Function at 0x10016195
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10064e9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x30], ecx
inc edi
mov dword [esp + 0x24], edx
xor ebx, ebx
lea ecx, [esp + 0x70]
push edi
mov dword [esp + 0x30], ebx
call fcn.10007996
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0x8876942a
mov dword [esp + 0x18], 0x8ef6b8f
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], 0xc90d2972
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], 9
mov dword [esp + 0xc], 0x2d7c
cmp dword [esp + 0xc], 0x2e3d
jle 0x10016295
mov edi, ebx
mov esi, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], 0x5d20
mov ecx, ebx
mov eax, esi
shl eax, cl
lea ecx, [esp + 0x8c]
or eax, edi
cdq
push edx
push eax
call fcn.10001aad
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001624e
mov eax, dword [eax]
push eax
call fcn.1004da5d
pop ecx
push 0
push 1
lea ecx, [esp + 0x94]
call fcn.10007f12
inc ebx
cmp ebx, 0x7f62
jl 0x1001622d
dec esi
dec dword [esp + 0x14]
push 0
pop ebx
jne 0x1001622d
mov esi, dword [esp + 0x10]
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x3bf0
jl 0x10016221
inc edi
cmp edi, 0x892
jl 0x1001621b
xor edi, edi
inc edi
push 3
pop esi
push esi
lea ecx, [esp + 0x5c]
call fcn.10007996
cmp dword [esp + 0xc], 0x2ae3
jge 0x100162b7
push str.njofjm_abkj_twxnkzw
call fcn.1004da5d
pop ecx
push edi
lea ecx, [esp + 0x50]
mov dword [esp + 0x130], edi
call fcn.10007996
mov dword [esp + 0xc], ebx
jmp 0x100162e1
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x110], 9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x100162ce
mov dword [esp + 0xc], ebx
jmp 0x10016301
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x70]
mov dword [eax + ecx*4], 0x50bf
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x100162ee
mov dword [esp + 0xc], ebx
jmp 0x10016320
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xd4], 0xdfd94759
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001630d
mov dword [esp + 0xc], ebx
jmp 0x1001633b
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x58]
mov dword [eax + ecx*4], esi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001632c
mov dword [esp + 0xc], ebx
jmp 0x10016356
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x4c]
mov dword [eax + ecx*4], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10016347
mov eax, dword [esp + 0x58]
dec dword [eax]
mov dword [esp + 0xc], ebx
jmp 0x100163d2
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x10016382
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x34], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10016376
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov dword [esp + 0x10], ebx
jmp 0x100163c8
mov dword [esp + 0x14], 0x4a1cf041
mov dword [esp + 0x18], 0xffffffff
inc dword [esp + 0x14]
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jl 0x100163c4
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x18], edi
inc dword [eax]
dec dword [esp + 0x14]
jns 0x100163b4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x10016396
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jle 0x10016368
lea ecx, [esp + 0x4c]
call fcn.100079d2
lea ecx, [esp + 0x58]
call fcn.100079d2
or dword [esp + 0x12c], 0xffffffff
lea ecx, [esp + 0x70]
call fcn.100079d2
call fcn.10012af7
push ecx
push eax
lea ecx, [esp + 0x40]
call fcn.10016e87
mov dword [esp + 0x12c], 4
mov dword [esp + 0xc], 0xada439be
mov dword [esp + 0x10], 0xfffffff8
cmp dword [esp + 0xc], ebx
jne 0x10016434
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], 0x68044455
inc dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
sub ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xfff6
setle cl
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 6
mov eax, dword [esp + 0x10]
setg cl
xor ebx, ebx
cmp ecx, eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
setg bl
xor edx, edx
cmp eax, ecx
setge dl
imul ebx, edx
add ebx, dword [esp + 0xc]
je 0x10016648
xor ebx, ebx
mov dword [esp + 0x14], 0xfffffffb
mov dword [esp + 0x10], ebx
jmp 0x100164bd
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x7c], 0xbebf3b8c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x100164ad
mov dword [esp + 0x18], 0x7773
cmp dword [esp + 0x18], 0x79d5
jle 0x10016527
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [esp + 0xa4]
cdq
push edx
push eax
call fcn.10001aad
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100164f9
mov eax, dword [eax]
push eax
call fcn.1004da5d
pop ecx
push ebx
push 1
lea ecx, [esp + 0xac]
call fcn.10007f12
inc edi
cmp edi, 0x2a6b
jl 0x100164da
inc esi
cmp esi, 0x534e
jl 0x100164d8
xor edi, edi
push 3
inc edi
pop esi
mov dword [esp + 0x10], ebx
jmp 0x10016619
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x7c], ebx
je 0x1001654d
mov eax, edi
cmp dword [esp + 0x80], ebx
jne 0x1001654f
mov eax, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], ebx
jmp 0x10016608
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], 0xffb
cmp dword [esp + 0x28], 0x1119
jle 0x100165d8
mov esi, ebx
mov edi, ebx
mov eax, esi
lea ecx, [esp + 0xbc]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001aad
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001659a
mov eax, dword [eax]
push eax
call fcn.1004da5d
pop ecx
push ebx
push 1
lea ecx, [esp + 0xc4]
call fcn.10007f12
inc edi
cmp edi, 0x491b
jl 0x1001657a
inc esi
cmp esi, 0x5483
jl 0x10016578
push ebx
push 0x2e9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 3
pop esi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x28], 0xfaf
jge 0x100165f9
push str.kmz_bpm_ddi_knkbdls_nptz_axasy_xtxwe_ohkfmbc_dxzrbzh_aikahbpf_roi
call fcn.1004da5d
pop ecx
mov dword [esp + 0x12c], 4
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jle 0x1001655c
inc dword [esp + 0x10]
push 1
pop edi
cmp dword [esp + 0x10], esi
jle 0x10016530
cmp dword [esp + 0x18], 0x760f
jge 0x10016638
push str.jnhzpj_wvwozf_tiqzkvpaa_opnnevsxb_qqzq_tbd_ewthd
call fcn.1004da5d
pop ecx
xor edi, edi
mov dword [esp + 0x12c], 4
inc edi
jmp 0x1001666d
xor ebx, ebx
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], bl
je 0x1001666d
push 0x23e2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
mov edx, dword [esp + 0x38]
mov ecx, edx
mov esi, dword [esp + 0x24]
add esi, 0xffffe9d3
mov eax, dword [edx + 4]
cmp byte [eax + 0xd], 0
jne 0x100166ad
cmp dword [eax + 0x10], esi
jge 0x10016690
mov eax, dword [eax + 8]
jmp 0x10016694
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x10016686
cmp ecx, edx
je 0x100166ad
cmp esi, dword [ecx + 0x10]
jl 0x100166ad
mov dword [esp + 0x44], ecx
lea esi, [esp + 0x44]
jmp 0x100166b5
mov dword [esp + 0x40], edx
lea esi, [esp + 0x40]
mov eax, dword [0x100833d4]
mov esi, dword [esi]
test al, 1
jne 0x100166ea
or eax, edi
mov dword [0x100833ec], 7
mov dword [0x100833d4], eax
xor eax, eax
push 0x10065fb9
mov dword [0x100833e8], ebx
mov word [0x100833d8], ax
call fcn.1004da33
pop ecx
mov dword [esp + 0x10], 0x399841b3
mov dword [esp + 0x24], 0xa34c865b
mov dword [esp + 0x10], ebx
jmp 0x100167b6
mov dword [esp + 0xc], ebx
jmp 0x10016719
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x64], 0xd065
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10016709
mov dword [esp + 0xc], ebx
jmp 0x10016736
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x20], 7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10016726
mov dword [esp + 0xc], ebx
jmp 0x10016752
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x48], 0xed02e889
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10016742
mov eax, dword [esp + 0x68]
mov ecx, edi
inc dword [esp + 0x68]
test eax, eax
mov eax, dword [esp + 0x20]
cmove ecx, ebx
sub eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
dec eax
add edx, eax
imul edx, dword [esp + 0x20]
imul edx, ecx
cmp dword [esp + 0x10], 0xb9dd952e
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
mov eax, dword [esp + 0x20]
setge cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, 0x920a6ff6
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x48], 0x635290ce
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff0
jge 0x10016703
cmp esi, dword [esp + 0x38]
je 0x100167e6
push dword [esi + 0x18]
mov edx, dword [esi + 0x14]
lea ecx, [esp + 0xfc]
call fcn.1000d531
pop ecx
mov byte [esp + 0x12c], 9
mov ebx, edi
jmp 0x10016805
push 0x100833d8
lea ecx, [esp + 0xe4]
call fcn.10007510
push 2
mov dword [esp + 0x130], 0xa
pop ebx
mov esi, dword [esp + 0x30]
mov ecx, esi
push eax
mov dword [esp + 0x30], ebx
call fcn.10007510
or ebx, 4
test bl, 2
je 0x1001682f
push 0
push edi
lea ecx, [esp + 0xe8]
and ebx, 0xfffffffd
call fcn.10008371
test bl, 1
je 0x10016843
push 0
push edi
lea ecx, [esp + 0x100]
call fcn.10008371
lea ecx, [esp + 0x38]
call fcn.10016da2
mov ecx, dword [esp + 0x124]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret