Function at 0x10053690
Capabilities:
Create process on windows
Get geographical location
Get session user name
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x6878
call fcn.1001a2d0
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
lea ecx, [ebp - 0xc]
call fcn.10001af0
lea ecx, [ebp - 0x5338]
call fcn.10001af0
lea ecx, [ebp - 8]
call fcn.10001af0
mov dword [ebp - 0x5170], 0
mov dword [ebp - 0x3154], 0
xor eax, eax
mov dword [ebp - 0x3150], eax
mov dword [ebp - 0x314c], eax
mov dword [ebp - 0x3148], eax
mov dword [ebp - 0x3144], eax
mov dword [ebp - 0x3140], eax
mov dword [ebp - 0x313c], eax
mov dword [ebp - 0x3138], eax
mov dword [ebp - 0x3134], eax
mov byte [ebp - 0x30a2], 0
mov byte [ebp - 0x5195], 0
call fcn.1003b3c0
movzx ecx, al
test ecx, ecx
je 0x1005374c
call sym.RtlLib.dll_RT_ACM_SoftAP_GetStatus
mov dword [ebp - 0x6330], eax
cmp dword [ebp - 0x6330], 2
jne 0x1005373f
mov byte [ebp - 0x5195], 1
call sym.RtlLib.dll_RT_AP_GetIsAPMode
mov byte [ebp - 0x30a2], al
jmp 0x1005375a
mov byte [ebp - 0x30a2], 0
mov byte [ebp - 0x5195], 0
mov dword [ebp - 0x533c], 0
push 4
lea edx, [ebp - 0x533c]
push edx
push 0x20001004
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x5164], eax
lea ecx, [ebp - 0x632c]
call fcn.10001af0
mov dword [ebp - 0x516c], 0
mov eax, dword [ebp + 8]
add eax, 0x32
push eax
lea ecx, [ebp - 0x632c]
call fcn.10003530
lea ecx, [ebp - 0x632c]
call fcn.10001330
mov dword [ebp - 0x516c], eax
push 0
push 0
mov ecx, dword [ebp - 0x516c]
push ecx
lea ecx, [ebp - 0x632c]
call fcn.10001ae0
push eax
push 0
mov edx, dword [ebp - 0x533c]
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x5168], eax
mov eax, dword [ebp - 0x5168]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10004590
add esp, 4
mov dword [ebp - 0x6868], eax
mov eax, dword [ebp - 0x6868]
mov dword [ebp - 0x309c], eax
mov ecx, dword [ebp - 0x5168]
lea edx, [ecx + ecx + 2]
push edx
push 0
mov eax, dword [ebp - 0x309c]
push eax
call fcn.100139b0
add esp, 0xc
mov ecx, dword [ebp - 0x5168]
push ecx
mov edx, dword [ebp - 0x309c]
push edx
push 0xffffffffffffffff
lea ecx, [ebp - 0x632c]
call fcn.10001ae0
push eax
push 0
mov eax, dword [ebp - 0x533c]
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x41
push 0
lea ecx, [ebp - 0x6328]
push ecx
call fcn.100139b0
add esp, 0xc
push 0x7d0
lea ecx, [ebp - 0xc]
call fcn.100015a0
push 0xc8
lea ecx, [ebp - 0x5338]
call fcn.100015a0
push 0x7d0
lea ecx, [ebp - 8]
call fcn.100015a0
movzx edx, byte [ebp - 0x5195]
test edx, edx
je 0x100538e0
push 0x10079ce0
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10079d50
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10079d58
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.HOSTED_NETWORK_PROFILE
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10053910
push str.__xml_version_1.0__encoding_UTF_8____WLANProfile_xmlns_http:__www.microsoft.com_networking_WLAN_profile_v1__
lea ecx, [ebp - 0x5338]
call fcn.10003530
push str._name_
lea ecx, [ebp - 0x5338]
call fcn.10003530
push 0x10079df8
lea ecx, [ebp - 0x5338]
call fcn.10003530
push 0x10079e04
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__name_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._SSIDConfig_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._SSID_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._hex_
lea ecx, [ebp - 0xc]
call fcn.10003530
mov dword [ebp - 0x30a0], 0
jmp 0x1005396c
mov eax, dword [ebp - 0x30a0]
add eax, 1
mov dword [ebp - 0x30a0], eax
mov ecx, dword [ebp + 8]
add ecx, 0x32
push ecx
call fcn.10013a30
add esp, 4
cmp dword [ebp - 0x30a0], eax
jae 0x100539eb
push 4
push 0
lea edx, [ebp - 0x5160]
push edx
call fcn.100139b0
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x30a0]
mov cl, byte [eax + 0x32]
mov byte [ebp - 0x30a1], cl
movsx edx, byte [ebp - 0x30a1]
and edx, 0xff
mov dword [ebp - 0x515c], edx
mov eax, dword [ebp - 0x515c]
push eax
push 0x10079e30
lea ecx, [ebp - 0x5160]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x5160]
push edx
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x1005395d
push str.__hex_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__SSID_
lea ecx, [ebp - 0xc]
call fcn.10003530
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5c]
shr ecx, 3
and ecx, 1
je 0x10053a22
push str._nonBroadcast_true__nonBroadcast_
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10053a2f
push str._nonBroadcast_false__nonBroadcast_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__SSIDConfig_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._connectionType_
lea ecx, [ebp - 0xc]
call fcn.10003530
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
shr eax, 3
and eax, 1
je 0x10053a66
push 0x10079eb0
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10053a73
push str.IBSS
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__connectionType_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._connectionMode_
lea ecx, [ebp - 0xc]
call fcn.10003530
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 3
and edx, 1
je 0x10053aaa
push str.auto
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10053ab7
push str.manual
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__connectionMode_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._autoSwitch_
lea ecx, [ebp - 0xc]
call fcn.10003530
movzx eax, byte [ebp - 0x5195]
test eax, eax
je 0x10053aeb
push 0x10079f18
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10053af8
push 0x10079f20
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__autoSwitch_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._MSM_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._security_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._authEncryption_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._authentication_
lea ecx, [ebp - 0xc]
call fcn.10003530
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 4
and edx, 1
je 0x10053ba4
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5c]
shr ecx, 5
and ecx, 7
jne 0x10053b64
push 0x10079f74
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10053ba2
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
shr eax, 5
and eax, 7
cmp eax, 1
jne 0x10053b84
push str.WPA2
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10053ba2
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 5
and edx, 7
cmp edx, 2
jne 0x10053ba2
push 0x10079f80
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10053c0e
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5c]
shr ecx, 1
and ecx, 3
cmp ecx, 3
jne 0x10053bc3
push str.WPA2PSK
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10053c0e
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
shr eax, 1
and eax, 3
cmp eax, 2
jne 0x10053be2
push str.WPAPSK
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10053c0e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 1
and edx, 3
cmp edx, 1
jne 0x10053c01
push str.shared
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10053c0e
push str.open
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__authentication_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._encryption_
lea ecx, [ebp - 0xc]
call fcn.10003530
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5c]
shr ecx, 0xa
and ecx, 3
cmp ecx, 3
jne 0x10053c48
push 0x10079fcc
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10053c95
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
shr eax, 0xa
and eax, 3
cmp eax, 2
jne 0x10053c68
push str.TKIP
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10053c95
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 1
jne 0x10053c88
push 0x10079fd8
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10053c95
push str.none
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__encryption_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._useOneX_
lea ecx, [ebp - 0xc]
call fcn.10003530
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5c]
shr ecx, 4
and ecx, 1
je 0x10053ccc
push str.true
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10053cd9
push str.false
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__useOneX_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__authEncryption_
lea ecx, [ebp - 0xc]
call fcn.10003530
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
shr eax, 4
and eax, 1
je 0x10053e41
push str._OneX_xmlns_http:__www.microsoft.com_networking_OneX_v1__
lea ecx, [ebp - 0xc]
call fcn.10003530
call fcn.1003b3c0
movzx ecx, al
test ecx, ecx
je 0x10053d38
push str._cacheUserData_true__cacheUserData_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._authMode_machineOrUser__authMode_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._EAPConfig_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._EapHostConfig_xmlns_http:__www.microsoft.com_provisioning_EapHostConfig__
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._EapMethod_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._Type_xmlns_http:__www.microsoft.com_provisioning_EapCommon__
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x1007a158
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__Type_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._VendorId_xmlns_http:__www.microsoft.com_provisioning_EapCommon__
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x1007a164
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__VendorId_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._VendorType_xmlns_http:__www.microsoft.com_provisioning_EapCommon__
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x1007a200
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__VendorType_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._AuthorId_xmlns_http:__www.microsoft.com_provisioning_EapCommon__
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x1007a25c
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__AuthorId_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__EapMethod_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._ConfigBlob___ConfigBlob_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__EapHostConfig_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__EAPConfig_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__OneX_
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10054033
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
and eax, 1
je 0x10054033
push str._sharedKey_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._keyType_
lea ecx, [ebp - 0xc]
call fcn.10003530
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 1
jne 0x10053e8a
push 0x1007a2dc
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10053eb2
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1bc], 0x40
jne 0x10053ea5
push str.networkKey
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10053eb2
push str.passPhrase
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__keyType_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._protected_false__protected_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str._keyMaterial_
lea ecx, [ebp - 0xc]
call fcn.10003530
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 1
jne 0x10053f56
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x62]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 0x64]
mov dword [ebp - 0x6334], eax
push 0x1e
push 0
lea ecx, [ebp - 0x5190]
push ecx
call fcn.100139b0
add esp, 0xc
push 1
mov edx, dword [ebp - 0x6334]
shl edx, 1
push edx
lea eax, [ebp - 0x5190]
push eax
mov ecx, dword [ebp - 0x6334]
push ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x62]
shl eax, 4
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x6c]
push edx
call fcn.10064bd0
add esp, 0x14
lea eax, [ebp - 0x5190]
push eax
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10053f82
push str.___CDATA_
lea ecx, [ebp - 0xc]
call fcn.10003530
mov ecx, dword [ebp + 8]
add ecx, 0xbc
push ecx
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x1007a348
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__keyMaterial_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__sharedKey_
lea ecx, [ebp - 0xc]
call fcn.10003530
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
shr eax, 0xa
and eax, 3
cmp eax, 1
jne 0x10054033
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 0x62]
test edx, edx
je 0x10054033
push str._keyIndex_
lea ecx, [ebp - 0xc]
call fcn.10003530
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 0x62]
mov dword [ebp - 0x6878], ecx
cmp dword [ebp - 0x6878], 3
ja case.default.0x10053fe5
mov edx, dword [ebp - 0x6878]
jmp dword [edx*4 + 0x10054950]
push str.0123
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp case.default.0x10053fe5
push 0x1007a37c
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp case.default.0x10053fe5
push 0x1007a380
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp case.default.0x10053fe5
push 0x1007a384
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x1007a388
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__security_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__MSM_
lea ecx, [ebp - 0xc]
call fcn.10003530
push str.__WLANProfile_
lea ecx, [ebp - 0xc]
call fcn.10003530
lea ecx, [ebp - 0x5194]
call fcn.100040a0
lea ecx, [ebp - 0x519c]
call fcn.100040a0
lea ecx, [ebp - 4]
call fcn.100040a0
push 0x7d0
push 0
lea eax, [ebp - 0x3098]
push eax
call fcn.100139b0
add esp, 0xc
push 0xc8
push 0
lea ecx, [ebp - 0x28c8]
push ecx
call fcn.100139b0
add esp, 0xc
push 0x7d0
push 0
lea edx, [ebp - 0x7e0]
push edx
call fcn.100139b0
add esp, 0xc
push 0xfa0
push 0
lea eax, [ebp - 0x62e0]
push eax
call fcn.100139b0
add esp, 0xc
push 0x2000
push 0
lea ecx, [ebp - 0x27e0]
push ecx
call fcn.100139b0
add esp, 0xc
push 0x190
push 0
lea edx, [ebp - 0x5330]
push edx
call fcn.100139b0
add esp, 0xc
push 0x2000
push 0
lea eax, [ebp - 0x5158]
push eax
call fcn.100139b0
add esp, 0xc
lea ecx, [ebp - 0x5194]
call fcn.10004060
lea ecx, [ebp - 0x519c]
call fcn.10004060
lea ecx, [ebp - 4]
call fcn.10004060
movzx ecx, byte [ebp - 0x5195]
test ecx, ecx
je 0x100541b1
lea ecx, [ebp - 0xc]
call fcn.10001330
push eax
lea ecx, [ebp - 0xc]
call fcn.10001ae0
push eax
lea edx, [ebp - 0x3098]
push edx
call fcn.10013640
add esp, 0xc
lea eax, [ebp - 0x3098]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x515c], eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x27fc], eax
lea edx, [ebp - 0x3098]
push edx
push 0x1007a3b8
lea eax, [ebp - 0x27e0]
push eax
call fcn.100039c0
add esp, 0xc
lea ecx, [ebp - 0x27e0]
push ecx
lea ecx, [ebp - 0x5194]
call fcn.10003f80
jmp 0x1005432d
mov dword [ebp - 0x6338], 0
lea ecx, [ebp - 0x5338]
call fcn.10001330
push eax
lea ecx, [ebp - 0x5338]
call fcn.10001ae0
push eax
lea edx, [ebp - 0x28c8]
push edx
call fcn.10013640
add esp, 0xc
lea eax, [ebp - 0x28c8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x515c], eax
lea ecx, [ebp - 0x28c8]
push ecx
push 0x1007a3bc
lea edx, [ebp - 0x5330]
push edx
call fcn.100039f0
add esp, 0xc
lea eax, [ebp - 0x5330]
push eax
lea ecx, [ebp - 0x519c]
call fcn.10003f80
mov ecx, dword [ebp - 0x515c]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x519c]
push edx
lea eax, [ebp - 0x5158]
push eax
call fcn.10013640
add esp, 0xc
mov ecx, dword [ebp - 0x515c]
mov edx, dword [ebp - 0x6338]
lea eax, [edx + ecx*2]
mov dword [ebp - 0x6338], eax
mov ecx, dword [ebp - 0x5168]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x309c]
push edx
mov eax, dword [ebp - 0x6338]
lea ecx, [ebp + eax - 0x5158]
push ecx
call fcn.10013640
add esp, 0xc
mov edx, dword [ebp - 0x5168]
mov eax, dword [ebp - 0x6338]
lea ecx, [eax + edx*2]
mov dword [ebp - 0x6338], ecx
lea ecx, [ebp - 0xc]
call fcn.10001330
push eax
lea ecx, [ebp - 0xc]
call fcn.10001ae0
push eax
lea edx, [ebp - 0x3098]
push edx
call fcn.10013640
add esp, 0xc
lea eax, [ebp - 0x3098]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x515c], eax
lea ecx, [ebp - 0x3098]
push ecx
push 0x1007a3c0
lea edx, [ebp - 0x27e0]
push edx
call fcn.100039c0
add esp, 0xc
lea eax, [ebp - 0x27e0]
push eax
lea ecx, [ebp - 0x5194]
call fcn.10003f80
mov ecx, dword [ebp - 0x515c]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x5194]
push edx
mov eax, dword [ebp - 0x6338]
lea ecx, [ebp + eax - 0x5158]
push ecx
call fcn.10013640
add esp, 0xc
mov edx, dword [ebp - 0x515c]
mov eax, dword [ebp - 0x6338]
lea ecx, [eax + edx*2]
mov dword [ebp - 0x6338], ecx
push 0x1007a3c4
mov edx, dword [ebp + 8]
add edx, 0x32
push edx
call fcn.10015ac0
add esp, 8
test eax, eax
je 0x10054384
movzx eax, byte [ebp + 0x18]
test eax, eax
jne 0x10054384
movzx ecx, byte [ebp - 0x5195]
test ecx, ecx
je 0x1005436f
lea edx, [ebp - 0x27e0]
push edx
call sub.RtlIhvOid.dll_Ordinal_4
add esp, 4
mov dword [ebp - 0x5334], eax
jmp 0x10054384
lea eax, [ebp - 0x5158]
push eax
call sub.RtlIhvOid.dll_Ordinal_4
add esp, 4
mov dword [ebp - 0x5334], eax
push 0x42
push 0
lea ecx, [ebp - 0x3130]
push ecx
call fcn.100139b0
add esp, 0xc
movzx edx, byte [ebp - 0x5195]
test edx, edx
je 0x100543ea
mov dword [ebp - 0x30a0], 0
jmp 0x100543bd
mov eax, dword [ebp - 0x30a0]
add eax, 1
mov dword [ebp - 0x30a0], eax
mov ecx, dword [ebp - 0x30a0]
cmp ecx, dword [ebp - 0x27fc]
jae 0x100543e8
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x30a0]
movsx ax, byte [edx]
mov ecx, dword [ebp - 0x30a0]
mov word [ebp + ecx*2 - 0x3130], ax
jmp 0x100543ae
jmp 0x10054409
mov edx, dword [ebp - 0x5168]
shl edx, 1
push edx
mov eax, dword [ebp - 0x309c]
push eax
lea ecx, [ebp - 0x3130]
push ecx
call fcn.10013640
add esp, 0xc
mov edx, dword [ebp - 0x309c]
mov dword [ebp - 0x686c], edx
mov eax, dword [ebp - 0x686c]
push eax
call fcn.10004585
add esp, 4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 4
and edx, 1
je 0x10054658
mov dword [ebp - 0x67e8], 0x400
lea eax, [ebp - 0x67e8]
push eax
lea ecx, [ebp - 0x67e0]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [ebp - 0x67e0]
push edx
lea ecx, [ebp - 0x67f0]
call fcn.100017d0
lea ecx, [ebp - 0x67f0]
call fcn.10002770
push 0x84
lea eax, [ebp - 0x3130]
push eax
lea ecx, [ebp - 0x63d8]
push ecx
call fcn.10013640
add esp, 0xc
lea edx, [ebp - 0x6800]
push edx
call sub.RtlIhvOid.dll_Ordinal_20
add esp, 4
mov eax, dword [ebp - 0x6800]
mov dword [ebp - 0x6354], eax
mov ecx, dword [ebp - 0x67fc]
mov dword [ebp - 0x6350], ecx
mov edx, dword [ebp - 0x67f8]
mov dword [ebp - 0x634c], edx
mov eax, dword [ebp - 0x67f4]
mov dword [ebp - 0x6348], eax
lea ecx, [ebp - 0x63dc]
call fcn.10001af0
lea ecx, [ebp - 0x633c]
call fcn.10001af0
lea ecx, [ebp - 0x6808]
push ecx
call fcn.10065660
add esp, 4
push 0x5c
lea ecx, [ebp - 0x6808]
call fcn.10001cb0
mov dword [ebp - 0x63e0], eax
mov edx, dword [ebp - 0x63e0]
push edx
lea eax, [ebp - 0x6870]
push eax
lea ecx, [ebp - 0x6808]
call fcn.10001f00
push eax
lea ecx, [ebp - 0x6808]
call fcn.10002750
lea ecx, [ebp - 0x6870]
call fcn.10001850
push 0x5c
lea ecx, [ebp - 0x6808]
call fcn.10001cb0
mov dword [ebp - 0x6804], eax
mov ecx, dword [ebp - 0x63e0]
push ecx
mov edx, dword [ebp - 0x6804]
add edx, 1
push edx
lea eax, [ebp - 0x6874]
push eax
lea ecx, [ebp - 0x6808]
call fcn.10001e20
push eax
lea ecx, [ebp - 0x633c]
call fcn.10002750
lea ecx, [ebp - 0x6874]
call fcn.10001850
mov ecx, dword [ebp - 0x633c]
push ecx
push 0x1007a3c8
lea edx, [ebp - 0x63dc]
push edx
call fcn.100025d0
add esp, 0xc
lea eax, [ebp - 0x67e4]
push eax
lea ecx, [ebp - 0x63dc]
call fcn.10001ae0
push eax
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x67ec], eax
cmp dword [ebp - 0x67ec], 0
jne 0x10054604
push 0xff
lea ecx, [ebp - 0x63d8]
push ecx
push 3
push 0
push str.Run1x
mov edx, dword [ebp - 0x67e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x67e4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 0x67e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Run1x.exe
lea edx, [ebp - 0x6808]
push edx
call fcn.100025d0
add esp, 8
push 1
lea ecx, [ebp - 0x6808]
call fcn.10001ae0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [ebp - 0x6808]
call fcn.10001850
lea ecx, [ebp - 0x633c]
call fcn.10001850
lea ecx, [ebp - 0x63dc]
call fcn.10001850
lea ecx, [ebp - 0x67f0]
call fcn.10001850
lea eax, [ebp - 0x3130]
push eax
call sub.RtlIhvOid.dll_Ordinal_6
add esp, 4
mov dword [ebp - 0x5334], eax
push 0x1007a3f0
mov ecx, dword [ebp + 8]
add ecx, 0x32
push ecx
call fcn.10015ac0
add esp, 8
test eax, eax
je 0x100546a5
movzx edx, byte [ebp + 0x18]
test edx, edx
jne 0x100546a5
mov dword [ebp - 0x27f8], 0
lea eax, [ebp - 0x3130]
mov dword [ebp - 0x27f4], eax
jmp 0x100546bb
mov dword [ebp - 0x27f8], 1
lea ecx, [ebp - 0x62e0]
mov dword [ebp - 0x27f4], ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x3154], eax
mov eax, dword [ebp - 0x3154]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x3150]
push edx
call fcn.10013640
add esp, 0xc
lea eax, [ebp - 0x3154]
mov dword [ebp - 0x27f0], eax
cmp dword [ebp + 0x14], 0
jne 0x10054703
mov dword [ebp - 0x27e8], 2
jmp 0x10054768
cmp dword [ebp + 0x14], 1
jne 0x10054715
mov dword [ebp - 0x27e8], 1
jmp 0x10054768
mov dword [ebp - 0x5334], 0x57
lea ecx, [ebp - 4]
call fcn.10004080
lea ecx, [ebp - 0x519c]
call fcn.10004080
lea ecx, [ebp - 0x5194]
call fcn.10004080
lea ecx, [ebp - 0x632c]
call fcn.10001850
lea ecx, [ebp - 8]
call fcn.10001850
lea ecx, [ebp - 0x5338]
call fcn.10001850
lea ecx, [ebp - 0xc]
call fcn.10001850
jmp 0x10054940
movzx ecx, byte [ebp - 0x5195]
test ecx, ecx
je 0x1005477d
mov dword [ebp - 0x27e8], 3
mov dword [ebp - 0x27ec], 0
mov dword [ebp - 0x27e4], 0
movzx edx, byte [ebp - 0x5195]
test edx, edx
jne 0x10054832
mov dword [ebp - 0x681c], 0x1e
mov dword [ebp - 0x6818], 0
mov eax, dword [ebp - 0x681c]
sub eax, 1
mov dword [ebp - 0x681c], eax
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
push 0
lea ecx, [ebp - 0x6814]
push ecx
call fcn.100139b0
add esp, 0xc
push 4
lea edx, [ebp - 0x6814]
push edx
push 0xff0101bd
push 0
call sub.RtlIhvOid.dll_Ordinal_2
add esp, 0x10
mov dword [ebp - 0x6818], eax
cmp dword [ebp - 0x6818], 0
je 0x10054817
mov eax, dword [ebp - 0x6814]
shr eax, 8
mov dword [ebp - 0x6814], eax
cmp dword [ebp - 0x6814], 1
jne 0x10054832
cmp dword [ebp - 0x6818], 0
je 0x10054832
cmp dword [ebp - 0x681c], 0
jne 0x100547b4
lea ecx, [ebp - 0x27f8]
push ecx
call sub.RtlIhvOid.dll_Ordinal_18
add esp, 4
mov dword [ebp - 0x5334], eax
movzx edx, byte [ebp - 0x5195]
test edx, edx
je 0x100548fc
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1bc], 0x40
je 0x1005487f
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1bc]
push edx
mov eax, dword [ebp + 8]
add eax, 0xbc
push eax
call sym.RtlLib.dll_RT_AP_SetPassphrase
add esp, 8
jmp 0x100548af
push 0
push 0x20
lea ecx, [ebp - 0x6864]
push ecx
push 0x40
mov edx, dword [ebp + 8]
add edx, 0xbc
push edx
call fcn.10064910
add esp, 0x14
push 0x40
lea eax, [ebp - 0x6864]
push eax
call sym.RtlLib.dll_RT_AP_SetPassphrase
add esp, 8
push 0x20
mov ecx, dword [ebp + 8]
add ecx, 0x32
push ecx
lea edx, [ebp - 0x683c]
push edx
call fcn.10013640
add esp, 0xc
mov dword [ebp - 0x6840], 0x24
mov dword [ebp - 0x6844], 0x64
mov eax, dword [ebp - 0x6844]
push eax
sub esp, 0x24
mov ecx, 9
lea esi, [ebp - 0x6840]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call sub.RtlIhvOid.dll_Ordinal_22
add esp, 0x28
lea ecx, [ebp - 4]
call fcn.10004080
lea ecx, [ebp - 0x519c]
call fcn.10004080
lea ecx, [ebp - 0x5194]
call fcn.10004080
lea ecx, [ebp - 0x632c]
call fcn.10001850
lea ecx, [ebp - 8]
call fcn.10001850
lea ecx, [ebp - 0x5338]
call fcn.10001850
lea ecx, [ebp - 0xc]
call fcn.10001850
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret