Function at 0x100175d3
Capabilities:
Clear file content
Create thread
Get common file path
Query environment variable
Terminate process

Disassembly:
mov eax, 0x1006f0cf
call fcn.1006e3a8
sub esp, 0xcec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x24], 0x94643cdf
xor eax, eax
mov dword [ebp - 0x24], 4
inc eax
mov dword [ebp - 0x24], 0x7e17f759
mov dword [ebp - 0x24], eax
push edi
mov dword [ebp - 0x24], 0x8ce3e63e
mov dword [ebp - 0x24], 0xfffffffc
push 0xfffffffffffffff9
mov dword [ebp - 0x24], ebx
pop edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x24], 0x12d2c87
push eax
mov byte [ebp - 0x71], dl
call fcn.10012a45
xor edx, edx
mov dword [ebp - 0x28], ebx
inc edx
jmp 0x10017652
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x790], 0xadf1adb2
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x10017641
push 0xfffffffffffffff7
mov dword [ebp - 0x28], ebx
pop esi
jmp 0x1001766c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x6f0], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1001765f
mov dword [ebp - 0x28], ebx
jmp 0x10017685
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x450]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x10017676
mov eax, dword [ebp - 0x450]
lea ecx, [ebp - 0x450]
dec dword [eax]
call fcn.10012ac7
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x528]
mov dword [ebp - 0x24], 0x94643cdf
push 4
pop eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x24], 0x7e17f759
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0x8ce3e63e
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x24], 0x12d2c87
push eax
call fcn.10012a45
xor edx, edx
mov dword [ebp - 0x28], ebx
inc edx
jmp 0x100176fd
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x714], 0xadf1adb2
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x100176ec
mov dword [ebp - 0x28], ebx
jmp 0x10017714
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x724], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x10017707
mov dword [ebp - 0x28], ebx
jmp 0x1001772d
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x528]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1001771e
mov eax, dword [ebp - 0x528]
lea ecx, [ebp - 0x528]
dec dword [eax]
call fcn.10012ac7
xor esi, esi
mov dword [ebp - 0x30], 7
inc esi
mov dword [ebp - 0x14], 0x25b0e446
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0x3c4]
push esi
call fcn.10012a45
mov dword [ebp - 4], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], ebx
jmp 0x1001778d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c4]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001777a
mov eax, dword [ebp - 0x30]
push 2
mov dword [ebp - 0x14], 0x8ade19d2
mov dword [ebp - 0x14], ebx
pop edi
jmp 0x100178da
mov dword [ebp - 0x24], 0x7d8cf4c5
lea ecx, [ebp - 0x334]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x34], 0x310c13fe
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x40], 0x78555145
mov dword [ebp - 0x24], 0x5245f5b1
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x44], 0xccd2466e
push edi
call fcn.10012a45
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x10], ebx
jmp 0x10017805
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x334]
mov dword [eax + ecx*4], 0x3e623b47
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100177f2
cmp dword [ebp - 0x14], ebx
je 0x100178c6
cmp dword [ebp - 0x30], ebx
je 0x1001781f
mov ecx, esi
cmp dword [ebp - 0x44], ebx
jne 0x10017821
mov ecx, ebx
mov eax, dword [ebp - 0x3c4]
mov edx, dword [eax]
imul eax, ecx, 0xfff6
cmp eax, edx
je 0x10017839
test edx, edx
mov edx, ebx
je 0x1001783b
mov edx, esi
mov eax, dword [ebp - 0x64]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x334]
setne cl
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x4c]
sete dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setle cl
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x334]
mov edx, dword [eax]
mov eax, dword [ebp - 0x18]
cmp eax, 0x60ec253d
setge cl
add ecx, edx
cmp ecx, edx
jg 0x10017889
mov edx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x1001788b
mov edx, esi
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x44]
cmp ecx, 5
je 0x100178a1
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x3c4]
cmp dword [eax], ecx
setne dl
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
dec dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x334]
mov dword [ebp - 0x18], eax
call fcn.10012ac7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 9
jle 0x100177a7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c4]
call fcn.10012ac7
push 3
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x468]
pop eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], 0x3dce9d05
mov dword [ebp - 0x1c], eax
push eax
call fcn.10012a45
push 3
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x1001792d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x468]
mov dword [eax + ecx*4], 0x8039d6b9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1001791a
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, esi
setl al
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x14], eax
jl 0x10017992
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x100179de
push ebx
push ebx
push 0x1503
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x100179de
mov dword [ebp - 0x10], ebx
jmp 0x100179d9
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], ebx
jl 0x100179d6
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x468]
cmp dword [eax + ecx*4], ebx
mov byte [ebp - 0x1d], bl
je 0x100179c4
cmp byte [ebp - 0x1d], 0
je 0x100179d1
push 0x10c8
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x100179d1
cmp byte [ebp - 0x1d], 0
je 0x100179d1
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [ebp - 0x14]
jns 0x1001799f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x10017997
lea ecx, [ebp - 0x468]
call fcn.10012ac7
push 4
pop eax
mov dword [ebp - 0x24], 0x94643cdf
lea ecx, [ebp - 0x364]
push eax
call fcn.10012a45
push 4
pop eax
push eax
lea ecx, [ebp - 0x5b8]
mov dword [ebp - 4], esi
call fcn.10012a45
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x44], 0xffffffff
push 4
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x28], ebx
pop edx
jmp 0x10017a3a
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x364]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x10017a2a
mov dword [ebp - 0x28], ebx
jmp 0x10017a53
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x5b8]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x10017a44
mov dword [ebp - 0x28], ebx
jmp 0x10017a6e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x6e0], 0xd6b9c2d6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10017a5d
mov edx, dword [ebp - 0x5b8]
push 3
pop eax
mov dword [edx + 8], eax
mov dword [ebp - 0x4c], 0x7f13
mov dword [ebp - 0x14], ebx
jmp 0x10017a9c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2f4], 0x1ea66e58
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10017a8b
mov ecx, dword [edx + 8]
mov eax, dword [ebp - 0x364]
mov dword [eax + ecx*4], esi
xor ecx, ecx
mov eax, dword [edx + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, esi
setge cl
mov dword [ebp - 0x2f4], ecx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x364]
mov eax, dword [eax]
dec dword [ebp - 0x44]
cmp eax, ecx
mov eax, esi
cmove eax, ebx
mov dword [ebp - 0x6e0], eax
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
inc eax
dec dword [edx + 8]
mov dword [ebp - 0x4c], eax
jns 0x10017a7f
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10017b4a
push 0x392
push 0x1511
push 0x97a
push ebx
push 0x1c8b
push 0xc3a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x145d
push 0x1b29
push 0xd34
push 0x820
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
lea ecx, [ebp - 0x5b8]
call fcn.10012ac7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x364]
call fcn.10012ac7
push 4
pop eax
mov dword [ebp - 0x24], eax
mov ecx, 0x7e17f759
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0x94643cdf
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0x8ce3e63e
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x24], 0x12d2c87
push esi
call fcn.10012a45
xor edx, edx
mov dword [ebp - 0x28], ebx
inc edx
jmp 0x10017bcc
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x734], 0xadf1adb2
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x10017bbb
mov dword [ebp - 0x28], ebx
jmp 0x10017be7
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x744], 0xfffffff7
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x10017bd6
mov dword [ebp - 0x28], ebx
jmp 0x10017c04
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x480]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x10017bf1
mov eax, dword [ebp - 0x480]
lea ecx, [ebp - 0x480]
dec dword [eax]
call fcn.10012ac7
push 7
pop esi
xor edi, edi
lea ecx, [ebp - 0x540]
push 4
inc edi
pop eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x10], 0xe1757117
mov dword [ebp - 0x24], esi
push eax
call fcn.10012a45
push 4
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x10017c59
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x540]
mov dword [eax + ecx*4], 0x923e64f1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10017c46
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], edx
jge 0x10017c9d
push 3
pop ecx
mov dword [ebp - 0x14], ebx
jmp 0x10017c7f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x958], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10017c6e
cmp dword [ebp - 0x958], ebx
jne 0x10017c9d
mov eax, dword [ebp - 0x540]
inc dword [eax + 4]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10017c69
lea ecx, [ebp - 0x540]
call fcn.10012ac7
movdqa xmm0, xmmword [0x1000c700]
lea ecx, [ebp - 0x87c]
push ecx
lea eax, [ebp - 0x86c]
mov dword [ebp - 0x24], 0x8ce3e63e
push eax
mov dword [ebp - 0x24], 0xfffffffc
push ecx
mov dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x6a8]
mov dword [ebp - 0x10], esi
movdqu xmmword [ebp - 0x87c], xmm0
call fcn.10012aa1
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
push 2
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x18], ebx
pop esi
jmp 0x10017d0f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe8], 0x7d8a8701
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10017cfe
dec dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x14]
sub edx, eax
mov eax, dword [ebp - 0x14]
cmp edx, eax
mov eax, dword [ebp - 0xe8]
setl cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
push 4
setle bl
xor edx, edx
sub ebx, eax
mov eax, dword [ebp - 0xe4]
sub ebx, 0x687256ed
cmp ebx, eax
mov eax, dword [ebp - 0xe8]
setne dl
xor ecx, ecx
cmp edx, eax
pop edx
setg cl
xor eax, eax
cmp ecx, edx
mov ecx, dword [ebp - 0xe4]
setl al
imul ecx, eax
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
mov dword [ebp - 0xe4], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x14]
je 0x10017db1
mov ecx, edi
cmp dword [ebp - 0x14], ebx
jne 0x10017db3
mov ecx, ebx
mov eax, dword [ebp - 0x14]
add eax, ecx
cmp eax, 5
sbb ecx, ecx
inc ecx
add ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x6a8]
mov dword [eax + 0xc], ecx
lea ecx, [ebp - 0x6a8]
call fcn.10012ac7
mov dword [ebp - 0x24], ebx
mov eax, 0xe56f9b2c
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x5f8], eax
mov dword [ebp - 0x5f4], eax
mov dword [ebp - 0x5f0], eax
mov dword [ebp - 0x5ec], eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], esi
jge 0x10017e31
push 3
pop esi
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x638], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10017e1b
push 2
pop esi
mov dword [ebp - 0x10], ebx
jmp 0x10017e47
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa0c], 0x2603
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10017e36
mov eax, dword [ebp - 0x5f8]
xor ecx, ecx
cmp eax, 0x99fb
setne cl
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], 6
jmp 0x10017f01
push 0xfffffffffffffff8
mov dword [ebp - 0x24], 0x3e93
lea ecx, [ebp - 0x854]
pop eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x24], eax
push 4
mov dword [ebp - 0x24], 0x426a760
pop eax
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0xb611fb8e
push eax
call fcn.10012a45
mov dword [ebp - 0x24], edi
push 4
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x10017eca
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x854]
mov dword [eax + ecx*4], 0xaa232401
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10017eb7
push 3
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x10017ee8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xaa8], 0x7da19ae8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10017ed7
mov dword [ebp - 0x638], edi
lea ecx, [ebp - 0x854]
call fcn.10012ac7
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff3
jge 0x10017e6b
mov dword [ebp - 0x24], 0xfffffff9
lea ecx, [ebp - 0x17c]
mov dword [ebp - 0x24], 0x12d2c87
mov dword [ebp - 0x14], 0xad313dd3
push esi
call fcn.10012a45
push esi
lea ecx, [ebp - 0x5ac]
mov dword [ebp - 4], esi
call fcn.10012a45
push 3
pop eax
mov byte [ebp - 4], al
mov dword [ebp - 0x34], 0xffff
mov dword [ebp - 0x10], ebx
jmp 0x10017f5c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x17c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10017f4d
mov dword [ebp - 0x10], ebx
jmp 0x10017f79
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5ac]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10017f66
mov dword [ebp - 0x14], 0xffffffe4
jmp 0x100182ad
mov dword [ebp - 0x28], edi
lea ecx, [ebp - 0x498]
push esi
call fcn.10012a45
push 4
pop eax
push 3
mov byte [ebp - 4], al
lea ecx, [ebp - 0x3ac]
pop eax
push eax
call fcn.10012a45
mov dword [ebp - 0x10], ebx
jmp 0x10017fc6
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x498]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10017fb3
push 3
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x10017fe3
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3ac]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10017fd3
mov dword [ebp - 0x28], ebx
jmp 0x10018270
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x4c], edx
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10018025
push ebx
push 0x143d
push 0x52e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
push 3
pop edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x17c]
cmp dword [eax + ecx*4], ebx
je 0x1001810b
mov dword [ebp - 0x44], 0x6092f644
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x30], 0x6c382506
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x30]
cmp dword [ecx + edx*4], eax
jle 0x10018060
mov edx, ebx
cmp dword [ebp - 0x14], ebx
je 0x10018062
mov edx, edi
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x17c]
push 2
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
sub edx, eax
mov ecx, dword [ebp - 0x28]
xor eax, eax
mov edi, dword [ebp - 0x498]
cmp edx, 0x3b8c
setne al
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x17c]
setg dl
xor ecx, ecx
cmp edx, dword [eax + 4]
setge cl
xor edx, edx
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x17c]
cmp dword [eax + ecx*4], ebx
sete dl
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x44]
mov esi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3ac]
neg edx
sbb edx, edx
add edx, 0xd9f98444
mov dword [eax], ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc ecx
xor eax, eax
inc edx
cmp dword [edi + 4], ecx
sete al
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x17c]
setge cl
imul ecx, dword [eax + esi*4]
pop esi
mov dword [edi + 4], ecx
xor edi, edi
inc edi
jmp 0x1001826a
mov dword [ebp - 0x4c], 0x1af2
cmp dword [ebp - 0x4c], 0x132e
jge 0x100181df
lea eax, [ebp - 0xfc]
mov dword [ebp - 0xfc], ebx
push eax
push 0x1000bf0c
call fcn.10053beb
lea eax, [ebp - 0xac]
mov dword [ebp - 0xac], ebx
push eax
push 0x1000bf0c
call fcn.10053beb
add esp, 0x10
mov esi, ebx
cmp dword [ebp - 0xac], 0
jle 0x1001816f
push 0x1000bf10
call fcn.10053e1f
inc esi
pop ecx
cmp esi, dword [ebp - 0xac]
jl 0x1001815b
push 0x1000bf14
call fcn.10053e1f
mov esi, edi
pop ecx
cmp dword [ebp - 0xfc], edi
jle 0x100181dc
lea eax, [ebp - 0xac]
push eax
push 0x1000bf0c
call fcn.10053beb
cmp dword [ebp - 0xac], 0
mov edi, ebx
pop ecx
pop ecx
jle 0x100181b6
push 0x1000bf18
call fcn.10053e1f
inc edi
pop ecx
cmp edi, dword [ebp - 0xac]
jl 0x100181a2
mov ecx, dword [ebp - 0xfc]
lea eax, [ecx - 1]
cmp esi, eax
jge 0x100181d4
push 0x1000bf14
call fcn.10053e1f
pop ecx
mov ecx, dword [ebp - 0xfc]
inc esi
cmp esi, ecx
jl 0x10018184
xor edi, edi
inc edi
push 2
pop esi
mov dword [ebp - 0x30], 0x86397847
mov dword [ebp - 0x10], ebx
jmp 0x100181fc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1c0], 0x70a6219f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100181eb
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], ebx
jl 0x1001826a
mov eax, dword [ebp - 0x28]
xor ebx, ebx
inc dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], 0xa301
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c0]
mov ecx, dword [ebp - 0x17c]
cmp dword [ecx + edx*4], eax
mov eax, dword [ebp - 0x5ac]
mov ecx, dword [ebp - 0x28]
setge bl
xor edx, edx
mov dword [eax], ebx
mov eax, dword [ebp - 0x3ac]
cmp ebx, dword [eax + ecx*4 + 4]
mov eax, dword [ebp - 0x1c0]
sete dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x4c], ecx
dec dword [ebp - 0x10]
jns 0x10018209
xor ebx, ebx
inc dword [ebp - 0x28]
push 3
pop edx
cmp dword [ebp - 0x28], edi
jle 0x10017ff0
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1001828e
push 0x18ad
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x3ac]
call fcn.10012ac7
push 3
pop eax
lea ecx, [ebp - 0x498]
mov byte [ebp - 4], al
call fcn.10012ac7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffa
je 0x10017f8a
lea ecx, [ebp - 0x5ac]
call fcn.10012ac7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x17c]
call fcn.10012ac7
mov dword [ebp - 0x10], 0xa631
mov dword [ebp - 0x18], 0x90611bc3
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x44], 0xdb62b2fa
cmp dword [ebp - 0x10], ebx
je 0x100183d6
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x44], 0xfffffffa
push 3
mov dword [ebp - 0x4c], 0x8ed0bd2f
mov dword [ebp - 0x18], ebx
pop ecx
jmp 0x1001831c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6c0], 0xc3f30b9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1001830b
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x14]
jne 0x10018330
mov edx, ebx
cmp dword [ebp - 0x10], ebx
je 0x10018332
mov edx, edi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, 0x3ef6885f
setge cl
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x44]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x44]
setge dl
xor ecx, ecx
cmp edx, eax
mov edx, 0xe07e
setle cl
sub edx, ecx
xor ecx, ecx
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setge cl
mov dword [ebp - 0x6c0], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jle 0x1001838c
mov eax, ebx
cmp dword [ebp - 0x18], ebx
je 0x1001838e
mov eax, edi
mov dword [ebp - 0x30], eax
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setg dl
xor eax, eax
imul edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x14]
cmp edx, 0xffffffff
setge al
cmp eax, dword [ebp - 0x14]
jge 0x100183bc
mov ecx, edi
cmp dword [ebp - 0x6c0], ebx
jne 0x100183be
mov ecx, ebx
mov eax, dword [ebp - 0x4c]
add eax, ecx
xor ecx, ecx
cmp eax, 0x37f4
setle cl
imul ecx, dword [ebp - 0x10]
mov dword [ebp - 0x44], ecx
jmp 0x10018430
mov dword [ebp - 0x10], 0x27649690
mov dword [ebp - 0x14], ebx
jmp 0x100183f3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x420], 0x885a1ec8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100183e2
cmp dword [ebp - 0x10], ebx
je 0x1001841d
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x41c], eax
je 0x10018417
mov eax, dword [ebp - 0x41c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov eax, dword [ebp - 0x44]
cmp eax, 0xffffffff
setne cl
neg ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10018459
push 0x28c
push ebx
push ebx
push ebx
push ebx
push 0xa78
push 0xed9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
push edi
lea ecx, [ebp - 0x4c8]
call fcn.10012a45
mov dword [ebp - 4], 5
xor ecx, ecx
mov dword [ebp - 0x40], ebx
inc ecx
mov dword [ebp - 0x10], ebx
jmp 0x10018485
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6c], 0x5b9b55bb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10018477
push 3
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x1001849f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9b8], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10018492
mov dword [ebp - 0x6c], 0xffffffe7
cmp dword [ebp - 0x6c], ecx
jge 0x100185b6
mov dword [ebp - 0x10], 0xf7a73d2d
mov edx, 0xee72c34c
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0xfffffffc
mov eax, dword [ebp - 0x6c]
sub edx, eax
mov ecx, dword [ebp - 0x10]
neg edx
mov eax, dword [ebp - 0x10]
sbb edx, edx
neg edx
add ecx, edx
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x30], 0x8ef3
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x40], ebx
jne 0x1001852c
cmp dword [ebp - 0x6c], ebx
jne 0x1001852c
mov edx, ebx
jmp 0x10018531
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
push 0
sete cl
xor ebx, ebx
cmp ecx, 0x1536c745
setg bl
xor edx, edx
neg ebx
cmp ebx, eax
mov eax, dword [ebp - 0x6c]
pop ebx
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x9b0]
sub ecx, 0xecc2
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x6c]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x6c]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x40], ecx
xor ecx, ecx
inc dword [ebp - 0x6c]
inc ecx
cmp dword [ebp - 0x6c], ecx
jl 0x100184b4
push 3
pop edx
mov dword [ebp - 0x28], ebx
jmp 0x100185cc
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x754], 0xadf1adb2
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x100185bb
push 0xfffffffffffffff7
pop edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x34], 0xb35d5697
mov dword [ebp - 0x30], esi
push 4
mov dword [ebp - 0x4c], 5
pop eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], edx
jge 0x1001860f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9a0], 0x6411d7fe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100185f6
push 4
pop eax
cmp dword [ebp - 0x14], ebx
jle 0x10018688
mov dword [ebp - 0x1c], 0xb1b055cc
xor edx, edx
mov dword [ebp - 0x30], 0x9f23e525
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setl cl
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
test eax, eax
setns cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x9a0], eax
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1001880b
push 0x1d1c
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
jmp 0x1001880b
push ecx
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x558]
call fcn.10012a45
xor edx, edx
mov byte [ebp - 4], 6
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x100186b3
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x558]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100186a3
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x4c]
cmp eax, edx
jae 0x100187f4
mov dword [ebp - 0x4c], 0x241a
cmp dword [ebp - 0x4c], 0xf86
jge 0x100187a2
mov eax, dword [ebp - 0x558]
mov dword [eax], 0x5674643a
lea ecx, [ebp - 0x558]
call fcn.10012ac7
inc dword [ebp - 0x40]
xor edx, edx
mov dword [ebp - 0x28], ebx
inc edx
jmp 0x10018823