Function at 0x1016b3a0
Capabilities:
Create process on windows
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b53ce
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x1022c684]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1ac], ecx
mov dword [ebp - 0x1a8], 0
push 0x101ee348
push 0x101ee34c
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x3c]
call eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x80]
push ecx
call fcn.1016f99d
add esp, 4
test eax, eax
je 0x1016b420
mov edx, dword [ebp - 0x80]
push edx
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x1c]
call fcn.1011c390
mov dword [ebp - 0x30], eax
jmp 0x1016b45d
mov ecx, dword [ebp - 0x1ac]
add ecx, 0x3c
push ecx
mov edx, esp
mov dword [ebp - 0x13c], esp
push ecx
mov ecx, edx
call fcn.10005d60
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x1c]
call fcn.1011c2b0
mov dword [ebp - 0x1b4], eax
mov ecx, dword [ebp - 0x1b4]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x1ac]
call fcn.1016c310
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x40]
push ecx
push 9
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx + 0x1c]
add eax, 0xc4
mov edx, dword [ecx + 0xc4]
mov ecx, eax
mov eax, dword [edx + 0xbc]
call eax
lea ecx, [ebp - 0x28]
call fcn.10005d40
mov dword [ebp - 4], 0
movzx ecx, byte [ebp - 0x1d]
test ecx, ecx
jne 0x1016b534
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx + 0x40]
push eax
push 9
mov ecx, dword [ebp - 0x1ac]
add ecx, 0x2c
push ecx
mov edx, esp
mov dword [ebp - 0x140], esp
push ecx
mov ecx, edx
call fcn.10005d60
mov dword [ebp - 0x1b8], eax
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x1ac]
mov ecx, dword [ecx + 0x1c]
call fcn.1011d720
mov dword [ebp - 0x1bc], eax
mov edx, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c0], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c0]
push eax
lea ecx, [ebp - 0x28]
call fcn.10003ea0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x144]
call fcn.10005e00
jmp 0x1016b546
mov ecx, dword [ebp - 0x1ac]
add ecx, 0x2c
push ecx
lea ecx, [ebp - 0x28]
call fcn.10003ea0
mov edx, dword [ebp - 0x30]
push edx
lea ecx, [ebp - 0x148]
call fcn.10003dd0
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1c8], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c8]
push ecx
lea ecx, [ebp - 0x44]
call fcn.10019d00
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x148]
call fcn.100058a0
cmp dword [ebp + 8], 0
je 0x1016b5a0
mov edx, dword [ebp + 8]
sub edx, 0xc4
mov dword [ebp - 0x1cc], edx
jmp 0x1016b5aa
mov dword [ebp - 0x1cc], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x14c], esp
lea eax, [ebp - 0x28]
push eax
call fcn.10005d60
mov dword [ebp - 0x1d0], eax
lea ecx, [ebp - 0x64]
push ecx
mov ecx, dword [ebp - 0x1cc]
call fcn.10125f20
mov dword [ebp - 0x1d4], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c]
call fcn.10012560
mov byte [ebp - 4], 6
push str.Content_Type:_application_x_www_form_urlencoded_n
lea ecx, [ebp - 0x2c]
call fcn.10005d80
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2c]
call fcn.10004390
push eax
lea ecx, [ebp - 0x150]
call fcn.10003dd0
mov dword [ebp - 0x1d8], eax
mov edx, dword [ebp - 0x1d8]
mov dword [ebp - 0x1dc], edx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x1dc]
push eax
lea ecx, [ebp - 0x7c]
call fcn.10019d00
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x150]
call fcn.100058a0
mov ecx, dword [ebp - 0x1ac]
add ecx, 0x30
call fcn.10004390
push eax
lea ecx, [ebp - 0x154]
call fcn.10003dd0
mov dword [ebp - 0x1e0], eax
mov ecx, dword [ebp - 0x1e0]
mov dword [ebp - 0x1e4], ecx
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x1e4]
push edx
lea ecx, [ebp - 0x54]
call fcn.10019d00
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x154]
call fcn.100058a0
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x70]
call eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x1ac]
xor edx, edx
cmp dword [ecx + 0x44], 0
setne dl
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ecx + 0x434]
mov byte [eax + 0x630], dl
push 0x101ee3cc
mov ecx, dword [ebp - 0x1ac]
add ecx, 0x28
push ecx
call fcn.10004370
add esp, 8
movzx edx, al
test edx, edx
jne 0x1016b7f5
mov eax, dword [ebp - 0x80]
push eax
call fcn.1016f99d
add esp, 4
test eax, eax
jne 0x1016b7e9
push str.true
mov ecx, dword [ebp - 0x1ac]
add ecx, 0x28
push ecx
call fcn.10004370
add esp, 8
movzx edx, al
test edx, edx
jne 0x1016b7f5
push 0x101ee3e4
push ecx
mov ecx, esp
mov dword [ebp - 0x15c], esp
push 0x101ee3e8
call fcn.10005d80
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1ec], eax
mov byte [ebp - 4], 0xe
push ecx
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x101ee3ec
call fcn.10005d80
mov dword [ebp - 0x1f0], eax
mov ecx, dword [ebp - 0x1f0]
mov dword [ebp - 0x1f4], ecx
mov byte [ebp - 4], 0xf
push ecx
mov ecx, esp
mov dword [ebp - 0x164], esp
push 0x101ee3f0
call fcn.10005d80
mov dword [ebp - 0x1f8], eax
lea edx, [ebp - 0x168]
push edx
mov byte [ebp - 4], 0xd
call fcn.100e0810
add esp, 0x10
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x200], eax
mov ecx, dword [ebp - 0x1a8]
or ecx, 1
mov dword [ebp - 0x1a8], ecx
mov edx, dword [ebp - 0x200]
push edx
call fcn.10004370
add esp, 8
movzx eax, al
test eax, eax
je 0x1016b7e9
mov ecx, dword [ebp - 0x1ac]
add ecx, 0x28
call fcn.10004400
movzx ecx, al
test ecx, ecx
jne 0x1016b7f5
mov dword [ebp - 0x204], 0
jmp 0x1016b7ff
mov dword [ebp - 0x204], 1
mov dl, byte [ebp - 0x204]
mov byte [ebp - 0x155], dl
mov eax, dword [ebp - 0x1a8]
and eax, 1
je 0x1016b828
and dword [ebp - 0x1a8], 0xfffffffe
lea ecx, [ebp - 0x168]
call fcn.10005e00
movzx ecx, byte [ebp - 0x155]
test ecx, ecx
je 0x1016b860
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [edx + 0x1c]
call fcn.1011bc30
push 5
push 0
mov eax, dword [ebp - 0x30]
push eax
push str.iexplore.exe
push 0x101ee41c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1016c19b
push str.modaldialog
mov ecx, dword [ebp - 0x1ac]
add ecx, 0x28
push ecx
call fcn.10004370
add esp, 8
movzx edx, al
test edx, edx
je 0x1016b943
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x1c]
push ecx
mov edx, dword [ebp - 0x1ac]
add edx, 0x38
push ecx
mov ecx, esp
mov dword [ebp - 0x16c], esp
push edx
call fcn.10005d60
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x20c], eax
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x1ac]
add ecx, 0x34
push ecx
mov edx, esp
mov dword [ebp - 0x170], esp
push ecx
mov ecx, edx
call fcn.10005d60
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x214], eax
mov byte [ebp - 4], 0x11
push ecx
mov ecx, esp
mov dword [ebp - 0x174], esp
mov edx, dword [ebp - 0x3c]
push edx
call fcn.10005d80
mov dword [ebp - 0x218], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xe4]
call fcn.100ae990
mov dword [ebp - 0x21c], eax
mov byte [ebp - 4], 0x12
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0xe4]
call fcn.1016cb70
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xe4]
call fcn.100aeda0
jmp 0x1016c19b
push str.minibrowser
mov eax, dword [ebp - 0x1ac]
add eax, 0x28
push eax
call fcn.10004370
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x1016b9bc
lea edx, [ebp - 0xe8]
push edx
mov ecx, dword [ebp - 0x1ac]
add ecx, 0x38
call fcn.100043a0
push eax
mov ecx, dword [ebp - 0x1ac]
add ecx, 0x34
call fcn.100043a0
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x1c]
mov eax, dword [edx + 0x434]
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x1c]
mov ecx, dword [edx + 0x434]
add ecx, 0x14
mov edx, dword [eax + 0x14]
push ecx
mov eax, dword [edx + 0x18c]
call eax
jmp 0x1016c19b
push str.flashbrowser
mov ecx, dword [ebp - 0x1ac]
add ecx, 0x28
push ecx
call fcn.10004370
add esp, 8
movzx edx, al
test edx, edx
je 0x1016ba4b
mov dword [ebp - 0x178], 0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x54]
call fcn.10012580
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x7c]
call fcn.10012580
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2c]
call fcn.10005e00
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c]
call fcn.10012580
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x64]
call fcn.10012580
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.10012580
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005e00
mov eax, dword [ebp - 0x178]
jmp 0x1016c247
push 0x101ee474
mov eax, dword [ebp - 0x1ac]
add eax, 0x28
push eax
call fcn.10004370
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x1016bcfc
lea ecx, [ebp - 0x28]
call fcn.10004400
movzx edx, al
test edx, edx
jne 0x1016bcfc
mov eax, dword [ebp - 0x1ac]
cmp dword [eax + 0x48], 0
je 0x1016bb26
mov ecx, dword [ebp - 0x1ac]
mov ecx, dword [ecx + 0x48]
add ecx, 0x30
call fcn.10004cb0
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1016babd
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [edx + 0x48]
add ecx, 0x2c
call fcn.100af900
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x48]
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx + 0x48]
mov ecx, dword [ecx]
push eax
mov edx, dword [ecx + 8]
call edx
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x48]
mov dword [ebp - 0x180], ecx
mov edx, dword [ebp - 0x180]
mov dword [ebp - 0x17c], edx
cmp dword [ebp - 0x17c], 0
je 0x1016bb1c
push 1
mov ecx, dword [ebp - 0x17c]
add ecx, 0x2c
mov eax, dword [ebp - 0x17c]
mov edx, dword [eax + 0x2c]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x220], eax
jmp 0x1016bb26
mov dword [ebp - 0x220], 0
push 0xa0
call fcn.1017072e
add esp, 4
mov dword [ebp - 0x188], eax
mov byte [ebp - 4], 0x13
cmp dword [ebp - 0x188], 0
je 0x1016bb65
push 0
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x1c]
push edx
mov ecx, dword [ebp - 0x188]
call fcn.100cc380
mov dword [ebp - 0x224], eax
jmp 0x1016bb6f
mov dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x184], eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ebp - 0x184]
mov dword [ecx + 0x48], edx
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx + 0x48]
mov dword [ecx + 0x43c], eax
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x48]
mov dword [edx + 0x84], 1
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x48]
mov byte [ecx + 0x80], 1
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx + 0x1c]
mov ecx, dword [eax + 0x434]
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx + 0x48]
mov ecx, dword [ecx + 0x628]
mov dword [eax + 0x70], ecx
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf0], 1
mov dword [ebp - 0xec], 1
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x18c], esp
push 0
call fcn.10004c60
push 0x200
push 0x40010000
push str.about:blank
push ecx
mov ecx, esp
mov dword [ebp - 0x190], esp
lea edx, [ebp - 0xf8]
push edx
call fcn.10004c40
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x1c]
add ecx, 4
call fcn.10004cb0
push eax
mov ecx, dword [ebp - 0x1ac]
mov ecx, dword [ecx + 0x48]
add ecx, 0x2c
call fcn.1001a590
push 5
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx + 0x48]
mov ecx, dword [eax + 0x30]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push 5
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [edx + 0x48]
add ecx, 0x30
call fcn.10004cb0
push eax
call dword [sym.imp.USER32.dll_GetWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x48]
call fcn.100116c0
test eax, eax
je 0x1016bcf7
mov ecx, dword [ebp - 0x1ac]
mov ecx, dword [ecx + 0x48]
call fcn.100116c0
mov dword [ebp - 0x228], eax
lea edx, [ebp - 0x7c]
push edx
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x228]
mov eax, dword [edx]
mov ecx, dword [eax + 0xd0]
call ecx
mov dword [ebp - 0x68], eax
jmp 0x1016c19b
push str.default_browser
mov edx, dword [ebp - 0x1ac]
add edx, 0x28
push edx
call fcn.10004370
add esp, 8
movzx eax, al
test eax, eax
je 0x1016bd36
push 1
push 0
push 0
mov ecx, dword [ebp - 0x30]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1016c19b
push 0x101ee4cc
mov edx, dword [ebp - 0x1ac]
add edx, 0x28
push edx
call fcn.10004370
add esp, 8
movzx eax, al
test eax, eax
je 0x1016be00
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x80
je 0x1016be00
mov dword [ebp - 0xfc], 0
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [edx + 0x1c]
call fcn.1011bc30
cmp dword [ebp + 8], 0
je 0x1016bd9d
mov eax, dword [ebp + 8]
sub eax, 0xc4
mov dword [ebp - 0x22c], eax
jmp 0x1016bda7
mov dword [ebp - 0x22c], 0
push 0xffffffffffffffff
lea ecx, [ebp - 0xfc]
push ecx
call fcn.10122750
add esp, 8
test eax, eax
je 0x1016bde7
lea edx, [ebp - 0x7c]
push edx
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0xfc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xfc]
push eax
mov ecx, dword [edx + 0xd0]
call ecx
mov edx, dword [ebp - 0xfc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xfc]
push ecx
mov edx, dword [eax + 8]
call edx
jmp 0x1016c19b
push str.default
mov eax, dword [ebp - 0x1ac]
add eax, 0x28
push eax
call fcn.10004370
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x1016beaa
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x80
je 0x1016beaa
call fcn.100e4640
test eax, eax
jle 0x1016beaa
lea ecx, [ebp - 0x10c]
call fcn.10012560
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x10c]
push eax
push 3
lea ecx, [ebp - 0x10c]
call fcn.1016cb30
mov dword [ebp - 0x104], 0x800
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ecx + 0xd0]
call eax
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x10c]
call fcn.10012580
jmp 0x1016c19b
mov ecx, dword [ebp - 0x1ac]
xor edx, edx
cmp dword [ecx + 0x44], 0
setne dl
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ecx + 0x434]
mov byte [eax + 0x630], dl
mov ecx, dword [ebp - 0x1ac]
add ecx, 0x30
call fcn.10004390
push eax
lea ecx, [ebp - 0x194]
call fcn.10003dd0
mov dword [ebp - 0x230], eax
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 0x234], ecx
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x234]
push edx
lea ecx, [ebp - 0x11c]
call fcn.10019d00
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x194]
call fcn.100058a0
push str.newtab
mov eax, dword [ebp - 0x1ac]
add eax, 0x28
push eax
call fcn.10004370
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x1016c11f
call fcn.100e4640
test eax, eax
jle 0x1016c11f
lea ecx, [ebp - 0x134]
call fcn.10012560
mov byte [ebp - 4], 0x18
lea edx, [ebp - 0x134]
push edx
push 3
lea ecx, [ebp - 0x134]
call fcn.1016cb30
mov dword [ebp - 0x12c], 0x800
lea ecx, [ebp - 0x28]
call fcn.10004400
movzx eax, al
test eax, eax
je 0x1016bfc0
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x134]
push ecx
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ecx + 0xd0]
call eax
mov dword [ebp - 0x120], eax
jmp 0x1016c10e
mov ecx, dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x138]
call fcn.10005d80
mov byte [ebp - 4], 0x19
push ecx
mov edx, esp
mov dword [ebp - 0x198], esp
lea eax, [ebp - 0x138]
push eax
push str.toolbarpost:
push edx
call fcn.1001a4e0
add esp, 0xc
mov dword [ebp - 0x238], eax
mov ecx, dword [ebp - 0x1ac]
mov ecx, dword [ecx + 0x1c]
call fcn.1011c2b0
mov dword [ebp - 0x23c], eax
mov edx, dword [ebp - 0x23c]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
push eax
lea ecx, [ebp - 0x19c]
call fcn.10003dd0
mov dword [ebp - 0x240], eax
mov ecx, dword [ebp - 0x240]
mov dword [ebp - 0x244], ecx
mov byte [ebp - 4], 0x1a
mov edx, dword [ebp - 0x244]
push edx
lea ecx, [ebp - 0x44]
call fcn.10019d30
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x19c]
call fcn.100058a0
lea ecx, [ebp - 0x28]
call fcn.10004390
push eax
lea ecx, [ebp - 0x1a0]
call fcn.10003dd0
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x24c]
call fcn.10013030
push eax
push 0x101ee518
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x1c]
mov eax, dword [edx + 0x434]
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x1c]
mov ecx, dword [edx + 0x434]
add ecx, 0x14
mov edx, dword [eax + 0x14]
push ecx
mov eax, dword [edx + 0x1b4]
call eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1a0]
call fcn.100058a0
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x134]
push ecx
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ecx + 0xd0]
call eax
mov dword [ebp - 0x120], eax
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x138]
call fcn.10005e00
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x134]
call fcn.10012580
jmp 0x1016c18c
lea ecx, [ebp - 0x28]
call fcn.10004400
movzx ecx, al
test ecx, ecx
je 0x1016c15e
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [edx + 0xd0]
call ecx
mov dword [ebp - 0x120], eax
jmp 0x1016c18c
lea edx, [ebp - 0x7c]
push edx
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [edx + 0xd0]
call ecx
mov dword [ebp - 0x120], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x11c]
call fcn.10012580
cmp dword [ebp - 0x80], 0
je 0x1016c1b5
mov edx, dword [ebp - 0x80]
push edx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0xa8]
call eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0xa8]
call edx
push 0x101ee52c
push 0x101ee530
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x44]
call eax
mov dword [ebp - 0x1a4], 0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x54]
call fcn.10012580
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x7c]
call fcn.10012580
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2c]
call fcn.10005e00
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c]
call fcn.10012580
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x64]
call fcn.10012580
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.10012580
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005e00
mov eax, dword [ebp - 0x1a4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8