Function at 0x10017654
Capabilities:
Create pipe
Enumerate gui resources
Query environment variable

Disassembly:
mov eax, 0x10084f57
call fcn.10084668
sub esp, 0x144
mov dword [ebp - 0x30], ecx
push ebx
push esi
push edi
test dl, dl
je 0x10018081
mov dword [ebp - 0x2c], 0xf0b96ca2
xor esi, esi
mov dword [ebp - 0x20], 0xad2086bd
inc esi
mov dword [ebp - 0x28], esi
xor ebx, ebx
mov dword [ebp - 0x24], 0xa41637c1
mov dword [ebp - 0x20], 0xec560449
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x100176b6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [ebp - 0x2c]
push 3
pop edi
sub eax, 4
je 0x1001773d
mov dword [ebp - 0x20], 6
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0x20], 0xc4ab274b
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0xdaab72b2
mov dword [ebp - 0x20], 0x420452a2
mov dword [ebp - 0x20], 0xe2f9d44c
push edi
call fcn.10015766
mov dword [ebp - 0x1c], ebx
jmp 0x10017712
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf0]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100176ff
mov dword [ebp - 0x1c], ebx
jmp 0x1001772a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x40], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001771c
dec dword [ebp - 0x40]
lea ecx, [ebp - 0xf0]
jmp 0x1001780a
push dword [ebp - 0x30]
movdqa xmm0, xmmword [0x10008110]
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x2c], 0xfffffffa
mov eax, 0x3f908025
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0x8f585950
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x20], 0x5ff57440
mov dword [ebp - 0x24], 0x8ef34ea8
mov dword [ebp - 0x20], 0xe42506ed
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x138]
mov dword [ebp - 0x84], ebx
push eax
push ebx
movdqu xmmword [ebp - 0x138], xmm0
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
call fcn.10016cdb
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
neg edx
mov eax, dword [ebp - 0x84]
sbb edx, edx
xor ecx, ecx
neg edx
dec dword [eax + 4]
cmp edx, 0x8fda
setg cl
sub ecx, dword [eax + 4]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x84]
imul eax, dword [ebp - 0x24], 0xffff5197
sub eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
call fcn.10015f83
mov dword [ebp - 0x28], 8
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x10], 0xb22489af
push edi
call fcn.10015766
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], 0x77405739
mov dword [ebp - 0x1c], ebx
jmp 0x10017846
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3c], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10017838
mov dword [ebp - 0x1c], ebx
jmp 0x10017863
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xb4]
mov dword [eax + ecx*4], 0xe0b5dae8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10017850
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, 0x1f90ef30
mov edx, 0x8d3c891c
setne cl
sub ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
add eax, dword [ebp - 0x28]
inc ecx
cmp edx, eax
sbb eax, eax
inc eax
imul ecx, eax
mov dword [ebp - 0x38], ecx
test ecx, ecx
je 0x100178de
mov dword [ebp - 0x18], esi
mov eax, 0xf758fc5
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
sub eax, 7
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], 0xfff7
dec dword [ebp - 0x24]
jmp 0x100179e7
mov eax, 0xcb06a9be
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], 0x82d77871
mov eax, dword [ebp - 0x10]
dec dword [ebp - 0x10]
test eax, eax
jne 0x10017903
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x50]
mov eax, 0x6d7d0454
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
je 0x10017940
mov dword [ebp - 0x2c], 0xa52e
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10017935
push ebx
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
jmp 0x100179d1
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0xd8]
push edi
call fcn.10015766
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
jmp 0x10017967
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xd8]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10017957
mov eax, dword [ebp - 0xd8]
cmp dword [eax + 8], ebx
jne 0x1001797a
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, esi
setge cl
cmp ecx, 0xffff
je 0x10017993
mov ecx, ebx
cmp dword [ebp - 0x4c], ebx
je 0x10017995
mov ecx, esi
mov eax, dword [ebp - 0xb4]
mov dword [eax + 8], ecx
test ecx, ecx
je 0x100179a5
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
call fcn.10015f83
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100179e7
push ebx
push esi
push 0xd50
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb4]
call fcn.10015f83
mov dword [ebp - 0x1c], 0xc7bf0b96
mov dword [ebp - 0x10], 0xee76f502
mov dword [ebp - 0x10], ebx
jmp 0x10017a1a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x118], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10017a09
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10017a36
push 0x2182
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CombineRgn]
mov dword [ebp - 0x10], ebx
jmp 0x10017a5f
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10017a4b
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10017a5c
push ebx
push ebx
call dword [sym.imp.USER32.dll_EnumWindows]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10017a3b
push esi
lea ecx, [ebp - 0x90]
call fcn.10015766
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x24], 0xffff
push 2
call fcn.10015766
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x10], 0x7bd55fd0
push edi
call fcn.10015766
mov dword [ebp - 0x18], ebx
jmp 0x10017ac4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x108]
mov dword [eax + ecx*4], 0xafbd13d8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10017ab1
mov dword [ebp - 0x18], ebx
jmp 0x10017ade
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10017acf
mov dword [ebp - 0x18], 0x905c
cmp dword [ebp - 0x18], ebx
je 0x10017b21
cmp dword [ebp - 0x24], ebx
jne 0x10017b0c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc0]
xor ecx, ecx
cmp dword [eax], ebx
setne cl
mov dword [eax], ecx
mov eax, esi
test ecx, ecx
jne 0x10017b23
mov eax, ebx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xc0]
call fcn.10015f83
lea ecx, [ebp - 0x108]
call fcn.10015f83
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], 0x40e708be
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ebx
jmp 0x10017b74
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x90]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10017b65
cmp dword [ebp - 0x1c], ebx
je 0x10017bd5
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x90]
sete dl
mov dword [eax], edx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
neg eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x1c]
cmp ecx, 0xfffffffd
setne al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x90]
cmp dword [eax], ebx
mov eax, esi
jne 0x10017bd7
mov eax, ebx
mov dword [ebp - 0x18], eax
xor edx, edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setge dl
sub edx, 0xf2c9
jne 0x10017bfe
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x90]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
or dword [ebp - 4], 0xffffffff
call fcn.10015f83
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x2c], 0x4f84b811
mov dword [ebp - 0x24], 0xaa39ed08
mov dword [ebp - 0x1c], 0x3859
push esi
call fcn.10015766
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x10], ebx
jmp 0x10017c65
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5c]
mov dword [eax + ecx*4], 0x4fda7ef5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10017c55
inc dword [ebp - 0x28]
je 0x10017c7e
mov dword [ebp - 0x24], 0x509978f3
dec dword [ebp - 0x24]
jmp 0x10017d18
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x10], 0xef99
mov dword [ebp - 0x18], 0xb8b0d58e
inc dword [eax]
jne 0x10017cfe
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x24]
cmp dword [eax], 6
mov eax, dword [ebp - 0x28]
setle cl
add edx, ecx
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x28], eax
jl 0x10017cd3
mov eax, dword [ebp - 0x5c]
mov ecx, esi
cmp dword [eax], ebx
jne 0x10017cd5
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
imul eax, ecx
dec eax
dec eax
jne 0x10017ce2
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x18]
sub edx, ecx
sub edx, 2
add eax, edx
mov edx, ebx
je 0x10017d00
mov edx, esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, 0xf4fe10ef
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x5c]
call fcn.10015f83
push 2
lea ecx, [ebp - 0x114]
call fcn.10015766
mov dword [ebp - 0x10], 0x57976326
mov dword [ebp - 0x20], 0xa485bf25
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x10], ebx
jmp 0x10017d5a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x114]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10017d47
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], ebx
jl 0x10017d77
mov dword [ebp - 0x2c], 0xbeb7
dec dword [ebp - 0x2c]
dec dword [ebp - 0x10]
jns 0x10017d68
lea ecx, [ebp - 0x114]
call fcn.10015f83
push esi
lea ecx, [ebp - 0x78]
call fcn.10015766
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x10], 0x3e58bfc4
mov dword [ebp - 0x18], ebx
jmp 0x10017daf
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x128], 0xc64a6847
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10017d9e
mov dword [ebp - 0x18], ebx
jmp 0x10017dca
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x78]
mov dword [eax + ecx*4], 0xfb871c7b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10017dba
mov eax, dword [ebp - 0x78]
mov dword [eax], edi
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x128], ebx
je 0x10017e07
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10017e20
push ebx
push 0x16cb
push 0x1e59
push ebx
push 0x6f6
push 0x18b3
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x10017e20
push 7
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], ebx
jmp 0x10017e1b
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x2c]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x10017e12
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x128], ebx
jne 0x10017e35
mov eax, dword [ebp - 0x78]
dec dword [eax]
jns 0x10017dd4
mov dword [ebp - 0x10], 0x18
jmp 0x10017e52
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10017e4f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff3
jl 0x10017e3e
lea ecx, [ebp - 0x78]
call fcn.10015f83
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], 0x1e66c619
mov dword [ebp - 0x20], 0x3a4df6f9
mov dword [ebp - 0x20], 0xe9378f1e
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
jmp 0x10017e91
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x140], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10017e80
mov dword [ebp - 0x18], ebx
jmp 0x10017ead
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x150], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10017e9c
mov dword [ebp - 0x1c], ebx
jmp 0x10017fd5
mov dword [ebp - 0x18], 0x67a876e6
mov dword [ebp - 0x20], 0xcc92ea21
mov dword [ebp - 0x20], 0x32b96ce0
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0x395e2de4
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], 0x915bb002
mov dword [ebp - 0x18], ebx
jmp 0x10017fc5
mov dword [ebp - 0x28], 0xf25cbd94
mov dword [ebp - 0x28], ebx
jmp 0x10017f9e
push 4
lea ecx, [ebp - 0xcc]
call fcn.10015766
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], ebx
jmp 0x10017f2a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], 0x946507e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10017f17
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x20], eax
mov dword [eax + 4], ebx
push edi
lea ecx, [ebp - 0x9c]
call fcn.10015766
mov dword [ebp - 0x10], ebx
jmp 0x10017f60
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x9c]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10017f4d
mov eax, dword [ebp - 0x9c]
lea ecx, [ebp - 0x9c]
cmp dword [eax], ebx
jne 0x10017f87
call fcn.10015f83
mov eax, dword [ebp - 0x20]
inc dword [eax + 4]
cmp dword [eax + 4], esi
jle 0x10017f3c
jmp 0x10017f8c
call fcn.10015f83
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc]
call fcn.10015f83
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff6
jle 0x10017f02
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10017fc2
push ebx
push 0x8c0
push 0x59d
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 8
je 0x10017ef3
inc dword [ebp - 0x2c]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe3
jne 0x10017ebb
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x28], ebx
jmp 0x1001800d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001800a
push ebx
push 0xc2f
push ebx
call dword [sym.imp.GDI32.dll_GetRegionData]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffed
jge 0x10017fee
mov eax, dword [ebp - 0x30]
mov dword [eax], esi
jmp 0x10018026
mov dword [ebp - 0x2c], 0xbeb7
dec dword [ebp - 0x2c]
dec dword [eax]
cmp dword [eax], ebx
jge 0x1001801a
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], 0x1b
je 0x100181ff
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x30], 0x2fd4914d
mov dword [ebp - 0x20], 0x555b7cef
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10018073
push 0x6bc
push ebx
call esi
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1b
jne 0x10018044
jmp 0x100181ff
push 2
lea ecx, [ebp - 0xfc]
call fcn.10015766
xor ebx, ebx
mov dword [ebp - 0x10], 0xd8e5ccc9
mov dword [ebp - 0x10], ebx
jmp 0x100180af
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xfc]
mov dword [eax + ecx*4], 0xdf75dcec
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001809c
xor esi, esi
inc esi
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], ebx
jl 0x100180d3
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x100180ce
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
dec dword [ebp - 0x10]
jns 0x100180c0
lea ecx, [ebp - 0xfc]
call fcn.10015f83
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x2c], ebx
push esi
call fcn.10015766
push 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], ebx
jmp 0x10018111
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xa8]
mov dword [eax + ecx*4], 0xee7d214c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100180fe
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x24], eax
je 0x100181aa
mov dword [ebp - 0x30], esi
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0x30], 0xe6e7f737
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 0x90069f30
mov dword [ebp - 0x30], 0x6ba47c9d
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 0x80db959c
push 3
mov dword [ebp - 0x30], esi
pop edi
mov dword [ebp - 0x30], 0x19adb821
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], ebx
push edi
call fcn.10015766
mov dword [ebp - 0x10], ebx
jmp 0x1001818f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xe4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10018180
mov eax, dword [ebp - 0xe4]
lea ecx, [ebp - 0xe4]
inc dword [eax + 8]
call fcn.10015f83
jmp 0x100181d8
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], al
je 0x100181d8
push ebx
push 0x1ae3
push 0x26ea
push 0x3dc
push 0x6ec
push 0x920
push 0x95e
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x24]
sub esi, dword [eax]
mov eax, dword [ebp - 0xa8]
add ecx, esi
mov dword [eax], ecx
lea ecx, [ebp - 0xa8]
call fcn.10015f83
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [eax], ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret