Function at 0x10027540
Capabilities:
Check os version
Get system information on windows
Log keystrokes via polling
Modify service
Query or enumerate registry key

Disassembly:
mov eax, 0x1006617e
call fcn.10064c08
sub esp, 0x360
push ebx
xor ebx, ebx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x100]
mov eax, 0xa8b060d2
mov dword [ebp - 0x28], 0xa147b80b
push esi
mov dword [ebp - 0x1f4], eax
push edi
mov dword [ebp - 0x1f0], eax
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x20], 0xffff
push 1
mov dword [ebp - 0xd0], edx
mov dword [ebp - 0x208], ebx
call fcn.100014bd
mov dword [ebp - 0x20], ebx
jmp 0x100275ba
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], 0x88b92280
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x100275a7
cmp dword [ebp - 0x28], ebx
jne 0x100275d6
mov eax, dword [ebp - 0x18]
add eax, eax
mov dword [ebp - 0x1e8], eax
jne 0x100275d6
mov edx, ebx
jmp 0x100275d9
xor edx, edx
inc edx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 0x7c6f
setge al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
sub eax, 7
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x100]
setg dl
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
cmp eax, edx
setge cl
cmp ecx, 0x39b642c
jl 0x1002763e
mov dword [ebp - 0x18], ebx
jmp 0x10027636
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], 0xd004dde9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10027623
jmp 0x10027670
mov dword [ebp - 0x20], 0xffffffff
jmp 0x1002766a
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x10027656
push ebx
call dword [sym.imp.USER32.dll_CreateIconIndirect]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x10027667
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 5
jne 0x10027647
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x100]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x100]
call fcn.10001540
mov dword [ebp - 0x20], 0xc93b4e1a
mov dword [ebp - 0x20], ebx
jmp 0x10027786
push dword [ebp - 0x68]
movdqa xmm0, xmmword [0x10074300]
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x2ac]
mov dword [ebp - 0x118], ebx
push eax
push ebx
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x114], ebx
movdqu xmmword [ebp - 0x2ac], xmm0
mov dword [ebp - 0x110], ebx
call fcn.10001981
push 4
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x100276f1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2e4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100276e4
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x1002771e
push ebx
push 0x238e
push 0x18f1
push ebx
push 0x255a
push 0x605
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 4
pop edx
mov eax, dword [ebp - 0x20]
inc eax
je 0x10027772
mov dword [ebp - 0x18], ebx
jmp 0x10027737
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x40], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10027729
mov dword [ebp - 0x40], ebx
jmp 0x10027755
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x118]
mov dword [eax + ecx*4], 0x3e31551d
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], edx
jl 0x10027742
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x10027778
push ebx
push 0x136e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
jmp 0x10027778
mov dword [ebp - 0x2d8], edx
lea ecx, [ebp - 0x118]
call fcn.10001540
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
je 0x1002769d
push 0x6c
pop eax
push 2
pop esi
mov word [ebp - 0x17e], ax
mov ecx, ebx
mov dword [ebp - 0x80], 0xd04a005
mov eax, 0x8a61928c
mov dword [ebp - 0x7c], 0x3010e02
mov dword [ebp - 0x78], 0x1b003006
mov dword [ebp - 0x74], 0x8dfc7d03
mov word [ebp - 0x70], 0x2503
mov dword [ebp - 0x38], esi
cmp esi, 0xc
jne 0x10027b19
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], ebx
jmp 0x10027803
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2c8], 0x70c3099c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x100277f2
mov dword [ebp - 0x98], ebx
jmp 0x10027851
mov dword [ebp - 0x20], 0xb1658084
mov dword [ebp - 0x20], ebx
jmp 0x1002782e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2c8], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002781d
cmp dword [ebp - 0x98], ebx
je 0x10027846
cmp dword [ebp - 0x20], ebx
je 0x10027846
xor eax, eax
inc eax
jmp 0x10027848
mov eax, ebx
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x98]
cmp dword [ebp - 0x98], 0xffffffe9
jl 0x10027811
mov dword [ebp - 0x20], ebx
jmp 0x1002786c
mov dword [ebp - 0x28], 0x66a92721
inc dword [ebp - 0x28]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1d
jl 0x1002785f
mov dword [ebp - 0x20], 0x3b910207
lea ecx, [ebp - 0x130]
push 4
mov dword [ebp - 0x38], 4
call fcn.100014bd
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x28], 0x32716399
mov dword [ebp - 0x34], 0x1b059873
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x34], 0x4ecb
push 2
call fcn.100014bd
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], ebx
jmp 0x100278d5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x130]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100278c2
push 3
mov dword [ebp - 0x18], ebx
pop edi
jmp 0x100278f0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x154], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100278e3
push 2
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10027910
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x238]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100278fd
cmp dword [ebp - 0x20], ebx
je 0x10027a22
push edi
lea ecx, [ebp - 0x13c]
call fcn.100014bd
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x18], ebx
jmp 0x10027945
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x13c]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10027935
mov dword [ebp - 0x18], ebx
jmp 0x10027960
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2d4], 0x351a9382
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1002794f
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2d4]
sub ecx, 0x6511
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x130]
setg dl
sub edx, 0x11aa84cb
neg edx
sbb edx, edx
neg edx
mov dword [eax], edx
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x13c]
sub edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
sete cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], 0x83af
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x154]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov ecx, dword [ebp - 0x13c]
setge dl
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
imul eax, dword [ecx + 4]
cmp eax, 0xfff6
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x5fe5
setg cl
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10027a12
push 0x135d
push ebx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
lea ecx, [ebp - 0x13c]
call fcn.10001540
jmp 0x10027af4
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x2c], 0xa46e4944
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
jmp 0x10027a4c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x284], 0xfd4076b8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10027a3b
mov eax, dword [ebp - 0x24]
xor edx, edx
mov ecx, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setne dl
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
sub edx, eax
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x130]
setge cl
xor edx, edx
mov eax, dword [eax]
add eax, 0xffffebbb
add eax, ecx
mov ecx, dword [ebp - 0x24]
imul ecx, eax
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x130]
setge cl
xor edx, edx
mov dword [eax], ecx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x154]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setle dl
cmp dword [ebp - 0x150], edx
jle 0x10027aed
mov dword [ebp - 0x30], 0x37d67f3e
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x30], eax
jmp 0x10027af4
mov dword [ebp - 0x2c], 1
lea ecx, [ebp - 0x238]
call fcn.10001540
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x130]
call fcn.10001540
mov ecx, dword [ebp - 0x38]
push 0xe
pop esi
jmp 0x10027c53
movzx edx, byte [ebp + esi - 0x7f]
mov eax, esi
sub eax, ecx
push 4
movzx eax, byte [ebp + eax - 0x82]
movzx ecx, word [ebp + eax*2 - 0x188]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x80]
add ecx, edx
mov word [ebp + eax*2 - 0x188], cx
lea ecx, [ebp - 0xcc]
call fcn.100014bd
mov dword [ebp - 0x18], 0x4a18885c
mov dword [ebp - 0x20], ebx
jmp 0x10027b75
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], 0xb3198a8f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10027b62
push 3
mov dword [ebp - 0x18], ebx
pop edi
cmp dword [ebp - 0x18], edi
jg 0x10027c46
mov dword [ebp - 0x28], 7
xor edx, edx
mov dword [ebp - 0x2c], 0xe28de637
push 2
pop eax
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x200], eax
mov dword [ebp - 0x1fc], eax
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x30], 4
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xcc]
mov eax, dword [ecx + eax*4]
cmp eax, dword [ecx + esi*4]
setne dl
mov dword [ebp - 0x2c], edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xcc]
mov edx, dword [ebp - 0x2c]
sub edx, dword [eax + ecx*4]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x348c
setge al
neg eax
jne 0x10027bfc
cmp dword [ebp - 0x2c], ebx
je 0x10027c1c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xcc]
cmp dword [eax + ecx*4], ebx
je 0x10027c1c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xcc]
cmp dword [eax + ecx*4], ebx
je 0x10027c1c
mov ecx, ebx
jmp 0x10027c1f
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1f8], ecx
mov eax, dword [ebp - 0x28]
imul eax, ecx
add eax, 0xa
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x10027b8a
mov esi, dword [ebp - 0x38]
lea ecx, [ebp - 0xcc]
call fcn.10001540
mov ecx, ebx
add esi, 2
mov eax, 0x8a61928c
mov dword [ebp - 0x38], esi
cmp esi, 0x12
jb 0x100277c9
mov dword [ebp - 0x3c], 0xa23
cmp dword [ebp - 0x3c], 0xdb4
jle 0x10027d0e
mov ecx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ebx
mov esi, ebx
mov dword [ebp - 0x34], ebx
mov edx, esi
mov dword [ebp - 0x38], 0x2956
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edx
mov eax, esi
and eax, ecx
lea ecx, [ebp - 0x32c]
and eax, edx
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10027cb5
mov eax, dword [eax]
push eax
call fcn.1004c2d0
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x32c]
call fcn.1000168f
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
dec edx
dec dword [ebp - 0x38]
mov dword [ebp - 0x28], edx
jne 0x10027c97
mov esi, dword [ebp - 0x34]
inc esi
mov dword [ebp - 0x34], esi
cmp esi, 0x140e
jl 0x10027c88
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x949
jl 0x10027c83
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x275d
jl 0x10027c80
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
mov dword [ebp - 0x24], 0xffffffff
cmp dword [ebp - 0x3c], 0x9e5
jge 0x10027d29
push str.atz_amik_vjkyptsns_asowtno_kdqwi_xenrk_fhrpo_vllgadupv_rsusdsq_brbvwwhs_mlw_recpxvzyw_utkuwntb
call fcn.1004c2d0
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x38], 0x4503
cmp dword [ebp - 0x38], 0x46e1
jle 0x10027dae
mov eax, ebx
mov dword [ebp - 0x2c], ebx
mov esi, ebx
mov dword [ebp - 0x28], ebx
cdq
idiv esi
mov dword [ebp - 0x30], ebx
mov esi, ebx
mov eax, edx
mov dword [ebp - 0x34], eax
mov ecx, esi
sar eax, cl
lea ecx, [ebp - 0x2fc]
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10027d70
mov eax, dword [eax]
push eax
call fcn.1004c2d0
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2fc]
call fcn.1000168f
mov eax, dword [ebp - 0x34]
inc esi
cmp esi, 0x6140
jl 0x10027d54
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x5b50
jl 0x10027d47
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x5a63
jl 0x10027d42
push 4
lea ecx, [ebp - 0x10c]
call fcn.100014bd
cmp dword [ebp - 0x38], 0x434e
jge 0x10027dcf
push str.yevqrf_aaug_vhb_qlvyl_utrphj_zgp_tstmrig_eallpil_clcypl_rqap_cuuakiy_viuw_mvxavswa_yxvave
call fcn.1004c2d0
pop ecx
push 4
pop edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x20], ebx
jmp 0x10027ded
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10c]
mov dword [eax + ecx*4], 0x2b57e8b7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10027dda
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0xc
jne 0x10027f73
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], edi
jg 0x10027f6b
mov dword [ebp - 0xb4], 0x3bf38c08
mov dword [ebp - 0xb0], 0x3bf38c08
mov dword [ebp - 0xac], 0x3bf38c08
mov dword [ebp - 0xa8], 0x3bf38c08
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10c]
mov dword [eax + ecx*4], 0x6a162c9c
mov dword [ebp - 0xac], edi
cmp dword [ebp - 0xac], ebx
jl 0x10027f63
mov dword [ebp - 0x28], 0x3b54
cmp dword [ebp - 0x28], 0x3e43
jle 0x10027eb6
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x23f2
push 0xcd
push 0x17f4
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esi, ebx
mov dword [ebp - 0x30], ebx
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, 0x10081dd8
cdq
push edx
push eax
call fcn.1000c947
inc ebx
cmp ebx, 0x122a
jl 0x10027e8e
inc esi
push 0
pop ebx
cmp esi, 0x68ce
jl 0x10027e8b
mov dword [ebp - 0x18], 0x50b5f0b1
mov byte [ebp - 4], 7
cmp dword [ebp - 0x28], 0x3a6b
jge 0x10027efa
mov edx, str.xtuplnx_btgod_vsd_qeyyn_hdmpmh_qogwksb_tsf_iwtfk_wrfcop_ouu_mmi_xucmuwpgx_vzrkn
mov ecx, 0x10081dd8
call fcn.1000fdbf
jmp 0x10027efa
mov dword [ebp - 4], 4
mov dword [ebp - 0x18], ebx
jmp 0x10027f43
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10c]
cmp dword [eax + ecx*4], ebx
jne 0x10027f1a
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10c]
mov dword [eax + edx*4], ecx
cmp dword [ebp - 0xac], ebx
jne 0x10027f48
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x10027f06
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10027f58
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
dec dword [ebp - 0xac]
jmp 0x10027e50
inc dword [ebp - 0x20]
jmp 0x10027e09
inc dword [ebp - 0x24]
jmp 0x10027df5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10c]
call fcn.10001540
xor eax, eax
lea ecx, [ebp - 0x1c0]
mov word [ebp - 0x17a], ax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x28], 0x716e289a
mov dword [ebp - 0x2c], ebx
push 4
call fcn.100014bd
mov dword [ebp - 0x24], 0xfd89d684
mov dword [ebp - 0x30], 0xf2c67a95
mov dword [ebp - 0x18], ebx
jmp 0x10027fd4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6c], 0xffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10027fc6
mov dword [ebp - 0x18], ebx
jmp 0x10027ff2
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c0]
mov dword [eax + ecx*4], 0xc7a88ff7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10027fdf
mov dword [ebp - 0x18], ebx
xor edx, edx
mov eax, dword [ebp - 0x6c]
cmp eax, 0xd6b5
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x6c]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge cl
add eax, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
add ecx, 2
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
imul ecx, dword [ebp - 0x18]
cmp ecx, 0xfffffff8
setge al
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c0]
setg dl
xor ecx, ecx
cmp edx, 0x9e68
setle cl
xor edx, edx
cmp eax, ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
setne dl
mov dword [ebp - 0x30], edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setle dl
imul eax, edx
xor edx, edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setg dl
cmp edx, dword [ebp - 0x18]
je 0x100280ac
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x6c]
cmp dword [esi + 4], eax
setge cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x1c0]
call fcn.10001540
xor eax, eax
mov dword [ebp - 0x23c], 7
mov word [ebp - 0x250], ax
lea ecx, [ebp - 0x250]
lea eax, [ebp - 0x188]
mov dword [ebp - 0x240], ebx
push eax
call fcn.1000ce6c
push dword [ebp - 0xd0]
mov dword [ebp - 4], 9
lea edi, [ebp - 0x188]
xor eax, eax
lea ecx, [ebp - 0x29c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10001dc3
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x24], ebx
jmp 0x10028137
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x90], 0x6a53d06c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10028126
push 3
mov dword [ebp - 0x8c], 0xffffffec
pop edi
cmp dword [ebp - 0x8c], 0xfffffffb
jg 0x100281a1
mov dword [ebp - 0x24], ebx
jmp 0x10028169
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf4], 0x7b1891f7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10028158
mov dword [ebp - 0xec], ebx
jmp 0x10028190
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1002818a
push 0x334
call dword [sym.imp.USER32.dll_GetKeyState]
dec dword [ebp - 0xec]
cmp dword [ebp - 0xec], 0xfffffff6
jl 0x10028176
inc dword [ebp - 0x8c]
jmp 0x1002814a
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100281b1
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push edi
lea ecx, [ebp - 0x1b4]
call fcn.100014bd
push 2
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 0xb
call fcn.100014bd
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x3c], 0x3112
cmp dword [ebp - 0x3c], 0x32c0
jle 0x100282d2
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xf63
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x34], ebx
mov ecx, ebx
mov dword [ebp - 0x38], 0x73d
mov dword [ebp - 0x2c], ecx
mov esi, ebx
mov eax, ecx
mov dword [ebp - 0x28], 0x7789
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], 0x23ae
cmp dword [ebp - 0x30], 0x1023
jge 0x10028264
push 0x100831dc
push 0x10083294
push str._d__d
call fcn.1004c442
mov eax, dword [0x100831dc]
add esp, 0xc
mov ecx, dword [0x10083294]
cdq
idiv ecx
cmp eax, 2
jne 0x10028254
sub ecx, edx
push ecx
jmp 0x10028255
push ebx
push 0x1006f754
call fcn.1004c2d0
mov eax, dword [ebp - 0x24]
pop ecx
pop ecx
cdq
lea ecx, [ebp - 0x314]
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002827c
mov eax, dword [eax]
push eax
call fcn.1004c2d0
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x314]
call fcn.1000168f
mov eax, dword [ebp - 0x24]
add eax, esi
dec dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
jne 0x10028215
mov ecx, dword [ebp - 0x2c]
inc esi
cmp esi, 0x3425
jl 0x10028209
mov eax, dword [ebp - 0x34]
add ecx, eax
dec dword [ebp - 0x38]
mov dword [ebp - 0x2c], ecx
jne 0x10028207
inc eax
mov dword [ebp - 0x34], eax
cmp eax, 0x441d
jl 0x100281fb
push 1
lea ecx, [ebp - 0x1e4]
call fcn.100014bd
cmp dword [ebp - 0x3c], 0x2dd3
jge 0x100282f3
push str.zpy_zgkymxsu_luxtglehk_bxk_thdfbcicq_wox_jqteimcqa_udk_rtaja_npybpqdhz_vmonmylcy_rswbv_wzaa
call fcn.1004c2d0
pop ecx
push edi
lea ecx, [ebp - 0x27c]
mov dword [ebp - 4], 0xd
call fcn.100014bd
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x28], 0x4f98
cmp dword [ebp - 0x28], 0x513b
jle 0x1002838e
push 0x159c
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
mov ecx, ebx
mov dword [ebp - 0x2c], ebx
mov esi, ebx
mov eax, esi
and eax, ecx
lea ecx, [ebp - 0x344]
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10028358
mov eax, dword [eax]
push eax
call fcn.1004c2d0
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x344]
call fcn.1000168f
mov ecx, dword [ebp - 0x2c]
inc esi
cmp esi, 0x648a
jl 0x1002833c
inc ecx
mov dword [ebp - 0x2c], ecx
cmp ecx, 0x38e9
jl 0x1002833a
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x18], ebx
jmp 0x100283a6
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1b4]
mov dword [eax + ecx*4], 0x399841b3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10028393
cmp dword [ebp - 0x28], 0x4e6e
jge 0x100283bf
push str.hpvoycej_pxysf_gpmikq_rbaxrj_ellkn_quqfuy_rajvlw
call fcn.1004c2d0
pop ecx
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x18], ebx
jmp 0x100283de
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1d8]
mov dword [eax + ecx*4], 0x2fdad5a5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100283cb
mov dword [ebp - 0x18], ebx
jmp 0x100283fc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1e4]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x100283e9
mov dword [ebp - 0x18], ebx
jmp 0x1002841a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x27c]
mov dword [eax + ecx*4], 0x1649bc00
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10028407
mov esi, dword [ebp - 0x1b4]
mov ecx, dword [ebp - 0x1d8]
mov dword [ebp - 0x30], ecx
mov dword [esi + 8], 0xfffffff0
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x38], 0xce96f8f9
mov dword [ebp - 0x24], ebx
jmp 0x10028459
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x270], 0xfffffff8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10028448
mov eax, dword [esi + 4]
xor edx, edx
cmp eax, dword [ecx + 4]
setge dl
xor ecx, ecx
cmp edx, 0x356ec7e4
mov dword [ebp - 0x270], edx
sete cl
xor eax, eax
cmp ecx, 0x2092
setne al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1e4]
sub dword [eax], ecx
inc dword [esi + 8]
cmp dword [esi + 8], 0x1c
mov ecx, dword [ebp - 0x30]
jle 0x10028435
lea ecx, [ebp - 0x27c]
call fcn.10001540
lea ecx, [ebp - 0x1e4]
call fcn.10001540
lea ecx, [ebp - 0x1d8]
call fcn.10001540
lea ecx, [ebp - 0x1b4]
mov byte [ebp - 4], 0xa
call fcn.10001540
mov byte [ebp - 0x64], bl
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x63], 0x8a210471
mov word [ebp - 0x5f], 0x43a0
mov dword [ebp - 0x28], 0xc7c8a6b9
push edi
call fcn.100014bd
mov dword [ebp - 0x2c], 0xfffffff6
xor edx, edx
mov dword [ebp - 0x38], 0xffffffff
inc edx
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x30], 0xe8a28d88
mov dword [ebp - 0x18], ebx
jmp 0x10028527
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x44], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002851d
mov dword [ebp - 0x18], ebx
jmp 0x10028540
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x124]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10028531
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov esi, dword [ebp - 0x124]
xor eax, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], esi
mov ecx, dword [esi + 8]
cmp dword [esi], ecx
mov esi, ecx
setl al
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setle dl
xor ecx, ecx
sub edx, 0xf49d
cmp edx, eax
mov eax, dword [ebp - 0x124]
setle cl
xor edx, edx
sub ecx, esi
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x44]
setl dl
add edx, esi
add eax, edx
jne 0x1002859e
mov eax, dword [ebp - 0x30]
cmp dword [eax + 8], ebx
jne 0x1002859e
mov ecx, ebx
jmp 0x100285a1
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x38]
add eax, ecx
jne 0x100285b0
cmp dword [ebp - 0x44], ebx
jne 0x100285b0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x2c]
cmp eax, ecx
jg 0x100285ca
xor edx, edx
inc edx
jmp 0x100285cc
mov edx, ebx
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x124]
call fcn.10001540
push 0x5c
pop eax
push 2
mov word [ebp - 0x5c], ax
mov ecx, ebx
pop esi
cmp esi, 2
jne 0x100285fc
push 5
pop ecx
push ecx
pop esi
jmp 0x10028623
movzx edx, byte [ebp + esi - 0x63]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x66]
movzx eax, word [ebp + eax*2 - 0x5c]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + esi - 0x64]
mov word [ebp + eax*2 - 0x5c], cx
mov ecx, ebx
add esi, 2
cmp esi, 7
jb 0x100285f0
xor eax, eax
mov dword [ebp - 0x164], 7
mov word [ebp - 0x5a], ax
lea ecx, [ebp - 0x178]
mov word [ebp - 0x178], ax
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x168], ebx
call fcn.1000ce6c
push 4
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 0x13
call fcn.100014bd
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x1a8], ebx
mov dword [ebp - 0x1a4], ebx
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x18], ebx
jmp 0x10028696
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4c], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002868c
mov dword [ebp - 0x18], ebx
jmp 0x100286b4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x148]
mov dword [eax + ecx*4], 0xaa29c146
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100286a1
inc dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ebx
jne 0x100286c8
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x148]
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], 0x45c17473
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x18], 0xffffffec
jmp 0x1002876f
mov dword [ebp - 0x28], 0x1d534a2c
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10028711
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
add ecx, 0x49a354bd
cmp ecx, eax
mov ecx, 0x69ee35c
mov eax, dword [ebp - 0x30]
setge dl
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
push 0
setl dl
neg eax
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x148]
setle cl
sub ecx, 0xcd53
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
pop eax
setne al
imul eax, eax, 0x6446
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffa
jg 0x100286fa
mov dword [ebp - 0x18], ebx
jmp 0x10028783
dec dword [ebp - 0x1a0]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x1002877a
lea ecx, [ebp - 0x148]
call fcn.10001540
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x28], 0x3f66
cmp dword [ebp - 0x28], 0x41e6
jle 0x100287d3
mov esi, ebx
mov dword [ebp - 0x30], ebx
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x10081dd8
cdq
push edx
push eax
call fcn.1000c947
inc ebx
cmp ebx, 0x1493
jl 0x100287ab
inc esi
push 0
pop ebx
cmp esi, 0x3c5c
jl 0x100287a8
mov dword [ebp - 0x20], 0x69fdf99f
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x28], 0x3c97
jge 0x10028817
mov edx, str.ztnhkecn_pfzmkw_cch_qgixzdsk_rncrric_mqnlqmzrc_tzje_ehrcgdddl_wryqv_cdzgwkbcn
mov ecx, 0x10081dd8
call fcn.1000fdbf
jmp 0x10028817
mov dword [ebp - 4], 0x13
lea eax, [ebp - 0x2ac]
push dword [ebp - 0x68]
movdqa xmm0, xmmword [0x10074320]
lea ecx, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x2bc]
mov dword [ebp - 0xc0], ebx
push eax
push ebx
movdqu xmmword [ebp - 0x2bc], xmm0
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
call fcn.10001981
mov dword [ebp - 0x30], 0xfffb
mov dword [ebp - 0x20], 0xfffffff8
jmp 0x1002895f
mov dword [ebp - 0x18], 2
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10028892
push ebx
push 0x252d
push ebx
push 0x2625
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x1002895c
mov dword [ebp - 0x24], ebx
jmp 0x100288b0
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x88], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x100288a3
mov dword [ebp - 0x88], edi
cmp dword [ebp - 0x88], ebx
jl 0x10028953
mov ecx, dword [ebp - 0x88]
mov eax, dword [ebp - 0xc0]
cmp dword [eax + ecx*4], 4
jne 0x10028936
mov dword [ebp - 0x24], ebx
jmp 0x100288f0
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xdc], 0xfffffff6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x100288df
mov dword [ebp - 0xd4], 2
jmp 0x1002892b
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10028911
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10028925
push 0x334
call dword [sym.imp.USER32.dll_GetKeyState]
dec dword [ebp - 0xd4]
cmp dword [ebp - 0xd4], 0xfffffffa
jl 0x10028901
jmp 0x10028947
mov ecx, dword [ebp - 0x88]
mov eax, dword [ebp - 0xc0]
cmp dword [eax + ecx*4], ebx
jne 0x10028953
dec dword [ebp - 0x88]
jns 0x100288c8
dec dword [ebp - 0x18]
jns 0x1002889e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xe
je 0x10028870
lea ecx, [ebp - 0xc0]
call fcn.10001540
push 2
lea ecx, [ebp - 0x220]
call fcn.100014bd
mov dword [ebp - 0x30], 0x909b7928
mov dword [ebp - 0x18], ebx
jmp 0x1002899d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x220]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002898d
mov dword [ebp - 0x18], ebx
jmp 0x100289b9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x198], 0xdf1febae
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100289a8
mov dword [ebp - 0x18c], ebx
jmp 0x100289eb
mov dword [ebp - 0x30], 0x363f
mov dword [ebp - 0x30], 0xe2c0d37a
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100289e5
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc dword [ebp - 0x18c]
cmp dword [ebp - 0x18c], 1
jle 0x100289c7
lea ecx, [ebp - 0x220]
call fcn.10001540
push 0x5f
pop eax
push 2
mov byte [ebp - 0x54], bl
mov ecx, ebx
mov dword [ebp - 0x53], 0x9f7602e0
mov word [ebp - 0x58], ax
pop esi
cmp esi, 2
jne 0x10028a20
mov ecx, edi
mov esi, edi
jmp 0x10028a47
movzx edx, byte [ebp + esi - 0x53]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x56]
movzx eax, word [ebp + eax*2 - 0x58]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + esi - 0x54]
mov word [ebp + eax*2 - 0x58], cx
mov ecx, ebx
add esi, 2
cmp esi, 5
jb 0x10028a15
xor eax, eax
mov dword [ebp - 0x254], 7
mov word [ebp - 0x56], ax
lea ecx, [ebp - 0x268]
mov word [ebp - 0x268], ax
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x258], ebx
call fcn.1000ce6c
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x1cc]
mov dword [ebp - 0x3c], 0x69f4288a
mov dword [ebp - 0x20], 0xb036
mov dword [ebp - 0x18], 0x9d01078
mov dword [ebp - 0x24], 0xffffffff
push 4
call fcn.100014bd
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x30], 0xdf851f08
mov dword [ebp - 0x34], 0x18d1
cmp dword [ebp - 0x34], 0x1a33
jle 0x10028b0e
mov dword [ebp - 0x2c], ebx
mov esi, ebx
mov dword [ebp - 0x38], ebx
mov ebx, esi
mov dword [ebp - 0x28], 0x65cd
mov esi, dword [ebp - 0x2c]
mov eax, esi
mov ecx, 0x10081dd8
and eax, ebx
cdq
push edx
push eax
call fcn.1000c947
dec ebx
dec dword [ebp - 0x28]
jne 0x10028ad7
mov esi, dword [ebp - 0x38]
inc esi
mov dword [ebp - 0x38], esi
cmp esi, 0x3f27
jl 0x10028acb
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
push 0
pop ebx
cmp eax, 0x2050
jl 0x10028ac6
mov dword [ebp - 0x28], 0xbf7a8323
mov byte [ebp - 4], 0x18
cmp dword [ebp - 0x34], 0x166b
jge 0x10028b52
mov edx, str.guhuqfztv_lzapre_qeyty_mstle_prrl_dxdejjjk_zhfol_hfs_zvekfwlth_lrbd_uorubre_ecwkvch
mov ecx, 0x10081dd8
call fcn.1000fdbf
jmp 0x10028b52
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x10028b78
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1cc]
mov dword [eax + ecx*4], 0x4198d72a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10028b65
mov dword [ebp - 0x18], ebx
jmp 0x10028b94
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x94], 0xeb945924
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10028b83
cmp dword [ebp - 0x3c], ebx
je 0x10028bd1
cmp dword [ebp - 0x20], ebx
je 0x10028bd1
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, 1
setg cl
imul eax, ecx, 0x39f5
test eax, eax
je 0x10028bce
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1cc]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x1cc]
setle dl
sub edx, eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 0x16
call fcn.10001540
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x3c], 0x73838a1f
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x34], 0xf93bd5de
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x28], 0x8dacb314
mov dword [ebp - 0x18], 0x727d
cmp dword [ebp - 0x18], 0x74fb
jle 0x10028cc2
mov dword [ebp - 0x2c], ebx
mov esi, ebx
mov ecx, ebx
mov dword [ebp - 0x24], ebx
mov eax, esi
cdq
idiv ecx
lea ecx, [ebp - 0x368]
or edx, dword [ebp - 0x2c]
mov eax, edx
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10028c87
mov eax, dword [eax]
push eax
call fcn.1004c2d0
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x368]
call fcn.1000168f
mov ecx, dword [ebp - 0x24]
inc ecx
mov dword [ebp - 0x24], ecx
cmp ecx, 0x76dc
jl 0x10028c65
inc esi
cmp esi, 0x6498
jl 0x10028c60
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x1e9c
jl 0x10028c5e
mov dword [ebp - 0x30], 0xffffffff
cmp dword [ebp - 0x18], 0x6f3d
jge 0x10028cdd
push str.bolf_gpvhg_unubi_smdb_dazg_seqp_tpip_migrhonz_frotxew
call fcn.1004c2d0
pop ecx
mov dword [ebp - 4], 0x16
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x3c]
jge 0x10028d0e
mov dword [ebp - 0x24], ebx
jmp 0x10028cfe
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x22c], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10028cf1
inc dword [ebp - 0x22c]
jmp 0x10028e6e
push 4
lea ecx, [ebp - 0xe8]
call fcn.100014bd
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x30], 0x7d96711d
mov dword [ebp - 0x30], 0xc0223dec
push 1
call fcn.100014bd
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x18], ebx
jmp 0x10028d56
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe8]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10028d43
mov dword [ebp - 0x18], ebx
jmp 0x10028d74
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x214]
mov dword [eax + ecx*4], 0x60df3928
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10028d61
mov esi, dword [ebp - 0xe8]
cmp dword [esi + 0xc], ebx
je 0x10028e0a
mov dword [ebp - 0x30], 0xfffffffa
lea ecx, [ebp - 0x160]
push edi
call fcn.100014bd
mov dword [ebp - 0x24], ebx
jmp 0x10028db0
cmp dword [ebp - 0x24], edi
jl 0x10028da1
mov dword [ebp - 0x30], 0xe7a
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x24], ebx
jmp 0x10028e2e
cmp dword [ebp - 0x24], edi
jl 0x10028e1d
mov dword [ebp - 0x20], 0xfffffff0
jmp 0x10028f39
mov dword [ebp - 0x24], 9
xor ecx, ecx
mov dword [ebp - 0x2c], 0x6dcb0c7b
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x30], 0x5309f33d
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xe0ea
setl cl
cmp dword [ebp - 0x2c], ecx
jle 0x10028eb8
cmp dword [ebp - 0x38], ebx
je 0x10028eb8
xor ecx, ecx
inc ecx
jmp 0x10028eba
mov ecx, ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 0xb2235412
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
imul ecx, dword [ebp - 0x30]
test ecx, ecx
jne 0x10028ef9
cmp dword [ebp - 0x24], ebx
jne 0x10028ef9
xor edx, edx
inc edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x28]
setge cl
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setg cl
xor edx, edx
cmp ecx, 0x2d1f
setne dl
xor eax, eax
cmp edx, 0xb681
setl al
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff1
jg 0x10028e7a
push dword [ebp - 0x168]
cmp dword [ebp - 0x164], 8
lea eax, [ebp - 0x178]
push ebx
cmovae eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x29c]
push eax
call fcn.10026a3a
cmp eax, 0xffffffff
je 0x10028f89
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x268]
push ecx
push 1
push eax
lea ecx, [ebp - 0x29c]
call fcn.10002362
jmp 0x10028f43
mov ecx, dword [ebp - 0x68]
lea eax, [ebp - 0x29c]
push eax
lea edx, [ebp - 0x250]
call fcn.100291bd
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x268]
call fcn.10001f60
push ebx
push 1
lea ecx, [ebp - 0x178]
call fcn.10001f60
push ebx
push 1
lea ecx, [ebp - 0x29c]
call fcn.10001f60
push ebx
push 1
lea ecx, [ebp - 0x250]
call fcn.10001f60
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret