Function at 0x10008010
Capabilities:
Create directory
Create mailslot
Extract resource via kernel32 functions
Get common file path
Get file attributes
Get geographical location
Get system firmware table
Manipulate console buffer
Read .ini file
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c0
mov dword [ebp - 0xa8], 0x10
mov eax, dword [0x1005f354]
mov dword [ebp - 0xac], eax
cmp dword [ebp + 8], 0
je 0x100081db
push 0
call dword [sym.imp.GDI32.dll_EndPath]
push 0
call dword [sym.imp.KERNEL32.dll_FlsGetValue]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupWrite]
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_LineDDA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_AddFontMemResourceEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TrySubmitThreadpoolCallback]
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPreferredUILanguages]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtTextOutW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemGeoID]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
push 0
call dword [sym.imp.GDI32.dll_StrokePath]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_LPtoDP]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapeParameters]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PolyBezierTo]
push 0
push 0
push 0
push 0x10069288
push 0
push 0x100692ac
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatEx]
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteBoundaryDescriptor]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RtlUnwind]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
lock dec dword [ecx]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesExW]
call dword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
jmp 0x100081f2
mov edx, 4
imul eax, edx, 0x94
mov ecx, dword [0x1005f364]
mov edx, dword [ecx + eax]
mov dword [ebp + 8], edx
mov dword [ebp - 0x60], 0
jmp 0x10008204
mov eax, dword [ebp - 0x60]
add eax, 1
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x100
jge 0x10008b1b
mov ecx, dword [ebp - 0x60]
mov dl, byte [ebp - 0x60]
mov byte [ebp + ecx - 0x1c0], dl
mov dword [ebp - 0x1c], 0x427
mov dword [ebp - 0x2c], 0x1e2b
mov dword [ebp - 0x10], 0x224e
mov dword [ebp - 0x18], 0x1051
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x24], 0xd5b
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x1339
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x1c5a
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x28], 0x243c
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x24]
and ecx, 0x80000001
jns 0x100082ef
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x100082fe
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
jmp 0x100082df
mov eax, dword [ebp - 0x34]
add eax, 0xc53
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x50]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x34]
add edx, 0xc59
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x38]
add ecx, 0xcdb
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x1ee0
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x50]
and eax, 0x80000001
jns 0x1000839f
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x100083ae
mov ecx, dword [ebp - 0x50]
add ecx, 1
mov dword [ebp - 0x50], ecx
jmp 0x10008390
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x34]
sub eax, 0x1e44
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x63a
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x17b4
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x23c3
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x50]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
add eax, 0x412
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x130b
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x1c]
sub eax, 0xbc4
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0xf7
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x2c]
add ecx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x8d9
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x2c]
add eax, 0x5a4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x20]
sub eax, 0xc8f
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x2116
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x6c], 0
jmp 0x10008508
mov edx, dword [ebp - 0x6c]
add edx, 1
mov dword [ebp - 0x6c], edx
cmp dword [ebp - 0x6c], 0x55
jge 0x10008519
mov eax, dword [ebp - 0x28]
sub eax, 9
mov dword [ebp - 0x28], eax
jmp 0x100084ff
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
add eax, 0x1756
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x50]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x50]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x24]
add eax, 0xb1d
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x34]
add edx, 0x1637
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x34]
add eax, 0x17ac
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x18]
add edx, 0x20b6
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x188f
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x34]
sub eax, 0x162c
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0xf5e
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x20]
add eax, 0x2663
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x50]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0x1d6f
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0x10e7
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x34]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x38]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
add edx, 0x27e
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x12fa
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x17d3
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x50]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x9f8
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x70], 0
jmp 0x1000869f
mov edx, dword [ebp - 0x70]
add edx, 1
mov dword [ebp - 0x70], edx
cmp dword [ebp - 0x70], 0x5c
jge 0x100086b0
mov eax, dword [ebp - 0x10]
add eax, 6
mov dword [ebp - 0x10], eax
jmp 0x10008696
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x28]
sub edx, 0x1d97
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x38]
sub ecx, 0x507
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x74], 0
jmp 0x100086ec
mov edx, dword [ebp - 0x74]
add edx, 1
mov dword [ebp - 0x74], edx
cmp dword [ebp - 0x74], 0x28
jge 0x100086fd
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
jmp 0x100086e3
mov ecx, dword [ebp - 0x24]
sub ecx, 0xc12
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x1c]
add edx, 0x1c9f
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0xcb9
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x1899
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x20]
add edx, 0x1e50
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x10]
add eax, 0x255a
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x1270
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
and edx, 0x80000001
jns 0x1000877b
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x1000878c
mov eax, dword [ebp - 0x20]
add eax, 0xe1f
mov dword [ebp - 0x20], eax
jmp 0x10008798
mov ecx, dword [ebp - 0x20]
sub ecx, 0xe1f
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
sub eax, 0x10aa
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x10]
and ecx, 0x80000003
jns 0x100087bc
dec ecx
or ecx, 0xfffffffc
inc ecx
test ecx, ecx
je 0x100087cc
mov edx, dword [ebp - 0x10]
sub edx, 0x1055
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x20]
sub eax, 0xe5d
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
and ecx, 0x80000001
jns 0x100087e7
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x100087f9
mov edx, dword [ebp - 0x10]
sub edx, 0x2697
mov dword [ebp - 0x10], edx
jmp 0x10008804
mov eax, dword [ebp - 0x10]
add eax, 0x2697
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x4fd
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
and edx, 0x80000001
jns 0x10008820
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x1000882f
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
jmp 0x10008810
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x50]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
add eax, 0x1986
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x8fe
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x18]
sub edx, 0x17cd
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x78], 0
jmp 0x10008876
mov eax, dword [ebp - 0x78]
add eax, 1
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x16
jge 0x10008887
mov ecx, dword [ebp - 0x10]
add ecx, 9
mov dword [ebp - 0x10], ecx
jmp 0x1000886d
mov edx, dword [ebp - 0x18]
add edx, 0x1c7f
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x28]
add eax, 0x1398
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x50]
and ecx, 0x80000001
jns 0x100088ae
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x100088bd
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x50], edx
jmp 0x1000889e
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x5c9
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
and eax, 0x80000001
jns 0x100088ea
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x100088f9
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
jmp 0x100088db
mov edx, dword [ebp - 0x28]
add edx, 0x5ec
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0xa28
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x18]
sub eax, 0x872
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x5a4
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x7c], 0
jmp 0x1000894c
mov edx, dword [ebp - 0x7c]
add edx, 1
mov dword [ebp - 0x7c], edx
cmp dword [ebp - 0x7c], 0x12
jge 0x1000895d
mov eax, dword [ebp - 0x2c]
sub eax, 4
mov dword [ebp - 0x2c], eax
jmp 0x10008943
mov ecx, dword [ebp - 0x28]
sub ecx, 0x730
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
sub eax, 0x347
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x213a
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x50]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x100089ac
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x50], edx
jmp 0x10008992
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x1d9f
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x38]
sub ecx, 0x1a2b
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x10]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x100089f9
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x100089df
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x405
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x34]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
add eax, 0x419
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x50]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
add eax, 0x1309
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
and eax, 0x80000001
jns 0x10008a60
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10008a70
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x252d
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x2c]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0xe32
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10008aba
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x10008aa0
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x1571
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x80], 0
jmp 0x10008b05
mov eax, dword [ebp - 0x80]
add eax, 1
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x5a
jge 0x10008b16
mov ecx, dword [ebp - 0x1c]
sub ecx, 6
mov dword [ebp - 0x1c], ecx
jmp 0x10008afc
jmp 0x100081fb
mov edx, 4
imul eax, edx, 0x62
mov ecx, dword [0x1005f348]
mov edx, dword [ecx + eax]
mov dword [ebp + 0xc], edx
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x5c], 0
jmp 0x10008b48
mov eax, dword [ebp - 0x5c]
add eax, 1
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x100
jge 0x100091a6
cmp dword [0x10040b04], 0x27a9314f
jne 0x10008da6
push 0
call dword [sym.imp.GDI32.dll_EndDoc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_FillRgn]
push 0
push 0
push 0x100692dc
push 0
call dword [sym.imp.KERNEL32.dll_GetFileMUIInfo]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleActiveScreenBuffer]
push 0
call dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor ecx, ecx
lock inc dword [ecx]
mov edx, dword [ebp - 0xbc]
mov dword [ebp - 0xa0], edx
push 0
mov eax, dword [ebp - 0xa0]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
call dword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
push 0
push 0
push 0
push 0x1006930c
push 0
push 0x10069334
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatEx]
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0
push 0
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
call dword [sym.imp.GDI32.dll_GetTextCharset]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadThreadProfilingData]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetWorldTransform]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberOfConsoleMouseButtons]
push 0
call dword [sym.imp.GDI32.dll_FillPath]
push 0
push 0
push 0x10069368
push 0
push 0
push 0
push 0
push 0x1006939c
call dword [sym.imp.KERNEL32.dll_GetDurationFormatEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
mov ecx, dword [ebp - 0xc0]
mov dword [ebp - 0xa4], ecx
mov edx, dword [ebp - 0xa4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolTimer]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 0
call dword [sym.imp.GDI32.dll_SetMiterLimit]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EraseTape]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
mov eax, dword [ebp - 0x5c]
movzx ecx, byte [ebp + eax - 0x1c0]
add ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x5c]
cdq
idiv dword [ebp - 0xa8]
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax + edx]
add ecx, edx
and ecx, 0x800000ff
jns 0x10008dd7
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x3c], 0x266a
mov eax, dword [ebp - 0x3c]
add eax, 0x2469
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], 0x195e
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x40]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0x1106
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x30], 0x97a
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x44]
and ecx, 0x80000003
jns 0x10008e3a
dec ecx
or ecx, 0xfffffffc
inc ecx
test ecx, ecx
je 0x10008e50
cmp dword [ebp - 0x44], 0
jle 0x10008e50
mov edx, dword [ebp - 0x44]
add edx, 0x24de
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x40]
add eax, 0x15bb
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x44]
add ecx, dword [ebp - 0x54]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x54]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10008e99
cmp dword [ebp - 0x30], 0
jle 0x10008e99
mov edx, dword [ebp - 0x30]
add edx, 0xbab
mov dword [ebp - 0x30], edx
jmp 0x10008ea4
mov eax, dword [ebp - 0x30]
sub eax, 0xbab
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0x180e
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x3c]
sub edx, 0xf40
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x30]
add eax, 0x1744
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x48]
sub ecx, 0xe90
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x3c]
add edx, 0x36d
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x84], 0
jmp 0x10008efa
mov eax, dword [ebp - 0x84]
add eax, 1
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x38
jge 0x10008f0e
mov ecx, dword [ebp - 0x40]
sub ecx, 5
mov dword [ebp - 0x40], ecx
jmp 0x10008eeb
mov edx, dword [ebp - 0x48]
add edx, 0x5e9
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x3c]
sub eax, 0x1bb8
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x1269
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x40]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10008f4c
mov edx, dword [ebp - 0x40]
sub edx, 0x8b0
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x3c]
sub eax, 0x3a
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x44]
add ecx, 0x1995
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x30]
add edx, 0x10ab
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0x358
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x3c]
add edx, 0x14d9
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x40]
sub ecx, dword [ebp - 0x54]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x30]
add edx, dword [ebp - 0x40]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x44]
add ecx, dword [ebp - 0x54]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x30]
add edx, dword [ebp - 0x40]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x48]
sub eax, 0xe55
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x44]
sub ecx, 0x7b8
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x44]
add edx, dword [ebp - 0x3c]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
sub eax, 0x270
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x40]
sub ecx, 0x1e06
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x3c]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x40]
add ecx, dword [ebp - 0x44]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x44]
add edx, dword [ebp - 0x40]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x88], 0
jmp 0x10009043
mov ecx, dword [ebp - 0x88]
add ecx, 1
mov dword [ebp - 0x88], ecx
cmp dword [ebp - 0x88], 0x5b
jge 0x10009057
mov edx, dword [ebp - 0x40]
add edx, 3
mov dword [ebp - 0x40], edx
jmp 0x10009034
mov eax, dword [ebp - 0x30]
add eax, 0x24b9
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0xef9
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x44]
add edx, dword [ebp - 0x48]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x30]
sub eax, 0x26ab
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x54]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x3c]
sub edx, 0x2109
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x44]
add eax, 0x488
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x44]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x8c], 0
jmp 0x100090c6
mov edx, dword [ebp - 0x8c]
add edx, 1
mov dword [ebp - 0x8c], edx
cmp dword [ebp - 0x8c], 0x4c
jge 0x100090da
mov eax, dword [ebp - 0x30]
sub eax, 3
mov dword [ebp - 0x30], eax
jmp 0x100090b7
mov ecx, dword [ebp - 0x48]
sub ecx, 0x1a5
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x48]
add edx, dword [ebp - 0x48]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
add eax, 0x2218
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x30]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
add edx, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x48]
sub eax, 0x1f02
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x40]
add ecx, dword [ebp - 0x54]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x3c]
add edx, 0x4a2
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
sub eax, 0xd14
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x44]
sub ecx, 0xd06
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x48]
sub edx, dword [ebp - 0x40]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x44]
sub eax, 0x218f
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x40]
add ecx, 0x123c
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x30]
sub edx, 0xa70
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x54]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x48]
add ecx, dword [ebp - 0x54]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x48]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x1c0]
push edx
call fcn.10007910
add esp, 0xc
jmp 0x10008b3f
mov dword [ebp - 0x64], 0
cmp dword [0x10040b04], 0x72ae599f
jne 0x100093a7
push 0
call dword [sym.imp.KERNEL32.dll_LocalHandle]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetWinMetaFileBits]
push 0
call dword [sym.imp.GDI32.dll_BeginPath]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileTransactedW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryProtectedPolicy]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtFloodFill]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_Pie]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileIoOverlappedRange]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
call dword [sym.imp.GDI32.dll_EndPath]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_EnumEnhMetaFile]
push 0
push 0
push 0x100693d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateScalableFontResourceW]
push 0
push 0
push 0
push 0
push 0x100693e8
push 0
push 0x10069410
push 0
push 0x10069434
call dword [sym.imp.KERNEL32.dll_CompareStringEx]
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextStreamW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileBandwidthReservation]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetTextExtentPointI]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PowerSetRequest]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharWidth32W]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetFontData]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x68], 0
jmp 0x100093c0
mov eax, dword [ebp - 0x68]
add eax, 1
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x68]
cmp ecx, dword [ebp - 0xac]
jge 0x10009eba
mov edx, dword [ebp - 0x64]
add edx, 1
and edx, 0x800000ff
jns 0x100093e5
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 4], 0x25dd
mov dword [ebp - 8], 0x963
mov dword [ebp - 0x14], 0xc57
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x1623
mov dword [ebp - 0x4c], 0x1114
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x4c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x90], 0
jmp 0x1000944a
mov ecx, dword [ebp - 0x90]
add ecx, 1
mov dword [ebp - 0x90], ecx
cmp dword [ebp - 0x90], 0x4d
jge 0x1000945e
mov edx, dword [ebp - 0x4c]
sub edx, 1
mov dword [ebp - 0x4c], edx
jmp 0x1000943b
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x1de3
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x1f6e
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x7dd
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
sub edx, 0x6b0
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x4c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, 0xd64
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
and ecx, 0x80000003
jns 0x100094d6
dec ecx
or ecx, 0xfffffffc
inc ecx
test ecx, ecx
je 0x100094ec
cmp dword [ebp - 0xc], 0
jle 0x100094ec
mov edx, dword [ebp - 0xc]
add edx, 0x1aa4
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 0x13e
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x97
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
sub eax, 0x10bd
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x12a0
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 0x94], 0
jmp 0x10009551
mov ecx, dword [ebp - 0x94]
add ecx, 1
mov dword [ebp - 0x94], ecx
cmp dword [ebp - 0x94], 0x4e
jge 0x10009565
mov edx, dword [ebp - 8]
add edx, 4
mov dword [ebp - 8], edx
jmp 0x10009542
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x1be6
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x1482
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x6a2
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x93f
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x1d9a
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
sub edx, 0x1087
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x6be
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x719
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
add eax, 0x1a62
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x4c]
and ecx, 0x80000003
jns 0x1000961e
dec ecx
or ecx, 0xfffffffc
inc ecx
test ecx, ecx
je 0x10009634
cmp dword [ebp - 0x4c], 0
jle 0x10009634
mov edx, dword [ebp - 0x4c]
sub edx, 0x711
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 4]
sub eax, 0xf7
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, 0x23fe
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
sub edx, 0xba3
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, 0x1df8
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
sub edx, 0x1ac1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 0x105
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x166f
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x1130
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
and ecx, 0x80000003
jns 0x100096cf
dec ecx
or ecx, 0xfffffffc
inc ecx
test ecx, ecx
je 0x100096e7
cmp dword [ebp - 4], 0
jle 0x100096e7
mov edx, dword [ebp - 4]
add edx, 0x1e55
mov dword [ebp - 4], edx
jmp 0x100096f2
mov eax, dword [ebp - 4]
sub eax, 0x1e55
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x10c9
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x4c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x4c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
sub edx, 0x177a
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
sub eax, 0x2596
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x1b4a
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
add eax, 0x1c93
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
and ecx, 0x80000001
jns 0x10009760
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x1000976f
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x10009750
mov eax, dword [ebp - 4]
add eax, 0x13f1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0xd67
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x6c4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
sub ecx, 0xd97
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x2316
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
add eax, 0x1670
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x5f
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
sub eax, 0x1cb4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x11df
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x5a4
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
add edx, 0x1c0d
mov dword [ebp - 8], edx
mov dword [ebp - 0x98], 0
jmp 0x10009845
mov eax, dword [ebp - 0x98]
add eax, 1
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x44
jge 0x10009859
mov ecx, dword [ebp - 4]
sub ecx, 3
mov dword [ebp - 4], ecx
jmp 0x10009836
mov edx, dword [ebp - 8]
sub edx, 0xe86
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x4c]
and edx, 0x80000003
jns 0x10009887
dec edx
or edx, 0xfffffffc
inc edx
test edx, edx
je 0x10009896
mov eax, dword [ebp - 0x4c]
add eax, 0x1e34
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x4c]
and edx, 0x80000001
jns 0x100098af
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x100098c6
cmp dword [ebp - 0x4c], 0
jle 0x100098c6
mov eax, dword [ebp - 0x4c]
sub eax, 0x5df
mov dword [ebp - 0x4c], eax
jmp 0x100098d2
mov ecx, dword [ebp - 0x4c]
add ecx, 0x5df
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 4]
sub edx, 0x1bda
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0x240b
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
add eax, 0x1cc4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x24cc
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
sub eax, 0x5af
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x1e00
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x4c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
add eax, 0x1573
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x1544
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10009990
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
jmp 0x10009976
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, 0x13ee
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, 0x13b
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0xd9b
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0xd6
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x9c], 0
jmp 0x10009a06
mov eax, dword [ebp - 0x9c]
add eax, 1
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x1e
jge 0x10009a1a
mov ecx, dword [ebp - 0x4c]
add ecx, 8
mov dword [ebp - 0x4c], ecx
jmp 0x100099f7
mov edx, dword [ebp - 4]
add edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, 0xc74
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x82a
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, 0x247b
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, 0xaec
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x176c
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
add eax, 0x1361
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0x14]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10009a95
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
jmp 0x10009a7b
mov eax, dword [ebp - 0xc]
sub eax, 0x1d4c
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x211
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x1f19
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, 0x1b58
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, 0xe96
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, 0xa20
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
and edx, 0x80000001
jns 0x10009afc
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x10009b13
cmp dword [ebp - 0xc], 0
jle 0x10009b13
mov eax, dword [ebp - 0xc]
add eax, 0x2429
mov dword [ebp - 0xc], eax
jmp 0x10009b1f
mov ecx, dword [ebp - 0xc]
sub ecx, 0x2429
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0xbf3
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
sub eax, 0x1eb3
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, 0x42a
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 0x14f7
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, 0x1337
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x138f
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x4c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
add eax, 0x1351
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x2411
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
sub eax, 0x72a
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
add eax, 0x434
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x64]
movzx eax, byte [ebp + edx - 0x1c0]
add eax, dword [ebp - 0x58]
and eax, 0x800000ff
jns 0x10009bdb
dec eax
or eax, 0xffffff00
inc eax
mov dword [ebp - 0x58], eax
mov ecx, dword [0x10040b04]
xor edx, edx
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0xb4], edx
cmp dword [ebp - 0xb8], 0xe4224e2d
jne 0x10009e51
cmp dword [ebp - 0xb4], 0
jne 0x10009e51
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_MoveToEx]
push 0
call dword [sym.imp.KERNEL32.dll_SetUserGeoID]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateFontW]
push 0
call dword [sym.imp.KERNEL32.dll_LocalHandle]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexExW]
push 0
call dword [sym.imp.KERNEL32.dll_GetPhysicallyInstalledSystemMemory]
push 0
call dword [sym.imp.GDI32.dll_GetBkMode]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRasterizerCaps]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 0
call dword [sym.imp.KERNEL32.dll_UnregisterBadMemoryNotification]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0
call dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
push 0
call dword [sym.imp.KERNEL32.dll_GetDynamicTimeZoneInformation]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetOutlineTextMetricsW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumLanguageGroupLocalesW]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push 0
call dword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileBits]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_TextOutW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferInfoEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexExW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PolyBezier]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetClipRgn]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
push 0
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push 0
call dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeServerSessionId]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetupComm]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateTapePartition]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x64]
push ecx
lea edx, [ebp - 0x1c0]
push edx
call fcn.10007910
add esp, 0xc
mov eax, dword [ebp - 0x64]
movzx ecx, byte [ebp + eax - 0x1c0]
mov edx, dword [ebp - 0x58]
movzx eax, byte [ebp + edx - 0x1c0]
add ecx, eax
and ecx, 0x800000ff
jns 0x10009e90
dec ecx
or ecx, 0xffffff00
inc ecx
movzx ecx, byte [ebp + ecx - 0x1c0]
mov dword [ebp - 0xb0], ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x68]
movzx eax, byte [edx]
xor eax, dword [ebp - 0xb0]
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x68]
mov byte [ecx], al
jmp 0x100093b7
mov esp, ebp
pop ebp
ret