Function at 0x100932e
Capabilities:
Accept command line arguments
Compare security identifiers
Parse pe header
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2404
call fcn.0100f500
mov eax, dword [0x1012d80]
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push 0x10131f1
push esi
push esi
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1a0c]
push esi
push esi
mov dword [ebp - 0x1a14], 1
mov dword [ebp - 0x1a18], eax
call fcn.010045e9
mov eax, dword [0x10111f0]
mov word [eax], si
mov eax, dword [0x1011a00]
mov word [eax], si
lea eax, [ebp - 0x215c]
add esp, 0x20
mov dword [ebp - 0x2164], 0x104
mov dword [ebp - 0x2168], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x22
mov ebx, eax
pop ecx
cmp word [ebx], cx
jne 0x10093ae
inc ebx
inc ebx
jmp 0x10093b1
push 0x20
pop ecx
mov ax, word [ebx]
cmp ax, si
je 0x10093cf
cmp ax, cx
je 0x10093c8
inc ebx
inc ebx
mov ax, word [ebx]
cmp ax, si
jne 0x10093b9
cmp word [ebx], si
je 0x10093cf
inc ebx
inc ebx
mov eax, dword [ebp + 8]
push 0xfffffffffffffff5
mov dword [0x10131d0], eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
mov dword [0x1013704], eax
je 0x10093f4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
jne 0x10093fa
mov dword [0x1013704], esi
xor eax, eax
mov edx, 0x1ff
mov word [ebp - 0xa08], si
mov ecx, edx
lea edi, [ebp - 0xa06]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x1208], si
mov ecx, edx
lea edi, [ebp - 0x1206]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xa08]
mov dword [ebp - 0x238c], eax
lea eax, [ebp - 0x1208]
mov dword [ebp - 0x23bc], esi
mov dword [ebp - 0x2394], eax
mov dword [ebp - 0x23a8], esi
mov dword [0x10131e4], esi
mov ax, word [ebx]
cmp ax, 0x20
je 0x1009462
cmp ax, 9
jne 0x1009466
inc ebx
inc ebx
jmp 0x1009453
mov ax, word [ebx]
cmp ax, 0x2f
je 0x1009479
cmp ax, 0x2d
jne 0x10095da
lea eax, [ebx + 2]
cmp eax, esi
je 0x10095da
mov ax, word [eax]
or ax, 0x20
cmp ax, 0x60
jne 0x10095da
lea eax, [ebp - 0x2380]
add ebx, 4
push eax
mov dword [ebp - 0x2380], ebx
call fcn.01005448
lea eax, [ebp - 0xa08]
mov dword [ebp - 0x2384], eax
lea eax, [ebp - 0x2384]
push eax
lea eax, [ebp - 0x2380]
push eax
call fcn.010055c5
mov eax, dword [ebp - 0x2164]
add eax, eax
mov dword [ebp - 0x23b4], eax
lea eax, [ebp - 0x2398]
push eax
mov dword [ebp - 0x23a0], esi
mov dword [ebp - 0x2398], 0x20019
call fcn.01004365
add esp, 0x10
lea eax, [ebp - 0x23ac]
push eax
push dword [ebp - 0x2398]
push esi
push 0x1002820
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100a7e3
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x23b4]
push eax
push dword [ebp - 0x2168]
lea eax, [ebp - 0x23a0]
push eax
push esi
lea eax, [ebp - 0xa08]
push eax
push dword [ebp - 0x23ac]
call edi
mov ebx, eax
cmp ebx, 0xea
jne 0x100958b
mov eax, dword [ebp - 0x23b4]
push esi
shr eax, 1
push eax
lea ecx, [ebp - 0x2168]
call fcn.010057b6
lea eax, [ebp - 0x23b4]
push eax
push dword [ebp - 0x2168]
lea eax, [ebp - 0x23a0]
push eax
push esi
lea eax, [ebp - 0xa08]
push eax
push dword [ebp - 0x23ac]
call edi
mov ebx, eax
push dword [ebp - 0x23ac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
jne 0x100a7e3
cmp dword [ebp - 0x23a0], 1
jne 0x100a7e3
mov eax, dword [ebp - 0x2168]
mov dword [ebp - 0x2380], eax
mov eax, dword [ebp - 0x2380]
mov si, word [eax]
cmp si, 0x20
je 0x10095d1
cmp si, 9
jne 0x1009979
add dword [ebp - 0x2380], 2
jmp 0x10095b8
lea eax, [ebp - 0x2388]
push eax
push 0x7fffffff
push ebx
mov dword [ebp - 0x2388], esi
call fcn.01004327
cmp eax, esi
jl 0x1009900
mov eax, dword [ebp - 0x2388]
push esi
inc eax
push eax
lea ecx, [ebp - 0x2168]
call fcn.010057b6
test al, al
je 0x1009af4
mov eax, dword [ebp - 0x2168]
xor edx, edx
mov word [eax], dx
mov esi, 0x1002814
lea edi, [ebp - 0x8c]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x100280c
lea edi, [ebp - 0x84]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x10027fc
lea edi, [ebp - 0xac]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 8
pop ecx
movsw word es:[edi], word [esi]
mov esi, 0x10027dc
lea edi, [ebp - 0xcc]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x23a0]
push ecx
mov eax, 0x10027cc
push 0x7fffffff
push eax
mov dword [ebp - 0x7c], 0x10027bc
mov dword [ebp - 0x78], edx
mov byte [ebp - 0x74], dl
mov dword [ebp - 0x70], 0x10027a8
mov dword [ebp - 0x6c], edx
mov byte [ebp - 0x68], dl
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], 0x10027a0
mov byte [ebp - 0x5c], 1
mov dword [ebp - 0x58], 0x1002794
mov dword [ebp - 0x54], 0x100278c
mov byte [ebp - 0x50], 1
mov dword [ebp - 0x4c], 0x1002780
mov dword [ebp - 0x48], 0x1002778
mov byte [ebp - 0x44], 1
mov dword [ebp - 0x40], 0x1002768
mov dword [ebp - 0x3c], 0x100273c
mov byte [ebp - 0x38], 1
mov dword [ebp - 0x34], 0x1002728
mov dword [ebp - 0x30], 0x10026fc
mov byte [ebp - 0x2c], 1
mov dword [ebp - 0x28], 0x10026e0
mov dword [ebp - 0x24], 0x10026c4
mov byte [ebp - 0x20], 1
mov dword [ebp - 0x1c], 0x10026a8
mov dword [ebp - 0x18], 0x1002688
mov byte [ebp - 0x14], 1
mov dword [ebp - 0x10], 0x1002680
mov dword [ebp - 0xc], 0x1002678
mov byte [ebp - 8], 1
mov dword [ebp - 0x23a0], edx
call fcn.01004327
test eax, eax
jl 0x1009900
and dword [ebp - 0x2384], 0
mov dword [ebp - 0x2388], ebx
jmp 0x10097ad
xor eax, eax
mov ax, word [esi]
test ax, ax
je 0x10097cc
push eax
call fcn.01004d4d
test al, al
pop ecx
je 0x10097ad
mov edi, dword [ebp - 0x2384]
lea eax, [edi - 1]
cmp eax, 1
jne 0x100977f
push 0xffffffffffffffff
push 0x1002674
lea eax, [edi - 1]
push eax
lea eax, [esi + 2]
push eax
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10097f8
lea eax, [edi - 1]
cmp dword [ebp - 0x23a0], eax
jne 0x10097ad
push dword [ebp - 0x23a0]
dec edi
push 0x10027cc
push edi
add esi, 2
push esi
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10097f8
lea eax, [ebp - 0x2384]
push eax
lea eax, [ebp - 0x2388]
push eax
call fcn.01004d6d
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x1009737
lea eax, [ebp - 0x84]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x74], 1
lea eax, [ebp - 0x8c]
mov byte [ebp - 0x68], 1
and dword [ebp - 0x2384], 0
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x2388], ebx
jmp 0x1009880
lea eax, [ebp - 0xac]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x74], 0
lea eax, [ebp - 0xcc]
mov byte [ebp - 0x68], 0
jmp 0x10097e3
xor eax, eax
mov ax, word [edi]
test ax, ax
je 0x100989f
push eax
call fcn.01004d4d
test al, al
pop ecx
je 0x100985a
xor ebx, ebx
lea esi, [ebp - 0x7c]
mov eax, dword [ebp - 0x2384]
push 0xffffffffffffffff
push dword [esi]
dec eax
push eax
lea eax, [edi + 2]
push eax
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10098c4
inc ebx
add esi, 0xc
cmp ebx, 0xa
jb 0x100982f
push 1
push dword [ebp - 0x2384]
lea eax, [ebp - 0x2168]
push edi
push eax
mov dword [ebp - 0x2160], 0x104
call fcn.01006ba9
add esp, 0x10
test eax, eax
jne 0x10098f0
lea eax, [ebp - 0x2384]
push eax
lea eax, [ebp - 0x2388]
push eax
call fcn.01004d6d
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x1009811
mov edi, dword [ebp - 0x2168]
and dword [ebp - 0x2388], 0
test edi, edi
je 0x10098f7
lea eax, [ebp - 0x2388]
push eax
push 0x7fffffff
push edi
call fcn.01004327
jmp 0x10098fc
lea eax, [ebx + ebx*2]
shl eax, 2
xor ecx, ecx
mov cl, byte [ebp + eax - 0x74]
mov dword [ebp - 0x2160], 0x104
push ecx
push dword [ebp + eax - 0x78]
lea eax, [ebp - 0x2168]
push eax
call fcn.01006c74
add esp, 0xc
jmp 0x100987c
mov esi, eax
jmp 0x100a7e3
mov eax, 0x80070057
test eax, eax
jge 0x100990a
mov esi, 0x65b
jmp 0x100a7e3
mov eax, dword [ebp - 0x2388]
test eax, eax
jbe 0x1009945
lea esi, [edi + eax*2 - 2]
xor eax, eax
mov ax, word [esi]
push eax
call fcn.01004d2d
jmp 0x1009940
cmp esi, edi
jb 0x1009945
and word [esi], 0
dec esi
dec esi
xor eax, eax
mov ax, word [esi]
push eax
call fcn.01004d2d
mov edi, dword [ebp - 0x2168]
test al, al
pop ecx
jne 0x1009925
xor esi, esi
mov si, word [edi]
test si, si
mov dword [ebp - 0x2380], edi
je 0x1009ccf
push esi
call fcn.01004d2d
test al, al
pop ecx
je 0x1009979
add dword [ebp - 0x2380], 2
mov eax, dword [ebp - 0x2380]
mov si, word [eax]
test si, si
jne 0x1009959
test si, si
je 0x1009ccf
mov edi, 0x104
cmp si, 0x2f
je 0x1009a08
cmp si, 0x2d
je 0x1009a08
lea eax, [ebp - 0x2370]
mov dword [ebp - 0x237c], eax
lea eax, [ebp - 0x237c]
push eax
lea eax, [ebp - 0x2380]
push eax
mov dword [ebp - 0x2378], edi
mov dword [ebp - 0x2374], edi
call fcn.01008332
test eax, eax
pop ecx
pop ecx
je 0x1009d47
push dword [ebp - 0x237c]
lea eax, [ebp - 0x1208]
push eax
call fcn.01007606
lea eax, [ebp - 0x2380]
push eax
call fcn.01005448
add esp, 0xc
cmp dword [ebp - 0x2378], edi
mov esi, eax
jle 0x1009cc6
push dword [ebp - 0x237c]
call fcn.010052fd
pop ecx
jmp 0x1009cc6
mov eax, dword [ebp - 0x2380]
inc eax
inc eax
movzx esi, word [eax]
push eax
or esi, 0x20
call fcn.010043b7
pop ecx
push 0x52
mov dword [ebp - 0x2380], eax
mov edi, 0x100149c
pop ecx
movzx ecx, cx
or ecx, 0x20
cmp ecx, esi
je 0x1009a3f
inc edi
inc edi
mov cx, word [edi]
test cx, cx
jne 0x1009a2b
mov si, word [edi]
test si, si
je 0x1009be5
mov ax, word [eax]
cmp ax, 0x20
je 0x1009a64
test ax, ax
je 0x1009a64
cmp ax, 9
je 0x1009a64
xor ebx, ebx
inc ebx
jmp 0x1009a66
xor ebx, ebx
lea eax, [ebp - 0x2380]
push eax
call fcn.01005448
cmp si, 0x63
lea eax, [ebp - 0xa08]
pop ecx
mov dword [ebp - 0x2384], eax
jne 0x1009a8d
test ebx, ebx
jne 0x1009be5
cmp si, 0x50
jne 0x1009afc
push 0
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0xa
push eax
lea ecx, [ebp - 0x1a18]
call fcn.01005704
test al, al
je 0x1009af4
mov eax, dword [ebp - 0x1a18]
mov dword [ebp - 0x2398], eax
lea eax, [ebp - 0x2398]
push eax
lea eax, [ebp - 0x2380]
push eax
call fcn.010055c5
mov eax, dword [ebp - 0x2398]
and word [eax], 0
mov edx, dword [ebp - 0x1a14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1a18]
inc eax
inc eax
lea ecx, [ecx + edx*2]
cmp ecx, eax
ja 0x1009b21
push 0xe
pop esi
jmp 0x100a7e3
cmp si, 0x71
je 0x1009b08
cmp si, 0x63
jne 0x1009b0c
test ebx, ebx
je 0x1009b21
lea eax, [ebp - 0x2384]
push eax
lea eax, [ebp - 0x2380]
push eax
call fcn.010055c5
pop ecx
pop ecx
lea eax, [ebp - 0x2380]
push eax
call fcn.01005448
pop ecx
mov esi, eax
mov eax, dword [ebp - 0x2384]
and word [eax], 0
mov ax, word [edi]
cmp ax, 0x46
je 0x1009b55
cmp ax, 0x71
je 0x1009b55
cmp ax, 0x4a
je 0x1009b55
cmp ax, 0x6c
jne 0x1009bb1
test ebx, ebx
je 0x1009bb1
cmp ax, 0x71
lea ecx, [ebp - 0x1208]
mov dword [ebp - 0x2384], ecx
lea ecx, [ebp - 0xa08]
mov dword [ebp - 0x2394], ecx
lea ecx, [ebp - 0x1208]
mov dword [ebp - 0x238c], ecx
je 0x1009bb1
lea eax, [ebp - 0x2384]
push eax
lea eax, [ebp - 0x2380]
push eax
call fcn.010055c5
lea eax, [ebp - 0x2380]
push eax
call fcn.01005448
add esp, 0xc
mov esi, eax
mov eax, dword [ebp - 0x2384]
and word [eax], 0
mov cx, word [edi]
cmp cx, 0x61
jb 0x1009bf4
cmp cx, 0x7a
ja 0x1009bf4
push dword [ebp - 0x238c]
sub edi, 0x100149c
push dword [ebp - 0x2394]
sar edi, 1
call dword [edi*4 + 0x1011188]
test eax, eax
pop ecx
pop ecx
je 0x1009c99
call fcn.01008dc2
mov esi, 0x667
jmp 0x100a7e3
mov eax, dword [0x1013708]
test eax, eax
je 0x1009c55
cmp cx, 0x50
jne 0x1009c3a
cmp word [eax], 0x41
jne 0x1009c3a
lea eax, [ebp - 0x1a08]
push eax
push 0x41
call fcn.01005051
test eax, eax
pop ecx
pop ecx
jne 0x1009be5
push 0x1e
push dword [ebp - 0x2394]
lea eax, [ebp - 0x108]
push eax
mov dword [0x1013708], edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x1009c99
cmp word [eax], 0x50
jne 0x1009be5
cmp cx, 0x41
jne 0x1009be5
push dword [ebp - 0x238c]
push 0x41
call fcn.01005051
jmp 0x1009bdb
cmp cx, 0x50
mov dword [0x1013708], edi
je 0x1009c79
push 0x400
push dword [ebp - 0x238c]
lea eax, [ebp - 0x1a08]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x1e
push dword [ebp - 0x2394]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [0x1013708]
cmp word [eax], 0x45
je 0x1009ccf
and word [ebp - 0xa08], 0
and word [ebp - 0x1208], 0
lea eax, [ebp - 0xa08]
mov dword [ebp - 0x238c], eax
lea eax, [ebp - 0x1208]
mov dword [ebp - 0x2394], eax
mov edi, 0x104
test si, si
jne 0x1009987
mov ecx, dword [0x1013708]
xor edi, edi
cmp ecx, edi
je 0x1009dfa
cmp word [ecx], 0x50
mov eax, dword [ebp - 0x1a18]
je 0x1009cf1
lea eax, [ebp - 0x1a08]
push eax
sub ecx, 0x100149c
lea eax, [ebp - 0x108]
sar ecx, 1
push eax
call dword [ecx*4 + 0x1011188]
mov esi, eax
mov eax, dword [0x1013708]
mov ax, word [eax]
cmp ax, 0x59
pop ecx
pop ecx
mov dword [ebp - 0x2394], esi
je 0x100a7e3
cmp ax, 0x5a
je 0x100a7e3
cmp esi, edi
jne 0x1009d7c
cmp ax, 0x45
jne 0x1009d6d
mov dword [0x10131e4], 1
jmp 0x1009e0a
call fcn.01008dc2
cmp dword [ebp - 0x2378], edi
mov esi, 0x667
jle 0x100a7e3
push dword [ebp - 0x237c]
call fcn.010052fd
jmp 0x100a7e2
mov dword [ebp - 0x23a8], 1
jmp 0x1009e0a
cmp esi, 0x8000
jne 0x1009d91
mov dword [0x10131e4], edi
xor esi, esi
jmp 0x100a7e3
cmp ax, 0x52
je 0x1009df1
cmp ax, 0x55
je 0x1009df1
mov eax, 0x4eb
cmp esi, eax
jg 0x1009dd1
je 0x1009e0a
cmp esi, 0xfffffffe
jl 0x1009df1
cmp esi, edi
jl 0x100a7e3
cmp esi, 1
jle 0x1009df1
cmp esi, 3
jle 0x1009dc4
cmp esi, 0x7b
jne 0x1009df1
mov esi, 0x653
mov dword [ebp - 0x2394], esi
jmp 0x1009df1
cmp esi, 0x642
jl 0x1009df1
cmp esi, 0x644
jle 0x1009e0a
cmp esi, 0x669
je 0x1009e0a
cmp esi, 0xbc2
je 0x1009e0a
push esi
call fcn.01007202
pop ecx
jmp 0x1009e0a
call fcn.01008dc2
mov esi, 0x667
mov dword [ebp - 0x2394], esi
cmp esi, edi
jne 0x100a7e3
cmp dword [ebp - 0x23a8], edi
jne 0x1009e26
cmp dword [0x10131e4], edi
je 0x100a7e3
cmp dword [0x10131e4], edi
push edi
je 0x1009e38
push edi
call dword [0x1012228]
jmp 0x1009e3e
call dword [sym.imp.ole32.dll_CoInitialize]
cmp dword [ebp - 0x23a8], edi
je 0x1009e8a
cmp dword [0x10131e4], edi
jne 0x1009e97
mov ebx, 0x10013c4
lea eax, [edi + 0x1013178]
push eax
push 1
push 4
lea eax, [edi + 0x10111e8]
push eax
push ebx
call dword [sym.imp.ole32.dll_CoRegisterClassObject]
test eax, eax
jne 0x1009e80
add ebx, 0x10
add edi, 4
cmp ebx, 0x10013d4
jl 0x1009e53
jmp 0x1009e8a
mov dword [ebp - 0x23bc], 1
cmp dword [0x10131e4], 0
je 0x100a819
mov esi, dword [ebp - 0x2380]
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x9c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov cx, word [esi]
cmp cx, 0x30
jb 0x1009ec2
cmp cx, 0x39
ja 0x1009ec2
movzx ecx, cx
sub ecx, 0x30
jmp 0x1009ed4
cmp cx, 0x41
jb 0x1009f00
cmp cx, 0x46
ja 0x1009f00
movzx ecx, cx
sub ecx, 0x37
mov eax, ebx
push 2
cdq
pop edi
idiv edi
neg edx
sbb edx, edx
and edx, 0xfffffff1
add edx, 0x10
imul ecx, edx
cmp ebx, 0x20
jge 0x100a652
lea eax, [ebp + eax - 0x9c]
or byte [eax], cl
inc ebx
inc esi
inc esi
jmp 0x1009eab
cmp ebx, 0x20
jne 0x100a652
cmp word [esi], 0
mov byte [ebp - 0x23d8], 0
mov byte [ebp - 0x238d], 0
je 0x1009f1f
inc esi
inc esi
mov ax, word [esi]
cmp ax, 0x43
jne 0x100a01d
mov byte [ebp - 0x23d8], 1
or dword [ebp - 0x2380], 0xffffffff
lea eax, [ebp - 0x2380]
push eax
push 1
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x1009f70
or dword [ebp - 0x2380], 0xffffffff
call ebx
cmp eax, 0x3f0
jne 0x100a652
cmp byte [ebp - 0x238d], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jne 0x1009f81
call esi
mov edi, 0x80000001
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push eax
push eax
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp byte [ebp - 0x238d], 0
je 0x1009fa4
call esi
lea eax, [ebp - 0x23d0]
push eax
push 8
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100a085
lea eax, [ebp - 0x239c]
push eax
call fcn.010047bc
test eax, eax
pop ecx
jne 0x100a00c
lea eax, [ebp - 0x2404]
push eax
push 0x50
lea eax, [ebp - 0x54]
push eax
push 1
push dword [ebp - 0x23d0]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x100a00c
push dword [ebp - 0x239c]
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esi, eax
neg esi
sbb esi, esi
and esi, 2
push dword [ebp - 0x23d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100a0bc
cmp ax, 0x4d
je 0x100a02f
cmp ax, 0x45
jne 0x1009f33
jmp 0x100a036
mov byte [ebp - 0x238d], 1
add esi, 4
push esi
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x100a808
cmp esi, 0xffffffff
je 0x100a808
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1009f33
push edi
push 0x1002608
call fcn.010081c5
pop ecx
jmp 0x100a651
call ebx
and word [ebp - 0x2370], 0
mov edx, eax
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x236e]
rep stosd dword es:[edi], eax
push edx
push 0x10025c8
stosw word es:[edi], ax
lea eax, [ebp - 0x2370]
push 0x104
push eax
call fcn.01005a9e
add esp, 0x10
xor edi, edi
cmp esi, edi
mov ebx, 0x100
push 5
mov dword [ebp - 0x23cc], ebx
pop eax
je 0x100a0d5
cmp esi, 1
jne 0x100a0d8
push 4
pop eax
push edi
push eax
lea eax, [ebp - 0x23cc]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.01005b2f
add esp, 0x10
cmp eax, edi
mov dword [ebp - 0x239c], eax
je 0x100a11a
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100a10f
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x239c]
jmp 0x100a7e3
mov eax, dword [ebp - 0x23cc]
push eax
lea ecx, [ebp - 0x1b24]
mov dword [ebp - 0x23dc], eax
mov dword [ebp - 0x23c0], eax
mov dword [ebp - 0x23d4], eax
mov dword [ebp - 0x23c8], eax
mov dword [ebp - 0x23c4], eax
call fcn.0100589c
push dword [ebp - 0x23c0]
lea ecx, [ebp - 0x1e48]
call fcn.0100589c
push dword [ebp - 0x23d4]
lea ecx, [ebp - 0x1f54]
call fcn.0100589c
push dword [ebp - 0x23c8]
lea ecx, [ebp - 0x1d3c]
call fcn.0100589c
push dword [ebp - 0x23c4]
lea ecx, [ebp - 0x1c30]
call fcn.0100589c
lea eax, [ebp - 0x23c4]
push eax
push dword [ebp - 0x1c30]
lea eax, [ebp - 0x23c8]
push eax
push dword [ebp - 0x1d3c]
lea eax, [ebp - 0x23d4]
push eax
push dword [ebp - 0x1f54]
lea eax, [ebp - 0x23c0]
push eax
push dword [ebp - 0x1e48]
lea eax, [ebp - 0x23dc]
push eax
push dword [ebp - 0x1b24]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
test eax, eax
jne 0x100a268
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x2380], 0xffffffff
mov esi, eax
je 0x100a201
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c2c], ebx
jle 0x100a215
push dword [ebp - 0x1c30]
call fcn.010052fd
pop ecx
cmp dword [ebp - 0x1d38], ebx
jle 0x100a229
push dword [ebp - 0x1d3c]
call fcn.010052fd
pop ecx
cmp dword [ebp - 0x1f50], ebx
jle 0x100a23d
push dword [ebp - 0x1f54]
call fcn.010052fd
pop ecx
cmp dword [ebp - 0x1e44], ebx
jle 0x100a251
push dword [ebp - 0x1e48]
call fcn.010052fd
pop ecx
cmp dword [ebp - 0x1b20], ebx
jle 0x100a7e3
push dword [ebp - 0x1b24]
jmp 0x1009d63
push edi
push edi
push edi
push 2
push 3
push edi
push edi
push 0xffffffffffffffff
push dword [ebp - 0x1b24]
call dword [0x101225c]
cmp eax, edi
mov dword [ebp - 0x239c], eax
je 0x100a30f
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100a2a2
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x239c]
push 0x1002568
call fcn.010081c5
pop ecx
pop ecx
cmp dword [ebp - 0x1c2c], ebx
jle 0x100a2c8
push dword [ebp - 0x1c30]
call fcn.010052fd
pop ecx
cmp dword [ebp - 0x1d38], ebx
jle 0x100a2dc
push dword [ebp - 0x1d3c]
call fcn.010052fd
pop ecx
cmp dword [ebp - 0x1f50], ebx
jle 0x100a2f0
push dword [ebp - 0x1f54]
call fcn.010052fd
pop ecx
cmp dword [ebp - 0x1e44], ebx
jle 0x100a304
push dword [ebp - 0x1e48]
call fcn.010052fd
pop ecx
cmp dword [ebp - 0x1b20], ebx
jmp 0x100a644
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, edi
mov dword [ebp - 0x2398], eax
jne 0x100a33e
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100a2b4
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100a2b4
and dword [ebp - 0x2384], 0
and dword [ebp - 0x238c], 0
call fcn.0100844a
mov edi, eax
test edi, edi
jne 0x100a37c
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100a36c
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x1002508
call fcn.010081c5
pop ecx
pop ecx
jmp 0x100a3b4
and dword [ebp - 0x23b0], 0
and dword [ebp - 0x239c], 0
call fcn.01004a77
test eax, eax
mov dword [ebp - 0x23a4], eax
jne 0x100a3dd
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100a3ae
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [ebp - 0x238c]
test eax, eax
je 0x100a3c4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2384]
test eax, eax
je 0x100a2b4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x100a2b4
mov eax, dword [ebp - 0x23a4]
mov ebx, dword [eax]
lea ecx, [ebp - 0x2384]
call fcn.010058cb
push eax
push 0x1001414
push dword [ebp - 0x23a4]
call dword [ebx]
mov eax, dword [ebp - 0x23a4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2384]
mov dword [ebp - 0x23a4], eax
lea eax, [ebp - 0x239c]
mov dword [ebp - 0x23b8], esi
mov ebx, dword [edi]
push eax
lea ecx, [ebp - 0x238c]
call fcn.010058cb
push eax
lea eax, [ebp - 0x23b0]
push eax
push dword [ebp - 0x23a4]
lea eax, [ebp - 0x9c]
push 0x10
push eax
lea eax, [ebp - 0x23b8]
push eax
push edi
call dword [ebx + 0x38]
test eax, eax
je 0x100a49c
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100a46b
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x1002498
call fcn.010081c5
mov eax, dword [edi]
pop ecx
pop ecx
push edi
call dword [eax + 8]
mov eax, dword [ebp - 0x238c]
test eax, eax
je 0x100a48f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2384]
test eax, eax
jmp 0x100a5e1
push dword [ebp - 0x23b0]
xor ebx, ebx
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0x23a4], eax
jne 0x100a4e0
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100a4cf
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002428
jmp 0x100a5bc
push dword [ebp - 0x238c]
call dword [0x1012278]
test eax, eax
jne 0x100a50e
cmp dword [ebp - 0x2380], 0xffffffff
je 0x100a5c3
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100a5c3
mov eax, dword [ebp - 0x2384]
lea edx, [ebp - 0x2388]
push edx
push 0x1001454
mov dword [ebp - 0x2388], ebx
mov ecx, dword [eax]
push eax
call dword [ecx]
sub esi, dword [ebp - 0x23b8]
mov eax, dword [ebp - 0x2388]
mov ecx, dword [eax]
lea edx, [ebp - 0x9c]
push edx
neg esi
sbb esi, esi
lea edx, [ebp - 0x23b8]
and esi, edx
push esi
push eax
call dword [ecx + 0x88]
mov eax, dword [ebp - 0x2388]
push dword [ebp - 0x2398]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x90]
push dword [ebp - 0x2380]
mov eax, dword [ebp - 0x2388]
push dword [ebp - 0x239c]
mov ecx, dword [eax]
push dword [ebp - 0x23d8]
push dword [ebp - 0x23b0]
push eax
call dword [ecx + 0x8c]
cmp dword [ebp - 0x2380], 0xffffffff
mov esi, eax
je 0x100a5ae
push dword [ebp - 0x2380]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x2380], 0xffffffff
cmp esi, ebx
je 0x100a65c
push ebx
push 0x10023c8
call fcn.010081c5
pop ecx
pop ecx
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [ebp - 0x238c]
cmp eax, ebx
je 0x100a5d9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2384]
cmp eax, ebx
je 0x100a5e9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, 0x100
cmp dword [ebp - 0x1c2c], esi
jle 0x100a602
push dword [ebp - 0x1c30]
call fcn.010052fd
pop ecx
cmp dword [ebp - 0x1d38], esi
jle 0x100a616
push dword [ebp - 0x1d3c]
call fcn.010052fd
pop ecx
cmp dword [ebp - 0x1f50], esi
jle 0x100a62a
push dword [ebp - 0x1f54]
call fcn.010052fd
pop ecx
cmp dword [ebp - 0x1e44], esi
jle 0x100a63e
push dword [ebp - 0x1e48]
call fcn.010052fd
pop ecx
cmp dword [ebp - 0x1b20], esi
jle 0x100a652
push dword [ebp - 0x1b24]
call fcn.010052fd
pop ecx
mov esi, 0x641
jmp 0x100a7e3
mov eax, dword [ebp - 0x2388]
push dword [ebp - 0x238c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x84]
mov eax, dword [ebp - 0x2388]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [ebp - 0x238c]
cmp eax, ebx
je 0x100a693
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2384]
cmp eax, ebx
je 0x100a6a3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x23a4]
mov esi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp - 0x23e4], eax
mov eax, dword [ebp - 0x2398]
mov dword [0x10131dc], 3
mov dword [ebp - 0x23e0], eax
mov edi, 0x4ff
jmp 0x100a717
cmp eax, 1
je 0x100a72c
cmp eax, 2
jne 0x100a738
jmp 0x100a701
cmp dword [ebp - 0x23fc], 0x12
je 0x100a738
lea eax, [ebp - 0x2400]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2400]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push ebx
push ebx
lea eax, [ebp - 0x2400]
push ebx
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x100a6de
push edi
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x23e4]
push eax
push 2
call esi
cmp eax, ebx
jne 0x100a6d2
jmp 0x100a738
push dword [ebp - 0x2398]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x100
cmp dword [ebp - 0x1c2c], esi
jle 0x100a751
push dword [ebp - 0x1c30]
call fcn.010052fd
pop ecx
cmp dword [ebp - 0x1d38], esi
jle 0x100a765
push dword [ebp - 0x1d3c]
call fcn.010052fd
pop ecx
cmp dword [ebp - 0x1f50], esi
jle 0x100a779
push dword [ebp - 0x1f54]
call fcn.010052fd
pop ecx
cmp dword [ebp - 0x1e44], esi
jle 0x100a78d
push dword [ebp - 0x1e48]
call fcn.010052fd
pop ecx
cmp dword [ebp - 0x1b20], esi
jle 0x100a7a1
push dword [ebp - 0x1b24]
call fcn.010052fd
pop ecx
mov esi, dword [ebp - 0x2394]
xor edi, edi
cmp dword [ebp - 0x23a8], edi
je 0x100a7c9
cmp dword [0x10131e4], edi
jne 0x100a7c9
mov eax, dword [0x1013178]
cmp eax, edi
je 0x100a7c9
push eax
call dword [sym.imp.ole32.dll_CoRevokeClassObject]
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [ebp - 0x23bc], edi
je 0x100a7e3
mov esi, 0x641
push esi
call fcn.01007202
pop ecx
lea ecx, [ebp - 0x2168]
call fcn.01005988
lea ecx, [ebp - 0x1a18]
call fcn.010073b2
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.0100f1d6
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002360
jmp 0x100a07a
mov dword [0x10131dc], 1
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x2400]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x100a851
cmp dword [0x10131fc], eax
je 0x100a7a7
cmp dword [0x10131d4], eax
je 0x100a7a7
lea eax, [ebp - 0x2400]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2400]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x100a823