Function at 0x10009c6c
Capabilities:
Allocate thread local storage
Connect pipe
Terminate process

Disassembly:
mov eax, 0x10058fa2
call fcn.100586e8
sub esp, 0x1d8
push ebx
push esi
mov dword [ebp - 0xa8], edx
xor ebx, ebx
mov dword [ebp - 0x18], 0x8f4a8fe2
xor edx, edx
push edi
mov dword [ebp - 0x24], 0x24891023
inc edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x18], ebx
jmp 0x10009cba
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4c], 0x53b26bdd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10009cac
mov dword [ebp - 0x4c], ebx
cmp dword [ebp - 0x4c], 0xe
jle 0x10009d40
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x18], 0x5f88e10e
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
shl eax, 2
cmp eax, 0x9ef4a042
push 1
sbb eax, eax
xor ecx, ecx
neg eax
add eax, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
test eax, eax
mov eax, dword [ebp - 0x4c]
setg cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
setl dl
add ecx, edx
neg ecx
pop edx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xfffe
setne al
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x4c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xe
jg 0x10009cc8
mov dword [ebp - 0x80], 0xd030d02
mov byte [ebp - 0x7c], dl
mov byte [ebp - 0x7b], 0xe
mov byte [ebp - 0x7a], dl
mov dword [ebp - 0x79], 0x40005ec
mov dword [ebp - 0x75], 0x3d060d
mov byte [ebp - 0x71], 0x1b
push 0x6f
pop eax
mov word [ebp - 0xe8], ax
mov dword [ebp - 0x24], 0x4615
mov dword [ebp - 0x18], 0xacde9e84
mov dword [ebp - 0x2c], 0xf628
mov dword [ebp - 0x20], 0x78ac
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], 0x642e40c1
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x38], 0xfffc
mov dword [ebp - 0x18], ebx
jmp 0x10009dc4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x128], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10009db7
cmp dword [ebp - 0x24], ebx
je 0x10009e2d
dec dword [ebp - 0x28]
jne 0x10009ddf
imul eax, dword [ebp - 0x20], 0xfffffff6
mov esi, ebx
cmp eax, 7
jbe 0x10009de1
mov esi, edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x128], esi
mov eax, dword [ebp - 0x18]
cmp eax, esi
setne cl
cmp dword [ebp - 0x24], ecx
jl 0x10009e03
mov esi, edx
cmp dword [ebp - 0x20], ebx
jne 0x10009e05
mov esi, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp esi, eax
setl cl
xor eax, eax
cmp ecx, 0x4acc
setl al
add eax, dword [ebp - 0x20]
je 0x10009e2a
cmp dword [ebp - 0x128], ebx
je 0x10009e2a
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov edi, ebx
mov eax, dword [ebp - 0x34]
push 2
mov dword [ebp - 0x30], 6
pop esi
mov dword [ebp - 0x18], ebx
jmp 0x10009e52
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x60], 0x7e2799ac
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10009e44
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x10009e68
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
xor edx, edx
inc edx
mov dword [ebp - 0x60], ebx
jmp 0x10009eb7
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x18], ebx
jmp 0x10009e8a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdc], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10009e79
mov dword [ebp - 0x18], ebx
jmp 0x10009ea6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdc], 0x5b7cefa9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10009e95
cmp dword [ebp - 0xdc], ebx
jne 0x10009ebd
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], 0x16
jge 0x10009e6d
cmp esi, 6
jne 0x10009ec7
push 2
pop edi
jmp 0x10009f43
mov dword [ebp - 0x2c], 0x5568
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x18], ebx
jmp 0x10009ef8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1cc], 0x3111738a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10009ee7
inc dword [ebp - 0x30]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x10009f11
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetRgnBox]
movzx edx, byte [ebp + esi - 0x7f]
mov eax, esi
sub eax, edi
mov edi, ebx
movzx eax, byte [ebp + eax - 0x82]
movzx ecx, word [ebp + eax*2 - 0xec]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x80]
add ecx, edx
mov word [ebp + eax*2 - 0xec], cx
add esi, 2
push 1
pop edx
cmp esi, 0x10
jb 0x10009e3f
mov dword [ebp - 0x2c], 0xfffb
mov dword [ebp - 0x18], ebx
jmp 0x10009f6f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x164], 0xd59e57ad
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10009f5e
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x160], eax
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x10009fae
push 0x1523
push 0x10b1
push 0x244c
push 0x1d09
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
xor eax, eax
mov dword [ebp - 0x130], 7
mov word [ebp - 0xde], ax
lea ecx, [ebp - 0x144]
mov word [ebp - 0x144], ax
lea eax, [ebp - 0xec]
push eax
mov dword [ebp - 0x134], ebx
call fcn.100048cd
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], 0xac64a684
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1000a01b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9c], 0x99244325
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000a00a
mov dword [ebp - 0x20], 0xffffffeb
jmp 0x1000a041
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000a03e
push 0x1411
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffd
je 0x1000a02a
push 2
pop esi
mov dword [ebp - 0x20], esi
mov edi, 0x50cf
cmp dword [ebp - 0x20], ebx
jl 0x1000a27a
mov dword [ebp - 0x2c], 0xe4f9dbc9
mov dword [ebp - 0x38], 0xdf860956
mov dword [ebp - 0x34], 0x4a938f73
mov dword [ebp - 0xb8], edi
mov dword [ebp - 0xb4], edi
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xac], edi
mov dword [ebp - 0x2c], 0x35ff
mov dword [ebp - 0x30], 0x879a2734
mov dword [ebp - 0x30], 0x1220
cmp dword [ebp - 0x30], 0x13b1
jle 0x1000a113
mov esi, ebx
mov dword [ebp - 0x44], ebx
mov edi, ebx
mov dword [ebp - 0x34], ebx
mov eax, esi
mov dword [ebp - 0x2c], ebx
cdq
mov esi, ebx
idiv edi
mov eax, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ebx
mov edi, 0x36e2
xor eax, ebx
mov ecx, 0x10073018
cdq
push edx
push eax
call fcn.1000421d
mov eax, dword [ebp - 0x30]
add ebx, esi
dec edi
jne 0x1000a0c7
inc esi
push 0
pop ebx
cmp esi, 0x23b9
jl 0x1000a0bf
mov edi, dword [ebp - 0x34]
mov esi, dword [ebp - 0x44]
inc edi
mov dword [ebp - 0x34], edi
cmp edi, 0x60e5
jl 0x1000a0b0
inc esi
mov dword [ebp - 0x44], esi
cmp esi, 0x42eb
jl 0x1000a0ab
push 0x2456
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x30], 0x1042
jge 0x1000a155
mov edx, str.rycufzcdf_ruyxs_vvfkilqm_yywzlfan_kcfp_yuhccpfc
mov ecx, 0x10073018
call fcn.100065e2
jmp 0x1000a155
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x9c], ebx
je 0x1000a173
mov dword [ebp - 0x30], 1
cmp dword [ebp - 0x9c], ebx
jne 0x1000a176
mov dword [ebp - 0x30], ebx
inc dword [ebp - 0xb0]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x98]
imul ecx, eax, 0xac8e
mov eax, dword [ebp - 0xc0]
cmp ecx, eax
setl dl
xor eax, eax
cmp edx, 0xe425
setg al
xor edx, edx
cmp eax, 0xd55c
mov eax, dword [ebp - 0x38]
setg dl
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 0x94]
jne 0x1000a1de
cmp dword [ebp - 0x34], ebx
jne 0x1000a1de
mov ecx, ebx
jmp 0x1000a1e1
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x9c]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp eax, ecx
sbb eax, eax
inc eax
shl eax, 3
test eax, eax
je 0x1000a217
cmp dword [ebp - 0xb0], ebx
je 0x1000a217
xor eax, eax
inc eax
jmp 0x1000a219
mov eax, ebx
imul eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
mov byte [ebp - 0x19], bl
je 0x1000a241
cmp byte [ebp - 0x19], 0
je 0x1000a272
push ebx
push ebx
push 0x1595
push ebx
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x1000a272
cmp byte [ebp - 0x19], 0
je 0x1000a272
push ebx
push 0x1aac
push ebx
push ebx
push 0x1f4a
push 0x2573
push 0x92a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
dec dword [ebp - 0x20]
jmp 0x1000a052
xor eax, eax
lea edi, [ebp - 0xec]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x18], 0x46dd
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x20], 0x4be3d0e7
mov dword [ebp - 0x2c], 0x8faa83fb
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x24], ebx
jmp 0x1000a2bf
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd4], 0xfffffffe
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1000a2ae
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x28]
jg 0x1000a2d6
cmp dword [ebp - 0x28], ebx
jne 0x1000a2d6
mov edx, ebx
jmp 0x1000a2d9
xor edx, edx
inc edx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xbebf
jge 0x1000a2f6
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setne dl
add edx, 0xe72c34c4
neg edx
sbb edx, edx
inc edx
cmp edx, 0x9fe9
jne 0x1000a31f
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
test eax, eax
mov dword [ebp - 0xcc], eax
setne cl
xor eax, eax
cmp ecx, 0x5ad3
sete al
cmp eax, dword [ebp - 0x20]
jg 0x1000a354
cmp dword [ebp - 0x20], ebx
jne 0x1000a354
mov ecx, ebx
jmp 0x1000a357
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x2c]
imul eax, ecx
cmp eax, 0x2c21
jge 0x1000a3c9
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000a375
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov dword [ebp - 0x20], ebx
jmp 0x1000a3c2
mov dword [ebp - 0x28], ebx
jmp 0x1000a3b0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0xd4]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd4], ecx
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000a3ad
push 0x1562
push 0xce2
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x1000a37f
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xd4]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x1000a37a
jmp 0x1000a401
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x18], ebx
jmp 0x1000a3f5
mov dword [ebp - 0x2c], 0xfffffff9
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000a3f2
push ebx
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x37
jg 0x1000a3d5
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x17c]
call fcn.10007198
xor edx, edx
mov byte [ebp - 4], 3
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x1000a42c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x48], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1000a41e
mov dword [ebp - 0x20], ebx
jmp 0x1000a443
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x188], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1000a436
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], 0x16
jge 0x1000a4ec
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], 0xfffffffd
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18], 0x1511ebc0
sub eax, 0xfff7
neg eax
sbb eax, eax
add eax, 0xffff0002
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x18]
sub eax, 0x3a6c3797
cmp eax, 0xfffc
ja 0x1000a496
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp eax, 0xfffffff9
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
cmp edx, eax
setl cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x184], edx
mov eax, dword [ebp - 0x48]
cmp eax, 0x59951ea6
setg cl
xor eax, eax
cmp ecx, edx
setg al
add eax, 5
jne 0x1000a4d6
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x16
jl 0x1000a456
xor edx, edx
inc edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x2c], 0x498d
dec dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
je 0x1000a58a
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x24], ebx
jmp 0x1000a52a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa4], 0xc3a23fe5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1000a519
cmp dword [ebp - 0x18], 0xf34bdac8
sbb eax, eax
inc eax
sub eax, 0x3628c20e
je 0x1000a543
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0xa4], esi
mov eax, dword [ebp - 0x18]
cmp eax, edx
setg cl
xor edx, edx
cmp ecx, 0x6ddcd166
setg dl
xor eax, eax
cmp esi, edx
setg al
cmp dword [ebp - 0x24], eax
jge 0x1000a580
cmp dword [ebp - 0x24], ebx
je 0x1000a580
xor eax, eax
inc eax
jmp 0x1000a582
mov eax, ebx
push 2
mov dword [ebp - 0x18], eax
pop esi
jmp 0x1000a59e
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000a59e
push 0x254d
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
jmp 0x1000a5be
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1a4], 0x7786
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1000a5ad
mov dword [ebp - 0x18], ebx
jmp 0x1000a624
mov dword [ebp - 0x20], 7
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1a4], 0x8f0d
imul ecx, dword [ebp - 0x20], 0x8f0e
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x20]
cmp edx, 0x95a
setge cl
xor eax, eax
imul ecx, dword [ebp - 0x20]
test ecx, ecx
sets al
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
test eax, eax
sets cl
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x1000a5c9
push 0x5c
pop eax
mov dword [ebp - 0x58], 0xb037900
mov edi, esi
mov word [ebp - 0x54], 0xecc7
mov ecx, ebx
mov word [ebp - 0x5c], ax
cmp edi, esi
jne 0x1000a64d
push 4
pop ecx
push ecx
pop edi
jmp 0x1000a674
movzx edx, byte [ebp + edi - 0x57]
mov eax, edi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x5a]
movzx eax, word [ebp + eax*2 - 0x5c]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + edi - 0x58]
mov word [ebp + eax*2 - 0x5c], cx
mov ecx, ebx
add edi, esi
cmp edi, 6
jb 0x1000a642
xor eax, eax
mov word [ebp - 0x5a], ax
mov dword [ebp - 0x34], 0x1742
cmp dword [ebp - 0x34], 0x1788
jle 0x1000a6e1
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x30], ebx
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x1e4]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000a6b4
mov eax, dword [eax]
push eax
call fcn.100402ac
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x1e4]
call fcn.10004889
mov ecx, dword [ebp - 0x30]
inc ecx
mov dword [ebp - 0x30], ecx
cmp ecx, 0x577e
jl 0x1000a698
inc edi
cmp edi, 0x5906
jl 0x1000a693
cmp dword [ebp - 0x34], 0x171d
jge 0x1000a6f5
push str.eheauqikc_jgafanl_wjxrwari_fdyq_kdz_edzh_skg_qcox_grpzk_hhmjh_ovr_rhq
call fcn.100402ac
pop ecx
push 3
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x24], ebx
jmp 0x1000a70d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x90], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 1
jl 0x1000a700
cmp dword [ebp - 0x90], ebx
je 0x1000a79a
mov dword [ebp - 0x20], 0xffffffff
mov eax, 0x88e1b61b
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x20], ebx
jmp 0x1000a766
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000a753
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x118], 1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1000a744
mov dword [ebp - 0x20], ebx
jmp 0x1000a793
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000a790
push 0x126a
push 0xdc2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1000a770
jmp 0x1000a7b7
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000a7b7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
xor eax, eax
mov dword [ebp - 0xf8], 7
mov word [ebp - 0x10c], ax
lea ecx, [ebp - 0x10c]
lea eax, [ebp - 0x5c]
mov dword [ebp - 0xfc], ebx
push eax
call fcn.100048cd
mov byte [ebp - 4], 6
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], 0x1e87df2f
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], 0x1fc3eee2
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x2c], 0xb4b13281
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x24], ebx
jmp 0x1000a837
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1c0], 0x32a831d2
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1000a826
inc dword [ebp - 0x30]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x2c], 0xc5a3d7f1
mov dword [ebp - 0x20], 0xee49
mov dword [ebp - 0x38], 0x6aed1d25
mov dword [ebp - 0x30], 0x223b
cmp dword [ebp - 0x30], 0x231f
jle 0x1000a89f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov edi, ebx
mov dword [ebp - 0x2c], ebx
mov eax, ebx
mov ecx, 0x10073018
or eax, edi
cdq
push edx
push eax
call fcn.1000421d
inc ebx
cmp ebx, 0x5ea7
jl 0x1000a879
inc edi
push 0
pop ebx
cmp edi, 0x1d05
jl 0x1000a876
mov dword [ebp - 0x34], 0x51dd2e9
mov byte [ebp - 4], 7
cmp dword [ebp - 0x30], 0x1f4e
jge 0x1000a8e3
mov edx, str.rqisnnm_edum_mskn_tkrfpx_qdycnv_haczxv_ulxpmihk_uhfheo
mov ecx, 0x10073018
call fcn.100065e2
jmp 0x1000a8e3
mov dword [ebp - 4], 6
mov dword [ebp - 0x2c], 0xad7494df
mov dword [ebp - 0x24], ebx
jmp 0x1000a907
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x194], 1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1000a8f6
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000a924
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
xor ecx, ecx
mov dword [ebp - 0x18c], ebx
mov eax, dword [ebp - 0x18]
mov edi, esi
test eax, eax
mov dword [ebp - 0x30], edi
push 0x5f
sets cl
mov dword [ebp - 0x34], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x34]
cmp eax, 0x4132
mov eax, dword [ebp - 0x38]
setle cl
xor edx, edx
cmp ecx, eax
mov ecx, ebx
pop eax
setne dl
sub edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], edx
mov byte [ebp - 0x50], bl
mov word [ebp - 0x4f], 0x101
mov byte [ebp - 0x4d], 0x49
mov word [ebp - 0x64], ax
cmp edi, esi
jne 0x1000a97f
mov ecx, esi
mov edi, esi
jmp 0x1000aa43
movzx edx, byte [ebp + edi - 0x4f]
mov eax, edi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x52]
movzx ecx, word [ebp + eax*2 - 0x64]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + edi - 0x50]
add ecx, edx
mov word [ebp + eax*2 - 0x64], cx
mov dword [ebp - 0x2c], 0x19e5
cmp dword [ebp - 0x2c], 0x426
jge 0x1000aa41
lea eax, [ebp - 0x84]
mov dword [ebp - 0x44], ebx
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x84], ebx
push eax
push str._ld__ld_n
call fcn.10040562
mov eax, dword [ebp - 0x44]
add esp, 0xc
mov ecx, ebx
mov dword [ebp - 0x24], ecx
test eax, eax
je 0x1000aa1c
mov edi, ebx
dec eax
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x8c]
push eax
push 0x10062028
call fcn.10040562
add edi, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
test eax, eax
jne 0x1000a9e9
mov dword [ebp - 0x24], edi
mov edi, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x44], eax
test ecx, ecx
jns 0x1000aa26
neg ecx
mov eax, ecx
cdq
idiv dword [ebp - 0x84]
test edx, edx
je 0x1000aa34
inc eax
push eax
push str._ld_n
call fcn.100402ac
pop ecx
pop ecx
mov ecx, ebx
add edi, esi
mov dword [ebp - 0x30], edi
cmp edi, 4
jb 0x1000a972
xor eax, eax
mov word [ebp - 0x62], ax
mov dword [ebp - 0x28], 0x6ce125d1
push 3
mov dword [ebp - 0x18], 0x5a42069
mov dword [ebp - 0x20], ebx
pop ecx
jmp 0x1000aa7b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x70], 1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000aa6d
mov dword [ebp - 0x20], ebx
jmp 0x1000aa96
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1b4], 1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000aa85
mov dword [ebp - 0x28], ebx
jmp 0x1000aaaf
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x70], 0xf251d69f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1000aaa1
mov dword [ebp - 0x28], ebx
jmp 0x1000ac29
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x70], ebx
je 0x1000ab35
mov dword [ebp - 0x18], 0xe9fb
mov dword [ebp - 0x24], ebx
jmp 0x1000aae5
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa0], 0x818264d9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 1
jl 0x1000aad4
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x70], ebx
je 0x1000aaf7
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x70]
cmp dword [ebp - 0x68], eax
jge 0x1000ab1a
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
cmp eax, 0x7d437f1b
setg cl
mov dword [ebp - 0xa0], ecx
jmp 0x1000abb4
mov dword [ebp - 0x18], 0xc3e5f88
mov dword [ebp - 0x24], ebx
jmp 0x1000ab52
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf4], 0x9025b0d6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1000ab41
cmp dword [ebp - 0x18], ebx
jne 0x1000ab7c
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x6c]
cmp ecx, eax
setge dl
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jne 0x1000ab7c
mov edx, ebx
jmp 0x1000ab7f
xor edx, edx
inc edx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
push 0
mov eax, dword [ebp + eax*4 - 0x70]
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0xf4]
neg ecx
sbb ecx, ecx
inc ecx
pop ecx
setns cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xf0]
setl dl
imul eax, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], ebx
jmp 0x1000ac21
mov dword [ebp - 0x24], 0x1cd05094
xor edx, edx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x24], 0x2e525b78
mov eax, dword [ebp - 0x28]
push 2
mov ecx, dword [ebp + eax*4 - 0x70]
test ecx, ecx
mov eax, dword [ebp - 0x28]
setne dl
mov dword [ebp + eax*4 - 0x70], ecx
xor ecx, ecx
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x1b0], esi
mov eax, dword [ebp - 0x2c]
cmp edx, eax
mov eax, dword [ebp - 0x28]
setl cl
sub eax, ecx
xor ecx, ecx
cmp eax, 0x7283
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
imul ecx, esi
pop esi
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1000abb9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x1000aabc
xor eax, eax
mov dword [ebp - 0x148], 7
mov word [ebp - 0x15c], ax
lea ecx, [ebp - 0x15c]
lea eax, [ebp - 0x64]
mov dword [ebp - 0x14c], ebx
push eax
call fcn.100048cd
mov byte [ebp - 4], 9
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x20], 0xd3f5047c
mov dword [ebp - 0x28], 0x32a2
cmp dword [ebp - 0x28], 0x35ee
jle 0x1000ad08
mov eax, ebx
mov dword [ebp - 0x24], ebx
mov edi, ebx
mov dword [ebp - 0x18], ebx
cdq
idiv edi
mov dword [ebp - 0x30], ebx
mov ecx, edx
mov dword [ebp - 0x34], ecx
mov edi, ebx
mov ebx, dword [ebp - 0x30]
lea eax, [edi + ebx]
or eax, ecx
mov ecx, 0x10073018
cdq
push edx
push eax
call fcn.1000421d
mov ecx, dword [ebp - 0x34]
inc edi
cmp edi, 0x15d8
jl 0x1000ac96
inc ebx
push 0
mov dword [ebp - 0x30], ebx
cmp ebx, 0x3074
pop ebx
jl 0x1000ac91
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x38d8
jl 0x1000ac86
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x5e78
jl 0x1000ac81
push 0xce0
push 0x3db
push 0x2527
push 0x109e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov dword [ebp - 0x24], 0xfffffffc
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x28], 0x3297
jge 0x1000ad4c
mov edx, str.ckmnbi_zjtpjtqb_mxctdqhmc_ssj_dwmwk_anpbyq_xbmndicr_rwpxwyeq
mov ecx, 0x10073018
call fcn.100065e2
jmp 0x1000ad4c
mov dword [ebp - 4], 9
mov dword [ebp - 0x18], 0xb243e5ec
mov dword [ebp - 0x18], 0xe289
mov dword [ebp - 0x28], 0xc5c6a81d
mov dword [ebp - 0x30], 0x898a8014
mov dword [ebp - 0x24], ebx
jmp 0x1000ad82
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x40], 0x56915a13
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1000ad74
cmp dword [ebp - 0x40], ebx
jne 0x1000ae29
mov eax, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, 0x6a37d7c8
mov edx, dword [ebp - 0x40]
setge al
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x3c]
cmp edx, eax
sete cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setl dl
sub eax, 0x8217c712
add eax, edx
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
test eax, eax
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
sub eax, ecx
cmp eax, 0xfffffffa
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x40]
je 0x1000ae16
cmp dword [ebp - 0x20], ebx
jne 0x1000ae16
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x40], 0x37b1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jne 0x1000ae29
mov eax, ebx
jmp 0x1000ae2c
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
add ecx, 0x4bab92a1
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x3c], ebx
je 0x1000ae74
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
push dword [ebp - 0xfc]
cmp dword [ebp - 0xf8], 8
lea eax, [ebp - 0x10c]
push ebx
cmovae eax, dword [ebp - 0x10c]
lea ecx, [ebp - 0x17c]
push eax
call fcn.1000b3fe
cmp eax, 0xffffffff
je 0x1000aece
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x15c]
push ecx
push 1
push eax
lea ecx, [ebp - 0x17c]
call fcn.1000b10a
jmp 0x1000ae88
mov ecx, dword [ebp - 0x88]
lea eax, [ebp - 0x17c]
push eax
lea edx, [ebp - 0x144]
call fcn.1000b4a1
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x15c]
call fcn.10004955
push ebx
push 1
lea ecx, [ebp - 0x10c]
call fcn.10004955
push ebx
push 1
lea ecx, [ebp - 0x17c]
call fcn.10004955
push ebx
push 1
lea ecx, [ebp - 0x144]
call fcn.10004955
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x88]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret