Function at 0x10016e0a
Capabilities:
Connect pipe
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059167
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x304
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x270], 5
mov dword [ebp - 0x128], 0x3443
mov dword [ebp - 0x1fc], str.rdnqaadp_xjmyf_kxvs_fmz_uya_eynem_htzlcizmr_fcyobzpr_xiwdshid_xhly_fylpg_pjhlzgbh_jgecnbgu
cmp dword [ebp - 0x128], 0x3767
jle 0x10016f21
push 0
push 0x1b89
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
and dword [ebp - 0x70], 0
jmp 0x10016e79
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xa13
jge 0x10016f21
and dword [ebp - 0xa0], 0
jmp 0x10016e9c
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x19fc
jge 0x10016f1c
and dword [ebp - 0x64], 0
jmp 0x10016eb5
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x77e5
jge 0x10016f17
mov eax, dword [ebp - 0x70]
imul eax, dword [ebp - 0xa0]
imul eax, dword [ebp - 0x64]
cdq
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x1c0], edx
push dword [ebp - 0x1c0]
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x2fc]
call fcn.10001a11
pop ecx
pop ecx
mov dword [ebp - 0x204], eax
mov ecx, dword [ebp - 0x204]
call fcn.10001aa8
push eax
call fcn.100400a6
pop ecx
lea ecx, [ebp - 0x2fc]
call fcn.10001a9e
jmp 0x10016eae
jmp 0x10016e8f
jmp 0x10016e72
mov byte [ebp - 0x31], 0
and dword [ebp - 4], 0
cmp dword [ebp - 0x128], 0x317b
jge 0x10016f41
push dword [ebp - 0x1fc]
call fcn.100400a6
pop ecx
jmp 0x10016f5d
or dword [ebp - 4], 0xffffffff
jmp 0x10016f67
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x10016f79
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov byte [ebp - 0x3b], 0
movzx eax, byte [ebp - 0x3b]
test eax, eax
je 0x10016fad
push 0x445
push 0xbe3
push 0x22c8
push 0x232f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
mov dword [ebp - 0x174], 0xceafd94
mov dword [ebp - 0xd0], 0x6f6dd8d1
mov dword [ebp - 0x25c], 1
mov dword [ebp - 0x26c], 0x3d1bca9d
mov dword [ebp - 0x44], 0xffff
mov dword [ebp - 0xc0], 0
jmp 0x10016ff5
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 4
jge 0x10017011
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x29c], 0x7a98815
jmp 0x10016fe8
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
jne 0x100170d1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x29c]
mov dword [ebp - 0x28c], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x29c]
cmp eax, dword [ebp - 0x44]
jle 0x1001704f
mov dword [ebp - 0x14c], 1
jmp 0x10017056
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x14c], eax
jne 0x1001706d
mov dword [ebp - 0x198], 1
jmp 0x10017074
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x198]
jg 0x1001708b
mov dword [ebp - 0xf8], 1
jmp 0x10017092
and dword [ebp - 0xf8], 0
cmp dword [ebp - 0xf8], 0xc4365dea
jbe 0x100170aa
mov dword [ebp - 0x148], 1
jmp 0x100170b1
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x148], eax
jne 0x100170c8
cmp dword [ebp - 0xd0], 0
jne 0x100170d1
and dword [ebp - 0x100], 0
jmp 0x100170db
mov dword [ebp - 0x100], 1
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0xc809
jne 0x10017108
mov eax, 0x80d1
test eax, eax
je 0x10017108
mov dword [ebp - 0x108], 1
jmp 0x1001710f
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xd0], eax
push 3
lea ecx, [ebp - 0x1a4]
call fcn.10001bdd
mov dword [ebp - 4], 2
mov dword [ebp - 0x50], 0xd45db34e
mov dword [ebp - 0x20], 0
jmp 0x10017146
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1001715c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2a8], 0xffffffff
jmp 0x1001713f
mov dword [ebp - 0x20], 0
jmp 0x1001716c
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10017185
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1a4]
call fcn.10001c56
and dword [eax], 0
jmp 0x10017165
push 0
lea ecx, [ebp - 0x1a4]
call fcn.10001c56
and dword [eax], 0
jmp 0x100171bb
push 0
lea ecx, [ebp - 0x1a4]
call fcn.10001c56
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x154]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1a4]
call fcn.10001c56
cmp dword [eax], 2
jg 0x100171fb
mov byte [ebp - 0x39], 0
movzx eax, byte [ebp - 0x39]
test eax, eax
je 0x100171f9
push 0
push 0x149f
push 0xad2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
jmp 0x10017197
mov dword [ebp - 0x50], 0
jmp 0x1001720b
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xfffffffb
jne 0x100172aa
mov dword [ebp - 0x110], 0xb7d8cf4c
mov dword [ebp - 0x58], 0
jmp 0x1001722f
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 4
jge 0x10017245
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x254], 8
jmp 0x10017228
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x254], 0
jmp 0x10017273
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x254]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x254], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x254], 0xffffffe8
jge 0x100172a5
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x110], eax
mov esi, dword [ebp - 0x110]
neg esi
push 0
lea ecx, [ebp - 0x1a4]
call fcn.10001c56
mov dword [eax], esi
jmp 0x10017258
jmp 0x10017204
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a4]
call fcn.10001c3a
mov dword [ebp - 0x194], 0x3a8e
mov dword [ebp - 0x1b4], str.zsias_ebvsf_femmfp_dznfnlgcs
cmp dword [ebp - 0x194], 0x3d01
jle 0x10017399
and dword [ebp - 0x6c], 0
jmp 0x100172ea
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xf13
jge 0x10017391
and dword [ebp - 0xa8], 0
jmp 0x1001730d
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x5d7d
jge 0x1001738c
and dword [ebp - 0x78], 0
jmp 0x10017326
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x5a64
jge 0x10017387
mov eax, dword [ebp - 0x6c]
imul eax, dword [ebp - 0xa8]
sub eax, dword [ebp - 0x78]
cdq
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1cc], edx
push dword [ebp - 0x1cc]
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0x2c0]
call fcn.10001a11
pop ecx
pop ecx
mov dword [ebp - 0x1a8], eax
mov ecx, dword [ebp - 0x1a8]
call fcn.10001aa8
push eax
call fcn.100400a6
pop ecx
lea ecx, [ebp - 0x2c0]
call fcn.10001a9e
jmp 0x1001731f
jmp 0x10017300
jmp 0x100172e3
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
push 1
lea ecx, [ebp - 0x27c]
call fcn.10001bdd
mov dword [ebp - 4], 3
mov dword [ebp - 0x80], 0x4c506d44
mov dword [ebp - 0xcc], 0
jmp 0x100173cd
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jge 0x100173ef
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x27c]
call fcn.10001c56
mov dword [eax], 0x5b57fd54
jmp 0x100173c0
mov dword [ebp - 0x80], 0
jmp 0x100173ff
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x1001741b
mov dword [ebp - 0x1b8], 0x29949dfc
mov dword [ebp - 0x1b8], 1
jmp 0x100173f8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x27c]
call fcn.10001c3a
mov dword [ebp - 4], 4
cmp dword [ebp - 0x194], 0x37cf
jge 0x10017449
push dword [ebp - 0x1b4]
call fcn.100400a6
pop ecx
jmp 0x10017465
or dword [ebp - 4], 0xffffffff
jmp 0x1001746f
movzx eax, byte [0x10073c04]
test eax, eax
je 0x1001748d
mov esi, 0x10071fc4
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x10018344
mov dword [ebp - 0x268], 0x10071fc4
mov dword [ebp - 0xb0], 0xffffffff
mov dword [ebp - 0xb0], 0xd
jmp 0x100174ba
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x1b
jl 0x100176ff
mov dword [ebp - 0x4c], 0xfffffff8
mov dword [ebp - 0x88], 0
jmp 0x100174e7
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x10017503
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x2cc], 0x88ad
jmp 0x100174da
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 0
jmp 0x1001751a
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jg 0x100176fa
push 4
lea ecx, [ebp - 0x21c]
call fcn.10001bdd
mov dword [ebp - 4], 6
mov dword [ebp - 0xc8], 0
jmp 0x10017551
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 4
jge 0x10017573
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x21c]
call fcn.10001c56
mov dword [eax], 0xefa2
jmp 0x10017544
mov dword [ebp - 0x118], 0xca9
mov dword [ebp - 0x1bc], str.zsvvjl_xxltg_zaw_cdqjcdy_dkuvpjaj_dcmf
cmp dword [ebp - 0x118], 0xe03
jle 0x1001767b
and dword [ebp - 0x98], 0
jmp 0x100175ad
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x6369
jge 0x1001766e
and dword [ebp - 0x90], 0
jmp 0x100175d3
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x27e2
jge 0x10017669
and dword [ebp - 0xb8], 0
jmp 0x100175f9
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0x2088
jge 0x10017664
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0xb8]
shl eax, cl
or eax, dword [ebp - 0x98]
cdq
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1d8], edx
push dword [ebp - 0x1d8]
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x2e4]
call fcn.10001a11
pop ecx
pop ecx
mov dword [ebp - 0x1f8], eax
mov ecx, dword [ebp - 0x1f8]
call fcn.10001aa8
push eax
call fcn.100400a6
pop ecx
lea ecx, [ebp - 0x2e4]
call fcn.10001a9e
jmp 0x100175ec
jmp 0x100175c6
jmp 0x100175a0
push 0x1f81
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 3
lea ecx, [ebp - 0x21c]
call fcn.10001c56
cmp dword [eax], 0
je 0x1001769e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.10001c3a
jmp 0x100176fa
mov byte [ebp - 4], 7
cmp dword [ebp - 0x118], 0xbfd
jge 0x100176ba
push dword [ebp - 0x1bc]
call fcn.100400a6
pop ecx
jmp 0x100176d6
mov dword [ebp - 4], 6
jmp 0x100176e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.10001c3a
jmp 0x10017513
jmp 0x100174ad
mov dword [ebp - 0x284], 0x10071fc8
mov dword [ebp - 0xc4], 0x5d6c05ba
mov byte [ebp - 0x26], 0
movzx eax, byte [ebp - 0x26]
test eax, eax
je 0x10017736
push 0x198b
push 0x17d9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [ebp - 0xc4], 0xffffffe6
jmp 0x1001774f
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
je 0x10017873
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x15c], 0x4129
mov dword [ebp - 0x1c8], str.plsdtxgow_ttgo_xmxezqdn_uya
cmp dword [ebp - 0x15c], 0x4475
jle 0x10017804
and dword [ebp - 0x5c], 0
jmp 0x10017791
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xe0b
jge 0x10017804
and dword [ebp - 0x60], 0
jmp 0x100177a7
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x4890
jge 0x10017802
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x60]
cdq
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1e4], edx
push dword [ebp - 0x1e4]
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x314]
call fcn.10001a11
pop ecx
pop ecx
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp - 0x20c]
call fcn.10001aa8
push eax
call fcn.100400a6
pop ecx
lea ecx, [ebp - 0x314]
call fcn.10001a9e
jmp 0x100177a0
jmp 0x1001778a
movzx eax, byte [ebp - 0x28]
test eax, eax
je 0x10017829
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0
push 0x1d98
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
mov dword [ebp - 4], 9
cmp dword [ebp - 0x15c], 0x3ef7
jge 0x10017848
push dword [ebp - 0x1c8]
call fcn.100400a6
pop ecx
jmp 0x10017864
or dword [ebp - 4], 0xffffffff
jmp 0x1001786e
jmp 0x10017742
mov byte [0x10073c04], 1
mov dword [ebp - 0x68], 3
mov dword [ebp - 0x68], 0xffffffe3
jmp 0x10017891
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x1d
jg 0x100178cd
mov dword [ebp - 0x74], 7
mov dword [ebp - 0x200], 0xfffe
mov dword [ebp - 0x74], 0xffffffea
jmp 0x100178b8
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xfffffff2
jl 0x100178cb
cmp dword [ebp - 0x200], 0
je 0x100178c9
jmp 0x100178cb
jmp 0x100178b1
jmp 0x1001788a
xor eax, eax
inc eax
imul eax, eax, 0x148
add eax, 0x10071fd8
mov dword [ebp - 0x150], eax
xor eax, eax
inc eax
imul eax, eax, 0x1c
add eax, 0x10071fd8
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x30], 0xac204e2d
mov dword [ebp - 0x14], 0x8530de9b
mov dword [ebp - 0x38], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0x1d4], 0xcef3cf68
mov dword [ebp - 0x17c], 5
mov dword [ebp - 0x7c], 0
jmp 0x10017935
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1001794b
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x228], 0xfff8
jmp 0x1001792e
mov dword [ebp - 0x30], 0xffffffe3
jmp 0x1001795b
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 6
jge 0x100179fa
mov dword [ebp - 0x8c], 0x390197f0
mov dword [ebp - 0x84], 0
jmp 0x10017988
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x100179a4
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x280], 0xfffffffe
jmp 0x1001797b
mov dword [ebp - 0x8c], 0
jmp 0x100179bd
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jl 0x100179e3
mov byte [ebp - 0x2a], 0
movzx eax, byte [ebp - 0x2a]
test eax, eax
je 0x100179e1
push 0
push 0
push 0x37c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
jmp 0x100179b0
mov byte [ebp - 0x27], 0
movzx eax, byte [ebp - 0x27]
test eax, eax
je 0x100179f5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x10017954
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x38]
add eax, dword [ebp - 0xd8]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x17c]
imul eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xd8]
jge 0x10017a2a
mov dword [ebp - 0x120], 1
jmp 0x10017a31
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 9
jae 0x10017a4c
mov dword [ebp - 0xec], 1
jmp 0x10017a53
and dword [ebp - 0xec], 0
mov eax, dword [ebp - 0x17c]
add eax, dword [ebp - 0xec]
cmp eax, 0x83e7
jl 0x10017a72
mov dword [ebp - 0x164], 1
jmp 0x10017a79
and dword [ebp - 0x164], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x164], eax
jge 0x10017a90
mov dword [ebp - 0x130], 1
jmp 0x10017a97
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x130], eax
je 0x10017aae
mov dword [ebp - 0x18c], 1
jmp 0x10017ab5
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x14]
neg eax
cmp eax, dword [ebp - 0x18c]
je 0x10017ace
mov dword [ebp - 0x138], 1
jmp 0x10017ad5
and dword [ebp - 0x138], 0
cmp dword [ebp - 0x138], 0
jne 0x10017aea
mov dword [ebp - 0x16c], 1
jmp 0x10017af1
and dword [ebp - 0x16c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x228]
add eax, dword [ebp - 0x16c]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1e0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x228]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x228], eax
mov eax, dword [ebp - 0x210]
cmp eax, dword [ebp - 0x1e0]
jg 0x10017b45
mov dword [ebp - 0x140], 1
jmp 0x10017b4c
and dword [ebp - 0x140], 0
cmp dword [ebp - 0x140], 0x90a
jne 0x10017b64
mov dword [ebp - 0x184], 1
jmp 0x10017b6b
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x184]
jle 0x10017b82
mov dword [ebp - 0xf0], 1
jmp 0x10017b89
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0xd8]
add eax, dword [ebp - 0xf0]
cmp eax, 0x68dd2ac3
jge 0x10017bad
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x228]
mov dword [ebp - 0x30], eax
jmp 0x10017c18
mov dword [ebp - 0x14], 0
jmp 0x10017bbd
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jg 0x10017bf4
mov dword [ebp - 0x38], 2
jmp 0x10017bd3
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x10017bf2
mov byte [ebp - 0x3d], 0
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x10017bf0
push 0x254f
call dword [sym.imp.KERNEL32.dll_ExitThread]
jmp 0x10017bcc
jmp 0x10017bb6
mov byte [ebp - 0x29], 0
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x10017c18
push 0x1577
push 0
push 0
push 0
push 0x1dca
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov eax, dword [ebp - 0x150]
mov dword [0x10071fc4], eax
mov dword [ebp - 0x258], 0x61f9c28a
mov byte [ebp - 0x3c], 0
movzx eax, byte [ebp - 0x3c]
test eax, eax
je 0x10017c41
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov byte [ebp - 0x2b], 0
movzx eax, byte [ebp - 0x2b]
test eax, eax
je 0x10017c5c
push 0x1916
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [ebp - 0xdc]
mov dword [0x10071fc8], eax
push 1
lea ecx, [ebp - 0xe8]
call fcn.10001bdd
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xfc], 3
mov dword [ebp - 0x208], 0xb275cf8b
mov dword [ebp - 0x1c], 0
jmp 0x10017c9f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x10017cbb
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xe8]
call fcn.10001c56
mov dword [eax], 0x9f9b3198
jmp 0x10017c98
mov dword [ebp - 0x1c], 0
jmp 0x10017ccb
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10017ce1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x264], 0
jmp 0x10017cc4
push 0
lea ecx, [ebp - 0xe8]
call fcn.10001c56
mov dword [eax], 3
jmp 0x10017d1a
push 0
lea ecx, [ebp - 0xe8]
call fcn.10001c56
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xf4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xe8]
call fcn.10001c56
cmp dword [eax], 0xffffffe2
je 0x10017ee6
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x134], 0x8e136dc9
cmp dword [ebp - 0x48], 0
jne 0x10017eb8
xor eax, eax
inc eax
je 0x10017e05
push 0
lea ecx, [ebp - 0xe8]
call fcn.10001c56
cmp dword [eax], 0
je 0x10017daa
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
add eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x48]
jl 0x10017d89
mov dword [ebp - 0x104], 1
jmp 0x10017d90
and dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x104]
sub eax, dword [ebp - 0x134]
je 0x10017daa
mov dword [ebp - 0x10c], 1
jmp 0x10017db1
and dword [ebp - 0x10c], 0
push 0
lea ecx, [ebp - 0xe8]
call fcn.10001c56
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [eax]
jg 0x10017dd4
mov dword [ebp - 0x114], 1
jmp 0x10017ddb
and dword [ebp - 0x114], 0
push 0
lea ecx, [ebp - 0xe8]
call fcn.10001c56
mov ecx, dword [ebp - 0x114]
cmp ecx, dword [eax]
je 0x10017e05
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x10017e05
mov dword [ebp - 0x11c], 1
jmp 0x10017e0c
and dword [ebp - 0x11c], 0
push 0
lea ecx, [ebp - 0xe8]
call fcn.10001c56
mov ecx, dword [ebp - 0x11c]
cmp ecx, dword [eax]
jge 0x10017e2f
mov dword [ebp - 0x124], 1
jmp 0x10017e36
and dword [ebp - 0x124], 0
push 0
lea ecx, [ebp - 0xe8]
call fcn.10001c56
mov ecx, dword [ebp - 0x124]
cmp ecx, dword [eax]
jg 0x10017e59
mov dword [ebp - 0x12c], 1
jmp 0x10017e60
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x12c]
add eax, 0x5fd0
cmp dword [ebp - 0x48], eax
jg 0x10017e7c
mov dword [ebp - 0x13c], 1
jmp 0x10017e83
and dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x13c], eax
jle 0x10017e9d
mov dword [ebp - 0x144], 1
jmp 0x10017ea4
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x144], eax
jl 0x10017eb8
and dword [ebp - 0xd4], 0
jmp 0x10017ec2
mov dword [ebp - 0xd4], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd4]
mov dword [ebp + eax - 0x264], ecx
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x208], eax
jmp 0x10017cf6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.10001c3a
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xdc]
push dword [ecx + eax]
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x150]
push dword [ecx + eax]
call fcn.10016d39
pop ecx
pop ecx
mov dword [ebp - 0x1ac], eax
push 2
lea ecx, [ebp - 0x234]
call fcn.10001bdd
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x24], 0
jmp 0x10017f44
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10017f5d
push dword [ebp - 0x24]
lea ecx, [ebp - 0x234]
call fcn.10001c56
and dword [eax], 0
jmp 0x10017f3d
mov dword [ebp - 0x24], 0
jmp 0x10017f6d
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x10017f83
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x244], 0x9bdba76a
jmp 0x10017f66
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x244], 1
jmp 0x10017fb1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x244]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x244], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x244], 0
jl 0x10018186
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], 1
jmp 0x10017fdc
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x10018000
push 1
lea ecx, [ebp - 0x234]
call fcn.10001c56
cmp dword [eax], 0
je 0x10017ff6
jmp 0x10018000
cmp dword [ebp - 0x18], 0
je 0x10017ffe
jmp 0x10017fd5
jmp 0x10017fd5
mov dword [ebp - 0x18], 1
jmp 0x10018010
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x10018181
mov dword [ebp - 0x158], 0x70e0
mov dword [ebp - 0x1ec], str.mbfcxdykq_udf_jkcl_xofsju_ipbdulmi_cpwjrj_wiwlzod_cvrxldur_miwzmbq_tqnpdx_hjhb_usla_anezvi
cmp dword [ebp - 0x158], 0x72d2
jle 0x1001811c
and dword [ebp - 0xac], 0
jmp 0x10018054
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x261d
jge 0x1001811c
and dword [ebp - 0x94], 0
jmp 0x1001807a
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0x685a
jge 0x10018117
and dword [ebp - 0x9c], 0
jmp 0x100180a0
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x3208
jge 0x10018112
and dword [ebp - 0xa4], 0
jmp 0x100180c2
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x3680
jge 0x10018110
mov eax, dword [ebp - 0x94]
cdq
idiv dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xa4]
shl edx, cl
or edx, dword [ebp - 0xac]
mov eax, edx
cdq
mov dword [ebp - 0x1f4], eax
mov dword [ebp - 0x1f0], edx
push dword [ebp - 0x1f0]
push dword [ebp - 0x1f4]
mov ecx, 0x10072ab8
call fcn.10001ac8
jmp 0x100180b5
jmp 0x10018093
jmp 0x1001806d
jmp 0x10018047
mov byte [ebp - 0x3a], 0
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x158], 0x6d19
jge 0x10018140
mov edx, dword [ebp - 0x1ec]
mov ecx, 0x10072ab8
call fcn.1000350a
jmp 0x1001815c
mov dword [ebp - 4], 0xc
jmp 0x1001816c
movzx eax, byte [ebp - 0x3a]
test eax, eax
je 0x1001817c
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x10018009
jmp 0x10017f96
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.10001c3a
push dword [ebp - 0xdc]
mov edx, 0x100723b4
mov ecx, dword [ebp - 0x1ac]
call fcn.10016dd3
pop ecx
mov dword [ebp - 0x190], 1
mov dword [ebp - 0x168], 0xea2a3b3f
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x1b0], 0x8d9dcee3
mov dword [ebp - 0xb4], 0
jmp 0x100181ea
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x10018206
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0xbc], 0x1476
jmp 0x100181dd
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
jne 0x1001828e
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x288], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbc], 0
je 0x10018266
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b0]
cmp ecx, dword [ebp + eax - 0xbc]
jl 0x1001824c
mov dword [ebp - 0x160], 1
jmp 0x10018253
and dword [ebp - 0x160], 0
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x160]
imul eax, eax, 0x5250
add eax, dword [ebp - 0x54]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0x8af8
jle 0x1001828e
and dword [ebp - 0x170], 0
jmp 0x10018298
mov dword [ebp - 0x170], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc]
cmp eax, dword [ebp - 0x170]
jl 0x100182b9
mov dword [ebp - 0x178], 1
jmp 0x100182c0
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x178]
neg eax
cmp eax, 0x5b3847d2
jl 0x100182db
mov dword [ebp - 0x180], 1
jmp 0x100182e2
and dword [ebp - 0x180], 0
cmp dword [ebp - 0x180], 0xaf86
jle 0x100182fa
mov dword [ebp - 0x188], 1
jmp 0x10018301
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x190], eax
mov byte [ebp - 0x25], 0
movzx eax, byte [ebp - 0x25]
test eax, eax
je 0x10018336
push 0
push 0
push 0
push 0
push 0x17f6
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, 0x10071fc4
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret