Function at 0x100167f8
Capabilities:
Create directory
Log keystrokes via polling
Query environment variable

Disassembly:
mov eax, 0x1006235e
call fcn.10061438
sub esp, 0x220
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x6c], ecx
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x18], 9
push 1
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x164], ebx
call fcn.1000e8c0
xor edx, edx
mov dword [ebp - 0x28], 0x971db956
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x10016853
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x84], 0x1147
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10016842
mov dword [ebp - 0x18], ebx
jmp 0x1001686c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x94]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1001685d
mov dword [ebp - 0x2c], 0x350d8af8
mov dword [ebp - 0x18], ebx
jmp 0x10016891
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x94]
mov eax, dword [ecx + eax*4]
mov dword [ecx], eax
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1001687d
mov dword [ebp - 0x18], 9
jmp 0x100168aa
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ebx
jne 0x100168b0
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 6
jne 0x1001689f
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
lea ecx, [ebp - 0x94]
call fcn.1000e943
push 2
lea ecx, [ebp - 0x148]
call fcn.1000e8c0
push 1
lea ecx, [ebp - 0x170]
mov dword [ebp - 4], ebx
call fcn.1000e8c0
mov dword [ebp - 0x28], 0x96121589
push 2
mov dword [ebp - 0x28], 0x90031234
mov dword [ebp - 0x18], ebx
pop edi
jmp 0x1001690f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x148]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100168fc
mov dword [ebp - 0x18], ebx
jmp 0x10016928
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x170]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10016919
mov eax, dword [ebp - 0x148]
lea ecx, [ebp - 0x170]
mov dword [eax], 0x1a
call fcn.1000e943
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x148]
call fcn.1000e943
push edi
lea ecx, [ebp - 0x80]
call fcn.1000e8c0
mov dword [ebp - 4], edi
lea eax, [ebp - 0x1c8]
push dword [ebp - 0x70]
movdqa xmm0, xmmword [0x10071b00]
lea ecx, [ebp - 0xac]
push eax
lea eax, [ebp - 0x1d8]
mov dword [ebp - 0x20], 0x506d4441
push eax
mov dword [ebp - 0x2c], 0x47706695
push ebx
movdqu xmmword [ebp - 0x1d8], xmm0
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
call fcn.10011dd5
mov byte [ebp - 4], 3
mov dword [ebp - 0x18], ebx
jmp 0x100169c6
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x80]
mov dword [eax + ecx*4], 0x57fd5464
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100169b6
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], ebx
jl 0x10016b9e
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], 0x4909
cmp dword [ebp - 0x18], 0x498c
jle 0x10016a16
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x1007fdb8
xor eax, esi
cdq
push edx
push eax
call fcn.1000e5de
inc edi
cmp edi, 0x1096
jl 0x100169f3
inc esi
cmp esi, 0x56fc
jl 0x100169f1
mov byte [ebp - 4], 4
cmp dword [ebp - 0x18], 0x469b
jge 0x10016a50
mov edx, str.xrqqktswy_qkctmtaj_trdofvcb_xvszkbf_eqjj_vpnlqdckc_hurzzixo
mov ecx, 0x1007fdb8
call fcn.100113ff
jmp 0x10016a50
mov dword [ebp - 4], 3
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x30], 0xf95e19f8
mov dword [ebp - 0x18], ebx
jmp 0x10016a7b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcc], 0x1dc6b79d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10016a6a
mov dword [ebp - 0x18], ebx
jmp 0x10016a97
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x174], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10016a86
mov dword [ebp - 0x24], 1
cmp dword [ebp - 0x24], ebx
jl 0x10016b96
mov dword [ebp - 0x18], 0x9cc25fa5
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], ebx
push 4
call fcn.1000e8c0
mov dword [ebp - 0x18], ebx
jmp 0x10016adf
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x130]
mov dword [eax + ecx*4], 0xe6d54ec7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10016acc
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], ebx
jl 0x10016b11
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x80]
cmp dword [eax + ecx*4], ebx
jne 0x10016b11
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10016b0c
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
dec dword [ebp - 0x18]
jns 0x10016af1
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
inc dword [ebp - 0x34]
jne 0x10016b28
mov eax, dword [ebp - 0x80]
cmp dword [eax + 4], ebx
jne 0x10016b28
mov edi, ebx
jmp 0x10016b2b
xor edi, edi
inc edi
mov eax, dword [ebp - 0xc8]
xor edx, edx
imul ecx, eax, 0xfffb
mov dword [ebp - 0xc8], eax
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x130]
setl dl
add edx, dword [eax + 0xc]
xor eax, eax
cmp edi, edx
setne al
xor ecx, ecx
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x68], eax
setge cl
xor eax, eax
add ecx, dword [ebp - 0x28]
cmp ecx, 0x2d14
setne al
imul ecx, eax, 0xffff
mov eax, dword [ebp - 0x80]
mov dword [eax + esi*4], ecx
lea ecx, [ebp - 0x130]
call fcn.1000e943
dec dword [ebp - 0x24]
jns 0x10016aad
dec dword [ebp - 0x20]
jmp 0x100169d3
lea ecx, [ebp - 0xac]
call fcn.1000e943
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.1000e943
mov dword [ebp - 0x34], 0x86c
cmp dword [ebp - 0x34], 0x9f3
jle 0x10016c1d
mov ecx, ebx
mov dword [ebp - 0x20], ebx
mov eax, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov esi, edi
mov dword [ebp - 0x28], ebx
and esi, eax
and esi, ecx
mov eax, esi
mov ecx, 0x1007fdb8
or eax, ebx
cdq
push edx
push eax
call fcn.1000e5de
inc ebx
cmp ebx, 0x483d
jl 0x10016bda
mov eax, dword [ebp - 0x18]
inc edi
mov ecx, dword [ebp - 0x20]
push 0
pop ebx
cmp edi, 0x41ee
jl 0x10016bd1
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x1232
jl 0x10016bcf
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x4ba5
jl 0x10016bca
mov dword [ebp - 4], 6
cmp dword [ebp - 0x34], 0x858
mov dword [ebp - 0x64], 0xe051303
mov byte [ebp - 0x60], 1
mov byte [ebp - 0x5f], bl
mov dword [ebp - 0x5e], 0xfc010d04
mov word [ebp - 0x5a], 0x3d06
mov byte [ebp - 0x58], bl
mov word [ebp - 0x57], 0x21b
mov byte [ebp - 0x55], 0x28
jge 0x10016c64
mov edx, str.rsnmrjk_giael_pgqrwgwk
mov ecx, 0x1007fdb8
call fcn.100113ff
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x24], 0x3b26bdde
mov dword [ebp - 0x18], 0xa8fe
mov dword [ebp - 0x30], 0xe5f0e77d
push 2
mov dword [ebp - 0x28], 9
pop edi
mov dword [ebp - 0x24], ebx
jmp 0x10016d00
mov dword [ebp - 0x34], 0xb99
mov dword [ebp - 0x20], 0x3ed15de0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
mov eax, dword [ebp - 0x24]
neg ecx
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, 0xffffffff
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x6a7609fa
setge al
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff5
jl 0x10016cae
cmp dword [ebp - 0x24], ebx
jne 0x10016d2b
cmp dword [ebp - 0x18], ebx
jne 0x10016d13
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x30], ebx
jne 0x10016d2b
mov ecx, ebx
jmp 0x10016d2e
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x18]
xor edx, edx
add eax, 0x7606
add ecx, eax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
push 0x62
setl dl
mov dword [ebp - 0x24], edx
pop eax
mov word [ebp - 0xee], ax
mov dword [ebp - 0x18], 0xfffffffb
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10016d67
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x18], edi
jmp 0x10016da0
mov dword [ebp - 0x20], 0x65683c8f
mov dword [ebp - 0x20], ebx
jmp 0x10016d97
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10016d94
push ebx
push ebx
push 0x2256
push 0x2163
push ebx
call dword [sym.imp.USER32.dll_InsertMenuA]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1b
jle 0x10016d78
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffa
jne 0x10016d6c
mov esi, edi
mov ecx, ebx
cmp esi, 8
jne 0x10016dbb
movzx eax, byte [ebp - 0x5c]
lea ecx, [eax + 1]
lea esi, [eax + 7]
jmp 0x10016dea
movzx edx, byte [ebp + esi - 0x63]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x66]
movzx ecx, word [ebp + eax*2 - 0xf4]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x64]
add ecx, edx
mov word [ebp + eax*2 - 0xf4], cx
mov ecx, ebx
add esi, edi
cmp esi, 0x10
jb 0x10016daa
mov dword [ebp - 0x30], 0x692f
cmp dword [ebp - 0x30], 0x6b37
jle 0x10016e2c
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov eax, ebx
mov ecx, 0x1007fdb8
xor eax, esi
cdq
push edx
push eax
call fcn.1000e5de
inc ebx
cmp ebx, 0x3e5d
jl 0x10016e06
inc esi
push 0
pop ebx
cmp esi, 0x4c62
jl 0x10016e03
mov dword [ebp - 4], 8
cmp dword [ebp - 0x30], 0x691e
jge 0x10016e6c
mov edx, str.toaxqnp_gfohwqk_qcvfipz_eobojhf_tklxc_ttaa_oqnwgf_duq_ncr_oaccaizzy_ecohnbd_lhpzde_mcymk
mov ecx, 0x1007fdb8
call fcn.100113ff
jmp 0x10016e6c
or dword [ebp - 4], 0xffffffff
xor esi, esi
mov dword [ebp - 0x20], 3
inc esi
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10016e89
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x10016f2c
push esi
lea ecx, [ebp - 0x160]
call fcn.1000e8c0
mov dword [ebp - 0x18], ebx
jmp 0x10016ebc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x160]
mov dword [eax + ecx*4], 0x5683
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10016ea9
mov dword [ebp - 0x18], ebx
jmp 0x10016ed4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x38], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10016ec6
mov dword [ebp - 0x38], ebx
jmp 0x10016f0f
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10016efc
push 0x1436
push 0x2149
push 0x2698
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10016f0c
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x10016ede
lea ecx, [ebp - 0x160]
call fcn.1000e943
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff6
jle 0x10016e98
xor eax, eax
mov dword [ebp - 0x178], 7
mov word [ebp - 0xe6], ax
lea ecx, [ebp - 0x18c]
mov word [ebp - 0x18c], ax
lea eax, [ebp - 0xf4]
push eax
mov dword [ebp - 0x17c], ebx
call fcn.10017b8d
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x28], 0xb90d
mov dword [ebp - 0x28], 0xb13638ec
mov dword [ebp - 0x28], 0x2906c902
mov dword [ebp - 0x24], ebx
jmp 0x10016f90
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x210], 0xed23b618
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10016f7f
mov dword [ebp - 0x24], ebx
jmp 0x10016fac
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1ec], 0xfffffffa
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10016f9b
mov dword [ebp - 0x24], ebx
jmp 0x10016fc4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x74], 0x722ba7b7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10016fb6
inc dword [ebp - 0x74]
lea edi, [ebp - 0xf4]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x2c], 0xc3938dd4
mov dword [ebp - 0x34], 0x566a
mov dword [ebp - 0x20], 0x3ec752f6
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x30], 0x47f8
cmp dword [ebp - 0x30], 0x4913
jle 0x10017035
mov edi, ebx
mov dword [ebp - 0x28], ebx
lea eax, [ebx + edi]
mov ecx, 0x1007fdb8
cdq
push edx
push eax
call fcn.1000e5de
inc ebx
cmp ebx, 0x3224
jl 0x10017010
inc edi
push 0
pop ebx
cmp edi, 0x29a9
jl 0x1001700d
mov dword [ebp - 0x28], ebx
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x30], 0x47d2
jge 0x10017075
mov edx, str.izrke_frnx_lhkiqa_swp_isow_hiu_wwjiyksg_flgsst_vxtuiue_qbskbp_krbh_idofx_trgsyla_rxkyezhy
mov ecx, 0x1007fdb8
call fcn.100113ff
jmp 0x10017075
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001708c
push ebx
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
je 0x100170ae
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
add eax, 0xa81c4908
cmp dword [ebp - 0x20], eax
jle 0x100170ae
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, ebx
cmp dword [ebp - 0x18], ebx
je 0x100170c6
mov eax, esi
push dword [ebp - 0x88]
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x1c8]
call fcn.1000e6f3
push esi
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0xd
call fcn.1000e8c0
mov dword [ebp - 0x18], ebx
jmp 0x10017100
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1e4], 0xffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100170ef
mov dword [ebp - 0x18], ebx
jmp 0x1001711e
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10c]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001710b
mov ecx, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001714c
push 0x1e23
push ebx
push ebx
push 0x14cb
call dword [sym.imp.GDI32.dll_PolyPolygon]
lea ecx, [ebp - 0x10c]
call fcn.1000e943
mov dword [ebp - 0x28], 0xfffffff7
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10017172
push 0x1b4
call dword [sym.imp.USER32.dll_ShowCaret]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10017182
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x5c
pop eax
push 2
mov byte [ebp - 0x50], bl
mov ecx, ebx
mov dword [ebp - 0x4f], 0xa29304b0
mov word [ebp - 0x4b], 0xde8c
mov word [ebp - 0x40], ax
pop edi
cmp edi, 2
jne 0x100171aa
push 5
pop ecx
push ecx
pop edi
jmp 0x100171d3
movzx edx, byte [ebp + edi - 0x4f]
mov eax, edi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x52]
movzx ecx, word [ebp + eax*2 - 0x40]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + edi - 0x50]
add ecx, edx
mov word [ebp + eax*2 - 0x40], cx
mov ecx, ebx
add edi, 2
cmp edi, 7
jb 0x1001719e
xor eax, eax
lea ecx, [ebp - 0x124]
mov word [ebp - 0x3e], ax
mov dword [ebp - 0x18], 0xe8cff0ea
push 2
call fcn.1000e8c0
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x20], ebx
jmp 0x10017211
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x124]
mov dword [eax + ecx*4], 0xac488899
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x100171fe
mov dword [ebp - 0x30], 0x7f4d
cmp dword [ebp - 0x30], 0x81af
jle 0x10017289
mov eax, ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x2c], ebx
add eax, edi
sar eax, cl
lea ecx, [ebp - 0x204]
cdq
push edx
push eax
call fcn.10001a7f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001724f
mov eax, dword [eax]
push eax
call fcn.10048643
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x204]
call fcn.1000f099
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x2c], ecx
cmp ecx, 0x2224
jl 0x10017233
inc edi
cmp edi, 0x28e5
jl 0x1001722e
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x76c4
jl 0x1001722c
mov dword [ebp - 0x18], 0xf
jmp 0x100172cb
mov dword [ebp - 0x20], ebx
jmp 0x100172a8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x194], 0x256a9ef7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10017297
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100172c0
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
cmp dword [ebp - 0x194], ebx
jne 0x100172d1
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffee
jge 0x10017292
cmp dword [ebp - 0x30], 0x7da9
jge 0x100172e5
push str.vawyoyb_pvuggwtrj_ljtna_ggdtmdk
call fcn.10048643
pop ecx
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x18], 0xe2fde2bb
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x124]
mov byte [ebp - 4], 0xd
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x124]
call fcn.1000e943
xor eax, eax
mov dword [ebp - 0xd0], 7
mov word [ebp - 0xe4], ax
lea ecx, [ebp - 0xe4]
lea eax, [ebp - 0x40]
mov dword [ebp - 0xd4], ebx
push eax
call fcn.10017b8d
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x20], ebx
jmp 0x10017354
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x70], 0xf54c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10017346
push 2
mov dword [ebp - 0x24], 5
pop edi
cmp dword [ebp - 0x24], 0xffffffeb
jne 0x100173c7
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x18], ebx
jmp 0x100173bd
push edi
lea ecx, [ebp - 0x100]
call fcn.1000e8c0
mov dword [ebp - 0x20], ebx
jmp 0x10017395
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10017386
mov eax, dword [ebp - 0x18]
push 4
pop ecx
mov eax, dword [ebp + eax*4 - 0x70]
sub ecx, eax
mov eax, dword [ebp - 0x100]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x100]
call fcn.1000e943
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10017375
dec dword [ebp - 0x24]
jmp 0x10017363
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0x18], 0xffffffff
push edi
call fcn.1000e8c0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x30], ebx
push edi
call fcn.1000e8c0
push 2
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x1001740c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100173fc
mov dword [ebp - 0x18], ebx
jmp 0x10017425
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x154]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10017416
mov dword [ebp - 0x18], 0xffffffe2
jmp 0x1001744a
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10017447
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe4
jg 0x10017433
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], esi
jg 0x100175a0
mov esi, dword [ebp - 0xc4]
mov edi, dword [ebp - 0x154]
mov dword [ebp - 0x28], esi
jmp 0x10017470
mov esi, dword [ebp - 0x28]
push 4
lea ecx, [ebp - 0xa0]
call fcn.1000e8c0
mov byte [ebp - 4], 0x14
xor edx, edx
mov dword [ebp - 0x68], ebx
inc edx
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], ebx
jmp 0x100174a9
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xa0]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10017496
mov dword [ebp - 0x24], ebx
jmp 0x100174c5
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x198], 0x66e9f086
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x100174b4
mov dword [ebp - 0x24], ebx
jmp 0x100174dd
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x54], 5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x100174cf
mov eax, dword [ebp - 0x54]
dec dword [ebp - 0x54]
test eax, eax
je 0x10017501
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x68]
xor ecx, ecx
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
cmp eax, dword [esi + 4]
setg cl
cmp ecx, dword [ebp - 0x18]
je 0x10017520
mov ecx, ebx
cmp dword [ebp - 0x54], ebx
je 0x10017522
mov ecx, edx
mov esi, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0xa0]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0xc4]
sete dl
xor ecx, ecx
cmp edx, dword [eax + esi*4]
setl cl
xor eax, eax
cmp ecx, dword [edi + 4]
setne al
cmp eax, dword [edi + 4]
je 0x100175e0
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10017570
push 0x2569
push ebx
push 0x2e4
push 0x16f4
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10017582
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor esi, esi
inc esi
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x13
call fcn.1000e943
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1001746d
lea ecx, [ebp - 0x154]
call fcn.1000e943
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 0x11
call fcn.1000e943
push 0x5f
pop eax
push 2
mov byte [ebp - 0x48], bl
mov ecx, ebx
mov dword [ebp - 0x47], 0xdaae039b
mov byte [ebp - 0x43], 0x20
mov word [ebp - 0x3c], ax
pop edi
cmp edi, 2
jne 0x1001762c
push 4
pop ecx
push ecx
pop edi
jmp 0x10017655
xor esi, esi
lea ecx, [ebp - 0x13c]
inc esi
push esi
call fcn.1000e8c0
mov dword [ebp - 0x20], ebx
jmp 0x10017607
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x13c]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100175f4
mov eax, dword [ebp - 0x13c]
mov ecx, 0xa1033631
mov dword [eax], ecx
mov dword [edi + 4], ecx
lea ecx, [ebp - 0x13c]
call fcn.1000e943
jmp 0x10017585
movzx edx, byte [ebp + edi - 0x47]
mov eax, edi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x4a]
movzx ecx, word [ebp + eax*2 - 0x3c]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + edi - 0x48]
add ecx, edx
mov word [ebp + eax*2 - 0x3c], cx
mov ecx, ebx
add edi, 2
cmp edi, 6
jb 0x100175d4
xor eax, eax
mov dword [ebp - 0x19c], 7
mov word [ebp - 0x3a], ax
lea ecx, [ebp - 0x1b0]
mov word [ebp - 0x1b0], ax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x1a0], ebx
call fcn.10017b8d
push 2
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x118]
pop edi
mov dword [ebp - 0x28], 0xd3f7bf48
mov dword [ebp - 0x28], 0x747b
mov dword [ebp - 0x28], esi
push edi
call fcn.1000e8c0
mov dword [ebp - 0x20], ebx
jmp 0x100176c9
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x118]
mov dword [eax + ecx*4], 0x28cae2fe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100176b6
mov eax, dword [ebp - 0x118]
mov dword [eax], 0x6d6dbc1c
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100176ef
push ebx
push 0x144c
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea ecx, [ebp - 0x118]
call fcn.1000e943
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x20], 0xecb45710
mov dword [ebp - 0x34], 0xb357
mov dword [ebp - 0x28], 0x6bc712ba
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x28], 0xa47b6c41
mov dword [ebp - 0x2c], 0xa251abe7
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
jmp 0x10017747
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb8], 0x692b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10017736
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], edi
jg 0x10017819
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001776d
push 0x257d
call dword [sym.imp.USER32.dll_GetKeyState]
mov dword [ebp - 0x30], 0x5bca
cmp dword [ebp - 0x30], 0x5ef4
jle 0x100177d2
mov eax, ebx
mov dword [ebp - 0x18], ebx
mov ecx, ebx
mov dword [ebp - 0x2c], ebx
add eax, ecx
lea ecx, [ebp - 0x228]
cdq
push edx
push eax
call fcn.10001a7f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100177a1
mov eax, dword [eax]
push eax
call fcn.10048643
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x228]
call fcn.1000f099
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x2c], ecx
cmp ecx, 0x1308
jl 0x10017787
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x7f94
jl 0x10017782
mov byte [ebp - 0x19], bl
cmp dword [ebp - 0x30], 0x5b30
jge 0x100177e9
push str.phfnaeg_pkvs_ttrzgbj_ybcrwg_fzexxl_uppmc_rcsoucki_gba_yex
call fcn.10048643
pop ecx
mov dword [ebp - 4], 0x15
cmp byte [ebp - 0x19], 0
je 0x10017811
push 0x2682
push 0xee9
push 0x2010
push 0x1ad1
push ebx
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
inc dword [ebp - 0x20]
jmp 0x10017750
mov ecx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
mov eax, dword [ebp - 0x34]
sub ecx, eax
mov dword [ebp - 0x28], ecx
je 0x1001783e
mov eax, esi
cmp dword [ebp - 0x34], ebx
jne 0x10017840
mov eax, ebx
mov dword [ebp - 0x2c], eax
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xb4]
cmp ecx, eax
setne dl
neg edx
neg edx
sbb edx, edx
xor eax, eax
neg edx
cmp edx, 0xde45a917
sete al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0xb4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
neg eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
push dword [ebp - 0xd4]
cmp dword [ebp - 0xd0], 8
lea eax, [ebp - 0xe4]
push ebx
cmovae eax, dword [ebp - 0xe4]
lea ecx, [ebp - 0x1c8]
push eax
call fcn.10017c15
cmp eax, 0xffffffff
je 0x100178c9
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x1b0]
push ecx
push esi
push eax
lea ecx, [ebp - 0x1c8]
call fcn.10011a0d
jmp 0x10017884
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x1c8]
push eax
lea edx, [ebp - 0x18c]
call fcn.10017cb8
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x1b0]
call fcn.1000f26d
push ebx
push esi
lea ecx, [ebp - 0xe4]
call fcn.1000f26d
push ebx
push esi
lea ecx, [ebp - 0x1c8]
call fcn.1000f26d
push ebx
push esi
lea ecx, [ebp - 0x18c]
call fcn.1000f26d
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x6c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret