Function at 0x10037987
Capabilities:
Accept command line arguments
Check for time delay via queryperformancecounter
Check os version
Create pipe
Delete registry key
Encrypt data using speck
Get keyboard layout
Get system information on windows
Get thread local storage value
Log keystrokes via polling
Query environment variable

Disassembly:
mov eax, 0x1006176e
call fcn.10060628
sub esp, 0x9a4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x40], 0x7d0fa516
mov dword [ebp - 0x38], 4
push 2
mov dword [ebp - 0x3c], 0xfffd
mov byte [ebp - 0x5c], dl
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x30], ebx
pop esi
jmp 0x100379d6
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x658], 0x273d
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x100379c5
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
cmp ecx, 0xfff6
sbb eax, eax
neg eax
add eax, dword [ebp - 0x18]
je 0x10037a09
cmp dword [ebp - 0x18], ebx
je 0x10037a09
xor edi, edi
inc edi
mov ecx, edi
jmp 0x10037a0e
xor edi, edi
mov ecx, ebx
inc edi
mov eax, dword [ebp - 0x18]
push 9
pop edx
cmp edx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add eax, ecx
xor ecx, ecx
cmp eax, 0xfffffffa
mov eax, dword [ebp - 0x18]
setl cl
xor edx, edx
cmp ecx, eax
setg dl
xor eax, eax
sub edx, dword [ebp - 0x18]
cmp edx, 7
setle al
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], ebx
jmp 0x10037a5f
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x658], ebx
jne 0x10037a64
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jle 0x10037a50
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x40], 0x7d0fa516
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x3c], 0xfffd
mov dword [ebp - 0x30], ebx
jmp 0x10037a92
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x618], 0x273d
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x10037a81
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
cmp ecx, 0xfff6
sbb eax, eax
neg eax
add eax, dword [ebp - 0x18]
je 0x10037ac0
mov ecx, edi
cmp dword [ebp - 0x18], ebx
jne 0x10037ac2
mov ecx, ebx
mov eax, dword [ebp - 0x18]
push 9
pop edx
cmp edx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add eax, ecx
xor ecx, ecx
cmp eax, 0xfffffffa
mov eax, dword [ebp - 0x18]
setl cl
xor edx, edx
cmp ecx, eax
setg dl
xor eax, eax
sub edx, dword [ebp - 0x18]
cmp edx, 7
setle al
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], ebx
jmp 0x10037b13
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x618], ebx
jne 0x10037b18
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jle 0x10037b04
push 3
pop esi
push esi
lea ecx, [ebp - 0x624]
call fcn.1000f6e4
push 2
lea ecx, [ebp - 0x2bc]
mov dword [ebp - 4], ebx
call fcn.1000f6e4
mov dword [ebp - 0x3c], 0xea122098
mov dword [ebp - 0x18], ebx
jmp 0x10037b56
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x624]
mov dword [eax + ecx*4], 0x2db58e46
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10037b43
push 2
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10037b76
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2bc]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10037b63
mov eax, dword [ebp - 0x2bc]
mov dword [eax], edx
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x10037b93
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x2bc]
dec dword [eax]
jns 0x10037b83
mov dword [ebp - 0x3c], ebx
jmp 0x10037bf7
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x30], 0xe9bf9f36
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0xffffffef
jmp 0x10037bee
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x10037bda
push ebx
push 0xd81
push ebx
push 0x24e7
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x10037beb
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x16
jg 0x10037bbf
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 7
jle 0x10037ba2
lea ecx, [ebp - 0x2bc]
call fcn.1000f766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x624]
call fcn.1000f766
mov dword [ebp - 0x20], 0xb8e
mov dword [ebp - 0x40], 0xba22e974
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x4c], 0x111d0188
mov dword [ebp - 0x38], 0x1b17d72
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x30], 0xbbbdebf8
mov dword [ebp - 0x40], 0xa5bc4220
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], 0x5764
mov dword [ebp - 0x3c], 0xb1b0cadf
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x24]
test eax, eax
je 0x10037c7c
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x20]
je 0x10037c7c
mov ecx, edi
cmp dword [ebp - 0x30], ebx
jne 0x10037c7e
mov ecx, ebx
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
sub ecx, dword [ebp - 0x20]
jne 0x10037c9e
mov edx, ebx
cmp dword [ebp - 0x28], ebx
je 0x10037ca0
mov edx, edi
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x30], ebx
jne 0x10037cd0
mov eax, ebx
cmp dword [ebp - 0x3c], ebx
je 0x10037cd2
mov eax, edi
mov dword [ebp - 0x28], eax
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setle dl
mov dword [ebp - 0x2c], edx
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x10037d03
push 0x18df
push 0x1ad0
push 0x259
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x30], 0xf
jmp 0x10037d4f
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x38], 0xdcc590f0
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], 6
jne 0x10037d4c
push 4
pop ecx
mov dword [ebp - 0x38], 0xf0ed
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 6
je 0x10037d2d
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffed
jne 0x10037d13
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x40], 0x7d0fa516
mov dword [ebp - 0x3c], 0xf9c28ade
mov dword [ebp - 0x30], ebx
jmp 0x10037d7c
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1b8], 0xffff
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x10037d6b
mov dword [ebp - 0x3c], ebx
jmp 0x10037d97
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1b8], 0xd29b
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jl 0x10037d86
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x30], 0xfffd
mov dword [ebp - 0x18], 0xdc4b4e12
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], 0xd2daffa8
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x10037dd2
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp dword [ebp - 0x18], ebx
je 0x10037de8
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], 6
mov eax, edi
jg 0x10037dea
mov eax, ebx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
je 0x10037e49
mov dword [ebp - 0x24], 0x13d0bb94
mov dword [ebp - 0x40], 0xb91ee4c
mov dword [ebp - 0x40], 0x7c44d996
mov dword [ebp - 0x40], 0x6af9031e
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sub eax, 2
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x10037e92
xor ecx, ecx
mov dword [ebp - 0x38], 0x3f121f20
mov eax, dword [ebp - 0x30]
cmp eax, 0xde8b
setl cl
xor eax, eax
cmp ecx, 0x5bf8
setle al
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0x634d71b3
sete al
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x10037e92
push ebx
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
mov dword [ebp - 0x30], ebx
jmp 0x10037ea8
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x5b8], 0x273d
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x10037e97
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x30], ebx
jmp 0x10037ed9
cmp byte [ebp - 0x31], 0
je 0x10037ed6
push ebx
push 0x1345
push 0x1a0c
push 0x96c
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xe
mov byte [ebp - 0x31], bl
jg 0x10037eba
cmp byte [ebp - 0x31], 0
je 0x10037f6d
mov dword [ebp - 0x40], 0x26f6
cmp dword [ebp - 0x40], 0x2ab1
jle 0x10037f43
mov dword [ebp - 0x24], ebx
mov esi, ebx
mov edi, ebx
mov ebx, dword [ebp - 0x24]
mov ecx, edi
lea eax, [esi + ebx]
shl eax, cl
mov ecx, 0x10609ad8
cdq
push edx
push eax
call fcn.1000f5cf
inc edi
cmp edi, 0x9b8
jl 0x10037f06
inc esi
push 0
pop ebx
cmp esi, 0x2098
jl 0x10037f01
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x432
jl 0x10037eff
xor edi, edi
push 3
inc edi
pop esi
push 0x2132
call dword [sym.imp.GDI32.dll_RealizePalette]
mov dword [ebp - 4], edi
cmp dword [ebp - 0x40], 0x261e
jge 0x10037f69
mov edx, 0x1000aa68
mov ecx, 0x10609ad8
call fcn.10011079
or dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
cmp ecx, 0xfff6
sbb eax, eax
neg eax
add eax, dword [ebp - 0x1c]
je 0x10037f96
mov ecx, edi
cmp dword [ebp - 0x1c], ebx
jne 0x10037f98
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
push 9
pop edx
cmp edx, eax
push edi
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add eax, ecx
xor ecx, ecx
cmp eax, 0xfffffffa
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
lea ecx, [ebp - 0x4dc]
setg dl
xor eax, eax
sub edx, dword [ebp - 0x1c]
cmp edx, 7
setle al
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
call fcn.1000f6e4
mov dword [ebp - 4], esi
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x40], 4
push esi
call fcn.1000f6e4
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], 0x5034859b
mov dword [ebp - 0x44], ebx
jmp 0x1003804b
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4dc]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], edi
jl 0x10038038
mov dword [ebp - 0x44], ebx
jmp 0x10038068
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 0x2bb11acc
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], esi
jl 0x10038055
mov dword [ebp - 0x44], ebx
jmp 0x10038083
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x5b0], 0xa2a0c0e0
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 2
jl 0x10038072
mov eax, dword [ebp - 0xec]
cmp dword [eax], ebx
je 0x100380ff
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xec]
cmp dword [eax], edi
setne cl
xor eax, eax
cmp ecx, esi
setne al
xor ecx, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x4dc]
mov esi, dword [eax]
mov eax, dword [ebp - 0x40]
cmp eax, esi
mov eax, dword [ebp - 0xec]
setne cl
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x3c]
setl dl
xor ecx, ecx
cmp edx, esi
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xec]
setne dl
mov dword [eax], edx
lea eax, [edx - 0xfff8]
test eax, eax
mov eax, edi
jne 0x10038101
mov eax, ebx
mov ecx, dword [ebp - 0x24]
imul eax, eax, 0xfffa
sub ecx, eax
mov dword [ebp - 0x5ac], ecx
inc dword [ebp - 0x24]
mov dword [ebp - 0x3c], ebx
jmp 0x10038159
mov dword [ebp - 0x194], 0xc7eb
mov dword [ebp - 0x190], 0xc7eb
mov dword [ebp - 0x18c], 0xc7eb
mov dword [ebp - 0x188], 0xc7eb
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x48], 5
mov dword [ebp - 0x40], 0x7dfcc86f
dec dword [ebp - 0x40]
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x1b
jne 0x1003811a
lea ecx, [ebp - 0xec]
call fcn.1000f766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4dc]
call fcn.1000f766
push 3
mov dword [ebp - 0x30], ebx
pop esi
cmp dword [ebp - 0x30], edi
jg 0x10038435
push edi
lea ecx, [ebp - 0x63c]
call fcn.1000f6e4
mov dword [ebp - 0x38], 0xcc25bfc8
mov dword [ebp - 0x18], ebx
jmp 0x100381b3
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x63c]
mov dword [eax + ecx*4], 0xe91a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100381a0
mov dword [ebp - 0x18], ebx
jmp 0x100381ce
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa0], 0xb0b02971
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100381bd
mov dword [ebp - 0xa0], ebx
jmp 0x10038243
mov dword [ebp - 0x3c], ebx
jmp 0x100381f2
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x350], 0x39ed080c
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 4
jl 0x100381e1
mov dword [ebp - 0x34c], ebx
jmp 0x1003820d
mov dword [ebp - 0x38], 0x5653d423
inc dword [ebp - 0x34c]
cmp dword [ebp - 0x34c], ebx
jle 0x10038200
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1003823d
push 0x61b
push 0x1cb2
push 0x1a50
push 0x1da9
push 0x913
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
inc dword [ebp - 0xa0]
cmp dword [ebp - 0xa0], ebx
jle 0x100381dc
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1003825a
call dword [sym.imp.USER32.dll_DestroyCaret]
lea ecx, [ebp - 0x63c]
call fcn.1000f766
mov dword [ebp - 0x40], 0x7b68
cmp dword [ebp - 0x40], 0x7c4d
jle 0x100382cc
push 0xd49
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
mov edi, ebx
mov esi, ebx
lea eax, [esi + edi]
cdq
lea ecx, [ebp - 0x978]
push edx
push eax
call fcn.1000d000
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003829f
mov eax, dword [eax]
push eax
call fcn.1004b356
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x978]
call fcn.1000fa70
inc esi
cmp esi, 0x30da
jl 0x10038284
inc edi
cmp edi, 0x5179
jl 0x10038282
xor edi, edi
push 3
inc edi
pop esi
push esi
lea ecx, [ebp - 0x1f4]
call fcn.1000f6e4
cmp dword [ebp - 0x40], 0x78b4
jge 0x100382ec
push 0x1000aac0
call fcn.1004b356
pop ecx
mov dword [ebp - 4], 4
mov dword [ebp - 0x38], 0xbe4438be
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x40], 0x8e8
cmp dword [ebp - 0x40], 0xb10
jle 0x1003836b
mov ecx, ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x24], ebx
mov edi, ebx
mov esi, ebx
mov ebx, dword [ebp - 0x24]
lea eax, [edi + ebx]
and eax, esi
and eax, ecx
mov ecx, 0x10609ad8
cdq
push edx
push eax
call fcn.1000f5cf
mov ecx, dword [ebp - 0x3c]
inc esi
cmp esi, 0x4b66
jl 0x1003831f
inc edi
push 0
pop ebx
cmp edi, 0x7cc
jl 0x1003831a
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x705f
jl 0x10038318
inc ecx
mov dword [ebp - 0x3c], ecx
cmp ecx, 0x40bb
jl 0x10038315
xor edi, edi
push 3
inc edi
pop esi
mov dword [ebp - 0x18], ebx
jmp 0x1003837e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x74], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10038370
mov byte [ebp - 4], 7
cmp dword [ebp - 0x40], 0x760
jge 0x100383c3
mov edx, 0x1000ab20
mov ecx, 0x10609ad8
call fcn.10011079
jmp 0x100383c3
mov dword [ebp - 0x18], ebx
jmp 0x100383d7
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1f4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100383c8
mov eax, dword [ebp - 0x1f4]
mov dword [eax], ebx
mov eax, dword [eax]
mov ecx, dword [ebp + eax*4 - 0x74]
mov edx, dword [ebp - 0x1f4]
mov eax, dword [edx]
mov dword [ebp + eax*4 - 0x74], ecx
mov eax, dword [edx]
mov eax, dword [ebp + eax*4 - 0x74]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1f4]
inc dword [eax]
cmp dword [eax], 0
jle 0x100383e4
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x1f4]
mov dword [ebp - 0x38], eax
or dword [ebp - 4], 0xffffffff
call fcn.1000f766
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x5b8], ebx
jne 0x10038435
inc dword [ebp - 0x30]
jmp 0x1003817f
push esi
lea ecx, [ebp - 0x650]
call fcn.1000f6e4
push 2
lea ecx, [ebp - 0x2e0]
mov dword [ebp - 4], 9
call fcn.1000f6e4
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x3c], 0xea122098
mov dword [ebp - 0x18], ebx
jmp 0x10038478
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x650]
mov dword [eax + ecx*4], 0x2db58e46
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10038465
mov dword [ebp - 0x40], 0x37ae
cmp dword [ebp - 0x40], 0x3832
jle 0x100384da
push 0xc64
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x24], ebx
mov edi, ebx
mov esi, ebx
mov ebx, dword [ebp - 0x24]
lea eax, [edi + ebx]
mov ecx, 0x10609ad8
and eax, esi
cdq
push edx
push eax
call fcn.1000f5cf
inc esi
cmp esi, 0x4aee
jl 0x100384a5
inc edi
push 0
pop ebx
cmp edi, 0x215d
jl 0x100384a0
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x5800
jl 0x1003849e
push 2
mov dword [ebp - 0x18], ebx
pop esi
jmp 0x100384f5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2e0]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100384e2
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x40], 0x3586
jge 0x10038537
mov edx, 0x1000ab68
mov ecx, 0x10609ad8
call fcn.10011079
jmp 0x10038537
mov eax, dword [ebp - 0x2e0]
xor edi, edi
inc edi
mov dword [eax], esi
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x10038552
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x2e0]
dec dword [eax]
jns 0x10038542
mov dword [ebp - 0x3c], ebx
jmp 0x100385b6
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x30], 0xe9bf9f36
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0xffffffef
jmp 0x100385ad
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x10038599
push ebx
push 0xd81
push ebx
push 0x24e7
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x100385aa
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x16
jg 0x1003857e
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 7
jle 0x10038561
lea ecx, [ebp - 0x2e0]
call fcn.1000f766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x650]
call fcn.1000f766
push esi
lea ecx, [ebp - 0x328]
call fcn.1000f6e4
mov dword [ebp - 0x24], 0xdc5336de
mov dword [ebp - 0x30], ebx
jmp 0x100385fd
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x328]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x100385ee
mov esi, dword [ebp - 0x328]
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x328]
mov edx, dword [eax]
xor eax, eax
test edx, edx
setle al
xor ecx, ecx
cmp eax, edx
setne cl
add ecx, edx
je 0x10038653
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1003863d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x100386aa
push 0x2132
call dword [sym.imp.GDI32.dll_RealizePalette]
jmp 0x100386aa
mov dword [ebp - 0x38], 3
xor ecx, ecx
mov dword [ebp - 0x40], 0xfffffff7
mov eax, dword [ebp - 0x38]
cmp dword [esi + 4], eax
setge cl
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], ebx
mov byte [ebp - 0x31], bl
je 0x10038699
cmp byte [ebp - 0x31], 0
je 0x100386aa
push 0x10ff
push 0x1bbb
push 0x2124
push 0x773
call dword [sym.imp.GDI32.dll_CreateRectRgn]
jmp 0x100386aa
cmp byte [ebp - 0x31], 0
je 0x100386aa
push 0xc37
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
lea ecx, [ebp - 0x328]
call fcn.1000f766
push 2
pop esi
push esi
lea ecx, [ebp - 0x1a4]
call fcn.1000f6e4
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0x4f4]
mov dword [ebp - 0x3c], 0x2ee76f50
push esi
call fcn.1000f6e4
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x38], 0xf0427242
mov dword [ebp - 0x18], ebx
jmp 0x100386fd
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1a4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100386ee
mov dword [ebp - 0x18], ebx
jmp 0x1003871a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4f4]
mov dword [eax + ecx*4], 0xc6f79b34
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10038707
mov dword [ebp - 0x3c], edi
cmp dword [ebp - 0x3c], ebx
jl 0x1003893f
movdqa xmm0, xmmword [0x1000bbe0]
lea ecx, [ebp - 0x6b8]
push ecx
lea eax, [ebp - 0x6a8]
push eax
push ecx
lea ecx, [ebp - 0x2f8]
movdqu xmmword [ebp - 0x6b8], xmm0
call fcn.1000f740
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x20], 0x6364d64e
mov dword [ebp - 0x30], 0xbd2e84cb
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x38], 0x74357240
mov dword [ebp - 0x4c], esi
mov dword [eax], ebx
cmp dword [eax], edi
jg 0x10038915
mov edx, dword [eax]
mov dword [ebp - 0x18], 0x7cbb4028
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1a4]
add eax, edx
je 0x100387a1
mov ecx, edi
cmp dword [esi + edx*4], ebx
jne 0x100387a3
mov ecx, ebx
xor eax, eax
cmp ecx, edx
setl al
xor ecx, ecx
cmp dword [esi + edx*4], eax
setl cl
xor eax, eax
cmp dword [esi + edx*4], eax
sete al
cmp eax, ecx
jl 0x1003887b
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x28], 0x1c95
cmp dword [ebp - 0x28], 0x1ce8
jle 0x1003881e
mov dword [ebp - 0x24], ebx
mov edi, ebx
mov esi, ebx
mov ebx, dword [ebp - 0x24]
mov ecx, esi
mov eax, edi
sar eax, cl
mov ecx, 0x10609ad8
and eax, ebx
cdq
push edx
push eax
call fcn.1000f5cf
inc esi
cmp esi, 0x60b9
jl 0x100387e3
inc edi
push 0
pop ebx
cmp edi, 0xbcc
jl 0x100387de
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x7cf1
jl 0x100387dc
xor edi, edi
inc edi
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], 0xf85a06c0
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x28], 0x1af6
jge 0x1003884a
mov edx, 0x1000abf4
mov ecx, 0x10609ad8
call fcn.10011079
mov dword [ebp - 4], 0xf
jmp 0x100388a3
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x100388a3
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x1003889e
push 0xd5a
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
dec dword [ebp - 0x18]
jns 0x10038883
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x30], ebx
jl 0x100388c3
mov eax, dword [ebp - 0x2f8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1a4]
cmp dword [eax + ecx*4], ebx
mov ecx, edi
jne 0x100388c5
mov ecx, ebx
mov eax, dword [ebp - 0x18]
imul eax, ecx
neg eax
jne 0x100388dc
mov eax, dword [ebp - 0x4f4]
cmp dword [eax + 4], ebx
mov eax, ebx
je 0x100388de
mov eax, edi
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov edx, dword [ebp - 0x18]
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
cmp edx, eax
setg cl
test ecx, ecx
jns 0x100388f9
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2f8]
inc dword [eax]
jmp 0x1003877c
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp eax, ecx
lea ecx, [ebp - 0x2f8]
setge dl
mov dword [ebp - 0x38], edx
mov byte [ebp - 4], 0xe
call fcn.1000f766
dec dword [ebp - 0x3c]
push 2
pop esi
jmp 0x10038722
lea ecx, [ebp - 0x4f4]
call fcn.1000f766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a4]
call fcn.1000f766
push 3
pop esi
push esi
lea ecx, [ebp - 0x59c]
call fcn.1000f6e4
push esi
lea ecx, [ebp - 0x3e0]
mov dword [ebp - 4], 0x12
call fcn.1000f6e4
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x4c4]
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x24], 0xfddd3f46
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x40], 0xfffffffa
push esi
call fcn.1000f6e4
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x50c]
mov dword [ebp - 0x40], 0xc3d4e703
push esi
call fcn.1000f6e4
mov dword [ebp - 0x44], ebx
jmp 0x100389d6
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3e0]
mov dword [eax + ecx*4], 0xc08901f2
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], esi
jl 0x100389c3
mov dword [ebp - 0x44], ebx
jmp 0x100389f3
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c4]
mov dword [eax + ecx*4], 0x37b04800
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], esi
jl 0x100389e0
mov dword [ebp - 0x44], ebx
jmp 0x10038a0d
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x50c]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], esi
jl 0x100389fd
inc dword [ebp - 0x40]
mov edx, dword [ebp - 0x3e0]
cmp dword [edx + 8], ebx
je 0x10038a59
mov esi, dword [ebp - 0x4c4]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50c]
sub ecx, dword [esi + 8]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [eax + 8]
jl 0x10038a43
mov ecx, ebx
cmp dword [edx + 8], ebx
je 0x10038a45
mov ecx, edi
xor eax, eax
cmp ecx, 0xffffffff
push 3
setne al
mov dword [esi + 8], eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
pop esi
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x50c]
mov dword [ebp - 0x24], 0xfffffffd
call fcn.1000f766
lea ecx, [ebp - 0x4c4]
call fcn.1000f766
lea ecx, [ebp - 0x3e0]
mov byte [ebp - 4], 0x12
call fcn.1000f766
push 2
lea ecx, [ebp - 0x340]
call fcn.1000f6e4
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1c4]
mov dword [ebp - 0x24], 0xea122098
push esi
call fcn.1000f6e4
mov dword [ebp - 0x24], 0xe4f1f13b
mov dword [ebp - 0x18], 0x2ea21e1d
mov dword [ebp - 0x40], 0x314d41bd
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x30], ebx
jmp 0x10038adc
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x10038acd
mov edi, dword [ebp - 0x1c4]
mov eax, dword [edi + 4]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x10038b3d
mov eax, dword [edi + 4]
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [edi + 4]
setne cl
imul eax, ecx, 0xf34e
test eax, eax
jne 0x10038b12
cmp dword [ebp - 0x18], ebx
je 0x10038b15
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov edx, 0xa3888ad8
mov ecx, dword [ebp - 0x1c4]
mov eax, 0xfffa
cmp eax, dword [ecx]
sbb eax, eax
neg eax
cmp edx, eax
sbb eax, eax
inc eax
cmp eax, dword [edi + 4]
jg 0x10038b43
xor edx, edx
inc edx
jmp 0x10038b45
mov ecx, dword [ebp - 0x1c4]
mov edx, ebx
mov esi, dword [edi + 4]
xor eax, eax
cmp edx, dword [ecx]
mov edx, dword [ebp - 0x24]
setg al
add edx, esi
sub edx, eax
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, esi
setl cl
xor eax, eax
cmp ecx, 1
setg al
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [edi + 4]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x10038b90
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [ebp - 0x1c4]
call fcn.1000f766
push 3
mov dword [ebp - 0x18], ebx
pop esi
jmp 0x10038bb6
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x59c]
mov dword [eax + ecx*4], 0x2db58e46
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10038ba3
mov dword [ebp - 0x30], 0xfffffffe
lea ecx, [ebp - 0x4a0]
mov dword [ebp - 0x40], 0x311e2db8
push 2
call fcn.1000f6e4
push 4
xor edi, edi
mov dword [ebp - 0x44], ebx
pop ecx
inc edi
cmp dword [ebp - 0x44], ecx
jge 0x10038bf3
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x9a0], edi
inc dword [ebp - 0x44]
jmp 0x10038bdf
mov dword [ebp - 0x44], ebx
jmp 0x10038c09
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x7f8], 9
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], esi
jl 0x10038bf8
mov dword [ebp - 0x44], ebx
jmp 0x10038c26
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4a0]
mov dword [eax + ecx*4], 0x48407374
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 2
jl 0x10038c13
mov eax, dword [ebp - 0x30]
xor edx, edx
mov dword [ebp - 0x40], edi
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4a0]
setge cl
mov dword [eax], ecx
lea ecx, [ebp - 0x4a0]
call fcn.1000f766
push 2
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10038c7d
cmp dword [ebp - 0x18], edx
jl 0x10038c6a