Function at 0x10007f80
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ba65
mov eax, dword fs:[0]
push eax
mov eax, 0x16f0
call fcn.1000ae20
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, 0x10050ef4
mov dword [ebp - 0x16dc], edi
call fcn.1001b430
push eax
lea ecx, [ebp - 0x16c0]
call fcn.10007f10
mov eax, dword [ebp - 0x16c0]
push 0
push 0xf003f
push eax
push 0x80000001
mov dword [ebp - 4], 0
call fcn.1001dbb0
mov ebx, dword [0x100400f4]
add esp, 0x10
push 0x10041aac
call ebx
push 0x10041aac
push eax
lea ecx, [ebp - 0x16c0]
call fcn.10002100
mov ecx, 0x10050f14
call fcn.1001b430
mov esi, eax
test esi, esi
je 0x10008023
push esi
call ebx
push esi
push eax
lea ecx, [ebp - 0x16c0]
call fcn.10002100
mov ecx, dword [ebp - 0x16c0]
push 0
push 0xf003f
push ecx
push 0x80000001
call fcn.1001dbb0
add esp, 0x10
push 0x13
lea edx, [ebp - 0x80]
push edx
push 1
lea ecx, [ebp - 0x16fc]
mov dword [ebp - 0x80], 0xe6f7f3c9
mov bl, 0xe2
mov dword [ebp - 0x7c], 0xe2aca89b
mov dword [ebp - 0x78], 0xe5adefc3
mov dword [ebp - 0x74], 0xb8ecf4ce
mov word [ebp - 0x70], 0xe8c2
mov byte [ebp - 0x6e], 0xee
call fcn.1001b330
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x286]
push ecx
mov byte [ebp - 4], 1
mov word [ebp - 0x288], ax
call fcn.1000ada0
add esp, 0xc
push 4
add edi, 0x628
push edi
push 4
push str.InstallType
mov ecx, 0x10050e64
call fcn.1001b430
mov edi, dword [0x10040314]
push eax
push 0x80000002
call edi
push 0x40
lea edx, [ebp - 0x288]
push edx
push 0x10
call fcn.10028cc0
add esp, 0xc
test eax, eax
je 0x10008164
lea eax, [ebp - 0x288]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100080f0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x288]
push ecx
push 1
push str.Version
mov ecx, 0x10050e64
call fcn.1001b430
push eax
push 0x80000002
call edi
lea eax, [ebp - 0x288]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10008130
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x288]
push eax
push 1
push str.DisplayVersion
mov ecx, 0x10050e74
call fcn.1001b430
push eax
push 0x80000002
call edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x48e]
push edx
mov dword [ebp - 0x16b4], 1
mov word [ebp - 0x490], cx
call fcn.1000ada0
add esp, 0xc
lea eax, [ebp - 0x16b8]
push eax
lea ecx, [ebp - 0x490]
push ecx
lea edx, [ebp - 0x16b4]
push edx
push str.stup.exe
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov dword [ebp - 0x16b8], 0x208
call dword [0x10040318]
lea eax, [ebp - 0x490]
push 0x104
push eax
call fcn.1000ca82
lea ecx, [ebp - 0x490]
push str.tencent
push ecx
call fcn.1000b356
add esp, 0x10
test eax, eax
je 0x100081fe
push str.stup.exe
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [0x10040320]
push 0x36
lea edx, [ebp - 0x48]
push edx
mov al, 0xf9
mov byte [ebp - 0x32], bl
push 4
lea ecx, [ebp - 0x16d4]
mov dword [ebp - 0x48], 0xede0e5f7
mov dword [ebp - 0x44], 0xfcf4ebd3
mov dword [ebp - 0x40], 0xfaefc7f8
mov dword [ebp - 0x3c], 0xf6f5e5d6
mov dword [ebp - 0x38], 0xcedafec2
mov word [ebp - 0x34], 0xe4cd
mov dword [ebp - 0x31], 0xdaf9d3f6
mov dword [ebp - 0x2d], 0xf4f8d1da
mov bl, 0xca
mov dword [ebp - 0x29], 0xd0fecafc
mov dword [ebp - 0x25], 0xeff9d6fc
mov dword [ebp - 0x21], 0xc3d6caf6
mov dword [ebp - 0x1d], 0xd5d6d0e1
mov dword [ebp - 0x19], 0xeffed0fc
mov word [ebp - 0x15], 0xc3f7
mov byte [ebp - 0x13], al
call fcn.1001b330
mov ecx, dword [0x10042384]
mov eax, dword [0x10042380]
mov edx, dword [0x10042388]
mov dword [ebp - 0x16ac], ecx
mov dword [ebp - 0x16b0], eax
mov eax, dword [0x1004238c]
lea ecx, [ebp - 0x16b4]
push ecx
mov byte [ebp - 4], 2
mov dword [ebp - 0x16bc], 0
mov dword [ebp - 0x16a8], edx
mov dword [ebp - 0x16a4], eax
call fcn.1001fe80
add esp, 4
mov eax, dword [ebp - 0x16b4]
mov byte [ebp - 4], 3
test eax, eax
jne 0x100088aa
xor esi, esi
lea edx, [ebp - 0x16b0]
push edx
push esi
call dword [0x100403cc]
push esi
call dword [0x100402bc]
lea eax, [ebp - 0x16bc]
push eax
lea ecx, [ebp - 0x16b0]
push ecx
call dword [0x100403e8]
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x48e]
push eax
mov word [ebp - 0x490], dx
call fcn.1000ada0
mov ecx, dword [ebp - 0x16bc]
add esp, 0xc
push ecx
lea ecx, [ebp - 0x16d4]
call fcn.1001b430
push eax
push 0x100414b4
lea edx, [ebp - 0x490]
push 0x104
push edx
call fcn.1000c64f
add esp, 0x14
mov eax, 4
mov dword [ebp - 0x16c4], eax
mov dword [ebp - 0x16d8], eax
lea eax, [ebp - 0x16d8]
push eax
lea ecx, [ebp - 0x16b8]
push ecx
lea edx, [ebp - 0x16c4]
push edx
push 0x10041ccc
lea eax, [ebp - 0x490]
push eax
push 0x80000001
mov dword [ebp - 0x16b8], 0
call dword [0x10040318]
test eax, eax
jne 0x100083c5
cmp dword [ebp - 0x16b8], 1
jne 0x100083c5
push 4
lea ecx, [ebp - 0x16a0]
push ecx
push 4
push 0x10041ccc
lea edx, [ebp - 0x490]
push edx
push 0x80000001
mov dword [ebp - 0x16a0], eax
call edi
mov eax, dword [ebp - 0x16bc]
mov esi, dword [0x100403e4]
push eax
call esi
mov eax, dword [ebp - 0x16b4]
lea ecx, [eax - 0xc]
mov byte [ebp - 4], 2
cmp ecx, dword [0x10050de0]
je 0x10008409
add eax, 0xfffffff4
push eax
call dword [0x100400d8]
test eax, eax
jg 0x10008409
mov eax, dword [ebp - 0x16b4]
add eax, 0xfffffff4
push eax
call fcn.1000af85
add esp, 4
lea edx, [ebp - 0x16b4]
push edx
push 0x10040988
mov dword [ebp - 0x16b4], 0
call dword [0x100403e8]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x48e]
push ecx
mov word [ebp - 0x490], ax
call fcn.1000ada0
mov edx, dword [ebp - 0x16b4]
add esp, 0xc
push edx
lea ecx, [ebp - 0x16d4]
call fcn.1001b430
push eax
push 0x100414b4
lea eax, [ebp - 0x490]
push 0x104
push eax
call fcn.1000c64f
add esp, 0x14
mov eax, 4
lea ecx, [ebp - 0x16a0]
push ecx
lea edx, [ebp - 0x16b8]
push edx
mov dword [ebp - 0x16c4], eax
mov dword [ebp - 0x16a0], eax
lea eax, [ebp - 0x16c4]
push eax
push 0x10041ccc
lea ecx, [ebp - 0x490]
push ecx
push 0x80000001
mov dword [ebp - 0x16b8], 0
call dword [0x10040318]
test eax, eax
jne 0x100084e7
cmp dword [ebp - 0x16b8], 1
jne 0x100084e7
push 4
lea edx, [ebp - 0x16d8]
push edx
push 4
mov dword [ebp - 0x16d8], eax
push 0x10041ccc
lea eax, [ebp - 0x490]
push eax
push 0x80000001
call edi
mov ecx, dword [ebp - 0x16b4]
push ecx
call esi
lea ecx, [ebp - 0x16d4]
mov byte [ebp - 4], 1
call fcn.1001b370
call fcn.1001d8f0
test eax, eax
je 0x100086f6
push 0x3c
lea edx, [ebp - 0x4c]
push edx
push 0x1a
lea ecx, [ebp - 0x16b0]
mov dword [ebp - 0x4c], 0xdbfacfe9
mov word [ebp - 0x48], 0xc1cd
mov byte [ebp - 0x46], 0xee
mov byte [ebp - 0x45], bl
mov dword [ebp - 0x44], 0xccf5ede6
mov dword [ebp - 0x40], 0xc0efcfc8
mov dword [ebp - 0x3c], 0xf8c0d4dc
mov dword [ebp - 0x38], 0xc0f8ced3
mov dword [ebp - 0x34], 0xecc0d3cd
mov word [ebp - 0x30], 0xd2cf
mov byte [ebp - 0x2e], 0xee
mov byte [ebp - 0x2d], bl
mov word [ebp - 0x2c], 0xd4d4
mov byte [ebp - 0x2a], bl
mov byte [ebp - 0x29], bl
mov dword [ebp - 0x28], 0xc0f5d3c8
mov dword [ebp - 0x24], 0xc0ccfcd4
mov dword [ebp - 0x20], 0xc6ffc9d6
mov dword [ebp - 0x1c], 0xeac0d3df
mov dword [ebp - 0x18], 0xecc0d4c2
mov dword [ebp - 0x14], 0xebd5f3f6
call fcn.1001b330
lea eax, [ebp - 0x16b4]
push eax
mov byte [ebp - 4], 4
call fcn.1001fe80
add esp, 4
lea ecx, [ebp - 0x16b0]
mov byte [ebp - 4], 5
call fcn.1001b430
push eax
lea ecx, [ebp - 0x16a0]
call fcn.10007f10
lea ecx, [ebp - 0x16b0]
mov byte [ebp - 4], 6
call fcn.1001b430
push 4
push 0x10041cc8
push 1
push 0
lea ecx, [ebp - 0x16b4]
mov esi, eax
call fcn.10001e60
push eax
push esi
push 0x80000001
call edi
mov eax, dword [ebp - 0x16a0]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x10050de0]
je 0x1000861f
lea esi, [eax - 0xc]
push esi
call dword [0x100400d8]
test eax, eax
jg 0x1000861f
push esi
call fcn.1000af85
add esp, 4
mov eax, dword [ebp - 0x16b4]
lea edx, [eax - 0xc]
mov byte [ebp - 4], 4
cmp edx, dword [0x10050de0]
je 0x10008654
add eax, 0xfffffff4
push eax
call dword [0x100400d8]
test eax, eax
jg 0x10008654
mov eax, dword [ebp - 0x16b4]
add eax, 0xfffffff4
push eax
call fcn.1000af85
add esp, 4
lea eax, [ebp - 0x16b4]
push eax
push 0x10040988
mov dword [ebp - 0x16b4], 0
call dword [0x100403e8]
mov ecx, dword [ebp - 0x16b4]
push ecx
lea ecx, [ebp - 0x16b8]
call fcn.10007f10
lea ecx, [ebp - 0x16b0]
mov byte [ebp - 4], 7
call fcn.1001b430
push 4
push 0x10041cc8
push 1
push 0
lea ecx, [ebp - 0x16b8]
mov esi, eax
call fcn.10001e60
push eax
push esi
push 0x80000001
call edi
mov edx, dword [ebp - 0x16b4]
push edx
call dword [0x100403e4]
mov eax, dword [ebp - 0x16b8]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x10050de0]
je 0x100086e7
lea esi, [eax - 0xc]
push esi
call dword [0x100400d8]
test eax, eax
jg 0x100086e7
push esi
call fcn.1000af85
add esp, 4
lea ecx, [ebp - 0x16b0]
mov byte [ebp - 4], 1
call fcn.1001b370
mov esi, dword [ebp - 0x16dc]
mov ecx, esi
call fcn.10005b30
mov dword [ebp - 0x3c], 0xede0e5f7
mov dword [ebp - 0x38], 0xfcf4ebd3
mov dword [ebp - 0x34], 0xfaefc7f8
mov dword [ebp - 0x30], 0xf6f5e5d6
mov dword [ebp - 0x2c], 0xd0dafec2
mov byte [ebp - 0x28], bl
mov word [ebp - 0x27], 0xe3fe
mov byte [ebp - 0x25], 0xeb
mov byte [ebp - 0x24], bl
mov dword [ebp - 0x23], 0xe1b9f2ef
mov dword [ebp - 0x1f], 0xcbf5f6f2
mov dword [ebp - 0x1b], 0xf8ebe3f8
mov word [ebp - 0x17], 0xe7c7
mov byte [ebp - 0x15], 0xf0
mov byte [ebp - 0x14], bl
push 0x29
test eax, eax
je 0x100089f5
lea edx, [ebp - 0x3c]
push edx
push 4
lea ecx, [ebp - 0x16ec]
call fcn.1001b330
push 0xa
lea eax, [ebp - 0x58]
push eax
push 0x3e
lea ecx, [ebp - 0x16d4]
mov byte [ebp - 4], 8
mov dword [ebp - 0x58], 0xa1a1b08d
mov dword [ebp - 0x54], 0xb290e4aa
mov word [ebp - 0x50], 0xa1b9
call fcn.1001b330
push 0x12
lea ecx, [ebp - 0x6c]
push ecx
push 0x19
lea ecx, [ebp - 0x16b0]
mov byte [ebp - 4], 9
mov dword [ebp - 0x6c], 0xdeefebd1
mov dword [ebp - 0x68], 0xc6b4b083
mov dword [ebp - 0x64], 0xdfb5f0d8
mov dword [ebp - 0x60], 0xc1f8b1c8
mov word [ebp - 0x5c], 0xb0d4
call fcn.1001b330
mov ecx, esi
mov byte [ebp - 4], 0xa
call fcn.10005ba0
test eax, eax
je 0x100088f5
lea ecx, [ebp - 0x16b0]
call fcn.1001b430
push eax
lea edx, [ebp - 0x288]
push 0x104
push edx
call fcn.1000c3bd
lea eax, [ebp - 0x288]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10008813
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x16d4]
mov ebx, eax
call fcn.1001b430
lea ecx, [ebx + ebx + 2]
push ecx
lea edx, [ebp - 0x288]
push edx
push 1
push eax
lea ecx, [ebp - 0x16ec]
call fcn.1001b430
push eax
push 0x80000001
call edi
call fcn.1001d8f0
lea ecx, [ebp - 0x16b0]
test eax, eax
je 0x100088c5
call fcn.1001b430
lea edx, [eax + 2]
jmp 0x10008870
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10008870
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x16b0]
mov ebx, eax
call fcn.1001b430
lea ecx, [ebx + ebx + 2]
push ecx
push eax
push 1
lea ecx, [ebp - 0x16d4]
call fcn.1001b430
push eax
push str.SOFTWAREAppDataLowTencentTBH
jmp 0x100089c5
push eax
call dword [0x100402b4]
mov esi, eax
test esi, esi
jne 0x100082da
push 0x8007000e
call fcn.10001c00
call fcn.1001b430
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100088d0
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x16b0]
mov ebx, eax
call fcn.1001b430
lea edx, [ebx + ebx + 2]
jmp 0x100089b0
xor eax, eax
push 0xffe
push eax
lea ecx, [ebp - 0x1696]
push ecx
mov word [ebp - 0x1698], ax
call fcn.1000ada0
add esp, 0xc
lea ecx, [ebp - 0x16d4]
mov dword [ebp - 0x16c4], 1
mov dword [ebp - 0x16a0], 0xffe
call fcn.1001b430
lea ecx, [ebp - 0x16ec]
mov ebx, eax
call fcn.1001b430
lea edx, [ebp - 0x16a0]
push edx
lea ecx, [ebp - 0x1698]
push ecx
lea edx, [ebp - 0x16c4]
push edx
push ebx
push eax
push 0x80000001
call dword [0x10040318]
test eax, eax
jne 0x100089cc
call fcn.1001d8f0
test eax, eax
lea eax, [ebp - 0x1698]
lea edx, [eax + 2]
je 0x10008997
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10008977
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x1698]
push ecx
jmp 0x10008892
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10008997
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
lea eax, [ebp - 0x1698]
push edx
push eax
push 1
lea ecx, [ebp - 0x16d4]
call fcn.1001b430
push eax
push str.SOFTWARETencentTBH
push 0x80000001
call edi
lea ecx, [ebp - 0x16b0]
mov byte [ebp - 4], 9
call fcn.1001b370
lea ecx, [ebp - 0x16d4]
mov byte [ebp - 4], 8
call fcn.1001b370
lea ecx, [ebp - 0x16ec]
jmp 0x10008b04
lea ecx, [ebp - 0x3c]
push ecx
push 4
lea ecx, [ebp - 0x16d4]
call fcn.1001b330
push 0xa
lea edx, [ebp - 0x58]
push edx
push 0x3e
lea ecx, [ebp - 0x16b0]
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x58], 0xa1a1b08d
mov dword [ebp - 0x54], 0xb290e4aa
mov word [ebp - 0x50], 0xa1b9
call fcn.1001b330
push 0x12
lea eax, [ebp - 0x6c]
push eax
push 0x19
lea ecx, [ebp - 0x16ec]
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x6c], 0xdeefebd1
mov dword [ebp - 0x68], 0xc6b4b083
mov dword [ebp - 0x64], 0xdfb5f0d8
mov dword [ebp - 0x60], 0xc1f8b1c8
mov word [ebp - 0x5c], 0xb0d4
call fcn.1001b330
mov ecx, esi
mov byte [ebp - 4], 0xd
call fcn.10005ba0
test eax, eax
je 0x10008ae0
lea ecx, [ebp - 0x16ec]
call fcn.1001b430
push eax
lea ecx, [ebp - 0x288]
push 0x104
push ecx
call fcn.1000c3bd
lea eax, [ebp - 0x288]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10008aa2
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x16b0]
mov ebx, eax
call fcn.1001b430
lea edx, [ebx + ebx + 2]
push edx
lea ecx, [ebp - 0x288]
push ecx
push 1
push eax
lea ecx, [ebp - 0x16d4]
call fcn.1001b430
push eax
push 0x80000001
call edi
lea ecx, [ebp - 0x16ec]
mov byte [ebp - 4], 0xc
call fcn.1001b370
lea ecx, [ebp - 0x16b0]
mov byte [ebp - 4], 0xb
call fcn.1001b370
lea ecx, [ebp - 0x16d4]
mov byte [ebp - 4], 1
call fcn.1001b370
mov ecx, esi
call fcn.10004e20
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x696]
push eax
mov word [ebp - 0x698], dx
call fcn.1000ada0
lea ecx, [ebp - 0x698]
push ecx
push 8
call fcn.10024cc0
add esp, 0x14
push 0x104
lea edx, [ebp - 0x698]
push edx
mov eax, edx
push eax
call dword [0x100400e8]
push str.Uninstall
lea ecx, [ebp - 0x698]
push ecx
push str.Rundll32.exe__s__s
lea edx, [ebp - 0x288]
push 0x103
push edx
call fcn.1000c2ed
lea eax, [ebp - 0x288]
add esp, 0x14
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10008b83
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x288]
push ecx
push 1
push str.UninstallString
mov ecx, 0x10050e74
call fcn.1001b430
push eax
push 0x80000002
call edi
push 0x208
lea edx, [ebp - 0x288]
push 0
push edx
call fcn.1000ada0
mov ecx, dword [0x10050e00]
mov esi, dword [0x10040370]
add esp, 0xc
push 0x208
lea eax, [ebp - 0x288]
push eax
push 0x70
push ecx
call esi
lea eax, [ebp - 0x288]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10008bf3
sub eax, ecx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x288]
push eax
push 1
push str.DisplayName
mov ecx, 0x10050e74
call fcn.1001b430
push eax
push 0x80000002
call edi
push 0x208
lea ecx, [ebp - 0x288]
push 0
push ecx
call fcn.1000ada0
mov eax, dword [0x10050e00]
add esp, 0xc
push 0x208
lea edx, [ebp - 0x288]
push edx
push 0x71
push eax
call esi
lea eax, [ebp - 0x288]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10008c60
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x288]
push edx
push 1
push str.Publisher
mov ecx, 0x10050e74
call fcn.1001b430
push eax
push 0x80000002
call edi
call fcn.1001d890
test eax, eax
jne 0x10008d14
push 0x104
lea eax, [ebp - 0x288]
push eax
call dword [0x100400fc]
push str.msiexec.exe
lea ecx, [ebp - 0x288]
push ecx
call dword [0x10040324]
lea edx, [ebp - 0x288]
push edx
call dword [0x10040328]
test eax, eax
je 0x10008d14
lea eax, [ebp - 0x288]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10008ce0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x288]
push ecx
push 1
push str.DisplayIcon
mov ecx, 0x10050e74
call fcn.1001b430
push eax
push 0x80000002
call edi
push 0x104
lea ecx, [ebp - 0x16fc]
call fcn.1001b430
push eax
lea edx, [ebp - 0x288]
push edx
call dword [0x1004012c]
lea eax, [ebp - 0x288]
lea edx, [eax + 2]
jmp 0x10008d40
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10008d40
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x288]
push ecx
push 1
push str.HelpLink
mov ecx, 0x10050e74
call fcn.1001b430
push eax
push 0x80000002
call edi
call fcn.1001d8f0
test eax, eax
je 0x10008fe7
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x48e]
push eax
mov word [ebp - 0x490], dx
call fcn.1000ada0
add esp, 0xc
lea ecx, [ebp - 0x16bc]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x221
push 0x20
push 2
lea edx, [ebp - 0x16a0]
push edx
mov dword [ebp - 0x16bc], 0
mov dword [ebp - 0x16a0], 0
mov word [ebp - 0x169c], 0x500
call dword [0x10040058]
test eax, eax
je 0x10008fe7
mov ecx, 0x10050e64
call fcn.1001b430
push eax
push str.MACHINE_s
lea eax, [ebp - 0x490]
push 0x103
push eax
call fcn.1000c2ed
mov ecx, dword [ebp - 0x16bc]
push 0
push 2
push 0xf003f
push 0
push ecx
lea edx, [ebp - 0x490]
push 4
push edx
call fcn.1001e280
add esp, 0x2c
test eax, eax
jne 0x10008e49
lea eax, [ebp - 0x490]
push eax
push str.AddAceToObjectsSecurityDescriptor__s__FAILED
call fcn.1001ac00
add esp, 8
mov ecx, 0x10050e74
call fcn.1001b430
push eax
push str.MACHINE_s
lea ecx, [ebp - 0x490]
push 0x103
push ecx
call fcn.1000c2ed
mov edx, dword [ebp - 0x16bc]
push 0
push 2
push 0xf003f
push 0
push edx
lea eax, [ebp - 0x490]
push 4
push eax
call fcn.1001e280
add esp, 0x2c
test eax, eax
jne 0x10008ea5
lea ecx, [ebp - 0x490]
push ecx
push str.AddAceToObjectsSecurityDescriptor__s__FAILED
call fcn.1001ac00
add esp, 8
mov eax, dword [0x10042384]
mov edx, dword [0x10042380]
mov ecx, dword [0x10042388]
mov dword [ebp - 0x16ac], eax
mov dword [ebp - 0x16b0], edx
mov edx, dword [0x1004238c]
lea eax, [ebp - 0x16b4]
push eax
mov dword [ebp - 0x16a8], ecx
mov dword [ebp - 0x16a4], edx
call fcn.1001fe80
add esp, 4
mov eax, dword [ebp - 0x16b4]
mov byte [ebp - 4], 0xe
test eax, eax
jne 0x1000904a
xor esi, esi
lea ecx, [ebp - 0x16b0]
push ecx
push esi
call dword [0x100403cc]
push esi
call dword [0x100402bc]
lea edx, [ebp - 0x16b0]
mov dword [ebp - 0x16d4], edx
mov dword [ebp - 0x16d0], 0x10040968
mov dword [ebp - 0x16cc], 0x10040978
mov dword [ebp - 0x16c8], 0x10040988
xor esi, esi
jmp 0x10008f40
mov eax, dword [ebp + esi*4 - 0x16d4]
push eax
call fcn.1001dde0
push eax
push str.CLASSES_ROOTCLSID_s
lea ecx, [ebp - 0x490]
push 0x103
push ecx
call fcn.1000c2ed
mov edx, dword [ebp - 0x16bc]
push 0
push 2
push 0xf003f
push 0
push edx
lea eax, [ebp - 0x490]
push 4
push eax
call fcn.1001e280
add esp, 0x30
test eax, eax
jne 0x10008f9f
lea ecx, [ebp - 0x490]
push ecx
push str.AddAceToObjectsSecurityDescriptor__s__FAILED
call fcn.1001ac00
add esp, 8
inc esi
cmp esi, 4
jb 0x10008f40
mov edx, dword [ebp - 0x16bc]
push edx
call dword [0x1004005c]
mov eax, dword [ebp - 0x16b4]
lea ecx, [eax - 0xc]
mov byte [ebp - 4], 1
cmp ecx, dword [0x10050de0]
je 0x10008fe7
add eax, 0xfffffff4
push eax
call dword [0x100400d8]
test eax, eax
jg 0x10008fe7
mov eax, dword [ebp - 0x16b4]
add eax, 0xfffffff4
push eax
call fcn.1000af85
add esp, 4
mov ecx, dword [ebp - 0x16dc]
call fcn.10005980
lea ecx, [ebp - 0x16fc]
mov byte [ebp - 4], 0
call fcn.1001b370
mov eax, dword [ebp - 0x16c0]
lea edx, [eax - 0xc]
cmp edx, dword [0x10050de0]
je 0x10009029
lea esi, [eax - 0xc]
push esi
call dword [0x100400d8]
test eax, eax
jg 0x10009029
push esi
call fcn.1000af85
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000ad8e
mov esp, ebp
pop ebp
ret
push eax
call dword [0x100402b4]
mov esi, eax
test esi, esi
jne 0x10008ef7
push 0x8007000e
call fcn.10001c00
int3