Function at 0x10020e67
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x10061302
call fcn.10060138
sub esp, 0x270
and dword [ebp - 0x1b0], 0
push ebx
push esi
push edi
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0xb4], ecx
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], eax
push 3
mov dword [ebp - 0x2c], edx
call fcn.10004840
mov dword [ebp - 0x30], 0xa50b5f0
mov dword [ebp - 0x18], 0
jmp 0x10020ec7
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x16c]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10020eb7
mov dword [ebp - 0x18], 0
jmp 0x10020ee7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x178], 0xd744d028
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10020ed6
inc dword [ebp - 0x174]
lea ecx, [ebp - 0x16c]
call fcn.1000489d
mov dword [ebp - 0x1c], 0x5bb4
cmp dword [ebp - 0x1c], 0x5c2c
jle 0x10020f8b
xor esi, esi
mov dword [ebp - 0x24], esi
xor eax, eax
mov dword [ebp - 0x28], 0x7009
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
xor edi, edi
mov ecx, edi
mov dword [ebp - 0x18], esi
xor ebx, ebx
shl esi, cl
mov eax, esi
lea ecx, [ebp - 0x218]
or eax, ebx
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10020f49
mov eax, dword [eax]
push eax
call fcn.10047e1c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x218]
call fcn.10004d0a
inc ebx
cmp ebx, 0x759f
jl 0x10020f2d
mov esi, dword [ebp - 0x14]
inc edi
cmp edi, 0x55d6
jl 0x10020f24
mov esi, dword [ebp - 0x24]
add dword [ebp - 0x14], esi
dec dword [ebp - 0x28]
jne 0x10020f1f
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x7d31
jl 0x10020f13
cmp dword [ebp - 0x1c], 0x595d
mov dword [ebp - 0x64], 0x2b051200
mov dword [ebp - 0x60], 0x3e033006
mov dword [ebp - 0x5c], 0x3010d02
mov word [ebp - 0x58], 0xd04
jge 0x10020fba
push str.bcyiyjns_dphhkc_kxktj_rhj_nejkqe_kppviym_slfk_nzwcm_opya_snt_xmsa_lqzey_xvdlkv_eoqiijg
call fcn.10047e1c
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0x7b5e
cmp dword [ebp - 0x24], 0x7e2d
jle 0x10021063
xor edi, edi
mov dword [ebp - 0x14], edi
xor esi, esi
mov dword [ebp - 0x28], esi
mov ecx, esi
mov dword [ebp - 0x18], edi
mov esi, edi
xor ebx, ebx
sar esi, cl
xor edi, edi
mov ecx, edi
mov eax, ebx
sar eax, cl
lea ecx, [ebp - 0x260]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10021010
mov eax, dword [eax]
push eax
call fcn.10047e1c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x260]
call fcn.10004d0a
inc edi
cmp edi, 0x74
jl 0x10020ff0
inc ebx
cmp ebx, 0x52dd
jl 0x10020fee
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x26ad
jl 0x10020fe3
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x342e
jl 0x10020fde
push 0x1f0c
push 0x2414
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0x28], 0x3413
cmp dword [ebp - 0x24], 0x7853
jge 0x1002107e
push str.esy_bewnlpsq_lquqfpoe_cezk_nefmkcf
call fcn.10047e1c
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0
jmp 0x1002109c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1ac], 1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002108b
dec dword [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
jmp 0x10021129
mov dword [ebp - 0x28], 0x9dbea522
xor edx, edx
mov dword [ebp - 0x14], 0xb372ba29
mov dword [ebp - 0x14], 0x487223b1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], 0xc9eb
imul ecx, dword [ebp - 0x14], 0xa00c
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x1ac]
setne dl
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0x75d5
setl al
cmp eax, 0xf746e33a
jae 0x1002110a
cmp dword [ebp - 0x1ac], 0
jne 0x1002110a
xor ecx, ecx
jmp 0x1002110d
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x28]
add eax, 0x718e5034
add eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x30
jle 0x100210ae
push 0x47
pop eax
push 2
pop ebx
push 3
mov word [ebp - 0xf4], ax
xor esi, esi
pop edi
mov dword [ebp - 0x28], 0x1994
cmp dword [ebp - 0x28], 0x428
jge 0x10021299
lea eax, [ebp - 0x4c]
push eax
push 0x1006c314
call fcn.100480d2
pop ecx
pop ecx
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x80], esi
call fcn.1000cd17
mov dword [ebp - 0x84], eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], esi
call fcn.1000cd17
mov dword [ebp - 0x7c], eax
mov byte [ebp - 4], 5
mov edi, esi
jmp 0x1002125a
dec eax
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
push str._d__d__d_n
call fcn.100480d2
add edi, dword [ebp - 0x88]
lea eax, [ebp - 0x6c]
add esp, 0x10
lea ecx, [ebp - 0x84]
push eax
call fcn.1000c5ac
test eax, eax
jne 0x10021219
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x7c]
call fcn.1000c5ac
test eax, eax
jne 0x10021219
movzx eax, byte [0x1007dd27]
push eax
lea eax, [ebp - 0x6c]
push eax
push ecx
lea eax, [ebp - 0x1f8]
push eax
lea ecx, [ebp - 0x84]
call fcn.1000cd42
movzx eax, byte [0x1007dd27]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x1f0]
jmp 0x10021250
movzx eax, byte [0x1007dd27]
add esi, dword [ebp - 0x88]
push eax
lea eax, [ebp - 0x68]
push eax
push ecx
lea eax, [ebp - 0x200]
push eax
lea ecx, [ebp - 0x84]
call fcn.1000cd42
movzx eax, byte [0x1007dd27]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x1e8]
push ecx
push eax
lea ecx, [ebp - 0x7c]
call fcn.1000cd42
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x1002119d
dec eax
sub edi, esi
cmp edi, esi
mov dword [ebp - 0x4c], eax
cmovl esi, edi
push esi
push str._ld_n
call fcn.10047e1c
pop ecx
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.1000c583
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.1000c583
push 3
xor esi, esi
pop edi
mov dword [ebp - 0x1c], 0x43cdf98a
mov dword [ebp - 0x14], esi
jmp 0x100212b6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1d4], 0xc93b4e1a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100212a5
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], esi
jl 0x10021312
mov dword [ebp - 0x24], 0x1da622a1
mov dword [ebp - 0x14], esi
jmp 0x100212e4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1e0], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100212d3
mov dword [ebp - 0x1e0], 0x9c3fbb4
mov dword [ebp - 0x24], esi
jmp 0x10021307
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x1d4], esi
jne 0x1002130d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x100212f8
dec dword [ebp - 0x1c]
jns 0x100212c7
movzx eax, byte [ebp + ebx - 0x66]
movzx ecx, byte [ebp + ebx - 0x63]
movzx eax, word [ebp + eax*2 - 0xf4]
mov edx, eax
and eax, ecx
or edx, ecx
sub edx, eax
movzx eax, byte [ebp + ebx - 0x64]
add ebx, 2
mov word [ebp + eax*2 - 0xf4], dx
cmp ebx, 0xe
jb 0x10021145
xor eax, eax
mov dword [ebp - 0x14c], 7
mov word [ebp - 0xe6], ax
lea ecx, [ebp - 0x160]
mov word [ebp - 0x160], ax
xor ebx, ebx
lea eax, [ebp - 0xf4]
mov dword [ebp - 0x150], ebx
push eax
call fcn.10004d4e
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x14], 0x844a7543
mov dword [ebp - 0x1c], 0xec3203bd
push edi
call fcn.10004840
mov dword [ebp - 0x28], 0x7b5cf1c9
xor ecx, ecx
mov dword [ebp - 0x24], edi
inc ecx
mov dword [ebp - 0x18], ebx
jmp 0x100213b6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x54], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100213ac
mov dword [ebp - 0x18], ebx
jmp 0x100213d3
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10c]
mov dword [eax + ecx*4], 0xaf0a9b27
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100213c0
mov eax, dword [ebp - 0x14]
xor edx, edx
mov edi, 0x8c66
mov dword [ebp - 0x54], edi
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x10c]
neg edx
sbb edx, edx
inc edx
cmp edx, 0xe6f7fbf2
mov edx, dword [esi + 8]
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, edi
setl cl
xor eax, eax
cmp ecx, edx
setne al
sub eax, edx
sub eax, 0xfffffff7
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
je 0x10021440
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1002145c
push ebx
call dword [sym.imp.COMDLG32.dll_FindTextW]
jmp 0x1002145c
mov dword [ebp - 0x28], 0x42be197e
dec dword [ebp - 0x28]
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1002145c
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
cmp dword [esi + 8], 9
setge cl
xor eax, eax
cmp ecx, dword [esi + 8]
setg al
cmp eax, dword [ebp - 0x14]
jle 0x10021497
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1c], eax
jmp 0x100214af
mov dword [ebp - 0x30], 0x4fa72d50
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x30], 0x3747c914
dec dword [ebp - 0x24]
lea ecx, [ebp - 0x10c]
call fcn.1000489d
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 0x35ba
cmp dword [ebp - 0x1c], 0x3641
jle 0x1002154c
mov dword [ebp - 0x24], ebx
mov eax, ebx
mov dword [ebp - 0x14], 0x3bef
mov dword [ebp - 0x28], eax
mov esi, ebx
mov edi, eax
mov ecx, esi
shl edi, cl
mov eax, edi
lea ecx, [ebp - 0x230]
and eax, ebx
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10021502
mov eax, dword [eax]
push eax
call fcn.10047e1c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.10004d0a
inc ebx
cmp ebx, 0x3b71
jl 0x100214e6
mov eax, dword [ebp - 0x28]
inc esi
push 0
pop ebx
cmp esi, 0x4ae8
jl 0x100214e0
mov edi, dword [ebp - 0x24]
add eax, edi
dec dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
jne 0x100214de
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x550
jl 0x100214d2
mov esi, dword [ebp - 0x18]
cmp dword [ebp - 0x1c], 0x3216
jge 0x10021560
push str.uzgcvezk_drtw_xva_pxupebx_gtscxgata_rgphsn_hqlr
call fcn.10047e1c
pop ecx
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x24], 0x4bda99da
mov dword [ebp - 0x30], ebx
push 3
call fcn.10004840
mov dword [ebp - 0x28], 0x9c1c50d5
mov dword [ebp - 0x50], 0x1a2955e3
mov dword [ebp - 0x1c], ebx
jmp 0x100215a6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x74], 0x9be1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10021598
mov dword [ebp - 0x1c], ebx
jmp 0x100215c4
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], 0x7520
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100215b1
cmp dword [ebp - 0x18], ebx
je 0x100216b5
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x100215e9
push ebx
push 0x24af
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x100215fe
push ebx
push 0x21a2
call dword [sym.imp.USER32.dll_ValidateRect]
xor edi, edi
inc edi
mov eax, dword [ebp - 0x18]
xor ebx, ebx
mov eax, dword [ebp - 0x70]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x100]
setg bl
xor edx, edx
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x18]
cmp ebx, ecx
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor ebx, ebx
sub ecx, dword [ebp - 0x24]
je 0x1002163a
cmp dword [ebp - 0x74], ebx
je 0x1002163a
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x24]
add ecx, 0x883eb999
cmp ecx, eax
lea ecx, [ebp - 0x100]
sete dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x50], eax
call fcn.1000489d
xor eax, eax
mov word [ebp + esi*2 - 0xf4], ax
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 8
jb 0x100214bf
push 6
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x118]
pop esi
mov dword [ebp - 0x18], 0x7f6cc9ca
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x14], esi
push edi
call fcn.10004840
mov dword [ebp - 0x14], ebx
jmp 0x10021769
xor edi, edi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x18], ebx
inc edi
jmp 0x10021748
mov dword [ebp - 0x14], 0xf2887cf2
mov dword [ebp - 0x50], 0xccae
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], ebx
jl 0x10021745
mov dword [ebp - 0x1c], 0xfc2285fa
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x100216f5
push 0x296
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], ebx
jl 0x10021740
mov dword [ebp - 0x28], 5
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x74], ebx
jne 0x1002172f
cmp dword [ebp - 0x50], ebx
je 0x10021715
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x74]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x1c]
jns 0x100216fd
dec dword [ebp - 0x14]
jns 0x100216d9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x100216c3
jmp 0x10021601
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x118]
mov dword [eax + ecx*4], 0x6bf5ee87
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10021756
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, 0xf451dba1
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
cmp edx, 0xe0c2
jg 0x100217bc
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
sub ecx, eax
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], 0xffffffe9
jmp 0x10021812
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1002180a
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x10021805
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x118]
cmp dword [eax + ecx*4], ebx
jne 0x10021805
dec dword [ebp - 0x14]
jns 0x100217f2
dec dword [ebp - 0x18]
jns 0x100217ea
cmp dword [ebp - 0x30], ebx
jne 0x10021818
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xc
jne 0x100217db
lea ecx, [ebp - 0x118]
call fcn.1000489d
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1c8]
call fcn.10007640
mov byte [ebp - 4], 9
mov dword [ebp - 0x18], 0x5c96
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x18], ebx
je 0x1002192f
mov dword [ebp - 0x14], 0xc63c4078
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x2c], 3
push 2
call fcn.10004840
push 4
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0xa
call fcn.10004840
mov dword [ebp - 0x1c], ebx
jmp 0x1002188c
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x124]
mov dword [eax + ecx*4], 0xc58f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10021879
mov dword [ebp - 0x1c], ebx
jmp 0x100218aa
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x130]
mov dword [eax + ecx*4], 0xef2f37fc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10021897
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x100218c1
push ebx
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x14]
add edx, esi
jne 0x100218e3
cmp dword [ebp - 0x18], ebx
jne 0x100218e3
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jge 0x10021908
mov eax, dword [ebp - 0x124]
cmp dword [eax], ebx
jne 0x10021908
mov ecx, ebx
cmp dword [ebp - 0x18], ebx
je 0x1002190a
mov ecx, edi
mov eax, dword [ebp - 0x130]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x130]
call fcn.1000489d
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 9
call fcn.1000489d
jmp 0x10021935
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], ebx
jmp 0x10021958
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10021955
push ebx
push 0x21e7
push ebx
push 0x993
call dword [sym.imp.USER32.dll_SetTimer]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff7
jne 0x1002193a
push 2
lea ecx, [ebp - 0xcc]
call fcn.10004840
mov dword [ebp - 0x18], 0x4a18885c
mov dword [ebp - 0x14], ebx
jmp 0x1002198a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], 0x9b3198a8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10021977
xor eax, eax
mov dword [ebp - 0x18], ebx
inc eax
jmp 0x10021a0c
mov dword [ebp - 0x28], 0xfd94fe5f
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jl 0x10021a09
mov dword [ebp - 0x1c], 0xe9323d1b
mov dword [ebp - 0x1c], ebx
jmp 0x100219ff
mov dword [ebp - 0x14], 0xcbcef054
mov dword [ebp - 0x14], ebx
jmp 0x100219f7
mov dword [ebp - 0x24], 0x3e38693
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jg 0x100219f4
mov esi, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xcc]
mov eax, dword [ecx + eax*4]
sub eax, dword [esi + 4]
mov dword [ecx + edx*4], eax
xor eax, eax
inc dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x24], eax
jle 0x100219d4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x100219bf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x100219b3
dec dword [ebp - 0x28]
jns 0x100219a7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x10021998
lea ecx, [ebp - 0xcc]
call fcn.1000489d
mov dword [ebp - 0x48], 0xb4041d00
mov word [ebp - 0x44], 0x17ac
mov byte [ebp - 0x42], 0x44
mov dword [ebp - 0x28], 0x39924432
mov dword [ebp - 0x2c], 0x31f145ba
mov dword [ebp - 0x14], ebx
jmp 0x10021a51
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x94], 0x64a6847d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10021a40
mov dword [ebp - 0x94], ebx
jmp 0x10021a7a
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10021a74
push ebx
push 0x10dd
call dword [sym.imp.USER32.dll_MapDialogRect]
dec dword [ebp - 0x94]
cmp dword [ebp - 0x94], 0xfffffffa
jle 0x10021a5f
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], ebx
jl 0x10021ac9
mov eax, 0x15362daa
mov dword [ebp - 0x2c], 0x5c9e53e5
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x14], 0x3bfa32a1
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jns 0x10021a94
push 0x5c
pop eax
push 2
mov word [ebp - 0x3c], ax
mov edi, ebx
pop esi
cmp esi, 2
jne 0x10021ae1
push 5
pop edi
push edi
pop esi
jmp 0x10021b4a
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x14], ebx
jmp 0x10021b1b
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10021b06
push 0x170e
push 0x23b7
call dword [sym.imp.USER32.dll_GetWindow]
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10021b18
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe9
jge 0x10021aed
movzx edx, byte [ebp + esi - 0x47]
mov eax, esi
sub eax, edi
mov edi, ebx
movzx eax, byte [ebp + eax - 0x4a]
movzx ecx, word [ebp + eax*2 - 0x3c]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x48]
add ecx, edx
mov word [ebp + eax*2 - 0x3c], cx
add esi, 2
cmp esi, 7
jb 0x10021ad5
xor edi, edi
mov dword [ebp - 0x18], 0xc8b13eca
mov dword [ebp - 0x2c], 0xfffffffa
inc edi
cmp dword [ebp - 0x18], ebx
je 0x10021d5e
push edi
lea ecx, [ebp - 0xc0]
call fcn.10004840
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x28], 0x3e2e
cmp dword [ebp - 0x28], 0x3f75
jle 0x10021bfe
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
xor edi, edi
xor esi, esi
mov eax, edi
cdq
idiv esi
mov eax, ebx
mov ecx, edx
sar eax, cl
lea ecx, [ebp - 0x248]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10021bc0
mov eax, dword [eax]
push eax
call fcn.10047e1c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.10004d0a
inc esi
cmp esi, 0x6787
jl 0x10021b9d
inc edi
cmp edi, 0x3654
jl 0x10021b9b
inc ebx
cmp ebx, 0x133a
jl 0x10021b99
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
xor edi, edi
inc edi
mov dword [ebp - 0x14], ebx
jmp 0x10021c16
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], 0xf34fda0e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10021c03
cmp dword [ebp - 0x28], 0x3da7
jge 0x10021c2f
push str.nxjp_zkokb_nlamhazu_ghhu_frbj_logxtzbf_iaumgthw_lbtjngg_fnmizgcnm_vpxbtyl_hgqrq_jqnmxhcck_jrtdebp_wwnczw
call fcn.10047e1c
pop ecx
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x10021d4d
mov esi, 0x36b1
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xac], esi
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], 0x3cc9f196
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0xac], ebx
jne 0x10021c7b
mov edx, ebx
cmp dword [ebp - 0x18], ebx
je 0x10021c7d
mov edx, edi
mov eax, dword [ebp - 0xc0]
xor ecx, ecx
cmp dword [eax], ebx
setle cl
cmp ecx, dword [ebp - 0xa8]
jge 0x10021c99
mov eax, ebx
cmp dword [ebp - 0x18], ebx
je 0x10021c9b
mov eax, edi
mov dword [ebp - 0x1c], 0xfffe
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x18]
cmp ecx, 0xcf04
setne al
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xa4]
sub ecx, eax
mov eax, dword [ebp - 0xa8]
imul eax, edx
imul eax, ecx
cmp eax, 0xe283d1f0
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ebx
jmp 0x10021d3f
mov dword [ebp - 0x14], ebx
jmp 0x10021d37
mov dword [ebp - 0x24], ebx
jmp 0x10021d2f
mov dword [ebp - 0x28], 0x69209a48
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x10021d2c
mov eax, dword [ebp - 0x18]
xor ebx, ebx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc0]
mov eax, dword [ecx + eax*4]
cmp eax, dword [ecx + edx*4]
setg bl
xor ecx, ecx
cmp ebx, 4
setg cl
xor eax, eax
cmp ecx, 0x1dd7
setne al
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x28]
jns 0x10021cf8
xor ebx, ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10021ce9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10021ce4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10021cdf
dec dword [ebp - 0x18]
jns 0x10021c47
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 9
call fcn.1000489d
jmp 0x10021d6b
mov dword [ebp - 0x2c], 0x73d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov word [ebp - 0x3a], ax
mov dword [ebp - 0x24], 0x69bd
push edi
call fcn.10004840
mov dword [ebp - 0x1c], 0xc6d21cd
push 6
pop esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x14], 0x67df2ddf
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x14], ebx
jmp 0x10021dba
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa0]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10021daa
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x24]
setle cl
xor ebx, ebx
cmp eax, ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xa0]
setne bl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp ebx, edx
setle cl
imul eax, ecx
test eax, eax
je 0x10021e04
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0xa0]
mov edx, dword [eax]
test edx, edx
setns cl
xor eax, eax
cmp ecx, edx
setge al
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0xa
cmp dword [ebp - 0x1c], 0x1d
jge 0x10021ede
mov ecx, dword [ebp - 0xa0]
xor edx, edx
mov dword [ebp - 0x24], 0x4acc
mov dword [ebp - 0x14], 0xfffffffa
cmp dword [ecx], 0x9ed5
mov eax, dword [ecx]
setne dl
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ebx, ebx
cmp eax, edx
setne bl
xor ecx, ecx
imul ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x28]
cmp eax, ebx
setl cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sub ecx, 0xc7e7
cmp ecx, eax
setg dl
xor ebx, ebx
neg edx
je 0x10021ea8
mov eax, edi
cmp dword [ebp - 0x24], ebx
jne 0x10021eaa
mov eax, ebx
imul ecx, eax, 0xfffffff9
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setge dl
imul edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x2c]
je 0x10021ec9
mov dword [ebp - 0x14], 0xa3d35555
jmp 0x10021ecf
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1d
jl 0x10021e31
jmp 0x10021ee0
xor ebx, ebx
lea ecx, [ebp - 0xa0]
call fcn.1000489d
xor eax, eax
mov dword [ebp - 0xd0], 7
mov word [ebp - 0xe4], ax
lea ecx, [ebp - 0xe4]
lea eax, [ebp - 0x3c]
mov dword [ebp - 0xd4], ebx
push eax
call fcn.10004d4e
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x18], 0x99cf
mov dword [ebp - 0x1c], 0x62a2b3b7
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
sete cl
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
jne 0x10021faf
cmp dword [ebp - 0x18], esi
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x18]
jne 0x10021faf
push 3
lea ecx, [ebp - 0x13c]
call fcn.10004840
mov dword [ebp - 0x14], ebx
jmp 0x10021f72
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x13c]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10021f63
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x10021fa2
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10021f9d
push 0x11fd
push 0xed3
call dword [sym.imp.GDI32.dll_SetTextAlign]
dec dword [ebp - 0x18]
jns 0x10021f84
lea ecx, [ebp - 0x13c]
call fcn.1000489d
jmp 0x10021fe7
mov dword [ebp - 0x1c], 0x19
jmp 0x10021fe1
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10021fc9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10021fde
push 0xa82
push ebx
call dword [sym.imp.KERNEL32.dll_WinExec]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jg 0x10021fb8
push 0x5f
pop eax
push 2
mov dword [ebp - 0x3c], ebx
mov ecx, ebx
mov dword [ebp - 0x38], 0x1c021400
mov byte [ebp - 0x34], 0x1a
mov word [ebp - 0x40], ax
pop esi
cmp esi, 2
jne 0x1002200d
push 3
pop ecx
push ecx
pop esi
jmp 0x10022034
movzx edx, byte [ebp + esi - 0x37]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x3a]
movzx eax, word [ebp + eax*2 - 0x40]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + esi - 0x38]
mov word [ebp + eax*2 - 0x40], cx
mov ecx, ebx
add esi, 2
cmp esi, 5
jb 0x10022001
xor eax, eax
mov word [ebp - 0x3e], ax
mov dword [ebp - 0x28], 0x4ce8
cmp dword [ebp - 0x28], 0x4e55
jle 0x1002209b
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x278]
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10022071
mov eax, dword [eax]
push eax
call fcn.10047e1c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x278]
call fcn.10004d0a
inc edi
cmp edi, 0x65c
jl 0x10022056
inc esi
cmp esi, 0x692f
jl 0x10022054
xor edi, edi
inc edi
xor eax, eax
mov dword [ebp - 0x17c], 7
mov word [ebp - 0x190], ax
lea ecx, [ebp - 0x190]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x180], ebx
push eax
call fcn.10004d4e
cmp dword [ebp - 0x28], 0x4ba1
jge 0x100220d7
push str.cvehzeejt_cbfjfys_bssuzpl_zla_erunjb_emwildt_mhmcnksz
call fcn.10047e1c
pop ecx
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x2c], 0x764ce34a
mov dword [ebp - 0x18], ebx
jmp 0x1002219a
xor ecx, ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, 0xe8fe
mov eax, dword [ebp - 0x28]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, 0xfffc
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x18]
jne 0x10022184
mov ecx, ebx
cmp dword [ebp - 0x14], ebx
je 0x10022186
mov ecx, edi
xor eax, eax
cmp ecx, 0x2c5d177c
setne al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1b
jne 0x100220f7
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], 0x11151c
mov dword [ebp - 0x14], 0x477862fd
mov dword [ebp - 0x14], ebx
jmp 0x100221ed
mov dword [ebp - 0x24], ebx
jmp 0x100221d3
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x148], 0xe08974b6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x100221c2
cmp dword [ebp - 0x148], ebx
jne 0x100221f3
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1a
jne 0x100221bd
push dword [ebp - 0xd4]
cmp dword [ebp - 0xd0], 8
lea eax, [ebp - 0xe4]
push ebx
cmovae eax, dword [ebp - 0xe4]
lea ecx, [ebp - 0x1c8]
push eax
call fcn.1000c68e
cmp eax, 0xffffffff
je 0x10022238
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x190]
push ecx
push edi
push eax
lea ecx, [ebp - 0x1c8]
call fcn.1000ce3f
jmp 0x100221f3
mov ecx, dword [ebp - 0xb4]
lea eax, [ebp - 0x1c8]
push eax
lea edx, [ebp - 0x160]
call fcn.10022472
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x190]
call fcn.10004dd6
push ebx
push edi
lea ecx, [ebp - 0xe4]
call fcn.10004dd6
push ebx
push edi
lea ecx, [ebp - 0x1c8]
call fcn.10004dd6
push ebx
push edi
lea ecx, [ebp - 0x160]
call fcn.10004dd6
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xb4]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret