Function at 0x1006989b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x10193250]
mov ecx, dword [0x10193254]
lea edx, [eax - 1]
imul edx, eax
test dl, 1
sete byte [ebp - 0x11]
cmp ecx, 0xa
setl byte [ebp - 0x12]
mov eax, dword [ebp + 8]
lea ecx, [eax + 0x66]
mov dword [ebp - 0x28], ecx
lea ecx, [eax + 0xca]
mov dword [ebp - 0x24], ecx
lea ecx, [eax + 0x12e]
mov dword [ebp - 0x20], ecx
lea ecx, [eax + 0x192]
mov dword [ebp - 0x1c], ecx
add eax, 0x1f6
mov dword [ebp - 0x18], eax
mov ebx, 0x64
mov eax, 0x2d93c309
cmp eax, 0x126ac39e
jle 0x1006995b
cmp eax, 0x430287dd
jg 0x100699d0
cmp eax, 0x2d93c308
jle 0x10069a91
cmp eax, 0x3d4e6623
jg 0x10069bfa
cmp eax, 0x379c96b3
jle 0x10069e59
cmp eax, 0x3962182e
jle 0x1006a200
cmp eax, 0x3962182f
je 0x1006a824
cmp eax, 0x3b8c3d04
je 0x1006a82e
cmp eax, 0x3c31865f
jne 0x100698f9
mov eax, 0x848b1175
jmp 0x100698f9
cmp eax, 0xc9f22bb2
jg 0x10069a3a
cmp eax, 0x9e83f931
jle 0x10069af0
cmp eax, 0xafcb289b
jg 0x10069c3b
cmp eax, 0xa4ccd057
jle 0x10069e84
cmp eax, 0xadf86372
jle 0x1006a233
cmp eax, 0xadf86373
je 0x1006a838
cmp eax, 0xaeb37086
je 0x1006a855
cmp eax, 0xaf7e3b86
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x126ac39f
mov ecx, 0xc047e4bf
jmp 0x1006b1a7
cmp eax, 0x63f3860f
jle 0x10069b4f
cmp eax, 0x73604567
jg 0x10069c87
cmp eax, 0x69e2cb7d
jle 0x10069eaf
cmp eax, 0x69fce6d9
jle 0x1006a266
cmp eax, 0x69fce6da
je 0x1006a90a
cmp eax, 0x6f14f179
je 0x1006a927
cmp eax, 0x73573e71
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x44d8de23
mov ecx, 0x602d6ca5
jmp 0x1006b1a7
cmp eax, 0xf09c3b3c
jle 0x10069bae
cmp eax, 0x5bcc4ca
jle 0x10069cdb
cmp eax, 0xd5521bd
jle 0x10069eed
cmp eax, 0x101acd1a
jle 0x1006a289
cmp eax, 0x101acd1b
je 0x1006a944
cmp eax, 0x110973a4
je 0x1006a94e
cmp eax, 0x1259e4ad
jne 0x100698f9
mov eax, 0x3f197836
jmp 0x100698f9
cmp eax, 0x2183a196
jg 0x10069d17
cmp eax, 0x16bd32e3
jle 0x10069f2b
cmp eax, 0x18cc188e
jle 0x1006a2bc
cmp eax, 0x18cc188f
je 0x1006a96b
cmp eax, 0x1b54df97
je 0x1006a975
cmp eax, 0x1e4251cf
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x90e48b77
mov ecx, 0x430287de
jmp 0x1006b1a7
cmp eax, 0x8de82f23
jle 0x10069d4d
cmp eax, 0x94dde444
jle 0x10069f56
cmp eax, 0x99037a47
jle 0x1006a2ef
cmp eax, 0x99037a48
je 0x1006a982
cmp eax, 0x9b13abbd
je 0x1006a99f
cmp eax, 0x9c43e270
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8e5ce2bf
mov ecx, 0x63f38610
jmp 0x1006b1a7
cmp eax, 0x4db021e5
jle 0x10069d83
cmp eax, 0x5afc961d
jle 0x10069f81
cmp eax, 0x5c084499
jle 0x1006a31b
cmp eax, 0x5c08449a
je 0x1006a9bc
cmp eax, 0x5d41498d
je 0x1006a9d9
cmp eax, 0x602d6ca5
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc8306a6c
mov ecx, 0x5bbd075b
jmp 0x1006b1a7
cmp eax, 0xd19eafc7
jle 0x10069dcc
cmp eax, 0xddf71f36
jle 0x10069fac
cmp eax, 0xe1cc2e8c
jle 0x1006a35c
cmp eax, 0xe1cc2e8d
je 0x1006a9f6
cmp eax, 0xeb273d15
je 0x1006aa13
cmp eax, 0xef93b367
jne 0x100698f9
mov eax, 0xca84f7df
jmp 0x100698f9
cmp eax, 0x3f303979
jle 0x10069fe2
cmp eax, 0x40b9d1e3
jle 0x1006a387
cmp eax, 0x40b9d1e4
je 0x1006aa30
cmp eax, 0x41489e2c
je 0x1006aa4d
cmp eax, 0x42f126c6
jne 0x100698f9
mov eax, 0xc66c9485
jmp 0x100698f9
cmp eax, 0xc1e1aa87
jle 0x1006a020
cmp eax, 0xc66c9484
jle 0x1006a3ba
cmp eax, 0xc66c9485
je 0x1006aa57
cmp eax, 0xc6d2dc12
je 0x1006aa74
cmp eax, 0xc8306a6c
jne 0x100698f9
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenEncryptedFileRawA]
mov eax, 0x5bbd075b
jmp 0x100698f9
cmp eax, 0x75bd4dd9
jle 0x1006a04b
cmp eax, 0x79629799
jle 0x1006a3f0
cmp eax, 0x7962979a
je 0x1006aa91
cmp eax, 0x7b8a43c0
je 0x1006aa9b
cmp eax, 0x7df7159e
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x16b0564a
mov ecx, 0x7451a442
jmp 0x1006b1a7
cmp eax, 0xfa82d17c
jle 0x10069e1b
cmp eax, 0x2991217
jg 0x1006a1cd
cmp eax, 0xfa82d17d
je 0x1006aaa5
cmp eax, 0xfdd59908
je 0x1006a4db
cmp eax, 0x28b6a4a
jne 0x100698f9
jmp 0x1006b1de
cmp eax, 0x28f06680
jle 0x1006a089
cmp eax, 0x29ebd338
jle 0x1006a423
cmp eax, 0x29ebd339
je 0x1006aac2
cmp eax, 0x2b45f921
jne 0x1006b1b9
mov eax, 0x76d06b9b
jmp 0x100698f9
cmp eax, 0x84a1674f
jg 0x1006a0b4
cmp eax, 0x848b1174
jg 0x1006a456
cmp eax, 0x826e0d54
je 0x1006aacc
cmp eax, 0x8367d669
jne 0x100698f9
mov eax, 0x110973a4
jmp 0x100698f9
cmp eax, 0x44d8de22
jg 0x1006a0df
cmp eax, 0x433e06bc
jg 0x1006a4c5
cmp eax, 0x430287de
je 0x1006aae9
cmp eax, 0x43069118
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf72c41b6
mov ecx, 0x5d41498d
jmp 0x1006b1a7
cmp eax, 0xcb80ec39
jg 0x1006a10a
cmp eax, 0xcb0df999
jg 0x1006a4e5
cmp eax, 0xc9f22bb3
je 0x1006ab06
cmp eax, 0xca84f7df
jne 0x100698f9
push eax
mov eax, esp
mov dword [ebp - 0x10], eax
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xef93b367
mov ecx, 0xc1e1aa88
jmp 0x1006b1a7
cmp eax, 0xf4ba4eaa
jg 0x1006a518
cmp eax, 0xf09c3b3d
je 0x1006ab23
cmp eax, 0xf1e8055f
jne 0x1006b1c6
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7b8a43c0
mov ecx, 0x94dde445
jmp 0x1006b1a7
cmp eax, 0x308e9a96
jg 0x1006a538
cmp eax, 0x2d93c309
je 0x1006ab2d
cmp eax, 0x2f4d57c5
jne 0x100698f9
mov eax, 0x6589b9ea
jmp 0x100698f9
cmp eax, 0x9f162111
jg 0x1006a56b
cmp eax, 0x9e83f932
je 0x1006ab4b
cmp eax, 0x9f058982
jne 0x100698f9
mov eax, 0xafcb289c
jmp 0x100698f9
cmp eax, 0x64a7a567
jg 0x1006a59e
cmp eax, 0x63f38610
je 0x1006ab68
cmp eax, 0x643baddf
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd32bd6d3
mov ecx, 0x58100c0c
jmp 0x1006b1a7
cmp eax, 0x93d961f
jg 0x1006a5d1
cmp eax, 0x5bcc4cb
je 0x1006ab85
cmp eax, 0x647fde3
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x84a16750
mov ecx, 0x99037a48
jmp 0x1006b1a7
cmp eax, 0x159a82e3
jg 0x1006a604
cmp eax, 0x126ac39f
je 0x1006aba2
cmp eax, 0x1281d573
jne 0x100698f9
mov eax, 0x29dc5463
jmp 0x100698f9
cmp eax, 0x8f61c806
jg 0x1006a637
cmp eax, 0x8de82f24
je 0x1006abac
cmp eax, 0x8e5ce2bf
jne 0x100698f9
mov eax, 0x9c43e270
jmp 0x100698f9
cmp eax, 0x58100c0b
jg 0x1006a66a
cmp eax, 0x4db021e6
je 0x1006abc9
cmp eax, 0x57b3cf98
jne 0x100698f9
mov eax, 0xa28967ef
jmp 0x100698f9
cmp eax, 0xd361de72
jg 0x1006a6a8
cmp eax, 0xd19eafc8
je 0x1006abe6
cmp eax, 0xd32bd6d3
jne 0x100698f9
push 0xf4240
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0x58100c0c
jmp 0x100698f9
cmp eax, 0x3ed1d228
jg 0x1006a6e5
cmp eax, 0x3d4e6624
je 0x1006ac52
cmp eax, 0x3d6e7a14
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x16b0564a
mov ecx, 0xddf71f37
jmp 0x1006b1a7
cmp eax, 0xba4bbdf6
jg 0x1006a718
cmp eax, 0xafcb289c
je 0x1006ac6f
cmp eax, 0xb60674d6
jne 0x100698f9
mov eax, 0x8de82f24
jmp 0x100698f9
cmp eax, 0x7484d069
jg 0x1006a738
cmp eax, 0x73604568
je 0x1006ac8c
cmp eax, 0x7451a442
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcc64d2ae
mov ecx, 0xd5521be
jmp 0x1006b1a7
cmp eax, 0x25789dc2
jg 0x1006a758
cmp eax, 0x2183a197
je 0x1006ac96
cmp eax, 0x21ff619c
jne 0x100698f9
mov eax, 0x40b9d1e4
jmp 0x100698f9
cmp eax, 0x87993711
jg 0x1006a78b
cmp eax, 0x84a16750
je 0x1006aca0
cmp eax, 0x85f97267
jne 0x100698f9
mov eax, 0x3f3d8b58
jmp 0x100698f9
cmp eax, 0x4b3a385b
jg 0x1006a7be
cmp eax, 0x44d8de23
je 0x1006acaa
cmp eax, 0x453ac0d7
jne 0x100698f9
mov eax, 0xc9f22bb3
jmp 0x100698f9
cmp eax, 0xccd1d2a8
jg 0x1006a7f1
cmp eax, 0xcb80ec3a
je 0x1006acc7
cmp eax, 0xcc64d2ae
jne 0x100698f9
push ebx
mov esi, dword [ebp + 8]
push esi
push 0x10192f5c
call fcn.1014bf80
add esp, 0xc
movzx eax, word [esi + 0x64]
mov word [0x10192fc0], ax
push ebx
push dword [ebp - 0x28]
push 0x10192fc2
call fcn.1014bf80
add esp, 0xc
push ebx
push dword [ebp - 0x24]
mov edi, 0x10193026
push edi
call fcn.1014bf80
add esp, 0xc
push ebx
push dword [ebp - 0x20]
push 0x1019308a
call fcn.1014bf80
add esp, 0xc
push ebx
push dword [ebp - 0x1c]
push 0x101930ee
call fcn.1014bf80
add esp, 0xc
push ebx
push dword [ebp - 0x18]
push 0x10193152
call fcn.1014bf80
add esp, 0xc
movzx eax, word [esi + 0x25a]
mov word [0x101931b6], ax
mov eax, dword [ebp - 0x10]
mov word [eax], 0x7325
mov byte [eax + 2], 0
push edi
push dword [ebp - 0x10]
push edi
call fcn.1006b1e6
add esp, 0xc
mov eax, 0xd5521be
jmp 0x100698f9
cmp eax, 0x2991218
je 0x1006acd1
cmp eax, 0x396cfc1
jne 0x1006b1d3
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7962979a
mov ecx, 0xd016110f
jmp 0x1006b1a7
cmp eax, 0x379c96b4
je 0x1006acdb
cmp eax, 0x37a0b934
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcb80ec3a
mov ecx, 0xe1cc2e8d
jmp 0x1006b1a7
cmp eax, 0xa4ccd058
je 0x1006ace5
cmp eax, 0xab04cf57
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xef93b367
mov ecx, 0xca84f7df
jmp 0x1006b1a7
cmp eax, 0x69e2cb7e
je 0x1006ad02
cmp eax, 0x69f97134
jne 0x100698f9
mov eax, dword [ebp - 0x2c]
mov eax, 0xc2cae878
jmp 0x100698f9
cmp eax, 0xd5521be
je 0x1006ad1f
cmp eax, 0xfc8d64d
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x16f64942
mov ecx, 0x5c08449a
jmp 0x1006b1a7
cmp eax, 0x16bd32e4
je 0x1006add4
cmp eax, 0x16f64942
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf09c3b3d
mov ecx, 0xadf86373
jmp 0x1006b1a7
cmp eax, 0x94dde445
je 0x1006adf1
cmp eax, 0x97315d74
jne 0x100698f9
cmp byte [ebp - 0x13], 0
mov eax, 0x25789dc3
mov ecx, 0x69e2cb7e
cmovne eax, ecx
jmp 0x100698f9
cmp eax, 0x5afc961e
je 0x1006ae0e
cmp eax, 0x5bbd075b
jne 0x100698f9
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenEncryptedFileRawA]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc8306a6c
mov ecx, 0x93d9620
jmp 0x1006b1a7
cmp eax, 0xddf71f37
je 0x1006ae2b
cmp eax, 0xe0590f7f
jne 0x100698f9
push 0xf4240
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0x5ab0c0b7
jmp 0x100698f9
cmp eax, 0x3f30397a
je 0x1006ae48
cmp eax, 0x3f3d8b58
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x85f97267
mov ecx, 0x97315d74
jmp 0x1006b1a7
cmp eax, 0xc1e1aa88
je 0x1006ae5d
cmp eax, 0xc2cae878
jne 0x100698f9
mov eax, dword [ebp - 0x2c]
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x69f97134
mov ecx, 0x1281d573
jmp 0x1006b1a7
cmp eax, 0x75bd4dda
je 0x1006ae7a
cmp eax, 0x76d06b9b
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x84a16750
mov ecx, 0x647fde3
jmp 0x1006b1a7
cmp eax, 0x28f06681
je 0x1006af1c
cmp eax, 0x29dc5463
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1b54df97
mov ecx, 0xd955a8cb
jmp 0x1006b1a7
cmp eax, 0x848b1175
je 0x1006af39
cmp eax, 0x848b988e
jne 0x100698f9
push 0x1019308a
mov esi, 0x10193026
push esi
call fcn.10082f87
add esp, 8
push esi
call fcn.1006730e
sub esp, 0x18
xorps xmm0, xmm0
movups xmmword [esp + 0xc], xmm0
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
mov dword [esp + 8], 0x10067e47
call fcn.101349e0
add esp, 0x1c
mov esi, eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x3ed1d229
jmp 0x100698f9
cmp eax, 0x433e06bd
je 0x1006af56
cmp eax, 0x4379ed82
jne 0x100698f9
mov eax, 0x64a7a568
jmp 0x100698f9
cmp eax, 0xcb0df99a
je 0x1006af73
cmp eax, 0xcb7f3446
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x85f97267
mov ecx, 0x3f3d8b58
jmp 0x1006b1a7
cmp eax, 0xf4ba4eab
je 0x1006af90
cmp eax, 0xf72c41b6
jne 0x100698f9
mov eax, 0x5d41498d
jmp 0x100698f9
cmp eax, 0x308e9a97
je 0x1006afad
cmp eax, 0x371bcb18
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x90e48b77
mov ecx, 0xafcb289c
jmp 0x1006b1a7
cmp eax, 0x9f162112
je 0x1006afca
cmp eax, 0xa28967ef
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x57b3cf98
mov ecx, 0xfc8d64d
jmp 0x1006b1a7
cmp eax, 0x64a7a568
je 0x1006afd4
cmp eax, 0x6589b9ea
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2f4d57c5
mov ecx, 0x4379ed82
jmp 0x1006b1a7
cmp eax, 0x93d9620
je 0x1006aff1
cmp eax, 0xab9fa12
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x69f97134
mov ecx, 0xc2cae878
jmp 0x1006b1a7
cmp eax, 0x159a82e4
je 0x1006b00e
cmp eax, 0x16b0564a
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x75bd4dda
mov ecx, 0xaeb37086
jmp 0x1006b1a7
cmp eax, 0x8f61c807
je 0x1006b018
cmp eax, 0x90e48b77
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x848b988e
mov ecx, 0x3ed1d229
jmp 0x1006b1a7
cmp eax, 0x58100c0c
je 0x1006b071
cmp eax, 0x5ab0c0b7
jne 0x100698f9
push 0xf4240
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe0590f7f
mov ecx, 0xf4ba4eab
jmp 0x1006b1a7
cmp eax, 0xd361de73
je 0x1006b099
cmp eax, 0xd955a8cb
jne 0x100698f9
mov eax, dword [ebp - 0x2c]
cmp eax, 0x7b
sete byte [ebp - 0x13]
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1b54df97
mov ecx, 0xa4ccd058
jmp 0x1006b1a7
cmp eax, 0x3ed1d229
je 0x1006b0b6
cmp eax, 0x3f197836
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1259e4ad
mov ecx, 0x5afc961e
jmp 0x1006b1a7
cmp eax, 0xba4bbdf7
je 0x1006b122
cmp eax, 0xc047e4bf
jne 0x100698f9
mov eax, 0x9b13abbd
jmp 0x100698f9
cmp eax, 0x7484d06a
je 0x1006b13c
cmp eax, 0x7534b6f5
jne 0x100698f9
mov eax, 0x5c08449a
jmp 0x100698f9
cmp eax, 0x25789dc3
je 0x1006b161
cmp eax, 0x273ca8b6
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x379c96b4
mov ecx, 0x7df7159e
jmp 0x1006b1a7
cmp eax, 0x87993712
je 0x1006b17b
cmp eax, 0x8c04379a
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3b8c3d04
mov ecx, 0x8367d669
jmp 0x1006b1a7
cmp eax, 0x4b3a385c
je 0x1006b185
cmp eax, 0x4b8262ec
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1259e4ad
mov ecx, 0x3f197836
jmp 0x1006b1a7
cmp eax, 0xccd1d2a9
je 0x1006b18f
cmp eax, 0xd016110f
jne 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7962979a
mov ecx, 0x7fef82f1
jmp 0x1006b1a7
mov eax, 0x433e06bd
jmp 0x100698f9
mov eax, 0x8c04379a
jmp 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf09c3b3d
mov ecx, 0x7534b6f5
jmp 0x1006b1a7
push ebx
mov esi, dword [ebp + 8]
push esi
push 0x10192f5c
call fcn.1014bf80
add esp, 0xc
movzx eax, word [esi + 0x64]
mov word [0x10192fc0], ax
push ebx
push dword [ebp - 0x28]
push 0x10192fc2
call fcn.1014bf80
add esp, 0xc
push ebx
push dword [ebp - 0x24]
mov edi, 0x10193026
push edi
call fcn.1014bf80
add esp, 0xc
push ebx
push dword [ebp - 0x20]
push 0x1019308a
call fcn.1014bf80
add esp, 0xc
push ebx
push dword [ebp - 0x1c]
push 0x101930ee
call fcn.1014bf80
add esp, 0xc
push ebx
push dword [ebp - 0x18]
push 0x10193152
call fcn.1014bf80
add esp, 0xc
movzx eax, word [esi + 0x25a]
mov word [0x101931b6], ax
mov eax, dword [ebp - 0x10]
mov word [eax], 0x7325
mov byte [eax + 2], 0
push edi
push dword [ebp - 0x10]
push edi
call fcn.1006b1e6
add esp, 0xc
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x75bd4dda
mov ecx, 0x101acd1b
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2991218
mov ecx, 0xcb0df99a
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2f4d57c5
mov ecx, 0x6589b9ea
jmp 0x1006b1a7
mov eax, 0x7451a442
jmp 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x21ff619c
mov ecx, 0x40b9d1e4
jmp 0x1006b1a7
mov eax, 0x4b8262ec
jmp 0x100698f9
mov eax, dword [ebp - 0x2c]
mov eax, 0xd955a8cb
jmp 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x69fce6da
mov ecx, 0x4b8262ec
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3c31865f
mov ecx, 0x848b1175
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x453ac0d7
mov ecx, 0xc9f22bb3
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf72c41b6
mov ecx, 0x159a82e4
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xab9fa12
mov ecx, 0x29dc5463
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe0590f7f
mov ecx, 0x5ab0c0b7
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x21ff619c
mov ecx, 0x371bcb18
jmp 0x1006b1a7
mov eax, 0x9e83f932
jmp 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x42f126c6
mov ecx, 0x73604568
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcb80ec3a
mov ecx, 0x37a0b934
jmp 0x1006b1a7
mov eax, 0xd016110f
jmp 0x100698f9
mov eax, 0xf1e8055f
jmp 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x29ebd339
mov ecx, 0x28f06681
jmp 0x1006b1a7
mov eax, 0xfa82d17d
jmp 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3962182f
mov ecx, 0x433e06bd
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb60674d6
mov ecx, 0x8de82f24
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x453ac0d7
mov ecx, 0xba4bbdf7
jmp 0x1006b1a7
mov eax, 0xadf86373
jmp 0x100698f9
mov cl, byte [ebp - 0x11]
cmp byte [ebp - 0x12], 0
mov eax, 0x8e5ce2bf
mov edx, 0x9c43e270
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x57b3cf98
mov ecx, 0xa28967ef
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x43069118
mov ecx, 0xab04cf57
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x126ac39f
mov ecx, 0xaf7e3b86
jmp 0x1006b1a7
mov eax, 0xaf7e3b86
jmp 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb60674d6
mov ecx, 0xfdd59908
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4b3a385c
mov ecx, 0x16bd32e4
jmp 0x1006b1a7
push 0x1019308a
mov esi, 0x10193026
push esi
call fcn.10082f87
add esp, 8
push esi
call fcn.1006730e
sub esp, 0x18
xorps xmm0, xmm0
movups xmmword [esp + 0xc], xmm0
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
mov dword [esp + 8], 0x10067e47
call fcn.101349e0
add esp, 0x1c
mov esi, eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8f61c807
mov ecx, 0x1e4251cf
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf11cc36b
mov ecx, 0x2c339cc4
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8f61c807
mov ecx, 0xd19eafc8
jmp 0x1006b1a7
mov eax, 0xc6d2dc12
jmp 0x100698f9
mov eax, 0x602d6ca5
jmp 0x100698f9
mov eax, 0x647fde3
jmp 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3f30397a
mov ecx, 0x7484d06a
jmp 0x1006b1a7
mov eax, 0x37a0b934
jmp 0x100698f9
mov eax, 0xcb0df99a
jmp 0x100698f9
mov eax, 0x273ca8b6
jmp 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xab9fa12
mov ecx, 0xcb7f3446
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x29ebd339
mov ecx, 0xfa82d17d
jmp 0x1006b1a7
push ebx
mov esi, dword [ebp + 8]
push esi
push 0x10192f5c
call fcn.1014bf80
add esp, 0xc
movzx eax, word [esi + 0x64]
mov word [0x10192fc0], ax
push ebx
push dword [ebp - 0x28]
push 0x10192fc2
call fcn.1014bf80
add esp, 0xc
push ebx
push dword [ebp - 0x24]
mov edi, 0x10193026
push edi
call fcn.1014bf80
add esp, 0xc
push ebx
push dword [ebp - 0x20]
push 0x1019308a
call fcn.1014bf80
add esp, 0xc
push ebx
push dword [ebp - 0x1c]
push 0x101930ee
call fcn.1014bf80
add esp, 0xc
push ebx
push dword [ebp - 0x18]
push 0x10193152
call fcn.1014bf80
add esp, 0xc
movzx eax, word [esi + 0x25a]
mov word [0x101931b6], ax
mov eax, dword [ebp - 0x10]
mov word [eax], 0x7325
mov byte [eax + 2], 0
push edi
push dword [ebp - 0x10]
push edi
call fcn.1006b1e6
add esp, 0xc
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcc64d2ae
mov ecx, 0x3d6e7a14
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4b3a385c
mov ecx, 0x41489e2c
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x643baddf
mov ecx, 0xeb273d15
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x69fce6da
mov ecx, 0x396cfc1
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3b8c3d04
mov ecx, 0x8c04379a
jmp 0x1006b1a7
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenEncryptedFileRawA]
mov eax, 0x7484d06a
jmp 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x43069118
mov ecx, 0x5bcc4cb
jmp 0x1006b1a7
push ebx
mov esi, dword [ebp + 8]
push esi
push 0x10192f5c
call fcn.1014bf80
add esp, 0xc
movzx eax, word [esi + 0x64]
mov word [0x10192fc0], ax
push ebx
push dword [ebp - 0x28]
push 0x10192fc2
call fcn.1014bf80
add esp, 0xc
push ebx
push dword [ebp - 0x24]
mov edi, 0x10193026
push edi
call fcn.1014bf80
add esp, 0xc
push ebx
push dword [ebp - 0x20]
push 0x1019308a
call fcn.1014bf80
add esp, 0xc
push ebx
push dword [ebp - 0x1c]
push 0x101930ee
call fcn.1014bf80
add esp, 0xc
push ebx
push dword [ebp - 0x18]
push 0x10193152
call fcn.1014bf80
add esp, 0xc
movzx eax, word [esi + 0x25a]
mov word [0x101931b6], ax
mov eax, dword [ebp - 0x10]
mov word [eax], 0x7325
mov byte [eax + 2], 0
push edi
push dword [ebp - 0x10]
push edi
call fcn.1006b1e6
add esp, 0xc
mov eax, 0xaeb37086
jmp 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3d4e6624
mov ecx, 0xccd1d2a9
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3c31865f
mov ecx, 0x73573e71
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3962182f
mov ecx, 0x2b45f921
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2991218
mov ecx, 0x18cc188f
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x643baddf
mov ecx, 0x4db021e6
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x42f126c6
mov ecx, 0xc66c9485
jmp 0x1006b1a7
mov eax, 0xeb273d15
jmp 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7b8a43c0
mov ecx, 0xf1e8055f
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x44d8de23
mov ecx, 0x308e9a97
jmp 0x1006b1a7
mov eax, 0xab04cf57
jmp 0x100698f9
push 0x1019308a
mov esi, 0x10193026
push esi
call fcn.10082f87
add esp, 8
push esi
call fcn.1006730e
sub esp, 0x18
xorps xmm0, xmm0
movups xmmword [esp + 0xc], xmm0
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
mov dword [esp + 8], 0x10067e47
call fcn.101349e0
add esp, 0x1c
mov esi, eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xd19eafc8
jmp 0x100698f9
push 0xf4240
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd32bd6d3
mov ecx, 0x9f162112
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3d4e6624
mov ecx, 0x826e0d54
jmp 0x1006b1a7
push 0x1019308a
mov esi, 0x10193026
push esi
call fcn.10082f87
add esp, 8
push esi
call fcn.1006730e
sub esp, 0x18
xorps xmm0, xmm0
movups xmmword [esp + 0xc], xmm0
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
mov dword [esp + 8], 0x10067e47
call fcn.101349e0
add esp, 0x1c
mov esi, eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x848b988e
mov ecx, 0x9f058982
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x16f64942
mov ecx, 0x6f14f179
jmp 0x1006b1a7
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenEncryptedFileRawA]
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3f30397a
mov ecx, 0x2183a197
jmp 0x1006b1a7
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x379c96b4
mov ecx, 0x273ca8b6
jmp 0x1006b1a7
mov eax, 0xccd1d2a9
jmp 0x100698f9
mov eax, 0x16bd32e4
jmp 0x100698f9
mov eax, dword [0x10193250]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4b3c76f
mov ecx, 0x28b6a4a
cmove eax, ecx
cmp dword [0x10193254], 0xa
cmovl eax, ecx
jmp 0x100698f9
cmp eax, 0x2c339cc4
jne 0x100698f9
jmp 0x1006b1de
cmp eax, 0xf11cc36b
jne 0x100698f9
jmp 0x1006b1de
cmp eax, 0x4b3c76f
jne 0x100698f9
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]