Function at 0x1006df57
Capabilities:
Check for time delay via gettickcount
Check os version
Create directory
Create thread
Shutdown system
Terminate process
Write file on windows

Disassembly:
push 0x384
mov eax, 0x10086293
call fcn.1008296f
mov eax, dword [0x2f92a08]
cmp eax, 0x4b1
je 0x1006dfb1
cmp eax, 0x321
je 0x1006dfb1
cmp eax, 0x1c85
je 0x1006dfb1
cmp eax, 0xfa1
je 0x1006dfb1
cmp eax, 0x8fd
je 0x1006dfb1
cmp eax, 0x907
je 0x1006dfb1
cmp eax, 0x911
je 0x1006dfb1
cmp eax, 0x91b
je 0x1006dfb1
cmp eax, 0x925
je 0x1006dfb1
cmp eax, 0x939
jne 0x1006dfd0
cmp byte [0x100a6088], 1
jne 0x1006dfd0
cmp dword [0x103d0f48], 0
jbe 0x1006dfd0
cmp byte [0x1035ef2a], 1
je 0x1006f764
mov ecx, dword [0x2fb7ac4]
mov dword [ebp - 0x388], ecx
test ecx, ecx
je 0x1006f764
mov eax, dword [0xe77dfc]
test eax, eax
je 0x1006f764
movzx ecx, word [ecx + 0x14]
imul ecx, ecx, 0x1cc
cmp dword [ecx + 0x333bab2], 0
je 0x1006f764
cmp byte [0x1035ef28], 0
jne 0x1006e031
cmp dword [eax + 0x30], 0xffffffff
je 0x1006e02a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1035ed50]
cmp eax, 0x1d4c0
jb 0x1006e031
mov byte [0x1035ef28], 1
mov al, al
mov eax, eax
mov cx, cx
cmp dword [0x103ca29c], 1
jne 0x1006e304
mov ebx, 0x2f9b2b0
mov esi, dword [ebx]
xor edi, edi
cmp esi, edi
je 0x1006e0c9
cmp byte [esi + 0x330], 0
je 0x1006e0c9
push 0x32
lea eax, [ebp - 0x5c]
push edi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [esi + 0x338]
push eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.MSVCR100.dll_strcpy]
pop ecx
pop ecx
cmp dword [0x103d5ea4], edi
jle 0x1006e0aa
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [0x103d5e9c]
push dword [eax + edi*4]
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x1006e1d4
inc edi
cmp edi, dword [0x103d5ea4]
jl 0x1006e085
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
mov esi, 0x103d5ea8
call fcn.1000117c
lea eax, [ebp - 0x5c]
push eax
mov esi, 0x103d5e9c
call fcn.100010da
add ebx, 4
cmp ebx, 0x2f9b2cc
jl 0x1006e04a
xor edi, edi
cmp dword [0x103d5ea4], edi
jle 0x1006e156
mov ebx, 0x2f9b2b0
mov esi, dword [ebx]
test esi, esi
je 0x1006e134
cmp byte [esi + 0x330], 0
je 0x1006e134
push 0x32
lea eax, [ebp - 0x5c]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
add esi, 0x338
lea eax, [ebp - 0x5c]
push esi
push eax
call dword [sym.imp.MSVCR100.dll_strcpy]
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [0x103d5e9c]
push dword [eax + edi*4]
call dword [sym.imp.MSVCR100.dll_strcmp]
add esp, 0x10
test eax, eax
je 0x1006e1fc
add ebx, 4
cmp ebx, 0x2f9b2cc
jl 0x1006e0e7
inc edi
push edi
mov esi, 0x103d5ea8
call fcn.100011d0
push edi
mov esi, 0x103d5e9c
call fcn.10001033
and dword [ebp - 0x380], 0
cmp dword [0x103d5ea4], 0
jle 0x1006e304
mov edi, 0x18b
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
xor ebx, ebx
push ebx
push ebx
push edi
push dword [0x103c9850]
mov dword [ebp - 0x37c], ebx
call esi
test eax, eax
jle 0x1006e218
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x189
push dword [0x103c9850]
call esi
mov ecx, dword [ebp - 0x380]
lea eax, [ebp - 0x24]
push eax
mov eax, dword [0x103d5e9c]
push dword [eax + ecx*4]
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x1006e20e
push 0
push 0
push edi
push dword [0x103c9850]
inc ebx
call esi
cmp ebx, eax
jl 0x1006e190
jmp 0x1006e218
mov eax, 0xffff
cmp word [esi + 0x366], ax
je 0x1006e0c9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x103d5ea8]
mov ecx, dword [ecx + edi*4]
mov dword [ecx], eax
jmp 0x1006e0c9
inc edi
cmp edi, dword [0x103d5ea4]
jl 0x1006e0e2
jmp 0x1006e156
mov dword [ebp - 0x37c], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x103d5ea8]
mov ecx, eax
mov eax, dword [ebp - 0x380]
mov edx, dword [edx + eax*4]
sub ecx, dword [edx]
cmp ecx, 0x1b7740
jb 0x1006e242
cmp dword [ebp - 0x37c], 0
je 0x1006e25a
inc eax
mov dword [ebp - 0x380], eax
cmp eax, dword [0x103d5ea4]
jl 0x1006e16f
jmp 0x1006e304
mov eax, dword [0x103d5e9c]
mov ecx, dword [ebp - 0x380]
push 2
push dword [eax + ecx*4]
call fcn.1003b72e
pop ecx
pop ecx
xor ebx, ebx
push ebx
push ebx
push edi
push dword [0x103c98c4]
call esi
test eax, eax
jle 0x1006e2ca
lea eax, [ebp - 0x8c]
push eax
push ebx
push 0x189
push dword [0x103c98c4]
call esi
mov eax, dword [0x103d5e9c]
mov ecx, dword [ebp - 0x380]
push dword [eax + ecx*4]
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x1006e2e7
push 0
push 0
push edi
push dword [0x103c98c4]
inc ebx
call esi
cmp ebx, eax
jl 0x1006e282
mov eax, dword [0x103d5e9c]
mov ecx, dword [ebp - 0x380]
push dword [eax + ecx*4]
push 0
push 0x180
push dword [0x103c98c4]
call esi
mov edi, dword [ebp - 0x380]
inc edi
push edi
mov esi, 0x103d5ea8
call fcn.100011d0
push edi
mov esi, 0x103d5e9c
call fcn.10001033
xor esi, esi
inc esi
cmp dword [0x103c9814], esi
je 0x1006e31f
cmp dword [0x103c9818], esi
je 0x1006e31f
cmp dword [0x103c9828], esi
jne 0x1006e32d
cmp dword [0x101117c4], 2
jne 0x1006e32d
call fcn.1006cbf6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov edi, 0x1008b7f4
mov dword [ebp - 0x384], ebx
call fcn.10006ac3
cmp eax, esi
jne 0x1006e362
mov edi, 0x1008b840
call fcn.10006ac3
cmp eax, esi
jne 0x1006e362
push 0
push 2
call fcn.1003b35d
pop ecx
pop ecx
movzx eax, word [0x34d29dc]
test ax, ax
je 0x1006e453
mov edx, dword [0x103d77d8]
mov cl, byte [0x100df8d0]
cmp eax, edx
jle 0x1006e397
mov dword [0x103d77d8], eax
mov eax, dword [0x100a58f8]
movzx edx, cl
dec edx
cmp eax, edx
jge 0x1006e39e
inc eax
jmp 0x1006e3a0
je 0x1006e387
mov dword [0x103d77d8], eax
xor eax, eax
movzx ecx, cl
sub ecx, eax
xor esi, esi
mov dword [0x100a58f8], eax
test ecx, ecx
jle 0x1006e45a
cmp byte [eax + esi + 0x100df830], 1
je 0x1006e3c8
inc esi
cmp esi, ecx
jl 0x1006e3b4
jmp 0x1006e45a
add eax, esi
movzx eax, word [eax*2 + 0x100df6f0]
push 0x5d
mov dword [ebp - 0x37c], eax
lea eax, [ebp - 0x85]
push 0
push eax
mov dword [ebp - 0x8c], 0
mov word [ebp - 0x88], 0x43
mov byte [ebp - 0x86], 0x58
call sub.MSVCR100.dll_memset
add esp, 0xc
push 2
lea eax, [ebp - 0x37c]
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.MSVCR100.dll_memmove]
lea eax, [ebp - 0x8c]
add esp, 0xc
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x378], 0x66
push dword [ebp - 0x378]
push dword [ebp - 0x380]
mov ecx, 0xe77dfc
mov ecx, dword [ecx]
mov eax, 0x67ca00
call eax
add dword [0x100a58f8], esi
jmp 0x1006e461
and dword [0x103d77d8], 0
or dword [0x100a58f8], 0xffffffff
mov eax, dword [ebp - 0x388]
mov eax, dword [eax + 0x1d44]
mov ecx, dword [0x103ca180]
xor esi, esi
inc esi
push 3
pop edi
cmp dword [0x103c5680], esi
je 0x1006e489
cmp ecx, esi
jne 0x1006e56a
cmp eax, 2
je 0x1006e55d
cmp eax, edi
je 0x1006e55d
cmp eax, 5
je 0x1006e55d
cmp byte [0x1035ef14], 1
je 0x1006e55d
test ecx, ecx
je 0x1006e4ff
cmp dword [0x101117c4], 2
je 0x1006e4ff
mov eax, ebx
sub eax, dword [0x1035ed80]
xor edx, edx
mov ecx, 0x3e8
div ecx
push 0x3c
xor edx, edx
pop ecx
div ecx
mov dword [ebp - 0x380], eax
fild dword [ebp - 0x380]
test eax, eax
jns 0x1006e4eb
fadd dword [0x1009da10]
fild dword [0x103ca17c]
fcompp
fnstsw ax
test ah, 0x41
jp 0x1006e4ff
call fcn.1003daee
cmp dword [0x103c5680], esi
jne 0x1006e56a
mov eax, ebx
sub eax, dword [0x1035ed80]
xor edx, edx
mov ecx, 0x3e8
div ecx
push 0x3c
xor edx, edx
pop ecx
div ecx
mov dword [ebp - 0x380], eax
fild dword [ebp - 0x380]
test eax, eax
jns 0x1006e535
fadd dword [0x1009da10]
fild dword [0x103c5a68]
fcompp
fnstsw ax
test ah, 0x41
jp 0x1006e56a
push 0
mov dword [0x1035ed80], ebx
push 0x1009ab44
call fcn.100370d7
pop ecx
pop ecx
jmp 0x1006f764
mov byte [0x1035ef14], 0
mov dword [0x1035ed80], ebx
cmp dword [0x103c5a80], esi
jne 0x1006e5a2
mov eax, dword [0x34d2980]
mov ecx, dword [0x34d2984]
cmp eax, dword [0x10384448]
jne 0x1006e591
cmp ecx, dword [0x1038444c]
je 0x1006e611
mov dword [0x1035ed78], ebx
mov dword [0x10384448], eax
mov dword [0x1038444c], ecx
cmp dword [0x103c18b0], esi
jne 0x1006e7a7
and dword [ebp - 0x378], 0
push 0
call dword [sym.imp.MSVCR100.dll__time64]
mov dword [ebp - 0x390], eax
pop ecx
lea eax, [ebp - 0x390]
push eax
mov dword [ebp - 0x38c], edx
call dword [sym.imp.MSVCR100.dll__localtime64]
pop ecx
push eax
push 0x10099cf4
lea eax, [ebp - 0x24]
push 0x14
push eax
call dword [sym.imp.MSVCR100.dll_strftime]
mov esi, dword [sym.imp.MSVCR100.dll_strcmp]
lea eax, [ebp - 0x24]
push str.Sunday
push eax
call esi
add esp, 0x18
test eax, eax
jne 0x1006e664
mov dword [ebp - 0x378], 7
jmp 0x1006e70f
mov eax, ebx
sub eax, dword [0x1035ed78]
xor edx, edx
mov ecx, 0x3e8
div ecx
push 0x3c
xor edx, edx
pop ecx
div ecx
mov dword [ebp - 0x380], eax
fild dword [ebp - 0x380]
test eax, eax
jns 0x1006e63f
fadd dword [0x1009da10]
fild dword [0x103c5a84]
fcompp
fnstsw ax
test ah, 0x41
jp 0x1006e5a2
push 0
mov dword [0x1035ed78], ebx
push 0x1009ab60
jmp 0x1006e551
lea eax, [ebp - 0x24]
push str.Monday
push eax
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1006e684
mov dword [ebp - 0x378], 1
jmp 0x1006e70f
lea eax, [ebp - 0x24]
push str.Tuesday
push eax
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1006e6a1
mov dword [ebp - 0x378], 2
jmp 0x1006e70f
lea eax, [ebp - 0x24]
push str.Wednesday
push eax
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1006e6ba
mov dword [ebp - 0x378], edi
jmp 0x1006e70f
lea eax, [ebp - 0x24]
push str.Thursday
push eax
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1006e6d7
mov dword [ebp - 0x378], 4
jmp 0x1006e70f
lea eax, [ebp - 0x24]
push str.Friday
push eax
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1006e6f4
mov dword [ebp - 0x378], 5
jmp 0x1006e70f
lea eax, [ebp - 0x24]
push str.Saturday
push eax
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1006e70f
mov dword [ebp - 0x378], 6
lea eax, [ebp - 0x360]
push eax
call dword [sym.imp.MSVCR100.dll__strtime]
pop ecx
lea eax, [ebp - 0x360]
push eax
push 2
pop edi
lea esi, [ebp - 0xb8]
call fcn.100064fa
pop ecx
lea eax, [ebp - 0x360]
push eax
push 3
pop ebx
lea esi, [ebp - 0xcc]
call fcn.1000655e
mov eax, dword [0x103c18a4]
inc eax
pop ecx
cmp dword [ebp - 0x378], eax
jne 0x1006e7a7
mov esi, dword [sym.imp.MSVCR100.dll_atoi]
lea eax, [ebp - 0xb8]
push eax
call esi
pop ecx
mov ecx, dword [0x103c18a8]
inc ecx
cmp eax, ecx
jne 0x1006e7a7
lea eax, [ebp - 0xcc]
push eax
call esi
pop ecx
mov ecx, dword [0x103c18ac]
inc ecx
cmp eax, ecx
jl 0x1006e7a7
push 0x1009abb8
call fcn.100060fb
pop ecx
mov ecx, dword [0x1012ecb8]
call fcn.100739ac
call fcn.10067fd4
jmp 0x1006f764
cmp byte [0x1035ef22], 0
je 0x1006f764
cmp dword [0x103cb934], 1
mov esi, dword [sym.imp.MSVCR100.dll_sprintf]
mov edi, 0x10110f10
jne 0x1006e8ba
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
xor edx, edx
mov ebx, 0x3e8
mov ecx, eax
mov eax, dword [0x1035ed70]
div ebx
sub ecx, eax
cmp ecx, 0xf
jb 0x1006e8ba
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
push ebx
mov dword [0x1035ed70], eax
call fcn.10010cc1
pop ecx
push edi
lea eax, [ebp - 0x2c0]
push 0x1009abd8
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x2c0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x1006e83b
push ebx
lea eax, [ebp - 0x2c0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x34d28e8
push 0x10110128
push edi
lea eax, [ebp - 0x2c0]
push 0x1009abe0
push eax
call esi
add esp, 0x14
lea ecx, [ebp - 0x380]
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea eax, [ebp - 0x380]
push eax
mov ecx, 0x103cb8c0
mov dword [ebp - 4], ebx
call dword [sym.imp.mfc100.dll_Ordinal_6970]
lea eax, [ebp - 0x2c0]
push 0x1009abf4
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
mov ebx, eax
mov eax, dword [ebp - 0x380]
mov ecx, dword [eax - 0xc]
push ebx
push 1
push ecx
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
push ebx
call dword [sym.imp.MSVCR100.dll_fclose]
or dword [ebp - 4], 0xffffffff
add esp, 0x1c
lea ecx, [ebp - 0x380]
call dword [sym.imp.mfc100.dll_Ordinal_901]
xor ebx, ebx
inc ebx
cmp dword [0x103c18dc], ebx
jne 0x1006e8dc
mov eax, dword [0x1035ee98]
cmp eax, dword [0x103c18fc]
jl 0x1006e8dc
push 0x1009abf8
jmp 0x1006e78c
cmp dword [0x103c18e0], ebx
jne 0x1006e8fb
mov eax, dword [0x1035ee9c]
cmp eax, dword [0x103c1900]
jl 0x1006e8fb
push 0x1009ac1c
jmp 0x1006e78c
cmp dword [0x103c1994], ebx
jne 0x1006e941
mov eax, dword [0x2fb7ac4]
movzx eax, word [eax + 0x14]
mov ecx, dword [0x10111778]
imul eax, eax, 0x1cc
sub ecx, dword [eax + 0x333bb68]
cmp ecx, dword [0x103c1998]
jl 0x1006e941
add eax, 0x333bab2
push eax
call dword [sym.imp.MSVCR100.dll_strlen]
pop ecx
test eax, eax
je 0x1006e941
push 0x1009ac40
jmp 0x1006e78c
cmp dword [0x103c18e4], ebx
jne 0x1006e96b
mov eax, dword [0x103c1904]
cdq
cmp dword [0x1035ed34], edx
jl 0x1006e96b
jg 0x1006e961
cmp dword [0x1035ed30], eax
jb 0x1006e96b
push 0x1009ac64
jmp 0x1006e78c
cmp dword [0x103c701c], 1
mov ebx, dword [sym.imp.mfc100.dll_Ordinal_265]
jne 0x1006e9ca
mov eax, dword [0x1035ee98]
cmp eax, dword [0x103c7024]
jl 0x1006e9ca
push 0x1009ac8c
call fcn.100060fb
mov dword [esp], 0x1f4
call ebx
pop ecx
push edi
push 0x10097b54
push eax
mov dword [ebp - 0x378], eax
call esi
add esp, 0xc
push 0x11
push 0
push dword [ebp - 0x378]
call dword [sym.imp.WINMM.dll_PlaySoundA]
push dword [ebp - 0x378]
call dword [sym.imp.mfc100.dll_Ordinal_1296]
pop ecx
cmp dword [0x103c7020], 1
jne 0x1006ea23
mov eax, dword [0x1035ee9c]
cmp eax, dword [0x103c7028]
jl 0x1006ea23
push 0x1009acb4
call fcn.100060fb
mov dword [esp], 0x1f4
call ebx
pop ecx
push edi
push 0x10097b54
push eax
mov dword [ebp - 0x378], eax
call esi
add esp, 0xc
push 0x11
push 0
push dword [ebp - 0x378]
call dword [sym.imp.WINMM.dll_PlaySoundA]
push dword [ebp - 0x378]
call dword [sym.imp.mfc100.dll_Ordinal_1296]
pop ecx
mov eax, dword [0x103c18d0]
mov ecx, dword [0x103c700c]
xor edx, edx
inc edx
cmp eax, edx
je 0x1006ea3d
cmp ecx, edx
jne 0x1006ebff
cmp byte [0x1035ef28], 1
jne 0x1006ebff
cmp eax, edx
jne 0x1006ebae
mov ecx, dword [0x1012ecb8]
call fcn.100739ac
mov eax, dword [0x103c18b4]
xor edi, edi
inc edi
cmp eax, edi
jne 0x1006eafd
lea eax, [ebp - 0x374]
push eax
mov dword [ebp - 0x374], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 2
pop ebx
cmp dword [ebp - 0x364], ebx
jne 0x1006eae8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x388]
push ecx
push 0x20
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x390]
push eax
push str.SeShutdownPrivilege
xor esi, esi
push esi
mov dword [ebp - 0x20], edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [ebp - 0x390]
push esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x38c]
push esi
push esi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp - 0x388]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x1006eaea
xor esi, esi
push esi
push 8
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0x1009acdc
jmp 0x1006ee6c
cmp eax, 2
jne 0x1006f764
lea eax, [ebp - 0xa4]
push eax
movzx eax, byte [0x34cdfc6]
push eax
mov edi, 0x1035ef6c
call fcn.1003db40
lea eax, [ebp - 0xa4]
push 0x2f99cb8
push eax
call dword [sym.imp.MSVCR100.dll_strcat]
add esp, 0x10
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 0x291
push dword [0x100f315c]
call ebx
lea eax, [ebp - 0xa4]
push eax
movzx eax, byte [0x34cdfc6]
push eax
call fcn.1003db40
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x360]
push 0x1009a564
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x360]
push eax
push dword [0x100ded8c]
push 0x2712
push dword [0x100f315c]
call ebx
push 1
push dword [0x100df8d4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1006f764
cmp ecx, edx
jne 0x1006ebff
cmp dword [0x103c8304], 0
jne 0x1006ebc6
mov ecx, dword [0x1012ecb8]
call fcn.100739ac
push 0x1009ace4
call fcn.100060fb
mov dword [esp], 0x1f4
call ebx
pop ecx
push edi
mov ebx, eax
push 0x10097b54
push ebx
call esi
add esp, 0xc
push 0x11
push 0
push ebx
call dword [sym.imp.WINMM.dll_PlaySoundA]
push ebx
call dword [sym.imp.mfc100.dll_Ordinal_1296]
jmp 0x1006e557
cmp dword [0x103c18c8], edx
jne 0x1006ec3a
mov esi, dword [0x34d2980]
mov edi, dword [0x34d2984]
cmp esi, dword [0x10384440]
jne 0x1006ec23
cmp edi, dword [0x10384444]
je 0x1006ec71
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1035ed7c], eax
mov dword [0x10384440], esi
mov dword [0x10384444], edi
cmp dword [0x103c18d4], 1
jne 0x1006ecbc
push 7
mov ecx, 0x2f9b2b0
xor edx, edx
pop esi
mov eax, dword [ecx]
test eax, eax
je 0x1006ec5d
cmp byte [eax + 0x330], 0
je 0x1006ec5d
inc edx
add ecx, 4
dec esi
jne 0x1006ec4d
test edx, edx
jne 0x1006ecbc
push 0x1009ad10
jmp 0x1006e78c
mov eax, dword [ebp - 0x384]
sub eax, dword [0x1035ed7c]
xor edx, edx
mov ecx, 0x3e8
div ecx
push 0x3c
xor edx, edx
pop ecx
div ecx
mov dword [ebp - 0x378], eax
fild dword [ebp - 0x378]
test eax, eax
jns 0x1006eca3
fadd dword [0x1009da10]
fild dword [0x103c18f8]
fcompp
fnstsw ax
test ah, 0x41
jp 0x1006ec3a
push 0x1009acf0
jmp 0x1006e78c
cmp dword [0x103c18d8], 1
mov ebx, 0x1009ad2c
jne 0x1006ed67
mov edx, dword [0x2f99460]
xor edi, edi
mov dword [ebp - 0x378], edi
call fcn.100061d1
test eax, eax
je 0x1006ed1b
lea esi, [edx + 0x53c]
mov eax, dword [esi]
test eax, eax
je 0x1006ed02
add eax, 0x64
push eax
push ebx
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x1006ed11
inc edi
add esi, 4
call fcn.100061d1
cmp edi, eax
jb 0x1006eceb
jmp 0x1006ed1b
mov dword [ebp - 0x378], 1
mov eax, dword [0x2f99464]
xor edi, edi
lea esi, [eax + 0x53c]
mov eax, dword [esi]
test eax, eax
je 0x1006ed3f
add eax, 0x64
push eax
push ebx
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x1006ed4a
inc edi
add esi, 4
cmp edi, 0xf
jl 0x1006ed28
jmp 0x1006ed54
mov dword [ebp - 0x378], 1
cmp dword [ebp - 0x378], 0
jne 0x1006ed67
push 0x1009ad34
jmp 0x1006e78c
cmp dword [0x103c1914], 1
jne 0x1006edc5
mov edx, dword [0x2f99460]
xor ebx, ebx
call fcn.100061d1
mov edi, 0x10099680
test eax, eax
je 0x1006edb0
lea esi, [edx + 0x53c]
mov eax, dword [esi]
test eax, eax
je 0x1006eda3
add eax, 0x64
push edi
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
pop ecx
pop ecx
test eax, eax
jne 0x1006edc5
inc ebx
add esi, 4
call fcn.100061d1
cmp ebx, eax
jb 0x1006ed8c
push edi
call fcn.100064ae
pop ecx
test eax, eax
jne 0x1006edc5
push 0x1009ad50
jmp 0x1006e78c
xor edi, edi
mov esi, 0xa7f9
cmp dword [0x34d2968], edi
jne 0x1006ef59
cmp dword [0x2f92a08], esi
jne 0x1006edf6
cmp dword [0x103c5664], 1
jne 0x1006edf6
cmp dword [0x103c58fc], edi
jne 0x1006edf6
call fcn.1003b5b2
cmp dword [0x34d2968], edi
jne 0x1006ef59
cmp dword [0x2f92a08], esi
je 0x1006ef59
cmp dword [0x103c5664], 1
jne 0x1006eef3
cmp dword [0x103c58fc], edi
jne 0x1006eeb3
cmp dword [0x101117c4], 2
jne 0x1006ee76
mov dword [0x10111bfc], edi
mov byte [0x1035ef19], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1035eda0], eax
mov eax, dword [0x10113488]
push 0x1006d47a
push 0xbb8
add eax, 0x45
push eax
push dword [0x100ded8c]
call dword [sym.imp.USER32.dll_SetTimer]
push 0x1009ad6c
call fcn.100060fb
jmp 0x1006e557
call fcn.100737d2
mov dword [0x10111bfc], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1006d3bb
push dword [0x103c5a6c]
mov dword [0x1035eda0], eax
mov eax, dword [0x10113488]
add eax, 0x44
push eax
push dword [0x100ded8c]
call dword [sym.imp.USER32.dll_SetTimer]
push 0x1009ad7c
jmp 0x1006ee6c
call fcn.100737d2
mov dword [0x10111bfc], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1006d33e
push dword [0x103c5a6c]
mov dword [0x1035eda0], eax
mov eax, dword [0x10113488]
add eax, 0x44
push eax
push dword [0x100ded8c]
call dword [sym.imp.USER32.dll_SetTimer]
push 0x1009ad8c
jmp 0x1006ee6c
cmp dword [0x103c5668], 1
jne 0x1006ef59
cmp dword [0x103c5900], 1
jne 0x1006ef44
call fcn.100737d2
mov dword [0x10111bfc], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1035eda0], eax
mov eax, dword [0x10113488]
push 0x1006d33e
push 0x12c
add eax, 0x44
push eax
push dword [0x100ded8c]
call dword [sym.imp.USER32.dll_SetTimer]
push 0x1009ad9c
jmp 0x1006ee6c
mov ecx, dword [0x1012ecb8]
call fcn.100739ac
push 0x1009adac
jmp 0x1006ee6c
cmp dword [0x103c2e30], 1
jne 0x1006efa1
mov eax, dword [0x2f99464]
xor edi, edi
lea esi, [eax + 0x53c]
mov eax, dword [esi]
test eax, eax
je 0x1006ef8a
add eax, 0x64
push eax
push 0x1009ad2c
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x1006efa1
inc edi
add esi, 4
cmp edi, 0xf
jl 0x1006ef6f
push 0
push 0x1009ad2c
call fcn.10006200
pop ecx
pop ecx
cmp dword [0x103c18e8], 1
jne 0x1006efdc
push 7
mov ecx, 0x2f9b2b0
xor edx, edx
pop esi
mov eax, dword [ecx]
test eax, eax
je 0x1006efc4
cmp byte [eax + 0x330], 0
je 0x1006efc4
inc edx
add ecx, 4
dec esi
jne 0x1006efb4
cmp edx, dword [0x103c1908]
jge 0x1006efdc
push 0x1009adc0
jmp 0x1006e78c
cmp dword [0x103c781c], 1
jne 0x1006f018
mov eax, dword [0x1035ed74]
xor edx, edx
mov esi, 0x3e8
mov ecx, esi
div ecx
mov ecx, dword [ebp - 0x384]
xor edx, edx
mov edi, eax
mov eax, ecx
div esi
sub eax, edi
cmp eax, 5
jb 0x1006f018
push 0x32
mov dword [0x1035ed74], ecx
call fcn.1006d5ce
pop ecx
cmp dword [0x103c982c], 1
mov esi, dword [sym.imp.mfc100.dll_Ordinal_6969]
jne 0x1006f078
push 0x14
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x103c9a74
call esi
mov edi, 0x2f9b2b0
mov eax, dword [edi]
test eax, eax
je 0x1006f05e
cmp byte [eax + 0x330], 0
je 0x1006f05e
lea ecx, [ebp - 0x24]
push ecx
add eax, 0x338
push eax
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x1006f06b
add edi, 4
cmp edi, 0x2f9b2cc
jl 0x1006f039
jmp 0x1006f078
lea eax, [ebp - 0x24]
push 1
push eax
call fcn.1003b72e
pop ecx
pop ecx
cmp dword [0x103c825c], 1
jne 0x1006f0c1
mov edi, dword [ebp - 0x388]
add edi, 0x4834
push edi
call dword [sym.imp.MSVCR100.dll_strlen]
pop ecx
test eax, eax
je 0x1006f0c1
push 0x32
lea eax, [ebp - 0x5c]
push eax
mov ecx, 0x103c8bbc
call esi
lea eax, [ebp - 0x5c]
push edi
push eax
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x1006f0c1
lea eax, [ebp - 0x5c]
push eax
call fcn.1003b7fe
pop ecx
mov eax, dword [0x2f99460]
add eax, 0x53c
mov dword [ebp - 0x380], eax
mov eax, dword [eax]
xor esi, esi
mov edi, 0x1008ed8c
cmp eax, esi
je 0x1006f0f3
add eax, 0x64
push edi
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
pop ecx
pop ecx
test eax, eax
jne 0x1006f3cc
mov dword [ebp - 0x384], esi
mov dword [ebp - 0x378], esi
mov dword [ebp - 0x37c], esi
call fcn.100061d1
test eax, eax
je 0x1006f16e
mov ebx, dword [ebp - 0x380]
mov esi, dword [ebx]
test esi, esi
je 0x1006f134
lea eax, [esi + 0x64]
push edi
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x1006f134
cmp dword [esi + 0xe74], 0
jne 0x1006f14c
inc dword [ebp - 0x37c]
add ebx, 4
call fcn.100061d1
cmp dword [ebp - 0x37c], eax
jb 0x1006f114
jmp 0x1006f16e
mov eax, dword [esi + 0xe44]
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x37c], eax
mov dword [ebp - 0x378], 1
cmp dword [0x103c91e8], 1
jne 0x1006f209
mov eax, dword [0x103c9260]
test eax, eax
jne 0x1006f18b
push 0x100973d4
jmp 0x1006f1a1
cmp eax, 1
jne 0x1006f197
push 0x100973e0
jmp 0x1006f1a1
cmp eax, 2
jne 0x1006f1ad
push 0x100973ec
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.MSVCR100.dll_strcpy]
pop ecx
pop ecx
xor edi, edi
call fcn.100061d1
test eax, eax
je 0x1006f209
mov ebx, dword [ebp - 0x380]
mov esi, dword [ebx]
test esi, esi
je 0x1006f1fc
lea eax, [ebp - 0x5c]
push eax
lea eax, [esi + 0x64]
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x1006f1fc
mov esi, dword [esi + 0xe44]
cmp esi, dword [ebp - 0x384]
jl 0x1006f1fc
mov dword [ebp - 0x384], esi
mov dword [ebp - 0x37c], edi
mov dword [ebp - 0x378], 1
inc edi
add ebx, 4
call fcn.100061d1
cmp edi, eax
jb 0x1006f1be
cmp dword [ebp - 0x378], 0
jne 0x1006f3ad
xor edi, edi
call fcn.100061d1
test eax, eax
je 0x1006f280
mov ebx, dword [ebp - 0x380]
mov esi, dword [ebx]
test esi, esi
je 0x1006f266
lea eax, [esi + 0x64]
push 0x1009ade4
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x1006f266
mov esi, dword [esi + 0xe44]
cmp esi, dword [ebp - 0x384]
jl 0x1006f266
mov dword [ebp - 0x384], esi
mov dword [ebp - 0x37c], edi
mov dword [ebp - 0x378], 1
inc edi
add ebx, 4
call fcn.100061d1
cmp edi, eax
jb 0x1006f227
cmp dword [ebp - 0x378], 0
jne 0x1006f3ad
xor edi, edi
call fcn.100061d1
test eax, eax
je 0x1006f2ea
mov ebx, dword [ebp - 0x380]
mov esi, dword [ebx]
test esi, esi
je 0x1006f2d0
lea eax, [esi + 0x64]
push 0x100973ec
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x1006f2d0
mov esi, dword [esi + 0xe44]
cmp esi, dword [ebp - 0x384]
jl 0x1006f2d0
mov dword [ebp - 0x384], esi
mov dword [ebp - 0x37c], edi
mov dword [ebp - 0x378], 1
inc edi
add ebx, 4
call fcn.100061d1
cmp edi, eax
jb 0x1006f291
cmp dword [ebp - 0x378], 0
jne 0x1006f3ad
xor edi, edi
call fcn.100061d1
test eax, eax
je 0x1006f350
mov ebx, dword [ebp - 0x380]
mov esi, dword [ebx]
test esi, esi
je 0x1006f33a
lea eax, [esi + 0x64]
push 0x100973e0
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x1006f33a
mov esi, dword [esi + 0xe44]
cmp esi, dword [ebp - 0x384]
jl 0x1006f33a
mov dword [ebp - 0x384], esi
mov dword [ebp - 0x37c], edi
mov dword [ebp - 0x378], 1
inc edi
add ebx, 4
call fcn.100061d1
cmp edi, eax
jb 0x1006f2fb
cmp dword [ebp - 0x378], 0
jne 0x1006f3ad
xor edi, edi
call fcn.100061d1
test eax, eax
je 0x1006f3cc
mov ebx, dword [ebp - 0x380]
mov esi, dword [ebx]
test esi, esi
je 0x1006f3a0
lea eax, [esi + 0x64]
push 0x100973d4
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x1006f3a0
mov esi, dword [esi + 0xe44]
cmp esi, dword [ebp - 0x384]
jl 0x1006f3a0
mov dword [ebp - 0x384], esi
mov dword [ebp - 0x37c], edi
mov dword [ebp - 0x378], 1
inc edi
add ebx, 4
call fcn.100061d1
cmp edi, eax
jb 0x1006f361
cmp dword [ebp - 0x378], 1
jne 0x1006f3cc
push 1
push 1
push 1
push 0
push dword [ebp - 0x37c]
call fcn.1003b894
add esp, 0x14
or dword [ebp - 0x378], 0xffffffff
and dword [ebp - 0x37c], 0
call fcn.100061d1
test eax, eax
je 0x1006f482
mov edi, dword [ebp - 0x380]
mov ebx, 0x1009adf0
mov esi, dword [edi]
test esi, esi
je 0x1006f41a
lea eax, [esi + 0x64]
push ebx
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x1006f41a
xor eax, eax
inc eax
mov dword [ebp - 0x378], eax
cmp dword [esi + 0xef4], eax
je 0x1006f432
inc dword [ebp - 0x37c]
add edi, 4
call fcn.100061d1
cmp dword [ebp - 0x37c], eax
jb 0x1006f3f2
jmp 0x1006f439
and dword [ebp - 0x378], 0
cmp dword [ebp - 0x378], 1
jne 0x1006f482
xor edi, edi
call fcn.100061d1
test eax, eax
je 0x1006f482
mov esi, dword [ebp - 0x380]
mov eax, dword [esi]
test eax, eax
je 0x1006f46a
add eax, 0x64
push ebx
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
pop ecx
pop ecx
test eax, eax
jne 0x1006f479
inc edi
add esi, 4
call fcn.100061d1
cmp edi, eax
jb 0x1006f453
jmp 0x1006f482
push edi
xor ecx, ecx
call fcn.1003a636
pop ecx
cmp dword [0x103c2e28], 1
jne 0x1006f5f6
mov eax, dword [ebp - 0x388]
mov esi, dword [0x2f99460]
xor ebx, ebx
cmp dword [eax + 0x47f8], ebx
jne 0x1006f4f9
call fcn.100061d1
test eax, eax
je 0x1006f5f6
lea edi, [esi + 0x53c]
mov esi, dword [edi]
test esi, esi
je 0x1006f4e1
lea eax, [esi + 0x64]
push 0x10099700
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x1006f4e1
mov eax, dword [esi + 0xd4c]
cmp eax, dword [0x103c5a64]
jg 0x1006f4f3
inc ebx
add edi, 4
call fcn.100061d1
cmp ebx, eax
jb 0x1006f4b8
jmp 0x1006f5f6
push ebx
jmp 0x1006f5ee
mov eax, dword [0x2f99464]
mov eax, dword [eax + 0x56c]
cmp eax, ebx
je 0x1006f5f6
mov ebx, dword [sym.imp.MSVCR100.dll_strstr]
add eax, 0x64
push 0x10099700
push eax
call ebx
pop ecx
pop ecx
test eax, eax
je 0x1006f5f6
and dword [ebp - 0x37c], 0
call fcn.100061d1
test eax, eax
je 0x1006f5f6
lea edi, [esi + 0x53c]
mov eax, dword [edi]
test eax, eax
je 0x1006f5cc
lea esi, [eax + 0x64]
push 0x100996d0
push esi
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x1006f5e8
push 0x100996d8
push esi
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x1006f5e8
push 0x100996e0
push esi
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x1006f5e8
push 0x100996e8
push esi
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x1006f5e8
push 0x100996f0
push esi
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x1006f5e8
push 0x100996f8
push esi
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x1006f5e8
push 0x10099708
push esi
call ebx
pop ecx
pop ecx
test eax, eax
jne 0x1006f5e8
inc dword [ebp - 0x37c]
add edi, 4
call fcn.100061d1
cmp dword [ebp - 0x37c], eax
jb 0x1006f541
jmp 0x1006f5f6
push dword [ebp - 0x37c]
xor ecx, ecx
call fcn.1003a636
pop ecx
mov eax, dword [ebp - 0x388]
cmp dword [eax + 0x51e4], 0
jne 0x1006f60e
cmp dword [eax + 0x2a50], 6
je 0x1006f620
cmp dword [eax + 0x47f8], 0
jne 0x1006f674
cmp dword [eax + 0x2a50], 4
jne 0x1006f674
xor edi, edi
lea esi, [ebp - 0x2e0]
mov ecx, edi
call fcn.10006368
xor esi, esi
cmp dword [0x103d5ed4], esi
jle 0x1006f65d
lea eax, [ebp - 0x2e0]
push eax
mov eax, dword [0x103d5ecc]
push dword [eax + esi*4]
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x1006f665
inc esi
cmp esi, dword [0x103d5ed4]
jl 0x1006f639
inc edi
cmp edi, 0x14
jl 0x1006f622
jmp 0x1006f674
push 1
push dword [ebp - 0x2c4]
call fcn.1003b96b
pop ecx
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, 0x3e8
xor edx, edx
mov ecx, edi
div ecx
xor ebx, ebx
sub eax, dword [0x1035f7fc]
cmp eax, dword [0x1035eed0]
jb 0x1006f69e
push ebx
call fcn.1006f8c3
pop ecx
call esi
xor edx, edx
mov ecx, edi
div ecx
sub eax, dword [0x101117d8]
cmp eax, 0x1194
jb 0x1006f6d7
push ebx
push ebx
push ebx
push 0x1006f80c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
xor edx, edx
mov ecx, edi
div ecx
mov dword [0x101117d8], eax
cmp dword [0x101117c4], 2
je 0x1006f764
cmp byte [0x1035ef30], 0
jne 0x1006f764
cmp dword [0x103d6048], 2
jne 0x1006f764
call fcn.1006db22
cmp al, 1
jne 0x1006f764
call fcn.100383dc
mov byte [0x1035ef30], 1
call fcn.100737d2
push ebx
push ebx
push ebx
push ebx
mov dword [0x10111c04], 0x7d0
call fcn.1006f76a
mov eax, dword [0x10113488]
push fcn.1006f76a
push edi
add eax, 0x4d
push eax
push dword [0x100ded8c]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [0x103d6040]
mov ecx, dword [eax + 4]
fild dword [ecx]
mov eax, dword [eax]
sub esp, 0xc
fstp dword [esp + 8]
fldz
fstp dword [esp + 4]
fild dword [eax]
fstp dword [esp]
call fcn.10039ece
add esp, 0xc
call fcn.100829f2
ret