Function at 0x1006c0a
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], esi
call fcn.01006bbe
push 7
pop ecx
or eax, 0xffffffff
mov edi, 0x1009580
push 4
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0xc]
pop ebx
dec edi
add esi, ebx
jmp 0x1006f5d
mov eax, dword [esi]
movzx ecx, word [eax]
cmp cx, 0x2f
je 0x1006c6e
cmp cx, 0x2d
je 0x1006c6e
push eax
push 0x2728
call fcn.01006518
pop ecx
jmp 0x1006e35
movzx eax, word [eax + 2]
xor ecx, ecx
dec edi
inc ecx
add esi, ebx
cmp edi, ecx
jge 0x1006caa
cmp ax, 0x71
je 0x1006caa
cmp ax, 0x70
je 0x1006caa
cmp ax, 0x62
je 0x1006caa
cmp ax, 0x45
je 0x1006caa
cmp ax, 0x3f
je 0x1006caa
cmp ax, 0x63
je 0x1006caa
cmp ax, 0x64
jne 0x1007051
movzx eax, ax
cmp eax, 0x61
jg 0x1006dcc
je 0x1006dc0
cmp eax, 0x4d
jg 0x1006d50
je 0x1006d44
sub eax, 0x41
je 0x1006d38
dec eax
je 0x1006d2c
dec eax
je 0x1006d14
dec eax
dec eax
je 0x1006d09
dec eax
je 0x1006cfc
dec eax
dec eax
je 0x1006cf0
dec eax
jne 0x1007071
mov eax, dword [esi]
mov dword [0x10094c4], eax
jmp 0x1006c44
mov eax, dword [esi]
mov dword [0x10094ec], eax
jmp 0x1006c44
mov eax, dword [esi]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
jmp 0x1006c44
mov dword [0x10094f4], ecx
jmp 0x1006f5d
push 0x10094cc
push dword [esi]
call fcn.01006627
mov dword [ebp - 0x14], 1
jmp 0x1006c44
mov eax, dword [esi]
mov dword [0x100959c], eax
jmp 0x1006c44
mov eax, dword [esi]
mov dword [0x100952c], eax
jmp 0x1006c44
mov eax, dword [esi]
mov dword [0x10094d4], eax
jmp 0x1006c44
sub eax, 0x4e
je 0x1006db4
dec eax
je 0x1006da8
dec eax
je 0x1006d9c
dec eax
dec eax
je 0x1006d90
dec eax
je 0x1006d84
dec eax
je 0x1006d78
dec eax
jne 0x1007071
mov eax, dword [esi]
mov dword [0x1009534], eax
jmp 0x1006c44
mov eax, dword [esi]
mov dword [0x10094d0], eax
jmp 0x1006c44
mov eax, dword [esi]
mov dword [0x10094d8], eax
jmp 0x1006c44
mov eax, dword [esi]
mov dword [0x1009518], eax
jmp 0x1006c44
mov eax, dword [esi]
mov dword [0x10094e0], eax
jmp 0x1006c44
mov eax, dword [esi]
mov dword [0x1009508], eax
jmp 0x1006c44
mov eax, dword [esi]
mov dword [0x1009500], eax
jmp 0x1006c44
mov eax, dword [esi]
mov dword [0x1009024], eax
jmp 0x1006c44
cmp eax, 0x6f
jg 0x1006eec
je 0x1006ee0
sub eax, 0x62
je 0x1006ed8
dec eax
je 0x1006ecd
dec eax
je 0x1006ec2
dec eax
je 0x1006eb6
dec eax
je 0x1006e63
sub eax, 3
je 0x1006e3b
sub eax, 5
jne 0x1007071
cmp dword [ebp - 8], 7
jge 0x1006e2b
push dword [esi]
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov dword [ecx*4 + 0x1009580], eax
jmp 0x1006c44
push 0x282e
call fcn.01006518
pop ecx
jmp 0x1006c44
push dword [esi]
call dword [sym.imp.msvcrt.dll__wtoi]
dec edi
add esi, ebx
pop ecx
mov dword [0x100901c], eax
test eax, eax
jne 0x1006f5d
mov dword [0x100901c], 0x3e8
jmp 0x1006f5d
mov ebx, dword [esi]
push 0x10
dec edi
add esi, 4
call fcn.01006572
push 0x2c
push ebx
mov dword [0x1009504], eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x1006e99
xor ecx, ecx
mov word [eax], cx
add eax, 2
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [0x1009038], eax
push dword [0x1009504]
push ebx
call dword [sym.imp.RPCRT4.dll_UuidFromStringW]
test eax, eax
jne 0x1007069
push 4
pop ebx
jmp 0x1006f5d
mov eax, dword [esi]
mov dword [0x10094b8], eax
jmp 0x1006c44
mov dword [0x100953c], ecx
jmp 0x1006f5d
mov dword [0x1009520], ecx
jmp 0x1006f5d
mov dword [0x10094f8], ecx
jmp 0x1006f5d
mov eax, dword [esi]
mov dword [0x10094c0], eax
jmp 0x1006c44
sub eax, 0x70
je 0x1006f57
dec eax
je 0x1006f4f
dec eax
je 0x1006f3c
dec eax
je 0x1006f30
dec eax
je 0x1006f24
dec eax
je 0x1006f1a
dec eax
jne 0x1007071
push dword [esi]
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [0x1009034], eax
jmp 0x1006c44
mov eax, dword [esi]
mov dword [ebp - 0xc], eax
jmp 0x1006c44
mov eax, dword [esi]
mov dword [0x1009018], eax
jmp 0x1006c44
mov eax, dword [esi]
mov dword [0x10094bc], eax
jmp 0x1006c44
push dword [esi]
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [0x1009020], eax
jmp 0x1006c44
mov dword [0x100951c], ecx
jmp 0x1006f5d
mov dword [0x1009540], ecx
test edi, edi
jg 0x1006c4c
push 0x272a
call fcn.01006530
mov edi, dword [sym.imp.msvcrt.dll_wcstol]
xor esi, esi
pop ecx
cmp dword [ebp - 0xc], esi
je 0x1006faf
push 0xa
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
call edi
mov dword [0x10094fc], eax
mov eax, dword [ebp - 4]
add esp, 0xc
cmp word [eax], si
je 0x1006faf
push 0x1004378
push dword [ebp - 0xc]
push 0x10090b8
call fcn.0100673e
mov dword [0x10094fc], eax
push 0x1004330
push dword [0x1009024]
push 0x1009040
call fcn.0100673e
xor ebx, ebx
inc ebx
mov dword [0x1009028], eax
cmp eax, ebx
je 0x10070be
cmp dword [0x10094fc], esi
je 0x10070b0
mov dword [0x100950c], ebx
cmp dword [0x10094c4], 0
mov esi, 0x1004278
je 0x100700f
push esi
call fcn.0100666d
push 0x10094c8
push 0x1004264
push dword [0x10094c4]
call fcn.01006965
cmp dword [ebp - 0x14], 0
je 0x100701b
push esi
call fcn.0100666d
cmp dword [0x10094d0], 0
je 0x10070d1
push 0x10041a8
call fcn.0100666d
push 0x1004160
push dword [0x10094d0]
push 0x1009078
call fcn.0100673e
mov dword [0x100902c], eax
jmp 0x10070e0
movzx eax, ax
push eax
push 0x2729
call fcn.01006518
pop ecx
pop ecx
push 1
call dword [sym.imp.msvcrt.dll_exit]
push ebx
push 0x281c
jmp 0x100705a
push 0x2711
call fcn.01006518
mov dword [esp], 0x2712
call fcn.01006518
mov dword [esp], 0x2713
call fcn.01006518
mov dword [esp], 0x2714
call fcn.01006518
mov dword [esp], 0x2715
call fcn.01006518
pop ecx
push 0
jmp 0x1007063
push 0x281d
call fcn.01006518
pop ecx
push ebx
jmp 0x1007063
cmp dword [0x10094fc], esi
je 0x1006fe6
push 0x281e
jmp 0x10070b5
cmp dword [0x100950c], 0
je 0x10070e0
mov dword [0x100902c], ebx
cmp dword [0x10094d4], 0
je 0x100710f
push 0x10040a0
call fcn.0100666d
push 0x1004060
push dword [0x10094d4]
push 0x1009090
call fcn.0100673e
mov dword [0x1009030], eax
jmp 0x1007122
cmp dword [0x100950c], 0
je 0x1007122
mov dword [0x1009030], 3
cmp dword [0x10094d8], 0
je 0x100715f
push 0x1003fb8
call fcn.0100666d
push 0x10094dc
push dword [0x10094d8]
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
jne 0x100715f
push dword [0x10094d8]
push 0x281f
call fcn.01006518
pop ecx
jmp 0x10070ba
cmp dword [0x10094e0], 0
je 0x10071a0
push 0x1003fac
call fcn.0100669b
cmp dword [0x10094ec], 0
jne 0x1007185
push 0x282f
jmp 0x10070b5
push 0x10094e4
push 0x1003f8c
push dword [0x10094e0]
call fcn.01006965
mov dword [0x1009510], ebx
cmp dword [0x100952c], 0
je 0x10071e1
push 0x1003f84
call fcn.0100669b
cmp dword [0x1009534], 0
jne 0x10071c6
push 0x2820
jmp 0x10070b5
push 0x1009530
push 0x1003f6c
push dword [0x100952c]
call fcn.01006965
mov dword [0x1009510], ebx
cmp dword [ebp - 0x18], 0
je 0x1007273
mov esi, dword [ebp - 0x1c]
push 0x10
lea eax, [ebp - 4]
push eax
push esi
call edi
mov eax, dword [ebp - 4]
add esp, 0xc
cmp word [eax], 0
je 0x1007258
mov eax, esi
push 0x2c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x1007220
inc dword [ebp - 0x10]
xor ecx, ecx
mov word [eax], cx
inc eax
inc eax
jne 0x1007205
mov edi, dword [ebp - 0x10]
inc edi
je 0x1007263
push 0x1003f38
push esi
push 0x1009130
call fcn.0100673e
or dword [0x10094e8], eax
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1007241
sub eax, edx
sar eax, 1
dec edi
lea esi, [esi + eax*2 + 2]
jne 0x1007226
jmp 0x1007263
push 0x10094e8
push esi
call fcn.01006627
push 0x1003f30
call fcn.0100669b
mov dword [0x1009510], ebx
cmp dword [0x10094ec], 0
je 0x1007388
push 0x1003f28
call fcn.0100669b
mov eax, dword [0x10094ec]
push 0x2c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x10072ad
inc dword [0x10094f0]
xor ecx, ecx
mov word [eax], cx
inc eax
inc eax
jne 0x100728f
inc dword [0x10094f0]
mov eax, dword [0x10094f0]
shl eax, 2
push eax
call fcn.01006572
mov edi, dword [0x10094ec]
xor ebx, ebx
mov dword [0x100956c], eax
cmp dword [0x10094f0], ebx
jbe 0x100737b
push 0xa
lea eax, [ebp - 4]
push eax
mov esi, ebx
push edi
shl esi, 2
call dword [sym.imp.msvcrt.dll_wcstol]
mov ecx, dword [0x100956c]
mov dword [esi + ecx], eax
mov eax, dword [ebp - 4]
add esp, 0xc
cmp word [eax], 0
je 0x100731a
push 0x1003ee8
push edi
push 0x10090f8
call fcn.0100673e
mov ecx, dword [0x100956c]
mov dword [esi + ecx], eax
mov eax, dword [0x100956c]
cmp dword [esi + eax], 1
jne 0x1007340
test byte [0x10094e8], 1
jne 0x1007340
push 0x1003e28
call fcn.010066e0
test eax, eax
je 0x1007061
mov eax, dword [0x100956c]
cmp dword [esi + eax], 0x10000
jne 0x1007357
cmp dword [0x1009520], 0
je 0x10073ae
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100735c
sub eax, edx
sar eax, 1
inc ebx
lea edi, [edi + eax*2 + 2]
cmp ebx, dword [0x10094f0]
jb 0x10072da
xor ebx, ebx
mov dword [0x1009510], 1
inc ebx
cmp dword [0x100959c], 0
je 0x10073c3
push 0x1003e1c
call fcn.0100669b
test byte [0x10094e8], 1
jne 0x10073bd
push 0x2821
jmp 0x10070b5
push 0x2835
call fcn.01006518
jmp 0x1007060
mov dword [0x1009510], ebx
cmp dword [0x10094f8], 0
je 0x1007402
push 0x1003e14
call fcn.0100669b
test byte [0x10094e8], 1
jne 0x10073e9
push 0x2822
jmp 0x10070b5
cmp dword [0x10094f4], 0
jne 0x10073fc
push 0x2823
jmp 0x10070b5
mov dword [0x1009510], ebx
xor ecx, ecx
cmp dword [0x1009520], ecx
je 0x1007498
cmp dword [0x10094fc], 0xe
jne 0x1007431
cmp dword [0x10094c4], ecx
je 0x100742b
push 0x2834
jmp 0x10070b5
mov dword [0x1009528], ebx
cmp dword [0x10094f0], ebx
jne 0x1007471
mov eax, dword [0x100956c]
cmp dword [eax], 0x10000
jne 0x1007471
mov dword [0x1009524], ebx
cmp dword [0x10094e0], ecx
je 0x100745e
push 0x2824
jmp 0x10070b5
test byte [0x10094e8], 1
jne 0x1007471
push 0x2825
jmp 0x10070b5
mov eax, dword [0x1009528]
cmp eax, ecx
jne 0x100748c
cmp dword [0x1009524], ecx
jne 0x100748c
push 0x2826
jmp 0x10070b5
push eax
push dword [0x1009524]
call fcn.01006840
cmp dword [0x1009534], 0
je 0x10075a4
push 0x1003e0c
call fcn.0100669b
mov eax, dword [0x1009534]
push 0x2c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x10074d2
inc dword [0x1009538]
xor ecx, ecx
mov word [eax], cx
inc eax
inc eax
jne 0x10074b4
inc dword [0x1009538]
mov eax, dword [0x1009538]
shl eax, 2
push eax
call fcn.01006572
mov edi, dword [0x1009534]
xor ebx, ebx
mov dword [0x1009570], eax
cmp dword [0x1009538], ebx
jbe 0x1007597
push 0xa
lea eax, [ebp - 4]
push eax
mov esi, ebx
push edi
shl esi, 2
call dword [sym.imp.msvcrt.dll_wcstol]
mov ecx, dword [0x1009570]
mov dword [esi + ecx], eax
mov eax, dword [ebp - 4]
add esp, 0xc
cmp word [eax], 0
je 0x100753f
push 0x1003ee8
push edi
push 0x10090f8
call fcn.0100673e
mov ecx, dword [0x1009570]
mov dword [esi + ecx], eax
mov eax, dword [0x1009570]
cmp dword [esi + eax], 1
jne 0x1007565
test byte [0x10094e8], 1
jne 0x1007565
push 0x1003e28
call fcn.010066e0
test eax, eax
je 0x1007061
mov eax, dword [0x1009570]
cmp dword [esi + eax], 0x10000
je 0x10075c0
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1007578
sub eax, edx
sar eax, 1
inc ebx
lea edi, [edi + eax*2 + 2]
cmp ebx, dword [0x1009538]
jb 0x10074ff
xor ebx, ebx
mov dword [0x1009510], 1
inc ebx
xor eax, eax
cmp dword [0x1009518], eax
je 0x10075ca
cmp dword [0x10094f4], eax
jne 0x10075d2
push 0x2828
jmp 0x10070b5
push 0x2827
jmp 0x10073b3
cmp dword [0x10094f4], eax
je 0x1007604
push 0x1003e04
call fcn.0100669b
push dword [0x10094c0]
call fcn.01006afc
cmp dword [0x10094b8], 0
jne 0x10075f9
cmp dword [0x1009504], 0
je 0x1007604
push 0x2829
call fcn.01006530
pop ecx
cmp dword [0x1009540], 0
pop edi
pop esi
pop ebx
je 0x100761a
push 0x1003d58
call fcn.0100666d
leave
ret 8