Function at 0x100938c
Capabilities:
Accept command line arguments
Compare security identifiers
Parse pe header
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2404
call fcn.0100f560
mov eax, dword [0x1012d50]
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push 0x10131c1
push esi
push esi
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1a0c]
push esi
push esi
mov dword [ebp - 0x1a14], 1
mov dword [ebp - 0x1a18], eax
call fcn.01004621
mov eax, dword [0x10111c0]
mov word [eax], si
mov eax, dword [0x10119d0]
mov word [eax], si
lea eax, [ebp - 0x215c]
add esp, 0x20
mov dword [ebp - 0x2164], 0x104
mov dword [ebp - 0x2168], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x22
mov ebx, eax
pop ecx
cmp word [ebx], cx
jne 0x100940c
inc ebx
inc ebx
jmp 0x100940f
push 0x20
pop ecx
mov ax, word [ebx]
cmp ax, si
je 0x100942d
cmp ax, cx
je 0x1009426
inc ebx
inc ebx
mov ax, word [ebx]
cmp ax, si
jne 0x1009417
cmp word [ebx], si
je 0x100942d
inc ebx
inc ebx
mov eax, dword [ebp + 8]
push 0xfffffffffffffff5
mov dword [0x10131a0], eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
mov dword [0x10136d4], eax
je 0x1009452
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
jne 0x1009458
mov dword [0x10136d4], esi
xor eax, eax
mov edx, 0x1ff
mov word [ebp - 0xa08], si
mov ecx, edx
lea edi, [ebp - 0xa06]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x1208], si
mov ecx, edx
lea edi, [ebp - 0x1206]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xa08]
mov dword [ebp - 0x238c], eax
lea eax, [ebp - 0x1208]
mov dword [ebp - 0x23bc], esi
mov dword [ebp - 0x2394], eax
mov dword [ebp - 0x23a8], esi
mov dword [0x10131b4], esi
mov ax, word [ebx]
cmp ax, 0x20
je 0x10094c0
cmp ax, 9
jne 0x10094c4
inc ebx
inc ebx
jmp 0x10094b1
mov ax, word [ebx]
cmp ax, 0x2f
je 0x10094d7
cmp ax, 0x2d
jne 0x1009638
lea eax, [ebx + 2]
cmp eax, esi
je 0x1009638
mov ax, word [eax]
or ax, 0x20
cmp ax, 0x60
jne 0x1009638
lea eax, [ebp - 0x2380]
add ebx, 4
push eax
mov dword [ebp - 0x2380], ebx
call fcn.01005480
lea eax, [ebp - 0xa08]
mov dword [ebp - 0x2384], eax
lea eax, [ebp - 0x2384]
push eax
lea eax, [ebp - 0x2380]
push eax
call fcn.010055fd
mov eax, dword [ebp - 0x2164]
add eax, eax
mov dword [ebp - 0x23b4], eax
lea eax, [ebp - 0x2398]
push eax
mov dword [ebp - 0x23a0], esi
mov dword [ebp - 0x2398], 0x20019
call fcn.0100439d
add esp, 0x10
lea eax, [ebp - 0x23ac]
push eax
push dword [ebp - 0x2398]
push esi
push 0x1002840
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100a82f
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x23b4]
push eax
push dword [ebp - 0x2168]
lea eax, [ebp - 0x23a0]
push eax
push esi
lea eax, [ebp - 0xa08]
push eax
push dword [ebp - 0x23ac]
call edi
mov ebx, eax
cmp ebx, 0xea
jne 0x10095e9
mov eax, dword [ebp - 0x23b4]
push esi
shr eax, 1
push eax
lea ecx, [ebp - 0x2168]
call fcn.010057ee
lea eax, [ebp - 0x23b4]
push eax
push dword [ebp - 0x2168]
lea eax, [ebp - 0x23a0]
push eax
push esi
lea eax, [ebp - 0xa08]
push eax
push dword [ebp - 0x23ac]
call edi
mov ebx, eax
push dword [ebp - 0x23ac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
jne 0x100a82f
cmp dword [ebp - 0x23a0], 1
jne 0x100a82f
mov eax, dword [ebp - 0x2168]
mov dword [ebp - 0x2380], eax
mov eax, dword [ebp - 0x2380]
mov si, word [eax]
cmp si, 0x20
je 0x100962f
cmp si, 9
jne 0x10099c5
add dword [ebp - 0x2380], 2
jmp 0x1009616
lea eax, [ebp - 0x2388]
push eax
push 0x7fffffff
push ebx
mov dword [ebp - 0x2388], esi
call fcn.01005b04
test eax, eax
jl 0x1009920
mov eax, dword [ebp - 0x2388]
push esi
inc eax
push eax
lea ecx, [ebp - 0x2168]
call fcn.010057ee
test al, al
je 0x1009b40
mov eax, dword [ebp - 0x2168]
xor edx, edx
mov word [eax], dx
mov esi, 0x1002834
lea edi, [ebp - 0x8c]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x100282c
lea edi, [ebp - 0x84]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x100281c
lea edi, [ebp - 0xac]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 8
pop ecx
movsw word es:[edi], word [esi]
mov esi, 0x10027fc
lea edi, [ebp - 0xcc]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x23a0]
push ecx
mov eax, 0x10027ec
push 0x7fffffff
push eax
mov dword [ebp - 0x7c], 0x10027dc
mov dword [ebp - 0x78], edx
mov byte [ebp - 0x74], dl
mov dword [ebp - 0x70], 0x10027c8
mov dword [ebp - 0x6c], edx
mov byte [ebp - 0x68], dl
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], 0x10027c0
mov byte [ebp - 0x5c], 1
mov dword [ebp - 0x58], 0x10027b4
mov dword [ebp - 0x54], 0x10027ac
mov byte [ebp - 0x50], 1
mov dword [ebp - 0x4c], 0x10027a0
mov dword [ebp - 0x48], 0x1002798
mov byte [ebp - 0x44], 1
mov dword [ebp - 0x40], 0x1002788
mov dword [ebp - 0x3c], 0x100275c
mov byte [ebp - 0x38], 1
mov dword [ebp - 0x34], 0x1002748
mov dword [ebp - 0x30], 0x100271c
mov byte [ebp - 0x2c], 1
mov dword [ebp - 0x28], 0x1002700
mov dword [ebp - 0x24], 0x10026e4
mov byte [ebp - 0x20], 1
mov dword [ebp - 0x1c], 0x10026c8
mov dword [ebp - 0x18], 0x10026a8
mov byte [ebp - 0x14], 1
mov dword [ebp - 0x10], 0x10026a0
mov dword [ebp - 0xc], 0x1002698
mov byte [ebp - 8], 1
mov dword [ebp - 0x23a0], edx
call fcn.01005b04
test eax, eax
jl 0x1009920
and dword [ebp - 0x2384], 0
mov dword [ebp - 0x2388], ebx
jmp 0x100980b
xor eax, eax
mov ax, word [esi]
test ax, ax
je 0x100982a
push eax
call fcn.01004d85
test al, al
pop ecx
je 0x100980b
mov edi, dword [ebp - 0x2384]
lea eax, [edi - 1]
cmp eax, 1
jne 0x10097dd
push 0xffffffffffffffff
push 0x1002694
lea eax, [edi - 1]
push eax
lea eax, [esi + 2]
push eax
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x1009856
lea eax, [edi - 1]
cmp dword [ebp - 0x23a0], eax
jne 0x100980b
push dword [ebp - 0x23a0]
dec edi
push 0x10027ec
push edi
add esi, 2
push esi
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x1009856
lea eax, [ebp - 0x2384]
push eax
lea eax, [ebp - 0x2388]
push eax
call fcn.01004da5
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x1009795
lea eax, [ebp - 0x84]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x74], 1
lea eax, [ebp - 0x8c]
mov byte [ebp - 0x68], 1
and dword [ebp - 0x2384], 0
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x2388], ebx
jmp 0x10098de
lea eax, [ebp - 0xac]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x74], 0
lea eax, [ebp - 0xcc]
mov byte [ebp - 0x68], 0
jmp 0x1009841
xor eax, eax
mov ax, word [edi]
test ax, ax
je 0x10098fd
push eax
call fcn.01004d85
test al, al
pop ecx
je 0x10098b8
xor ebx, ebx
lea esi, [ebp - 0x7c]
mov eax, dword [ebp - 0x2384]
push 0xffffffffffffffff
push dword [esi]
dec eax
push eax
lea eax, [edi + 2]
push eax
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x100992a
inc ebx
add esi, 0xc
cmp ebx, 0xa
jb 0x100988d
push 1
push dword [ebp - 0x2384]
lea eax, [ebp - 0x2168]
push edi
push eax
mov dword [ebp - 0x2160], 0x104
call fcn.01006c21
add esp, 0x10
test eax, eax
jne 0x1009956
lea eax, [ebp - 0x2384]
push eax
lea eax, [ebp - 0x2388]
push eax
call fcn.01004da5
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x100986f
mov esi, dword [ebp - 0x2168]
and dword [ebp - 0x2388], 0
lea eax, [ebp - 0x2388]
push eax
push 0x7fffffff
push esi
call fcn.01005b04
test eax, eax
jge 0x100995d
mov esi, 0x65b
jmp 0x100a82f
lea eax, [ebx + ebx*2]
shl eax, 2
xor ecx, ecx
mov cl, byte [ebp + eax - 0x74]
mov dword [ebp - 0x2160], 0x104
push ecx
push dword [ebp + eax - 0x78]
lea eax, [ebp - 0x2168]
push eax
call fcn.01006cdf
add esp, 0xc
jmp 0x10098da
mov esi, eax
jmp 0x100a82f
mov eax, dword [ebp - 0x2388]
test eax, eax
jbe 0x100998b
lea esi, [esi + eax*2 - 2]
jmp 0x100997b
cmp esi, dword [ebp - 0x2168]
jb 0x100998b
and word [esi], 0
dec esi
dec esi
xor eax, eax
mov ax, word [esi]
push eax
call fcn.01004d65
test al, al
pop ecx
jne 0x100996d
mov eax, dword [ebp - 0x2168]
xor esi, esi
mov si, word [eax]
test si, si
mov dword [ebp - 0x2380], eax
je 0x1009d1b
push esi
call fcn.01004d65
test al, al
pop ecx
je 0x10099c5
add dword [ebp - 0x2380], 2
mov eax, dword [ebp - 0x2380]
mov si, word [eax]
test si, si
jne 0x10099a5
test si, si
je 0x1009d1b
mov edi, 0x104
cmp si, 0x2f
je 0x1009a54
cmp si, 0x2d
je 0x1009a54
lea eax, [ebp - 0x2370]
mov dword [ebp - 0x237c], eax
lea eax, [ebp - 0x237c]
push eax
lea eax, [ebp - 0x2380]
push eax
mov dword [ebp - 0x2378], edi
mov dword [ebp - 0x2374], edi
call fcn.01008390
test eax, eax
pop ecx
pop ecx
je 0x1009d93
push dword [ebp - 0x237c]
lea eax, [ebp - 0x1208]
push eax
call fcn.01007664
lea eax, [ebp - 0x2380]
push eax
call fcn.01005480
add esp, 0xc
cmp dword [ebp - 0x2378], edi
mov esi, eax
jle 0x1009d12
push dword [ebp - 0x237c]
call fcn.01005335
pop ecx
jmp 0x1009d12
mov eax, dword [ebp - 0x2380]
inc eax
inc eax
movzx esi, word [eax]
push eax
or esi, 0x20
call fcn.010043ef
pop ecx
push 0x52
mov dword [ebp - 0x2380], eax
mov edi, 0x10014bc
pop ecx
movzx ecx, cx
or ecx, 0x20
cmp ecx, esi
je 0x1009a8b
inc edi
inc edi
mov cx, word [edi]
test cx, cx
jne 0x1009a77
mov si, word [edi]
test si, si
je 0x1009c31
mov ax, word [eax]
cmp ax, 0x20
je 0x1009ab0
test ax, ax
je 0x1009ab0
cmp ax, 9
je 0x1009ab0
xor ebx, ebx
inc ebx
jmp 0x1009ab2
xor ebx, ebx
lea eax, [ebp - 0x2380]
push eax
call fcn.01005480
cmp si, 0x63
lea eax, [ebp - 0xa08]
pop ecx
mov dword [ebp - 0x2384], eax
jne 0x1009ad9
test ebx, ebx
jne 0x1009c31
cmp si, 0x50
jne 0x1009b48
push 0
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0xa
push eax
lea ecx, [ebp - 0x1a18]
jmp 0x102b00a
push 0xe
pop esi
jmp 0x100a82f
cmp si, 0x71
je 0x1009b54
cmp si, 0x63
jne 0x1009b58
test ebx, ebx
je 0x1009b6d
lea eax, [ebp - 0x2384]
push eax
lea eax, [ebp - 0x2380]
push eax
call fcn.010055fd
pop ecx
pop ecx
lea eax, [ebp - 0x2380]
push eax
call fcn.01005480
pop ecx
mov esi, eax
mov eax, dword [ebp - 0x2384]
and word [eax], 0
mov ax, word [edi]
cmp ax, 0x46
je 0x1009ba1
cmp ax, 0x71
je 0x1009ba1
cmp ax, 0x4a
je 0x1009ba1
cmp ax, 0x6c
jne 0x1009bfd
test ebx, ebx
je 0x1009bfd
cmp ax, 0x71
lea ecx, [ebp - 0x1208]
mov dword [ebp - 0x2384], ecx
lea ecx, [ebp - 0xa08]
mov dword [ebp - 0x2394], ecx
lea ecx, [ebp - 0x1208]
mov dword [ebp - 0x238c], ecx
je 0x1009bfd
lea eax, [ebp - 0x2384]
push eax
lea eax, [ebp - 0x2380]
push eax
call fcn.010055fd
lea eax, [ebp - 0x2380]
push eax
call fcn.01005480
add esp, 0xc
mov esi, eax
mov eax, dword [ebp - 0x2384]
and word [eax], 0
mov cx, word [edi]
cmp cx, 0x61
jb 0x1009c40
cmp cx, 0x7a
ja 0x1009c40
push dword [ebp - 0x238c]
sub edi, 0x10014bc
push dword [ebp - 0x2394]
sar edi, 1
call dword [edi*4 + 0x1011158]
test eax, eax
pop ecx
pop ecx
je 0x1009ce5
call fcn.01008e20
mov esi, 0x667
jmp 0x100a82f
mov eax, dword [0x10136d8]
test eax, eax
je 0x1009ca1
cmp cx, 0x50
jne 0x1009c86
cmp word [eax], 0x41
jne 0x1009c86
lea eax, [ebp - 0x1a08]
push eax
push 0x41
call fcn.01005089
test eax, eax
pop ecx
pop ecx
jne 0x1009c31
push 0x1e
push dword [ebp - 0x2394]
lea eax, [ebp - 0x108]
push eax
mov dword [0x10136d8], edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x1009ce5
cmp word [eax], 0x50
jne 0x1009c31
cmp cx, 0x41
jne 0x1009c31
push dword [ebp - 0x238c]
push 0x41
call fcn.01005089
jmp 0x1009c27
cmp cx, 0x50
mov dword [0x10136d8], edi
je 0x1009cc5
push 0x400
push dword [ebp - 0x238c]
lea eax, [ebp - 0x1a08]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x1e
push dword [ebp - 0x2394]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [0x10136d8]
cmp word [eax], 0x45
je 0x1009d1b
and word [ebp - 0xa08], 0
and word [ebp - 0x1208], 0
lea eax, [ebp - 0xa08]
mov dword [ebp - 0x238c], eax
lea eax, [ebp - 0x1208]
mov dword [ebp - 0x2394], eax
mov edi, 0x104
test si, si
jne 0x10099d3
mov ecx, dword [0x10136d8]
xor edi, edi
cmp ecx, edi
je 0x1009e46
cmp word [ecx], 0x50
mov eax, dword [ebp - 0x1a18]
je 0x1009d3d
lea eax, [ebp - 0x1a08]
push eax
sub ecx, 0x10014bc
lea eax, [ebp - 0x108]
sar ecx, 1
push eax
call dword [ecx*4 + 0x1011158]
mov esi, eax
mov eax, dword [0x10136d8]
mov ax, word [eax]
cmp ax, 0x59
pop ecx
pop ecx
mov dword [ebp - 0x2394], esi
je 0x100a82f
cmp ax, 0x5a
je 0x100a82f
cmp esi, edi
jne 0x1009dc8
cmp ax, 0x45
jne 0x1009db9
mov dword [0x10131b4], 1
jmp 0x1009e56
call fcn.01008e20
cmp dword [ebp - 0x2378], edi
mov esi, 0x667
jle 0x100a82f
push dword [ebp - 0x237c]
call fcn.01005335
jmp 0x100a82e
mov dword [ebp - 0x23a8], 1
jmp 0x1009e56
cmp esi, 0x8000
jne 0x1009ddd
mov dword [0x10131b4], edi
xor esi, esi
jmp 0x100a82f
cmp ax, 0x52
je 0x1009e3d
cmp ax, 0x55
je 0x1009e3d
mov eax, 0x4eb
cmp esi, eax
jg 0x1009e1d
je 0x1009e56
cmp esi, 0xfffffffe
jl 0x1009e3d
cmp esi, edi
jl 0x100a82f
cmp esi, 1
jle 0x1009e3d
cmp esi, 3
jle 0x1009e10
cmp esi, 0x7b
jne 0x1009e3d
mov esi, 0x653
mov dword [ebp - 0x2394], esi
jmp 0x1009e3d
cmp esi, 0x642
jl 0x1009e3d
cmp esi, 0x644
jle 0x1009e56
cmp esi, 0x669
je 0x1009e56
cmp esi, 0xbc2
je 0x1009e56
push esi
call fcn.01007260
pop ecx
jmp 0x1009e56
call fcn.01008e20
mov esi, 0x667
mov dword [ebp - 0x2394], esi
cmp esi, edi
jne 0x100a82f
cmp dword [ebp - 0x23a8], edi
jne 0x1009e72
cmp dword [0x10131b4], edi
je 0x100a82f
cmp dword [0x10131b4], edi
push edi
je 0x1009e84
push edi
call dword [0x10121f8]
jmp 0x1009e8a
call dword [sym.imp.ole32.dll_CoInitialize]
cmp dword [ebp - 0x23a8], edi
je 0x1009ed6
cmp dword [0x10131b4], edi
jne 0x1009ee3
mov ebx, 0x10013e4
lea eax, [edi + 0x1013148]
push eax
push 1
push 4
lea eax, [edi + 0x10111b8]
push eax
push ebx
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
test eax, eax
jne 0x1009ecc
add ebx, 0x10
add edi, 4
cmp ebx, 0x10013f4
jl 0x1009e9f
jmp 0x1009ed6
mov dword [ebp - 0x23bc], 1
cmp dword [0x10131b4], 0
je 0x100a865
mov esi, dword [ebp - 0x2380]
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x9c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov cx, word [esi]
cmp cx, 0x30
jb 0x1009f0e
cmp cx, 0x39
ja 0x1009f0e
movzx ecx, cx
sub ecx, 0x30
jmp 0x1009f20
cmp cx, 0x41
jb 0x1009f4c
cmp cx, 0x46
ja 0x1009f4c
movzx ecx, cx
sub ecx, 0x37
mov eax, ebx
push 2
cdq
pop edi
idiv edi
neg edx
sbb edx, edx
and edx, 0xfffffff1
add edx, 0x10
imul ecx, edx
cmp ebx, 0x20
jge 0x100a69e
lea eax, [ebp + eax - 0x9c]
or byte [eax], cl
inc ebx
inc esi
inc esi
jmp 0x1009ef7
cmp ebx, 0x20
jne 0x100a69e
cmp word [esi], 0
mov byte [ebp - 0x23d8], 0
mov byte [ebp - 0x238d], 0
je 0x1009f6b
inc esi
inc esi
mov ax, word [esi]
cmp ax, 0x43
jne 0x100a069
mov byte [ebp - 0x23d8], 1
or dword [ebp - 0x2380], 0xffffffff
lea eax, [ebp - 0x2380]
push eax
push 1
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x1009fbc
or dword [ebp - 0x2380], 0xffffffff
call ebx
cmp eax, 0x3f0
jne 0x100a69e
cmp byte [ebp - 0x238d], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jne 0x1009fcd
call esi
mov edi, 0x80000001
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push eax
push eax
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp byte [ebp - 0x238d], 0
je 0x1009ff0
call esi
lea eax, [ebp - 0x23d0]
push eax
push 8
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100a0d1
lea eax, [ebp - 0x239c]
push eax
call fcn.010047f4
test eax, eax
pop ecx
jne 0x100a058
lea eax, [ebp - 0x2404]
push eax
push 0x50
lea eax, [ebp - 0x54]
push eax
push 1
push dword [ebp - 0x23d0]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x100a058
push dword [ebp - 0x239c]
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esi, eax
neg esi
sbb esi, esi
and esi, 2
push dword [ebp - 0x23d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100a108
cmp ax, 0x4d
je 0x100a07b
cmp ax, 0x45
jne 0x1009f7f
jmp 0x100a082
mov byte [ebp - 0x238d], 1
add esi, 4
push esi
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x100a854
cmp esi, 0xffffffff
je 0x100a854
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1009f7f
push edi
push 0x1002628
call fcn.01008223
pop ecx
jmp 0x100a69d
call ebx
and word [ebp - 0x2370], 0
mov edx, eax
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x236e]
rep stosd dword es:[edi], eax
push edx
push 0x10025e8
stosw word es:[edi], ax
lea eax, [ebp - 0x2370]
push 0x104
push eax
call fcn.01005ad6
add esp, 0x10
xor edi, edi
cmp esi, edi
mov ebx, 0x100
push 5
mov dword [ebp - 0x23cc], ebx
pop eax
je 0x100a121
cmp esi, 1
jne 0x100a124
push 4
pop eax
push edi
push eax
lea eax, [ebp - 0x23cc]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.01005ba7
add esp, 0x10
cmp eax, edi
mov dword [ebp - 0x239c], eax
je 0x100a166
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100a15b
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x239c]
jmp 0x100a82f
mov eax, dword [ebp - 0x23cc]
push eax
lea ecx, [ebp - 0x1b24]
mov dword [ebp - 0x23dc], eax
mov dword [ebp - 0x23c0], eax
mov dword [ebp - 0x23d4], eax
mov dword [ebp - 0x23c8], eax
mov dword [ebp - 0x23c4], eax
call fcn.010058d4
push dword [ebp - 0x23c0]
lea ecx, [ebp - 0x1e48]
call fcn.010058d4
push dword [ebp - 0x23d4]
lea ecx, [ebp - 0x1f54]
call fcn.010058d4
push dword [ebp - 0x23c8]
lea ecx, [ebp - 0x1d3c]
call fcn.010058d4
push dword [ebp - 0x23c4]
lea ecx, [ebp - 0x1c30]
call fcn.010058d4
lea eax, [ebp - 0x23c4]
push eax
push dword [ebp - 0x1c30]
lea eax, [ebp - 0x23c8]
push eax
push dword [ebp - 0x1d3c]
lea eax, [ebp - 0x23d4]
push eax
push dword [ebp - 0x1f54]
lea eax, [ebp - 0x23c0]
push eax
push dword [ebp - 0x1e48]
lea eax, [ebp - 0x23dc]
push eax
push dword [ebp - 0x1b24]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
test eax, eax
jne 0x100a2b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x2380], 0xffffffff
mov esi, eax
je 0x100a24d
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c2c], ebx
jle 0x100a261
push dword [ebp - 0x1c30]
call fcn.01005335
pop ecx
cmp dword [ebp - 0x1d38], ebx
jle 0x100a275
push dword [ebp - 0x1d3c]
call fcn.01005335
pop ecx
cmp dword [ebp - 0x1f50], ebx
jle 0x100a289
push dword [ebp - 0x1f54]
call fcn.01005335
pop ecx
cmp dword [ebp - 0x1e44], ebx
jle 0x100a29d
push dword [ebp - 0x1e48]
call fcn.01005335
pop ecx
cmp dword [ebp - 0x1b20], ebx
jle 0x100a82f
push dword [ebp - 0x1b24]
jmp 0x1009daf
push edi
push edi
push edi
push 2
push 3
push edi
push edi
push 0xffffffffffffffff
push dword [ebp - 0x1b24]
call dword [0x101222c]
cmp eax, edi
mov dword [ebp - 0x239c], eax
je 0x100a35b
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100a2ee
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x239c]
push 0x1002588
call fcn.01008223
pop ecx
pop ecx
cmp dword [ebp - 0x1c2c], ebx
jle 0x100a314
push dword [ebp - 0x1c30]
call fcn.01005335
pop ecx
cmp dword [ebp - 0x1d38], ebx
jle 0x100a328
push dword [ebp - 0x1d3c]
call fcn.01005335
pop ecx
cmp dword [ebp - 0x1f50], ebx
jle 0x100a33c
push dword [ebp - 0x1f54]
call fcn.01005335
pop ecx
cmp dword [ebp - 0x1e44], ebx
jle 0x100a350
push dword [ebp - 0x1e48]
call fcn.01005335
pop ecx
cmp dword [ebp - 0x1b20], ebx
jmp 0x100a690
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, edi
mov dword [ebp - 0x2398], eax
jne 0x100a38a
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100a300
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100a300
and dword [ebp - 0x2384], 0
and dword [ebp - 0x238c], 0
call fcn.010084a8
mov edi, eax
test edi, edi
jne 0x100a3c8
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100a3b8
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x1002528
call fcn.01008223
pop ecx
pop ecx
jmp 0x100a400
and dword [ebp - 0x23b0], 0
and dword [ebp - 0x239c], 0
call fcn.01004aaf
test eax, eax
mov dword [ebp - 0x23a4], eax
jne 0x100a429
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100a3fa
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [ebp - 0x238c]
test eax, eax
je 0x100a410
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2384]
test eax, eax
je 0x100a300
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x100a300
mov eax, dword [ebp - 0x23a4]
mov ebx, dword [eax]
lea ecx, [ebp - 0x2384]
call fcn.01005903
push eax
push 0x1001434
push dword [ebp - 0x23a4]
call dword [ebx]
mov eax, dword [ebp - 0x23a4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2384]
mov dword [ebp - 0x23a4], eax
lea eax, [ebp - 0x239c]
mov dword [ebp - 0x23b8], esi
mov ebx, dword [edi]
push eax
lea ecx, [ebp - 0x238c]
call fcn.01005903
push eax
lea eax, [ebp - 0x23b0]
push eax
push dword [ebp - 0x23a4]
lea eax, [ebp - 0x9c]
push 0x10
push eax
lea eax, [ebp - 0x23b8]
push eax
push edi
call dword [ebx + 0x38]
test eax, eax
je 0x100a4e8
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100a4b7
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x10024b8
call fcn.01008223
mov eax, dword [edi]
pop ecx
pop ecx
push edi
call dword [eax + 8]
mov eax, dword [ebp - 0x238c]
test eax, eax
je 0x100a4db
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2384]
test eax, eax
jmp 0x100a62d
push dword [ebp - 0x23b0]
xor ebx, ebx
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0x23a4], eax
jne 0x100a52c
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100a51b
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002448
jmp 0x100a608
push dword [ebp - 0x238c]
call dword [0x1012248]
test eax, eax
jne 0x100a55a
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100a60f
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100a60f
mov eax, dword [ebp - 0x2384]
lea edx, [ebp - 0x2388]
push edx
push 0x1001474
mov dword [ebp - 0x2388], ebx
mov ecx, dword [eax]
push eax
call dword [ecx]
sub esi, dword [ebp - 0x23b8]
mov eax, dword [ebp - 0x2388]
mov ecx, dword [eax]
lea edx, [ebp - 0x9c]
push edx
neg esi
sbb esi, esi
lea edx, [ebp - 0x23b8]
and esi, edx
push esi
push eax
call dword [ecx + 0x88]
mov eax, dword [ebp - 0x2388]
push dword [ebp - 0x2398]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x90]
push dword [ebp - 0x2380]
mov eax, dword [ebp - 0x2388]
push dword [ebp - 0x239c]
mov ecx, dword [eax]
push dword [ebp - 0x23d8]
push dword [ebp - 0x23b0]
push eax
call dword [ecx + 0x8c]
cmp dword [ebp - 0x2380], 0xffffffff
mov esi, eax
je 0x100a5fa
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x2380], 0xffffffff
cmp esi, ebx
je 0x100a6a8
push ebx
push 0x10023e8
call fcn.01008223
pop ecx
pop ecx
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [ebp - 0x238c]
cmp eax, ebx
je 0x100a625
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2384]
cmp eax, ebx
je 0x100a635
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, 0x100
cmp dword [ebp - 0x1c2c], esi
jle 0x100a64e
push dword [ebp - 0x1c30]
call fcn.01005335
pop ecx
cmp dword [ebp - 0x1d38], esi
jle 0x100a662
push dword [ebp - 0x1d3c]
call fcn.01005335
pop ecx
cmp dword [ebp - 0x1f50], esi
jle 0x100a676
push dword [ebp - 0x1f54]
call fcn.01005335
pop ecx
cmp dword [ebp - 0x1e44], esi
jle 0x100a68a
push dword [ebp - 0x1e48]
call fcn.01005335
pop ecx
cmp dword [ebp - 0x1b20], esi
jle 0x100a69e
push dword [ebp - 0x1b24]
call fcn.01005335
pop ecx
mov esi, 0x641
jmp 0x100a82f
mov eax, dword [ebp - 0x2388]
push dword [ebp - 0x238c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x84]
mov eax, dword [ebp - 0x2388]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [ebp - 0x238c]
cmp eax, ebx
je 0x100a6df
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2384]
cmp eax, ebx
je 0x100a6ef
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x23a4]
mov esi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp - 0x23e4], eax
mov eax, dword [ebp - 0x2398]
mov dword [0x10131ac], 3
mov dword [ebp - 0x23e0], eax
mov edi, 0x4ff
jmp 0x100a763
cmp eax, 1
je 0x100a778
cmp eax, 2
jne 0x100a784
jmp 0x100a74d
cmp dword [ebp - 0x23fc], 0x12
je 0x100a784
lea eax, [ebp - 0x2400]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2400]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push ebx
push ebx
lea eax, [ebp - 0x2400]
push ebx
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x100a72a
push edi
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x23e4]
push eax
push 2
call esi
cmp eax, ebx
jne 0x100a71e
jmp 0x100a784
push dword [ebp - 0x2398]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x100
cmp dword [ebp - 0x1c2c], esi
jle 0x100a79d
push dword [ebp - 0x1c30]
call fcn.01005335
pop ecx
cmp dword [ebp - 0x1d38], esi
jle 0x100a7b1
push dword [ebp - 0x1d3c]
call fcn.01005335
pop ecx
cmp dword [ebp - 0x1f50], esi
jle 0x100a7c5
push dword [ebp - 0x1f54]
call fcn.01005335
pop ecx
cmp dword [ebp - 0x1e44], esi
jle 0x100a7d9
push dword [ebp - 0x1e48]
call fcn.01005335
pop ecx
cmp dword [ebp - 0x1b20], esi
jle 0x100a7ed
push dword [ebp - 0x1b24]
call fcn.01005335
pop ecx
mov esi, dword [ebp - 0x2394]
xor edi, edi
cmp dword [ebp - 0x23a8], edi
je 0x100a815
cmp dword [0x10131b4], edi
jne 0x100a815
mov eax, dword [0x1013148]
cmp eax, edi
je 0x100a815
push eax
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [ebp - 0x23bc], edi
je 0x100a82f
mov esi, 0x641
push esi
call fcn.01007260
pop ecx
lea ecx, [ebp - 0x2168]
call fcn.010059c0
lea ecx, [ebp - 0x1a18]
call fcn.01007410
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.0100f222
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002380
jmp 0x100a0c6
mov dword [0x10131ac], 1
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x2400]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x100a89d
cmp dword [0x10131cc], eax
je 0x100a7f3
cmp dword [0x10131a4], eax
je 0x100a7f3
lea eax, [ebp - 0x2400]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2400]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x100a86f