Function at 0x10059d60
Capabilities:
Contain obfuscated stackstrings
Get common file path
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x2c38
call fcn.10087c20
mov eax, dword [0x100c51b8]
xor eax, ebp
mov dword [esp + 0x2c30], eax
mov eax, 0xb8a1bdc3
cmp eax, 0xe7b4511e
jle 0x10059db8
cmp eax, 0xe7b4511f
je 0x10059db1
cmp eax, 0xebaeedf0
je 0x10059dcf
cmp eax, 0x3ff25e
jne 0x10059d86
mov eax, dword [ebp + 8]
mov dword [eax], 0x4d3c2b1a
mov word [eax + 4], 0x6f5e
mov eax, 0xe2e7bac3
jmp 0x10059d86
cmp eax, 0xb8a1bdc3
je 0x1005a201
cmp eax, 0xe2e7bac3
jne 0x10059d86
jmp 0x1005b00e
lea eax, [esp + 0x88]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x78]
lea edx, [esp + 0x2b14]
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
lea eax, [esp + 0x290c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
xorps xmm0, xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax + 0x20], xmm0
movups xmmword [eax + 0x30], xmm0
movups xmmword [eax], xmm0
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x18]
mov byte [eax], 0x37
lea eax, [esp + 0x2b18]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
mov dword [ecx], eax
lea eax, [esp + 0x2b1c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov word [eax], 0x100
push edx
call sub.NETAPI32.dll_Netbios
movzx eax, al
mov dword [esp + 0x1c], eax
mov eax, 0x5893ed1a
mov dword [esp + 8], ecx
cmp eax, 0xd9c619
jg 0x10059e98
cmp eax, 0xddbaa1a6
jg 0x10059f24
cmp eax, 0xd274fe94
jg 0x10059f9d
cmp eax, 0x9cb472d3
je 0x10059fb9
cmp eax, 0xcf6a1d1c
jne 0x10059e5c
movzx esi, byte [esp + 0x290c]
jmp 0x1005a055
cmp eax, 0x17c16e58
jg 0x10059f53
cmp eax, 0xd9c61a
je 0x10059fd4
cmp eax, 0x3429126
je 0x10059f8b
cmp eax, 0x3d9187b
jne 0x10059e5c
mov eax, dword [esp + 0xc]
xorps xmm0, xmm0
movups xmmword [eax + 0x30], xmm0
movups xmmword [eax + 0x20], xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax], xmm0
mov eax, dword [esp + 0x18]
mov byte [eax], 0x32
mov eax, dword [esp + 4]
lea eax, [esp + eax + 0x290d]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x7c]
mov al, byte [eax]
lea ecx, [esp + 0x2b44]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov byte [ecx], al
lea eax, [esp + 0x2b14]
push eax
call sub.NETAPI32.dll_Netbios
test al, al
mov eax, 0x17c16e59
mov ecx, 0xd9c61a
cmove eax, ecx
jmp 0x10059e5c
cmp eax, 0xddbaa1a7
je 0x1005a1e8
cmp eax, 0xe11d9acf
je 0x10059f8b
cmp eax, 0xe45fa3f0
jne 0x10059e5c
mov dword [esp + 0x24], 2
mov eax, 0xddbaa1a7
jmp 0x10059e5c
cmp eax, 0x17c16e59
je 0x1005a051
cmp eax, 0x7582c950
je 0x1005a060
cmp eax, 0x5893ed1a
jne 0x10059e5c
cmp dword [esp + 0x1c], 0
mov eax, 0xe11d9acf
mov ecx, 0xcf6a1d1c
cmove eax, ecx
jmp 0x10059e5c
mov eax, 0xd274fe95
mov dword [esp + 8], 0
jmp 0x10059e5c
cmp eax, 0xdd391868
jne 0x1005a1d8
mov eax, 0xddbaa1a7
xor ecx, ecx
inc ecx
mov dword [esp + 0x24], ecx
jmp 0x10059e5c
mov dword [esp + 4], esi
cmp dword [esp + 4], 0
mov eax, 0xe45fa3f0
mov ecx, 0x3d9187b
cmovns eax, ecx
jmp 0x10059e5c
push 0x258
push 0
push dword [esp + 0x80]
call fcn.1008c000
add esp, 0xc
mov eax, dword [esp + 0xc]
xorps xmm0, xmm0
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax + 0x20], xmm0
movups xmmword [eax + 0x30], xmm0
mov eax, dword [esp + 0x18]
mov byte [eax], 0x33
mov eax, dword [esp + 0x7c]
mov al, byte [eax]
mov ecx, dword [esp + 0x10]
mov byte [ecx], al
mov word [esp + 0x2b1e], 0x2a
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x2c]
mov dword [ecx], eax
mov eax, dword [esp + 0x30]
mov word [eax], 0x258
lea eax, [esp + 0x2b14]
push eax
call sub.NETAPI32.dll_Netbios
test al, al
mov eax, 0x17c16e59
mov ecx, 0x7582c950
cmove eax, ecx
jmp 0x10059e5c
mov esi, dword [esp + 4]
dec esi
mov eax, 0x9cb472d3
jmp 0x10059e5c
mov dword [esp + 0x20], esi
mov al, byte [esp + 0x88]
mov ecx, dword [ebp + 8]
mov byte [ecx], al
mov al, byte [esp + 0x89]
mov byte [ecx + 1], al
mov al, byte [esp + 0x8a]
mov byte [ecx + 2], al
mov al, byte [esp + 0x8b]
mov byte [ecx + 3], al
mov al, byte [esp + 0x8c]
mov byte [ecx + 4], al
mov al, byte [esp + 0x8d]
mov byte [ecx + 5], al
mov word [esp + 0x2c1c], 0
mov dword [esp + 0x2c18], 0
mov esi, 0xc55209bc
xor eax, eax
cmp esi, 0xf8db1015
jle 0x1005a10b
cmp esi, 0x44441303
jg 0x1005a137
cmp esi, 0xf8db1016
je 0x1005a18b
cmp esi, 0x320edc0b
jne 0x1005a0be
mov esi, dword [esp + 0x80]
mov edi, dword [ebp + 8]
mov bl, byte [edi + esi]
mov edi, dword [esp + 0x80]
mov esi, 0x44bd094f
cmp bl, byte [esp + edi + 0x2c18]
je 0x1005a0be
mov esi, 0x44441304
jmp 0x1005a0be
cmp esi, 0xd271761c
jle 0x1005a15d
cmp esi, 0xd271761d
je 0x1005a197
cmp esi, 0xe996ce99
jne 0x1005a0be
cmp edx, 2
mov esi, 0x98d572d4
mov ecx, 0xf8db1016
cmove esi, ecx
xor ecx, ecx
jmp 0x1005a0be
cmp esi, 0x44441304
je 0x1005a1a6
cmp esi, 0x44bd094f
jne 0x1005a0be
mov eax, dword [esp + 0x80]
inc eax
mov esi, 0xc55209bc
jmp 0x1005a0be
cmp esi, 0xc55209bc
jne 0x1005a1b3
mov dword [esp + 0x80], eax
mov ebx, dword [esp + 0x80]
mov esi, 0x320edc0b
cmp ebx, 6
jb 0x1005a0be
mov esi, 0xd271761d
jmp 0x1005a0be
mov esi, 0x98d572d4
mov cl, 1
jmp 0x1005a0be
mov esi, 0xe996ce99
mov edx, 2
jmp 0x1005a0be
mov esi, 0xe996ce99
xor edx, edx
inc edx
jmp 0x1005a0be
cmp esi, 0x98d572d4
jne 0x1005a0be
test cl, 1
mov eax, 0xdd391868
mov ecx, 0x17c16e59
cmovne eax, ecx
mov esi, dword [esp + 0x20]
jmp 0x10059e5c
cmp eax, 0xd274fe95
jne 0x10059e5c
jmp 0x1005afeb
cmp dword [esp + 0x24], 2
mov eax, 0xd274fe95
mov ecx, 0x3429126
cmove eax, ecx
mov cl, 1
jmp 0x10059e58
lea esi, [esp + 0x290c]
mov dword [esp + 0x38], esi
mov eax, dword [esp + 0x38]
push 0x208
push 0
push dword [esp + 0x40]
call fcn.1008c000
add esp, 0xc
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.iphlpapi.dll
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x3c], eax
mov eax, 0x46e3c793
mov dword [esp + 8], ecx
cmp eax, 0x1a5f8549
jle 0x1005a3d3
cmp eax, 0x46e3c792
jg 0x1005a418
cmp eax, 0x2b245480
jle 0x1005a490
cmp eax, 0x2b245481
je 0x1005a52a
cmp eax, 0x2cc0f4f9
je 0x1005a534
cmp eax, 0x343d427c
jne 0x1005a24f
mov word [esp + 0x2b18], 0
mov dword [esp + 0x2b14], 0
mov edx, 0xc55209bc
xor eax, eax
mov dword [esp + 8], ecx
cmp edx, 0xf8db1015
jle 0x1005a2fa
cmp edx, 0x44441303
jg 0x1005a333
cmp edx, 0xf8db1016
je 0x1005a387
cmp edx, 0x320edc0b
jne 0x1005a2ad
mov edx, dword [esp + 0x2c18]
mov esi, dword [ebp + 8]
mov bl, byte [esi + edx]
mov esi, dword [esp + 0x2c18]
mov edx, 0x44bd094f
cmp bl, byte [esp + esi + 0x2b14]
je 0x1005a2ad
mov edx, 0x44441304
jmp 0x1005a2ad
cmp edx, 0xd271761c
jle 0x1005a359
cmp edx, 0xd271761d
je 0x1005a397
cmp edx, 0xe996ce99
jne 0x1005a2ad
cmp ecx, 2
mov edx, 0x98d572d4
mov esi, 0xf8db1016
cmove edx, esi
mov dword [esp + 8], 0
jmp 0x1005a2ad
cmp edx, 0x44441304
je 0x1005a3a6
cmp edx, 0x44bd094f
jne 0x1005a2ad
mov eax, dword [esp + 0x2c18]
inc eax
mov edx, 0xc55209bc
jmp 0x1005a2ad
cmp edx, 0xc55209bc
jne 0x1005a3b3
mov dword [esp + 0x2c18], eax
mov esi, dword [esp + 0x2c18]
mov edx, 0x320edc0b
cmp esi, 6
jb 0x1005a2ad
mov edx, 0xd271761d
jmp 0x1005a2ad
mov edx, 0x98d572d4
mov bl, 1
mov dword [esp + 8], ebx
jmp 0x1005a2ad
mov edx, 0xe996ce99
mov ecx, 2
jmp 0x1005a2ad
mov edx, 0xe996ce99
xor ecx, ecx
inc ecx
jmp 0x1005a2ad
cmp edx, 0x98d572d4
jne 0x1005a2ad
mov eax, dword [esp + 8]
xor al, 1
mov dword [esp + 8], eax
mov eax, 0xdb379417
jmp 0x1005a24f
cmp eax, 0xd792dcc9
jg 0x1005a455
cmp eax, 0xaf48baab
jle 0x1005a4b4
cmp eax, 0xaf48baac
je 0x1005a550
cmp eax, 0xcf2510f5
je 0x1005a577
cmp eax, 0xcf38289a
jne 0x1005a24f
mov eax, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
mov eax, 0x2b245481
jmp 0x1005a24f
cmp eax, 0x68b9417d
jle 0x1005a4dc
cmp eax, 0x68b9417e
je 0x1005a5a1
cmp eax, 0x700c3395
je 0x1005a5c8
cmp eax, 0x7f567276
jne 0x1005a24f
mov eax, dword [esp + 0x60]
cmp eax, 0x17
mov eax, 0x15f0fe8f
jmp 0x1005a56a
cmp eax, 0xe7516a49
jg 0x1005a506
cmp eax, 0xd792dcca
je 0x1005a5d2
cmp eax, 0xe4ec5194
jne 0x1005afd0
mov dword [esp + 0x44], 3
mov eax, 0x68b9417e
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x48], ecx
jmp 0x1005a24f
cmp eax, 0x1a5f854a
je 0x1005a8b1
cmp eax, 0x21765c6b
jne 0x1005a24f
mov eax, dword [esp + 0x34]
mov eax, 0x9bbd7ead
jmp 0x1005a24f
cmp eax, 0x9bbd7ead
je 0x1005a8d9
cmp eax, 0x9ff824f0
jne 0x1005a24f
mov eax, 0xdb379417
mov dword [esp + 8], 0
jmp 0x1005a24f
cmp eax, 0x46e3c793
je 0x1005a927
cmp eax, 0x626dfa51
jne 0x1005a24f
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x343d427c
jmp 0x1005a24f
cmp eax, 0xe7516a4a
je 0x1005a93e
cmp eax, 0x15f0fe8f
jne 0x1005a24f
mov eax, dword [esp + 0x34]
mov eax, 0x2cc0f4f9
jmp 0x1005a8cc
mov eax, 0x626dfa51
jmp 0x1005a24f
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
mov dword [esp + 0x48], eax
mov eax, 0x68b9417e
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x44], ecx
jmp 0x1005a24f
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 0x1a0]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
cmp eax, 6
mov eax, 0x7f567276
mov ecx, 0x1a5f854a
cmove eax, ecx
jmp 0x1005a24f
push str.GetAdaptersInfo
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x4c], eax
cmp dword [esp + 0x4c], 0
mov eax, 0xe7516a4a
mov ecx, 0x2b245481
cmove eax, ecx
jmp 0x1005a24f
mov eax, dword [esp + 0x44]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], 0
mov eax, 0xd792dcca
mov ecx, 0x700c3395
cmove eax, ecx
jmp 0x1005a24f
mov eax, 0xcf38289a
jmp 0x1005a24f
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x2c18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov ah, 1
mov byte [esp + 0x2b14], ah
mov byte [esp + 0x2b15], 0x32
mov al, 0x2f
mov byte [esp + 0x2b16], al
mov al, 6
mov byte [esp + 0x2b17], al
mov al, 6
mov ch, 0xd
mov byte [esp + 0x2b18], ch
mov byte [esp + 0x2b19], ch
mov byte [esp + 0x2b1a], 0x1d
mov byte [esp + 0x2b1b], 0x16
mov byte [esp + 0x2b1c], 0x26
mov byte [esp + 0x2b1d], 0x36
mov byte [esp + 0x2b1e], ah
mov cl, 5
mov byte [esp + 0x2b1f], cl
mov dh, 4
mov byte [esp + 0x2b20], dh
mov bl, 0x14
mov byte [esp + 0x2b21], bl
mov byte [esp + 0x2b22], 0x1e
mov byte [esp + 0x2b23], 7
mov bh, 0x31
mov byte [esp + 0x2b24], bh
mov cl, 2
mov byte [esp + 0x2b25], cl
mov byte [esp + 0x2b26], cl
mov byte [esp + 0x2b27], 0x1b
mov byte [esp + 0x2b28], 0x1c
mov byte [esp + 0x2b29], al
mov byte [esp + 0x2b2a], dh
mov cl, 0x38
mov byte [esp + 0x2b2b], cl
mov dl, 0xf
mov byte [esp + 0x2b2c], dl
mov al, 0x11
mov byte [esp + 0x2b2d], al
mov byte [esp + 0x2b2e], cl
mov byte [esp + 0x2b2f], 0x24
mov byte [esp + 0x2b30], 9
mov byte [esp + 0x2b31], dl
mov byte [esp + 0x2b32], bl
mov byte [esp + 0x2b33], al
mov byte [esp + 0x2b34], ch
mov byte [esp + 0x2b35], bh
mov byte [esp + 0x2b36], 0
mov byte [esp + 0x2b37], al
mov byte [esp + 0x2b38], 0x3b
mov byte [esp + 0x2b39], 0x2d
mov al, 0x2f
mov byte [esp + 0x2b3a], al
mov byte [esp + 0x2b3b], 0x34
mov byte [esp + 0x2b3c], 0x28
mov byte [esp + 0x2b3d], 0x3e
mov al, 8
mov byte [esp + 0x2b3e], al
mov byte [esp + 0x2b3f], 0x2c
mov byte [esp + 0x2b40], 0x62
mov byte [esp + 0x2b41], 0x15
mov cl, 0x63
mov byte [esp + 0x2b42], cl
mov byte [esp + 0x2b43], 0x65
mov byte [esp + 0x2b44], 0x17
mov byte [esp + 0x2b45], 0x74
mov dl, 0x7b
mov byte [esp + 0x2b46], dl
mov byte [esp + 0x2b47], 0x7d
mov byte [esp + 0x2b48], cl
mov byte [esp + 0x2b49], 0xc
mov byte [esp + 0x2b4a], dl
mov byte [esp + 0x2b4b], 0x79
mov byte [esp + 0x2b4c], 0x7f
mov byte [esp + 0x2b4d], 0x68
mov byte [esp + 0x2b4e], 0x75
mov byte [esp + 0x2b4f], 0x76
mov cl, 5
mov byte [esp + 0x2b50], cl
mov byte [esp + 0x2b51], dh
mov byte [esp + 0x2b52], 0x6d
mov byte [esp + 0x2b53], ah
mov byte [esp + 0x2b54], dh
mov byte [esp + 0x2b55], 0x7e
mov byte [esp + 0x2b56], ch
mov byte [esp + 0x2b57], 0x12
mov byte [esp + 0x2b58], 0xe
mov byte [esp + 0x2b59], ah
mov byte [esp + 0x2b5a], al
mov cl, 0xb
mov byte [esp + 0x2b5b], cl
mov byte [esp + 0x2b5c], al
mov byte [esp + 0x2b5d], 0x77
mov byte [esp + 0x2b5e], 0x71
mov al, 6
mov byte [esp + 0x2b5f], al
mov byte [esp + 0x2b60], al
mov al, 2
mov byte [esp + 0x2b61], al
mov byte [esp + 0x2b62], ah
mov byte [esp + 0x2b63], cl
mov byte [esp + 0x2b64], 0x4f
lea eax, [esp + 0x2b67]
mov dword [esp + 4], eax
mov ecx, 0x50502404
lea eax, [esp + 0x2b65]
cmp ecx, 0x4a88d7d0
je 0x1005a984
cmp ecx, 0x50502404
jne 0x1005a886
mov byte [eax], 0
inc eax
cmp eax, dword [esp + 4]
mov ecx, 0x50502404
mov edx, 0x4a88d7d0
cmove ecx, edx
jmp 0x1005a886
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x40]
cmp ecx, eax
mov eax, dword [esp + 0x34]
mov eax, 0x2cc0f4f9
mov ecx, 0x9bbd7ead
cmovg eax, ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x20], ecx
jmp 0x1005a24f
mov eax, dword [esp + 0x28]
mov cl, byte [eax + 0x194]
mov edx, dword [ebp + 8]
mov byte [edx], cl
mov cl, byte [eax + 0x195]
mov byte [edx + 1], cl
mov cl, byte [eax + 0x196]
mov byte [edx + 2], cl
mov cl, byte [eax + 0x197]
mov byte [edx + 3], cl
mov cl, byte [eax + 0x198]
mov byte [edx + 4], cl
mov al, byte [eax + 0x199]
mov byte [edx + 5], al
mov eax, 0x2cc0f4f9
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x20], ecx
jmp 0x1005a24f
cmp dword [esp + 0x3c], 0
mov eax, 0xcf2510f5
mov ecx, 0x9ff824f0
cmove eax, ecx
jmp 0x1005a24f
lea ecx, [esp + 0x88]
mov dword [esp + 0x50], ecx
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x64]
mov dword [esp + 0x54], edx
mov eax, dword [esp + 0x54]
mov dword [esp + 0x64], 0x2880
mov dword [esp + 0x58], ecx
mov eax, dword [esp + 0x4c]
push edx
push dword [esp + 0x5c]
call eax
test eax, eax
mov eax, 0xcf38289a
mov ecx, 0xe4ec5194
cmove eax, ecx
jmp 0x1005a24f
lea eax, [esp + 0x2b14]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov al, byte [eax]
mov byte [esp + 0x1c], al
mov eax, 0xbc7652d2
cmp eax, 0x624075b6
jg 0x1005aa03
cmp eax, 0xb8e04b7e
je 0x1005aa8b
cmp eax, 0xbc7652d2
je 0x1005aa31
cmp eax, 0xc749d7b
jne 0x1005a99e
mov eax, dword [esp + 0x7c]
mov cl, byte [esp + eax + 0x2b16]
mov eax, dword [esp + 0x7c]
mov dl, byte [esp + 0x2b15]
mov esi, 0xfe
sub esi, eax
and esi, 0xbe
inc eax
and eax, 0x41
or eax, esi
xor al, dl
xor al, cl
xor al, 0xf1
mov ecx, dword [esp + 0x7c]
mov byte [esp + ecx + 0x2b16], al
inc dword [esp + 0x7c]
mov eax, 0x6c0daa17
jmp 0x1005a99e
cmp eax, 0x624075b7
je 0x1005aa48
cmp eax, 0x64a56982
je 0x1005aa66
cmp eax, 0x6c0daa17
jne 0x1005a99e
mov eax, dword [esp + 0x7c]
cmp eax, 0x4f
mov eax, 0x64a56982
mov ecx, 0xc749d7b
cmovb eax, ecx
jmp 0x1005a99e
test byte [esp + 0x1c], 1
mov eax, 0x624075b7
mov ecx, 0xb8e04b7e
cmove eax, ecx
jmp 0x1005a99e
lea eax, [esp + 0x7c]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x7c], 0
mov eax, 0x6c0daa17
jmp 0x1005a99e
mov eax, dword [esp + 4]
mov byte [esp + 0x2b65], 0
mov byte [esp + 0x2b66], 0
mov eax, dword [esp + 0x10]
mov byte [eax], 0
mov eax, 0xb8e04b7e
jmp 0x1005a99e
add dword [esp + 0x24], 8
xor ebx, ebx
mov dword [esp + 0x2c18], ebx
mov dword [esp + 0x2c28], ebx
mov dword [esp + 0x2c2c], 0xf
mov byte [esp + 0x2c18], 0
lea esi, [esp + 0x2b16]
push esi
call fcn.1009ee80
add esp, 4
lea edi, [esp + 0x2c18]
mov ecx, edi
push eax
push esi
call fcn.10007b00
lea eax, [esp + 0x2b14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
lea eax, [esp + 0x78]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x78], 0x104
lea eax, [esp + 0x74]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x74], 1
lea esi, [esp + 0x70]
mov dword [esp + 0x30], esi
mov eax, dword [esp + 0x30]
mov dword [esp + 0x70], ebx
lea eax, [esp + 0x6c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x6c], ebx
lea eax, [esp + 0x68]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x68], ebx
mov ecx, edi
call fcn.10007bca
push esi
push 0x20019
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x10], eax
mov ecx, 0xd4d670f1
cmp ecx, 0x296ac6d1
jle 0x1005aba4
cmp ecx, 0x63b9e1b4
jg 0x1005ac0c
cmp ecx, 0x432e1db2
jg 0x1005ac95
cmp ecx, 0x296ac6d2
je 0x1005adc2
cmp ecx, 0x42fec53a
jne 0x1005ab5d
cmp dword [esp + 0x68], 2
mov ecx, 0xc7d1a5e6
je 0x1005ab5d
mov ecx, 0x73520bc7
jmp 0x1005ab5d
cmp ecx, 0xc7d1a5e5
jle 0x1005ac57
cmp ecx, 0xd4d670f0
jg 0x1005ad04
cmp ecx, 0xc7d1a5e6
je 0x1005ade9
cmp ecx, 0xc95f04de
jne 0x1005ab5d
mov eax, 4
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x80]
lea eax, [esp + 0x7c]
push eax
push 0
push str.MediaSubType
push dword [esp + 0x80]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, 0x4df8ed32
jmp 0x1005acf7
cmp ecx, 0x73520bc6
jg 0x1005ad2b
cmp ecx, 0x63b9e1b5
je 0x1005adf6
cmp ecx, 0x6a158629
jne 0x1005ab5d
push 3
push 0x100be40a
push dword [esp + 0xc]
call fcn.1009ef10
add esp, 0xc
test eax, eax
mov ecx, 0x3a8071b
mov eax, 0x42fec53a
cmove ecx, eax
jmp 0x1005ab5d
cmp ecx, 0xc05e4e73
jg 0x1005adaa
cmp ecx, 0x89490b78
je 0x1005ae0c
cmp ecx, 0xbeb30394
jne 0x1005ab5d
cmp dword [esp + 0x68], 1
mov ecx, 0x6a158629
je 0x1005ab5d
mov ecx, 0x42fec53a
jmp 0x1005ab5d
cmp ecx, 0x432e1db3
je 0x1005ae26
cmp ecx, 0x4df8ed32
jne 0x1005ab5d
mov dword [esp + 0x74], 1
mov dword [esp + 0x78], 0x103
push 0x104
xor esi, esi
push esi
push dword [esp + 0xc]
call fcn.1008c000
add esp, 0xc
lea eax, [esp + 0x78]
push eax
push dword [esp + 8]
lea eax, [esp + 0x7c]
push eax
push esi
push str.PnpInstanceID
push dword [esp + 0x80]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, 0x89490b78
test eax, eax
jne 0x1005ad9b
jmp 0x1005ada0
cmp ecx, 0xd4d670f1
je 0x1005ae3c
cmp ecx, 0x3a8071b
jne 0x1005ab5d
mov ecx, 0x432e1db3
mov esi, 2
jmp 0x1005ab5d
cmp ecx, 0x73520bc7
je 0x1005ad9b
cmp ecx, 0x7b80d0a1
jne 0x1005ab5d
lea eax, [esp + 0x2b14]
mov dword [esp + 4], eax
push dword [esp + 0x24]
push str._sConnection
push 0xffffffffffffffff
push 0x103
push dword [esp + 0x14]
call fcn.1005b53c
add esp, 0x14
lea eax, [esp + 0x6c]
push eax
push 0x20019
push 0
push dword [esp + 0x10]
push dword [esp + 0x80]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, 0xc95f04de
test eax, eax
je 0x1005ad91
mov ecx, 0x63b9e1b5
mov ebx, 3
jmp 0x1005ab5d
mov ecx, 0x432e1db3
mov esi, 3
jmp 0x1005ab5d
cmp ecx, 0xc466b1fb
jne 0x1005ae57
mov ecx, 0x432e1db3
xor esi, esi
jmp 0x1005ab5d
push 3
push 0x100be40a
push dword [esp + 0xc]
call fcn.1009ef10
add esp, 0xc
test eax, eax
mov ecx, 0xbeb30394
mov eax, 0xc466b1fb
cmove ecx, eax
jmp 0x1005ab5d
mov ecx, 0x432e1db3
xor esi, esi
inc esi
jmp 0x1005ab5d
push dword [esp + 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0xc05e4e74
mov edi, ebx
jmp 0x1005ab5d
cmp dword [esp + 0x68], 1
mov ecx, 0x296ac6d2
je 0x1005ab5d
mov ecx, 0xbeb30394
jmp 0x1005ab5d
push dword [esp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x63b9e1b5
mov ebx, esi
jmp 0x1005ab5d
cmp dword [esp + 0x10], 0
mov ecx, 0x7b80d0a1
je 0x1005ae4d
mov ecx, 0xc05e4e74
mov edi, 3
jmp 0x1005ab5d
cmp ecx, 0xc05e4e74
jne 0x1005ab5d
mov eax, dword [esp + 0x7c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x2c18]
call fcn.100087f0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x5c], edi
lea eax, [esp + 0x80]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov word [esp + 0x84], 0
mov dword [esp + 0x80], 0
mov esi, 0xc55209bc
xor eax, eax
cmp esi, 0xf8db1015
jle 0x1005af07
cmp esi, 0x44441303
jg 0x1005af33
cmp esi, 0xf8db1016
je 0x1005af87
cmp esi, 0x320edc0b
jne 0x1005aeba
mov esi, dword [esp + 0x2b14]
mov edi, dword [ebp + 8]
mov bl, byte [edi + esi]
mov edi, dword [esp + 0x2b14]
mov esi, 0x44bd094f
cmp bl, byte [esp + edi + 0x80]
je 0x1005aeba
mov esi, 0x44441304
jmp 0x1005aeba
cmp esi, 0xd271761c
jle 0x1005af59
cmp esi, 0xd271761d
je 0x1005af93
cmp esi, 0xe996ce99
jne 0x1005aeba
cmp edx, 2
mov esi, 0x98d572d4
mov ecx, 0xf8db1016
cmove esi, ecx
xor ecx, ecx
jmp 0x1005aeba
cmp esi, 0x44441304
je 0x1005afa2
cmp esi, 0x44bd094f
jne 0x1005aeba
mov eax, dword [esp + 0x2b14]
inc eax
mov esi, 0xc55209bc
jmp 0x1005aeba
cmp esi, 0xc55209bc
jne 0x1005afaf
mov dword [esp + 0x2b14], eax
mov edi, dword [esp + 0x2b14]
mov esi, 0x320edc0b
cmp edi, 6
jb 0x1005aeba
mov esi, 0xd271761d
jmp 0x1005aeba
mov esi, 0x98d572d4
mov cl, 1
jmp 0x1005aeba
mov esi, 0xe996ce99
mov edx, 2
jmp 0x1005aeba
mov esi, 0xe996ce99
xor edx, edx
inc edx
jmp 0x1005aeba
cmp esi, 0x98d572d4
jne 0x1005aeba
test cl, 1
mov eax, 0xaf48baac
mov ecx, 0x21765c6b
cmovne eax, ecx
jmp 0x1005a24f
cmp eax, 0xdb379417
jne 0x1005a24f
mov eax, dword [esp + 0x38]
test byte [esp + 8], 1
mov eax, 0xebaeedf0
jmp 0x1005b001
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x78]
test byte [esp + 8], 1
mov eax, 0x3ff25e
mov ecx, 0xe7b4511f
cmovne eax, ecx
jmp 0x10059d86
mov ecx, dword [esp + 0x2c30]
xor ecx, ebp
call fcn.100879aa
mov al, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret