Function at 0x10058ef0
Capabilities:
Create process on windows
Get geographical location
Get session user name
Print debug messages
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x6878
call fcn.1001a2d0
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
lea ecx, [ebp - 0xc]
call fcn.10001af0
lea ecx, [ebp - 0x5338]
call fcn.10001af0
lea ecx, [ebp - 8]
call fcn.10001af0
mov dword [ebp - 0x5170], 0
mov dword [ebp - 0x3154], 0
xor eax, eax
mov dword [ebp - 0x3150], eax
mov dword [ebp - 0x314c], eax
mov dword [ebp - 0x3148], eax
mov dword [ebp - 0x3144], eax
mov dword [ebp - 0x3140], eax
mov dword [ebp - 0x313c], eax
mov dword [ebp - 0x3138], eax
mov dword [ebp - 0x3134], eax
mov byte [ebp - 0x30a2], 0
mov byte [ebp - 0x5199], 0
call fcn.1003b3c0
movzx ecx, al
test ecx, ecx
je 0x10058fac
call sym.RtlLib.dll_RT_ACM_SoftAP_GetStatus
mov dword [ebp - 0x6330], eax
cmp dword [ebp - 0x6330], 2
jne 0x10058f9f
mov byte [ebp - 0x5199], 1
call sym.RtlLib.dll_RT_AP_GetIsAPMode
mov byte [ebp - 0x30a2], al
jmp 0x10058fba
mov byte [ebp - 0x30a2], 0
mov byte [ebp - 0x5199], 0
mov dword [ebp - 0x533c], 0
push 4
lea edx, [ebp - 0x533c]
push edx
push 0x20001004
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x5164], eax
lea ecx, [ebp - 0x632c]
call fcn.10001af0
mov dword [ebp - 0x516c], 0
mov eax, dword [ebp + 8]
add eax, 0x32
push eax
lea ecx, [ebp - 0x632c]
call fcn.10003530
lea ecx, [ebp - 0x632c]
call fcn.10001330
mov dword [ebp - 0x516c], eax
push 0
push 0
mov ecx, dword [ebp - 0x516c]
push ecx
lea ecx, [ebp - 0x632c]
call fcn.10001ae0
push eax
push 0
mov edx, dword [ebp - 0x533c]
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x5168], eax
mov eax, dword [ebp - 0x5168]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10004590
add esp, 4
mov dword [ebp - 0x6868], eax
mov eax, dword [ebp - 0x6868]
mov dword [ebp - 0x309c], eax
mov ecx, dword [ebp - 0x5168]
lea edx, [ecx + ecx + 2]
push edx
push 0
mov eax, dword [ebp - 0x309c]
push eax
call fcn.100139b0
add esp, 0xc
mov ecx, dword [ebp - 0x5168]
push ecx
mov edx, dword [ebp - 0x309c]
push edx
push 0xffffffffffffffff
lea ecx, [ebp - 0x632c]
call fcn.10001ae0
push eax
push 0
mov eax, dword [ebp - 0x533c]
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x41
push 0
lea ecx, [ebp - 0x6328]
push ecx
call fcn.100139b0
add esp, 0xc
push 0x7d0
lea ecx, [ebp - 0xc]
call fcn.100015a0
push 0xc8
lea ecx, [ebp - 0x5338]
call fcn.100015a0
push 0x7d0
lea ecx, [ebp - 8]
call fcn.100015a0
movzx edx, byte [ebp - 0x5199]
test edx, edx
je 0x10059140
push 0x10076b68
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076bd8
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076be0
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076bec
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10059170
push 0x10076c08
lea ecx, [ebp - 0x5338]
call fcn.10003530
push 0x10076c78
lea ecx, [ebp - 0x5338]
call fcn.10003530
push 0x10076c80
lea ecx, [ebp - 0x5338]
call fcn.10003530
push 0x10076c8c
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076c90
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076c98
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076ca8
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076cb0
lea ecx, [ebp - 0xc]
call fcn.10003530
mov dword [ebp - 0x30a0], 0
jmp 0x100591cc
mov eax, dword [ebp - 0x30a0]
add eax, 1
mov dword [ebp - 0x30a0], eax
mov ecx, dword [ebp + 8]
add ecx, 0x32
push ecx
call fcn.10013a30
add esp, 4
cmp dword [ebp - 0x30a0], eax
jae 0x1005924b
push 4
push 0
lea edx, [ebp - 0x5160]
push edx
call fcn.100139b0
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x30a0]
mov cl, byte [eax + 0x32]
mov byte [ebp - 0x30a1], cl
movsx edx, byte [ebp - 0x30a1]
and edx, 0xff
mov dword [ebp - 0x515c], edx
mov eax, dword [ebp - 0x515c]
push eax
push 0x10076cb8
lea ecx, [ebp - 0x5160]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x5160]
push edx
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x100591bd
push 0x10076cbc
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076cc4
lea ecx, [ebp - 0xc]
call fcn.10003530
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5c]
shr ecx, 3
and ecx, 1
je 0x10059282
push 0x10076ccc
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x1005928f
push 0x10076cf0
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076d14
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076d24
lea ecx, [ebp - 0xc]
call fcn.10003530
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
shr eax, 3
and eax, 1
je 0x100592c6
push 0x10076d38
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x100592d3
push 0x10076d3c
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076d44
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076d58
lea ecx, [ebp - 0xc]
call fcn.10003530
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 3
and edx, 1
je 0x1005930a
push 0x10076d6c
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10059317
push 0x10076d74
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076d7c
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076d90
lea ecx, [ebp - 0xc]
call fcn.10003530
movzx eax, byte [ebp - 0x5199]
test eax, eax
je 0x1005934b
push 0x10076da0
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10059358
push 0x10076da8
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076db0
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076dc0
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076dc8
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076dd4
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076de8
lea ecx, [ebp - 0xc]
call fcn.10003530
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 4
and edx, 1
je 0x10059404
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5c]
shr ecx, 5
and ecx, 7
jne 0x100593c4
push 0x10076dfc
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10059402
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
shr eax, 5
and eax, 7
cmp eax, 1
jne 0x100593e4
push 0x10076e00
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10059402
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 5
and edx, 7
cmp edx, 2
jne 0x10059402
push 0x10076e08
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x1005946e
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5c]
shr ecx, 1
and ecx, 3
cmp ecx, 3
jne 0x10059423
push 0x10076e10
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x1005946e
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
shr eax, 1
and eax, 3
cmp eax, 2
jne 0x10059442
push 0x10076e18
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x1005946e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 1
and edx, 3
cmp edx, 1
jne 0x10059461
push 0x10076e20
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x1005946e
push 0x10076e28
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076e30
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076e44
lea ecx, [ebp - 0xc]
call fcn.10003530
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5c]
shr ecx, 0xa
and ecx, 3
cmp ecx, 3
jne 0x100594a8
push 0x10076e54
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x100594f5
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
shr eax, 0xa
and eax, 3
cmp eax, 2
jne 0x100594c8
push 0x10076e58
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x100594f5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 1
jne 0x100594e8
push 0x10076e60
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x100594f5
push 0x10076e64
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076e6c
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076e7c
lea ecx, [ebp - 0xc]
call fcn.10003530
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5c]
shr ecx, 4
and ecx, 1
je 0x1005952c
push 0x10076e88
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10059539
push 0x10076e90
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076e98
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076ea4
lea ecx, [ebp - 0xc]
call fcn.10003530
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
shr eax, 4
and eax, 1
je 0x100596a1
push 0x10076eb8
lea ecx, [ebp - 0xc]
call fcn.10003530
call fcn.1003b3c0
movzx ecx, al
test ecx, ecx
je 0x10059598
push 0x10076ef4
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076f18
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076f3c
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076f48
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076f94
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076fa0
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076fe0
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076fe4
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076ff0
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10076fec
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10077034
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10077040
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10077088
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x1007708c
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x100770a0
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x100770e4
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x100770e8
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x100770f4
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10077104
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10077120
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10077134
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10077144
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10059893
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
and eax, 1
je 0x10059893
push 0x1007714c
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10077158
lea ecx, [ebp - 0xc]
call fcn.10003530
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 1
jne 0x100596ea
push 0x10077164
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10059712
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1bc], 0x40
jne 0x10059705
push 0x10077170
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x10059712
push 0x1007717c
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10077188
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10077194
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x100771b4
lea ecx, [ebp - 0xc]
call fcn.10003530
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 1
jne 0x100597b6
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x62]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 0x64]
mov dword [ebp - 0x6334], eax
push 0x1e
push 0
lea ecx, [ebp - 0x5190]
push ecx
call fcn.100139b0
add esp, 0xc
push 1
mov edx, dword [ebp - 0x6334]
shl edx, 1
push edx
lea eax, [ebp - 0x5190]
push eax
mov ecx, dword [ebp - 0x6334]
push ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x62]
shl eax, 4
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x6c]
push edx
call fcn.10064bd0
add esp, 0x14
lea eax, [ebp - 0x5190]
push eax
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp 0x100597e2
push 0x100771c4
lea ecx, [ebp - 0xc]
call fcn.10003530
mov ecx, dword [ebp + 8]
add ecx, 0xbc
push ecx
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x100771d0
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x100771d4
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x100771e4
lea ecx, [ebp - 0xc]
call fcn.10003530
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
shr eax, 0xa
and eax, 3
cmp eax, 1
jne 0x10059893
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 0x62]
test edx, edx
je 0x10059893
push 0x100771f4
lea ecx, [ebp - 0xc]
call fcn.10003530
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 0x62]
mov dword [ebp - 0x6878], ecx
cmp dword [ebp - 0x6878], 3
ja case.default.0x10059845
mov edx, dword [ebp - 0x6878]
jmp dword [edx*4 + 0x1005a1f4]
push 0x10077200
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp case.default.0x10059845
push 0x10077204
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp case.default.0x10059845
push 0x10077208
lea ecx, [ebp - 0xc]
call fcn.10003530
jmp case.default.0x10059845
push 0x1007720c
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10077210
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x1007721c
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10077228
lea ecx, [ebp - 0xc]
call fcn.10003530
push 0x10077230
lea ecx, [ebp - 0xc]
call fcn.10003530
lea ecx, [ebp - 0x5198]
call fcn.100040a0
lea ecx, [ebp - 0x51a0]
call fcn.100040a0
lea ecx, [ebp - 4]
call fcn.100040a0
push 0x7d0
push 0
lea eax, [ebp - 0x3098]
push eax
call fcn.100139b0
add esp, 0xc
push 0xc8
push 0
lea ecx, [ebp - 0x28c8]
push ecx
call fcn.100139b0
add esp, 0xc
push 0x7d0
push 0
lea edx, [ebp - 0x7e0]
push edx
call fcn.100139b0
add esp, 0xc
push 0xfa0
push 0
lea eax, [ebp - 0x62e0]
push eax
call fcn.100139b0
add esp, 0xc
push 0x2000
push 0
lea ecx, [ebp - 0x27e0]
push ecx
call fcn.100139b0
add esp, 0xc
push 0x190
push 0
lea edx, [ebp - 0x5330]
push edx
call fcn.100139b0
add esp, 0xc
push 0x2000
push 0
lea eax, [ebp - 0x5158]
push eax
call fcn.100139b0
add esp, 0xc
lea ecx, [ebp - 0x5198]
call fcn.10004060
lea ecx, [ebp - 0x51a0]
call fcn.10004060
lea ecx, [ebp - 4]
call fcn.10004060
movzx ecx, byte [ebp - 0x5199]
test ecx, ecx
je 0x10059a11
lea ecx, [ebp - 0xc]
call fcn.10001330
push eax
lea ecx, [ebp - 0xc]
call fcn.10001ae0
push eax
lea edx, [ebp - 0x3098]
push edx
call fcn.10013640
add esp, 0xc
lea eax, [ebp - 0x3098]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x515c], eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x27fc], eax
lea edx, [ebp - 0x3098]
push edx
push 0x10077240
lea eax, [ebp - 0x27e0]
push eax
call fcn.100039c0
add esp, 0xc
lea ecx, [ebp - 0x27e0]
push ecx
lea ecx, [ebp - 0x5198]
call fcn.10003f80
jmp 0x10059b8d
mov dword [ebp - 0x6338], 0
lea ecx, [ebp - 0x5338]
call fcn.10001330
push eax
lea ecx, [ebp - 0x5338]
call fcn.10001ae0
push eax
lea edx, [ebp - 0x28c8]
push edx
call fcn.10013640
add esp, 0xc
lea eax, [ebp - 0x28c8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x515c], eax
lea ecx, [ebp - 0x28c8]
push ecx
push 0x10077244
lea edx, [ebp - 0x5330]
push edx
call fcn.100039f0
add esp, 0xc
lea eax, [ebp - 0x5330]
push eax
lea ecx, [ebp - 0x51a0]
call fcn.10003f80
mov ecx, dword [ebp - 0x515c]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x51a0]
push edx
lea eax, [ebp - 0x5158]
push eax
call fcn.10013640
add esp, 0xc
mov ecx, dword [ebp - 0x515c]
mov edx, dword [ebp - 0x6338]
lea eax, [edx + ecx*2]
mov dword [ebp - 0x6338], eax
mov ecx, dword [ebp - 0x5168]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x309c]
push edx
mov eax, dword [ebp - 0x6338]
lea ecx, [ebp + eax - 0x5158]
push ecx
call fcn.10013640
add esp, 0xc
mov edx, dword [ebp - 0x5168]
mov eax, dword [ebp - 0x6338]
lea ecx, [eax + edx*2]
mov dword [ebp - 0x6338], ecx
lea ecx, [ebp - 0xc]
call fcn.10001330
push eax
lea ecx, [ebp - 0xc]
call fcn.10001ae0
push eax
lea edx, [ebp - 0x3098]
push edx
call fcn.10013640
add esp, 0xc
lea eax, [ebp - 0x3098]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x515c], eax
lea ecx, [ebp - 0x3098]
push ecx
push 0x10077248
lea edx, [ebp - 0x27e0]
push edx
call fcn.100039c0
add esp, 0xc
lea eax, [ebp - 0x27e0]
push eax
lea ecx, [ebp - 0x5198]
call fcn.10003f80
mov ecx, dword [ebp - 0x515c]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x5198]
push edx
mov eax, dword [ebp - 0x6338]
lea ecx, [ebp + eax - 0x5158]
push ecx
call fcn.10013640
add esp, 0xc
mov edx, dword [ebp - 0x515c]
mov eax, dword [ebp - 0x6338]
lea ecx, [eax + edx*2]
mov dword [ebp - 0x6338], ecx
push 0x1007724c
mov edx, dword [ebp + 8]
add edx, 0x32
push edx
call fcn.10015ac0
add esp, 8
test eax, eax
je 0x10059be4
movzx eax, byte [ebp + 0x18]
test eax, eax
jne 0x10059be4
movzx ecx, byte [ebp - 0x5199]
test ecx, ecx
je 0x10059bcf
lea edx, [ebp - 0x27e0]
push edx
call sub.RtlIhvOid.dll_Ordinal_4
add esp, 4
mov dword [ebp - 0x5334], eax
jmp 0x10059be4
lea eax, [ebp - 0x5158]
push eax
call sub.RtlIhvOid.dll_Ordinal_4
add esp, 4
mov dword [ebp - 0x5334], eax
push 0x42
push 0
lea ecx, [ebp - 0x3130]
push ecx
call fcn.100139b0
add esp, 0xc
movzx edx, byte [ebp - 0x5199]
test edx, edx
je 0x10059c4a
mov dword [ebp - 0x30a0], 0
jmp 0x10059c1d
mov eax, dword [ebp - 0x30a0]
add eax, 1
mov dword [ebp - 0x30a0], eax
mov ecx, dword [ebp - 0x30a0]
cmp ecx, dword [ebp - 0x27fc]
jge 0x10059c48
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x30a0]
movsx ax, byte [edx]
mov ecx, dword [ebp - 0x30a0]
mov word [ebp + ecx*2 - 0x3130], ax
jmp 0x10059c0e
jmp 0x10059c69
mov edx, dword [ebp - 0x5168]
shl edx, 1
push edx
mov eax, dword [ebp - 0x309c]
push eax
lea ecx, [ebp - 0x3130]
push ecx
call fcn.10013640
add esp, 0xc
mov edx, dword [ebp - 0x309c]
mov dword [ebp - 0x686c], edx
mov eax, dword [ebp - 0x686c]
push eax
call fcn.10004585
add esp, 4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 4
and edx, 1
je 0x10059eb8
mov dword [ebp - 0x67e8], 0x400
lea eax, [ebp - 0x67e8]
push eax
lea ecx, [ebp - 0x67e0]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [ebp - 0x67e0]
push edx
lea ecx, [ebp - 0x67f0]
call fcn.100017d0
lea ecx, [ebp - 0x67f0]
call fcn.10002770
push 0x84
lea eax, [ebp - 0x3130]
push eax
lea ecx, [ebp - 0x63d8]
push ecx
call fcn.10013640
add esp, 0xc
lea edx, [ebp - 0x6800]
push edx
call sub.RtlIhvOid.dll_Ordinal_20
add esp, 4
mov eax, dword [ebp - 0x6800]
mov dword [ebp - 0x6354], eax
mov ecx, dword [ebp - 0x67fc]
mov dword [ebp - 0x6350], ecx
mov edx, dword [ebp - 0x67f8]
mov dword [ebp - 0x634c], edx
mov eax, dword [ebp - 0x67f4]
mov dword [ebp - 0x6348], eax
lea ecx, [ebp - 0x63dc]
call fcn.10001af0
lea ecx, [ebp - 0x633c]
call fcn.10001af0
lea ecx, [ebp - 0x6808]
push ecx
call fcn.10065660
add esp, 4
push 0x5c
lea ecx, [ebp - 0x6808]
call fcn.10001cb0
mov dword [ebp - 0x63e0], eax
mov edx, dword [ebp - 0x63e0]
push edx
lea eax, [ebp - 0x6870]
push eax
lea ecx, [ebp - 0x6808]
call fcn.10001f00
push eax
lea ecx, [ebp - 0x6808]
call fcn.10002750
lea ecx, [ebp - 0x6870]
call fcn.10001850
push 0x5c
lea ecx, [ebp - 0x6808]
call fcn.10001cb0
mov dword [ebp - 0x6804], eax
mov ecx, dword [ebp - 0x63e0]
push ecx
mov edx, dword [ebp - 0x6804]
add edx, 1
push edx
lea eax, [ebp - 0x6874]
push eax
lea ecx, [ebp - 0x6808]
call fcn.10001e20
push eax
lea ecx, [ebp - 0x633c]
call fcn.10002750
lea ecx, [ebp - 0x6874]
call fcn.10001850
mov ecx, dword [ebp - 0x633c]
push ecx
push 0x10077250
lea edx, [ebp - 0x63dc]
push edx
call fcn.100025d0
add esp, 0xc
lea eax, [ebp - 0x67e4]
push eax
lea ecx, [ebp - 0x63dc]
call fcn.10001ae0
push eax
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x67ec], eax
cmp dword [ebp - 0x67ec], 0
jne 0x10059e64
push 0xff
lea ecx, [ebp - 0x63d8]
push ecx
push 3
push 0
push 0x10077264
mov edx, dword [ebp - 0x67e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x67e4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 0x67e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1007726c
lea edx, [ebp - 0x6808]
push edx
call fcn.100025d0
add esp, 8
push 1
lea ecx, [ebp - 0x6808]
call fcn.10001ae0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [ebp - 0x6808]
call fcn.10001850
lea ecx, [ebp - 0x633c]
call fcn.10001850
lea ecx, [ebp - 0x63dc]
call fcn.10001850
lea ecx, [ebp - 0x67f0]
call fcn.10001850
lea eax, [ebp - 0x3130]
push eax
call sub.RtlIhvOid.dll_Ordinal_6
add esp, 4
mov dword [ebp - 0x5334], eax
push 0x10077278
mov ecx, dword [ebp + 8]
add ecx, 0x32
push ecx
call fcn.10015ac0
add esp, 8
test eax, eax
je 0x10059f05
movzx edx, byte [ebp + 0x18]
test edx, edx
jne 0x10059f05
mov dword [ebp - 0x27f8], 0
lea eax, [ebp - 0x3130]
mov dword [ebp - 0x27f4], eax
jmp 0x10059f1b
mov dword [ebp - 0x27f8], 1
lea ecx, [ebp - 0x62e0]
mov dword [ebp - 0x27f4], ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x3154], eax
mov eax, dword [ebp - 0x3154]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x3150]
push edx
call fcn.10013640
add esp, 0xc
lea eax, [ebp - 0x3154]
mov dword [ebp - 0x27f0], eax
cmp dword [ebp + 0x14], 0
jne 0x10059f63
mov dword [ebp - 0x27e8], 2
jmp 0x10059fc8
cmp dword [ebp + 0x14], 1
jne 0x10059f75
mov dword [ebp - 0x27e8], 1
jmp 0x10059fc8
mov dword [ebp - 0x5334], 0x57
lea ecx, [ebp - 4]
call fcn.10004080
lea ecx, [ebp - 0x51a0]
call fcn.10004080
lea ecx, [ebp - 0x5198]
call fcn.10004080
lea ecx, [ebp - 0x632c]
call fcn.10001850
lea ecx, [ebp - 8]
call fcn.10001850
lea ecx, [ebp - 0x5338]
call fcn.10001850
lea ecx, [ebp - 0xc]
call fcn.10001850
jmp 0x1005a1e4
movzx ecx, byte [ebp - 0x5199]
test ecx, ecx
je 0x10059fdd
mov dword [ebp - 0x27e8], 3
mov dword [ebp - 0x27ec], 0
mov dword [ebp - 0x27e4], 0
movzx edx, byte [ebp - 0x5199]
test edx, edx
jne 0x1005a092
mov dword [ebp - 0x681c], 0x1e
mov dword [ebp - 0x6818], 0
mov eax, dword [ebp - 0x681c]
sub eax, 1
mov dword [ebp - 0x681c], eax
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
push 0
lea ecx, [ebp - 0x6814]
push ecx
call fcn.100139b0
add esp, 0xc
push 4
lea edx, [ebp - 0x6814]
push edx
push 0xff0101bd
push 0
call sub.RtlIhvOid.dll_Ordinal_2
add esp, 0x10
mov dword [ebp - 0x6818], eax
cmp dword [ebp - 0x6818], 0
je 0x1005a077
mov eax, dword [ebp - 0x6814]
shr eax, 8
mov dword [ebp - 0x6814], eax
cmp dword [ebp - 0x6814], 1
jne 0x1005a092
cmp dword [ebp - 0x6818], 0
je 0x1005a092
cmp dword [ebp - 0x681c], 0
jne 0x1005a014
lea ecx, [ebp - 0x27f8]
push ecx
call sub.RtlIhvOid.dll_Ordinal_18
add esp, 4
mov dword [ebp - 0x5334], eax
lea ecx, [ebp - 0x5194]
call fcn.10001af0
mov edx, dword [ebp - 0x5334]
push edx
push 0x1007727c
lea eax, [ebp - 0x5194]
push eax
call fcn.100025d0
add esp, 0xc
lea ecx, [ebp - 0x5194]
call fcn.10001ae0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movzx ecx, byte [ebp - 0x5199]
test ecx, ecx
je 0x1005a195
mov edx, dword [ebp + 8]
cmp dword [edx + 0x1bc], 0x40
je 0x1005a118
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1bc]
push ecx
mov edx, dword [ebp + 8]
add edx, 0xbc
push edx
call sym.RtlLib.dll_RT_AP_SetPassphrase
add esp, 8
jmp 0x1005a148
push 0
push 0x20
lea eax, [ebp - 0x6864]
push eax
push 0x40
mov ecx, dword [ebp + 8]
add ecx, 0xbc
push ecx
call fcn.10064910
add esp, 0x14
push 0x40
lea edx, [ebp - 0x6864]
push edx
call sym.RtlLib.dll_RT_AP_SetPassphrase
add esp, 8
push 0x20
mov eax, dword [ebp + 8]
add eax, 0x32
push eax
lea ecx, [ebp - 0x683c]
push ecx
call fcn.10013640
add esp, 0xc
mov dword [ebp - 0x6840], 0x24
mov dword [ebp - 0x6844], 0x64
mov edx, dword [ebp - 0x6844]
push edx
sub esp, 0x24
mov ecx, 9
lea esi, [ebp - 0x6840]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call sub.RtlIhvOid.dll_Ordinal_22
add esp, 0x28
lea ecx, [ebp - 0x5194]
call fcn.10001850
lea ecx, [ebp - 4]
call fcn.10004080
lea ecx, [ebp - 0x51a0]
call fcn.10004080
lea ecx, [ebp - 0x5198]
call fcn.10004080
lea ecx, [ebp - 0x632c]
call fcn.10001850
lea ecx, [ebp - 8]
call fcn.10001850
lea ecx, [ebp - 0x5338]
call fcn.10001850
lea ecx, [ebp - 0xc]
call fcn.10001850
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret