Function at 0x101614b0
Capabilities:
Create process on windows
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101aac71
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x10222354]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1b0], ecx
mov dword [ebp - 0x1ac], 0
push 0x101e5688
push 0x101e568c
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x3c]
call eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x80]
push ecx
call fcn.1016680a
add esp, 4
test eax, eax
je 0x10161530
mov edx, dword [ebp - 0x80]
push edx
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0x1c]
call fcn.101139c0
mov dword [ebp - 0x30], eax
jmp 0x1016156d
mov ecx, dword [ebp - 0x1b0]
add ecx, 0x3c
push ecx
mov edx, esp
mov dword [ebp - 0x138], esp
push ecx
mov ecx, edx
call fcn.1000b9e0
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0x1c]
call fcn.101138e0
mov dword [ebp - 0x1b8], eax
mov ecx, dword [ebp - 0x1b8]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x1b0]
call fcn.10162420
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0x40]
push ecx
push 9
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ebp - 0x1b0]
mov eax, dword [edx + 0x1c]
add eax, 0xc4
mov edx, dword [ecx + 0xc4]
mov ecx, eax
mov eax, dword [edx + 0xbc]
call eax
lea ecx, [ebp - 0x28]
call fcn.1000b9c0
mov dword [ebp - 4], 0
movzx ecx, byte [ebp - 0x1d]
test ecx, ecx
jne 0x10161644
mov edx, dword [ebp - 0x1b0]
mov eax, dword [edx + 0x40]
push eax
push 9
mov ecx, dword [ebp - 0x1b0]
add ecx, 0x2c
push ecx
mov edx, esp
mov dword [ebp - 0x13c], esp
push ecx
mov ecx, edx
call fcn.1000b9e0
mov dword [ebp - 0x1bc], eax
lea eax, [ebp - 0x140]
push eax
mov ecx, dword [ebp - 0x1b0]
mov ecx, dword [ecx + 0x1c]
call fcn.10114bc0
mov dword [ebp - 0x1c0], eax
mov edx, dword [ebp - 0x1c0]
mov dword [ebp - 0x1c4], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c4]
push eax
lea ecx, [ebp - 0x28]
call fcn.10007b80
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140]
call fcn.1000ba80
jmp 0x10161656
mov ecx, dword [ebp - 0x1b0]
add ecx, 0x2c
push ecx
lea ecx, [ebp - 0x28]
call fcn.10007b80
mov edx, dword [ebp - 0x30]
push edx
lea ecx, [ebp - 0x144]
call fcn.10007b00
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x1cc], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1cc]
push ecx
lea ecx, [ebp - 0x44]
call fcn.1001d870
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x144]
call fcn.10009fb0
cmp dword [ebp + 8], 0
je 0x101616b0
mov edx, dword [ebp + 8]
sub edx, 0xc4
mov dword [ebp - 0x1d0], edx
jmp 0x101616ba
mov dword [ebp - 0x1d0], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x148], esp
lea eax, [ebp - 0x28]
push eax
call fcn.1000b9e0
mov dword [ebp - 0x1d4], eax
lea ecx, [ebp - 0x64]
push ecx
mov ecx, dword [ebp - 0x1d0]
call fcn.1011d1d0
mov dword [ebp - 0x1d8], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c]
call fcn.10016fb0
mov byte [ebp - 4], 6
push str.Content_Type:_application_x_www_form_urlencoded_n
lea ecx, [ebp - 0x2c]
call fcn.1000ba00
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2c]
call fcn.10007f90
push eax
lea ecx, [ebp - 0x14c]
call fcn.10007b00
mov dword [ebp - 0x1dc], eax
mov edx, dword [ebp - 0x1dc]
mov dword [ebp - 0x1e0], edx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x1e0]
push eax
lea ecx, [ebp - 0x7c]
call fcn.1001d870
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x14c]
call fcn.10009fb0
mov ecx, dword [ebp - 0x1b0]
add ecx, 0x30
call fcn.10007f90
push eax
lea ecx, [ebp - 0x150]
call fcn.10007b00
mov dword [ebp - 0x1e4], eax
mov ecx, dword [ebp - 0x1e4]
mov dword [ebp - 0x1e8], ecx
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x1e8]
push edx
lea ecx, [ebp - 0x54]
call fcn.1001d870
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x150]
call fcn.10009fb0
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x70]
call eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x1b0]
xor edx, edx
cmp dword [ecx + 0x44], 0
setne dl
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ecx + 0x424]
mov byte [eax + 0x5c0], dl
push 0x101e570c
mov ecx, dword [ebp - 0x1b0]
add ecx, 0x28
push ecx
call fcn.10007f70
add esp, 8
movzx edx, al
test edx, edx
jne 0x10161905
mov eax, dword [ebp - 0x80]
push eax
call fcn.1016680a
add esp, 4
test eax, eax
jne 0x101618f9
push str.true
mov ecx, dword [ebp - 0x1b0]
add ecx, 0x28
push ecx
call fcn.10007f70
add esp, 8
movzx edx, al
test edx, edx
jne 0x10161905
push 0x101e5724
push ecx
mov ecx, esp
mov dword [ebp - 0x158], esp
push 0x101e5728
call fcn.1000ba00
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x1f0], eax
mov byte [ebp - 4], 0xe
push ecx
mov ecx, esp
mov dword [ebp - 0x15c], esp
push 0x101e572c
call fcn.1000ba00
mov dword [ebp - 0x1f4], eax
mov ecx, dword [ebp - 0x1f4]
mov dword [ebp - 0x1f8], ecx
mov byte [ebp - 4], 0xf
push ecx
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x101e5730
call fcn.1000ba00
mov dword [ebp - 0x1fc], eax
lea edx, [ebp - 0x164]
push edx
mov byte [ebp - 4], 0xd
call fcn.100dd430
add esp, 0x10
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x204], eax
mov ecx, dword [ebp - 0x1ac]
or ecx, 1
mov dword [ebp - 0x1ac], ecx
mov edx, dword [ebp - 0x204]
push edx
call fcn.10007f70
add esp, 8
movzx eax, al
test eax, eax
je 0x101618f9
mov ecx, dword [ebp - 0x1b0]
add ecx, 0x28
call fcn.10008000
movzx ecx, al
test ecx, ecx
jne 0x10161905
mov dword [ebp - 0x208], 0
jmp 0x1016190f
mov dword [ebp - 0x208], 1
mov dl, byte [ebp - 0x208]
mov byte [ebp - 0x151], dl
mov eax, dword [ebp - 0x1ac]
and eax, 1
je 0x10161938
and dword [ebp - 0x1ac], 0xfffffffe
lea ecx, [ebp - 0x164]
call fcn.1000ba80
movzx ecx, byte [ebp - 0x151]
test ecx, ecx
je 0x10161970
mov edx, dword [ebp - 0x1b0]
mov ecx, dword [edx + 0x1c]
call fcn.10113260
push 5
push 0
mov eax, dword [ebp - 0x30]
push eax
push str.iexplore.exe
push 0x101e575c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x101622ab
push str.modaldialog
mov ecx, dword [ebp - 0x1b0]
add ecx, 0x28
push ecx
call fcn.10007f70
add esp, 8
movzx edx, al
test edx, edx
je 0x10161a53
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0x1c]
push ecx
mov edx, dword [ebp - 0x1b0]
add edx, 0x38
push ecx
mov ecx, esp
mov dword [ebp - 0x168], esp
push edx
call fcn.1000b9e0
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x210], eax
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x1b0]
add ecx, 0x34
push ecx
mov edx, esp
mov dword [ebp - 0x16c], esp
push ecx
mov ecx, edx
call fcn.1000b9e0
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x218], eax
mov byte [ebp - 4], 0x11
push ecx
mov ecx, esp
mov dword [ebp - 0x170], esp
mov edx, dword [ebp - 0x3c]
push edx
call fcn.1000ba00
mov dword [ebp - 0x21c], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xe4]
call fcn.100acd60
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 0x12
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0xe4]
call fcn.10163750
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xe4]
call fcn.100ad170
jmp 0x101622ab
push str.minibrowser
mov eax, dword [ebp - 0x1b0]
add eax, 0x28
push eax
call fcn.10007f70
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10161c3f
mov edx, dword [ebp - 0x1b0]
mov ecx, dword [edx + 0x1c]
call fcn.1012d7a0
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0x1c]
cmp dword [ecx + 0x3d0], 0
je 0x10161b42
mov edx, dword [ebp - 0x1b0]
mov eax, dword [edx + 0x1c]
mov ecx, dword [eax + 0x3d0]
mov ecx, dword [ecx + 0x24c]
add ecx, 0xc0
call fcn.10018010
mov dword [ebp - 0x224], eax
mov edx, dword [ebp - 0x224]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x224]
push ecx
mov edx, dword [eax + 0x38]
call edx
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ecx + 0x3d0]
mov ecx, dword [edx + 0x24c]
add ecx, 0xc0
call fcn.10018010
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x228]
push edx
mov eax, dword [ebp - 0x228]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xd0]
call edx
push 5
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0x1c]
mov ecx, dword [ecx + 0x3d0]
add ecx, 4
call fcn.10009080
jmp 0x10161c3a
push 0x254
call fcn.1016683f
add esp, 4
mov dword [ebp - 0x178], eax
mov byte [ebp - 4], 0x13
cmp dword [ebp - 0x178], 0
je 0x10161c0b
mov edx, dword [ebp - 0x1b0]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp - 0x1b0]
add ecx, 0x38
push ecx
mov edx, esp
mov dword [ebp - 0x17c], esp
push ecx
mov ecx, edx
call fcn.1000b9e0
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x1b0]
add ecx, 0x34
push ecx
mov edx, esp
mov dword [ebp - 0x180], esp
push ecx
mov ecx, edx
call fcn.1000b9e0
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x238], eax
mov byte [ebp - 4], 0x15
push ecx
mov ecx, esp
mov dword [ebp - 0x184], esp
mov edx, dword [ebp - 0x3c]
push edx
call fcn.1000ba00
mov dword [ebp - 0x23c], eax
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x178]
call fcn.100ccb50
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x244], eax
jmp 0x10161c15
mov dword [ebp - 0x244], 0
mov ecx, dword [ebp - 0x244]
mov dword [ebp - 0x174], ecx
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x1b0]
mov eax, dword [edx + 0x1c]
mov ecx, dword [ebp - 0x174]
mov dword [eax + 0x3d0], ecx
jmp 0x101622ab
push str.flashbrowser
mov edx, dword [ebp - 0x1b0]
add edx, 0x28
push edx
call fcn.10007f70
add esp, 8
movzx eax, al
test eax, eax
je 0x10161cce
mov dword [ebp - 0x188], 0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x54]
call fcn.10016fd0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x7c]
call fcn.10016fd0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2c]
call fcn.1000ba80
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c]
call fcn.10016fd0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x64]
call fcn.10016fd0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.10016fd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000ba80
mov eax, dword [ebp - 0x188]
jmp 0x10162357
push 0x101e57b4
mov ecx, dword [ebp - 0x1b0]
add ecx, 0x28
push ecx
call fcn.10007f70
add esp, 8
movzx edx, al
test edx, edx
je 0x10161f76
lea ecx, [ebp - 0x28]
call fcn.10008000
movzx eax, al
test eax, eax
jne 0x10161f76
mov ecx, dword [ebp - 0x1b0]
cmp dword [ecx + 0x48], 0
je 0x10161da9
mov edx, dword [ebp - 0x1b0]
mov ecx, dword [edx + 0x48]
add ecx, 0x30
call fcn.10008fd0
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10161d40
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0x48]
add ecx, 0x2c
call fcn.100add30
mov ecx, dword [ebp - 0x1b0]
mov edx, dword [ecx + 0x48]
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0x48]
mov edx, dword [edx]
push ecx
mov eax, dword [edx + 8]
call eax
mov ecx, dword [ebp - 0x1b0]
mov edx, dword [ecx + 0x48]
mov dword [ebp - 0x190], edx
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
je 0x10161d9f
push 1
mov ecx, dword [ebp - 0x18c]
add ecx, 0x2c
mov edx, dword [ebp - 0x18c]
mov eax, dword [edx + 0x2c]
mov edx, dword [eax + 4]
call edx
mov dword [ebp - 0x248], eax
jmp 0x10161da9
mov dword [ebp - 0x248], 0
push 0xc8
call fcn.1016683f
add esp, 4
mov dword [ebp - 0x198], eax
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x198], 0
je 0x10161de6
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0x1c]
push ecx
mov ecx, dword [ebp - 0x198]
call fcn.100d1790
mov dword [ebp - 0x24c], eax
jmp 0x10161df0
mov dword [ebp - 0x24c], 0
mov edx, dword [ebp - 0x24c]
mov dword [ebp - 0x194], edx
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x194]
mov dword [eax + 0x48], ecx
mov edx, dword [ebp - 0x1b0]
mov eax, dword [edx + 0x1c]
mov ecx, dword [ebp - 0x1b0]
mov edx, dword [ecx + 0x48]
mov dword [eax + 0x42c], edx
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0x48]
mov dword [ecx + 0xb8], 1
mov edx, dword [ebp - 0x1b0]
mov eax, dword [edx + 0x48]
mov byte [eax + 0xb5], 1
mov ecx, dword [ebp - 0x1b0]
mov edx, dword [ecx + 0x1c]
mov eax, dword [edx + 0x424]
mov ecx, dword [ebp - 0x1b0]
mov edx, dword [ecx + 0x48]
mov eax, dword [eax + 0x5b8]
mov dword [edx + 0xa4], eax
call fcn.100bcde0
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 1
mov dword [ebp - 0xe8], 1
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x19c], esp
push 0
call fcn.10008f80
push 0x200
push 0x40010000
push str.about:blank
push ecx
mov ecx, esp
mov dword [ebp - 0x1a0], esp
lea edx, [ebp - 0xf4]
push edx
call fcn.10008f60
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0x1c]
add ecx, 4
call fcn.10008fd0
push eax
mov ecx, dword [ebp - 0x1b0]
mov ecx, dword [ecx + 0x48]
call fcn.100d1cf0
push 5
mov edx, dword [ebp - 0x1b0]
mov eax, dword [edx + 0x48]
mov ecx, dword [eax + 0x30]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push 5
mov edx, dword [ebp - 0x1b0]
mov ecx, dword [edx + 0x48]
add ecx, 0x30
call fcn.10008fd0
push eax
call dword [sym.imp.USER32.dll_GetWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0x48]
add ecx, 0xc0
call fcn.10018010
mov dword [ebp - 0x250], eax
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx]
mov eax, dword [edx + 0xd0]
call eax
mov dword [ebp - 0x68], eax
jmp 0x101622ab
push str.default_browser
mov ecx, dword [ebp - 0x1b0]
add ecx, 0x28
push ecx
call fcn.10007f70
add esp, 8
movzx edx, al
test edx, edx
je 0x10161fb0
push 1
push 0
push 0
mov eax, dword [ebp - 0x30]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x101622ab
push 0x101e580c
mov ecx, dword [ebp - 0x1b0]
add ecx, 0x28
push ecx
call fcn.10007f70
add esp, 8
movzx edx, al
test edx, edx
je 0x10162078
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x80
je 0x10162078
mov dword [ebp - 0xf8], 0
mov ecx, dword [ebp - 0x1b0]
mov ecx, dword [ecx + 0x1c]
call fcn.10113260
cmp dword [ebp + 8], 0
je 0x10162015
mov edx, dword [ebp + 8]
sub edx, 0xc4
mov dword [ebp - 0x254], edx
jmp 0x1016201f
mov dword [ebp - 0x254], 0
push 0xffffffffffffffff
lea eax, [ebp - 0xf8]
push eax
call fcn.10119ac0
add esp, 8
test eax, eax
je 0x1016205f
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xf8]
push edx
mov eax, dword [ecx + 0xd0]
call eax
mov ecx, dword [ebp - 0xf8]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xf8]
push eax
mov ecx, dword [edx + 8]
call ecx
jmp 0x101622ab
push str.default
mov edx, dword [ebp - 0x1b0]
add edx, 0x28
push edx
call fcn.10007f70
add esp, 8
movzx eax, al
test eax, eax
je 0x10162123
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x80
je 0x10162123
call fcn.100e08e0
cmp eax, 1
jne 0x10162123
lea ecx, [ebp - 0x10c]
call fcn.10016fb0
mov byte [ebp - 4], 0x17
lea edx, [ebp - 0x10c]
push edx
push 3
lea ecx, [ebp - 0x10c]
call fcn.10163710
mov dword [ebp - 0x104], 0x800
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [eax + 0xd0]
call edx
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x10c]
call fcn.10016fd0
jmp 0x101622ab
mov eax, dword [ebp - 0x1b0]
xor ecx, ecx
cmp dword [eax + 0x44], 0
setne cl
mov edx, dword [ebp - 0x1b0]
mov eax, dword [edx + 0x1c]
mov edx, dword [eax + 0x424]
mov byte [edx + 0x5c0], cl
mov ecx, dword [ebp - 0x1b0]
add ecx, 0x30
call fcn.10007f90
push eax
lea ecx, [ebp - 0x1a4]
call fcn.10007b00
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x11c]
call fcn.1001d870
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x1a4]
call fcn.10009fb0
push str.newtab
mov edx, dword [ebp - 0x1b0]
add edx, 0x28
push edx
call fcn.10007f70
add esp, 8
movzx eax, al
test eax, eax
je 0x1016222f
call fcn.100e08e0
cmp eax, 1
jne 0x1016222f
lea ecx, [ebp - 0x134]
call fcn.10016fb0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x134]
push ecx
push 3
lea ecx, [ebp - 0x134]
call fcn.10163710
mov dword [ebp - 0x12c], 0x800
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x134]
push edx
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [edx + 0xd0]
call ecx
mov dword [ebp - 0x120], eax
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x134]
call fcn.10016fd0
jmp 0x1016229c
lea ecx, [ebp - 0x28]
call fcn.10008000
movzx edx, al
test edx, edx
je 0x1016226e
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [eax + 0xd0]
call edx
mov dword [ebp - 0x120], eax
jmp 0x1016229c
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [eax + 0xd0]
call edx
mov dword [ebp - 0x120], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x11c]
call fcn.10016fd0
cmp dword [ebp - 0x80], 0
je 0x101622c5
mov eax, dword [ebp - 0x80]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0xa8]
call eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0xa8]
call edx
push 0x101e583c
push 0x101e5840
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x44]
call eax
mov dword [ebp - 0x1a8], 0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x54]
call fcn.10016fd0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x7c]
call fcn.10016fd0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2c]
call fcn.1000ba80
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c]
call fcn.10016fd0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x64]
call fcn.10016fd0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.10016fd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000ba80
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8