Function at 0x1006807a
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Self delete

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [0x10193240]
mov ecx, dword [0x10193244]
lea edx, [eax - 1]
imul edx, eax
test dl, 1
sete byte [ebp - 0x21]
cmp ecx, 0xa
setl byte [ebp - 0x22]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, 0xa055ccc6
cmp eax, 0xf89af633
jg 0x10068104
cmp eax, 0xb517e512
jg 0x1006815b
cmp eax, 0xa4594780
jg 0x10068252
cmp eax, 0x970ee702
jg 0x1006838f
cmp eax, 0x8c550322
jg 0x10068664
cmp eax, 0x851bac54
jg 0x10068a41
cmp eax, 0x81a8e327
je 0x1006904a
cmp eax, 0x8511e09e
jne 0x100680ad
mov eax, 0xa129509
jmp 0x100680ad
cmp eax, 0x3d68f1a9
jle 0x100681ba
cmp eax, 0x55d8e260
jg 0x100682a6
cmp eax, 0x44fe2edb
jg 0x100683d8
cmp eax, 0x41512bdb
jg 0x100686a2
cmp eax, 0x3ecd5c00
jg 0x10068a74
cmp eax, 0x3d68f1aa
je 0x1006908d
cmp eax, 0x3e5036f8
jne 0x100680ad
mov eax, 0xc37f0bc0
jmp 0x100680ad
cmp eax, 0xce5f1d8c
jg 0x10068307
cmp eax, 0xc66faea8
jg 0x1006840e
cmp eax, 0xc2c387e4
jg 0x100686cd
cmp eax, 0xba452b0b
jg 0x10068aa7
cmp eax, 0xb517e513
je 0x10069097
cmp eax, 0xb8021eda
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x31759219
mov ecx, 0x78e17310
jmp 0x10069873
cmp eax, 0x1d028d8e
jle 0x10068348
cmp eax, 0x2d283c9c
jg 0x10068450
cmp eax, 0x1fdc17bb
jg 0x1006870b
cmp eax, 0x1f239db1
jg 0x10068ada
cmp eax, 0x1d028d8f
je 0x100690b4
cmp eax, 0x1e3ad0ee
jne 0x100680ad
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x3c
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], str.Open
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x14], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x40
push dword [ebp - 0x10]
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov eax, 0x64d7e6f7
jmp 0x100680ad
cmp eax, 0xab828e05
jg 0x10068486
cmp eax, 0xa7f4a011
jg 0x10068749
cmp eax, 0xa5bb5f42
jg 0x10068b0d
cmp eax, 0xa4594781
je 0x100690be
cmp eax, 0xa4a9b95c
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb19d08d6
mov ecx, 0x41512bdc
jmp 0x10069873
cmp eax, 0x72de7961
jg 0x100684cf
cmp eax, 0x62581e1b
jg 0x10068787
cmp eax, 0x5adfeb9b
jg 0x10068b2d
cmp eax, 0x55d8e261
je 0x100690eb
cmp eax, 0x56c1e56b
jne 0x100680ad
push str.___nul
push dword [ebp - 0x14]
call ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x970ee703
mov ecx, 0xed2c2683
jmp 0x10069873
cmp eax, 0xdded7b59
jg 0x10068518
cmp eax, 0xd66d4b46
jg 0x10068817
cmp eax, 0xd474038a
jg 0x10068b60
cmp eax, 0xce5f1d8d
je 0x100690f5
cmp eax, 0xd35fecf1
jne 0x100680ad
mov eax, 0xf89af634
jmp 0x100680ad
cmp eax, 0x39447d1
jg 0x10068561
cmp eax, 0xfda958cb
jg 0x10068842
cmp eax, 0xfb3edff3
jg 0x10068b93
cmp eax, 0xf89af634
je 0x10069112
cmp eax, 0xfa8ff17d
jne 0x100680ad
mov eax, 0xa058d469
xor ecx, ecx
inc ecx
mov dword [ebp - 0x3c], ecx
jmp 0x100680ad
cmp eax, 0xa058d468
jg 0x10068880
cmp eax, 0x97b6eddd
jg 0x10068bc6
cmp eax, 0x970ee703
je 0x1006912f
cmp eax, 0x97457216
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xda0b2e5
mov ecx, 0x16c25ce4
jmp 0x10069873
cmp eax, 0x4a415df8
jg 0x100688ae
cmp eax, 0x462afc81
jg 0x10068bfa
cmp eax, 0x44fe2edc
je 0x10069146
cmp eax, 0x4539ab0a
jne 0x100680ad
mov eax, 0xa4a9b95c
jmp 0x100680ad
cmp eax, 0xcb83330b
jg 0x100688ec
cmp eax, 0xc7e6efc5
jg 0x10068c30
cmp eax, 0xc66faea9
je 0x10069163
cmp eax, 0xc7dd1b99
jne 0x100680ad
cmp byte [ebp - 0x23], 0
mov eax, 0x5ede09ca
mov ecx, 0xcb83330c
cmovne eax, ecx
jmp 0x100680ad
cmp eax, 0x31c26e29
jg 0x1006892a
cmp eax, 0x307bd6ca
jg 0x10068c63
cmp eax, 0x2d283c9d
je 0x10069189
cmp eax, 0x2ddb2356
jne 0x100680ad
mov eax, 0x462afc82
jmp 0x100680ad
cmp eax, 0xaeff494c
jg 0x1006895c
cmp eax, 0xade09632
jg 0x10068c96
cmp eax, 0xab828e06
je 0x100691a6
cmp eax, 0xadd77703
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf5388e92
mov ecx, 0x8c550323
jmp 0x10069873
cmp eax, 0x7709a567
jg 0x1006899a
cmp eax, 0x7459990b
jg 0x10068cc9
cmp eax, 0x72de7962
je 0x100691c3
cmp eax, 0x72e0ea03
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1f239db2
mov ecx, 0xab40050a
jmp 0x10069873
cmp eax, 0xed2c2682
jg 0x100689d8
cmp eax, 0xe2316633
jg 0x10068ce9
cmp eax, 0xdded7b5a
je 0x100691e0
cmp eax, 0xe0cb97c7
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcb934630
mov ecx, 0x2b491257
jmp 0x10069873
cmp eax, 0xe95faf8
jg 0x10068a03
cmp eax, 0xa129508
jg 0x10068d1c
cmp eax, 0x39447d2
je 0x100691fd
cmp eax, 0x905aaac
jne 0x100680ad
push eax
sub esp, 0x100
mov ecx, esp
mov dword [ebp - 0x18], ecx
sub esp, 0x104
mov edi, esp
sub esp, 0x104
mov ebx, esp
mov dword [ebp - 0x1c], ebx
sub esp, 0x3c
mov eax, esp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov esi, 0x104
push esi
xor eax, eax
push eax
push dword [ebp - 0x30]
call fcn.1014ca80
add esp, 0xc
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x34]
push esi
xor eax, eax
push eax
push dword [ebp - 0x34]
call fcn.1014ca80
add esp, 0xc
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x38]
push esi
xor eax, eax
push eax
push dword [ebp - 0x38]
call fcn.1014ca80
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
push dword [ebp - 0x20]
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x20]
push esi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [ebp - 0x28], edi
push esi
push dword [ebp - 0x28]
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
push 0x1018382b
push dword [ebp - 0x14]
call ebx
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call ebx
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xfebe75e1
mov ecx, 0xfda958cc
jmp 0x10069873
cmp eax, 0x93a20a37
jg 0x10068d3c
cmp eax, 0x8c550323
je 0x10069207
cmp eax, 0x8e6e3751
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7688f5b3
mov ecx, 0x3adfedb9
jmp 0x10069873
cmp eax, 0x44278954
jg 0x10068d5c
cmp eax, 0x41512bdc
je 0x10069224
cmp eax, 0x419fceb2
jne 0x100680ad
mov eax, 0xb517e513
jmp 0x100680ad
cmp eax, 0xc37f0bbf
jg 0x10068d8f
cmp eax, 0xc2c387e5
je 0x10069241
cmp eax, 0xc3071533
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd8cb04c3
mov ecx, 0x2d283c9d
jmp 0x10069873
cmp eax, 0x25ef9306
jg 0x10068dc2
cmp eax, 0x1fdc17bc
je 0x1006925e
cmp eax, 0x24cf5e12
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x851bac55
mov ecx, 0xa4a9b95c
jmp 0x10069873
cmp eax, 0xaa3b9d6e
jg 0x10068df5
cmp eax, 0xa7f4a012
je 0x1006927b
cmp eax, 0xa8dff7e4
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7e37e00b
mov ecx, 0xfd6fd279
jmp 0x10069873
cmp eax, 0x6c2d8fec
jg 0x10068ea9
cmp eax, 0x62581e1c
je 0x100692d1
cmp eax, 0x64d7e6f7
jne 0x100680ad
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x3c
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], str.Open
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x14], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x40
push dword [ebp - 0x10]
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
setne byte [ebp - 0x23]
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1e3ad0ee
mov ecx, 0xc9ef541c
jmp 0x10069873
cmp eax, 0xda225250
jg 0x10068ec9
cmp eax, 0xd66d4b47
je 0x100692ee
cmp eax, 0xd8cb04c3
jne 0x100680ad
mov eax, 0x2d283c9d
jmp 0x100680ad
cmp eax, 0xfebe75e0
jg 0x10068efc
cmp eax, 0xfda958cc
je 0x1006930b
cmp eax, 0xfdbff016
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6c2d8fed
mov ecx, 0xab828e06
jmp 0x10069873
cmp eax, 0xa13d610a
jg 0x10068f2f
cmp eax, 0xa058d469
je 0x10069328
cmp eax, 0xa0e24f1e
jne 0x100680ad
mov eax, dword [ebp - 0x10]
mov eax, 0xc66faea9
jmp 0x100680ad
cmp eax, 0x4e196522
jg 0x10068f4f
cmp eax, 0x4a415df9
je 0x10069357
cmp eax, 0x4ae36338
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xddcf9da6
mov ecx, 0xc3071533
jmp 0x10069873
cmp eax, 0xccb79740
jg 0x10068f6f
cmp eax, 0xcb83330c
je 0x10069374
cmp eax, 0xcb934630
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd474038b
mov ecx, 0x486a9dd6
jmp 0x10069873
cmp eax, 0x3adfedb8
jg 0x10068f8f
cmp eax, 0x31c26e2a
je 0x10069391
cmp eax, 0x33fdfae7
jne 0x100680ad
mov eax, 0xa058d469
mov dword [ebp - 0x3c], 0
jmp 0x100680ad
cmp eax, 0xb19d08d5
jg 0x10068faf
cmp eax, 0xaeff494d
je 0x1006939b
cmp eax, 0xb102a55f
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf0dddbf1
mov ecx, 0xade09633
jmp 0x10069873
cmp eax, 0x79abfea7
jg 0x10068fcf
cmp eax, 0x7709a568
je 0x100693b8
cmp eax, 0x78e17310
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1e3ad0ee
mov ecx, 0x64d7e6f7
jmp 0x10069873
cmp eax, 0xf3fc710a
jg 0x10068fef
cmp eax, 0xed2c2683
je 0x100693d5
cmp eax, 0xf0dddbf1
jne 0x100680ad
mov eax, 0xb102a55f
jmp 0x100680ad
cmp eax, 0x16c25ce3
jg 0x10069022
cmp eax, 0xe95faf9
je 0x100693df
cmp eax, 0x13dbfb44
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xce4e75db
mov ecx, 0x8511e09e
jmp 0x10069873
cmp eax, 0x851bac55
je 0x10069422
cmp eax, 0x8a3c1d1f
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8e6e3751
mov ecx, 0xd5e5049e
jmp 0x10069873
cmp eax, 0x3ecd5c01
je 0x1006943f
cmp eax, 0x4009d631
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x44278955
mov ecx, 0xa5bb5f43
jmp 0x10069873
cmp eax, 0xba452b0c
je 0x1006945c
cmp eax, 0xc237fb65
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb4f85788
mov ecx, 0x24cf5e12
jmp 0x10069873
cmp eax, 0x1f239db2
je 0x10069466
cmp eax, 0x1f9e43bc
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xccb79741
mov ecx, 0xdded7b5a
jmp 0x10069873
cmp eax, 0xa5bb5f43
je 0x100694f1
cmp eax, 0xa5dab7a6
jne 0x100680ad
mov eax, 0xaee76589
jmp 0x100680ad
cmp eax, 0x5adfeb9c
je 0x1006950e
cmp eax, 0x5ede09ca
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x31c26e2a
mov ecx, 0xe840bcdf
jmp 0x10069873
cmp eax, 0xd474038b
je 0x1006952e
cmp eax, 0xd5e5049e
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xda0b2e5
mov ecx, 0x97457216
jmp 0x10069873
cmp eax, 0xfb3edff4
je 0x1006953b
cmp eax, 0xfd6fd279
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7e37e00b
mov ecx, 0xfa8ff17d
jmp 0x10069873
cmp eax, 0x97b6edde
je 0x10069558
cmp eax, 0xa055ccc6
jne 0x100680ad
mov cl, byte [ebp - 0x21]
cmp byte [ebp - 0x22], 0
mov eax, 0xf0dddbf1
mov edx, 0xb102a55f
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x100680ad
cmp eax, 0x462afc82
je 0x100695ae
cmp eax, 0x486a9dd6
jne 0x100680ad
mov eax, dword [ebp - 0x10]
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd474038b
mov ecx, 0x5326811d
jmp 0x10069873
cmp eax, 0xc7e6efc6
je 0x100695cb
cmp eax, 0xc9ef541c
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x31759219
mov ecx, 0xfdbff016
jmp 0x10069873
cmp eax, 0x307bd6cb
je 0x100695e8
cmp eax, 0x31759219
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x97b6edde
mov ecx, 0xe2316634
jmp 0x10069873
cmp eax, 0xade09633
je 0x100695f2
cmp eax, 0xaee76589
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa5dab7a6
mov ecx, 0xb8021eda
jmp 0x10069873
cmp eax, 0x7459990c
je 0x1006960f
cmp eax, 0x7688f5b3
jne 0x100680ad
mov eax, 0x3adfedb9
jmp 0x100680ad
cmp eax, 0xe2316634
je 0x1006962c
cmp eax, 0xe840bcdf
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x31c26e2a
mov ecx, 0x4a415df9
jmp 0x10069873
cmp eax, 0xa129509
je 0x10069695
cmp eax, 0xda0b2e5
jne 0x100680ad
mov eax, 0x97457216
jmp 0x100680ad
cmp eax, 0x93a20a38
je 0x100696b2
cmp eax, 0x95aa5066
jne 0x100680ad
mov eax, 0x8c550323
jmp 0x100680ad
cmp eax, 0x44278955
je 0x10069708
cmp eax, 0x444f450f
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xaa3b9d6f
mov ecx, 0x419fceb2
jmp 0x10069873
cmp eax, 0xc37f0bc0
je 0x10069712
cmp eax, 0xc3b7f37f
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x25ef9307
mov ecx, 0xa4594781
jmp 0x10069873
cmp eax, 0x25ef9307
je 0x1006972f
cmp eax, 0x2b491257
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa0e24f1e
mov ecx, 0xc66faea9
jmp 0x10069873
cmp eax, 0xaa3b9d6f
je 0x10069746
cmp eax, 0xab40050a
jne 0x100680ad
push eax
sub esp, 0x100
mov edi, esp
sub esp, 0x104
mov esi, esp
mov dword [ebp - 0x1c], esi
sub esp, 0x104
mov dword [ebp - 0x18], esp
mov ebx, 0x104
push ebx
xor eax, eax
push eax
push edi
call fcn.1014ca80
add esp, 0xc
push ebx
xor eax, eax
push eax
push esi
call fcn.1014ca80
add esp, 0xc
push ebx
xor eax, eax
push eax
mov esi, dword [ebp - 0x18]
push esi
call fcn.1014ca80
add esp, 0xc
push ebx
push edi
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push ebx
push dword [ebp - 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x1018382b
push esi
call ebx
push edi
push esi
call ebx
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1f239db2
mov ecx, 0x6cc3f083
jmp 0x10069873
cmp eax, 0x6c2d8fed
je 0x10069750
cmp eax, 0x6cc3f083
jne 0x100680ad
mov eax, 0x3ecd5c01
jmp 0x100680ad
cmp eax, 0xda225251
je 0x1006975a
cmp eax, 0xddcf9da6
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x79abfea8
mov ecx, 0xfb3edff4
jmp 0x10069873
cmp eax, 0xfebe75e1
je 0x10069764
cmp eax, 0xff794982
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1d028d8f
mov ecx, 0xa13d610b
jmp 0x10069873
cmp eax, 0xa13d610b
je 0x100697ef
cmp eax, 0xa28af64d
jne 0x100680ad
mov eax, 0xc7e6efc6
jmp 0x100680ad
cmp eax, 0x4e196523
je 0x10069809
cmp eax, 0x5326811d
jne 0x100680ad
mov eax, 0x2b491257
jmp 0x100680ad
cmp eax, 0xccb79741
je 0x10069813
cmp eax, 0xce4e75db
jne 0x100680ad
mov eax, 0x13dbfb44
jmp 0x100680ad
cmp eax, 0x3adfedb9
je 0x1006982d
cmp eax, 0x3b7b796a
jne 0x100680ad
mov eax, 0x5adfeb9c
jmp 0x100680ad
cmp eax, 0xb19d08d6
je 0x10069847
cmp eax, 0xb4f85788
jne 0x100680ad
mov eax, 0xc237fb65
jmp 0x100680ad
cmp eax, 0x79abfea8
je 0x10069851
cmp eax, 0x7e37e00b
jne 0x100680ad
mov eax, 0xfd6fd279
jmp 0x100680ad
cmp eax, 0xf3fc710b
je 0x1006985b
cmp eax, 0xf5388e92
jne 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe95faf9
mov ecx, 0xa7f4a012
jmp 0x10069873
cmp eax, 0x19bd7444
jne 0x10069885
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xaa3b9d6f
mov ecx, 0x444f450f
jmp 0x10069873
push 0x40
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x100
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
push dword [ebp - 0x20]
push 1
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, 0x93a20a38
jmp 0x100680ad
mov eax, 0xce5f1d8d
jmp 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x39447d2
mov ecx, 0x1fdc17bc
jmp 0x10069873
mov eax, 0xa13d610b
jmp 0x100680ad
push str.___nul
push dword [ebp - 0x14]
call ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x25ef9307
mov ecx, 0x1f9e43bc
jmp 0x10069873
mov eax, 0x44fe2edc
jmp 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3d68f1aa
mov ecx, 0xe0cb97c7
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd35fecf1
mov ecx, 0x4ae36338
jmp 0x10069873
push str.___nul
push dword [ebp - 0x14]
call ebx
mov eax, dword [ebp - 0x10]
mov eax, 0x56c1e56b
jmp 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x55d8e261
mov ecx, 0x4539ab0a
jmp 0x10069873
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa0e24f1e
mov ecx, 0xd66d4b47
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd8cb04c3
mov ecx, 0x33fdfae7
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6c2d8fed
mov ecx, 0xc7dd1b99
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf5388e92
mov ecx, 0x62581e1c
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3e5036f8
mov ecx, 0xc37f0bc0
jmp 0x10069873
mov eax, 0x1fdc17bc
jmp 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x81a8e327
mov ecx, 0x93a20a38
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb19d08d6
mov ecx, 0x7459990c
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xba452b0c
mov ecx, 0xf3fc710b
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x39447d2
mov ecx, 0xadd77703
jmp 0x10069873
push 0x40
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x100
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
push dword [ebp - 0x20]
push 1
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe95faf9
mov ecx, 0x95aa5066
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xce4e75db
mov ecx, 0x13dbfb44
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcb934630
mov ecx, 0x19bd7444
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x72e0ea03
mov ecx, 0xff794982
jmp 0x10069873
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x44278955
mov ecx, 0x4009d631
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xddcf9da6
mov ecx, 0xc7e6efc6
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3d68f1aa
mov ecx, 0xce5f1d8d
jmp 0x10069873
mov eax, 0xe840bcdf
jmp 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xda225251
mov ecx, 0x7709a568
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xccb79741
mov ecx, 0xc3b7f37f
jmp 0x10069873
mov eax, 0xc3b7f37f
jmp 0x100680ad
push 0x40
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x100
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
push dword [ebp - 0x20]
push 1
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, 0xa7f4a012
jmp 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x55d8e261
mov ecx, 0x44fe2edc
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xfebe75e1
mov ecx, 0x905aaac
jmp 0x10069873
mov eax, 0xf3fc710b
jmp 0x100680ad
push eax
sub esp, 0x100
mov edi, esp
sub esp, 0x104
mov esi, esp
mov dword [ebp - 0x1c], esi
sub esp, 0x104
mov dword [ebp - 0x18], esp
mov ebx, 0x104
push ebx
xor eax, eax
push eax
push edi
call fcn.1014ca80
add esp, 0xc
push ebx
xor eax, eax
push eax
push esi
call fcn.1014ca80
add esp, 0xc
push ebx
xor eax, eax
push eax
mov esi, dword [ebp - 0x18]
push esi
call fcn.1014ca80
add esp, 0xc
push ebx
push edi
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push ebx
push dword [ebp - 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x1018382b
push esi
call ebx
push edi
push esi
call ebx
mov eax, 0xab40050a
jmp 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8e6e3751
mov ecx, 0xc2c387e5
jmp 0x10069873
mov eax, dword [ebp - 0x40]
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa5dab7a6
mov ecx, 0xaee76589
jmp 0x10069873
mov eax, dword [ebp - 0x10]
mov eax, 0x486a9dd6
jmp 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x79abfea8
mov ecx, 0xa28af64d
jmp 0x10069873
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x3c
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], str.Open
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x14], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x40
push dword [ebp - 0x10]
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov eax, 0xe2316634
jmp 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xda225251
mov ecx, 0xaeff494d
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd35fecf1
mov ecx, 0xf89af634
jmp 0x10069873
mov eax, 0xc2c387e5
jmp 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x72e0ea03
mov ecx, 0x3ecd5c01
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x851bac55
mov ecx, 0xa8dff7e4
jmp 0x10069873
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x3c
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], str.Open
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x14], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x40
push dword [ebp - 0x10]
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x97b6edde
mov ecx, 0x4e196523
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb4f85788
mov ecx, 0xc237fb65
jmp 0x10069873
push 0x40
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x100
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
push dword [ebp - 0x20]
push 1
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x81a8e327
mov ecx, 0x72de7962
jmp 0x10069873
mov eax, 0x4009d631
jmp 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3e5036f8
mov ecx, 0x3b7b796a
jmp 0x10069873
push str.___nul
push dword [ebp - 0x14]
call ebx
mov eax, dword [ebp - 0x10]
mov eax, 0xa4594781
jmp 0x100680ad
mov eax, 0x444f450f
jmp 0x100680ad
mov eax, 0xab828e06
jmp 0x100680ad
mov eax, 0xaeff494d
jmp 0x100680ad
push eax
sub esp, 0x100
mov edi, esp
sub esp, 0x104
mov esi, esp
mov dword [ebp - 0x1c], esi
sub esp, 0x104
mov dword [ebp - 0x18], esp
mov ebx, 0x104
push ebx
xor eax, eax
push eax
push edi
call fcn.1014ca80
add esp, 0xc
push ebx
xor eax, eax
push eax
push esi
call fcn.1014ca80
add esp, 0xc
push ebx
xor eax, eax
push eax
mov esi, dword [ebp - 0x18]
push esi
call fcn.1014ca80
add esp, 0xc
push ebx
push edi
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push ebx
push dword [ebp - 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x1018382b
push esi
call ebx
push edi
push esi
call ebx
mov eax, 0x905aaac
jmp 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1d028d8f
mov ecx, 0x2ddb2356
jmp 0x10069873
mov eax, 0x78e17310
jmp 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x970ee703
mov ecx, 0x56c1e56b
jmp 0x10069873
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7688f5b3
mov ecx, 0x307bd6cb
jmp 0x10069873
mov eax, 0x41512bdc
jmp 0x100680ad
mov eax, 0xfb3edff4
jmp 0x100680ad
mov eax, dword [0x10193240]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xba452b0c
mov ecx, 0x8a3c1d1f
cmove eax, ecx
cmp dword [0x10193244], 0xa
cmovl eax, ecx
jmp 0x100680ad
cmp eax, 0x16c25ce4
jne 0x100680ad
mov eax, dword [ebp - 0x44]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret