Function at 0x10056f20
Capabilities:
Create process on windows
Get session user name
Print debug messages
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1e20
call fcn.1001a2d0
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
mov byte [ebp - 0x889], 0
mov byte [ebp - 0x8dd], 0
cmp dword [ebp + 0x1c], 0
je 0x10056f8f
call fcn.1003b3c0
movzx eax, al
test eax, eax
je 0x10056f81
call sym.RtlLib.dll_RT_ACM_SoftAP_GetStatus
mov dword [ebp - 0x18d4], eax
cmp dword [ebp - 0x18d4], 2
jne 0x10056f74
mov byte [ebp - 0x8dd], 1
call sym.RtlLib.dll_RT_AP_GetIsAPMode
mov byte [ebp - 0x889], al
jmp 0x10056f8f
mov byte [ebp - 0x889], 0
mov byte [ebp - 0x8dd], 0
lea ecx, [ebp - 4]
call fcn.10001af0
mov dword [ebp - 0x8b8], 0
mov dword [ebp - 0x8b0], 0
xor ecx, ecx
mov dword [ebp - 0x8ac], ecx
mov dword [ebp - 0x8a8], ecx
mov dword [ebp - 0x8a4], ecx
mov dword [ebp - 0x8a0], ecx
mov dword [ebp - 0x89c], ecx
mov dword [ebp - 0x898], ecx
mov dword [ebp - 0x894], ecx
mov dword [ebp - 0x890], ecx
push 0x41
push 0
lea edx, [ebp - 0x18d0]
push edx
call fcn.100139b0
add esp, 0xc
push 0x7d0
lea ecx, [ebp - 4]
call fcn.100015a0
push str.__xml_version_1.0____WLANProfile_xmlns_http:__www.microsoft.com_networking_WLAN_profile_v1__
lea ecx, [ebp - 4]
call fcn.10003530
push 0x100779b0
lea ecx, [ebp - 4]
call fcn.10003530
push 0x100779b8
lea ecx, [ebp - 4]
call fcn.10003530
movzx eax, byte [ebp - 0x8dd]
test eax, eax
je 0x10057044
cmp dword [ebp + 0x1c], 0
je 0x10057044
push 0x100779c4
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x10057050
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 4]
call fcn.10003530
push 0x100779dc
lea ecx, [ebp - 4]
call fcn.10003530
push 0x100779e0
lea ecx, [ebp - 4]
call fcn.10003530
push 0x100779e8
lea ecx, [ebp - 4]
call fcn.10003530
push 0x100779f8
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077a00
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077a08
lea ecx, [ebp - 4]
call fcn.10003530
mov edx, dword [ebp + 8]
add edx, 0x32
push edx
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077a14
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077a18
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077a20
lea ecx, [ebp - 4]
call fcn.10003530
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5c]
shr ecx, 3
and ecx, 1
je 0x100570f1
push 0x10077a28
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x100570fe
push 0x10077a4c
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077a70
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077a80
lea ecx, [ebp - 4]
call fcn.10003530
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
shr eax, 3
and eax, 1
je 0x10057135
push 0x10077a94
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x10057142
push 0x10077a98
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077aa0
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077ab4
lea ecx, [ebp - 4]
call fcn.10003530
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 3
and edx, 1
je 0x10057179
push 0x10077ac8
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x10057186
push 0x10077ad0
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077ad8
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077aec
lea ecx, [ebp - 4]
call fcn.10003530
movzx eax, byte [ebp - 0x8dd]
test eax, eax
je 0x100571ba
push 0x10077afc
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x100571c7
push 0x10077b04
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077b0c
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077b1c
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077b24
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077b30
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077b44
lea ecx, [ebp - 4]
call fcn.10003530
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 4
and edx, 1
je 0x10057273
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5c]
shr ecx, 5
and ecx, 7
jne 0x10057233
push 0x10077b58
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x10057271
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
shr eax, 5
and eax, 7
cmp eax, 1
jne 0x10057253
push 0x10077b5c
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x10057271
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 5
and edx, 7
cmp edx, 2
jne 0x10057271
push 0x10077b64
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x100572dd
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5c]
shr ecx, 1
and ecx, 3
cmp ecx, 3
jne 0x10057292
push 0x10077b6c
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x100572dd
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
shr eax, 1
and eax, 3
cmp eax, 2
jne 0x100572b1
push 0x10077b74
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x100572dd
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 1
and edx, 3
cmp edx, 1
jne 0x100572d0
push 0x10077b7c
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x100572dd
push 0x10077b84
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077b8c
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077ba0
lea ecx, [ebp - 4]
call fcn.10003530
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5c]
shr ecx, 0xa
and ecx, 3
cmp ecx, 3
jne 0x10057317
push 0x10077bb0
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x10057364
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
shr eax, 0xa
and eax, 3
cmp eax, 2
jne 0x10057337
push 0x10077bb4
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x10057364
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 1
jne 0x10057357
push 0x10077bbc
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x10057364
push 0x10077bc0
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077bc8
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077bd8
lea ecx, [ebp - 4]
call fcn.10003530
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5c]
shr ecx, 4
and ecx, 1
je 0x1005739b
push 0x10077be4
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x100573a8
push 0x10077bec
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077bf4
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077c00
lea ecx, [ebp - 4]
call fcn.10003530
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
shr eax, 4
and eax, 1
je 0x10057510
push 0x10077c14
lea ecx, [ebp - 4]
call fcn.10003530
call fcn.1003b3c0
movzx ecx, al
test ecx, ecx
je 0x10057407
push 0x10077c50
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077c74
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077c98
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077cb0
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077ca4
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077cfc
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077d3c
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077d40
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077d48
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077d8c
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077d90
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077da0
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077d9c
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077de8
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077df8
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077e3c
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077e40
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077e4c
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077e5c
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077e78
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077e8c
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077e9c
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x10057702
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
and eax, 1
je 0x10057702
push 0x10077ea4
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077eb0
lea ecx, [ebp - 4]
call fcn.10003530
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 1
jne 0x10057559
push 0x10077ebc
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x10057581
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1bc], 0x40
jne 0x10057574
push 0x10077ec8
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x10057581
push 0x10077ed4
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077ee0
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077eec
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077f0c
lea ecx, [ebp - 4]
call fcn.10003530
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 0xa
and edx, 3
cmp edx, 1
jne 0x10057625
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x62]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2 + 0x64]
mov dword [ebp - 0x18d8], eax
push 0x1e
push 0
lea ecx, [ebp - 0x8d8]
push ecx
call fcn.100139b0
add esp, 0xc
push 1
mov edx, dword [ebp - 0x18d8]
shl edx, 1
push edx
lea eax, [ebp - 0x8d8]
push eax
mov ecx, dword [ebp - 0x18d8]
push ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x62]
shl eax, 4
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x6c]
push edx
call fcn.10064bd0
add esp, 0x14
lea eax, [ebp - 0x8d8]
push eax
lea ecx, [ebp - 4]
call fcn.10003530
jmp 0x10057651
push 0x10077f1c
lea ecx, [ebp - 4]
call fcn.10003530
mov ecx, dword [ebp + 8]
add ecx, 0xbc
push ecx
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077f28
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077f2c
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077f3c
lea ecx, [ebp - 4]
call fcn.10003530
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x5c]
shr eax, 0xa
and eax, 3
cmp eax, 1
jne 0x10057702
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 0x62]
test edx, edx
je 0x10057702
push 0x10077f4c
lea ecx, [ebp - 4]
call fcn.10003530
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 0x62]
mov dword [ebp - 0x1e20], ecx
cmp dword [ebp - 0x1e20], 3
ja case.default.0x100576b4
mov edx, dword [ebp - 0x1e20]
jmp dword [edx*4 + 0x10057e78]
push 0x10077f58
lea ecx, [ebp - 4]
call fcn.10003530
jmp case.default.0x100576b4
push 0x10077f5c
lea ecx, [ebp - 4]
call fcn.10003530
jmp case.default.0x100576b4
push 0x10077f60
lea ecx, [ebp - 4]
call fcn.10003530
jmp case.default.0x100576b4
push 0x10077f64
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077f68
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077f74
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077f80
lea ecx, [ebp - 4]
call fcn.10003530
push str._IHV_
lea ecx, [ebp - 4]
call fcn.10003530
push str._OUIHeader_
lea ecx, [ebp - 4]
call fcn.10003530
push str._OUI_00E04C__OUI_
lea ecx, [ebp - 4]
call fcn.10003530
push str._type_00__type_
lea ecx, [ebp - 4]
call fcn.10003530
push str.__OUIHeader_
lea ecx, [ebp - 4]
call fcn.10003530
push str.__IHV_
lea ecx, [ebp - 4]
call fcn.10003530
push 0x10077fd8
lea ecx, [ebp - 4]
call fcn.10003530
push 0x7d0
push 0
lea eax, [ebp - 0x7f8]
push eax
call fcn.100139b0
add esp, 0xc
lea ecx, [ebp - 4]
call fcn.10001330
push eax
lea ecx, [ebp - 4]
call fcn.10001ae0
push eax
lea ecx, [ebp - 0x7f8]
push ecx
call fcn.10013640
add esp, 0xc
lea edx, [ebp - 0x7f8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x8b4], eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x20], eax
push 0xfa0
push 0
lea ecx, [ebp - 0x1888]
push ecx
call fcn.100139b0
add esp, 0xc
mov dword [ebp - 0x7fc], 0
jmp 0x100577ff
mov edx, dword [ebp - 0x7fc]
add edx, 1
mov dword [ebp - 0x7fc], edx
mov eax, dword [ebp - 0x7fc]
cmp eax, dword [ebp - 0x8b4]
jge 0x1005782c
mov ecx, dword [ebp - 0x7fc]
movsx dx, byte [ebp + ecx - 0x7f8]
mov eax, dword [ebp - 0x7fc]
mov word [ebp + eax*2 - 0x1888], dx
jmp 0x100577f0
push 4
push 0x10077fe8
mov ecx, dword [ebp + 8]
add ecx, 0x32
push ecx
call fcn.10018115
add esp, 0xc
test eax, eax
je 0x10057863
movzx edx, byte [ebp + 0x18]
test edx, edx
jne 0x10057863
lea eax, [ebp - 0x1888]
push eax
call sub.RtlIhvOid.dll_Ordinal_4
add esp, 4
mov dword [ebp - 0x8e4], eax
push 0x42
push 0
lea ecx, [ebp - 0x888]
push ecx
call fcn.100139b0
add esp, 0xc
mov dword [ebp - 0x7fc], 0
jmp 0x10057891
mov edx, dword [ebp - 0x7fc]
add edx, 1
mov dword [ebp - 0x7fc], edx
mov eax, dword [ebp - 0x7fc]
cmp eax, dword [ebp - 0x20]
jge 0x100578b9
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x7fc]
movsx dx, byte [ecx]
mov eax, dword [ebp - 0x7fc]
mov word [ebp + eax*2 - 0x888], dx
jmp 0x10057882
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x5c]
shr edx, 4
and edx, 1
je 0x10057bb9
mov byte [ebp - 0x1d8d], 0
mov dword [ebp - 0x1d8c], 0x400
lea eax, [ebp - 0x1d8c]
push eax
lea ecx, [ebp - 0x1d80]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [ebp - 0x1d80]
push edx
lea ecx, [ebp - 0x1d98]
call fcn.100017d0
lea ecx, [ebp - 0x1d98]
call fcn.10002770
push 0
push str.SYSTEM
lea ecx, [ebp - 0x1d98]
call fcn.10001c30
cmp eax, 0xffffffff
je 0x1005792b
mov byte [ebp - 0x1d8d], 1
push 0x84
lea eax, [ebp - 0x888]
push eax
lea ecx, [ebp - 0x1978]
push ecx
call fcn.10013640
add esp, 0xc
lea edx, [ebp - 0x1da8]
push edx
call sub.RtlIhvOid.dll_Ordinal_20
add esp, 4
mov eax, dword [ebp - 0x1da8]
mov dword [ebp - 0x18f4], eax
mov ecx, dword [ebp - 0x1da4]
mov dword [ebp - 0x18f0], ecx
mov edx, dword [ebp - 0x1da0]
mov dword [ebp - 0x18ec], edx
mov eax, dword [ebp - 0x1d9c]
mov dword [ebp - 0x18e8], eax
lea ecx, [ebp - 0x197c]
call fcn.10001af0
lea ecx, [ebp - 0x18dc]
call fcn.10001af0
lea ecx, [ebp - 0x1db0]
push ecx
call fcn.10065660
add esp, 4
push 0x5c
lea ecx, [ebp - 0x1db0]
call fcn.10001cb0
mov dword [ebp - 0x1980], eax
mov edx, dword [ebp - 0x1980]
push edx
lea eax, [ebp - 0x1e18]
push eax
lea ecx, [ebp - 0x1db0]
call fcn.10001f00
push eax
lea ecx, [ebp - 0x1db0]
call fcn.10002750
lea ecx, [ebp - 0x1e18]
call fcn.10001850
push 0x5c
lea ecx, [ebp - 0x1db0]
call fcn.10001cb0
mov dword [ebp - 0x1dac], eax
mov ecx, dword [ebp - 0x1980]
push ecx
mov edx, dword [ebp - 0x1dac]
add edx, 1
push edx
lea eax, [ebp - 0x1e1c]
push eax
lea ecx, [ebp - 0x1db0]
call fcn.10001e20
push eax
lea ecx, [ebp - 0x18dc]
call fcn.10002750
lea ecx, [ebp - 0x1e1c]
call fcn.10001850
mov ecx, dword [ebp - 0x18dc]
push ecx
push 0x10077ff4
lea edx, [ebp - 0x197c]
push edx
call fcn.100025d0
add esp, 0xc
call fcn.10047420
mov dword [ebp - 0x1d88], eax
cmp dword [ebp - 0x1d88], 1
jne 0x10057a96
lea eax, [ebp - 0x1d84]
push eax
push 0x20206
push 0
lea ecx, [ebp - 0x197c]
call fcn.10001ae0
push eax
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x1d94], eax
jmp 0x10057aba
lea ecx, [ebp - 0x1d84]
push ecx
lea ecx, [ebp - 0x197c]
call fcn.10001ae0
push eax
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x1d94], eax
cmp dword [ebp - 0x1d94], 0
jne 0x10057aff
push 0xff
lea edx, [ebp - 0x1978]
push edx
push 3
push 0
push 0x10078008
mov eax, dword [ebp - 0x1d84]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x1d84]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [ebp - 0x1d84]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [ebp - 0x1d8d]
test eax, eax
je 0x10057b65
mov dword [ebp - 0x1db4], 0xffffffff
lea ecx, [ebp - 0x1db4]
push ecx
call sym.RtlLib.dll_RT_Get_User_Token
add esp, 4
mov edx, dword [ebp - 0x1db4]
push edx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x1db8], eax
push 1
mov eax, dword [ebp - 0x1db8]
push eax
lea ecx, [ebp - 0x888]
push ecx
call sub.RtlIhvOid.dll_Ordinal_5
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x10057b8d
push 0x10078010
lea edx, [ebp - 0x1db0]
push edx
call fcn.100025d0
add esp, 8
push 1
lea ecx, [ebp - 0x1db0]
call fcn.10001ae0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [ebp - 0x1db0]
call fcn.10001850
lea ecx, [ebp - 0x18dc]
call fcn.10001850
lea ecx, [ebp - 0x197c]
call fcn.10001850
lea ecx, [ebp - 0x1d98]
call fcn.10001850
lea eax, [ebp - 0x888]
push eax
call sub.RtlIhvOid.dll_Ordinal_6
add esp, 4
mov dword [ebp - 0x8e4], eax
push 4
push 0x1007801c
mov ecx, dword [ebp + 8]
add ecx, 0x32
push ecx
call fcn.10018115
add esp, 0xc
test eax, eax
je 0x10057c02
movzx edx, byte [ebp + 0x18]
test edx, edx
jne 0x10057c02
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x888]
mov dword [ebp - 0x18], eax
jmp 0x10057c12
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x1888]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp - 0x8b0]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x8ac]
push edx
call fcn.10013640
add esp, 0xc
lea eax, [ebp - 0x8b0]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x14], 0
jne 0x10057c54
mov dword [ebp - 0xc], 2
jmp 0x10057c7a
cmp dword [ebp + 0x14], 1
jne 0x10057c63
mov dword [ebp - 0xc], 1
jmp 0x10057c7a
mov dword [ebp - 0x8e4], 0x57
lea ecx, [ebp - 4]
call fcn.10001850
jmp 0x10057e68
movzx ecx, byte [ebp - 0x8dd]
test ecx, ecx
je 0x10057c92
cmp dword [ebp + 0x1c], 0
je 0x10057c92
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
movzx edx, byte [ebp - 0x8dd]
test edx, edx
jne 0x10057d4b
cmp dword [ebp + 0x1c], 0
je 0x10057d4b
mov dword [ebp - 0x1dcc], 0x1e
mov dword [ebp - 0x1dc8], 0
mov eax, dword [ebp - 0x1dcc]
sub eax, 1
mov dword [ebp - 0x1dcc], eax
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
push 0
lea ecx, [ebp - 0x1dc4]
push ecx
call fcn.100139b0
add esp, 0xc
push 4
lea edx, [ebp - 0x1dc4]
push edx
push 0xff0101bd
push 0
call sub.RtlIhvOid.dll_Ordinal_2
add esp, 0x10
mov dword [ebp - 0x1dc8], eax
cmp dword [ebp - 0x1dc8], 0
je 0x10057d30
mov eax, dword [ebp - 0x1dc4]
shr eax, 8
mov dword [ebp - 0x1dc4], eax
cmp dword [ebp - 0x1dc4], 1
jne 0x10057d4b
cmp dword [ebp - 0x1dc8], 0
je 0x10057d4b
cmp dword [ebp - 0x1dcc], 0
jne 0x10057ccd
lea ecx, [ebp - 0x1c]
push ecx
call sub.RtlIhvOid.dll_Ordinal_18
add esp, 4
mov dword [ebp - 0x8e4], eax
lea ecx, [ebp - 0x8dc]
call fcn.10001af0
mov edx, dword [ebp - 0x8e4]
push edx
push 0x10078020
lea eax, [ebp - 0x8dc]
push eax
call fcn.100025d0
add esp, 0xc
lea ecx, [ebp - 0x8dc]
call fcn.10001ae0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movzx ecx, byte [ebp - 0x8dd]
test ecx, ecx
je 0x10057e55
cmp dword [ebp + 0x1c], 0
je 0x10057e55
mov edx, dword [ebp + 8]
cmp dword [edx + 0x1bc], 0x40
je 0x10057dd8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1bc]
push ecx
mov edx, dword [ebp + 8]
add edx, 0xbc
push edx
call sym.RtlLib.dll_RT_AP_SetPassphrase
add esp, 8
jmp 0x10057e08
push 0
push 0x20
lea eax, [ebp - 0x1e14]
push eax
push 0x40
mov ecx, dword [ebp + 8]
add ecx, 0xbc
push ecx
call fcn.10064910
add esp, 0x14
push 0x40
lea edx, [ebp - 0x1e14]
push edx
call sym.RtlLib.dll_RT_AP_SetPassphrase
add esp, 8
push 0x20
mov eax, dword [ebp + 8]
add eax, 0x32
push eax
lea ecx, [ebp - 0x1dec]
push ecx
call fcn.10013640
add esp, 0xc
mov dword [ebp - 0x1df0], 0x24
mov dword [ebp - 0x1df4], 0x64
mov edx, dword [ebp - 0x1df4]
push edx
sub esp, 0x24
mov ecx, 9
lea esi, [ebp - 0x1df0]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call sub.RtlIhvOid.dll_Ordinal_22
add esp, 0x28
lea ecx, [ebp - 0x8dc]
call fcn.10001850
lea ecx, [ebp - 4]
call fcn.10001850
pop edi
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret