Function at 0x100156ca
Capabilities:
Create directory
Terminate process

Disassembly:
mov eax, 0x1005cb18
call fcn.1005c15c
sub esp, 0x27c
push ebx
mov dword [ebp - 0x54], edx
xor ebx, ebx
mov dword [ebp - 0x24], 0xfffd
push esi
mov dword [ebp - 0x10], 0x62e08974
push edi
mov dword [ebp - 0x2c], 0xddbf
mov edi, ecx
mov dword [ebp - 0x10], ebx
jmp 0x1001570f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x23c], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100156fe
mov esi, 0xc0001115
push 1
pop eax
cmp dword [ebp - 0x24], ebx
je 0x1001574a
mov dword [ebp - 0x34], 3
xor edx, edx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setg dl
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp esi, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x10], eax
jmp 0x10015792
mov dword [ebp - 0x28], 0xe649
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 0xe0184dcc
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x996a
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], ebx
jmp 0x10015789
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x278], 0x5c2dd78f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10015778
dec dword [ebp - 0x2c]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x100157a6
push 0x1083
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [edi + 0x10], ebx
jne 0x100157b2
xor al, al
jmp 0x10016d6a
mov dword [ebp - 0x28], 0xa53d06ce
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x100157ca
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x100157de
push 0x4d7
push ebx
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
mov eax, dword [ebp - 0x54]
xor ecx, ecx
inc ecx
mov dword [eax], ebx
mov dword [ebp - 0x24], 0x2e3f9150
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], 0x7392715e
mov dword [ebp - 0x28], 0xe2e4e
mov dword [ebp - 0x2c], 0x7b47e0fa
mov dword [ebp - 0x10], ebx
jmp 0x10015818
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x38], 0x251d69f4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001580a
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
neg ecx
push 4
sbb ecx, ecx
inc ecx
add eax, ecx
mov ecx, dword [ebp - 0x38]
add ecx, 0x107
sub ecx, eax
mov eax, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
setg dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
setl dl
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setl dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x38]
cmp eax, edx
setl cl
add dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x188]
inc dword [ebp - 0x2c]
call fcn.100134ea
mov dword [ebp - 0x14], 0xb4c23afc
mov dword [ebp - 0x2c], 0x2324
mov dword [ebp - 0x14], ebx
jmp 0x100158a9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x25c], 0xec2e0cf5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10015898
mov dword [ebp - 0x14], ebx
jmp 0x100158c7
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x188]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100158b4
mov esi, dword [ebp - 0x188]
mov dword [esi + 0xc], ebx
mov dword [ebp - 0x24], 6
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x100158ed
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
dec dword [ebp - 0x24]
inc dword [esi + 0xc]
cmp dword [esi + 0xc], 2
jle 0x100158d6
mov dword [ebp - 0x14], 0x15
jmp 0x100159a5
mov dword [ebp - 0x18], 0xfa3a92bd
xor edx, edx
mov dword [ebp - 0x20], 0x9cbc21b0
mov dword [ebp - 0x10], 0xfffffffc
mov dword [ebp - 0x24], 0xde8cc195
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
shl eax, 2
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0x3585
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, 0x77dfcc86
jl 0x1001595e
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
jg 0x1001597c
cmp dword [ebp - 0x10], ebx
jne 0x1001597c
mov eax, ebx
jmp 0x1001597f
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x18]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, 0xafbc
mov dword [esi + 0xc], ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 7
jg 0x10015905
lea ecx, [ebp - 0x188]
call fcn.10013ddb
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x1c8]
mov dword [ebp - 0x14], 0xf425f5f9
xor eax, eax
inc eax
mov dword [ebp - 0x24], 0x6959
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x28], eax
push eax
call fcn.100134ea
mov dword [ebp - 4], ebx
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x10], ebx
jmp 0x10015a09
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c8]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x100159f6
cmp dword [ebp - 0x18], ebx
jne 0x10015a27
mov eax, dword [ebp - 0x18]
mov esi, ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
jmp 0x10015a2a
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp eax, edx
setne cl
sub ecx, esi
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x18]
jl 0x10015ac4
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0x34], 0xd7ba
mov dword [ebp - 0x20], 0xad2214c2
cmp dword [ebp - 0x24], ebx
je 0x10015aa2
mov eax, dword [ebp - 0x2c]
neg eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0x2c], 1
jne 0x10015a9c
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x20], ecx
jmp 0x10015b2e
mov dword [ebp - 0x28], 0x380d33b9
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0x14], 0x4322e7c6
push 3
call fcn.100134ea
mov dword [ebp - 0x20], 0xd602ff7
mov dword [ebp - 0x10], ebx
jmp 0x10015afe
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 0x63446b7d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10015aeb
dec dword [ebp - 0x20]
mov dword [ebp - 0x14], ebx
jmp 0x10015b1d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xf8]
cmp dword [eax + ecx*4], ebx
jne 0x10015b23
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x10015b0c
lea ecx, [ebp - 0xf8]
call fcn.10013ddb
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c8]
mov eax, dword [ebp - 0x40]
xor esi, esi
mov eax, dword [ebp - 0x18]
inc esi
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], esi
or dword [ebp - 4], 0xffffffff
call fcn.10013ddb
mov dword [ebp - 0x10], 0x4e064826
lea ecx, [ebp - 0x194]
mov dword [ebp - 0x18], 0xfffffff6
push esi
call fcn.100134ea
mov dword [ebp - 0x10], ebx
jmp 0x10015b8d
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x194]
mov dword [eax + ecx*4], 0x5e790e86
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x10015b7a
mov dword [ebp - 0x18], ebx
jmp 0x10015bcc
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10015bc9
push 0xecb
push 0x2335
push 0x10c2
push 0xca2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x10
jl 0x10015b98
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x4210e164
jge 0x10015bf7
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10015c29
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
jmp 0x10015c29
mov dword [ebp - 0x14], 0x7a61
mov dword [ebp - 0x18], ebx
jmp 0x10015c09
inc dword [ebp - 0x14]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1a
jge 0x10015c03
mov dword [ebp - 0x14], ebx
jmp 0x10015c23
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x194]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x10015c14
lea ecx, [ebp - 0x194]
call fcn.10013ddb
mov dword [ebp - 0x10], ebx
jmp 0x10015c4a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1f8], 0x64dc9ed9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10015c39
mov dword [ebp - 0x14], 0x68206240
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10015c68
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x14], ebx
jmp 0x10015cc1
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x30], 0x2b9193c1
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x10], ebx
jmp 0x10015c95
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x50], 0x8cf5a8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x10015c87
cmp dword [ebp - 0x50], ebx
jne 0x10015ca3
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x14], ebx
jne 0x10015cab
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], 0xab5c2947
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff7
jne 0x10015c6d
mov dword [ebp - 0x10], ebx
jmp 0x10015f5e
mov dword [ebp - 0x14], 0x82062403
lea ecx, [ebp - 0x1e0]
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x28], 0x6de1f171
push 1
call fcn.100134ea
mov dword [ebp - 4], 1
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
jmp 0x10015d17
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1e0]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x10015d07
mov dword [ebp - 0x14], 0x11
jmp 0x10015f1b
push 1
lea ecx, [ebp - 0x14c]
call fcn.100134ea
push 2
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 2
call fcn.100134ea
push 3
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 3
call fcn.100134ea
mov byte [ebp - 4], 4
mov dword [ebp - 0x18], ebx
jmp 0x10015d72
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x214], 0x1ca2961c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10015d61
mov dword [ebp - 0x18], ebx
jmp 0x10015d90
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14c]
mov dword [eax + ecx*4], 0xf065f4b3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10015d7d
push 2
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10015db1
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x17c]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10015d9e
mov dword [ebp - 0x18], ebx
jmp 0x10015dce
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x134]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10015dbb
mov eax, dword [ebp - 0x20c]
neg eax
push edx
je 0x10015eb2
lea ecx, [ebp - 0x11c]
call fcn.100134ea
mov dword [ebp - 0x18], ebx
jmp 0x10015e06
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], 0x96a0b597
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10015df3
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10015e1c
push ebx
call dword [sym.imp.USER32.dll_CharUpperW]
mov edx, dword [ebp - 0x11c]
xor ecx, ecx
mov eax, dword [edx]
add eax, 0x791e6e40
cmp eax, dword [edx]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x14c]
setle cl
mov dword [eax], ecx
mov esi, dword [edx]
imul esi, ecx
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp esi, eax
setge cl
xor eax, eax
cmp edx, ecx
mov ecx, 0xab6ce1a8
setle al
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x79c9
setg cl
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x17c]
mov dword [eax + 4], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x134]
mov edx, dword [eax]
mov eax, dword [ebp - 0x14]
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x11c]
jmp 0x10015eee
lea ecx, [ebp - 0x164]
call fcn.100134ea
mov dword [ebp - 0x18], ebx
jmp 0x10015ed5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x164]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10015ec2
mov eax, dword [ebp - 0x164]
lea ecx, [ebp - 0x164]
mov dword [eax + 4], 0xe26a25a
call fcn.10013ddb
lea ecx, [ebp - 0x134]
call fcn.10013ddb
lea ecx, [ebp - 0x17c]
call fcn.10013ddb
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 1
call fcn.10013ddb
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe8
jg 0x10015d29
dec dword [ebp - 0x20]
lea ecx, [ebp - 0x1e0]
or dword [ebp - 4], 0xffffffff
call fcn.10013ddb
mov dword [ebp - 0x30], 0xffff
mov dword [ebp - 0x40], 0x9ee1c974
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1f0], ecx
mov eax, dword [ebp - 0x10]
xor eax, eax
test ecx, ecx
setns al
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff9
jge 0x10015ccf
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x1f8], 0x37a5b7d8
jb 0x10015f7c
mov ecx, dword [edi]
jmp 0x10015f7e
mov ecx, edi
push 2
pop esi
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x4c], ecx
jb 0x10015f8e
mov edx, dword [edi]
jmp 0x10015f90
mov edx, edi
mov eax, dword [edi + 0x10]
add eax, edx
cmp ecx, eax
je 0x10016d5b
xor eax, eax
lea ecx, [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0x7e4a9061
push eax
call fcn.100134ea
xor eax, eax
mov dword [ebp - 4], 5
inc eax
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xfffe
push eax
call fcn.100134ea
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x10015ff4
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1b0]
mov dword [eax + ecx*4], 0x13d0bb94
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10015fe1
mov dword [ebp - 0x14], ebx
jmp 0x10016011
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], 0xb11f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10015ffe
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x104]
add ecx, 0xff54
mov dword [eax], ecx
lea ecx, [ebp - 0x104]
call fcn.10013ddb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b0]
call fcn.10013ddb
mov eax, dword [ebp - 0x4c]
mov al, byte [eax]
cmp al, 0x30
jl 0x10016111
cmp al, 0x39
jg 0x10016111
push 0x1c52
push 0x4604
push ebx
push 0x459b
call fcn.10018e24
add esp, 0x10
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x110]
push esi
call fcn.100134ea
mov dword [ebp - 0x28], 0xffff
mov dword [ebp - 0x10], ebx
jmp 0x100160c3
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x110]
mov dword [eax + ecx*4], 0x453606de
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100160b0
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], cl
je 0x100160ec
push 0x152d
push 0x180b
push ebx
call dword [sym.imp.USER32.dll_InflateRect]
lea ecx, [ebp - 0x110]
call fcn.10013ddb
push ebx
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.100184dc
mov ecx, dword [ebp - 0x4c]
add esp, 0xc
inc ecx
jmp 0x10015f81
mov dword [ebp - 0x14], 0xa624
lea ecx, [ebp - 0x90]
push 1
call fcn.100134ea
mov dword [ebp - 0x24], 0xea0627e8
xor ecx, ecx
mov dword [ebp - 0x20], 0xed23c5ad
inc ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x30], 0x53dd
mov dword [ebp - 0x20], 0x9515ed76
mov dword [ebp - 0x20], 0x187e526
mov dword [ebp - 0x18], ebx
jmp 0x10016169
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x90]
mov dword [eax + ecx*4], 0xc7c44d99
xor ecx, ecx
inc dword [ebp - 0x18]
inc ecx
cmp dword [ebp - 0x18], ecx
jl 0x10016153
mov dword [ebp - 0x18], ebx
jmp 0x10016181
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5c], 0x7649
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10016173
mov dword [ebp - 0x18], ebx
jmp 0x10016199
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x78], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1001618b
cmp dword [ebp - 0x14], ebx
je 0x100161e2
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x90]
neg eax
je 0x100161c2
cmp dword [edx], ebx
jne 0x100161c4
mov ecx, ebx
xor eax, eax
or edi, 0xffffffff
cmp ecx, edi
setge al
imul eax, dword [edx]
sub eax, 8
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
jmp 0x100161e5
or edi, 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x90]
dec ecx
neg ecx
sbb ecx, ecx
mov edx, dword [eax]
neg ecx
add ecx, dword [ebp - 0x14]
xor eax, eax
cmp ecx, edx
setle al
cmp eax, edx
jle 0x10016211
cmp dword [ebp - 0x24], ebx
jne 0x10016211
mov ecx, ebx
jmp 0x10016214
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x5c]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x5c]
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x30]
imul ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x5c]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
add eax, edx
xor edx, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setge dl
xor ecx, ecx
sub edx, dword [ebp - 0x5c]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
cmp eax, 0x56a759f3
setge cl
mov dword [ebp - 0x78], ecx
lea ecx, [ebp - 0x90]
call fcn.10013ddb
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x20], 0xfffffffd
push 3
call fcn.100134ea
mov dword [ebp - 0x10], ebx
jmp 0x1001629a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x128]
mov dword [eax + ecx*4], 0x75d5f8d9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10016287
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp eax, 0x2ae7
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
imul ecx, ecx, 0xffff
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0xba29f583
setne al
xor edx, edx
imul eax, dword [ebp - 0x20]
imul ecx, eax, 0xd329
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x128]
setne dl
xor ecx, ecx
cmp edx, edi
setne cl
mov dword [eax + 4], ecx
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001630c
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
lea ecx, [ebp - 0x128]
call fcn.10013ddb
mov dword [ebp - 0x2c], 0xfffd
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x10], 0x62e08974
push esi
call fcn.100134ea
mov dword [ebp - 4], 6
lea eax, [ebp - 0x224]
push dword [ebp - 0x28]
movdqa xmm0, xmmword [0x10006600]
lea ecx, [ebp - 0x74]
push eax
lea eax, [ebp - 0x234]
mov dword [ebp - 0x74], ebx
push eax
push ebx
movdqu xmmword [ebp - 0x234], xmm0
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
call fcn.10014beb
mov dword [ebp - 0x28], 0xe93d
mov eax, 0xffff
mov dword [ebp - 0x24], 0x26a7609f
mov dword [ebp - 0x14], 0x86a67606
mov dword [ebp - 0x20], 0xfaa0
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x30], 0xae9140de
mov dword [ebp - 0x10], ebx
jmp 0x100163c3
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xa8]
mov dword [eax + ecx*4], 0xcdbe8e56
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100163b0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa8]
neg ecx
sbb ecx, ecx
neg ecx
mov esi, dword [eax]
mov eax, dword [ebp - 0xec]
add eax, ecx
xor ecx, ecx
cmp esi, eax
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
cmp esi, ecx
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xa8]
setge cl
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0x74]
mov eax, dword [ebp - 0x74]
setge dl
mov dword [eax + 0xc], edx
call fcn.10013ddb
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], edi
call fcn.10013ddb
push 0xfffffffffffffff8
pop esi
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x1d4]
mov dword [ebp - 0x10], esi
push 4
call fcn.100134ea
mov dword [ebp - 4], 7
lea eax, [ebp - 0x214]
push dword [ebp - 0x28]
movdqa xmm0, xmmword [0x10006680]
lea ecx, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0xb4], ebx
push eax
push ebx
movdqu xmmword [ebp - 0x224], xmm0
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
call fcn.10014beb
push 3
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 8
call fcn.100134ea
mov dword [ebp - 0x18], 0xf3faa32f
mov dword [ebp - 0x14], ebx
jmp 0x100164c6
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1d4]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100164b3
push 3
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x100164e3
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x140]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100164d4
mov dword [ebp - 0x14], 0x15
jmp 0x10016539
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], 0x135
mov dword [ebp - 0x10], ebx
jmp 0x10016511
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x250], 0x47dc4b4e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10016500
dec dword [ebp - 0x18]
mov dword [ebp - 0x18], ebx
jmp 0x10016531
cmp dword [ebp - 0x14], 1
je 0x100164f1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x100165b9
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x10016599
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10016562
push ebx
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 3
pop edx
mov dword [ebp - 0x10], ebx
jmp 0x1001658f
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100165b4
push ebx
push ebx
push 0x2458
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 3
pop edx
dec dword [ebp - 0x18]
jns 0x10016547
lea ecx, [ebp - 0x140]
call fcn.10013ddb
lea ecx, [ebp - 0xb4]
call fcn.10013ddb
lea ecx, [ebp - 0x1d4]
mov dword [ebp - 4], edi
call fcn.10013ddb
mov dword [ebp - 0x34], 0xddbf
lea ecx, [ebp - 0x204]
push 2
call fcn.100134ea
xor edx, edx
inc edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x10], ebx
jmp 0x10016611
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x204]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10016602
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ebx
jl 0x10016671
push ebx
push 0x5c06
call fcn.10016db9
pop ecx
pop ecx
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret