Function at 0x10006970
Capabilities:
Connect to wmi namespace via wbemlocator
Get common file path
Get disk information
Get mac address on windows
Query or enumerate registry value
Reference wmi statements
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6ec
mov eax, dword [0x1013c270]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x200
mov esi, ecx
push 0
push esi
mov dword [ebp - 0x6dc], esi
call fcn.1006cd80
add esp, 0xc
lea edi, [esi + 0x200]
push 0x200
push 0
push edi
call fcn.1006cd80
add esp, 0xc
lea eax, [esi + 0x400]
push 0x200
push 0
push eax
call fcn.1006cd80
add esp, 0xc
lea ebx, [esi + 0x600]
push 0x200
push 0
push ebx
call fcn.1006cd80
add esp, 0xc
lea eax, [esi + 0x800]
push 0x200
push 0
push eax
call fcn.1006cd80
add esp, 0xc
lea eax, [esi + 0xa00]
push 0x200
push 0
push eax
call fcn.1006cd80
add esp, 0xc
add esi, 0xc00
push 0x200
push 0
push esi
call fcn.1006cd80
mov eax, dword [ebp - 0x6dc]
add esp, 0xc
add eax, 0xe00
push 0x200
push 0
push eax
call fcn.1006cd80
mov eax, dword [ebp - 0x6dc]
add esp, 0xc
add eax, 0x1000
push 0x200
push 0
push eax
call fcn.1006cd80
mov eax, dword [ebp - 0x6dc]
add esp, 0xc
add eax, 0x1200
mov dword [ebp - 0x6b4], eax
push 0x200
push 0
push eax
call fcn.1006cd80
mov eax, dword [ebp - 0x6dc]
add esp, 0xc
add eax, 0x1400
mov dword [ebp - 0x6e8], eax
push 0x200
push 0
push eax
call fcn.1006cd80
mov eax, dword [ebp - 0x6dc]
add esp, 0xc
add eax, 0x1600
push 0x200
push 0
push eax
call fcn.1006cd80
add esp, 0xc
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x1000729d
lea eax, [ebp - 0x6cc]
mov dword [ebp - 0x6cc], 0
push eax
push 0x1009f360
push 1
push 0
push 0x1009f430
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1000729d
mov eax, dword [ebp - 0x6cc]
lea edx, [ebp - 0x694]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x694], 0
mov ecx, dword [eax]
push str.ROOTCIMV2
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x10007291
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [ebp - 0x694]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x10007285
mov eax, dword [ebp - 0x694]
lea edx, [ebp - 0x6c0]
push edx
push 0
push 0x30
push str.SELECT__FROM_Win32_ComputerSystemProduct
mov dword [ebp - 0x6c0], 0
mov ecx, dword [eax]
push 0x100ab8cc
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x10006c90
mov eax, dword [ebp - 0x6c0]
lea edx, [ebp - 0x68c]
push edx
lea edx, [ebp - 0x6c4]
mov dword [ebp - 0x68c], 0
push edx
push 1
mov dword [ebp - 0x6c4], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x10006c7c
cmp dword [ebp - 0x68c], 0
jbe 0x10006c7c
xor eax, eax
lea edx, [ebp - 0x6a8]
push 0
push 0
mov word [ebp - 0x6a8], ax
xorps xmm0, xmm0
mov dword [ebp - 0x69e], eax
mov word [ebp - 0x69a], ax
mov eax, dword [ebp - 0x6c4]
push edx
push 0
movq qword [ebp - 0x6a6], xmm0
mov ecx, dword [eax]
push str.UUID
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x10006c5c
push 0x100
push dword [ebp - 0x6a0]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
call ebx
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x6c4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6c0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x10006c96
mov eax, dword [ebp - 0x6c4]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6c0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x10006c96
mov eax, dword [ebp - 0x6c0]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x10006c96
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp - 0x694]
lea edx, [ebp - 0x6c0]
push edx
push 0
push 0x30
mov ecx, dword [eax]
push str.SELECT__FROM_Win32_ComputerSystemProduct
push 0x100ab8cc
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x10006d7f
mov eax, dword [ebp - 0x6c0]
lea edx, [ebp - 0x68c]
push edx
lea edx, [ebp - 0x6c4]
mov dword [ebp - 0x68c], 0
push edx
push 1
mov dword [ebp - 0x6c4], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x10006d73
cmp dword [ebp - 0x68c], 0
jbe 0x10006d73
xor eax, eax
lea edx, [ebp - 0x6a8]
push 0
push 0
mov word [ebp - 0x6a8], ax
xorps xmm0, xmm0
mov dword [ebp - 0x69e], eax
mov word [ebp - 0x69a], ax
mov eax, dword [ebp - 0x6c4]
push edx
push 0
movq qword [ebp - 0x6a6], xmm0
mov ecx, dword [eax]
push str.Name
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x10006d67
mov eax, dword [ebp - 0x6dc]
push 0x100
push dword [ebp - 0x6a0]
add eax, 0x800
push eax
call ebx
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x6c4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6c0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x694]
lea edx, [ebp - 0x6c0]
push edx
push 0
push 0x30
mov ecx, dword [eax]
push str.SELECT__FROM_Win32_OperatingSystem
push 0x100ab8cc
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x10006e68
mov eax, dword [ebp - 0x6c0]
lea edx, [ebp - 0x68c]
push edx
lea edx, [ebp - 0x6c4]
mov dword [ebp - 0x68c], 0
push edx
push 1
mov dword [ebp - 0x6c4], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x10006e5c
cmp dword [ebp - 0x68c], 0
jbe 0x10006e5c
xor eax, eax
lea edx, [ebp - 0x6a8]
push 0
push 0
mov word [ebp - 0x6a8], ax
xorps xmm0, xmm0
mov dword [ebp - 0x69e], eax
mov word [ebp - 0x69a], ax
mov eax, dword [ebp - 0x6c4]
push edx
push 0
movq qword [ebp - 0x6a6], xmm0
mov ecx, dword [eax]
push str.SerialNumber
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x10006e50
mov eax, dword [ebp - 0x6dc]
push 0x100
push dword [ebp - 0x6a0]
add eax, 0xa00
push eax
call ebx
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x6c4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6c0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x694]
lea edx, [ebp - 0x6c0]
push edx
push 0
push 0x30
mov ecx, dword [eax]
push str.SELECT__FROM_Win32_OperatingSystem
push 0x100ab8cc
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x10006f6c
mov eax, dword [ebp - 0x6c0]
lea edx, [ebp - 0x68c]
push edx
lea edx, [ebp - 0x6c4]
mov dword [ebp - 0x68c], 0
push edx
push 1
mov dword [ebp - 0x6c4], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x10006f60
cmp dword [ebp - 0x68c], 0
jbe 0x10006f60
xor eax, eax
lea edx, [ebp - 0x6a8]
push 0
push 0
mov word [ebp - 0x6a8], ax
xorps xmm0, xmm0
mov dword [ebp - 0x69e], eax
mov word [ebp - 0x69a], ax
mov eax, dword [ebp - 0x6c4]
push edx
push 0
movq qword [ebp - 0x6a6], xmm0
mov ecx, dword [eax]
push 0x100ab954
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x10006f54
push 0x100
push dword [ebp - 0x6a0]
push esi
call ebx
cmp word [esi], 0
je 0x10006f47
mov eax, esi
cmp word [esi], 0x2e
jne 0x10006f3c
xor ecx, ecx
mov word [esi], cx
add eax, 2
mov esi, eax
cmp word [eax], 0
jne 0x10006f31
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x6c4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6c0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x694]
lea edx, [ebp - 0x6c0]
push edx
push 0
push 0x30
mov ecx, dword [eax]
push str.SELECT__FROM_Win32_BIOS
push 0x100ab8cc
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x10007055
mov eax, dword [ebp - 0x6c0]
lea edx, [ebp - 0x68c]
push edx
lea edx, [ebp - 0x6c4]
mov dword [ebp - 0x68c], 0
push edx
push 1
mov dword [ebp - 0x6c4], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x10007049
cmp dword [ebp - 0x68c], 0
jbe 0x10007049
xor eax, eax
lea edx, [ebp - 0x6a8]
push 0
push 0
mov word [ebp - 0x6a8], ax
xorps xmm0, xmm0
mov dword [ebp - 0x69e], eax
mov word [ebp - 0x69a], ax
mov eax, dword [ebp - 0x6c4]
push edx
push 0
movq qword [ebp - 0x6a6], xmm0
mov ecx, dword [eax]
push str.SerialNumber
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x1000703d
mov eax, dword [ebp - 0x6dc]
push 0x100
push dword [ebp - 0x6a0]
add eax, 0xe00
push eax
call ebx
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x6c4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6c0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x694]
lea edx, [ebp - 0x6c0]
push edx
push 0
push 0x30
mov ecx, dword [eax]
push str.SELECT__FROM_Win32_BIOS
push 0x100ab8cc
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x1000713e
mov eax, dword [ebp - 0x6c0]
lea edx, [ebp - 0x68c]
push edx
lea edx, [ebp - 0x6c4]
mov dword [ebp - 0x68c], 0
push edx
push 1
mov dword [ebp - 0x6c4], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x10007132
cmp dword [ebp - 0x68c], 0
jbe 0x10007132
xor eax, eax
lea edx, [ebp - 0x6a8]
push 0
push 0
mov word [ebp - 0x6a8], ax
xorps xmm0, xmm0
mov dword [ebp - 0x69e], eax
mov word [ebp - 0x69a], ax
mov eax, dword [ebp - 0x6c4]
push edx
push 0
movq qword [ebp - 0x6a6], xmm0
mov ecx, dword [eax]
push str.SMBIOSBIOSVersion
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x10007126
mov eax, dword [ebp - 0x6dc]
push 0x100
push dword [ebp - 0x6a0]
add eax, 0x1000
push eax
call ebx
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x6c4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6c0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x694]
lea edx, [ebp - 0x6c0]
push edx
push 0
push 0x30
mov ecx, dword [eax]
push str.SELECT__FROM_Win32_DiskDrive
push 0x100ab8cc
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x10007285
mov eax, dword [ebp - 0x6c0]
lea edx, [ebp - 0x68c]
push edx
lea edx, [ebp - 0x6c4]
mov dword [ebp - 0x68c], 0
push edx
push 1
mov dword [ebp - 0x6c4], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x10007279
cmp dword [ebp - 0x68c], 0
jbe 0x10007279
xor eax, eax
lea edx, [ebp - 0x6a8]
push 0
push 0
mov word [ebp - 0x6a8], ax
xorps xmm0, xmm0
mov dword [ebp - 0x69e], eax
mov word [ebp - 0x69a], ax
mov eax, dword [ebp - 0x6c4]
push edx
push 0
movq qword [ebp - 0x6a6], xmm0
mov ecx, dword [eax]
push str.SerialNumber
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x1000726d
push 0x208
lea eax, [ebp - 0x278]
push 0
push eax
call fcn.1006cd80
add esp, 0xc
lea eax, [ebp - 0x278]
push 0x100
push dword [ebp - 0x6a0]
push eax
call ebx
xor esi, esi
movzx eax, word [ebp + esi*2 - 0x278]
push eax
call fcn.10073546
add esp, 4
test eax, eax
je 0x10007241
inc esi
cmp esi, 0x208
jb 0x10007221
jmp 0x10007260
lea ecx, [ebp - 0x278]
mov edx, edi
lea ecx, [ecx + esi*2]
sub edx, ecx
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x10007250
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x6c4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6c0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x694]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6cc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [ebp - 0x6e4], 0
mov dword [ebp - 0x6e0], 0
mov eax, 1
xor edx, edx
cpuid
mov dword [ebp - 0x6e4], edx
mov dword [ebp - 0x6e0], eax
push dword [ebp - 0x6e0]
push dword [ebp - 0x6e4]
push str._08X_08X
push dword [ebp - 0x6dc]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
call fcn.100068c0
add esp, 4
test al, al
je 0x10007308
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100072f7
sub ecx, edx
sar ecx, 1
jne 0x1000735d
push 0x200
push 0
push edi
call fcn.1006cd80
add esp, 0xc
xor esi, esi
nop word [eax + eax]
push 0x200
lea eax, [ebp - 0x270]
push 0
push eax
call fcn.1006cd80
add esp, 0xc
lea edx, [ebp - 0x270]
mov ecx, esi
call fcn.10006600
test eax, eax
jne 0x1000734f
inc esi
cmp esi, 0xa
jl 0x10007320
jmp 0x1000735d
lea eax, [ebp - 0x270]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea eax, [ebp - 0x6d4]
push eax
push 0
mov byte [ebp - 0x690], 0
mov dword [ebp - 0x68f], 0
mov byte [ebp - 0x68b], 0
mov dword [ebp - 0x6d4], 0
call ebx
push dword [ebp - 0x6d4]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x100073f1
lea eax, [ebp - 0x6d4]
push eax
push esi
call ebx
test eax, eax
jne 0x100073f1
mov ebx, dword [ebp - 0x690]
lea ecx, [esi + 8]
call fcn.10006770
mov ecx, eax
cmp ecx, 1
je 0x100073cb
test ecx, ecx
jne 0x100073e9
mov ax, word [esi + 0x198]
mov ebx, dword [esi + 0x194]
mov dword [ebp - 0x690], ebx
mov word [ebp - 0x68c], ax
test ecx, ecx
je 0x100073f7
mov esi, dword [esi]
test esi, esi
jne 0x100073b8
jmp 0x100073f7
mov ebx, dword [ebp - 0x690]
mov eax, dword [ebp - 0x68c]
shr eax, 8
movzx eax, al
push eax
movzx eax, byte [ebp - 0x68c]
push eax
mov eax, ebx
shr eax, 0x18
push eax
mov eax, ebx
shr ebx, 8
shr eax, 0x10
movzx eax, al
push eax
movzx eax, bl
push eax
movzx eax, byte [ebp - 0x690]
push eax
mov eax, dword [ebp - 0x6dc]
add eax, 0x400
push str._02X__02X__02X__02X__02X__02X
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
mov ecx, edi
call fcn.10008a80
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007450
sub ecx, edx
sar ecx, 1
je 0x1000763d
lea eax, [ebp - 0x6b0]
push edi
push eax
call fcn.1000d1e0
add esp, 8
lea eax, [ebp - 0x6b0]
cmp dword [ebp - 0x69c], 0x10
lea ecx, [ebp - 0x6d5]
cmovae eax, dword [ebp - 0x6b0]
push dword [ebp - 0x6a0]
push eax
call fcn.1000d800
cmp dword [ebp - 0x69c], 0x10
lea eax, [ebp - 0x694]
mov ebx, dword [ebp - 0x6a0]
lea edi, [ebp - 0x6b0]
cmovae edi, dword [ebp - 0x6b0]
push eax
push str.SoftwarexiaoyuInstall
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x694], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x100074f7
push ebx
push edi
push 3
push 0
push 0x100aba50
push dword [ebp - 0x694]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x694]
test eax, eax
je 0x10007504
push eax
call esi
mov eax, dword [ebp - 0x69c]
cmp eax, 0x10
jb 0x10007550
mov ecx, dword [ebp - 0x6b0]
inc eax
cmp eax, 0x1000
jb 0x10007547
test cl, 0x1f
jne 0x10007e15
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x10007e1a
sub ecx, eax
cmp ecx, 4
jb 0x10007e1f
cmp ecx, 0x23
ja 0x10007e24
mov ecx, eax
push ecx
call fcn.100547d8
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edi, dword [ebp - 0x6dc]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007561
sub ecx, edx
sar ecx, 1
je 0x1000789c
lea eax, [ebp - 0x6b0]
push edi
push eax
call fcn.1000d1e0
add esp, 8
lea eax, [ebp - 0x6b0]
cmp dword [ebp - 0x69c], 0x10
lea ecx, [ebp - 0x6d5]
cmovae eax, dword [ebp - 0x6b0]
push dword [ebp - 0x6a0]
push eax
call fcn.1000d800
cmp dword [ebp - 0x69c], 0x10
lea eax, [ebp - 0x694]
mov ebx, dword [ebp - 0x6a0]
lea edi, [ebp - 0x6b0]
cmovae edi, dword [ebp - 0x6b0]
push eax
push str.SoftwarexiaoyuInstall
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x694], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10007601
push ebx
push edi
push 3
push eax
push 0x100aba6c
push dword [ebp - 0x694]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x694]
test eax, eax
je 0x1000760e
push eax
call esi
mov eax, dword [ebp - 0x69c]
cmp eax, 0x10
jb 0x100077ad
mov ecx, dword [ebp - 0x6b0]
inc eax
cmp eax, 0x1000
jb 0x100077a4
test cl, 0x1f
je 0x10007783
jmp 0x10007e29
push 0x64
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.1006cd80
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x694]
add esp, 0xc
mov dword [ebp - 0x68c], 0x64
mov dword [ebp - 0x694], 0
push eax
push str.SoftwarexiaoyuInstall
push reloc.WS2_32.dll_accept
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10007693
mov eax, dword [ebp - 0x694]
test eax, eax
je 0x100076e2
push eax
call esi
jmp 0x100076e2
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x70]
push eax
push 0
push 0
push 0x100aba50
push dword [ebp - 0x694]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 0x694]
je 0x100076c6
test eax, eax
je 0x100076e2
push eax
call esi
jmp 0x100076e2
test eax, eax
je 0x100076cd
push eax
call esi
push dword [ebp - 0x68c]
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x6d5]
call fcn.1000d800
push 0x200
push 0
push edi
call fcn.1006cd80
add esp, 0xc
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x6b0]
call fcn.1000d300
mov ecx, eax
cmp dword [ecx + 0x14], 8
jb 0x10007710
mov ecx, dword [ecx]
nop word [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edi], ax
lea edi, [edi + 2]
test ax, ax
jne 0x10007710
mov eax, dword [ebp - 0x69c]
cmp eax, 8
jb 0x10007556
mov ecx, dword [ebp - 0x6b0]
inc eax
cmp eax, 0x7fffffff
ja 0x10007e2e
add eax, eax
cmp eax, 0x1000
jb 0x10007775
test cl, 0x1f
jne 0x10007e33
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x10007e38
sub ecx, eax
cmp ecx, 4
jb 0x10007e3d
cmp ecx, 0x23
ja 0x10007e42
mov ecx, eax
push ecx
call fcn.100547d8
add esp, 4
jmp 0x10007556
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x10007e47
sub ecx, eax
cmp ecx, 4
jb 0x10007e4c
cmp ecx, 0x23
ja 0x10007e51
mov ecx, eax
push ecx
call fcn.100547d8
add esp, 4
mov edi, dword [ebp - 0x6dc]
lea ebx, [edi + 0x400]
mov ecx, ebx
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100077c0
sub ecx, edx
sar ecx, 1
je 0x100079f7
lea eax, [ebp - 0x6b0]
push ebx
push eax
call fcn.1000d1e0
add esp, 8
lea eax, [ebp - 0x6b0]
cmp dword [ebp - 0x69c], 0x10
lea ecx, [ebp - 0x6d5]
cmovae eax, dword [ebp - 0x6b0]
push dword [ebp - 0x6a0]
push eax
call fcn.1000d800
cmp dword [ebp - 0x69c], 0x10
lea eax, [ebp - 0x694]
mov ebx, dword [ebp - 0x6a0]
lea edi, [ebp - 0x6b0]
cmovae edi, dword [ebp - 0x6b0]
push eax
push str.SoftwarexiaoyuInstall
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x694], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10007860
push ebx
push edi
push 3
push eax
push 0x100aba70
push dword [ebp - 0x694]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x694]
test eax, eax
je 0x1000786d
push eax
call esi
mov eax, dword [ebp - 0x69c]
cmp eax, 0x10
jb 0x10007b10
mov ecx, dword [ebp - 0x6b0]
inc eax
cmp eax, 0x1000
jb 0x10007b07
test cl, 0x1f
je 0x100079d3
jmp 0x10007e56
push 0x64
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.1006cd80
add esp, 0xc
mov dword [ebp - 0x68c], 0x64
lea eax, [ebp - 0x694]
mov dword [ebp - 0x694], 0
push eax
push str.SoftwarexiaoyuInstall
push reloc.WS2_32.dll_accept
call ebx
test eax, eax
je 0x100078e6
mov eax, dword [ebp - 0x694]
test eax, eax
je 0x10007935
push eax
call esi
jmp 0x10007935
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x70]
push eax
push 0
push 0
push 0x100aba6c
push dword [ebp - 0x694]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 0x694]
je 0x10007919
test eax, eax
je 0x10007935
push eax
call esi
jmp 0x10007935
test eax, eax
je 0x10007920
push eax
call esi
push dword [ebp - 0x68c]
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x6d5]
call fcn.1000d800
push 0x200
push 0
push edi
call fcn.1006cd80
add esp, 0xc
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x6b0]
call fcn.1000d300
mov ecx, eax
cmp dword [ecx + 0x14], 8
jb 0x1000795d
mov ecx, dword [ecx]
mov edx, edi
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x10007960
mov eax, dword [ebp - 0x69c]
cmp eax, 8
jb 0x100077b3
mov ecx, dword [ebp - 0x6b0]
inc eax
cmp eax, 0x7fffffff
ja 0x10007e5b
add eax, eax
cmp eax, 0x1000
jb 0x100079c5
test cl, 0x1f
jne 0x10007e60
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x10007e65
sub ecx, eax
cmp ecx, 4
jb 0x10007e6a
cmp ecx, 0x23
ja 0x10007e6f
mov ecx, eax
push ecx
call fcn.100547d8
add esp, 4
jmp 0x100077b3
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x10007e74
sub ecx, eax
cmp ecx, 4
jb 0x10007e79
cmp ecx, 0x23
jbe 0x10007b05
jmp 0x10007e7e
push 0x64
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.1006cd80
add esp, 0xc
mov dword [ebp - 0x68c], 0x64
lea eax, [ebp - 0x694]
mov dword [ebp - 0x694], 0
push eax
push str.SoftwarexiaoyuInstall
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x10007a45
mov eax, dword [ebp - 0x694]
test eax, eax
je 0x10007a94
push eax
call esi
jmp 0x10007a94
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x70]
push eax
push 0
push 0
push 0x100aba70
push dword [ebp - 0x694]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 0x694]
je 0x10007a78
test eax, eax
je 0x10007a94
push eax
call esi
jmp 0x10007a94
test eax, eax
je 0x10007a7f
push eax
call esi
push dword [ebp - 0x68c]
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x6d5]
call fcn.1000d800
push 0x200
push 0
push ebx
call fcn.1006cd80
add esp, 0xc
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x6b0]
call fcn.1000d300
mov ecx, eax
cmp dword [ecx + 0x14], 8
jb 0x10007ac0
mov ecx, dword [ecx]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ebx], ax
lea ebx, [ebx + 2]
test ax, ax
jne 0x10007ac0
mov eax, dword [ebp - 0x69c]
cmp eax, 8
jb 0x10007b10
mov ecx, dword [ebp - 0x6b0]
inc eax
cmp eax, 0x7fffffff
ja 0x10007e83
add eax, eax
cmp eax, 0x1000
jb 0x10007b07
test cl, 0x1f
je 0x100079d3
jmp 0x10007e88
mov ecx, eax
push ecx
call fcn.100547d8
add esp, 4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x6bc]
mov dword [ebp - 0x6bc], 0
push eax
push 0
push 0
push 0x100aba74
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x10007b56
push dword [ebp - 0x6bc]
push str._08X
push dword [ebp - 0x6b4]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x208
lea eax, [ebp - 0x688]
push 0
push eax
call fcn.1006cd80
add esp, 0xc
lea eax, [ebp - 0x480]
push 0x208
push 0
push eax
call fcn.1006cd80
add esp, 0xc
lea eax, [ebp - 0x688]
xorps xmm0, xmm0
movlpd qword [ebp - 0x6c8], xmm0
movlpd qword [ebp - 0x6d0], xmm0
push eax
push 0
push 0
push 0x25
push 0
movlpd qword [ebp - 0x690], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x10007dc2
push 0x100abae4
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileTime]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x10007c76
push 0
push 0
push 3
push 0
push 1
push closesocket
lea eax, [ebp - 0x480]
push eax
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x10007c70
push 0
push 0
lea eax, [ebp - 0x6b8]
mov dword [ebp - 0x6b8], 0
push eax
push esi
mov dword [ebp - 0x6b4], 0
call ebx
test eax, eax
je 0x10007c6d
mov ecx, dword [ebp - 0x6b8]
mov eax, dword [ebp - 0x6b4]
add ecx, 0x2ac18000
push 0
push 0x989680
adc eax, 0xfe624e21
mov dword [ebp - 0x694], 0
push eax
push ecx
call fcn.1008f3f0
mov dword [ebp - 0x6c8], eax
mov dword [ebp - 0x6c4], edx
push esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push str.user32.dll
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x10007d1a
push 0
push 0
push 3
push 0
push 1
push closesocket
lea eax, [ebp - 0x480]
push eax
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x10007d1a
push 0
push 0
lea eax, [ebp - 0x6b8]
mov dword [ebp - 0x6b8], 0
push eax
push esi
mov dword [ebp - 0x6b4], 0
call ebx
test eax, eax
je 0x10007d17
mov ecx, dword [ebp - 0x6b8]
mov eax, dword [ebp - 0x6b4]
add ecx, 0x2ac18000
push 0
push 0x989680
adc eax, 0xfe624e21
mov dword [ebp - 0x694], 0
push eax
push ecx
call fcn.1008f3f0
mov dword [ebp - 0x6d0], eax
mov dword [ebp - 0x6cc], edx
push esi
call edi
push str.notepad.exe
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x10007dc2
push 0
push 0
push 3
push 0
push 1
push closesocket
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10007dc2
push 0
push 0
lea eax, [ebp - 0x6b8]
mov dword [ebp - 0x6b8], 0
push eax
push esi
mov dword [ebp - 0x6b4], 0
call ebx
test eax, eax
je 0x10007dbf
mov ecx, dword [ebp - 0x6b8]
mov eax, dword [ebp - 0x6b4]
add ecx, 0x2ac18000
push 0
push 0x989680
adc eax, 0xfe624e21
mov dword [ebp - 0x694], 0
push eax
push ecx
call fcn.1008f3f0
mov dword [ebp - 0x690], eax
mov dword [ebp - 0x68c], edx
push esi
call edi
push dword [ebp - 0x68c]
push dword [ebp - 0x690]
push dword [ebp - 0x6cc]
push dword [ebp - 0x6d0]
push dword [ebp - 0x6c4]
push dword [ebp - 0x6c8]
push str._llu__llu__llu
push 0x100
push dword [ebp - 0x6e8]
call fcn.10007e90
mov ecx, dword [ebp - 4]
add esp, 0x24
mov eax, dword [ebp - 0x6dc]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10054c42
mov esp, ebp
pop ebp
ret
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
call fcn.1006f4f6
int3