Function at 0x10001b40
Capabilities:
Access the windows event log
Check if file exists
Copy file
Delete file
Get common file path
Print debug messages
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100266c7
mov eax, dword fs:[0]
push eax
sub esp, 0x1e0
mov eax, dword [0x10030050]
xor eax, esp
mov dword [esp + 0x1d8], eax
push ebx
push esi
push edi
mov eax, dword [0x10030050]
xor eax, esp
push eax
lea eax, [esp + 0x1f0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
mov edi, edx
push ecx
lea esi, [esp + 0x9c]
mov dword [esp + 0x54], edi
call fcn.100088d0
lea esi, [edi + 0x10]
lea edx, [esp + 0x7c]
push edx
mov ecx, esi
mov dword [esp + 0x1fc], 0
mov dword [esp + 0x34], esi
call fcn.10003300
lea eax, [esp + 0xdc]
push eax
push 0x104
mov byte [esp + 0x200], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [edi + 8]
test eax, eax
je 0x10001c1e
push edi
call eax
test eax, eax
jne 0x10001c1e
mov esi, dword [esp + 0x80]
test esi, esi
je 0x10001c08
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x84]
push ecx
mov eax, esi
call fcn.10004730
add esp, 4
push esi
call fcn.1001274b
add esp, 4
lea eax, [esp + 0x94]
call fcn.10002e10
mov eax, 1
jmp 0x10002de8
lea edx, [esp + 0x94]
lea eax, [esp + 0x54]
push eax
mov ecx, edx
push ecx
mov dword [edi + 0x40], edx
call fcn.10008a40
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x98]
push eax
mov byte [esp + 0x200], 2
call fcn.10008c30
lea ecx, [esp + 0x20]
push 0x3ec
push ecx
mov byte [esp + 0x200], 3
call fcn.1000ce60
add esp, 8
push eax
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x68]
push eax
mov byte [esp + 0x204], 4
call fcn.100036e0
mov ebx, eax
mov byte [esp + 0x1f8], 5
call fcn.10003570
mov byte [esp + 0x1f8], 4
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10001cb8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10001cd8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 3
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10001d00
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push 0x3ed
push ecx
call fcn.1000ce60
add esp, 8
push eax
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x68]
push eax
mov byte [esp + 0x204], 6
call fcn.100036e0
mov ebx, eax
mov byte [esp + 0x1f8], 7
call fcn.10003570
mov byte [esp + 0x1f8], 6
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10001d61
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10001d81
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 3
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10001da9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor ebx, ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov byte [esp + 0x1f8], 8
mov edx, dword [0x100317f0]
mov eax, dword [edx + 0xc]
mov ecx, 0x100317f0
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x1f8], 9
mov edx, dword [0x100317f0]
mov eax, dword [edx + 0xc]
mov ecx, 0x100317f0
call eax
add eax, 0x10
mov dword [esp + 0x58], eax
mov edi, dword [esp + 0x4c]
add edi, 0x20
mov byte [esp + 0x1f8], 0xa
mov esi, dword [edi + 4]
cmp esi, dword [edi + 8]
mov dword [esp + 0x50], edi
jbe 0x10001e15
call fcn.10012f39
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], esi
lea ecx, [ecx]
mov esi, dword [edi + 8]
cmp dword [edi + 4], esi
jbe 0x10001e2d
call fcn.10012f39
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10001e39
cmp eax, edi
je 0x10001e3e
call fcn.10012f39
cmp dword [esp + 0x18], esi
je 0x10002184
add ebx, 1
push ebx
push 0x1002bbdc
lea edi, [esp + 0x60]
mov dword [esp + 0x74], ebx
call fcn.100044d0
lea ecx, [esp + 0x78]
push ecx
call fcn.1000c980
add esp, 0xc
mov esi, eax
lea edx, [esp + 0x78]
push edx
mov ecx, 0x1002bbb4
mov byte [esp + 0x1fc], 0xb
call fcn.10002ee0
lea ecx, [esp + 0x68]
push ecx
mov ecx, eax
lea edx, [esp + 0xe0]
mov byte [esp + 0x1fc], 0xc
call fcn.10003130
add esp, 4
lea edx, [esp + 0x74]
push esi
push edx
mov ecx, eax
mov byte [esp + 0x200], 0xd
call fcn.10002f90
lea ecx, [esp + 0x34]
push str._registry
push ecx
mov ecx, eax
mov byte [esp + 0x208], 0xe
call fcn.10003050
mov edx, edi
push edx
lea ecx, [esp + 0x5c]
push ecx
mov ecx, eax
mov byte [esp + 0x210], 0xf
call fcn.10002f90
lea edx, [esp + 0x38]
push str..reg
push edx
mov ecx, eax
mov byte [esp + 0x218], 0x10
call fcn.10003050
add esp, 0x20
mov byte [esp + 0x1f8], 0x11
mov ecx, dword [eax]
mov esi, dword [esp + 0x1c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x10001f5d
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x10001f50
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x10001f50
call fcn.10003b30
mov ebx, eax
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x10001f47
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [esp + 0x1c], ebx
jmp 0x10001f5d
mov edi, dword [ecx - 0xc]
push ecx
lea eax, [esp + 0x20]
call fcn.10003aa0
mov byte [esp + 0x1f8], 0x10
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10001f85
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 0xf
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10001fad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 0xe
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10001fd5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 0xd
mov eax, dword [esp + 0x74]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10001ffd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 0xc
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002025
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 0xb
mov eax, dword [esp + 0x78]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000204d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 0xa
mov eax, dword [esp + 0x70]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002075
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x1000208d
call fcn.10012f39
mov esi, dword [esp + 0x18]
cmp esi, dword [edi + 8]
jb 0x1000209b
call fcn.10012f39
mov edi, dword [esi]
push ebx
call fcn.1000d1c0
add esp, 4
test al, al
je 0x10002155
lea ebx, [esp + 0x1c]
lea esi, [esp + 0x38]
call fcn.10003250
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
cmp esi, dword [ecx + 8]
jb 0x100020cd
call fcn.10012f39
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.10003b30
add eax, 0x10
mov dword [esp + 0x24], eax
mov byte [esp + 0x1f8], 0x12
mov eax, dword [esi + 4]
sub eax, 0x10
call fcn.10003b30
lea edi, [eax + 0x10]
mov dword [esp + 0x28], edi
mov esi, dword [esp + 0x30]
lea ebx, [esp + 0x24]
mov byte [esp + 0x1f8], 0x13
call fcn.10003570
lea eax, [edi - 0x10]
mov byte [esp + 0x1f8], 0xa
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10002133
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002160
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x10002160
push str.Could_not_write_registry_hive_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
cmp edx, dword [ecx + 8]
jb 0x10002172
call fcn.10012f39
add dword [esp + 0x18], 8
mov ebx, dword [esp + 0x6c]
mov edi, dword [esp + 0x50]
jmp 0x10001e20
mov esi, dword [esp + 0x4c]
mov ebx, dword [esi + 0x34]
add esi, 0x30
cmp ebx, dword [esi + 8]
mov dword [esp + 0x24], esi
jbe 0x1000219c
call fcn.10012f39
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ebx
mov edi, dword [esi + 8]
cmp dword [esi + 4], edi
jbe 0x100021b1
call fcn.10012f39
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100021bd
cmp eax, esi
je 0x100021c2
call fcn.10012f39
cmp ebx, edi
je 0x1000265c
cmp dword [esp + 0x14], 0
jne 0x100021d6
call fcn.10012f39
mov eax, dword [esp + 0x14]
cmp ebx, dword [eax + 8]
jb 0x100021e4
call fcn.10012f39
mov eax, dword [ebx]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
test eax, eax
mov dword [esp + 0x2c], eax
je 0x10002628
lea ecx, [esp + 0x20]
push ecx
call fcn.1000c980
add esp, 4
mov esi, eax
lea edx, [esp + 0x74]
push edx
mov ecx, 0x1002bbb4
mov byte [esp + 0x1fc], 0x14
call fcn.10002ee0
lea ecx, [esp + 0x68]
push ecx
mov ecx, eax
lea edx, [esp + 0xe0]
mov byte [esp + 0x1fc], 0x15
call fcn.10003130
add esp, 4
lea edx, [esp + 0x78]
push esi
push edx
mov ecx, eax
mov byte [esp + 0x200], 0x16
call fcn.10002f90
lea ecx, [esp + 0x78]
push 0x1002bc1c
push ecx
mov ecx, eax
mov byte [esp + 0x208], 0x17
call fcn.10003050
add esp, 0x10
mov esi, eax
mov byte [esp + 0x1f8], 0x18
mov edx, dword [esp + 0x14]
cmp ebx, dword [edx + 8]
jb 0x10002288
call fcn.10012f39
lea eax, [esp + 0x6c]
push ebx
push eax
mov ecx, esi
call fcn.10002f90
lea ecx, [esp + 0x58]
push str..evt
push ecx
mov ecx, eax
mov byte [esp + 0x208], 0x19
call fcn.10003050
add esp, 0x10
mov byte [esp + 0x1f8], 0x1a
mov ecx, dword [eax]
mov edi, dword [esp + 0x1c]
lea eax, [ecx - 0x10]
lea esi, [edi - 0x10]
cmp eax, esi
je 0x10002313
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x10002302
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x10002302
call fcn.10003b30
mov ebx, eax
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x100022f5
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x18]
jmp 0x1000230f
mov edi, dword [ecx - 0xc]
push ecx
lea eax, [esp + 0x20]
call fcn.10003aa0
mov edi, dword [esp + 0x1c]
mov byte [esp + 0x1f8], 0x19
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000233b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 0x18
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002363
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 0x17
mov eax, dword [esp + 0x70]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000238b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 0x16
mov eax, dword [esp + 0x78]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100023b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 0x15
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100023db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 0x14
mov eax, dword [esp + 0x74]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002403
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 0xa
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000242b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x2c]
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_BackupEventLogA]
test eax, eax
je 0x10002610
mov edx, dword [esp + 0x14]
cmp ebx, dword [edx + 8]
jb 0x10002454
call fcn.10012f39
mov ecx, dword [edi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea esi, [edi - 0x10]
call edx
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x1000247b
cmp eax, dword [esi]
jne 0x1000247b
mov ebx, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x100024b1
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x10002657
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov eax, dword [esi + 4]
add eax, 1
push eax
add esi, 0x10
push esi
push eax
lea ecx, [ebx + 0x10]
push ecx
call fcn.10012795
add esp, 0x10
add ebx, 0x10
mov dword [esp + 0x60], ebx
mov byte [esp + 0x1f8], 0x1b
mov edx, dword [esp + 0x18]
mov esi, dword [edx + 4]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
sub esi, 0x10
call edx
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x100024ee
cmp eax, dword [esi]
jne 0x100024ee
mov ebx, esi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x10002524
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x10002657
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov eax, dword [esi + 4]
add eax, 1
push eax
add esi, 0x10
push esi
push eax
lea ecx, [ebx + 0x10]
push ecx
call fcn.10012795
add esp, 0x10
lea edi, [ebx + 0x10]
mov dword [esp + 0x64], edi
mov esi, dword [esp + 0x30]
lea ebx, [esp + 0x60]
mov byte [esp + 0x1f8], 0x1c
call fcn.10003570
lea eax, [edi - 0x10]
mov byte [esp + 0x1f8], 0xa
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10002564
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002584
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x3c]
test esi, esi
mov edx, dword [esp + 0x40]
je 0x100025dc
mov ecx, dword [esp + 0x44]
mov eax, edx
sub eax, esi
sub ecx, esi
sar eax, 2
sar ecx, 2
cmp eax, ecx
jae 0x100025dc
mov eax, dword [esp + 0x24]
mov byte [esp + 0x48], 0
mov ecx, dword [esp + 0x48]
push ecx
push eax
lea ecx, [esp + 0x24]
push ecx
push edx
mov ecx, 1
mov esi, edx
call fcn.10004690
mov ecx, dword [esp + 0x3c]
add esp, 0x10
add esi, 4
push ecx
mov dword [esp + 0x44], esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x10002633
cmp esi, edx
mov edi, edx
jbe 0x100025e7
call fcn.10012f39
push edi
lea eax, [esp + 0x3c]
push eax
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x48]
call fcn.10003830
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x10002633
push str.could_not_backup_log_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x10002633
push str.could_not_open_log_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp eax, dword [edx + 8]
jb 0x10002645
call fcn.10012f39
add dword [esp + 0x18], 8
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x24]
jmp 0x100021a4
call fcn.10001110
xor ecx, ecx
mov dword [esp + 0x2c], ecx
jmp 0x10002670
mov edx, dword [esp + 0xb0]
test edx, edx
je 0x10002929
mov eax, dword [esp + 0xb4]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x10002929
lea edx, [esp + 0x50]
push edx
mov edi, ecx
lea esi, [esp + 0x98]
call fcn.100090d0
mov byte [esp + 0x1f8], 0x1d
mov eax, dword [eax]
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
call fcn.10002ee0
mov byte [esp + 0x1f8], 0x1e
mov edx, dword [0x100317f0]
mov eax, dword [edx + 0xc]
mov ecx, 0x100317f0
call eax
add eax, 0x10
mov dword [esp + 0x48], eax
push 0x3ee
mov byte [esp + 0x1fc], 0x1f
call fcn.10007ce0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10002705
lea edx, [esp + 0x48]
push edx
mov eax, 0x3ee
call fcn.10004400
mov byte [esp + 0x1f8], 0x20
mov esi, dword [esp + 0x20]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
add esi, 0xfffffff0
call edx
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x10002738
cmp eax, dword [esi]
jne 0x10002738
mov edi, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x1000276e
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x10002657
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
add eax, 1
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.10012795
add esp, 0x10
add edi, 0x10
mov dword [esp + 0x14], edi
mov byte [esp + 0x1f8], 0x21
mov esi, dword [esp + 0x48]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x100027a8
cmp eax, dword [esi]
jne 0x100027a8
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x100027de
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x10002657
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
add eax, 1
push eax
lea ecx, [esi + 0x10]
push ecx
push eax
lea edx, [edi + 0x10]
push edx
call fcn.10012795
add esp, 0x10
add edi, 0x10
mov dword [esp + 0x18], edi
mov edi, dword [esp + 0x30]
mov byte [esp + 0x1f8], 0x22
mov eax, dword [edi + 4]
test eax, eax
jne 0x100027fc
xor edx, edx
jmp 0x10002804
mov edx, dword [edi + 8]
sub edx, eax
sar edx, 3
test eax, eax
je 0x10002840
mov ecx, dword [edi + 0xc]
sub ecx, eax
sar ecx, 3
cmp edx, ecx
jae 0x10002840
mov ebx, dword [edi + 8]
mov byte [esp + 0x24], 0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
push eax
push ecx
push ebx
lea ecx, [esp + 0x20]
mov edx, 1
call fcn.10004780
add esp, 0xc
add ebx, 8
mov dword [edi + 8], ebx
jmp 0x10002862
mov ebx, dword [edi + 8]
cmp eax, ebx
jbe 0x1000284c
call fcn.10012f39
push ebx
push edi
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x98]
push eax
mov eax, edi
call fcn.100038c0
mov byte [esp + 0x1f8], 0x20
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000288a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100028aa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 0x1e
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100028cb
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov byte [esp + 0x1f8], 0x1d
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100028f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 0xa
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000291b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add dword [esp + 0x2c], 1
mov ecx, dword [esp + 0x2c]
jmp 0x10002670
push str.Uninstall_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, dword [esp + 0x4c]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov byte [esi + 0x44], 0
lea esi, [esp + 0x34]
call fcn.1000caf0
xor ebx, ebx
mov dword [esp + 0x14], vtable.CZLib.0
mov dword [esp + 0x18], ebx
mov byte [esp + 0x1f8], 0x24
mov edx, dword [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x34]
push eax
call fcn.1000df79
add esp, 4
cmp eax, ebx
mov dword [esp + 0x18], eax
jne 0x10002abc
mov byte [esp + 0x1f8], 0xa
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100029b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 9
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100029d9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 8
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002a01
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 3
mov esi, dword [esp + 0x3c]
cmp esi, ebx
je 0x10002a52
mov eax, dword [esp + 0x40]
cmp esi, eax
mov edi, eax
je 0x10002a49
jmp 0x10002a20
mov eax, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002a3e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 4
cmp esi, edi
jne 0x10002a20
mov esi, dword [esp + 0x3c]
push esi
call fcn.1001274b
add esp, 4
mov byte [esp + 0x1f8], 2
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002a86
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 1
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002aae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x80]
cmp esi, ebx
jmp 0x10001be7
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
jbe 0x10002acd
call fcn.10012f39
mov esi, dword [ebx + 4]
cmp esi, dword [ebx + 8]
jbe 0x10002ae0
call fcn.10012f39
lea ebx, [ebx]
mov eax, ebx
mov edi, dword [eax + 8]
cmp dword [eax + 4], edi
jbe 0x10002af1
call fcn.10012f39
mov eax, ebx
test ebx, ebx
je 0x10002af9
cmp ebx, eax
je 0x10002afe
call fcn.10012f39
cmp esi, edi
je 0x10002b47
test ebx, ebx
jne 0x10002b0b
call fcn.10012f39
cmp esi, dword [ebx + 8]
jb 0x10002b15
call fcn.10012f39
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10002b38
cmp esi, dword [ebx + 8]
jb 0x10002b2c
call fcn.10012f39
mov ecx, dword [esi]
lea edx, [esp + 0x14]
push edx
call fcn.1000db8a
cmp esi, dword [ebx + 8]
jb 0x10002b42
call fcn.10012f39
add esi, 8
jmp 0x10002ae0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10002b54
call fcn.1000e6a0
lea eax, [esp + 0x24]
push 0
mov byte [esp + 0x1fc], 0x23
mov esi, dword [esp + 0x38]
push eax
call fcn.1000cbd0
mov eax, dword [eax]
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 8
push 0
push eax
push esi
call ebx
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002b9d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x24]
push 1
push ecx
call fcn.1000cbd0
mov eax, dword [eax]
add esp, 8
push 0
push eax
push esi
call ebx
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10002bd8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edx
mov byte [ecx + 0x45], 0
call esi
mov eax, dword [esp + 0x5c]
push eax
call esi
mov ecx, dword [esp + 0x34]
push ecx
call esi
mov esi, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
cmp esi, eax
jbe 0x10002c10
call fcn.10012f39
mov eax, dword [esp + 0x40]
lea ebx, [esp + 0x38]
cmp dword [esp + 0x3c], eax
mov edi, eax
jbe 0x10002c21
call fcn.10012f39
test ebx, ebx
je 0x10002c2d
lea edx, [esp + 0x38]
cmp ebx, edx
je 0x10002c32
call fcn.10012f39
cmp esi, edi
je 0x10002c65
test ebx, ebx
jne 0x10002c3f
call fcn.10012f39
cmp esi, dword [ebx + 8]
jb 0x10002c49
call fcn.10012f39
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, dword [ebx + 8]
jb 0x10002c5c
call fcn.10012f39
mov eax, dword [esp + 0x40]
add esi, 4
jmp 0x10002c14
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x7c]
push ecx
call fcn.100033e0
mov eax, dword [esp + 0x4c]
xor edx, edx
xor ebx, ebx
cmp byte [eax + 0x45], bl
mov dword [eax + 0x40], ebx
sete dl
mov byte [esp + 0x1f8], 0xa
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov dword [esp + 0x24], edx
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002cb0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 9
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002cd8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 8
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002d00
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 3
mov esi, dword [esp + 0x3c]
cmp esi, ebx
je 0x10002d52
mov eax, dword [esp + 0x40]
cmp esi, eax
mov edi, eax
je 0x10002d49
lea ebx, [ebx]
mov eax, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002d3e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 4
cmp esi, edi
jne 0x10002d20
mov esi, dword [esp + 0x3c]
push esi
call fcn.1001274b
add esp, 4
mov byte [esp + 0x1f8], 2
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002d86
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1f8], 1
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002dae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x80]
cmp esi, ebx
je 0x10002dd8
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x84]
push ecx
mov eax, esi
call fcn.10004730
add esp, 4
push esi
call fcn.1001274b
add esp, 4
lea eax, [esp + 0x94]
call fcn.10002e10
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1f0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1d8]
xor ecx, esp
call fcn.10012810
mov esp, ebp
pop ebp
ret 4