ecx, dword [0x10540ac]
call fcn.01012a40
push 0x1054a70
push 0x10551f8
push 0x10321a3
push 0x1001d5c
call fcn.0101293b
cmp dword [0x105521c], ebx
jne 0x10275a5
push ebx
call edi
push eax
call fcn.0101349f
mov esi, dword [ebp - 0xc64]
push ebx
mov dword [ebp - 0xcf0], 0x30
mov dword [ebp - 0xcec], ebx
mov dword [ebp - 0xce8], 0x1001ede
mov dword [ebp - 0xce4], ebx
mov dword [ebp - 0xce0], ebx
mov dword [ebp - 0xcdc], esi
call fcn.01012a09
push 1
mov dword [ebp - 0xcd8], eax
call fcn.01012a09
push 0x7f00
push ebx
mov dword [ebp - 0xcc4], eax
call dword [fcn.010013d0]
mov dword [ebp - 0xcd4], eax
lea eax, [ebp - 0xc74]
push eax
push 1
push 0x9d
push ebx
call edi
push eax
call fcn.010076e7
mov eax, dword [ebp - 0xc74]
mov dword [0x105432c], eax
lea eax, [ebp - 0xcf0]
mov edi, 0x1001d70
push eax
mov dword [ebp - 0xcd0], ebx
mov dword [ebp - 0xccc], 0x6c
mov dword [ebp - 0xcc8], edi
call dword [0x1001328]
test ax, ax
je 0x1027619
push ebx
push esi
push ebx
push ebx
mov esi, 0x80000000
push esi
push esi
push esi
push esi
push 0xca0000
lea eax, [ebp - 0x458]
push eax
push edi
push 0x100
call dword [fcn.0100141c]
push ebx
push dword [ebp - 0xc64]
mov dword [ebp - 0xc6c], eax
push ebx
push eax
push esi
push esi
push esi
push esi
push 0x40000000
push ebx
push edi
push ebx
call dword [fcn.0100141c]
push 0x34
mov dword [0x1054330], eax
call fcn.01002286
mov esi, eax
pop ecx
cmp esi, ebx
je 0x101920e
push 0x1014e74
lea ecx, [ebp - 0xcb0]
call fcn.010127cb
xor edi, edi
inc edi
push edi
lea eax, [ebp - 0xcb0]
push eax
mov ecx, esi
mov dword [ebp - 0xc5c], edi
call fcn.0101733a
test byte [ebp - 0xc5c], 1
mov dword [0x1054080], eax
je 0x1001841
and dword [ebp - 0xc5c], 0xfffffffe
push ebx
push edi
lea ecx, [ebp - 0xcb0]
call fcn.0101212a
push 0x38
call fcn.01002286
mov esi, eax
pop ecx
cmp esi, ebx
je 0x1019218
push 0x1001d84
lea ecx, [ebp - 0xcb0]
call fcn.010127cb
or dword [ebp - 0xc5c], 2
push 0x12c
push 5
lea eax, [ebp - 0xcb0]
push eax
push dword [0x1054080]
mov ecx, esi
call fcn.01016712
test byte [ebp - 0xc5c], 2
mov dword [0x1054084], eax
je 0x10018a0
push ebx
push edi
lea ecx, [ebp - 0xcb0]
call fcn.0101212a
push 0xffffffffffffffff
push dword [ebp - 0xc68]
lea eax, [ebp - 0xc58]
push 0x400
push eax
lea eax, [ebp - 0xc70]
push eax
mov dword [ebp - 0xc70], ebx
call dword [0x10015d8]
add esp, 0x14
lea eax, [ebp - 0xc58]
push eax
lea ecx, [ebp - 0xcb0]
call fcn.010127cb
mov ecx, dword [0x1054080]
lea eax, [ebp - 0xcb0]
push eax
call fcn.010173a1
push ebx
push edi
lea ecx, [ebp - 0xcb0]
mov dword [ebp - 0xc68], eax
call fcn.0101212a
push ebx
lea eax, [ebp - 0xcc0]
push eax
lea eax, [ebp - 0xc78]
push eax
call sub.gdiplus.dll_GdiplusStartup
push ebx
lea eax, [ebp - 0xc60]
push eax
push ebx
push 0x20019
push ebx
push ebx
push ebx
push 0x100879c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1027620
push edi
mov edi, 0x100b990
push edi
push dword [ebp - 0xc60]
call fcn.010157a9
mov esi, eax
cmp esi, 4
jge 0x102762b
push ebx
push 0x1014e64
push dword [ebp - 0xc60]
call fcn.010157a9
push ebx
push 0x100c5e8
push dword [ebp - 0xc60]
mov dword [ebp - 0xc64], eax
call fcn.010157a9
mov dword [0x1054a50], ebx
cmp eax, ebx
jne 0x10191e7
push ebx
push 0x100c9e4
push dword [ebp - 0xc60]
call fcn.010157a9
test eax, eax
jne 0x1027640
push ebx
push 0x100c9f8
push dword [ebp - 0xc60]
call fcn.010157a9
cmp eax, ebx
jne 0x10191f3
push ebx
push 0x100ca0c
push dword [ebp - 0xc60]
call fcn.010157a9
test eax, eax
jne 0x1027657
cmp dword [ebp - 0xc60], ebx
je 0x10019f0
push dword [ebp - 0xc60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x1054330]
mov dword [0x1054304], esi
call dword [fcn.010013fc]
push eax
call dword [0x1001344]
mov edi, dword [0x1001418]
push ebx
add esi, 0x130
push esi
push 0x133
push 0x130
push eax
mov dword [ebp - 0xc5c], eax
call edi
mov eax, dword [ebp - 0xc64]
neg eax
sbb eax, eax
and eax, 8
push eax
push 0x12f
push dword [ebp - 0xc5c]
call dword [0x1001364]
mov esi, 0x1054210
mov ecx, esi
call fcn.010150a3
mov ecx, esi
call fcn.01015070
lea ecx, [ebp - 0xd2c]
call fcn.0100885d
push dword [ebp - 0xc6c]
lea ecx, [ebp - 0xd2c]
push ebx
call fcn.01017085
lea eax, [ebp - 0xd58]
push eax
push dword [ebp - 0xc6c]
lea ecx, [ebp - 0xd2c]
call fcn.010170fd
lea eax, [ebp - 0xd58]
push eax
push dword [ebp - 0xc6c]
mov dword [ebp - 0xd50], ebx
call dword [0x1001324]
cmp dword [0x1054330], ebx
je 0x1027663
mov ecx, esi
call fcn.010167ff
push esi
lea ecx, [ebp - 0xd00]
call fcn.01015494
mov ecx, dword [0x1054080]
call fcn.0101729f
mov ecx, dword [0x1054084]
lea eax, [ebp - 0xd00]
push eax
call fcn.010157ec
mov ecx, dword [0x1054084]
call fcn.01015806
cmp dword [ebp - 0xc68], ebx
jne 0x102766f
push 1
mov ecx, esi
call fcn.0101515a
push ebx
mov ecx, esi
call fcn.0100b4c6
push dword [0x1054330]
call dword [fcn.010013fc]
push eax
lea ecx, [ebp - 0xd2c]
call fcn.0101240d
push dword [ebp - 0xc64]
mov ecx, dword [0x1054300]
call fcn.0101496b
cmp dword [0x105521c], ebx
jne 0x102768a
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x1027701
push ebx
mov ecx, esi
call fcn.0100bab5
cmp byte [0x105430a], bl
jne 0x101a82f
mov ecx, esi
call fcn.0100a49d
push 0x96
push dword [0x1054340]
call dword [fcn.010013c0]
push eax
call dword [fcn.010013f0]
push ebx
call fcn.010021b6
mov ecx, eax
call fcn.01002541
mov ecx, eax
call fcn.01003349
call fcn.010024b9
push dword [0x1054330]
call dword [fcn.010013fc]
push eax
call dword [0x1001320]
xor eax, eax
cmp eax, 0x1054220
je 0x1001bd2
lea edi, [eax*2 + 0x1054220]
cmp word [edi], bx
jne 0x102771b
cmp eax, ebx
jg 0x1027730
call fcn.0101498d
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc94]
push eax
call dword [0x100131c]
test eax, eax
je 0x1001cc4
mov edi, dword [0x1001318]
lea eax, [ebp - 0xc94]
push eax
push dword [0x1054324]
push dword [0x1054330]
call edi
test eax, eax
jne 0x1001cac
lea eax, [ebp - 0xc94]
push eax
mov ecx, esi
call fcn.01001d93
test eax, eax
jne 0x1001cac
lea eax, [ebp - 0xc94]
push eax
call fcn.01001e16
test al, al
jne 0x1001cac
cmp dword [ebp - 0xc90], 0x201
je 0x1006552
lea eax, [ebp - 0xc94]
push eax
mov ecx, esi
call fcn.01001dd6
test eax, eax
jne 0x1001cac
lea eax, [ebp - 0xc94]
push eax
push dword [0x1054328]
push dword [0x1054330]
call edi
test eax, eax
jne 0x1001cac
lea eax, [ebp - 0xc94]
push eax
mov eax, dword [0x105430c]
push dword [eax*4 + 0x1054310]
push dword [0x1054330]
call edi
test eax, eax
jne 0x1001cac
lea eax, [ebp - 0xc94]
push eax
call dword [0x1001310]
lea eax, [ebp - 0xc94]
push eax
call dword [0x100130c]
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc94]
push eax
call dword [0x100131c]
test eax, eax
jne 0x1001bf5
push 0x1054a70
call fcn.01017f21
call fcn.010021b6
cmp eax, ebx
je 0x1001ce0
push 1
mov ecx, eax
call fcn.010189db
mov ecx, dword [0x10540ac]
call fcn.01018506
mov ecx, dword [0x10540ac]
call fcn.010180ed
call dword [sym.imp.ole32.dll_CoUninitialize]
push dword [ebp - 0xc78]
call sub.gdiplus.dll_GdiplusShutdown
call fcn.010180b5
mov ecx, dword [0x1054084]
cmp ecx, ebx
je 0x1001d1d
push 1
call fcn.01018a25
mov ecx, dword [0x1054080]
cmp ecx, ebx
je 0x1001d2e
push 1
call fcn.01018bbc
mov esi, dword [ebp - 0xc8c]
lea ecx, [ebp - 0xd2c]
mov dword [ebp - 0xd00], 0x100cf90
call fcn.0100d0d5
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001e8f
leave
ret 0x10
call dword [0x1001314]
test eax, 0xff515780
je 0x1001c48
jmp 0x10277a7
mov byte [0x1054308], 1
jmp 0x1001991
dec eax
mov byte [0x105430a], 1
mov dword [0x1054a50], eax
cmp eax, 3
jbe 0x10019dc
jmp 0x102764c
xor edi, edi
xor eax, eax
inc edi
jmp 0x100181f
xor eax, eax
jmp 0x1001885
push ebx
push 0xffffffffffffffff
push 0x3d3
push 0x3cd
push dword [ebp - 0xc5c]
call edi
mov eax, dword [0x1054a50]
push ebx
add eax, 0x2710
push eax
push 0x2713
push 0x2710
push dword [ebp - 0xc5c]
call edi
mov eax, dword [0x1054a50]
mov ecx, dword [0x1054300]
add eax, 0x2710
push eax
call fcn.0101a882
jmp 0x1001b66
push esi
call dword [0x10015d4]
mov al, byte [0x1055220]
cmp al, 4
jae 0x10275b6
cmp al, bl
jne 0x10016e1
mov eax, dword [0x1055208]
mov ecx, dword [0x105520c]
mov edx, 0x10000
mov esi, 0x80010000
and eax, edx
and ecx, esi
or eax, ecx
je 0x10016e1
mov eax, dword [0x1055210]
mov ecx, eax
and ecx, edx
mov edx, dword [0x1055214]
and edx, esi
cmp ecx, eax
jne 0x10016e1
cmp edx, dword [0x1055214]
jne 0x10016e1
push 5
push 0x10277b8
push dword [0x1054a74]
push dword [0x1054a70]
call fcn.010321fa
jmp 0x10016e1
xor eax, eax
jmp 0x1001d4b
mov dword [ebp - 0xc60], ebx
jmp 0x100193e
xor esi, esi
inc esi
push esi
push edi
push dword [ebp - 0xc60]
call fcn.0100e974
jmp 0x100195b
mov byte [0x1054309], 1
jmp 0x10019dc
mov dword [0x1054a50], ebx
jmp 0x10019dc
mov byte [0x105430b], 1
jmp 0x10019dc
mov ecx, esi
call fcn.0103223e
jmp 0x1001ab6
mov ecx, dword [0x1054084]
call fcn.01043350
mov ecx, dword [0x1054084]
call fcn.0104332f
jmp 0x1001afd
mov al, byte [0x1055220]
cmp al, 4
jae 0x102769b
cmp al, bl
jne 0x1001b43
mov eax, dword [0x1055208]
mov ecx, dword [0x105520c]
mov edx, 0x10000
and eax, edx
and ecx, 0x80010000
or eax, ecx
je 0x1001b43
mov eax, dword [0x1055210]
mov ecx, eax
and ecx, edx
mov edx, dword [0x1055214]
and edx, 0x80010000
cmp ecx, eax
jne 0x1001b43
cmp edx, dword [0x1055214]
jne 0x1001b43
push 6
push 0x10277c8
push dword [0x1054a74]
push dword [0x1054a70]
call fcn.010321fa
jmp 0x1001b43
lea ecx, [ebp - 0xd2c]
mov dword [ebp - 0xd00], 0x100cf90
call fcn.0100d0d5
jmp 0x1027619
mov cl, byte [edi]
mov byte [ebp + eax - 0x58], cl
inc eax
cmp eax, 0x52
jae 0x1001bca
jmp 0x1001bba
mov byte [ebp + eax - 0x58], bl
lea eax, [ebp + eax - 0x57]
push ebx
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [0x1054338]
mov eax, dword [eax + 8]
push dword [eax + 4]
mov ecx, esi
call fcn.01022103
mov ecx, dword [0x1054300]
push 0x93
call fcn.01004d6f
lea eax, [ebp - 0xca4]
push eax
push dword [0x1054340]
call dword [fcn.01001400]
push 2
lea eax, [ebp - 0xca4]
push eax
push dword [0x1054330]
push dword [0x1054340]
call dword [fcn.010013b8]
push ebx
lea eax, [ebp - 0xca4]
push eax
push dword [0x1054330]
call dword [fcn.01001300]
jmp 0x1001bd2
mov eax, dword [0x10540ac]
or dword [eax + 0x20], 4
jmp 0x1001c48