Function at 0x100102b0
Capabilities:
Manipulate console buffer
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov byte [ebp - 9], 0
push 0x1ff
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
lea ecx, [ebp - 0x74]
push ecx
call fcn.10014f20
add esp, 0xc
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
call fcn.100155b0
add esp, 8
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 4
mov dword [ebp - 0x48], 0x3000
mov dword [ebp - 0x4c], 0x100
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x38]
push edx
push 0x11a
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push eax
lea ecx, [ebp - 0x7c]
push ecx
call fcn.10014f20
add esp, 0xc
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
call fcn.10015690
add esp, 0x1c
mov dword [0x100c9ec8], eax
cmp dword [0x10072ae4], 0x4564acd0
jne 0x100104cb
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCompact]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x58], edx
push 0
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push 0
call dword [sym.imp.USER32.dll_OemKeyScan]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolTimerEx]
call dword [sym.imp.USER32.dll_WaitMessage]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateTapePartition]
push 0
call dword [sym.imp.KERNEL32.dll_LocalSize]
push 0
call dword [sym.imp.USER32.dll_IsWindow]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_HiliteMenuItem]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateWindowStationW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetAltTabInfoW]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfoEx]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetWaitableTimerEx]
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
push 0
push 0
call dword [sym.imp.USER32.dll_UpdateLayeredWindowIndirect]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 4
push 0x3000
push 0x100
push 0
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x100c9d34], eax
mov byte [0x100c7d95], 1
mov eax, 4
imul ecx, eax, 0xc7
mov dword [ecx + 0x100c7da8], 0xee0
push 0x1f5
push 0x10008c00
lea edx, [ebp - 0x84]
push edx
call fcn.10014f20
add esp, 0xc
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.10015020
add esp, 8
mov dword [ebp - 4], 0x17b3
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0xaeb
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10f6
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0x22dd
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x1fd6
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
and eax, 0x80000001
jns 0x100105a4
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x100105b4
mov ecx, dword [ebp - 4]
add ecx, 0xdfa
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x168d
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x141a
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0x25d2
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x1053
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x1b25
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x152e
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0x3f1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x1564
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x1f6a
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x21a4
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0xe3
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0x22d
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
and edx, 0x80000003
jns 0x100106a1
dec edx
or edx, 0xfffffffc
inc edx
test edx, edx
je 0x100106b0
mov eax, dword [ebp - 8]
add eax, 0x2131
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x1120
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0x80000001
jns 0x100106de
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x100106ed
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x100106ce
mov eax, dword [ebp - 4]
add eax, 0x34
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0x80000001
jns 0x10010706
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x1001071e
cmp dword [ebp - 4], 0
jle 0x1001071e
mov edx, dword [ebp - 4]
add edx, 0x1798
mov dword [ebp - 4], edx
jmp 0x10010729
mov eax, dword [ebp - 4]
sub eax, 0x1798
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x2629
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x9f1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
and eax, 0x80000001
jns 0x10010750
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x1001075f
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x10010741
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x1dcc
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x80000001
jns 0x1001078c
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x1001079b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x1001077c
mov ecx, dword [ebp - 4]
sub ecx, 0x71
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x53c
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x1a28
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x18a6
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0xd21
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x9c4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x2046
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x266c
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x234a
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x21b0
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x2480
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x1f25
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x898
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x10c7
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x109a
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x33f
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0xef2
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x8fe
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x1a80
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0x55f
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10010935
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x1001091b
mov eax, dword [ebp - 4]
add eax, 0x231c
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x130
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x2144
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x1e73
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x19f5
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x1392
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0xd94
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0xabd
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0xf5
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
and ecx, 0x80000001
jns 0x10010a3d
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x10010a4c
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x10010a2d
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 0
jmp 0x10010a67
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], 0x43
jge 0x10010a78
mov edx, dword [ebp - 4]
add edx, 2
mov dword [ebp - 4], edx
jmp 0x10010a5e
mov eax, dword [ebp - 4]
add eax, 0x2004
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10010a9d
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x10010a83
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x64a
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x2ab
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0xe18
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x949
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x14cb
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x14e1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x774
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0xbf5
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0xcbd
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10010b8e
mov edx, dword [ebp - 4]
add edx, 0x12f
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0x12ed
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x10ea
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0xb3a
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10010be6
mov edx, dword [ebp - 8]
sub edx, 0x193
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0x650
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x184f
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x1cd3
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10010c3e
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x10010c24
mov eax, dword [ebp - 4]
sub eax, 0xf42
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x7f5
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, 4
imul ecx, eax, 0xe9
mov edx, dword [0x100c9ec8]
mov dword [edx + ecx], str.1G2YnVmdyBp2kct1igTvg3HwUTmW1CfRa33hxjsVoQtThNiR0srCP9oCRV22H04u0pbX_61C4SZrBK200zY572hFZM77utOZEVrFqErXy8uNpzgDLaJnr3UHef1LnNbca46BGsH5md1iPuUknJDEYQm1gQPhPOsWnPWSwQSzxXDakuULg2v6dYGUBV3i_scltOAwz7KaFIEwdCElnevNPhmh_YA6GsbN4nysf79Sgc4qiOFnhRKSuQeeZocXjElUdvxYIxCqb5yTiaDvdF0Y11TOvUlgmODYCY8O43NsfCyEOyRd1yte3b4O0ynXBvcMl0hOVNaX7wwo_NQ27yX3asVpOteR8si7aFGxk3DGbgO1ju4eKB41iKfujvpOcpuXrhFICUu_zbH3NbvbW8ByxNgGd2SQztLV6A5TtGdVG_Jt9Jr5tzmbPjH4sUhRBUvADOT1VrLDByH2XhP1VnfFSezEZBKpVvjjOC2SddB1HaAUo59Tyea_G6kS4AmEbiFPnUzKKmRST87wsCVQVMO5KJGk_qCBumtVOqftq0MNr5vnbf7rPAwDDtVPWPCm2mfCOHcLIoB3VDz_NXlfNhRZsbeZHnuH0fuAW3fqcpmPO64K4R8UgJ0wBDw1K8vo7sHESto9jEnt7xP0hZgZz1DD1neIkrVRulk7OFWn3ftFN7dhRB8LgAa4ICEdvdqrrzDudmZUi7MvFZcWZaLek6xIf95hYMg5QbaNIYLsv7qQDRwmqf8QjxRoPzf1OHCnTIVL1hagytHht6Q6AmGMzBBuN2V0d9Zu35_NO5f77_IX8oVnH7PgWBOpoS0kqheHwESgdz0zHdzVIeMDdDpqgVzohxnaK25VLh0tn8nrtYreBf8cdc48tz0Gcsla3VZ6yOMk6pZHoM5T7WmEg7zL44VnBHTrF4wBOQmQrqkAenUqRbSzz5wTWIL3HLzAaZqbjt2BJADAKMPxHkMLEHW7ZI4z3BTyxsmc_CZOW7eW6CKt56oYts6UcXWAd_hETl0ZDQwZTONyLTycVyWAxxcl8f8TpATm58iD7A9OmA6JQS3ZGIM2PytoezT4o8NVW76B5SdMCJTUzE5R9RFevuaMNUT8uWi109SgarPrfkG7Vo45swg0ZGcUhUKuIbmwdUJnCvPPl2ZhHuc7cj3bm8Qk0tcj_XGBO0DtBlyDMqSme4xSyO_e7J303LMHDZ9FuhNIiMxYyhkLu6KDawW0q_I3yKTlr3QxmPkBXTx3phR_B17NHdGtIoLDgTjyAb2WTL6bjNM0rzZohMZUqGmE2NxyGx6bvVpEhGzO70ysJrwlUj1iZjsRu2DzW6nyFFQzUPw3DMaYt0cLletmMGEiE2aGXgbUMpbGApfKenk1EvADfnI4BbH0QGcwWR0OQzvYLS8A_3H7AnEfxgFDimBVOV8mD9YuGQ2SUEBoZhrJGjhwsMyKAM_bm8l8goEmbcl1b708BZsccCG7n3mJdzNEw44U57LP2kDjmk6cF7kczSvmfJtAzdx8wmZNT8eEPgsdPc8LlrwoZ7jkrVSQPTvWpL1f0oA0QNqi8ja9W1fKLIceK6s5QiueBpVGS2lWgwj1xkTlNb2O7uxS7Dy9mBM1yUyHnZ7hVqXjRUl5N79k6MQyWjCqlfkJQza_Qfjjvsh6nv4Cs0Zrm5iolFIoUFj0pPn32zHiVb6IsdLG8sAce4squY0dXtQy0uiHdRU7riO3lL1qrOEhGJm1DcHWowUbdV5CowZ0Gj20hmJ1baHGnewtJ8gFxUpom1rgZPBuL9_5lHPuwS4LJzkoMwRo2ZoQoF_NRWEmCj6W7RBrrRns76xhpVRS4UZOJGmhjrdcMDTAVlv6Wgb3sUCRpPC5ueKFSz7zFnCSna1AxvGrNFELLsZCQhfpNQPSJrxKH1QZEgTnB8NQksrDBLGLU3NVQfcLh4tg6iqA7mMgoz5VQBU5qfa5Ss6mbNXS8QNH06sBLzwu0LukV8YdVQRm3QwnI48B8k8gLlS0pP1LvraLx4biiMQGyUmcgqsFGOtZKWMc25FCulmq5mOZJm8xHMN4UDmNUsanJvWR2nV3DpoFnkxx0AuZOzeQAtDCVRgsDZrOBbmLOYeIVqeQlH_UGmoeNnncJlaeqfdgv_lXpaHbugjoF4k0rqp6JRY5OUtRnln0M4ROx5eebuOZo8tx3YrKf9vu7Kui7H2Ss7KrVbE9W1jxqsgMBE_UTagNdLfDe3qmdtvlW3mRoUOMoYStXEl7XRhiWY5JtayiZo_Ba_5LFE081qKDefQHM_nvxCMfTo4dXhlDZDGf2ZunT1hERq9Bpxfu2P9pnFigtB9UIC34wjuvUf3PuuRfJuZV9kqpX_0t9vkaa7DKHoqpHGjJOkYTvSFslVSBQowhlLiZvb3GHl315c3JwjZqwAgYdj71z5aTjxliR1jKROoRbbHwBJRKqvW_04DOwwPNh0iVbNVn8mTtw115DPM3gkaW4yfdr7Bpo_sghYIneELoeqGd7zJmF7kZ9JhNLD85C8wMsnukHqhrqsKDMUJkmtu4q2QPnm85breyjjKEXUK32G50028nLNjUgYNURgbfBpZGxmcr9SG20ncfF2XaQlrcbLCQYeWWZhA8Glnj2O_lD9ZWiWhnI3VmJ6zWmB05oaa57SogOXuXJPPyTZCigVTGAdiIbyyLOeAZ_CqUCxZAZeK5vgRMy_uHSvio4bXnS4ZRtokUtFSoVUyphTRtEB3O1Mhwskya3rkuWwThtrkbuDhbaTwQbyoIOWWXk2dK4eGG8oJiZVKq0L7kIcz626lNTIKxATFi925l76yz6Xt5A0yHZ8NTk6xlMwNU8D6dHD0HCCvypJyhtQQh20GGtLaR585ItWWvg9QzC1ai_iM0sGt4oVrN83PKEfvJF3Ld2lUHbrjIY2Uypv33zuNGxkaCVWoY78jASq2fE4tQ4akmMV2c_25E2APbUIGEjRIiyTVZCbO5_QDUsKGzyg_I8ZeRGwbCVvchIr0aN0N6nrWRV9Emq3AVn_VQ_lRBz8TAQaDmn9_z2ZxUnWNBwlYFKeoC7i7CZgLh42bDMdFFfBY_d4CWFnGIoxsbEilJqHHXn8svAg3rCvSlwcY7u_kALZuKwBzdFnebtbTYNThtUYOlKF6gDc6pCCbPROm0GgvYeK8vqLIg6_Z8eSl3EE1dJkzQNCKPa93pvEZP7p2G0tCcYRfhCdFNnafWznd7AJNhSAPFWojJV4UXKK3Vyu6UAzN5TqFfFtaP60oZCTeTRdDK2Fy8AGJvfMk381JuQ0rCMsEBuI0oWvYercFvmY8mGBDjwwMe6oJGPjz0TwzMoMNFBzAxRfRYf15_5a7_O8_88P2dPylT5BZAJ5eX6erTMfw5nqOam_k5jn_giGN6BeW6WIM7bZx5x0AUt_dqM9VZlphrE6I21qqzobKcHJIj_yDuJpeljeEsqnUqOgrvoKATHCZObL4rENEMLKqqUSoZ9xwYP302EC3vm20eKTGAVa4kRhss79v_6MwO_y4o8JeyrMWPJCfXmg3Lfpcla3VNDEodLsjNFEVit75TxDxARlgINRVHbPgiYTGB2qjn9QMEDzhcREnMFgNrTHgbnd1GbdHu4qp5LThZ8dypj1joLEFoIYqB3DWHauguWtNcq1jKjKAFeS31dWT1zstOPLZgStdCNsfPIaRLR3slWNrEfl4wZVJE0kLaKT8FI9EqysnmuPMYiwoP1j10yvG13tXGg9WpqYYpaVycy4jj6wkUg7qclRbivzS6fMcvgBmCmBoIUOq5uaHvBPrK3mR5Q_ZbfgYNOWUEb7ZQ4BePNjE73Tj85tVYD5ap2_gLk7XR30JWs88VUZeWCJ6e_8yRwTT4O3G9snqAVsnsIUNzu5ogoDWAs9DSDtUkW03l5deY2IR31oNF60F2DmwDWYiZl0G9blJPKDCedqqdYWlf5uGeycwXHjyBEEHRGGuIBWDBVeIz7GkQ7AzsHdXlOVAfs75oWEkRrHrUkhZ7Ujy7swdFJaZUharRTCXopwmqVSEHs9
push 0x1a9
push 0x1000be20
lea eax, [ebp - 0x8c]
push eax
call fcn.10014f20
add esp, 0xc
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.10015020
add esp, 8
mov dword [ebp - 0x10], 0x2420
mov dword [ebp - 0x24], 0x1a17
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x18], 0x22f9
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0x141b
mov ecx, dword [ebp - 0x14]
add ecx, 0x6d1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x20], 0x1fd3
mov dword [ebp - 0x28], 0x2a7
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0x11ed
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10010d39
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x10010d1f
mov dword [ebp - 0x3c], 0x1515
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x18]
sub eax, 0x82d
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x10]
add eax, 0x62b
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x1726
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x1c]
add edx, 0x108a
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x14], 0x3de5
jne 0x10010df0
cmp dword [ebp - 0x24], 0xffffdc32
jne 0x10010df0
cmp dword [ebp - 0x5c], 0
jne 0x10010df0
cmp dword [ebp - 0x10], 0x1036
jne 0x10010df0
cmp dword [ebp - 0x30], 0xfffffd59
jne 0x10010df0
cmp dword [ebp - 0x1c], 0x3383
jne 0x10010df0
cmp dword [ebp - 0x3c], 0x1515
jne 0x10010df0
cmp dword [ebp - 0x34], 0xffffeef4
jne 0x10010df0
cmp dword [ebp - 0x18], 0x1acc
jne 0x10010df0
cmp dword [ebp - 0x28], 0x17bc
jne 0x10010df0
cmp dword [ebp - 0x20], 0xfffffea2
jne 0x10010df0
mov eax, 1
test eax, eax
jne 0x10010df8
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x100c9ec8], 0
je 0x10010e13
cmp dword [0x100c9d34], 0
je 0x10010e13
mov dword [ebp - 0x40], 1
jmp 0x10010e1a
mov dword [ebp - 0x40], 0
mov cl, byte [ebp - 0x40]
mov byte [ebp - 9], cl
mov edx, dword [0x10072ae4]
xor eax, eax
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x64], 0xe147a784
jne 0x10010e7d
cmp dword [ebp - 0x60], 0
jne 0x10010e7d
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolTimer]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesExW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
push 0
call dword [sym.imp.KERNEL32.dll_GetPhysicallyInstalledSystemMemory]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret