Function at 0x10015d22
Capabilities:
Connect pipe
Terminate process

Disassembly:
mov eax, 0x1005f6d4
call fcn.1005ea30
sub esp, 0xc0
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x28], ecx
push edi
mov dword [ebp - 0x38], esi
cmp byte [esi], 0x50
jne 0x10016470
cmp byte [esi + 1], 0x4b
jne 0x10016470
mov al, byte [esi + 2]
xor ebx, ebx
mov dword [ebp - 0x24], 0xffffffff
push 4
mov dword [ebp - 0x30], 0x2ca96836
mov byte [ebp - 0x29], al
mov dword [ebp - 0x24], ebx
pop edi
jmp 0x10015dc7
push edi
lea ecx, [ebp - 0x64]
call fcn.100039f2
mov dword [ebp - 0x14], ebx
jmp 0x10015d88
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x64]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10015d7c
cmp dword [ebp - 0x24], ebx
je 0x10015da3
mov byte [ebp - 0x2a], bl
cmp byte [ebp - 0x2a], bl
je 0x10015dbc
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x10015dbc
mov dword [ebp - 0x30], 0xda37bb00
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x64]
cmp dword [eax + 8], 1
setle cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x64]
call fcn.10003a4f
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff3
jge 0x10015d6e
mov al, byte [esi + 3]
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x20], 0x49fe387
mov dword [ebp - 0x20], 0x971c1ec2
mov dword [ebp - 0x20], 0x4f84b811
mov dword [ebp - 0x20], 0xaa39ed08
mov dword [ebp - 0x20], 0x509978f3
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0x653d4237
mov dword [ebp - 0x20], 0x5cc25bfc
mov dword [ebp - 0x20], 1
push 3
mov byte [ebp - 0xd], al
call fcn.100039f2
mov dword [ebp - 0x3c], 0xb564
mov dword [ebp - 0x14], ebx
jmp 0x10015e3e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], 0x591b68de
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10015e2b
inc dword [ebp - 0x3c]
mov byte [ebp - 0x2a], bl
cmp byte [ebp - 0x2a], bl
je 0x10015e5d
push ebx
push ebx
push 0x20ee
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
lea ecx, [ebp - 0xcc]
call fcn.10003a4f
movzx edi, byte [ebp - 0x29]
lea ecx, [ebp - 0xc0]
add edi, 4
push 1
mov dword [ebp - 0x30], edi
call fcn.100039f2
mov dword [ebp - 0x24], 0x9a3df603
mov dword [ebp - 0x14], ebx
jmp 0x10015e9e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], 0x1124f01c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x10015e8b
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x24], ebx
jmp 0x10015ee1
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], ebx
jmp 0x10015ed9
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], bl
je 0x10015ed6
push ebx
push 0x1077
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10015eb7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10015eaf
lea ecx, [ebp - 0xc0]
call fcn.10003a4f
movzx eax, byte [ebp - 0xd]
mov ecx, dword [ebp - 0x30]
add eax, 0x18
add edi, eax
mov eax, dword [ebp - 0x38]
mov edx, dword [ecx + eax]
mov ecx, dword [ecx + eax + 0x14]
call fcn.10015d16
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x1c], 0xe223
inc eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x3c], 0xffffffff
mov ecx, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x94]
call fcn.100039f2
mov dword [ebp - 0x20], 0x2d0da0bd
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
jmp 0x10015f5a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x94]
mov dword [eax + ecx*4], 0x20002526
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x10015f47
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10015f79
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0x1c], ebx
jmp 0x10015fd0
mov dword [ebp - 0x14], 0x8358bd4d
mov dword [ebp - 0x20], 0x1a7ecc24
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0xe8fe7528
mov dword [ebp - 0x14], ebx
jmp 0x10015fba
mov dword [ebp - 0x20], 0x5da2
mov dword [ebp - 0x20], 0xdac842f8
inc dword [ebp - 0x3c]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10015fa6
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x94]
cmp dword [eax + ecx*4], ebx
jne 0x10015fd5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10015f7e
lea ecx, [ebp - 0x94]
call fcn.10003a4f
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x70]
push 2
pop esi
add eax, edi
mov dword [ebp - 0x18], 0xfe0a8eac
push esi
mov dword [ebp - 0x3c], eax
call fcn.100039f2
push 4
lea ecx, [ebp - 0x88]
mov dword [ebp - 4], ebx
call fcn.100039f2
mov byte [ebp - 4], 1
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x18], ebx
jmp 0x1001602b
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x70]
mov dword [eax + ecx*4], 0xc9ca
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001601b
mov dword [ebp - 0x18], ebx
jmp 0x10016044
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x88]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10016035
mov dword [ebp - 0x18], 9
jmp 0x1001612c
mov dword [ebp - 0x1c], 0xf951fe77
lea ecx, [ebp - 0x7c]
push 1
call fcn.100039f2
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1001607f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x7c]
mov dword [eax + ecx*4], 0x2972
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1001606f
mov dword [ebp - 0x1c], ebx
jmp 0x10016117
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 0xffffffe5
jmp 0x1001610e
mov dword [ebp - 0x28], 0x16b471df
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x1001610b
mov dword [ebp - 0x24], 0xe864896e
mov dword [ebp - 0x24], ebx
jmp 0x10016101
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x7c]
cmp dword [eax + ecx*4], ebx
jne 0x10016106
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jl 0x100160f8
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100160df
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100160fb
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x100160fb
mov dword [ebp - 0x20], edx
inc dword [ebp - 0x24]
push 1
pop edx
cmp dword [ebp - 0x24], ebx
jle 0x100160b6
dec dword [ebp - 0x28]
jns 0x100160aa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x12
jle 0x10016098
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
jl 0x1001608c
lea ecx, [ebp - 0x7c]
call fcn.10003a4f
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe3
jge 0x10016056
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 1
jg 0x1001617f
mov edi, dword [ebp - 0x88]
mov dword [ebp - 0x28], 0x79096a9c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x28]
add eax, dword [ecx + edx*4]
mov dword [edi + 4], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jle 0x10016145
lea ecx, [ebp - 0x88]
call fcn.10003a4f
lea ecx, [ebp - 0x70]
call fcn.10003a4f
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x34]
mov dword [eax], edi
mov dword [ebp - 0x20], 0x5720e83c
mov dword [ebp - 0x20], 0x4f37831e
mov dword [ebp - 0x20], 0x532bb11a
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x34], 9
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100161d2
push 0xbfa
push ebx
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
dec dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x38]
shr edi, 2
inc edi
mov dword [ebp - 0x34], edi
mov eax, dword [ecx + edx]
mov dword [ebp - 0xa4], eax
mov eax, dword [ecx + edx + 4]
mov dword [ebp - 0xa0], eax
mov eax, dword [ecx + edx + 8]
mov dword [ebp - 0x9c], eax
mov eax, dword [ecx + edx + 0xc]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x24], 0x1a049fe3
mov dword [ebp - 0x24], 0xfffffffd
jmp 0x1001626f
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1001622e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa8], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x10016221
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x1001626c
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001624d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10016267
push 0x6b6
push 0x6e1
push ebx
call dword [sym.imp.GDI32.dll_PtInRegion]
dec dword [ebp - 0x28]
jns 0x1001623c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x11
jge 0x10016219
mov edi, ebx
cmp dword [ebp - 0x34], edi
jbe 0x10016635
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x20], 0xc84060a3
mov dword [ebp - 0x28], 0x4ab19f88
mov dword [ebp - 0x14], ebx
jmp 0x100162af
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4c], 1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100162a1
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100162c6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov dword [ebp - 0x18], ebx
jmp 0x10016428
mov dword [ebp - 0x24], 0xe1265ab3
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], ebx
jl 0x10016425
mov dword [ebp - 0x14], 0x40271dbc
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x4c]
cmp eax, 0xfffffffc
mov eax, dword [ebp - 0x18]
setle cl
sub eax, ecx
cmp eax, 0xffff
jne 0x100163fd
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x1c], ebx
jmp 0x10016398
mov dword [ebp - 0x20], 0xf4a1d2da
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x24]
cmp ecx, eax
sete dl
sub edx, dword [ebp - 0x44]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x14], edx
jne 0x10016350
cmp dword [ebp - 0x18], ebx
jne 0x10016350
mov edx, ebx
jmp 0x10016353
xor edx, edx
inc edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
sete cl
xor edx, edx
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
add eax, 0x3922c12e
add ecx, eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x4c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
mov eax, dword [ebp + eax*4 - 0x4c]
add eax, edx
cmp eax, 1
jb 0x1001638f
cmp dword [ebp - 0x18], ebx
jne 0x1001638f
mov eax, ebx
jmp 0x10016392
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x1c]
xor edx, edx
cmp dword [ebp - 0x1c], esi
jle 0x10016321
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x1c]
je 0x100163cd
cmp dword [ebp - 0x1c], ebx
je 0x100163cd
xor ecx, ecx
inc ecx
jmp 0x100163cf
mov ecx, ebx
xor eax, eax
mov dword [ebp - 0x30], 0xffffffff
cmp ecx, 0x27649690
setne al
xor edx, edx
cmp eax, 0x5bf8
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
add edx, 4
cmp eax, edx
setg cl
mov dword [ebp - 0x20], ecx
jmp 0x1001641c
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], ebx
jl 0x1001641c
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
jne 0x10016465
dec dword [ebp - 0x14]
jns 0x1001640e
dec dword [ebp - 0x24]
jns 0x100162e1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x100162ce
mov ecx, dword [ebp - 0x3c]
mov edx, edi
and edx, 3
mov ecx, dword [ecx]
mov edx, dword [ebp + edx*4 - 0xa4]
call fcn.10015d16
mov ecx, dword [ebp - 0x38]
add dword [ebp - 0x3c], 4
mov dword [ecx], eax
add ecx, 4
inc edi
mov dword [ebp - 0x38], ecx
cmp edi, dword [ebp - 0x34]
jb 0x10016280
jmp 0x10016635
push 0x504
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov dword [ebp - 0x20], 0xfffffff7
inc eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x1c], eax
push eax
call fcn.100039f2
push 2
xor edx, edx
pop esi
mov dword [ebp - 4], esi
inc edx
mov dword [ebp - 0x20], 0x80eec299
xor ebx, ebx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x1c], ebx
jmp 0x100164aa
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x40], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100164a0
mov dword [ebp - 0x1c], ebx
jmp 0x100164c0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x58]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100164b4
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], 8
jne 0x1001657e
mov dword [ebp - 0x20], 0xbc6e5c7a
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x20], 0x6c74aa0d
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x20], 0x3f5047c4
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0xb76eea53
push esi
call fcn.100039f2
mov dword [ebp - 0x20], 0x7b44
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x38], ebx
jmp 0x1001653c
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0xb4]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x10016529
inc dword [ebp - 0x30]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10016563
push ebx
push 0xe35
push ebx
push 0x1aed
push 0x11ec
call dword [sym.imp.GDI32.dll_ExtCreatePen]
lea ecx, [ebp - 0xb4]
call fcn.10003a4f
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 8
je 0x100164d2
xor edx, edx
inc edx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x10016625
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x34], 0x85d5fca4
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x58]
cmp dword [eax + ecx*4], ebx
je 0x100165ab
mov dword [ebp - 0x40], edx
jmp 0x100165b3
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], ebx
je 0x100165b6
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x58]
mov eax, dword [ecx + eax*4]
imul eax, dword [ecx]
xor ecx, ecx
neg eax
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x58]
dec eax
cmp dword [esi + edx*4], eax
setne cl
xor eax, eax
cmp ecx, dword [esi]
setg al
xor ecx, ecx
cmp eax, dword [esi + edi*4]
setg cl
cmp ecx, dword [ebp - 0x3c]
jge 0x100165fc
cmp dword [ebp - 0x40], ebx
je 0x100165fc
xor edx, edx
inc edx
mov esi, edx
jmp 0x10016601
xor edx, edx
mov esi, ebx
inc edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x58]
mov dword [eax + ecx*4], esi
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x1c]
jns 0x1001658a
lea ecx, [ebp - 0x58]
call fcn.10003a4f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret