Function at 0x100a1f5
Capabilities:
Accept command line arguments
Check os version
Compare security identifiers
Parse pe header
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2418
call fcn.010109f0
mov eax, dword [0x1014d9c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push 0x1015519
push esi
push esi
push esi
lea eax, [ebp - 0x1a0c]
push esi
push esi
mov dword [ebp - 0x1a14], 1
mov dword [ebp - 0x1a18], eax
call fcn.01004ad4
mov eax, dword [0x10131b8]
mov word [eax], si
mov eax, dword [0x10139c8]
mov word [eax], si
lea eax, [ebp - 0x215c]
add esp, 0x20
mov dword [ebp - 0x2164], 0x104
mov dword [ebp - 0x2168], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x22
mov ebx, eax
pop ecx
cmp word [ebx], cx
jne 0x100a277
inc ebx
inc ebx
jmp 0x100a27a
push 0x20
pop ecx
movzx eax, word [ebx]
cmp ax, si
je 0x100a298
cmp ax, cx
je 0x100a291
inc ebx
inc ebx
movzx eax, word [ebx]
cmp ax, si
jne 0x100a282
cmp word [ebx], si
je 0x100a298
inc ebx
inc ebx
mov eax, dword [ebp + 8]
push 0xfffffffffffffff5
mov dword [0x10154f8], eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
mov dword [0x1015a28], eax
je 0x100a2bd
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
jne 0x100a2c3
mov dword [0x1015a28], esi
mov edi, 0x7fe
push edi
lea eax, [ebp - 0xa06]
push esi
push eax
mov dword [ebp - 0x23d8], esi
mov word [ebp - 0xa08], si
call sub.msvcrt.dll_memset
push edi
lea eax, [ebp - 0x1206]
push esi
push eax
mov word [ebp - 0x1208], si
call sub.msvcrt.dll_memset
lea eax, [ebp - 0xa08]
mov dword [ebp - 0x2394], eax
lea eax, [ebp - 0x1208]
add esp, 0x18
mov dword [ebp - 0x239c], eax
mov dword [ebp - 0x23b4], esi
mov dword [0x101550c], esi
movzx eax, word [ebx]
cmp ax, 0x20
je 0x100a32e
cmp ax, 9
jne 0x100a332
inc ebx
inc ebx
jmp 0x100a31f
movzx eax, word [ebx]
cmp ax, 0x2f
je 0x100a345
cmp ax, 0x2d
jne 0x100a4c8
lea eax, [ebx + 2]
cmp eax, esi
je 0x100a4c8
mov ax, word [eax]
or ax, 0x20
cmp ax, 0x60
jne 0x100a4c8
lea eax, [ebp - 0x2380]
add ebx, 4
push eax
mov dword [ebp - 0x2380], ebx
call fcn.010059b7
lea eax, [ebp - 0xa08]
mov dword [ebp - 0x2388], eax
lea eax, [ebp - 0x2388]
push eax
lea eax, [ebp - 0x2380]
push eax
call fcn.01005b4d
mov eax, dword [ebp - 0x2164]
add eax, eax
mov dword [ebp - 0x23b8], eax
lea eax, [ebp - 0x23a4]
push eax
mov dword [ebp - 0x23a8], esi
mov dword [ebp - 0x23a4], 0x20019
call fcn.01004818
add esp, 0x10
lea eax, [ebp - 0x23c0]
push eax
push dword [ebp - 0x23a4]
push esi
push 0x1002b90
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100a434
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x23b8]
push eax
push dword [ebp - 0x2168]
lea eax, [ebp - 0x23a8]
push eax
push esi
lea eax, [ebp - 0xa08]
push eax
push dword [ebp - 0x23c0]
call edi
mov ebx, eax
cmp ebx, 0xea
jne 0x100a481
mov eax, dword [ebp - 0x23b8]
push esi
shr eax, 1
push eax
lea ecx, [ebp - 0x2168]
call fcn.01005ea9
test al, al
jne 0x100a45b
push 0xe
pop esi
lea ecx, [ebp - 0x2168]
call fcn.01006126
lea ecx, [ebp - 0x1a18]
call fcn.01006100
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.010108f5
leave
ret
lea eax, [ebp - 0x23b8]
push eax
push dword [ebp - 0x2168]
lea eax, [ebp - 0x23a8]
push eax
push esi
lea eax, [ebp - 0xa08]
push eax
push dword [ebp - 0x23c0]
call edi
mov ebx, eax
push dword [ebp - 0x23c0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
jne 0x100a434
cmp dword [ebp - 0x23a8], 1
jne 0x100a434
mov eax, dword [ebp - 0x2168]
mov dword [ebp - 0x2380], eax
mov eax, dword [ebp - 0x2380]
movzx esi, word [eax]
cmp si, 0x20
je 0x100a4bf
cmp si, 9
jne 0x100a85e
add dword [ebp - 0x2380], 2
jmp 0x100a4a6
lea eax, [ebp - 0x238c]
push eax
push 0x7fffffff
push ebx
mov dword [ebp - 0x238c], esi
call fcn.0100639a
test eax, eax
jge 0x100a4ee
mov esi, 0x65b
jmp 0x100a434
mov eax, dword [ebp - 0x238c]
push esi
inc eax
push eax
lea ecx, [ebp - 0x2168]
call fcn.01005ea9
test al, al
je 0x100a431
mov eax, dword [ebp - 0x2168]
xor edx, edx
mov word [eax], dx
mov esi, 0x1002b88
lea edi, [ebp - 0x8c]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x1002b80
lea edi, [ebp - 0x84]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x1002b70
lea edi, [ebp - 0xac]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 8
pop ecx
movsw word es:[edi], word [esi]
mov esi, 0x1002b50
lea edi, [ebp - 0xcc]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x23a8]
push ecx
mov eax, 0x1002b40
push 0x7fffffff
push eax
mov dword [ebp - 0x7c], 0x1002b30
mov dword [ebp - 0x78], edx
mov byte [ebp - 0x74], dl
mov dword [ebp - 0x70], 0x1002b1c
mov dword [ebp - 0x6c], edx
mov byte [ebp - 0x68], dl
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], 0x1002b14
mov byte [ebp - 0x5c], 1
mov dword [ebp - 0x58], 0x1002b08
mov dword [ebp - 0x54], 0x1002b00
mov byte [ebp - 0x50], 1
mov dword [ebp - 0x4c], 0x1002af4
mov dword [ebp - 0x48], 0x1002aec
mov byte [ebp - 0x44], 1
mov dword [ebp - 0x40], 0x1002adc
mov dword [ebp - 0x3c], 0x1002ab0
mov byte [ebp - 0x38], 1
mov dword [ebp - 0x34], 0x1002a9c
mov dword [ebp - 0x30], 0x1002a70
mov byte [ebp - 0x2c], 1
mov dword [ebp - 0x28], 0x1002a54
mov dword [ebp - 0x24], 0x1002a38
mov byte [ebp - 0x20], 1
mov dword [ebp - 0x1c], 0x1002a1c
mov dword [ebp - 0x18], 0x10029fc
mov byte [ebp - 0x14], 1
mov dword [ebp - 0x10], 0x10029f4
mov dword [ebp - 0xc], 0x10029ec
mov byte [ebp - 8], 1
mov dword [ebp - 0x23a8], edx
call fcn.0100639a
test eax, eax
jl 0x100a4e4
and dword [ebp - 0x2390], 0
mov dword [ebp - 0x238c], ebx
jmp 0x100a69f
movzx eax, word [esi]
test ax, ax
je 0x100a6be
push eax
call fcn.01005315
test al, al
pop ecx
je 0x100a69f
mov edi, dword [ebp - 0x2390]
lea eax, [edi - 1]
cmp eax, 1
jne 0x100a671
push 0xffffffffffffffff
push 0x10029e8
lea eax, [edi - 1]
push eax
lea eax, [esi + 2]
push eax
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x100a6ea
lea eax, [edi - 1]
cmp dword [ebp - 0x23a8], eax
jne 0x100a69f
push dword [ebp - 0x23a8]
dec edi
push 0x1002b40
push edi
add esi, 2
push esi
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x100a6ea
lea eax, [ebp - 0x2390]
push eax
lea eax, [ebp - 0x238c]
push eax
call fcn.01005335
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x100a62b
lea eax, [ebp - 0x84]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x74], 1
lea eax, [ebp - 0x8c]
mov byte [ebp - 0x68], 1
and dword [ebp - 0x2390], 0
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x238c], ebx
jmp 0x100a786
lea eax, [ebp - 0xac]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x74], 0
lea eax, [ebp - 0xcc]
mov byte [ebp - 0x68], 0
jmp 0x100a6d5
movzx eax, word [edi]
test ax, ax
je 0x100a7a5
push eax
call fcn.01005315
test al, al
pop ecx
je 0x100a75c
mov ebx, dword [ebp - 0x2390]
and dword [ebp - 0x2388], 0
dec ebx
lea esi, [ebp - 0x7c]
push 0xffffffffffffffff
push dword [esi]
lea eax, [edi + 2]
push ebx
push eax
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x100a7dc
inc dword [ebp - 0x2388]
add esi, 0xc
cmp dword [ebp - 0x2388], 0xa
jb 0x100a72b
push 1
push dword [ebp - 0x2390]
lea eax, [ebp - 0x2168]
push edi
push eax
mov dword [ebp - 0x2160], 0x104
call fcn.01007691
add esp, 0x10
test eax, eax
jne 0x100a80d
lea eax, [ebp - 0x2390]
push eax
lea eax, [ebp - 0x238c]
push eax
call fcn.01005335
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x100a703
mov esi, dword [ebp - 0x2168]
and dword [ebp - 0x238c], 0
lea eax, [ebp - 0x238c]
push eax
push 0x7fffffff
push esi
call fcn.0100639a
test eax, eax
jl 0x100a4e4
mov eax, dword [ebp - 0x238c]
test eax, eax
jbe 0x100a830
lea esi, [esi + eax*2 - 2]
jmp 0x100a822
mov eax, dword [ebp - 0x2388]
imul eax, eax, 0xc
movzx ecx, byte [ebp + eax - 0x74]
push ecx
push dword [ebp + eax - 0x78]
lea eax, [ebp - 0x2168]
push eax
mov dword [ebp - 0x2160], 0x104
call fcn.01007748
add esp, 0xc
jmp 0x100a77e
mov esi, eax
jmp 0x100a434
cmp esi, dword [ebp - 0x2168]
jb 0x100a830
and word [esi], 0
dec esi
dec esi
movzx eax, word [esi]
push eax
call fcn.010052f5
test al, al
pop ecx
jne 0x100a814
mov eax, dword [ebp - 0x2168]
mov dword [ebp - 0x2380], eax
jmp 0x100a856
push esi
call fcn.010052f5
test al, al
pop ecx
je 0x100a85e
add dword [ebp - 0x2380], 2
mov eax, dword [ebp - 0x2380]
movzx esi, word [eax]
test si, si
jne 0x100a83e
and dword [ebp - 0x2398], 0
test si, si
je 0x100ac0d
mov edi, 0x104
cmp si, 0x2f
je 0x100a8ee
cmp si, 0x2d
je 0x100a8ee
lea ecx, [ebp - 0x237c]
call fcn.01005fbb
lea eax, [ebp - 0x237c]
push eax
lea eax, [ebp - 0x2380]
push eax
mov dword [ebp - 0x2374], edi
call fcn.0100932c
test eax, eax
pop ecx
pop ecx
je 0x100aca4
push dword [ebp - 0x237c]
lea eax, [ebp - 0x1208]
push eax
call fcn.010082fc
lea eax, [ebp - 0x2380]
push eax
call fcn.010059b7
add esp, 0xc
cmp dword [ebp - 0x2378], edi
movzx esi, ax
jle 0x100ac04
push dword [ebp - 0x237c]
call fcn.01005859
pop ecx
jmp 0x100ac04
mov eax, dword [ebp - 0x2380]
inc eax
inc eax
movzx esi, word [eax]
push eax
or esi, 0x20
call fcn.0100486a
pop ecx
mov ecx, eax
push 0x52
mov dword [ebp - 0x2380], ecx
mov edi, 0x1001710
pop eax
movzx eax, ax
or eax, 0x20
cmp eax, esi
je 0x100a927
inc edi
inc edi
movzx eax, word [edi]
test ax, ax
jne 0x100a913
movzx esi, word [edi]
test si, si
je 0x100ab7d
movzx eax, word [ecx]
cmp ax, 0x20
je 0x100a94c
test ax, ax
je 0x100a94c
cmp ax, 9
je 0x100a94c
xor ebx, ebx
inc ebx
jmp 0x100a94e
xor ebx, ebx
lea eax, [ebp - 0x2380]
push eax
call fcn.010059b7
cmp si, 0x63
lea eax, [ebp - 0xa08]
pop ecx
mov dword [ebp - 0x2388], eax
jne 0x100a975
test ebx, ebx
jne 0x100ab7d
cmp si, 0x50
jne 0x100aa34
push 0
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0xa
push eax
lea ecx, [ebp - 0x1a18]
call fcn.01005cea
test al, al
je 0x100a9e0
mov eax, dword [ebp - 0x1a18]
mov dword [ebp - 0x23a4], eax
lea eax, [ebp - 0x23a4]
push eax
lea eax, [ebp - 0x2380]
push eax
call fcn.01005b4d
mov eax, dword [ebp - 0x23a4]
and word [eax], 0
mov edx, dword [ebp - 0x1a14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1a18]
inc eax
inc eax
lea ecx, [ecx + edx*2]
cmp ecx, eax
ja 0x100aa59
mov dword [ebp - 0x2398], 0xe
call fcn.01005bdc
cmp dword [ebp - 0x2398], 0
jne 0x100acf3
cmp dword [0x1015a2c], 0
jne 0x100ad76
call fcn.01009bd0
mov esi, 0x667
mov dword [ebp - 0x2398], esi
xor edi, edi
cmp esi, edi
jne 0x100acf3
cmp dword [ebp - 0x23b4], edi
jne 0x100ad84
jmp 0x100ad78
cmp si, 0x71
je 0x100aa40
cmp si, 0x63
jne 0x100aa44
test ebx, ebx
je 0x100aa59
lea eax, [ebp - 0x2388]
push eax
lea eax, [ebp - 0x2380]
push eax
call fcn.01005b4d
pop ecx
pop ecx
lea eax, [ebp - 0x2380]
push eax
call fcn.010059b7
movzx esi, ax
mov eax, dword [ebp - 0x2388]
and word [eax], 0
movzx eax, word [edi]
cmp ax, 0x46
pop ecx
je 0x100aa8e
cmp ax, 0x71
je 0x100aa8e
cmp ax, 0x4a
je 0x100aa8e
cmp ax, 0x6c
jne 0x100aaeb
test ebx, ebx
je 0x100aaeb
cmp ax, 0x71
lea ecx, [ebp - 0x1208]
mov dword [ebp - 0x2388], ecx
lea ecx, [ebp - 0xa08]
mov dword [ebp - 0x239c], ecx
lea ecx, [ebp - 0x1208]
mov dword [ebp - 0x2394], ecx
je 0x100aaeb
lea eax, [ebp - 0x2388]
push eax
lea eax, [ebp - 0x2380]
push eax
call fcn.01005b4d
lea eax, [ebp - 0x2380]
push eax
call fcn.010059b7
movzx esi, ax
mov eax, dword [ebp - 0x2388]
add esp, 0xc
and word [eax], 0
movzx ecx, word [edi]
cmp cx, 0x61
jb 0x100ab17
cmp cx, 0x7a
ja 0x100ab17
push dword [ebp - 0x2394]
sub edi, 0x1001710
push dword [ebp - 0x239c]
sar edi, 1
call dword [edi*4 + 0x1013158]
jmp 0x100ab77
mov eax, dword [0x1015a2c]
test eax, eax
je 0x100ab91
cmp cx, 0x50
jne 0x100ab5e
cmp word [eax], 0x41
jne 0x100ab5e
lea eax, [ebp - 0x1a08]
push eax
push 0x41
call fcn.01007933
test eax, eax
pop ecx
pop ecx
jne 0x100ab7d
push 0x1e
push dword [ebp - 0x239c]
lea eax, [ebp - 0x108]
push 0x1e
push eax
mov dword [0x1015a2c], edi
call fcn.0100624b
jmp 0x100abd7
cmp word [eax], 0x50
jne 0x100ab7d
cmp cx, 0x41
jne 0x100ab7d
push dword [ebp - 0x2394]
push 0x41
call fcn.01007933
test eax, eax
pop ecx
pop ecx
je 0x100abd7
call fcn.01009bd0
mov dword [ebp - 0x2398], 0x667
jmp 0x100a9ea
cmp cx, 0x50
mov dword [0x1015a2c], edi
je 0x100abb6
mov eax, 0x400
push eax
push dword [ebp - 0x2394]
push eax
lea eax, [ebp - 0x1a08]
push eax
call fcn.0100624b
push 0x1e
push dword [ebp - 0x239c]
lea eax, [ebp - 0x108]
push 0x1e
push eax
call fcn.0100624b
mov eax, dword [0x1015a2c]
cmp word [eax], 0x45
je 0x100ac0d
and word [ebp - 0xa08], 0
and word [ebp - 0x1208], 0
lea eax, [ebp - 0xa08]
mov dword [ebp - 0x2394], eax
lea eax, [ebp - 0x1208]
mov dword [ebp - 0x239c], eax
mov edi, 0x104
test si, si
jne 0x100a873
mov eax, dword [0x1015a2c]
xor edi, edi
cmp eax, edi
je 0x100a9ea
movzx eax, word [eax]
cmp ax, 0x45
je 0x100ac36
cmp ax, 0x59
je 0x100ac36
cmp ax, 0x5a
je 0x100ac36
call fcn.01005bdc
mov ecx, dword [0x1015a2c]
cmp word [ecx], 0x50
mov eax, dword [ebp - 0x1a18]
je 0x100ac4e
lea eax, [ebp - 0x1a08]
push eax
sub ecx, 0x1001710
lea eax, [ebp - 0x108]
sar ecx, 1
push eax
call dword [ecx*4 + 0x1013158]
mov esi, eax
mov eax, dword [0x1015a2c]
movzx eax, word [eax]
cmp ax, 0x59
pop ecx
pop ecx
mov dword [ebp - 0x2398], esi
je 0x100a434
cmp ax, 0x5a
je 0x100a434
cmp esi, edi
jne 0x100acdf
cmp ax, 0x45
jne 0x100acd0
mov dword [0x101550c], 1
jmp 0x100aa1b
call fcn.01009bd0
cmp dword [ebp - 0x2378], edi
mov dword [ebp - 0x2398], 0x667
jle 0x100a9ea
push dword [ebp - 0x237c]
call fcn.01005859
pop ecx
jmp 0x100a9ea
mov dword [ebp - 0x23b4], 1
jmp 0x100aa1b
cmp esi, 0x8000
jne 0x100acfe
mov dword [0x101550c], edi
mov dword [ebp - 0x2398], edi
mov esi, dword [ebp - 0x2398]
jmp 0x100a434
cmp ax, 0x52
je 0x100ad6a
cmp ax, 0x55
je 0x100ad6a
mov eax, 0x4eb
cmp esi, eax
jg 0x100ad3e
je 0x100aa1b
cmp esi, 0xfffffffe
jl 0x100ad6a
cmp esi, edi
jl 0x100acf3
cmp esi, 1
jle 0x100ad6a
cmp esi, 3
jle 0x100ad31
cmp esi, 0x7b
jne 0x100ad6a
mov esi, 0x653
mov dword [ebp - 0x2398], esi
jmp 0x100ad6a
cmp esi, 0x642
jl 0x100ad6a
cmp esi, 0x644
jle 0x100aa1b
cmp esi, 0x669
je 0x100aa1b
cmp esi, 0xbc2
je 0x100aa1b
push esi
call fcn.010090ec
pop ecx
jmp 0x100aa1b
xor edi, edi
cmp dword [0x101550c], edi
je 0x100acf3
cmp dword [0x101550c], edi
push edi
je 0x100ad96
push edi
call dword [0x10141f0]
jmp 0x100ada7
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x10029cc
call fcn.0100cba2
pop ecx
cmp dword [ebp - 0x23b4], edi
je 0x100adf7
cmp dword [0x101550c], edi
jne 0x100ae06
xor ebx, ebx
xor esi, esi
mov edi, 0x1001638
inc ebx
lea eax, [esi + 0x10154a0]
push eax
push ebx
push 4
lea eax, [esi + 0x1015a68]
push eax
push edi
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
test eax, eax
jne 0x100adef
add edi, 0x10
add esi, 4
cmp edi, 0x1001648
jl 0x100adc1
xor edi, edi
jmp 0x100adfa
mov dword [ebp - 0x23d8], ebx
jmp 0x100adeb
xor ebx, ebx
inc ebx
cmp dword [0x101550c], edi
je 0x100b88a
mov esi, dword [ebp - 0x2380]
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x9c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movzx eax, word [esi]
cmp ax, 0x30
jb 0x100ae44
cmp ax, 0x39
ja 0x100ae44
mov ecx, ebx
and ecx, 0x80000001
jns 0x100ae38
dec ecx
or ecx, 0xfffffffe
inc ecx
neg ecx
movzx eax, ax
sbb ecx, ecx
sub eax, 0x30
jmp 0x100ae69
cmp ax, 0x41
jb 0x100ae90
cmp ax, 0x46
ja 0x100ae90
mov ecx, ebx
and ecx, 0x80000001
jns 0x100ae5f
dec ecx
or ecx, 0xfffffffe
inc ecx
neg ecx
movzx eax, ax
sbb ecx, ecx
sub eax, 0x37
and ecx, 0xfffffff1
add ecx, 0x10
imul ecx, eax
cmp ebx, 0x20
jge 0x100b880
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
lea eax, [ebp + eax - 0x9c]
or byte [eax], cl
inc ebx
inc esi
inc esi
jmp 0x100ae1a
cmp ebx, 0x20
jne 0x100b880
cmp word [esi], 0
mov byte [ebp - 0x23ac], 0
mov byte [ebp - 0x239d], 0
mov byte [ebp - 0x2381], 0
mov byte [ebp - 0x23c8], 0
je 0x100aebd
inc esi
inc esi
movzx eax, word [esi]
cmp ax, 0x43
jne 0x100afc9
mov byte [ebp - 0x23ac], 1
xor ebx, ebx
or dword [ebp - 0x2380], 0xffffffff
lea eax, [ebp - 0x2380]
push eax
push 1
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x100af10
or dword [ebp - 0x2380], 0xffffffff
call edi
cmp eax, 0x3f0
jne 0x100b880
cmp byte [ebp - 0x239d], 0
jne 0x100af1f
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, 0x80000001
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp byte [ebp - 0x239d], 0
je 0x100af44
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea eax, [ebp - 0x23d4]
push eax
xor esi, esi
push 8
mov dword [ebp - 0x238c], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100b057
lea eax, [ebp - 0x23b0]
push eax
call fcn.01004d4d
test eax, eax
pop ecx
jne 0x100afb8
lea eax, [ebp - 0x2418]
push eax
push 0x50
lea eax, [ebp - 0x54]
push eax
push 1
push dword [ebp - 0x23d4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x100afb8
push dword [ebp - 0x23b0]
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esi, eax
neg esi
sbb esi, esi
and esi, 2
mov dword [ebp - 0x238c], esi
push dword [ebp - 0x23d4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100b08e
cmp ax, 0x55
jne 0x100afe2
mov byte [ebp - 0x23ac], 1
mov byte [ebp - 0x2381], 1
jmp 0x100aed1
cmp ax, 0x41
jne 0x100aff4
mov byte [ebp - 0x23c8], 1
jmp 0x100aed1
cmp ax, 0x4d
je 0x100b006
cmp ax, 0x45
jne 0x100aed1
jmp 0x100b00d
mov byte [ebp - 0x239d], 1
add esi, 4
push esi
xor ebx, ebx
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
cmp esi, ebx
je 0x100b86d
cmp esi, 0xffffffff
je 0x100b86d
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x100aed3
push edi
push 0x1002960
jmp 0x100b879
call edi
push 0x206
mov edi, eax
lea eax, [ebp - 0x236e]
push ebx
push eax
mov word [ebp - 0x2370], bx
call sub.msvcrt.dll_memset
push edi
push 0x1002920
lea eax, [ebp - 0x2370]
push 0x104
push eax
call fcn.01006339
add esp, 0x1c
cmp byte [ebp - 0x2381], 0
je 0x100b0ad
cmp esi, 1
jne 0x100b0a0
push 7
jmp 0x100b0a6
cmp esi, ebx
jne 0x100b0c2
push 6
pop esi
mov dword [ebp - 0x238c], esi
cmp byte [ebp - 0x23c8], 0
push 5
pop eax
je 0x100b0de
cmp esi, ebx
jne 0x100b0cd
push 4
pop esi
jmp 0x100b0d8
push ebx
push 0x1002858
jmp 0x100b879
cmp esi, 1
jne 0x100b880
mov esi, eax
mov dword [ebp - 0x238c], esi
cmp esi, ebx
mov edi, 0x100
mov dword [ebp - 0x23e0], edi
je 0x100b105
cmp esi, 1
je 0x100b105
cmp esi, 4
je 0x100b105
cmp esi, eax
je 0x100b105
cmp esi, 6
je 0x100b105
cmp esi, 7
jne 0x100b108
push 4
pop eax
push ebx
push eax
lea eax, [ebp - 0x23e0]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.010063fe
mov esi, eax
add esp, 0x10
cmp esi, ebx
je 0x100b144
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100a434
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100a434
mov eax, dword [ebp - 0x23e0]
push eax
lea ecx, [ebp - 0x1b24]
mov dword [ebp - 0x23ec], eax
mov dword [ebp - 0x23dc], eax
mov dword [ebp - 0x23d0], eax
mov dword [ebp - 0x23e4], eax
mov dword [ebp - 0x23e8], eax
call fcn.01005fe7
push dword [ebp - 0x23dc]
lea ecx, [ebp - 0x1c30]
call fcn.01005fe7
push dword [ebp - 0x23d0]
lea ecx, [ebp - 0x1e48]
call fcn.01005fe7
push dword [ebp - 0x23e4]
lea ecx, [ebp - 0x1f54]
call fcn.01005fe7
push dword [ebp - 0x23e8]
lea ecx, [ebp - 0x1d3c]
call fcn.01005fe7
lea eax, [ebp - 0x23e8]
push eax
push dword [ebp - 0x1d3c]
lea eax, [ebp - 0x23e4]
push eax
push dword [ebp - 0x1f54]
lea eax, [ebp - 0x23d0]
push eax
push dword [ebp - 0x1e48]
lea eax, [ebp - 0x23dc]
push eax
push dword [ebp - 0x1c30]
lea eax, [ebp - 0x23ec]
push eax
push dword [ebp - 0x1b24]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
test eax, eax
jne 0x100b298
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x2380], 0xffffffff
mov esi, eax
je 0x100b22b
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1d38], edi
jle 0x100b23f
push dword [ebp - 0x1d3c]
call fcn.01005859
pop ecx
cmp dword [ebp - 0x1f50], edi
jle 0x100b253
push dword [ebp - 0x1f54]
call fcn.01005859
pop ecx
cmp dword [ebp - 0x1e44], edi
jle 0x100b267
push dword [ebp - 0x1e48]
call fcn.01005859
pop ecx
cmp dword [ebp - 0x1c2c], edi
jle 0x100b27b
push dword [ebp - 0x1c30]
call fcn.01005859
pop ecx
cmp dword [ebp - 0x1b20], edi
jle 0x100a434
push dword [ebp - 0x1b24]
call fcn.01005859
pop ecx
jmp 0x100a434
push ebx
push ebx
push ebx
push 2
push 3
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x1b24]
call dword [0x1014224]
mov esi, eax
cmp esi, ebx
je 0x100b347
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100b2ce
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x10027f8
call fcn.01008f7e
pop ecx
pop ecx
cmp dword [ebp - 0x1d38], edi
jle 0x100b2ef
push dword [ebp - 0x1d3c]
call fcn.01005859
pop ecx
cmp dword [ebp - 0x1f50], edi
jle 0x100b303
push dword [ebp - 0x1f54]
call fcn.01005859
pop ecx
cmp dword [ebp - 0x1e44], edi
jle 0x100b317
push dword [ebp - 0x1e48]
call fcn.01005859
pop ecx
cmp dword [ebp - 0x1c2c], edi
jle 0x100b32b
push dword [ebp - 0x1c30]
call fcn.01005859
pop ecx
cmp dword [ebp - 0x1b20], edi
jle 0x100b880
push dword [ebp - 0x1b24]
call fcn.01005859
jmp 0x100b87f
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push 1
push ebx
call esi
cmp eax, ebx
mov dword [ebp - 0x23a4], eax
jne 0x100b37c
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100b2db
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100b2db
push ebx
push ebx
push ebx
push ebx
call esi
cmp eax, ebx
mov dword [ebp - 0x23c4], eax
je 0x100b35e
xor esi, esi
mov dword [ebp - 0x2388], esi
mov dword [ebp - 0x2390], esi
mov dword [ebp - 0x2394], esi
call fcn.01009444
mov ebx, eax
cmp ebx, esi
jne 0x100b3f6
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100b3c0
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x1002798
call fcn.01008f7e
mov eax, dword [ebp - 0x2394]
cmp eax, esi
pop ecx
pop ecx
je 0x100b3dd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2390]
cmp eax, esi
je 0x100b2db
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x100b2db
mov dword [ebp - 0x23bc], esi
mov dword [ebp - 0x23b0], esi
call fcn.0100502e
mov esi, eax
test esi, esi
jne 0x100b442
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100b422
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov eax, dword [ebp - 0x2394]
test eax, eax
je 0x100b438
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2390]
test eax, eax
jmp 0x100b3e5
mov eax, dword [esi]
lea ecx, [ebp - 0x2390]
mov dword [ebp - 0x239c], eax
call fcn.01005d5e
push eax
mov eax, dword [ebp - 0x239c]
push 0x1001688
push esi
call dword [eax]
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, dword [ebp - 0x238c]
mov dword [ebp - 0x23cc], eax
mov eax, dword [ebp - 0x2390]
mov esi, dword [ebx]
mov dword [ebp - 0x239c], eax
lea eax, [ebp - 0x23b0]
push eax
lea ecx, [ebp - 0x2394]
add esi, 0x38
call fcn.01005d5e
push eax
lea eax, [ebp - 0x23bc]
push eax
push dword [ebp - 0x239c]
lea eax, [ebp - 0x9c]
push 0x10
push eax
lea eax, [ebp - 0x23cc]
push eax
push ebx
call dword [esi]
test eax, eax
je 0x100b4e6
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100b4d3
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x1002728
call fcn.01008f7e
pop ecx
pop ecx
jmp 0x100b422
push dword [ebp - 0x23bc]
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [ebp - 0x239c], eax
jne 0x100b526
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100b518
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10026b8
jmp 0x100b4da
push dword [ebp - 0x2394]
call dword [0x1014240]
test eax, eax
je 0x100b40d
mov eax, dword [ebp - 0x2390]
mov ecx, dword [eax]
lea edx, [ebp - 0x2388]
push edx
push 0x10016c8
push eax
call dword [ecx]
mov eax, dword [ebp - 0x238c]
xor ecx, ecx
cmp eax, dword [ebp - 0x23cc]
jne 0x100b56b
cmp eax, 6
je 0x100b56b
cmp eax, 7
jne 0x100b571
lea ecx, [ebp - 0x23cc]
mov eax, dword [ebp - 0x2388]
mov edx, dword [eax]
lea esi, [ebp - 0x9c]
push esi
push ecx
push eax
call dword [edx + 0xa0]
mov eax, dword [ebp - 0x2388]
push dword [ebp - 0x23a4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xa8]
mov eax, dword [ebp - 0x2388]
mov esi, dword [ebp - 0x23c4]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0xac]
push dword [ebp - 0x2380]
mov eax, dword [ebp - 0x2388]
push dword [ebp - 0x23b0]
mov ecx, dword [eax]
push dword [ebp - 0x23c8]
push dword [ebp - 0x23ac]
push dword [ebp - 0x23bc]
push eax
call dword [ecx + 0xa4]
cmp dword [ebp - 0x2380], 0xffffffff
mov dword [ebp - 0x23c4], eax
je 0x100b602
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x2380], 0xffffffff
cmp dword [ebp - 0x23c4], 0
je 0x100b617
push 0
push 0x1002658
jmp 0x100b4da
mov eax, dword [ebp - 0x2388]
push dword [ebp - 0x2394]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x9c]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov eax, dword [ebp - 0x2394]
test eax, eax
je 0x100b642
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2390]
test eax, eax
je 0x100b652
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x239c]
mov ebx, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 3
pop eax
mov dword [ebp - 0x23f0], esi
mov esi, 0x4ff
push esi
mov dword [ebp - 0x23f8], ecx
mov ecx, dword [ebp - 0x23a4]
push 0xffffffffffffffff
mov dword [ebp - 0x23f4], ecx
push 0
lea ecx, [ebp - 0x23f8]
push ecx
mov dword [0x1015504], eax
mov byte [ebp - 0x2381], 0
push eax
jmp 0x100b827
cmp eax, 1
je 0x100b836
cmp eax, 2
jne 0x100b6ff
push dword [ebp - 0x239c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2388]
and dword [ebp - 0x23ac], 0
mov ecx, dword [eax]
lea edx, [ebp - 0x23ac]
push edx
push eax
call dword [ecx + 0xb0]
push dword [ebp - 0x23ac]
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [ebp - 0x239c], eax
je 0x100b847
mov dword [ebp - 0x23f8], eax
jmp 0x100b819
cmp eax, 3
je 0x100b7eb
mov eax, dword [ebp - 0x2388]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x239c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1d38], edi
jle 0x100b734
push dword [ebp - 0x1d3c]
call fcn.01005859
pop ecx
cmp dword [ebp - 0x1f50], edi
jle 0x100b748
push dword [ebp - 0x1f54]
call fcn.01005859
pop ecx
cmp dword [ebp - 0x1e44], edi
jle 0x100b75c
push dword [ebp - 0x1e48]
call fcn.01005859
pop ecx
cmp dword [ebp - 0x1c2c], edi
jle 0x100b770
push dword [ebp - 0x1c30]
call fcn.01005859
pop ecx
cmp dword [ebp - 0x1b20], edi
jle 0x100b784
push dword [ebp - 0x1b24]
call fcn.01005859
pop ecx
xor esi, esi
cmp dword [ebp - 0x23b4], esi
je 0x100b7a6
cmp dword [0x101550c], esi
jne 0x100b7a6
mov eax, dword [0x10154a0]
cmp eax, esi
je 0x100b7a6
push eax
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [ebp - 0x23d8], esi
je 0x100acf3
mov esi, 0x641
push esi
call fcn.010090ec
jmp 0x100b292
cmp dword [ebp - 0x2410], 0x12
je 0x100b805
lea eax, [ebp - 0x2414]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2414]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x2414]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x100b7c8
jmp 0x100b80c
mov byte [ebp - 0x2381], 1
cmp byte [ebp - 0x2381], 0
jne 0x100b708
push esi
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x23f8]
push eax
push 3
call ebx
test eax, eax
jne 0x100b69c
jmp 0x100b708
push dword [ebp - 0x23a4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100b708
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100b85c
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10026b8
jmp 0x100b2d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10025f0
call fcn.01008f7e
pop ecx
pop ecx
mov esi, 0x641
jmp 0x100a434
mov dword [0x1015504], ebx
push edi
push edi
push edi
lea eax, [ebp - 0x2414]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x100b8bc
cmp dword [0x1015524], edi
je 0x100b784
cmp dword [0x10154fc], edi
je 0x100b784
lea eax, [ebp - 0x2414]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2414]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x100b890