Function at 0x1006b7b6
Capabilities:
Get common file path
Log keystrokes via polling

Disassembly:
mov eax, 0x100879af
call fcn.10086580
sub esp, 0x184
push ebx
push esi
push edi
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0xc8]
push 2
mov byte [ebp - 0x35], dl
call fcn.1001ff2e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 0x716a
cmp dword [ebp - 0x10], 0x74d6
push 1
pop edi
jle 0x1006b84a
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x174]
push edx
push eax
call fcn.10010ffe
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1006b81e
mov eax, dword [eax]
push eax
call fcn.100714f3
pop ecx
xor eax, eax
lea ecx, [ebp - 0x174]
push ebx
inc eax
push eax
call fcn.1002065a
inc edi
cmp edi, 0x787a
jl 0x1006b803
inc esi
cmp esi, 0x4819
jl 0x1006b801
xor edi, edi
inc edi
mov dword [ebp - 0x1c], 6
cmp dword [ebp - 0x10], 0x6e5e
jge 0x1006b865
push 0x1000f528
call fcn.100714f3
pop ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x1c], ebx
jmp 0x1006b880
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc8]
mov dword [eax + ecx*4], 0xe8ed
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1006b86d
mov dword [ebp - 0x1c], ebx
jmp 0x1006b921
mov dword [ebp - 0x18], 0x1cdcb363
dec dword [ebp - 0x18]
mov dword [ebp - 0x10], 0x1c36
cmp dword [ebp - 0x10], 0x1cca
jle 0x1006b8f6
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x12c]
cdq
push edx
push eax
call fcn.10010ffe
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1006b8ca
mov eax, dword [eax]
push eax
call fcn.100714f3
pop ecx
xor eax, eax
lea ecx, [ebp - 0x12c]
push ebx
inc eax
push eax
call fcn.1002065a
inc edi
cmp edi, 0x7dcc
jl 0x1006b8ac
inc esi
cmp esi, 0x7d65
jl 0x1006b8aa
xor edi, edi
inc edi
mov dword [ebp - 0x18], ebx
jmp 0x1006b905
mov dword [ebp - 0x30], 0xfffffff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x1006b8fb
cmp dword [ebp - 0x10], 0x187a
jge 0x1006b91e
push 0x1000f550
call fcn.100714f3
pop ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x1006b88e
or esi, 0xffffffff
lea ecx, [ebp - 0xc8]
mov dword [ebp - 4], esi
call fcn.1001ffb0
mov dword [ebp - 0x20], 0xbcd8c45
lea ecx, [ebp - 0x8c]
mov eax, 0x9b2c
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], 0x6cdead9b
mov dword [ebp - 0x64], 0x3e67dcaf
mov dword [ebp - 0x3c], 0x5826cce7
mov dword [ebp - 0x28], esi
push 2
call fcn.1001ff2e
mov dword [ebp - 4], edi
mov dword [ebp - 0x30], 0xff61739b
mov dword [ebp - 0x1c], ebx
jmp 0x1006b99a
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x8c]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1006b987
cmp dword [ebp - 0x20], ebx
je 0x1006bae3
push 3
mov dword [ebp - 0x14], ebx
pop ecx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ebx
jl 0x1006bc49
mov dword [ebp - 0x1c], 0x5dae5a60
mov dword [ebp - 0x1c], ebx
jmp 0x1006bab6
mov dword [ebp - 0x10], ebx
jmp 0x1006b9e0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe4], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1006b9cf
inc dword [ebp - 0x14]
mov dword [ebp - 0x14], ebx
jmp 0x1006baaa
mov dword [ebp - 0x30], 0xf8ab
mov dword [ebp - 0x2c], 0x4b58fe4d
mov dword [ebp - 0x18], ebx
jmp 0x1006ba9e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
sete dl
cmp edi, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
mov eax, dword [ebp + eax*4 - 0x4c]
imul eax, ecx
test eax, eax
jne 0x1006ba41
mov edx, ebx
cmp dword [ebp - 0x30], ebx
je 0x1006ba43
mov edx, edi
mov eax, dword [ebp - 0xe0]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
push 3
setne cl
cmp ecx, 0x91920b24
mov esi, dword [ebp + eax*4 - 0x4c]
sbb ecx, ecx
neg ecx
imul esi, ecx
sub esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x4c]
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x907
pop ecx
setg al
imul eax, eax, 0xb54
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x1006ba06
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x1006b9f0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x1006b9ca
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1006bad5
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_RedrawWindow]
push 3
pop ecx
dec dword [ebp - 0x20]
jns 0x1006b9bb
jmp 0x1006bc49
mov dword [ebp - 0x20], 0x21e8
cmp dword [ebp - 0x20], 0x23e7
jle 0x1006bb52
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], 0x1f45
mov esi, dword [ebp - 0x10]
mov edi, ebx
mov ecx, edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], ebx
sar esi, cl
mov eax, esi
mov ecx, 0x1008bbb8
and eax, ebx
cdq
push edx
push eax
call fcn.1001fc14
inc ebx
cmp ebx, 0x1877
jl 0x1006bb0f
mov esi, dword [ebp - 0x10]
inc edi
push 0
pop ebx
cmp edi, 0x3f21
jl 0x1006bb05
mov esi, dword [ebp - 0x14]
add dword [ebp - 0x10], esi
dec dword [ebp - 0x1c]
jne 0x1006bb00
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x2bf1
jl 0x1006baf6
or esi, 0xffffffff
mov dword [ebp - 0x30], 0xfffd
cmp dword [ebp - 0x20], 0x2058
jge 0x1006bb71
mov edx, 0x1000f584
mov ecx, 0x1008bbb8
call fcn.100228da
mov dword [ebp - 0x14], 0x577b
cmp dword [ebp - 0x14], 0x5a00
jle 0x1006bbce
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
mov esi, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], 0x2548
mov edi, ebx
mov ebx, dword [ebp - 0x10]
mov ecx, edi
mov eax, ebx
shl eax, cl
mov ecx, 0x1008bbb8
cdq
push edx
push eax
call fcn.1001fc14
inc edi
cmp edi, 0x59b7
jl 0x1006bb99
add ebx, esi
dec dword [ebp - 0x1c]
push 0
mov dword [ebp - 0x10], ebx
pop ebx
jne 0x1006bb94
inc esi
cmp esi, 0x4802
jl 0x1006bb8a
or esi, 0xffffffff
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x14], 0x55d1
jge 0x1006bbe9
mov edx, 0x1000f5c0
mov ecx, 0x1008bbb8
call fcn.100228da
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], ebx
jl 0x1006bc46
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
add eax, 0xc3bbb365
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setl dl
imul edx, dword [ebp - 0x20]
dec edx
mov dword [ebp - 0x10], edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setge dl
imul edx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
dec dword [ebp - 0x20]
jns 0x1006bbf5
xor edi, edi
inc edi
cmp dword [ebp - 0x18], ebx
jne 0x1006bcbd
mov esi, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
sub esi, 0xfffb
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp eax, 0xdd18
mov eax, dword [ebp - 0x64]
setne cl
xor edx, edx
cmp esi, ecx
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, 0x44ca7af7
imul ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4c]
sub ecx, eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
cmp dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x48]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x4ed9
setge al
cmp eax, dword [ebp - 0x20]
mov eax, ebx
jle 0x1006bcbf
mov eax, edi
cmp eax, 0xfff8
mov ecx, 0xeaa4
sbb eax, eax
inc eax
sub ecx, eax
mov eax, dword [ebp - 0x8c]
or dword [ebp - 4], 0xffffffff
mov dword [eax], ecx
lea ecx, [ebp - 0x8c]
call fcn.1001ffb0
mov dword [ebp - 0x18], 0xe83c773
mov dword [ebp - 0x10], 0x1865425a
mov dword [ebp - 0x14], ebx
jmp 0x1006bd05
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbc], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1006bcf8
mov dword [ebp - 0x14], ebx
jmp 0x1006bd20
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xfc], 0xbd42ca8c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1006bd0f
mov dword [ebp - 0x18], ebx
jmp 0x1006bd45
mov dword [ebp - 0x28], 6
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setge dl
mov dword [ebp - 0x10], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1006bd2b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
je 0x1006bd5c
mov eax, edi
cmp dword [ebp - 0x18], ebx
jne 0x1006bd5e
mov eax, ebx
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x80]
mov eax, dword [ebp - 0x18]
mov edi, dword [0x1009301c]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x20], 0xfffd
push 3
mov dword [ebp - 0x30], edi
call fcn.1001ff2e
mov dword [ebp - 0x10], ebx
jmp 0x1006bdae
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x80]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1006bd9e
mov dword [ebp - 0x18], 0x11
cmp dword [ebp - 0x18], 0xffffffeb
jl 0x1006be85
mov esi, dword [ebp - 0x80]
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x10], 0xc9cc1417
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1006bdef
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff9
je 0x1006bdde
dec dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x80]
imul edx, dword [eax]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, dword [esi + 4]
setne al
cmp eax, dword [ebp - 0x18]
jg 0x1006be20
cmp dword [ebp - 0x20], ebx
jne 0x1006be27
mov eax, dword [ebp - 0x80]
cmp dword [eax], ebx
je 0x1006be2a
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x10]
setge cl
xor edx, edx
cmp eax, ecx
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp eax, 0xfffffff8
setle dl
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setl cl
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffeb
jge 0x1006bdc8
lea ecx, [ebp - 0x80]
call fcn.1001ffb0
cmp byte [ebp - 0x35], 0
mov esi, dword [ebp + 8]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
je 0x1006c008
xor eax, eax
inc eax
cmp edi, eax
jne 0x1006c008
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xc1b0fe2c
mov dword [ebp - 0x2c], 0x480c
cmp dword [ebp - 0x2c], 0x48f1
jle 0x1006bf1d
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [ebp - 0x144]
and eax, esi
cdq
push edx
push eax
call fcn.10010ffe
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1006bef1
mov eax, dword [eax]
push eax
call fcn.100714f3
pop ecx
xor eax, eax
lea ecx, [ebp - 0x144]
push ebx
inc eax
push eax
call fcn.1002065a
inc edi
cmp edi, 0x5dc0
jl 0x1006bed5
inc esi
cmp esi, 0x6c93
jl 0x1006bed3
mov esi, dword [ebp + 8]
mov byte [ebp - 0x21], bl
cmp dword [ebp - 0x2c], 0x45e4
jge 0x1006bf34
push 0x1000f60c
call fcn.100714f3
pop ecx
cmp byte [ebp - 0x21], 0
je 0x1006bf43
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xfffffffd
jg 0x1006bffa
xor esi, esi
mov dword [ebp - 0x1c], 0xffff
mov dword [ebp - 0x2c], 2
cmp dword [ebp - 0x18], ebx
je 0x1006bfca
mov eax, dword [ebp - 0x1c]
or edi, 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
cmp edi, eax
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
neg edx
sub edx, 5
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0xfc3
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp eax, edx
lea edx, [esi + 1]
setl cl
xor eax, eax
cmp ecx, edi
setge al
add eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x1c]
je 0x1006bfcc
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1006bfea
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffd
jle 0x1006bf52
mov esi, dword [ebp + 8]
mov dword [esi + 8], 4
mov dword [esi + 0xc], 0x1009301c
mov dword [ebp - 0x14], 0x2e91a049
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x2c], 0xedf6b3e7
xor edi, edi
inc edi
or esi, 0xffffffff
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], 0xef9953e8
mov dword [ebp - 0x28], 0xab56411d
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], edi
push 3
call fcn.1001ff2e
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], esi
push edi
call fcn.1001ff2e
mov byte [ebp - 4], 3
mov dword [ebp - 0x20], ebx
jmp 0x1006c073
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x9c], 8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1006c062
mov dword [ebp - 0x20], ebx
jmp 0x1006c08c
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xb8]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1006c07d
mov dword [ebp - 0x20], ebx
jmp 0x1006c0a8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xac], 0x85c2f4fe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1006c097
mov dword [ebp - 0x10], 0x365d
cmp dword [ebp - 0x10], 0x38c0
jle 0x1006c112
mov edi, ebx
mov dword [ebp - 0x2c], ebx
mov esi, ebx
mov ecx, esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x3c], ebx
shl edi, cl
mov eax, edi
mov ecx, 0x1008bbb8
or eax, ebx
cdq
push edx
push eax
call fcn.1001fc14
inc ebx
cmp ebx, 0x69cf
jl 0x1006c0ce
mov edi, dword [ebp - 0x2c]
inc esi
push 0
pop ebx
cmp esi, 0x3aa5
jl 0x1006c0c4
inc edi
mov dword [ebp - 0x2c], edi
cmp edi, 0x4995
jl 0x1006c0c2
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
xor edi, edi
inc edi
or esi, 0xffffffff
mov dword [ebp - 0x20], ebx
jmp 0x1006c12a
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x98]
mov dword [eax + ecx*4], 0xc16b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1006c117
cmp dword [ebp - 0x10], 0x34aa
jge 0x1006c147
mov edx, 0x1000f630
mov ecx, 0x1008bbb8
call fcn.100228da
mov dword [ebp - 0x14], ebx
jmp 0x1006c183
mov dword [ebp - 0x18], 0x70cd
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jne 0x1006c14c
mov eax, dword [ebp - 0x98]
lea ecx, [ebp - 0x98]
inc dword [eax]
call fcn.1001ffb0
lea ecx, [ebp - 0xb8]
mov dword [ebp - 4], esi
call fcn.1001ffb0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x30]
jge 0x1006c65b
mov dword [ebp - 0x2c], 0x32d1
cmp dword [ebp - 0x2c], 0x3510
jle 0x1006c201
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov eax, ebx
mov ecx, 0x1008bbb8
or eax, esi
or eax, edi
cdq
push edx
push eax
call fcn.1001fc14
inc ebx
cmp ebx, 0xd93
jl 0x1006c1cd
inc esi
push 0
pop ebx
cmp esi, 0x685f
jl 0x1006c1ca
inc edi
cmp edi, 0x3b7
jl 0x1006c1c8
xor edi, edi
inc edi
cmp dword [ebp - 0x2c], 0x2f56
mov esi, 0x10093020
mov dword [ebp - 0x18], esi
jge 0x1006c221
mov edx, 0x1000f688
mov ecx, 0x1008bbb8
call fcn.100228da
mov dword [ebp - 0x10], 0x1bf5
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x28], 0xced4
cmp dword [ebp - 0x10], ebx
je 0x1006c24b
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, edi
cmp dword [ebp - 0x1c], ebx
jne 0x1006c24d
mov eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setl cl
cmp ecx, dword [ebp - 0x14]
jl 0x1006c33c
cmp dword [ebp - 0x14], ebx
je 0x1006c33c
mov dword [ebp - 0x1c], 0xb24
cmp dword [ebp - 0x1c], 0xbec
jle 0x1006c2fc
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_RaiseException]
cmp dword [ebp - 0x1c], 0x951
jge 0x1006c310
push 0x1000f6e8
call fcn.100714f3
pop ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], ebx
jmp 0x1006c325
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf0], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1006c318
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
jmp 0x1006c34c
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1006c34c
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov ecx, dword [ebp - 0x34]
test ecx, ecx
jle 0x1006c474
mov edi, dword [esi]
mov dword [ebp - 0x14], 0xac204e2d
mov dword [ebp - 0x10], ebx
jmp 0x1006c376
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x114], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1006c365
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
cmp dword [ebp - 0x14], 0x13
jge 0x1006c3db
mov dword [ebp - 0x10], 0x290be443
mov dword [ebp - 0x10], ebx
jmp 0x1006c3a5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x104], 0xca0029bf
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1006c394
mov dword [ebp - 0x10], ebx
jmp 0x1006c3ca
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1006c3c7
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetWinMetaFileBits]
xor edx, edx
inc edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x1006c3b0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x13
jl 0x1006c388
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x14], ebx
jmp 0x1006c3f1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x114], 0x1b66bafc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1006c3e0
mov dword [ebp - 0x34], 0xe223
mov dword [ebp - 0x1c], 0x6652d0da
mov dword [ebp - 0x28], 0xf7cd95da
mov dword [ebp - 0x28], 0x64c7b7f6
mov dword [ebp - 0x2c], 0x9675
mov dword [ebp - 0x10], ebx
jmp 0x1006c429
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x54], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1006c41f
cmp dword [ebp - 0x34], ebx
je 0x1006c453
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov eax, edx
jmp 0x1006c455
mov eax, ebx
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 4]
add esi, 8
test eax, eax
jne 0x1006c465
add esi, 8
add esi, edi
dec ecx
mov dword [ebp - 0x34], ecx
jne 0x1006c357
mov dword [ebp - 0x18], esi
mov edi, dword [esi]
mov dword [ebp - 0x2c], 0x2181
cmp dword [ebp - 0x2c], 0x22c1
mov dword [ebp - 0x28], edi
jle 0x1006c4f0
mov edx, ebx
mov dword [ebp - 0x34], ebx
mov edi, ebx
mov esi, ebx
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x18c]
and eax, edx
cdq
push edx
push eax
call fcn.10010ffe
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1006c4b2
mov eax, dword [eax]
push eax
call fcn.100714f3
pop ecx
xor eax, eax
lea ecx, [ebp - 0x18c]
push ebx
inc eax
push eax
call fcn.1002065a
mov edx, dword [ebp - 0x34]
inc esi
cmp esi, 0x26bc
jl 0x1006c492
inc edi
cmp edi, 0x1196
jl 0x1006c490
inc edx
mov dword [ebp - 0x34], edx
cmp edx, 0x77ad
jl 0x1006c48e
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 0x1e36
jge 0x1006c504
push 0x1000f728
call fcn.100714f3
pop ecx
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x70]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000fb90]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0xd8]
mov dword [ebp - 0x70], ebx
push eax
push ebx
movdqu xmmword [ebp - 0xd8], xmm0
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
call fcn.10022f98
push 3
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 4
call fcn.1001ff2e
mov dword [ebp - 0x10], ebx
jmp 0x1006c569
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xa8]
mov dword [eax + ecx*4], 0x15d7249a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1006c556
mov eax, dword [ebp - 0x70]
lea ecx, [ebp - 0xa8]
mov dword [eax + 8], ebx
call fcn.1001ffb0
or eax, 0xffffffff
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], eax
call fcn.1001ffb0
cmp dword [ebp - 0x28], 0
jne 0x1006c65b
cmp byte [ebp - 0x35], 0
je 0x1006c5af
xor eax, eax
inc eax
cmp dword [ebp - 0x30], eax
jne 0x1006c5af
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x10]
add dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0xc]
add esi, 0x10
push edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], esi
call fcn.1006ffc8
pop ecx
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x60]
lea eax, [ebp - 0x74]
mov dword [ebp - 0x74], ebx
push eax
push edi
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
call fcn.1006d8cb
mov ecx, ebx
test edi, edi
jle 0x1006c640
mov eax, ecx
and eax, 0x80000001
jns 0x1006c5f8
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x28]
add eax, ecx
add eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x3c]
cdq
idiv edi
mov eax, dword [ebp - 0x60]
cmp word [eax + edx*2], bx
je 0x1006c628
mov esi, eax
lea eax, [edx + 1]
cdq
idiv edi
cmp word [esi + edx*2], bx
jne 0x1006c616
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x60]
xor ebx, ebx
inc ebx
mov word [eax + edx*2], bx
mov al, byte [edx + esi]
mov edx, dword [ebp - 0x30]
push 0
pop ebx
mov byte [ecx + edx], al
inc ecx
cmp ecx, edi
jl 0x1006c5ea
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x60]
mov dword [esi], edi
test eax, eax
je 0x1006c65e
push eax
call fcn.100716c9
pop ecx
jmp 0x1006c65e
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret