Function at 0x100052c0
Capabilities:
Encode data using base64
Schedule task via itaskservice

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ffe1
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xbe8
mov eax, dword [0x1002c014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xab8], edx
mov esi, ecx
mov eax, dword [ebx + 8]
lea edx, [ecx + 2]
mov dword [ebp - 0xac8], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0xa30], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0xa0c], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0xa58], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x9e8], eax
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x9e0], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0xa10], eax
mov eax, dword [ebx + 0x28]
mov dword [ebp - 0x9ec], 0
mov dword [ebp - 0xa70], eax
xor eax, eax
mov dword [ebp - 0x8c8], 0
mov dword [ebp - 0x8b8], 0
mov dword [ebp - 0x8b4], 0
mov dword [ebp - 0x8b8], 0
mov dword [ebp - 0x8b4], 7
mov word [ebp - 0x8c8], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100053a0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x8c8]
call fcn.10003b20
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x8c8]
call fcn.100048e0
mov dword [ebp - 0xa2c], 0
mov byte [ebp - 4], 2
lea eax, [ebp - 0xa2c]
push eax
push 0x10022260
push 1
push 0
push 0x100222c0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0x10008205
mov esi, dword [ebp - 0xa2c]
mov eax, dword [esi]
mov edi, dword [eax + 0x28]
lea eax, [ebp - 0xbf8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 4
lea eax, [ebp - 0xbb8]
movups xmm0, xmmword [ebp - 0xbf8]
push eax
movups xmmword [ebp - 0xae0], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 5
lea eax, [ebp - 0xba8]
movups xmm0, xmmword [ebp - 0xbb8]
push eax
movups xmmword [ebp - 0xb50], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 6
lea eax, [ebp - 0xbe8]
movups xmm0, xmmword [ebp - 0xba8]
push eax
movups xmmword [ebp - 0xb98], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 7
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xae0]
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xb50]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xb98]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0xbe8]
push esi
movups xmmword [eax], xmm0
call edi
mov edi, eax
mov byte [ebp - 4], 6
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0xbe8]
push eax
call esi
mov byte [ebp - 4], 5
lea eax, [ebp - 0xba8]
push eax
call esi
mov byte [ebp - 4], 4
lea eax, [ebp - 0xbb8]
push eax
call esi
mov byte [ebp - 4], 2
lea eax, [ebp - 0xbf8]
push eax
call esi
test edi, edi
js 0x10008205
mov dword [ebp - 0xa4c], 0
mov byte [ebp - 4], 0xa
mov esi, dword [ebp - 0xa2c]
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x9dc], eax
call fcn.10010295
mov edi, eax
add esp, 4
mov dword [ebp - 0xa00], edi
mov byte [ebp - 4], 0xb
test edi, edi
je 0x1000555b
mov dword [edi + 4], 0
push 0x10027328
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
je 0x10008280
jmp 0x1000555d
xor edi, edi
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xab0], edi
test edi, edi
je 0x10008280
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0xab0]
test eax, eax
je 0x10005581
mov eax, dword [eax]
jmp 0x10005583
xor eax, eax
lea ecx, [ebp - 0xa4c]
push ecx
push eax
push esi
call dword [ebp - 0x9dc]
mov edi, eax
mov byte [ebp - 4], 0xa
mov esi, dword [ebp - 0xab0]
test esi, esi
je 0x100055f0
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x100055e6
test esi, esi
je 0x100055e6
mov eax, dword [esi]
test eax, eax
je 0x100055c4
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100055db
push eax
call fcn.1000fd2a
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1000fd64
add esp, 8
mov dword [ebp - 0xab0], 0
test edi, edi
js 0x100081f6
mov esi, dword [ebp - 0xa4c]
cmp dword [ebp - 0x8b4], 8
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xa00], eax
lea eax, [ebp - 0x8c8]
cmovae eax, dword [ebp - 0x8c8]
mov dword [ebp - 0x9dc], eax
call fcn.10010295
mov edi, eax
add esp, 4
mov dword [ebp - 0x9fc], edi
mov byte [ebp - 4], 0xf
test edi, edi
je 0x1000566b
push dword [ebp - 0x9dc]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x1000566d
cmp dword [ebp - 0x9dc], eax
jne 0x10008280
jmp 0x1000566d
xor edi, edi
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xaac], edi
test edi, edi
je 0x10008280
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0xaac]
test eax, eax
je 0x10005691
mov eax, dword [eax]
jmp 0x10005693
xor eax, eax
push 0
push eax
push esi
call dword [ebp - 0xa00]
mov byte [ebp - 4], 0xa
mov esi, dword [ebp - 0xaac]
test esi, esi
je 0x100056f9
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x100056ef
test esi, esi
je 0x100056ef
mov eax, dword [esi]
test eax, eax
je 0x100056cd
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100056e4
push eax
call fcn.1000fd2a
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1000fd64
add esp, 8
mov dword [ebp - 0xaac], 0
mov dword [ebp - 0xa08], 0
mov byte [ebp - 4], 0x12
lea edx, [ebp - 0xa08]
mov eax, dword [ebp - 0xa2c]
push edx
push 0
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x24]
call ecx
mov edi, eax
test edi, edi
js 0x100081e7
mov dword [ebp - 0xa48], 0
mov byte [ebp - 4], 0x17
lea edx, [ebp - 0xa48]
mov eax, dword [ebp - 0xa08]
push edx
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x1c]
call ecx
mov edi, eax
test edi, edi
js 0x100081d8
mov esi, dword [ebp - 0xa48]
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0xa00], eax
call fcn.10010295
mov edi, eax
add esp, 4
mov dword [ebp - 0x9fc], edi
mov byte [ebp - 4], 0x1c
test edi, edi
je 0x100057ae
push dword [ebp - 0xa0c]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x100057b0
cmp dword [ebp - 0xa0c], eax
jne 0x10008280
jmp 0x100057b0
xor edi, edi
mov byte [ebp - 4], 0x17
mov dword [ebp - 0xaa8], edi
test edi, edi
je 0x10008280
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0xaa8]
test eax, eax
je 0x100057d4
mov eax, dword [eax]
jmp 0x100057d6
xor eax, eax
push eax
push esi
call dword [ebp - 0xa00]
mov edi, eax
mov byte [ebp - 4], 0x17
mov esi, dword [ebp - 0xaa8]
test esi, esi
je 0x1000583c
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x10005832
test esi, esi
je 0x10005832
mov eax, dword [esi]
test eax, eax
je 0x10005810
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10005827
push eax
call fcn.1000fd2a
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1000fd64
add esp, 8
mov dword [ebp - 0xaa8], 0
test edi, edi
js 0x100081d8
mov esi, dword [ebp - 0xa48]
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0xa00], eax
call fcn.10010295
mov edi, eax
add esp, 4
mov dword [ebp - 0x9fc], edi
mov byte [ebp - 4], 0x22
test edi, edi
je 0x1000589d
push dword [ebp - 0x9e8]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x1000589f
cmp dword [ebp - 0x9e8], eax
jne 0x10008280
jmp 0x1000589f
xor edi, edi
mov byte [ebp - 4], 0x17
mov dword [ebp - 0xaa4], edi
test edi, edi
je 0x10008280
mov byte [ebp - 4], 0x23
mov eax, dword [ebp - 0xaa4]
test eax, eax
je 0x100058c3
mov eax, dword [eax]
jmp 0x100058c5
xor eax, eax
push eax
push esi
call dword [ebp - 0xa00]
mov edi, eax
mov byte [ebp - 4], 0x17
mov esi, dword [ebp - 0xaa4]
test esi, esi
je 0x1000592b
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x10005921
test esi, esi
je 0x10005921
mov eax, dword [esi]
test eax, eax
je 0x100058ff
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10005916
push eax
call fcn.1000fd2a
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1000fd64
add esp, 8
mov dword [ebp - 0xaa4], 0
test edi, edi
js 0x100081d8
mov dword [ebp - 0x9f4], 0
mov byte [ebp - 4], 0x29
lea edx, [ebp - 0x9f4]
mov eax, dword [ebp - 0xa08]
push edx
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x2c]
call ecx
mov edi, eax
test edi, edi
js 0x100081c9
mov eax, dword [ebp - 0x9f4]
mov esi, dword [ebp - 0xa10]
mov ecx, dword [eax]
push dword [esi]
push eax
mov ecx, dword [ecx + 0x38]
call ecx
mov edi, eax
test edi, edi
js 0x100081c9
push 2
xor eax, eax
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x858], 0
lea ecx, [ebp - 0x868]
mov dword [ebp - 0x854], 0
push 0x100273d0
mov dword [ebp - 0x858], 0
mov dword [ebp - 0x854], 7
mov word [ebp - 0x868], ax
call fcn.10003b20
mov byte [ebp - 4], 0x34
mov ecx, dword [esi + 4]
mov byte [ebp - 4], 0x35
lea edx, [ebp - 0x220]
call fcn.1000afc0
xor eax, eax
mov dword [ebp - 0x9a8], 0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x998], 0
mov dword [ebp - 0x994], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x998], 0
mov dword [ebp - 0x994], 7
mov word [ebp - 0x9a8], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005a27
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x9a8]
call fcn.10003b20
cmp dword [ebp - 0x994], 8
lea edx, [ebp - 0x9a8]
mov ecx, dword [ebp - 0x858]
cmovae edx, dword [ebp - 0x9a8]
mov eax, dword [ebp - 0x854]
mov edi, dword [ebp - 0x998]
sub eax, ecx
mov dword [ebp - 0x9ec], 4
mov dword [ebp - 0xa10], ecx
cmp edi, eax
ja 0x10005ac3
cmp dword [ebp - 0x854], 8
lea eax, [edi + ecx]
lea esi, [ebp - 0x868]
mov dword [ebp - 0x858], eax
cmovae esi, dword [ebp - 0x868]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.100115d0
mov eax, dword [ebp - 0xa10]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x10005ad7
push edi
push edx
push dword [ebp - 0x9fc]
lea ecx, [ebp - 0x868]
push edi
call fcn.100037b0
mov eax, 4
mov dword [ebp - 0x9ec], eax
and eax, 0xfffffffb
mov dword [ebp - 0x9ec], eax
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x9a8]
call fcn.100040e0
mov esi, dword [ebp - 0x854]
mov edi, 0x4d
mov edx, dword [ebp - 0x858]
mov eax, esi
sub eax, edx
cmp eax, 1
jb 0x10005b39
cmp esi, 8
lea eax, [ebp - 0x868]
lea ecx, [edx + 1]
cmovae eax, dword [ebp - 0x868]
mov dword [ebp - 0x858], ecx
mov word [eax + edx*2], di
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x10005b53
push 1
push 0x10027444
push dword [ebp - 0x9fc]
lea ecx, [ebp - 0x868]
push 1
call fcn.100037b0
mov esi, dword [ebp - 0x9f4]
cmp dword [ebp - 0x854], 8
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x70]
mov dword [ebp - 0xa10], eax
lea eax, [ebp - 0x868]
cmovae eax, dword [ebp - 0x868]
mov dword [ebp - 0x9e8], eax
call fcn.10010295
mov edi, eax
add esp, 4
mov dword [ebp - 0x9fc], edi
mov byte [ebp - 4], 0x36
test edi, edi
je 0x10005bc6
push dword [ebp - 0x9e8]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x10005bc8
cmp dword [ebp - 0x9e8], eax
jne 0x10008280
jmp 0x10005bc8
xor edi, edi
mov byte [ebp - 4], 0x34
mov dword [ebp - 0xaa0], edi
test edi, edi
je 0x10008280
mov byte [ebp - 4], 0x37
mov eax, dword [ebp - 0xaa0]
test eax, eax
je 0x10005bec
mov eax, dword [eax]
jmp 0x10005bee
xor eax, eax
push eax
push esi
call dword [ebp - 0xa10]
mov edi, eax
mov byte [ebp - 4], 0x34
mov esi, dword [ebp - 0xaa0]
test esi, esi
je 0x10005c54
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x10005c4a
test esi, esi
je 0x10005c4a
mov eax, dword [esi]
test eax, eax
je 0x10005c28
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10005c3f
push eax
call fcn.1000fd2a
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1000fd64
add esp, 8
mov dword [ebp - 0xaa0], 0
test edi, edi
jns 0x10005c67
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x868]
jmp 0x100081c4
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x868]
call fcn.100040e0
mov esi, dword [ebx + 0x1c]
test esi, 0x4000
je 0x10005c91
mov eax, dword [ebp - 0x9f4]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x58]
call ecx
test esi, 0x400
je 0x10005ca9
mov eax, dword [ebp - 0x9f4]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x68]
call ecx
test esi, 0x200
je 0x10005cc4
mov eax, dword [ebp - 0x9f4]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x98]
call ecx
mov eax, dword [ebp - 0x9f4]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x48]
test esi, 0x10000
je 0x10005cdb
push 0xffffffffffffffff
jmp 0x10005cdd
push 0
push eax
call ecx
mov eax, dword [ebp - 0x9f4]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x40]
test esi, 0x20000
je 0x10005cf7
push 0xffffffffffffffff
jmp 0x10005cf9
push 0
push eax
call ecx
mov esi, dword [ebp - 0xa70]
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x940], 0
mov dword [ebp - 0x930], 0
mov dword [ebp - 0x92c], 0
mov dword [ebp - 0x930], 0
mov dword [ebp - 0x92c], 7
lea edx, [ecx + 2]
mov word [ebp - 0x940], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005d42
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x940]
call fcn.10003b20
mov byte [ebp - 4], 0x3d
lea edi, [ebp - 0x940]
cmp dword [ebp - 0x92c], 8
cmovae edi, dword [ebp - 0x940]
cmp dword [ebp - 0x930], 3
jne 0x10005dc7
movzx ecx, word [edi]
mov edx, 0x32
mov esi, 3
mov eax, 0x100273d8
cmp ecx, edx
jb 0x10005dc7
sub edi, eax
cmp cx, dx
ja 0x10005dc7
cmp esi, 1
je 0x10005db4
movzx ecx, word [eax + edi + 2]
add eax, 2
dec esi
movzx edx, word [eax]
cmp cx, dx
jae 0x10005d9a
jmp 0x10005dc7
mov eax, dword [ebp - 0x9f4]
push 6
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x90]
call ecx
mov eax, dword [ebp - 0x9f4]
mov esi, dword [ebx + 0x1c]
mov ecx, dword [eax]
mov ecx, dword [ecx + 0xb0]
test esi, 0x80000
je 0x10005de4
push 0xffffffffffffffff
jmp 0x10005de6
push 0
push eax
call ecx
test esi, 0x8000
je 0x10005e4e
mov dword [ebp - 0xa38], 0
mov byte [ebp - 4], 0x3f
lea edx, [ebp - 0xa38]
mov eax, dword [ebp - 0xa08]
push edx
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x3c]
call ecx
mov edi, eax
test edi, edi
js 0x10005ed8
mov eax, dword [ebp - 0xa38]
push 1
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x48]
call ecx
mov edi, eax
test edi, edi
js 0x10005ed8
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0xa38]
test eax, eax
je 0x10005e4e
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 8]
call eax
mov dword [ebp - 0x9f8], 0
mov byte [ebp - 4], 0x4e
lea edx, [ebp - 0x9f8]
mov eax, dword [ebp - 0xa08]
push edx
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x24]
call ecx
mov edi, eax
test edi, edi
js 0x100081ab
mov ecx, dword [ebp - 0x9e0]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x9dc], eax
mov dword [ebp - 0xa00], ecx
cmp eax, ecx
je 0x100074d2
xorps xmm0, xmm0
movsd qword [ebp - 0xb48], xmm0
nop word [eax + eax]
mov dword [ebp - 0x9f0], 0
mov byte [ebp - 4], 0x56
mov eax, dword [eax]
dec eax
mov byte [ebp - 0x9e1], 0
cmp eax, 0xc
ja case.default.0x10005ed1
jmp dword [eax*4 + 0x100082a8]
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0xa38]
test eax, eax
je 0x100081ba
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 8]
call eax
jmp 0x100081ba
mov eax, dword [ebp - 0x9f8]
lea edx, [ebp - 0x9f0]
push edx
push 2
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x28]
call ecx
mov edi, eax
test edi, edi
js 0x10007664
mov dword [ebp - 0xa3c], 0
mov byte [ebp - 4], 0x5f
lea edx, [ebp - 0xa3c]
mov eax, dword [ebp - 0x9f0]
push edx
push 0x10022250
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx]
call ecx
mov edi, eax
test edi, edi
js 0x100075c6
mov eax, dword [ebp - 0xa3c]
mov edi, dword [ebp - 0x9dc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x54]
movzx ecx, word [edi + 4]
push ecx
push eax
call edx
mov byte [ebp - 0x9e1], 1
mov byte [ebp - 4], 0x56
mov eax, dword [ebp - 0xa3c]
test eax, eax
je 0x100069e9
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 8]
call eax
jmp 0x100069e9
mov eax, dword [ebp - 0x9f8]
lea edx, [ebp - 0x9f0]
push edx
push 3
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x28]
call ecx
mov edi, eax
test edi, edi
js 0x10007664
mov dword [ebp - 0xa1c], 0
mov byte [ebp - 4], 0x71
lea edx, [ebp - 0xa1c]
mov eax, dword [ebp - 0x9f0]
push edx
push 0x100222b0
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx]
call ecx
mov edi, eax
test edi, edi
js 0x100075d2
mov eax, dword [ebp - 0xa1c]
mov edi, dword [ebp - 0x9dc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x5c]
movzx ecx, word [edi + 4]
push ecx
push eax
call edx
mov eax, dword [ebp - 0xa1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x54]
movzx ecx, word [edi + 0xc]
push ecx
push eax
call edx
mov byte [ebp - 0x9e1], 1
mov byte [ebp - 4], 0x56
mov eax, dword [ebp - 0xa1c]
jmp 0x10005f73
mov eax, dword [ebp - 0x9f8]
lea edx, [ebp - 0x9f0]
push edx
push 4
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x28]
call ecx
mov edi, eax
test edi, edi
js 0x10007664
mov dword [ebp - 0xa20], 0
mov byte [ebp - 4], 0x83
lea edx, [ebp - 0xa20]
mov eax, dword [ebp - 0x9f0]
push edx
push 0x100222a0
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx]
call ecx
mov edi, eax
test edi, edi
js 0x100075de
mov eax, dword [ebp - 0xa20]
mov edx, 1
mov edi, dword [ebp - 0x9dc]
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, dword [edi + 4]
dec ecx
shl edx, cl
push edx
push eax
call esi
mov eax, dword [ebp - 0xa20]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x5c]
movzx ecx, word [edi + 0xc]
push ecx
push eax
call edx
mov byte [ebp - 0x9e1], 1
mov byte [ebp - 4], 0x56
mov eax, dword [ebp - 0xa20]
jmp 0x10005f73
mov eax, dword [ebp - 0x9f8]
lea edx, [ebp - 0x9f0]
push edx
push 5
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x28]
call ecx
mov edi, eax
test edi, edi
js 0x10007664
mov dword [ebp - 0xa14], 0
mov byte [ebp - 4], 0x95
lea edx, [ebp - 0xa14]
mov eax, dword [ebp - 0x9f0]
push edx
push 0x10022280
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx]
call ecx
mov edi, eax
test edi, edi
js 0x100075ea
mov eax, dword [ebp - 0xa14]
mov edx, 1
mov edi, dword [ebp - 0x9dc]
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, dword [edi + 4]
shl dx, cl
movzx ecx, dx
push ecx
push eax
call esi
mov eax, dword [ebp - 0xa14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x64]
movzx ecx, word [edi + 0xc]
push ecx
push eax
call edx
mov eax, dword [ebp - 0xa14]
mov edx, 1
mov ecx, dword [eax]
mov esi, dword [ecx + 0x5c]
mov ecx, dword [edi + 8]
dec ecx
shl dx, cl
movzx ecx, dx
push ecx
push eax
call esi
mov byte [ebp - 0x9e1], 1
mov byte [ebp - 4], 0x56
mov eax, dword [ebp - 0xa14]
jmp 0x10005f73
mov eax, dword [ebp - 0x9f8]
lea edx, [ebp - 0x9f0]
push edx
push 6
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x28]
call ecx
mov edi, eax
test edi, edi
js 0x10007664
mov dword [ebp - 0xa34], 0
mov byte [ebp - 4], 0xa7
lea edx, [ebp - 0xa34]
mov eax, dword [ebp - 0x9f4]
push edx
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x9c]
call ecx
mov edi, eax
test edi, edi
js 0x10007614
push 2
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x840], 0
lea ecx, [ebp - 0x850]
mov dword [ebp - 0x83c], 0
push 0x100273d0
mov dword [ebp - 0x840], 0
mov dword [ebp - 0x83c], 7
mov word [ebp - 0x850], ax
call fcn.10003b20
mov byte [ebp - 4], 0xb0
mov eax, dword [ebp - 0x9dc]
movzx ecx, word [eax + 4]
mov byte [ebp - 4], 0xb1
lea edx, [ebp - 0x220]
call fcn.1000afc0
xor eax, eax
mov dword [ebp - 0x990], 0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x980], 0
mov dword [ebp - 0x97c], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x980], 0
mov dword [ebp - 0x97c], 7
mov word [ebp - 0x990], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006272
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x990]
call fcn.10003b20
mov edi, dword [ebp - 0x9ec]
lea ecx, [ebp - 0x990]
or edi, 8
mov dword [ebp - 0x9ec], edi
cmp dword [ebp - 0x97c], 8
mov esi, dword [ebp - 0x840]
cmovae ecx, dword [ebp - 0x990]
mov eax, dword [ebp - 0x83c]
mov edx, dword [ebp - 0x980]
sub eax, esi
mov dword [ebp - 0xa70], edx
mov dword [ebp - 0x9e0], ecx
mov dword [ebp - 0x9e8], esi
cmp edx, eax
ja 0x1000632e
cmp dword [ebp - 0x83c], 8
lea eax, [edx + esi]
mov dword [ebp - 0x840], eax
lea esi, [ebp - 0x850]
cmovae esi, dword [ebp - 0x850]
mov eax, dword [ebp - 0x9e8]
lea ecx, [esi + eax*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x9e0]
push ecx
call fcn.100115d0
mov eax, dword [ebp - 0xa70]
add esp, 0xc
add eax, dword [ebp - 0x9e8]
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x10006342
push edx
push ecx
push dword [ebp - 0x9fc]
lea ecx, [ebp - 0x850]
push edx
call fcn.100037b0
and edi, 0xfffffff7
mov dword [ebp - 0x9ec], edi
mov byte [ebp - 4], 0xb0
lea ecx, [ebp - 0x990]
call fcn.100040e0
mov esi, dword [ebp - 0x83c]
mov eax, esi
mov edx, dword [ebp - 0x840]
sub eax, edx
cmp eax, 1
jb 0x10006399
cmp esi, 8
lea eax, [ebp - 0x850]
lea ecx, [edx + 1]
mov esi, 0x4d
cmovae eax, dword [ebp - 0x850]
mov dword [ebp - 0x840], ecx
mov word [eax + edx*2], si
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x100063b3
push 1
push 0x10027444
push dword [ebp - 0x9fc]
lea ecx, [ebp - 0x850]
push 1
call fcn.100037b0
mov esi, dword [ebp - 0xa34]
cmp dword [ebp - 0x83c], 8
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x9e0], eax
lea eax, [ebp - 0x850]
cmovae eax, dword [ebp - 0x850]
mov dword [ebp - 0x9e8], eax
call fcn.10010295
mov edi, eax
add esp, 4
mov dword [ebp - 0x9fc], edi
mov byte [ebp - 4], 0xb2
test edi, edi
je 0x10006426
push dword [ebp - 0x9e8]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x10006428
cmp dword [ebp - 0x9e8], eax
jne 0x10008280
jmp 0x10006428
xor edi, edi
mov byte [ebp - 4], 0xb0
mov dword [ebp - 0xa54], edi
test edi, edi
je 0x10008280
mov byte [ebp - 4], 0xb3
mov eax, dword [ebp - 0xa54]
test eax, eax
je 0x1000644c
mov eax, dword [eax]
jmp 0x1000644e
xor eax, eax
push eax
push esi
call dword [ebp - 0x9e0]
mov edi, eax
mov byte [ebp - 4], 0xb0
mov esi, dword [ebp - 0xa54]
test esi, esi
je 0x100064b4
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x100064aa
test esi, esi
je 0x100064aa
mov eax, dword [esi]
test eax, eax
je 0x10006488
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1000649f
push eax
call fcn.1000fd2a
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1000fd64
add esp, 8
mov dword [ebp - 0xa54], 0
test edi, edi
js 0x10007605
push 5
xor eax, eax
mov dword [ebp - 0x910], 0
mov dword [ebp - 0x900], 0
lea ecx, [ebp - 0x910]
mov dword [ebp - 0x8fc], 0
push str.PT60M
mov dword [ebp - 0x900], 0
mov dword [ebp - 0x8fc], 7
mov word [ebp - 0x910], ax
call fcn.10003b20
mov byte [ebp - 4], 0xbc
mov esi, dword [ebp - 0xa34]
cmp dword [ebp - 0x8fc], 8
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x9e0], eax
lea eax, [ebp - 0x910]
cmovae eax, dword [ebp - 0x910]
mov dword [ebp - 0x9e8], eax
call fcn.10010295
mov edi, eax
add esp, 4
mov dword [ebp - 0xb78], edi
mov byte [ebp - 4], 0xbd
test edi, edi
je 0x10006580
push dword [ebp - 0x9e8]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x10006582
cmp dword [ebp - 0x9e8], eax
jne 0x10008280
jmp 0x10006582
xor edi, edi
mov byte [ebp - 4], 0xbc
mov dword [ebp - 0xa9c], edi
test edi, edi
je 0x10008280
mov byte [ebp - 4], 0xbe
mov eax, dword [ebp - 0xa9c]
test eax, eax
je 0x100065a6
mov eax, dword [eax]
jmp 0x100065a8
xor eax, eax
push eax
push esi
call dword [ebp - 0x9e0]
mov edi, eax
mov byte [ebp - 4], 0xbc
mov esi, dword [ebp - 0xa9c]
test esi, esi
je 0x1000660e
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x10006604
test esi, esi
je 0x10006604
mov eax, dword [esi]
test eax, eax
je 0x100065e2
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100065f9
push eax
call fcn.1000fd2a
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1000fd64
add esp, 8
mov dword [ebp - 0xa9c], 0
test edi, edi
js 0x100075f6
mov byte [ebp - 4], 0xb0
lea ecx, [ebp - 0x910]
call fcn.100040e0
mov byte [ebp - 4], 0xa7
lea ecx, [ebp - 0x850]
call fcn.100040e0
mov byte [ebp - 4], 0x56
mov eax, dword [ebp - 0xa34]
jmp 0x100069d7
mov eax, dword [ebp - 0x9f8]
lea edx, [ebp - 0x9f0]
push edx
push 8
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x28]
call ecx
mov edi, eax
test edi, edi
js 0x10007664
jmp case.default.0x10005ed1
mov eax, dword [ebp - 0x9f8]
lea edx, [ebp - 0x9f0]
push edx
push 9
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x28]
call ecx
mov edi, eax
test edi, edi
js 0x10007664
jmp case.default.0x10005ed1
mov eax, dword [ebp - 0x9f8]
lea edx, [ebp - 0x9f0]
push edx
push 0
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x28]
call ecx
mov edi, eax
test edi, edi
js 0x10007664
mov dword [ebp - 0xa40], 0
mov byte [ebp - 4], 0xde
lea edx, [ebp - 0xa40]
mov eax, dword [ebp - 0x9f0]
push edx
push 0x10022290
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx]
call ecx
mov edi, eax
test edi, edi
js 0x10007620
mov esi, dword [ebp - 0xa40]
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0x9e0], eax
mov eax, dword [ebp - 0x9dc]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x9e8], eax
call fcn.10010295
mov edi, eax
add esp, 4
mov dword [ebp - 0xb74], edi
mov byte [ebp - 4], 0xe7
test edi, edi
je 0x10006749
push dword [ebp - 0x9e8]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x1000674b
cmp dword [ebp - 0x9e8], eax
jne 0x10008280
jmp 0x1000674b
xor edi, edi
mov byte [ebp - 4], 0xde
mov dword [ebp - 0xa5c], edi
test edi, edi
je 0x10008280
mov byte [ebp - 4], 0xe8
mov eax, dword [ebp - 0xa5c]
test eax, eax
je 0x1000676f
mov eax, dword [eax]
jmp 0x10006771
xor eax, eax
push eax
push esi
call dword [ebp - 0x9e0]
mov edi, eax
mov byte [ebp - 4], 0xde
mov esi, dword [ebp - 0xa5c]
test esi, esi
je 0x100067d7
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x100067cd
test esi, esi
je 0x100067cd
mov eax, dword [esi]
test eax, eax
je 0x100067ab
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100067c2
push eax
call fcn.1000fd2a
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1000fd64
add esp, 8
mov dword [ebp - 0xa5c], 0
test edi, edi
js 0x10007620
mov byte [ebp - 4], 0x56
mov eax, dword [ebp - 0xa40]
jmp 0x100069d7
mov eax, dword [ebp - 0x9f8]
lea edx, [ebp - 0x9f0]
push edx
push 7
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x28]
call ecx
mov edi, eax
test edi, edi
js 0x10007664
jmp case.default.0x10005ed1
mov eax, dword [ebp - 0x9f8]
lea edx, [ebp - 0x9f0]
push edx
push 0xb
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x28]
call ecx
mov edi, eax
test edi, edi
js 0x10007664
mov dword [ebp - 0xa24], 0
mov dword [ebp - 4], 0x101
lea edx, [ebp - 0xa24]
mov eax, dword [ebp - 0x9f0]
push edx
push 0x10022270
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx]
call ecx
mov edi, eax
test edi, edi
js 0x1000762c
mov esi, dword [ebp - 0xa24]
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 0x9e0], eax
mov eax, dword [ebp - 0x9dc]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x9e8], eax
call fcn.10010295
mov edi, eax
add esp, 4
mov dword [ebp - 0xac0], edi
mov byte [ebp - 4], 0xa
test edi, edi
je 0x100068d1
push dword [ebp - 0x9e8]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x100068d3
cmp dword [ebp - 0x9e8], eax
jne 0x10008280
jmp 0x100068d3
xor edi, edi
mov byte [ebp - 4], 1
mov dword [ebp - 0xa64], edi
test edi, edi
je 0x10008280
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0xa64]
test eax, eax
je 0x100068f7
mov eax, dword [eax]
jmp 0x100068f9
xor eax, eax
push eax
push esi
call dword [ebp - 0x9e0]
mov edi, eax
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0xa64]
test esi, esi
je 0x1000695f
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x10006955
test esi, esi
je 0x10006955
mov eax, dword [esi]
test eax, eax
je 0x10006933
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1000694a
push eax
call fcn.1000fd2a
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1000fd64
add esp, 8
mov dword [ebp - 0xa64], 0
test edi, edi
js 0x1000762c
mov ecx, dword [ebp - 0x9dc]
xor edx, edx
mov eax, dword [ecx]
add eax, 0xfffffff6
cmp eax, 3
ja case.default.0x10006979
jmp dword [eax*4 + 0x100082dc]
mov edx, dword [ecx + 0x18]
shr edx, 0x11
not edx
and edx, 2
or edx, 1
jmp case.default.0x10006979
mov edx, dword [ecx + 0x18]
and edx, 0x40000
neg edx
sbb edx, edx
and edx, 0xfffffffe
add edx, 4
jmp case.default.0x10006979
mov edx, 7
jmp case.default.0x10006979
mov edx, 8
mov eax, dword [ebp - 0xa24]
push edx
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x64]
call ecx
mov edi, eax
test edi, edi
js 0x1000762c
mov dword [ebp - 4], 0x56
mov eax, dword [ebp - 0xa24]
test eax, eax
je case.default.0x10005ed1
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 8]
call eax
mov edi, dword [ebp - 0x9dc]
cmp dword [edi + 0x14], 0
jle 0x10007024
mov dword [ebp - 0xa18], 0
mov dword [ebp - 4], 0x11e
lea edx, [ebp - 0xa18]
mov eax, dword [ebp - 0x9f0]
push edx
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x28]
call ecx
mov edi, eax
test edi, edi
js 0x1000763b
push 2
xor eax, eax
mov dword [ebp - 0x8b0], 0
mov dword [ebp - 0x8a0], 0
lea ecx, [ebp - 0x8b0]
mov dword [ebp - 0x89c], 0
push 0x100273d0
mov dword [ebp - 0x8a0], 0
mov dword [ebp - 0x89c], 7
mov word [ebp - 0x8b0], ax
call fcn.10003b20
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x9dc]
mov ecx, dword [eax + 0x14]
mov byte [ebp - 4], 0x28
lea edx, [ebp - 0x630]
call fcn.1000afc0
xor eax, eax
mov dword [ebp - 0x958], 0
lea ecx, [ebp - 0x630]
mov dword [ebp - 0x948], 0
mov dword [ebp - 0x944], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x948], 0
mov dword [ebp - 0x944], 7
mov word [ebp - 0x958], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006ad0
sub ecx, edx
lea eax, [ebp - 0x630]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x958]
call fcn.10003b20
or dword [ebp - 0x9ec], 0x10
lea edx, [ebp - 0x958]
cmp dword [ebp - 0x944], 8
mov ecx, dword [ebp - 0x8a0]
cmovae edx, dword [ebp - 0x958]
mov eax, dword [ebp - 0x89c]
mov edi, dword [ebp - 0x948]
sub eax, ecx
mov dword [ebp - 0x9e0], ecx
cmp edi, eax
ja 0x10006b69
cmp dword [ebp - 0x89c], 8
lea eax, [ecx + edi]
lea esi, [ebp - 0x8b0]
mov dword [ebp - 0x8a0], eax
cmovae esi, dword [ebp - 0x8b0]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.100115d0
mov eax, dword [ebp - 0x9e0]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x10006b7d
push edi
push edx
push dword [ebp - 0xac0]
lea ecx, [ebp - 0x8b0]
push edi
call fcn.100037b0
and dword [ebp - 0x9ec], 0xffffffef
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x958]
call fcn.100040e0
mov esi, dword [ebp - 0x89c]
mov eax, esi
mov edx, dword [ebp - 0x8a0]
sub eax, edx
cmp eax, 1
jb 0x10006bd2
cmp esi, 8
lea eax, [ebp - 0x8b0]
lea ecx, [edx + 1]
mov esi, 0x4d
cmovae eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x8a0], ecx
mov word [eax + edx*2], si
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x10006bec
push 1
push 0x10027444
push dword [ebp - 0xac0]
lea ecx, [ebp - 0x8b0]
push 1
call fcn.100037b0
mov esi, dword [ebp - 0xa18]
cmp dword [ebp - 0x89c], 8
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x9e0], eax
lea eax, [ebp - 0x8b0]
cmovae eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x9e8], eax
call fcn.10010295
mov edi, eax
add esp, 4
mov dword [ebp - 0xacc], edi
mov byte [ebp - 4], 0x29
test edi, edi
je 0x10006c5f
push dword [ebp - 0x9e8]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x10006c61
cmp dword [ebp - 0x9e8], eax
jne 0x10008280
jmp 0x10006c61
xor edi, edi
mov byte [ebp - 4], 0x27
mov dword [ebp - 0xa68], edi
test edi, edi
je 0x10008280
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp - 0xa68]
test eax, eax
je 0x10006c85
mov eax, dword [eax]
jmp 0x10006c87
xor eax, eax
push eax
push esi
call dword [ebp - 0x9e0]
mov byte [ebp - 4], 0x27
mov esi, dword [ebp - 0xa68]
test esi, esi
je 0x10006ceb
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x10006ce1
test esi, esi
je 0x10006ce1
mov eax, dword [esi]
test eax, eax
je 0x10006cbf
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10006cd6
push eax
call fcn.1000fd2a
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1000fd64
add esp, 8
mov dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0x9dc]
cmp dword [eax + 0x10], 0
je 0x10006fda
push 2
xor eax, eax
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x870], 0
lea ecx, [ebp - 0x880]
mov dword [ebp - 0x86c], 0
push 0x100273d0
mov dword [ebp - 0x870], 0
mov dword [ebp - 0x86c], 7
mov word [ebp - 0x880], ax
call fcn.10003b20
mov byte [ebp - 4], 0x2b
mov eax, dword [ebp - 0x9dc]
mov ecx, dword [eax + 0x10]
mov byte [ebp - 4], 0x2c
lea edx, [ebp - 0x838]
call fcn.1000afc0
xor eax, eax
mov dword [ebp - 0x8e0], 0
lea ecx, [ebp - 0x838]
mov dword [ebp - 0x8d0], 0
mov dword [ebp - 0x8cc], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x8d0], 0
mov dword [ebp - 0x8cc], 7
mov word [ebp - 0x8e0], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006db0
sub ecx, edx
lea eax, [ebp - 0x838]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x8e0]
call fcn.10003b20
or dword [ebp - 0x9ec], 0x20
lea edx, [ebp - 0x8e0]
cmp dword [ebp - 0x8cc], 8
mov ecx, dword [ebp - 0x870]
cmovae edx, dword [ebp - 0x8e0]
mov eax, dword [ebp - 0x86c]
mov edi, dword [ebp - 0x8d0]
sub eax, ecx
mov dword [ebp - 0x9e0], ecx
cmp edi, eax
ja 0x10006e49
cmp dword [ebp - 0x86c], 8
lea eax, [edi + ecx]
lea esi, [ebp - 0x880]
mov dword [ebp - 0x870], eax
cmovae esi, dword [ebp - 0x880]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.100115d0
mov eax, dword [ebp - 0x9e0]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x10006e5d
push edi
push edx
push dword [ebp - 0xacc]
lea ecx, [ebp - 0x880]
push edi
call fcn.100037b0
and dword [ebp - 0x9ec], 0xffffffdf
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x8e0]
call fcn.100040e0
mov esi, dword [ebp - 0x86c]
mov eax, esi
mov edx, dword [ebp - 0x870]
sub eax, edx
cmp eax, 1
jb 0x10006eb2
cmp esi, 8
lea eax, [ebp - 0x880]
lea ecx, [edx + 1]
mov esi, 0x4d
cmovae eax, dword [ebp - 0x880]
mov dword [ebp - 0x870], ecx
mov word [eax + edx*2], si
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x10006ecc
push 1
push 0x10027444
push dword [ebp - 0xacc]
lea ecx, [ebp - 0x880]
push 1
call fcn.100037b0
mov esi, dword [ebp - 0xa18]
cmp dword [ebp - 0x86c], 8
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x9e0], eax
lea eax, [ebp - 0x880]
cmovae eax, dword [ebp - 0x880]
mov dword [ebp - 0x9e8], eax
call fcn.10010295
mov edi, eax
add esp, 4
mov dword [ebp - 0xac4], edi
mov byte [ebp - 4], 0x2d
test edi, edi
je 0x10006f3f
push dword [ebp - 0x9e8]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x10006f41
cmp dword [ebp - 0x9e8], eax
jne 0x10008280
jmp 0x10006f41
xor edi, edi
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0xa7c], edi
test edi, edi
je 0x10008280
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0xa7c]
test eax, eax
je 0x10006f65
mov eax, dword [eax]
jmp 0x10006f67
xor eax, eax
push eax
push esi
call dword [ebp - 0x9e0]
mov byte [ebp - 4], 0x2b
mov esi, dword [ebp - 0xa7c]
test esi, esi
je 0x10006fcb
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x10006fc1
test esi, esi
je 0x10006fc1
mov eax, dword [esi]
test eax, eax
je 0x10006f9f
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10006fb6
push eax
call fcn.1000fd2a
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1000fd64
add esp, 8
mov dword [ebp - 0xa7c], 0
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x880]
call fcn.100040e0
mov eax, dword [ebp - 0xa18]
mov edi, dword [ebp - 0x9dc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
mov ecx, dword [edi + 0x18]
and cl, 2
movzx ecx, cl
neg ecx
sbb ecx, ecx
push ecx
push eax
call edx
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x8b0]
call fcn.100040e0
mov dword [ebp - 4], 0x56
mov eax, dword [ebp - 0xa18]
test eax, eax
je 0x10007024
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 8]
call eax
cmp dword [edi + 0x20], 0
jle 0x1000730d
push 2
xor eax, eax
mov dword [ebp - 0x898], 0
mov dword [ebp - 0x888], 0
lea ecx, [ebp - 0x898]
mov dword [ebp - 0x884], 0
push 0x100273d0
mov dword [ebp - 0x888], 0
mov dword [ebp - 0x884], 7
mov word [ebp - 0x898], ax
call fcn.10003b20
mov dword [ebp - 4], 0x130
mov eax, dword [ebp - 0x9dc]
mov ecx, dword [eax + 0x20]
mov byte [ebp - 4], 0x31
lea edx, [ebp - 0x428]
call fcn.1000afc0
xor eax, eax
mov dword [ebp - 0x8f8], 0
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x8e8], 0
mov dword [ebp - 0x8e4], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x8e8], 0
mov dword [ebp - 0x8e4], 7
mov word [ebp - 0x8f8], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100070e0
sub ecx, edx
lea eax, [ebp - 0x428]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x8f8]
call fcn.10003b20
or dword [ebp - 0x9ec], 0x40
lea edx, [ebp - 0x8f8]
cmp dword [ebp - 0x8e4], 8
mov ecx, dword [ebp - 0x888]
cmovae edx, dword [ebp - 0x8f8]
mov eax, dword [ebp - 0x884]
mov edi, dword [ebp - 0x8e8]
sub eax, ecx
mov dword [ebp - 0x9e0], ecx
cmp edi, eax
ja 0x10007179
cmp dword [ebp - 0x884], 8
lea eax, [ecx + edi]
lea esi, [ebp - 0x898]
mov dword [ebp - 0x888], eax
cmovae esi, dword [ebp - 0x898]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.100115d0
mov eax, dword [ebp - 0x9e0]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x1000718d
push edi
push edx
push dword [ebp - 0xac4]
lea ecx, [ebp - 0x898]
push edi
call fcn.100037b0
and dword [ebp - 0x9ec], 0xffffffbf
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x8f8]
call fcn.100040e0
mov esi, dword [ebp - 0x884]
mov eax, esi
mov edx, dword [ebp - 0x888]
sub eax, edx
cmp eax, 1
jb 0x100071e2
cmp esi, 8
lea eax, [ebp - 0x898]
lea ecx, [edx + 1]
mov esi, 0x4d
cmovae eax, dword [ebp - 0x898]
mov dword [ebp - 0x888], ecx
mov word [eax + edx*2], si
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x100071fc
push 1
push 0x10027444
push dword [ebp - 0xac4]
lea ecx, [ebp - 0x898]
push 1
call fcn.100037b0
mov esi, dword [ebp - 0x9f0]
cmp dword [ebp - 0x884], 8
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x9e0], eax
lea eax, [ebp - 0x898]
cmovae eax, dword [ebp - 0x898]
mov dword [ebp - 0x9e8], eax
call fcn.10010295
mov edi, eax
add esp, 4
mov dword [ebp - 0xa04], edi
mov byte [ebp - 4], 0x32
test edi, edi
je 0x1000726f
push dword [ebp - 0x9e8]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x10007271
cmp dword [ebp - 0x9e8], eax
jne 0x10008280
jmp 0x10007271
xor edi, edi
mov byte [ebp - 4], 0x30
mov dword [ebp - 0xa80], edi
test edi, edi
je 0x10008280
mov byte [ebp - 4], 0x33
mov eax, dword [ebp - 0xa80]
test eax, eax
je 0x10007295
mov eax, dword [eax]
jmp 0x10007297
xor eax, eax
push eax
push esi
call dword [ebp - 0x9e0]
mov byte [ebp - 4], 0x30
mov esi, dword [ebp - 0xa80]
test esi, esi
je 0x100072fb
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x100072f1
test esi, esi
je 0x100072f1
mov eax, dword [esi]
test eax, eax
je 0x100072cf
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100072e6
push eax
call fcn.1000fd2a
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1000fd64
add esp, 8
mov dword [ebp - 0xa80], 0
mov dword [ebp - 4], 0x56
lea ecx, [ebp - 0x898]
call fcn.100040e0
lea eax, [ebp - 0x978]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x978], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [ebp - 0x9dc]
xorps xmm0, xmm0
movzx edx, word [ebp - 0x972]
movzx ecx, word [ebp - 0x976]
movups xmmword [ebp - 0xae0], xmm0
movzx edi, word [eax + 0x1c]
movsd xmm0, qword [ebp - 0xb48]
mov eax, edi
shr eax, 5
mov si, di
and eax, 0x3f
movsd qword [ebp - 0xafc], xmm0
mov word [ebp - 0xad6], ax
xorps xmm0, xmm0
movzx eax, word [ebp - 0x978]
movups xmmword [ebp - 0x968], xmm0
mov word [ebp - 0x966], cx
movzx ecx, word [ebp - 0x970]
shr si, 0xb
mov word [ebp - 0x962], dx
mov dl, byte [ebp - 0x9e1]
mov word [ebp - 0x968], ax
test dl, dl
movzx eax, si
cmovne ecx, eax
mov word [ebp - 0xad8], si
mov eax, dword [ebp - 0xad8]
mov word [ebp - 0x960], cx
movzx ecx, word [ebp - 0x96e]
shr eax, 0x10
test dl, dl
mov dword [ebp - 0xaf4], 0
cmovne ecx, eax
and edi, 0x1f
mov word [ebp - 0x95e], cx
add edi, edi
movzx ecx, word [ebp - 0x96c]
test dl, dl
movzx eax, di
lea edx, [ebp - 0xafc]
cmovne ecx, eax
mov word [ebp - 0x95c], cx
lea ecx, [ebp - 0x968]
call fcn.10008c00
neg eax
push ecx
sbb eax, eax
lea ecx, [ebp - 0xafc]
inc eax
mov dword [ebp - 0xaf4], eax
lea eax, [ebp - 0xaec]
push eax
call fcn.10008770
mov dword [ebp - 4], 0x134
mov eax, dword [eax]
test eax, eax
jne 0x1000743c
xor esi, esi
mov dword [ebp - 0xa10], esi
jmp 0x10007453
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0xa10], esi
test esi, esi
je 0x1000828a
mov byte [ebp - 4], 0x36
or eax, 0xffffffff
mov edx, dword [ebp - 0xaec]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10007477
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
mov eax, dword [ebp - 0x9f0]
push esi
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x3c]
call ecx
mov edi, eax
test edi, edi
js 0x10007656
mov dword [ebp - 4], 0x56
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 4], 0x4e
mov eax, dword [ebp - 0x9f0]
test eax, eax
je 0x100074b7
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 8]
call eax
mov eax, dword [ebp - 0x9dc]
add eax, 0x28
mov dword [ebp - 0x9dc], eax
cmp eax, dword [ebp - 0xa00]
jne 0x10005eb0
mov dword [ebp - 0xa98], 0
mov dword [ebp - 4], 0x141
lea edx, [ebp - 0xa98]
mov eax, dword [ebp - 0xa08]
push edx
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x44]
call ecx
mov edi, eax
test edi, edi
js 0x10008199
mov dword [ebp - 0xa78], 0
mov byte [ebp - 4], 0x4a
lea edx, [ebp - 0xa78]
mov eax, dword [ebp - 0xa98]
push edx
push 0
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x30]
call ecx
mov edi, eax
test edi, edi
js 0x1000818a
mov dword [ebp - 0xa28], 0
mov byte [ebp - 4], 0x54
lea edx, [ebp - 0xa28]
mov eax, dword [ebp - 0xa78]
push edx
push str.MbLk
push eax
mov ecx, dword [eax]
mov ecx, dword [ecx]
call ecx
mov edi, eax
test edi, edi
js 0x1000817b
mov esi, dword [ebp - 0xa28]
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x9e0], eax
call fcn.10010295
mov edi, eax
add esp, 4
mov dword [ebp - 0xa04], edi
mov byte [ebp - 4], 0x5e
test edi, edi
je 0x10007686
push dword [ebp - 0xab8]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x10007688
cmp dword [ebp - 0xab8], eax
jne 0x10008280
jmp 0x10007688
mov byte [ebp - 4], 0x56
mov eax, dword [ebp - 0xa3c]
jmp 0x10007648
mov byte [ebp - 4], 0x56
mov eax, dword [ebp - 0xa1c]
jmp 0x10007648
mov byte [ebp - 4], 0x56
mov eax, dword [ebp - 0xa20]
jmp 0x10007648
mov byte [ebp - 4], 0x56
mov eax, dword [ebp - 0xa14]
jmp 0x10007648
mov byte [ebp - 4], 0xb0
lea ecx, [ebp - 0x910]
call fcn.100040e0
mov byte [ebp - 4], 0xa7
lea ecx, [ebp - 0x850]
call fcn.100040e0
mov byte [ebp - 4], 0x56
mov eax, dword [ebp - 0xa34]
jmp 0x10007648
mov byte [ebp - 4], 0x56
mov eax, dword [ebp - 0xa40]
jmp 0x10007648
mov dword [ebp - 4], 0x56
mov eax, dword [ebp - 0xa24]
jmp 0x10007648
mov dword [ebp - 4], 0x56
mov eax, dword [ebp - 0xa18]
test eax, eax
je 0x10007664
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 8]
call eax
jmp 0x10007664
mov dword [ebp - 4], 0x56
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 4], 0x4e
mov eax, dword [ebp - 0x9f0]
test eax, eax
je 0x100081ab
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 8]
call eax
jmp 0x100081ab
xor edi, edi
mov byte [ebp - 4], 0x54
mov dword [ebp - 0xa90], edi
test edi, edi
je 0x10008280
mov byte [ebp - 4], 0x5f
mov eax, dword [ebp - 0xa90]
test eax, eax
je 0x100076ac
mov eax, dword [eax]
jmp 0x100076ae
xor eax, eax
push eax
push esi
call dword [ebp - 0x9e0]
mov edi, eax
mov byte [ebp - 4], 0x54
mov esi, dword [ebp - 0xa90]
test esi, esi
je 0x10007714
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x1000770a
test esi, esi
je 0x1000770a
mov eax, dword [esi]
test eax, eax
je 0x100076e8
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100076ff
push eax
call fcn.1000fd2a
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1000fd64
add esp, 8
mov dword [ebp - 0xa90], 0
test edi, edi
js 0x1000817b
mov esi, dword [ebp - 0xa28]
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x9e0], eax
call fcn.10010295
mov edi, eax
add esp, 4
mov dword [ebp - 0xa04], edi
mov byte [ebp - 4], 0x69
test edi, edi
je 0x10007775
push dword [ebp - 0xac8]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x10007777
cmp dword [ebp - 0xac8], eax
jne 0x10008280
jmp 0x10007777
xor edi, edi
mov byte [ebp - 4], 0x54
mov dword [ebp - 0xa50], edi
test edi, edi
je 0x10008280
mov byte [ebp - 4], 0x6a
mov eax, dword [ebp - 0xa50]
test eax, eax
je 0x1000779b
mov eax, dword [eax]
jmp 0x1000779d
xor eax, eax
push eax
push esi
call dword [ebp - 0x9e0]
mov edi, eax
mov byte [ebp - 4], 0x54
mov esi, dword [ebp - 0xa50]
test esi, esi
je 0x10007803
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x100077f9
test esi, esi
je 0x100077f9
mov eax, dword [esi]
test eax, eax
je 0x100077d7
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100077ee
push eax
call fcn.1000fd2a
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1000fd64
add esp, 8
mov dword [ebp - 0xa50], 0
test edi, edi
js 0x1000817b
mov esi, dword [ebp - 0xa28]
push 0xc
mov eax, dword [esi]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x9e0], eax
call fcn.10010295
mov edi, eax
add esp, 4
mov dword [ebp - 0xa04], edi
mov byte [ebp - 4], 0x74
test edi, edi
je 0x10007864
push dword [ebp - 0xa30]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x10007866
cmp dword [ebp - 0xa30], eax
jne 0x10008280
jmp 0x10007866
xor edi, edi
mov byte [ebp - 4], 0x54
mov dword [ebp - 0xa60], edi
test edi, edi
je 0x10008280
mov byte [ebp - 4], 0x75
mov eax, dword [ebp - 0xa60]
test eax, eax
je 0x1000788a
mov eax, dword [eax]
jmp 0x1000788c
xor eax, eax
push eax
push esi
call dword [ebp - 0x9e0]
mov edi, eax
mov byte [ebp - 4], 0x54
mov esi, dword [ebp - 0xa60]
test esi, esi
je 0x100078f2
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x100078e8
test esi, esi
je 0x100078e8
mov eax, dword [esi]
test eax, eax
je 0x100078c6
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100078dd
push eax
call fcn.1000fd2a
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1000fd64
add esp, 8
mov dword [ebp - 0xa60], 0
test edi, edi
js 0x1000817b
mov edi, dword [ebp - 0xa0c]
mov eax, 8
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push edi
mov word [ebp - 0xb60], ax
call esi
mov dword [ebp - 0xb58], eax
test eax, eax
jne 0x10007927
test edi, edi
jne 0x10008280
mov byte [ebp - 4], 0x7f
mov eax, 8
mov edi, dword [ebp - 0xa58]
push edi
mov word [ebp - 0xb40], ax
call esi
mov dword [ebp - 0xb38], eax
test eax, eax
jne 0x10007952
test edi, edi
jne 0x10008280
mov byte [ebp - 4], 0x80
test dword [ebx + 0x1c], 0x2000
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov dword [ebp - 0x9dc], 1
je 0x10007ca2
mov esi, dword [ebp - 0xa0c]
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x9d8], 0
mov dword [ebp - 0x9c8], 0
mov dword [ebp - 0x9c4], 0
mov dword [ebp - 0x9c8], 0
mov dword [ebp - 0x9c4], 7
lea edx, [ecx + 2]
mov word [ebp - 0x9d8], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100079c0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x9d8]
call fcn.10003b20
mov byte [ebp - 4], 0x81
lea ecx, [ebp - 0xabc]
mov esi, dword [ebp - 0x9ec]
lea eax, [ebp - 0x9d8]
or esi, 1
mov dword [ebp - 0x9ec], esi
cmp dword [ebp - 0x9c4], 8
push ecx
cmovae eax, dword [ebp - 0x9d8]
push 1
push eax
push 0
mov dword [ebp - 0xabc], 0
call dword [sym.imp.NETAPI32.dll_NetLocalGroupGetInfo]
test eax, eax
jne 0x10007a3e
push dword [ebp - 0xabc]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov dword [ebp - 0x9dc], 4
jmp 0x10007c1e
mov ecx, dword [ebp - 0xa0c]
xor eax, eax
mov dword [ebp - 0x9c0], 0
mov dword [ebp - 0x9b0], 0
mov dword [ebp - 0x9ac], 0
mov dword [ebp - 0x9b0], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x9ac], 7
mov word [ebp - 0x9c0], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007a82
sub ecx, edx
sar ecx, 1
push ecx
push dword [ebp - 0xa0c]
lea ecx, [ebp - 0x9c0]
call fcn.10003b20
mov dword [ebp - 4], 0x182
or esi, 2
mov dword [ebp - 0x9ec], esi
lea eax, [ebp - 0xa6c]
push dword [ebp - 0xa04]
lea edx, [ebp - 0xaf0]
mov dword [ebp - 0xa6c], 0
lea ecx, [ebp - 0xae8]
mov dword [ebp - 0xaf0], eax
call fcn.10002210
mov dword [ebp - 4], 0x183
push ecx
lea ecx, [ebp - 0xa8c]
call fcn.10001ac0
mov byte [ebp - 4], 0x84
lea esi, [ebp - 0x9c0]
cmp dword [ebp - 0x9ac], 8
mov eax, dword [ebp - 0xa88]
cmovae esi, dword [ebp - 0x9c0]
test eax, eax
je 0x10007bdc
push str.ConvertStringSidToSidW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10007bd0
lea ecx, [ebp - 0xa6c]
push ecx
push esi
call eax
test eax, eax
je 0x10007bdc
mov ecx, dword [ebp - 0xa6c]
lea edx, [ebp - 0xab4]
mov dword [ebp - 0xab4], 7
call fcn.10009700
test al, al
jne 0x10007b60
jmp 0x10007bdc
mov eax, dword [ebp - 0xab4]
cmp eax, 4
je 0x10007b7c
cmp eax, 2
je 0x10007b7c
mov byte [ebp - 0x9e1], 0
cmp eax, 5
jne 0x10007b83
mov byte [ebp - 0x9e1], 1
mov byte [ebp - 4], 0x83
mov eax, dword [ebp - 0xa88]
mov dword [ebp - 0xa8c], 0x100272ac
test eax, eax
je 0x10007bac
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0xa88], 0
mov byte [ebp - 4], 0x82
lea ecx, [ebp - 0xae8]
call fcn.10001cc0
cmp byte [ebp - 0x9e1], 0
je 0x10007c14
mov dword [ebp - 0x9dc], 4
jmp 0x10007c1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xa84], eax
mov byte [ebp - 4], 0x83
mov eax, dword [ebp - 0xa88]
mov dword [ebp - 0xa8c], 0x100272ac
test eax, eax
je 0x10007c05
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0xa88], 0
mov byte [ebp - 4], 0x82
lea ecx, [ebp - 0xae8]
call fcn.10001cc0
mov dword [ebp - 0x9dc], 3
mov dword [ebp - 4], 0x181
mov eax, dword [ebp - 0x9ec]
test al, 2
je 0x10007c49
and eax, 0xfffffffd
lea ecx, [ebp - 0x9c0]
mov dword [ebp - 0x9ec], eax
call fcn.100040e0
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 4], 0x180
test al, 1
je 0x10007c68
and eax, 0xfffffffe
lea ecx, [ebp - 0x9d8]
mov dword [ebp - 0x9ec], eax
call fcn.100040e0
lea eax, [ebp - 0xbc8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x88
lea eax, [ebp - 0xbc8]
push eax
lea eax, [ebp - 0xb40]
push eax
call edi
test eax, eax
js 0x10008294
mov byte [ebp - 4], 0x80
lea eax, [ebp - 0xbc8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, dword [ebp - 0xa0c]
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x928], 0
mov dword [ebp - 0x918], 0
mov dword [ebp - 0x914], 0
mov dword [ebp - 0x918], 0
mov dword [ebp - 0x914], 7
lea edx, [ecx + 2]
mov word [ebp - 0x928], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007cf0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x928]
call fcn.10003b20
mov byte [ebp - 4], 0x89
mov eax, dword [ebp - 0x918]
test eax, eax
je 0x10007d7a
cmp dword [ebp - 0x914], 8
lea edi, [ebp - 0x928]
cmovae edi, dword [ebp - 0x928]
cmp eax, 6
jne 0x10007e0e
movzx ecx, word [edi]
mov esi, 0x53
mov edx, eax
mov eax, str.SYSTEM
cmp ecx, esi
jb 0x10007e0e
sub edi, eax
cmp cx, si
ja 0x10007e0e
cmp edx, 1
je 0x10007d74
movzx ecx, word [edi + eax + 2]
add eax, 2
dec edx
movzx esi, word [eax]
cmp cx, si
jae 0x10007d53
jmp 0x10007e0e
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov eax, 8
mov dword [ebp - 0x9dc], 5
push str.SYSTEM
mov word [ebp - 0xb70], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0xb68], eax
test eax, eax
je 0x10008280
mov byte [ebp - 4], 0x8a
lea eax, [ebp - 0xb70]
push eax
lea eax, [ebp - 0xb60]
push eax
call edi
test eax, eax
js 0x1000829a
mov byte [ebp - 4], 0x89
lea eax, [ebp - 0xb70]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push eax
call esi
lea eax, [ebp - 0xbd8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x8b
lea eax, [ebp - 0xbd8]
push eax
lea eax, [ebp - 0xb40]
push eax
call edi
test eax, eax
js 0x100082a0
mov byte [ebp - 4], 0x89
lea eax, [ebp - 0xbd8]
push eax
call esi
mov dword [ebp - 0xa94], 0
mov byte [ebp - 4], 0x8d
mov esi, dword [ebp - 0xa4c]
push 0x10027358
mov eax, dword [esi]
mov eax, dword [eax + 0x44]
mov dword [ebp - 0x9e0], eax
mov eax, 8
mov word [ebp - 0xb88], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0xb80], eax
test eax, eax
je 0x10008280
mov byte [ebp - 4], 0x8e
movups xmm0, xmmword [ebp - 0xb88]
mov eax, dword [ebp - 0xa08]
cmp dword [ebp - 0x8b4], 8
movups xmmword [ebp - 0xb98], xmm0
mov dword [ebp - 0xa58], eax
lea eax, [ebp - 0x8c8]
movups xmm0, xmmword [ebp - 0xb40]
cmovae eax, dword [ebp - 0x8c8]
push 0xc
movups xmmword [ebp - 0xae0], xmm0
mov dword [ebp - 0xa30], eax
movups xmm0, xmmword [ebp - 0xb60]
movups xmmword [ebp - 0xb50], xmm0
call fcn.10010295
mov edi, eax
add esp, 4
mov dword [ebp - 0xa04], edi
mov byte [ebp - 4], 0x8f
test edi, edi
je 0x10007eee
push dword [ebp - 0xa30]
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
jne 0x10007ef0
cmp dword [ebp - 0xa30], eax
jne 0x10008280
jmp 0x10007ef0
xor edi, edi
mov byte [ebp - 4], 0x8e
mov dword [ebp - 0xa74], edi
test edi, edi
je 0x10008280
mov byte [ebp - 4], 0x90
mov eax, dword [ebp - 0xa74]
test eax, eax
je 0x10007f14
mov ecx, dword [eax]
jmp 0x10007f16
xor ecx, ecx
movups xmm0, xmmword [ebp - 0xb98]
lea eax, [ebp - 0xa94]
push eax
sub esp, 0x10
mov eax, esp
push dword [ebp - 0x9dc]
movups xmmword [eax], xmm0
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xae0]
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0xb50]
push 6
push dword [ebp - 0xa58]
movups xmmword [eax], xmm0
push ecx
push esi
call dword [ebp - 0x9e0]
mov edi, eax
mov byte [ebp - 4], 0x8e
mov esi, dword [ebp - 0xa74]
test esi, esi
je 0x10007fbe
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x10007fb4
test esi, esi
je 0x10007fb4
mov eax, dword [esi]
test eax, eax
je 0x10007f92
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10007fa9
push eax
call fcn.1000fd2a
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1000fd64
add esp, 8
mov dword [ebp - 0xa74], 0
mov byte [ebp - 4], 0x8d
lea eax, [ebp - 0xb88]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push eax
call esi
test edi, edi
js 0x10008143
cmp dword [ebp - 0x9dc], 1
jne 0x10008141
mov dword [ebp - 0xb2c], 0
mov dword [ebp - 0xb28], 0
mov dword [ebp - 0xb24], 0
mov byte [ebp - 4], 0x9b
mov dword [ebp - 0xb20], 0
mov dword [ebp - 0xb1c], 0
mov dword [ebp - 0xb18], 0
mov byte [ebp - 4], 0x9c
mov dword [ebp - 0xb14], 0
mov dword [ebp - 0xb10], 0
mov dword [ebp - 0xb0c], 0
mov dword [ebp - 0xb08], 0
mov dword [ebp - 0xb04], 0
mov dword [ebp - 0xb00], 0
mov byte [ebp - 4], 0x9d
lea ecx, [ebp - 0xb2c]
push 1
push 0xa0000000
push str.S_1_1_0
call fcn.10001170
push 1
push 0x10000000
push str.S_1_5_18
lea ecx, [ebp - 0xb2c]
call fcn.10001170
push 1
push 0x10000000
push str.S_1_5_21
lea ecx, [ebp - 0xb2c]
call fcn.10001170
push 0
push 0x10000000
push dword [ebp - 0xa0c]
lea ecx, [ebp - 0xb2c]
call fcn.10001170
lea ecx, [ebp - 0xb2c]
call fcn.100016f0
test eax, eax
je 0x10008132
push 0
lea eax, [ebp - 0xa44]
mov dword [ebp - 0xa44], 0
push eax
push 0xf
push 1
push dword [ebp - 0xb10]
call dword [sym.imp.ADVAPI32.dll_ConvertSecurityDescriptorToStringSecurityDescriptorW]
test eax, eax
je 0x10008246
mov eax, dword [ebp - 0xa94]
push 0x10
push dword [ebp - 0xa44]
mov ecx, dword [eax]
push eax
mov ecx, dword [ecx + 0x58]
call ecx
mov edi, eax
mov eax, dword [ebp - 0xa44]
test eax, eax
je 0x1000812a
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
js 0x1000826c
mov byte [ebp - 4], 0x8d
lea ecx, [ebp - 0xb2c]
call fcn.10001020
xor edi, edi
mov byte [ebp - 4], 0x89
lea ecx, [ebp - 0xa94]
call fcn.100082f0
mov byte [ebp - 4], 0x80
lea ecx, [ebp - 0x928]
call fcn.100040e0
mov byte [ebp - 4], 0x7f
lea eax, [ebp - 0xb40]
push eax
call esi
mov byte [ebp - 4], 0x54
lea eax, [ebp - 0xb60]
push eax
call esi
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0xa28]
call fcn.100082f0
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0xa78]
call fcn.100082f0
mov dword [ebp - 4], 0x4e
lea ecx, [ebp - 0xa98]
call fcn.100082f0
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x9f8]
call fcn.100082f0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x940]
call fcn.100040e0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x9f4]
call fcn.100082f0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xa48]
call fcn.100082f0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xa08]
call fcn.100082f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa4c]
call fcn.100082f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa2c]
call fcn.100082f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c8]
call fcn.100040e0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000fd1c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, dword [ebp - 0xa44]
test eax, eax
je 0x10008257
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x1000826c
movzx edi, di
or edi, 0x80070000
mov byte [ebp - 4], 0x8d
lea ecx, [ebp - 0xb2c]
call fcn.10001020
jmp 0x10008143
push 0x8007000e
call fcn.1000f340
push 0x8007000e
call fcn.10001a10
push eax
call fcn.1000f340
push eax
call fcn.1000f340
push eax
call fcn.1000f340
nop
neg dword [esi]
adc byte [eax + 470810719], cl
pushal
add byte [eax], dl
mov bh, 0x60
add byte [eax], dl
inc ebx
add byte [eax], dl
imul esp, dword [esi], 0x617310
adc byte [edi - 300941210], cl
add byte [bx + si], dl
adc al, 0x68
add byte [eax], dl
adc al, 0x68
add byte [eax], dl
adc al, 0x68
add byte [eax], dl
adc al, 0x68
add byte [eax], dl
sub byte [ecx], 0x10
nop
imul eax, dword [eax], 6923536
adc byte [ecx + ebp*2 - 0x3333f000], ch
int3