Function at 0x10006990
Capabilities:
Check for debugger via api
Check for unexpected memory writes
Create directory
Create process on windows
Create thread
Delete directory
Delete file
Enumerate files on windows
Enumerate gui resources
Get common file path
Get disk information
Get disk size
Get file size
Get geographical location
Get uefi variable
Identify system language via api
Manipulate console buffer
Query environment variable
Read .ini file
Read file on windows
Set console window title
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
cmp dword [ebp + 8], 0
je 0x10006c20
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetPixel]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
push 0
push 0
push 0x10090f34
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0
call dword [sym.imp.KERNEL32.dll_HeapLock]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FlsSetValue]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0
push 0x10090f58
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetWorldTransform]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateDIBSection]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProximityNode]
push 0
push 0x10090f74
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePrivateNamespaceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EraseTape]
push 0
call dword [sym.imp.GDI32.dll_GetLayout]
push 0
push 0
push 0
push 0
push 0x10090f9c
push 0
push 0x10090fbc
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolTimer]
push 0
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockShared]
push 0
push 0x10090ff0
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
push 0
call dword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapValidate]
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x78], eax
push 0
mov ecx, dword [ebp - 0x78]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
push 0
push 0
push 0
push 0x10091018
push 0
call dword [sym.imp.KERNEL32.dll_GetStringScripts]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push 0
push 0
call dword [sym.imp.GDI32.dll_ResetDCW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharWidthI]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesExW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 0xa4]
mov dword [ebp - 0x7c], edx
mov eax, dword [ebp - 0x7c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddResourceAttributeAce]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolIo]
push 0
push 0
call dword [sym.imp.GDI32.dll_ResetDCW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_FrameRgn]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp 0x10006c36
mov ecx, 4
imul edx, ecx, 0xe5
mov eax, dword [0x10087b5c]
mov ecx, dword [eax + edx]
mov dword [ebp + 8], ecx
mov byte [0x10037b00], 0
mov byte [ebp - 0x4d], 0
mov dword [ebp - 0x40], 0
jmp 0x10006c53
mov edx, dword [ebp - 0x40]
add edx, 8
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
cmp eax, dword [0x10087b4c]
jae 0x10008192
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 4]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x10], 0x2284
mov edx, dword [ebp - 0x10]
and edx, 0x80000001
jns 0x10006c8f
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x10006ca4
cmp dword [ebp - 0x10], 0
jle 0x10006ca4
mov eax, dword [ebp - 0x10]
sub eax, 0xa2b
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0x2352
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x54], 0
jmp 0x10006ccd
mov edx, dword [ebp - 0x54]
add edx, 1
mov dword [ebp - 0x54], edx
cmp dword [ebp - 0x54], 0x27
jge 0x10006cde
mov eax, dword [ebp - 4]
add eax, 6
mov dword [ebp - 4], eax
jmp 0x10006cc4
mov dword [ebp - 0xc], 0x12ce
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x28], 0x2477
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x58], 0
jmp 0x10006d10
mov eax, dword [ebp - 0x58]
add eax, 1
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0x2f
jge 0x10006d21
mov ecx, dword [ebp - 0x28]
sub ecx, 5
mov dword [ebp - 0x28], ecx
jmp 0x10006d07
mov dword [ebp - 0x14], 0x2469
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x1bd6
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x1698
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
sub eax, 0xe59
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x2244
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x65
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
add edx, 0x2534
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
add eax, 0x1991
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
and ecx, 0x80000001
jns 0x10006daa
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x10006dba
mov edx, dword [ebp - 8]
sub edx, 0x1b8a
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x169e
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x1332
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
add ecx, 0x623
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x5c], 0
jmp 0x10006e37
mov edx, dword [ebp - 0x5c]
add edx, 1
mov dword [ebp - 0x5c], edx
cmp dword [ebp - 0x5c], 0x2f
jge 0x10006e48
mov eax, dword [ebp - 0x28]
add eax, 4
mov dword [ebp - 0x28], eax
jmp 0x10006e2e
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x1982
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add eax, 0xda4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
and eax, 0x80000001
jns 0x10006e89
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10006e9f
cmp dword [ebp - 8], 0
jle 0x10006e9f
mov ecx, dword [ebp - 8]
add ecx, 0x1658
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
sub eax, 0x1665
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x962
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x15d5
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
add eax, 0x26b8
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x28]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x7ab
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
add eax, 0xe26
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x136
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
sub eax, 0x77f
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x43c
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
sub edx, 0x5e0
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, 0x194e
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x1949
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
sub eax, 0x13
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x3b3
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 0x60], 0
jmp 0x10006fbe
mov ecx, dword [ebp - 0x60]
add ecx, 1
mov dword [ebp - 0x60], ecx
cmp dword [ebp - 0x60], 0x63
jge 0x10006fcf
mov edx, dword [ebp - 4]
add edx, 2
mov dword [ebp - 4], edx
jmp 0x10006fb5
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10006ff2
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x10006fd8
mov eax, dword [ebp - 4]
add eax, 0x1ba1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, 0x23c7
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 4
mov dword [ebp - 0x38], 0
cmp dword [0x10037b08], 0x50106070
jne 0x100071ab
push 0
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemRegistryQuota]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateDiscardableBitmap]
push 0
push 0
push 0x1009103c
push 0
call dword [sym.imp.KERNEL32.dll_GetFileMUIInfo]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
push 0
push 0x10091064
call dword [sym.imp.KERNEL32.dll_LoadModule]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddVectoredContinueHandler]
push 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadThreadProfilingData]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFlags]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetPixelV]
push 0
call dword [sym.imp.GDI32.dll_EndPage]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_Chord]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetMetaRgn]
push 0
call dword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_MoveToEx]
call dword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
push 0
call dword [sym.imp.KERNEL32.dll_FlsAlloc]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0
call dword [sym.imp.KERNEL32.dll_AddSecureMemoryCacheCallback]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov edx, dword [ebp - 0x70]
lea eax, [edx*4 + 0x1f]
mov dword [ebp - 0x38], eax
jmp 0x100071c3
mov ecx, dword [ebp - 0x38]
sub ecx, 1
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], 0xffffffff
je 0x10007f52
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x4c], 0
mov edx, dword [ebp - 0x44]
mov eax, dword [edx]
mov dword [ebp - 0x74], eax
cmp dword [0x10037b08], 0x3d69b0e9
jne 0x10007390
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Wow64GetThreadSelectorEntry]
push 0
call dword [sym.imp.GDI32.dll_FillPath]
push 0
push 0
push 0
push 0x1009107c
push 0
push 0x100910a0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatEx]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRasterizerCaps]
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMaximum]
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0x80], ecx
mov edx, dword [ebp - 0x80]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
push 0
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 0
call dword [sym.imp.KERNEL32.dll_LocalHandle]
push 0
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push 0
call dword [sym.imp.KERNEL32.dll_GetTapeStatus]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetTextAlign]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
push 0
call dword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
push 0
call dword [sym.imp.GDI32.dll_CloseFigure]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddIntegrityLabelToBoundaryDescriptor]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiberEx]
push 0
call dword [sym.imp.KERNEL32.dll_QueryDepthSList]
push 0
call dword [sym.imp.GDI32.dll_GdiSetBatchLimit]
push 0
call dword [sym.imp.GDI32.dll_FillPath]
push 0
call dword [sym.imp.KERNEL32.dll_FatalExit]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
shl ecx, 6
mov dword [ebp - 0x3c], ecx
cmp dword [0x10037b08], 0x2ebd6c49
jne 0x10007535
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupSeek]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 0
call dword [sym.imp.KERNEL32.dll_GetTapeStatus]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
call dword [sym.imp.KERNEL32.dll_GetTapeStatus]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineTransform]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetDIBitsToDevice]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetMetaRgn]
push 0
call dword [sym.imp.KERNEL32.dll_FatalExit]
mov edx, dword [ebp - 0x44]
mov eax, dword [edx]
shr eax, 8
mov dword [ebp - 0x4c], eax
mov ecx, 4
imul edx, ecx, 0xd6
mov eax, dword [0x10087b48]
mov ecx, dword [eax + edx]
mov dword [ebp - 0x84], ecx
mov ecx, dword [ebp - 0x3c]
xor ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x38]
xor edx, edx
div dword [ebp - 0x70]
mov eax, dword [ebp - 0x84]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x3c], ecx
cmp dword [0x10037b08], 0x1c68e365
jne 0x100077d9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetupComm]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_EnumEnhMetaFile]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RtlUnwind]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_LineDDA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
push 0
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharWidthW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileNameW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexExW]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineTransform]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
push 0
call dword [sym.imp.GDI32.dll_EndPage]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharWidth32W]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetDCPenColor]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0x1009112c
call dword [sym.imp.KERNEL32.dll_IsValidLocaleName]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateEllipticRgn]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PatBlt]
push 0
call dword [sym.imp.GDI32.dll_PathToRegion]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetMetaRgn]
push 0
call dword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
push 0
call dword [sym.imp.GDI32.dll_GetDCBrushColor]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileTransactedW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push 0
call dword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
call dword [sym.imp.GDI32.dll_GetBkMode]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileTransactedW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetTextExtentExPointW]
xor ecx, ecx
lock dec dword [ecx]
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetGlyphIndicesW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
push 0
call dword [sym.imp.GDI32.dll_GetLayout]
push 0
call dword [sym.imp.GDI32.dll_StrokeAndFillPath]
call dword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PowerClearRequest]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateDiscardableBitmap]
mov edx, dword [ebp - 0x44]
mov eax, dword [edx]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
cmp dword [0x10037b08], 0x3b5bfddf
jne 0x10007a3b
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpool]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLongPathNameTransactedW]
push 0
call dword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
push 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWriteWatch]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
call dword [sym.imp.GDI32.dll_GdiFlush]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetBkMode]
push 0
call dword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov dword [ebp - 0xac], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeServerProcessId]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PlayEnhMetaFileRecord]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetBitmapDimensionEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
push 0
push 0x10091158
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsNLSDefinedString]
push 0
push 0
push 0
push 0x10091180
push 0
push 0x100911b4
call dword [sym.imp.KERNEL32.dll_GetNumberFormatEx]
push 0
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0x100911e0
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolWaitEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentConsoleFontEx]
call dword [sym.imp.KERNEL32.dll_GetSystemDEPPolicy]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPreferredUILanguages]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
push 0
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PrefetchVirtualMemory]
push 0
push 0x1009120c
push 0
call dword [sym.imp.KERNEL32.dll_IsValidNLSVersion]
push 0
call dword [sym.imp.GDI32.dll_BeginPath]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
call dword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryTransactedW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_StretchBlt]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SelectPalette]
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebp - 0x4c]
add ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
cmp dword [0x10037b08], 0x6110cf7d
jne 0x10007d0a
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0x88], edx
push 0
mov eax, dword [ebp - 0x88]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolStackInformation]
push 0
push 0
push 0
push 0
push 0
push 0x10091248
push 0
call dword [sym.imp.KERNEL32.dll_GetFileMUIPath]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_OffsetViewportOrgEx]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PowerSetRequest]
mov ecx, dword [ebp - 0xb4]
mov dword [ebp - 0x8c], ecx
push 0
mov edx, dword [ebp - 0x8c]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
push 0
push 0
push 0
push 0
push 0x10091278
call dword [sym.imp.KERNEL32.dll_FindFirstStreamTransactedW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyMetaFileW]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PtVisible]
push 0
call dword [sym.imp.KERNEL32.dll_IsThreadpoolTimerSet]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessorSystemCycleTime]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessGroupAffinity]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetMailslotInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeaps]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetTextExtentExPointI]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLocaleName]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x90], eax
push 0
mov ecx, dword [ebp - 0x90]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push 0
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLongPathNameTransactedW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesTransactedW]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PolyPolyline]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddVectoredContinueHandler]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetPixel]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeServerProcessId]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileById]
push 0
call dword [sym.imp.KERNEL32.dll_ApplicationRecoveryInProgress]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetColorAdjustment]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov edx, dword [ebp - 0xbc]
mov dword [ebp - 0x94], edx
mov eax, dword [ebp - 0x94]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
push 0
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov ecx, dword [ebp - 0x48]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x48]
mov dword [eax], edx
mov dword [ebp - 0x20], 0xe7e
mov dword [ebp - 0x30], 0x23ff
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x30]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x34], 0
mov edx, dword [ebp - 0x48]
mov eax, dword [edx]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x24], 0x4ee
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x68], 0x1907
mov dword [ebp - 0x2c], 0
mov edx, dword [ebp - 0x2c]
add edx, 0x211b
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x2c]
add eax, 0x261
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x9c], 0
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0xa3a
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x24]
sub eax, 0x818
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
and ecx, 0x80000003
jns 0x10007dbd
dec ecx
or ecx, 0xfffffffc
inc ecx
test ecx, ecx
je 0x10007dd5
cmp dword [ebp - 0x18], 0
jle 0x10007dd5
mov edx, dword [ebp - 0x18]
add edx, 0x2060
mov dword [ebp - 0x18], edx
jmp 0x10007de0
mov eax, dword [ebp - 0x18]
sub eax, 0x2060
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x2fc
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x20]
add edx, 0x501
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x2c]
add eax, 0x219d
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x68]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
add eax, 0xa81
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x98]
mov dword [ecx], edx
mov eax, dword [ebp - 0x20]
add eax, 0x1bf0
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0x750
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x30]
add eax, 0xdb5
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x30]
sub edx, 0x946
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0xc24
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0x1ce6
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x24]
sub eax, 0x1f9
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x534
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x9c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x64], 0
jmp 0x10007ed3
mov edx, dword [ebp - 0x64]
add edx, 1
mov dword [ebp - 0x64], edx
cmp dword [ebp - 0x64], 0x28
jge 0x10007ee4
mov eax, dword [ebp - 0x1c]
sub eax, 2
mov dword [ebp - 0x1c], eax
jmp 0x10007eca
mov ecx, dword [ebp - 0x18]
add ecx, 0x10ad
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x68]
sub edx, 0x1c7c
mov dword [ebp - 0x68], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x74]
mov dword [ecx], edx
mov eax, dword [ebp - 0x1c]
add eax, 0x117d
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x6c], 0
jmp 0x10007f33
mov edx, dword [ebp - 0x6c]
add edx, 1
mov dword [ebp - 0x6c], edx
cmp dword [ebp - 0x6c], 0x61
jge 0x10007f44
mov eax, dword [ebp - 0x34]
sub eax, 7
mov dword [ebp - 0x34], eax
jmp 0x10007f2a
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x18], ecx
jmp 0x100071ba
cmp dword [0x10037b08], 0x7310c887
jne 0x1000818d
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
push 0
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleOriginalTitleW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
call dword [sym.imp.KERNEL32.dll_QueryUnbiasedInterruptTime]
xor edx, edx
xor eax, eax
lock xadd dword [eax], edx
push 0
call dword [sym.imp.GDI32.dll_DeleteMetaFile]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFlags]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolIo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_FillRgn]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetFontUnicodeRanges]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharWidthI]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PolylineTo]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
push 0
call dword [sym.imp.GDI32.dll_GetTextColor]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
push 0
call dword [sym.imp.GDI32.dll_GetStretchBltMode]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64SuspendThread]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetFontUnicodeRanges]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_PowerCreateRequest]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_IntersectClipRect]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRecoveryCallback]
xor ecx, ecx
lock inc dword [ecx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLanguageGroup]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64SuspendThread]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetColorAdjustment]
push 0
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolIoCallbacks]
jmp 0x10006c4a
mov esp, ebp
pop ebp
ret