Function at 0x10014ec7
Capabilities:
Allocate thread local storage
Connect pipe
Get geographical location
Log keystrokes via polling
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
push edi
push 2
pop edi
mov dword [ebp - 0x90], ecx
xor ecx, ecx
mov dword [ebp - 0xc], 0x622ba394
push 1
mov dword [ebp - 4], 0x8e92eda8
mov dword [ebp - 0x94], edx
mov dword [ebp - 4], ecx
pop esi
jmp 0x10014f07
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xac], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x10014efa
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], ecx
jl 0x10014fe0
mov dword [ebp - 0x10], 6
mov dword [ebp - 4], ecx
jmp 0x10014f34
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x50], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x10014f2a
mov dword [ebp - 0x4c], ecx
jmp 0x10014fad
mov dword [ebp - 0x14], 0xd49f
mov dword [ebp - 0x14], 0x1509cf13
cmp dword [ebp - 0x14], ecx
je 0x10014f53
mov ecx, esi
mov eax, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xac]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x50]
cmp ecx, eax
setle dl
cmp dword [ebp - 0x10], 0xfffa
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setg cl
mov dword [ebp - 4], ecx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
jmp 0x10014fa5
mov dword [ebp - 4], ecx
jmp 0x10014f9d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xac], 0xfffffffc
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x10014f8c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10014f87
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], esi
jle 0x10014f3e
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x10014fd7
push 0x37d
push 0x1e49
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor ecx, ecx
dec dword [ebp - 0xc]
jns 0x10014f1e
or edi, 0xffffffff
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], 0x3bc6e5c7
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x10015005
push 0xcab
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ecx, ecx
mov dword [ebp - 4], 0xfffffff9
jmp 0x1001501a
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jg 0x1001500e
mov dword [ebp - 4], 0x9fdf99ff
mov dword [ebp - 4], esi
mov dword [ebp - 4], 0xffffffed
jmp 0x10015056
cmp byte [ebp - 5], 0
je 0x10015041
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor ecx, ecx
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x10015053
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x17
mov byte [ebp - 5], cl
jne 0x10015032
cmp byte [ebp - 5], 0
je 0x10015075
push 0x1682
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x10015097
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x1001508f
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_EndDialog]
xor ecx, ecx
cmp dword [ebp - 4], ecx
jne 0x1001509d
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xe
jl 0x1001507a
mov dword [ebp - 0x14], 0x7cefa9d1
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x2c], 0xe011b55e
mov dword [ebp - 0x10], 0xeec54165
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ecx
jmp 0x100150df
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x28], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x100150d5
mov dword [ebp - 0xc], ecx
jmp 0x100150fa
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x8c], 0xc299e885
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x100150e9
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0x1d
je 0x10015176
mov dword [ebp - 4], 0xfffffff9
xor edx, edx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
imul eax, ecx, 0x849b
test eax, eax
jne 0x10015139
cmp dword [ebp - 4], eax
jne 0x10015139
xor ecx, ecx
jmp 0x1001513b
mov ecx, esi
mov eax, dword [ebp - 0x28]
lea eax, [ecx + 0xd7d3]
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
sub edx, eax
mov eax, dword [ebp - 0x28]
cmp edx, eax
setge cl
mov dword [ebp - 0x8c], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1d
jne 0x10015108
xor ecx, ecx
mov dword [ebp - 4], 5
mov dword [ebp - 0x1c], 9
mov dword [ebp - 4], ecx
jmp 0x10015196
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xf4], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10015189
mov dword [ebp - 4], ecx
jmp 0x100151ae
mov dword [ebp - 0x10], 0xcbd94543
inc dword [ebp - 0x10]
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jle 0x100151a1
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ebx, ebx
cmp eax, 0x57e8
mov eax, dword [ebp - 0x14]
setge bl
xor ecx, ecx
sub ebx, edx
test eax, eax
setle cl
cmp ebx, ecx
jne 0x10015487
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x100151ff
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x34], 0xc75b57fd
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x100151f1
or ebx, 0xffffffff
push 3
mov dword [ebp - 0x34], ebx
pop edi
jmp 0x10015259
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ecx
jmp 0x10015228
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x12c], 0x2c7c
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x10015217
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], ecx
jl 0x10015256
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x10015251
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
xor ecx, ecx
dec dword [ebp - 0x10]
jns 0x10015239
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x15
jle 0x1001520f
mov dword [ebp - 0x2c], 0xb44a
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x14], 0xfffffff4
cmp dword [ebp - 0x14], 0x17
je 0x100152b4
push ecx
push 0x4327
lea eax, [ebp - 0x84]
mov dword [ebp - 0x84], 0x2ba75a59
push eax
push 0x1960
mov dword [ebp - 0x2c], ecx
push 0x1af7
call fcn.1001c2e6
add esp, 0x14
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x17
push 0
pop ecx
jne 0x1001527c
mov dword [ebp - 4], ecx
mov dword [ebp - 4], ecx
jmp 0x100152c6
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x3c], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x100152bc
mov dword [ebp - 4], 0x16
jmp 0x10015329
mov dword [ebp - 0x10], 0xfffffff7
mov dword [ebp - 0x10], 0xf82baef
mov dword [ebp - 0x14], ecx
jmp 0x100152f4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x114], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100152e7
mov dword [ebp - 0x3c], 2
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ecx
jne 0x10015316
mov eax, ecx
cmp dword [ebp - 4], ecx
je 0x10015318
mov eax, esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x3c]
add eax, 0x7213ec75
mov dword [ebp - 0x10], eax
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xb
jle 0x100152d4
lea eax, [ebp - 0x7c]
push eax
push 0xbeb
lea eax, [ebp - 0x88]
push eax
push 0x36d5
push ecx
call fcn.10016239
mov dword [ebp - 4], 6
add esp, 0x14
mov dword [ebp - 0xc], esi
xor ecx, ecx
mov dword [ebp - 0x10], 0x9017ca4e
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], 0xeb2d
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x14], ecx
jmp 0x10015380
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x80], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10015376
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x10]
jg 0x100153b2
cmp dword [ebp - 4], 0
jne 0x100153b2
xor ecx, ecx
jmp 0x100153b4
mov ecx, esi
mov eax, dword [ebp - 4]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
imul eax, ecx, 0x50df
xor ecx, ecx
cmp eax, 0x8014
mov eax, dword [ebp - 4]
setg cl
sub eax, ecx
je 0x100153fc
cmp dword [ebp - 0x10], 0
je 0x100153fc
mov eax, esi
jmp 0x100153fe
xor eax, eax
mov ecx, dword [ebp - 4]
xor edx, edx
add ecx, eax
imul ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 4]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
xor edx, edx
sub ecx, 5
cmp ecx, dword [ebp - 0x1c]
jge 0x10015473
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 4], edx
jmp 0x10015445
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xd0], 0xbe74
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10015434
mov eax, dword [ebp - 0xd0]
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, esi
setle cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x10], 0xe08cccdd
mov dword [ebp - 0x14], edx
jmp 0x10015a86
mov byte [ebp - 5], dl
cmp byte [ebp - 5], dl
je 0x10015461
push edx
push edx
call dword [sym.imp.KERNEL32.dll_GetCommState]
xor edx, edx
jmp 0x10015461
xor edx, edx
or ebx, 0xffffffff
push 3
mov dword [ebp - 0x14], edx
pop edi
cmp dword [ebp - 0x14], edi
jg 0x10015461
mov dword [ebp - 0x10], 0xfffffffc
mov dword [ebp - 0xc], 0x3152c58f
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], edx
jmp 0x100154be
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x48], 0x6158d32f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x100154b0
mov dword [ebp - 0xc], edx
jmp 0x100154d9
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xb8], 0x58bdfadf
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x100154c8
cmp dword [ebp - 0x48], edx
jne 0x10015500
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setne dl
cmp edx, dword [ebp - 0x40]
je 0x100154fe
xor edx, edx
cmp dword [ebp - 0x40], edx
je 0x1001550a
jmp 0x10015500
xor edx, edx
mov ecx, esi
cmp dword [ebp - 0xb8], edx
jne 0x1001550c
mov ecx, edx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0xc]
sub edx, ecx
xor ecx, ecx
cmp eax, edx
setl cl
xor edx, edx
add ecx, 0x7533b484
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], 2
cmp dword [ebp - 0xc], edx
jl 0x1001559a
mov dword [ebp - 4], 0xd17017a6
xor edx, edx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x48]
cmp edx, eax
mov eax, dword [ebp - 0xc]
setg cl
imul ecx, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x48], ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 4], esi
dec dword [ebp - 0xc]
jns 0x10015538
xor edx, edx
mov dword [ebp - 0x10], edx
jmp 0x10015910
mov dword [ebp - 4], edx
jmp 0x100155b5
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x78], 8
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x100155a7
mov dword [ebp - 0x74], 0x17
jmp 0x10015609
mov dword [ebp - 4], edx
jmp 0x100155d6
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x58], 0xfffffff7
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x100155c8
mov dword [ebp - 0x58], edx
jmp 0x10015600
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x100155fd
push 0xb11
push 0x1f8e
push edx
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor edx, edx
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 2
jl 0x100155e1
dec dword [ebp - 0x74]
cmp dword [ebp - 0x74], 0xffffffe9
jne 0x100155c3
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10015627
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
xor edx, edx
mov dword [ebp - 0xc], 0x6b0f
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0xb6917ab6
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], edx
jmp 0x1001564d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x104], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x10015640
dec dword [ebp - 0xc]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], edi
jg 0x100156cb
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x18], 0x70f9e3d3
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0xc]
neg edx
push 0
sbb edx, edx
neg edx
mov ecx, dword [ebp + eax*4 - 0x104]
lea eax, [edx + 8]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xc]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0xa4], ecx
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg dl
mov dword [ebp - 0x18], edx
inc dword [ebp - 0xc]
pop edx
cmp dword [ebp - 0xc], edi
jle 0x1001565e
mov dword [ebp - 4], edx
jmp 0x100156de
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x38], 0x80bfe737
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x100156d0
mov dword [ebp - 0x38], edi
cmp dword [ebp - 0x38], edx
jl 0x1001590d
mov dword [ebp - 0x18], 0xd07ddbf4
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], 0xc1477a14
mov dword [ebp - 0x1c], 0xc298c245
mov dword [ebp - 0xc], edx
jmp 0x1001571d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x24], 0x477862f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x1001570f
mov dword [ebp - 0xc], edx
jmp 0x10015735
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x68], 0x96960f57
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10015727
mov dword [ebp - 0x68], edx
jmp 0x1001574e
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x24], 0xfffffffe
inc dword [ebp - 0x68]
cmp dword [ebp - 0x68], esi
jl 0x10015740
mov dword [ebp - 0x18], ebx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, ebx
mov eax, dword [ebp - 0x24]
setne cl
imul eax, ecx
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor eax, eax
cmp ecx, 0x4c638299
setge al
dec eax
mov dword [ebp - 0x1c], eax
jne 0x100157bb
xor ebx, ebx
cmp dword [ebp - 0xc], ebx
jne 0x100157bd
mov eax, dword [ebp - 0x24]
jmp 0x100157bd
xor ebx, ebx
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x2d], bl
mov dword [ebp - 4], 0xfffffffb
mov dword [ebp - 4], 0xffffffea
jmp 0x10015804
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x100157fc
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
cmp dword [ebp - 4], ebx
jne 0x1001580a
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffe3
jle 0x100157e2
push 0x3e46
lea eax, [ebp - 0x2d]
push ebx
push eax
call fcn.1001766d
mov dword [ebp - 4], 0xaeef20fe
add esp, 0xc
mov dword [ebp - 4], ebx
jmp 0x10015839
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xec], 0x177e
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x10015828
mov dword [ebp - 4], 2
cmp dword [ebp - 4], ebx
jl 0x10015863
mov dword [ebp - 0x1c], 0xcb36
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xec], ecx
dec dword [ebp - 4]
jns 0x1001584a
mov byte [ebp - 0x2e], bl
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 4], ebx
jmp 0x10015880
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x6c], 0x949dfcf0
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x10015872
mov dword [ebp - 0x18], ebx
jmp 0x100158e7
mov dword [ebp - 0xc], 0x4182bd7b
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
jmp 0x100158de
mov dword [ebp - 4], 0xfef9d786
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
jl 0x100158d8
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x100158ca
push 0x165
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x6c], ebx
jne 0x100158d8
dec dword [ebp - 4]
jns 0x100158a8
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffa
je 0x10015899
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffb
jne 0x1001588a
push ebx
mov edx, 0x60f1
lea ecx, [ebp - 0x2e]
call fcn.10015c59
dec dword [ebp - 0x38]
pop ecx
push 0xffffffffffffffff
pop ebx
push 0
pop edx
jns 0x100156ef
or ebx, ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x100155a2
mov dword [ebp - 0xc], 0x56f9b2cf
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x10], edx
jmp 0x1001593a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x20], 0xdde0bcd8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001592c
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], edx
jl 0x100159bc
mov dword [ebp - 4], 0xfffffffd
mov dword [ebp - 4], edx
jmp 0x100159b2
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x20]
mov eax, dword [ebp - 0xc]
cmp ecx, dword [ebp + eax*4 - 0x20]
jge 0x1001597a
mov eax, esi
cmp dword [ebp - 0x20], edx
jne 0x1001597c
mov eax, edx
xor edx, edx
cmp eax, esi
setle dl
sub edx, 0xe243
neg edx
sbb edx, edx
inc edx
sub edx, 0xa7609fa8
add edx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 4]
setl cl
mov dword [ebp + eax*4 - 0x20], ecx
inc dword [ebp - 4]
xor edx, edx
cmp dword [ebp - 4], edx
jle 0x10015953
dec dword [ebp - 0xc]
jns 0x10015947
mov dword [ebp - 0xc], edx
jmp 0x10015a60
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 6
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
je 0x100159f3
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
je 0x10015a06
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
sub ecx, 0xe74
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0xc]
setle dl
xor ecx, ecx
cmp eax, edx
setne cl
xor edx, edx
cmp ecx, ebx
jne 0x10015a41
mov eax, edx
cmp dword [ebp - 0xc], edx
je 0x10015a43
mov eax, esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], esi
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10015a5d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
xor edx, edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 7
jl 0x100159c4
mov eax, dword [ebp - 0x2c]
inc dword [ebp - 0x14]
jmp 0x10015492
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe0], 0x52cb1363
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10015a75
mov dword [ebp - 0x14], edx
jmp 0x10015aa1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x120], 0xc4530722
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10015a90
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xd8], eax
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], 0xfffffff9
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x14], 0x1e19e95d
mov dword [ebp - 0x2c], 0xdf628589
mov dword [ebp - 4], 0x1191
mov dword [ebp - 0x10], edx
jmp 0x10015af0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd4], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10015ae3
mov eax, dword [ebp - 0x2c]
sub ebx, eax
add ebx, dword [ebp - 4]
dec dword [ebp - 4]
test ebx, ebx
cmovne esi, edx
mov edx, dword [ebp - 0xc]
sub edx, 0xfff9
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp esi, 5
sete al
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0xc], ecx
jle 0x10015b93
xor ebx, ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x10015ba5
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x10015b66
push ebx
push 0x1808
push ebx
push 0x4a5
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x10015b8c
push 0x1dc7
push 0xd0d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
dec dword [ebp - 0x18]
jns 0x10015b4c
jmp 0x10015ba5
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], al
je 0x10015ba5
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov eax, dword [ebp - 0x94]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [ebp - 0x90]
mov esi, edx
mov edi, eax
call fcn.10014e55
add eax, esi
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret