Function at 0x10003b40
Capabilities:
Create directory
Create thread
Delete directory
Get disk information
Get geographical location
Get keyboard layout
Log keystrokes via polling
Manipulate console buffer
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push esi
push edi
cmp dword [0x10040b04], 0x4d662ae5
jne 0x10003d9b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RaiseException]
push 0x11d
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, 4
imul ecx, edx, 0x2b
mov edx, dword [0x100612e8]
mov dword [edx + ecx], eax
mov dword [ebp - 0x2c], 0x682
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0x7b
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x34], 0x14d8
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], 0x1ef9
mov dword [ebp - 0xc], 0xde7
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x38], 0xb89
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x24]
add eax, 0x1b
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x2156
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], 0xa07
mov edx, dword [ebp - 0x14]
and edx, 0x80000001
jns 0x10003e4d
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x10003e5c
mov eax, dword [ebp - 0x14]
add eax, 0x1def
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x30]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x44]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x28]
sub edx, 0x242a
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x30]
sub eax, 0x12ee
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x2021
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x172
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
and ecx, 0x80000001
jns 0x10003ed5
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x10003eed
cmp dword [ebp - 0x18], 0
jle 0x10003eed
mov edx, dword [ebp - 0x18]
add edx, 0x1de9
mov dword [ebp - 0x18], edx
jmp 0x10003ef8
mov eax, dword [ebp - 0x18]
sub eax, 0x1de9
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x1e79
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0xfd7
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x231b
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x1416
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x38]
sub edx, 0x8e3
mov dword [ebp - 0x38], edx
mov eax, 4
imul ecx, eax, 0x2b
mov edx, 4
imul eax, edx, 0
mov edx, dword [0x100612e8]
mov ecx, dword [edx + ecx]
mov dword [eax + ecx], 0x22b39d2
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0xd64
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x20]
add eax, 0xa81
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x44]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x2c]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x30]
add edx, 0x2027
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10003fd8
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
jmp 0x10003fbe
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x2146
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x12da
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x926
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0xde
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10004045
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x1000402b
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x171f
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x30]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x44]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10004086
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x1000406c
mov eax, dword [ebp - 0x28]
add eax, 0x667
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
add eax, 0x1afb
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x1f8
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x100040d4
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
jmp 0x100040ba
mov eax, dword [ebp - 0x10]
sub eax, 0xee0
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x38]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0xc]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x1c]
sub eax, 0xe7a
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x2303
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0xc]
add eax, 0x16e5
mov dword [ebp - 0xc], eax
mov ecx, 4
imul edx, ecx, 0x2b
mov eax, 4
shl eax, 0
mov ecx, dword [0x100612e8]
mov edx, dword [ecx + edx]
mov dword [eax + edx], 0xb509d77c
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x2c]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x1eda
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0x2057
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x28]
sub edx, 0x13b3
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x38]
add ecx, 0xbc7
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x95b
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
sub eax, 0x25a4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x1aff
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0x1340
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0x16b4
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x20]
add eax, 0x26c1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x24]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
sub eax, 0xb48
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x24]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x1d65
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x28]
and edx, 0x80000003
jns 0x1000423c
dec edx
or edx, 0xfffffffc
inc edx
test edx, edx
je 0x1000424d
mov eax, dword [ebp - 0x28]
sub eax, 0x18f
mov dword [ebp - 0x28], eax
jmp 0x10004259
mov ecx, dword [ebp - 0x28]
add ecx, 0x18f
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x813
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0xc]
and ecx, 0x80000001
jns 0x10004299
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x100042a8
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x10004289
mov eax, 4
imul ecx, eax, 0x2b
mov edx, 4
shl edx, 1
mov eax, dword [0x100612e8]
mov ecx, dword [eax + ecx]
mov dword [edx + ecx], 0x4b26c3cb
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x48], 0
jmp 0x100042e1
mov eax, dword [ebp - 0x48]
add eax, 1
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xf
jge 0x100042f2
mov ecx, dword [ebp - 0xc]
sub ecx, 4
mov dword [ebp - 0xc], ecx
jmp 0x100042d8
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x14]
and eax, 0x80000001
jns 0x1000430a
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10004319
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x100042fb
mov edx, dword [ebp - 0xc]
add edx, 0x165b
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x20]
sub eax, 0x67
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x219c
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x2c]
sub eax, 0x13e3
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0x2537
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
add edx, 0x8c4
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x28]
add eax, 0x10da
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x1004
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0xc]
add eax, 0x1d82
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0x13d9
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x38]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x4c], 0
jmp 0x10004400
mov edx, dword [ebp - 0x4c]
add edx, 1
mov dword [ebp - 0x4c], edx
cmp dword [ebp - 0x4c], 0x54
jge 0x10004411
mov eax, dword [ebp - 0xc]
sub eax, 8
mov dword [ebp - 0xc], eax
jmp 0x100043f7
mov ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x803
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x38]
add edx, 0x1dcc
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x20]
sub eax, 0x230
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x2245
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0x1c17
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x22b2
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0xc]
add eax, 0x2213
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x1da0
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x44]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x50], 0
jmp 0x100044bf
mov ecx, dword [ebp - 0x50]
add ecx, 1
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x50], 0xa
jge 0x100044d0
mov edx, dword [ebp - 0xc]
sub edx, 5
mov dword [ebp - 0xc], edx
jmp 0x100044b6
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x24]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x2c]
sub eax, 0x1e76
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x16e8
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x1b7d
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0x14f7
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov edx, 4
imul eax, edx, 0x2b
mov ecx, 4
imul edx, ecx, 3
mov ecx, dword [0x100612e8]
mov eax, dword [ecx + eax]
mov dword [edx + eax], 0x445b56eb
mov dword [ebp - 0x54], 0
jmp 0x1000458b
mov ecx, dword [ebp - 0x54]
add ecx, 1
mov dword [ebp - 0x54], ecx
cmp dword [ebp - 0x54], 0x44
jge 0x1000459c
mov edx, dword [ebp - 0x20]
sub edx, 4
mov dword [ebp - 0x20], edx
jmp 0x10004582
mov eax, dword [ebp - 0x20]
sub eax, 0x2624
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x1b13
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x100045d4
cmp dword [ebp - 0xc], 0
jle 0x100045d4
mov edx, dword [ebp - 0xc]
sub edx, 0x1faf
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x34]
and ecx, 0x80000003
jns 0x100045ed
dec ecx
or ecx, 0xfffffffc
inc ecx
test ecx, ecx
je 0x10004603
cmp dword [ebp - 0x34], 0
jle 0x10004603
mov edx, dword [ebp - 0x34]
add edx, 0x2155
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x155f
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x2c]
sub eax, 0xd42
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x133b
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x1334
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x30]
add eax, 0x10ac
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x34]
sub edx, 0x2127
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0xd80
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x1497
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x24]
and edx, 0x80000003
jns 0x100046c2
dec edx
or edx, 0xfffffffc
inc edx
test edx, edx
je 0x100046d9
cmp dword [ebp - 0x24], 0
jle 0x100046d9
mov eax, dword [ebp - 0x24]
sub eax, 0xdeb
mov dword [ebp - 0x24], eax
jmp 0x100046e5
mov ecx, dword [ebp - 0x24]
add ecx, 0xdeb
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x18]
sub edx, 0x13df
mov dword [ebp - 0x18], edx
cmp dword [0x10040b04], 0x4d662ae5
jne 0x100048b7
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ToUnicode]
call dword [sym.imp.USER32.dll_CreateMenu]
push 0
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
call dword [sym.imp.KERNEL32.dll_WakeAllConditionVariable]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push 0
push 0
call dword [sym.imp.USER32.dll_CreateAcceleratorTableW]
push 0
call dword [sym.imp.KERNEL32.dll_HeapLock]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessDEPPolicy]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0
call dword [sym.imp.USER32.dll_IsCharUpperW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
push 0
push 0x1006acf8
push 0
call dword [sym.imp.KERNEL32.dll_IsValidNLSVersion]
push 0
call dword [sym.imp.KERNEL32.dll_CancelSynchronousIo]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DeferWindowPos]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetRawInputDeviceList]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 0
call dword [sym.imp.USER32.dll_GetPhysicalCursorPos]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddIntegrityLabelToBoundaryDescriptor]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedPushListSListEx]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SendMessageCallbackW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckNameLegalDOS8Dot3W]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetPropW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LockFileEx]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
push 0
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push 0x1006ad2c
push 0
call dword [sym.imp.USER32.dll_CharNextExA]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PowerClearRequest]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0x123c
mov dword [ebp - 0x40], 0x1aa6
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xee1
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, 0x1993
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x3c]
add eax, 0x13
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 4]
add ecx, 0x20b6
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x3c]
add ecx, 0xa
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 8]
and edx, 0x80000001
jns 0x10004931
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x10004940
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x10004921
mov ecx, dword [ebp - 8]
sub ecx, 0x2167
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 0x2554
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x40]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x1000498d
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x10004973
mov eax, dword [ebp - 0x3c]
add eax, 5
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 4]
add ecx, 0x20df
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x14b1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 0x478
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x3c]
add ecx, 1
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x1d87
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x4d2
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 0x6b
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x1c64
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, 0x216f
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x3c]
add ecx, 0x18
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 4]
add edx, 0x161c
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x40]
and eax, 0x80000001
jns 0x10004a55
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10004a64
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
jmp 0x10004a46
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 4]
and ecx, 0x80000003
jns 0x10004a83
dec ecx
or ecx, 0xfffffffc
inc ecx
test ecx, ecx
je 0x10004a9b
cmp dword [ebp - 4], 0
jle 0x10004a9b
mov edx, dword [ebp - 4]
sub edx, 0x1794
mov dword [ebp - 4], edx
jmp 0x10004aa6
mov eax, dword [ebp - 4]
add eax, 0x1794
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1622
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, 0x25ac
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x40]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x3c]
add edx, 1
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 4]
sub eax, 0x1ccd
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, 0xab8
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x3c]
add ecx, 3
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 4]
sub edx, 0x8fd
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, 0xa42
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
sub eax, 0x1e50
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x22c0
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 4]
sub ecx, 0xfea
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, 0xe18
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x40]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1358
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x40]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x3c]
add edx, 1
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x22
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
and edx, 0x80000001
jns 0x10004bcc
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x10004bdd
mov eax, dword [ebp - 8]
add eax, 0x1a70
mov dword [ebp - 8], eax
jmp 0x10004be9
mov ecx, dword [ebp - 8]
sub ecx, 0x1a70
mov dword [ebp - 8], ecx
mov edx, 4
imul eax, edx, 0x85
mov ecx, dword [0x100612e8]
mov edx, dword [ebp - 0x3c]
mov dword [ecx + eax], edx
mov eax, 4
imul ecx, eax, 0x2b
mov edx, 4
shl edx, 1
mov eax, dword [0x100612e8]
mov ecx, dword [eax + ecx]
mov edx, dword [ecx + edx]
add edx, 0x94b62
mov eax, 4
imul ecx, eax, 0x2b
mov eax, 4
shl eax, 1
mov esi, dword [0x100612e8]
mov ecx, dword [esi + ecx]
mov dword [eax + ecx], edx
cmp dword [0x10040b04], 0x4d662ae5
jne 0x10004e44
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileById]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitCommEvent]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLongPathNameTransactedW]
push 0
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetClassWord]
push 0
push 0
call dword [sym.imp.USER32.dll_GetScrollPos]
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
push 0
push 0x1006ad48
call dword [sym.imp.USER32.dll_OemToCharW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
call dword [sym.imp.USER32.dll_IsChild]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
call dword [sym.imp.KERNEL32.dll_DisableThreadProfiling]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPagesNuma]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetCoalescableTimer]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DrawTextW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DeferWindowPos]
xor eax, eax
xor edx, edx
xor esi, esi
xor edi, edi
xor ecx, ecx
push ebx
mov ebx, edi
lock cmpxchg8b qword [esi]
mov edi, ebx
pop ebx
push 0
call dword [sym.imp.USER32.dll_TrackMouseEvent]
push 0
push 0
call dword [sym.imp.USER32.dll_GetIconInfo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTapePosition]
push 0
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeClientComputerNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommModemStatus]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
pop esi
mov esp, ebp
pop ebp
ret