Function at 0x10001c00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov edx, 0x10005495
mov esi, dword [edx + 0x18]
mov esi, dword [ebp - 0xc]
mov di, 0xc5
mov eax, dword [edx]
mov dword [ebp - 0x10], edx
mov dword [edx], eax
mov dword [ebp - 8], eax
and dword [edx + 0x84], 0xffffff
mov eax, dword [0x10005480]
mov edx, dword [0x10005494]
add edi, eax
mov edx, dword [0x100054e0]
mov dword [ebp - 0x10], edx
mov dword [0x1000537c], edx
mov edi, dword [ebp - 8]
mov edx, dword [0x10005544]
mov edi, dword [ebp - 0x10]
sub eax, edi
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [0x100055c8], eax
mov dword [ebp - 0xc], eax
push str.shell32
call sub.KERNEL32.dll_LoadLibraryA
mov edi, eax
mov ecx, 0x100000
mov eax, dword [ebp - 8]
mov eax, dword [0x10005394]
sub eax, edx
mov dword [ebp - 0x10], eax
mov dword [0x1000557c], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0xc], eax
mov edx, dword [edi + ecx]
cmp edx, dword [0x1002974a]
je 0x10001cdd
dec ecx
jne 0x10001c8a
mov eax, dword [0x100055ec]
mov eax, dword [ebp - 8]
add eax, eax
mov edx, dword [ebp - 0xc]
sub eax, dword [0x100054f4]
mov ax, 4
mov dword [ebp - 0x10], eax
mov dword [0x1000573c], eax
mov dword [0x10005450], edx
mov dword [ebp - 0x10], eax
push 0
call 0x10001ccb
jb 0x10001d38
jns 0x10001ccf
add byte [eax], al
dec ebx
add byte [ebx], cl
cmp dword [edi + 0x44], esp
pop ecx
jns 0x10001d53
add byte [edx + 0x1000547d], bh
mov edx, 0x1000547d
mov edi, dword [edx + 4]
mov cx, 0x80
sub eax, eax
mov dword [ebp - 8], esi
mov dword [edx + 0xc], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xc], edi
push 0x100053b4
call sub.user32.dll_CharNextA
mov eax, 0x1000548d
mov edi, dword [eax + 0x10]
mov esi, dword [ebp - 8]
add esi, edx
sbb esi, dword [eax + 8]
mov dword [ebp - 8], eax
mov dword [eax], eax
mov dword [ebp - 0xc], esi
mov dword [eax], eax
mov dword [0x10005464], eax
call sub.user32.dll_GetActiveWindow
mov esi, 0x10005489
mov edx, dword [ebp - 0xc]
mov eax, dword [esi + 0x18]
mov cx, 0xf3
mov dword [ebp - 8], eax
mov dword [esi], eax
push es
mov eax, dword [ebp - 0xc]
sub eax, eax
cmp dword [esi], 0xcd
ja 0x10001d60
mov eax, dword [ebp - 0xc]
mov dword [0x10005488], edx
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 0x10]
mov eax, 0x40
inc esi
adc byte [eax + 0x40], bh
mov dword [ebp - 8], eax
mov dword [esi + 8], edx
call fcn.100019e0
mov esi, 0x100054c5
mov eax, dword [esi + 0x14]
mov edx, dword [ebp - 0x10]
mov eax, 0x40
mov eax, dword [esi + 0x14]
mov dword [ebp - 8], 8
mov dword [esi + 0x14], esi
mov eax, dword [0x10005608]
mov eax, dword [0x1000572c]
mov eax, dword [ebp - 0xc]
sub eax, edi
mov eax, dword [ebp - 8]
mov esi, dword [0x100056d0]
mov ax, 4
mov dword [ebp - 8], edx
mov dword [0x100055ec], eax
call fcn.10001ab0
push 0x10005738
call sub.user32.dll_CharNextA
call fcn.10001a00
mov edi, 0x1000549d
mov eax, dword [edi]
mov ax, 0x7a
mov dword [ebp - 0xc], eax
mov dword [edi + 4], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
xor edi, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetWindowTextLengthA
mov edi, 0x10005485
mov eax, dword [edi]
mov eax, dword [ebp - 8]
and edx, eax
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [edi + 0x10], eax
sbb dword [ebp - 8], eax
call fcn.10002250
mov eax, 0x100054c1
mov edx, dword [eax + 0x18]
mov esi, dword [ebp - 8]
mov ecx, 0x80
mov edx, dword [eax + 0x14]
mov edi, dword [ebp - 8]
sub edi, edx
and dword [ebp - 8], 0xeeee00ee
mov dword [eax], edx
mov dword [eax], eax
mov ecx, dword [ebp - 0x10]
call fcn.10002250
mov esi, dword [0x10005458]
mov ecx, dword [ebp - 8]
mov eax, 8
mov eax, dword [ebp - 0x10]
sub edi, edi
mov dword [ebp - 0xc], eax
mov dword [0x10005704], edi
mov dword [ebp - 8], eax
mov dword [0x100054fc], esi
push 0x1000554c
call sub.KERNEL32.dll_lstrlenA
mov edi, 0x100054ad
mov edx, dword [edi + 0xc]
mov ax, 0x6a
mov eax, dword [edi]
mov dword [ebp - 0xc], edx
mov dword [edi + 4], edi
mov dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x10]
call fcn.10002750
call sub.user32.dll_GetActiveWindow
mov eax, dword [0x10005718]
mov edx, 0xa2
mov eax, dword [ebp - 8]
add edx, eax
mov dword [ebp - 8], eax
mov dword [0x10005370], esi
and dword [0x100054e8], edx
mov dword [ebp - 8], esi
call fcn.10002250
mov dword [ebp - 0xc], ecx
lea esi, [ebp - 0xc]
mov dword [0x10005400], edx
push esi
call sub.user32.dll_CharNextA
call fcn.10001930
mov eax, 0x100054a5
sbb esi, dword [eax + 0x18]
mov ecx, dword [ebp - 0xc]
add edx, esi
mov ecx, dword [ebp - 8]
add ecx, esi
mov dword [ebp - 8], esi
mov dword [eax + 0x18], edi
mov dword [eax], edx
or dword [0x100055c4], ecx
mov dword [0x10005658], ecx
push 0x100055dc
call sub.KERNEL32.dll_lstrlenA
call fcn.10001250
mov eax, dword [0x100053b4]
mov eax, dword [ebp - 8]
sub ecx, eax
mov eax, dword [0x100054c4]
mov ecx, 2
cmp edi, dword [0x10005424]
je 0x10001f3a
mov dword [0x10005390], eax
mov edi, dword [0x100056e0]
mov edi, dword [ebp - 8]
mov ax, 3
mov eax, dword [ebp - 0x10]
mov esi, dword [0x10005564]
inc dword [ebp - 8]
mov dword [0x10005658], eax
mov dword [ebp - 0xc], edi
adc dword [0x10005380], eax
mov eax, dword [ebp - 0xc]
mov dword [0x1000568c], eax
and eax, dword [0x100055d4]
add ecx, eax
mov eax, dword [0x10005418]
mov di, 0xfd
mov dword [ebp - 0xc], esi
mov dword [0x10005588], eax
mov dword [0x1000545c], eax
and edi, dword [0x100054fc]
call fcn.10001930
call fcn.10001a00
mov edi, dword [0x100055fc]
mov ecx, dword [ebp - 0x10]
mov edx, 0xba
mov edi, dword [0x10005648]
mov dword [ebp - 0x10], edi
mov dword [0x100053f0], edi
mov dword [ebp - 0x10], edi
mov dword [0x100053f8], eax
call fcn.10001460
mov eax, dword [0x10005434]
sub edx, ecx
mov edi, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov dword [0x10005370], eax
mov dword [ebp - 0x10], eax
mov dword [0x10005718], edi
mov edi, dword [ebp - 0x10]
mov eax, dword [0x10005660]
mov eax, dword [ebp - 8]
mov edi, 2
mov eax, dword [0x1000562c]
mov dword [ebp - 0xc], edi
mov dword [0x100055d8], esi
mov dword [0x10005564], eax
adc edx, dword [0x100054d4]
call fcn.10001a00
mov esi, dword [0x100053b4]
sub eax, eax
mov esi, dword [ebp - 0xc]
mov dword [ebp - 0x10], esi
mov dword [0x10005370], edx
mov dword [ebp - 0xc], esi
mov dword [0x100053c4], ecx
xor dword [0x100053c4], 0xff00ffff
lea eax, [ebp - 0xc]
push eax
call sub.user32.dll_CharNextA
mov eax, 0x100054b5
mov esi, dword [eax + 0x10]
mov ecx, dword [ebp - 0xc]
add esi, edi
mov ecx, dword [ebp - 8]
mov dword [ebp - 8], eax
mov dword [eax], eax
mov edi, dword [ebp - 8]
call fcn.10001930
mov edi, dword [0x10005718]
add eax, edi
mov esi, dword [0x100056ec]
mov dword [ebp - 0x10], eax
mov dword [0x100054b4], eax
mov dword [0x1000569c], edx
mov edi, dword [ebp - 0xc]
call sub.KERNEL32.dll_GetOEMCP
mov eax, 0x10005481
mov edx, dword [eax]
mov edx, dword [ebp - 0xc]
mov edx, 0x42
mov esi, dword [eax + 8]
add edx, edi
mov dword [ebp - 0xc], edx
mov dword [eax + 0x10], eax
mov dword [eax], edx
mov dword [ebp - 8], eax
call fcn.100019e0
mov eax, dword [0x100055e8]
mov eax, dword [ebp - 0x10]
mov ax, 0x40
mov dword [ebp - 0xc], eax
mov dword [0x1000569c], edx
mov dword [ebp - 0x10], eax
push dword [0x10005370]
call sub.user32.dll_IsCharLowerA
call fcn.10001000
mov eax, 0x10005481
mov esi, dword [eax]
mov esi, dword [ebp - 0x10]
mov si, 0xa2
mov esi, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov dword [eax + 0x10], ecx
mov dword [ebp - 0xc], eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]