Function at 0x10030bd0
Capabilities:
Check for time delay via gettickcount
Check os version
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1016f744
mov eax, dword fs:[0]
push eax
sub esp, 0x9d0
mov eax, dword [0x101bd92c]
xor eax, esp
mov dword [esp + 0x9c8], eax
push ebx
push esi
push edi
mov eax, dword [0x101bd92c]
xor eax, esp
push eax
lea eax, [esp + 0x9e0]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x20], edi
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 0x1b4]
mov dword [esp + 0x30], eax
mov dword [edi + 0xb4], 0
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x40], 0
mov eax, dword [ecx]
push 0x9e
call dword [eax]
mov edx, dword [edi + 0xf8]
mov ecx, dword [esp + 0x30]
mov esi, dword [edx]
dec ecx
push ecx
mov ecx, edx
mov ebx, eax
call dword [esi + 0x10]
mov esi, eax
mov dword [esp + 0x1c], esi
test esi, esi
jne 0x10030cb6
mov ecx, dword [edi + 0xf4]
cmp dword [ecx + 0x500], 1
jne 0x10030caf
lea eax, [ebx + 1]
cmp dword [esp + 0x30], eax
jne 0x10030caf
cmp dword [ecx + 0x558], esi
jbe 0x10030caf
add ecx, 0x548
cmp dword [ecx + 0x14], 8
jb 0x10030ca5
mov ecx, dword [ecx]
call fcn.1000ddc0
jmp 0x10031c96
xor eax, eax
jmp 0x10031c9b
push 0
push 0x10199228
lea ecx, [edi + 0x1c]
call fcn.100048b0
mov eax, dword [esi + 4]
mov ebx, dword [esi + 0x10]
mov dword [esp + 0x24], ebx
test eax, eax
js 0x10030caf
cmp dword [ebx + 0x5c], 0
je 0x10030caf
cmp eax, 3
je 0x10031c6f
cmp eax, 0xb
je 0x10031c6f
cmp eax, 0xc
je 0x10031c6f
cmp eax, 0xd
je 0x10031c6f
cmp eax, 0x15
je 0x10031c6f
mov eax, dword [edi + 0xf4]
cmp dword [eax + 0x444], 0xa
jne 0x10030d2a
push 0x10199b34
lea ecx, [edi + 0xc4]
call fcn.100044a0
jmp 0x10031c86
mov eax, dword [ebx + 8]
cmp eax, 0x30
jne 0x10030d52
lea eax, [ebx + 0x4c]
lea ecx, [edi + 0xc4]
cmp ecx, eax
je 0x10031c8d
push 0xffffffffffffffff
push 0
push eax
call fcn.10004790
jmp 0x10031c8d
cmp eax, 0x28
jne 0x10030f4a
mov ecx, dword [edi + 0x1b4]
push 0xb4
mov eax, dword [ecx]
xor ebx, ebx
call dword [eax + 0x10]
mov esi, dword [eax]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10030d93
push ebx
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, esi
push 0x10199228
lea ecx, [esp + 0xf8]
call fcn.10004410
mov dword [esp + 0x9e8], 0
mov eax, dword [edi + 0xf4]
mov eax, dword [eax + 0x440]
mov esi, dword [eax]
cmp esi, dword [eax + 4]
je 0x10030dea
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x30]
push eax
lea ecx, [esp + 0x100]
call fcn.10004bd0
mov eax, dword [edi + 0xf4]
add esi, 0x60
mov eax, dword [eax + 0x440]
cmp esi, dword [eax + 4]
jne 0x10030dc2
mov eax, dword [esp + 0x24]
add eax, 0x7c
push eax
lea ecx, [esp + 0xe0]
call fcn.10006680
lea eax, [esp + 0xdc]
push eax
lea eax, [esp + 0xf8]
push eax
lea eax, [esp + 0x114]
push eax
mov byte [esp + 0x9f4], 1
call fcn.10011360
add esp, 0xc
lea ecx, [esp + 0xdc]
push eax
call fcn.1000fdf0
lea ecx, [esp + 0x10c]
call fcn.10004470
cmp dword [edi + 0x160], 8
lea eax, [edi + 0x14c]
jb 0x10030e50
mov eax, dword [eax]
push str.EXCEL.exe
push eax
call fcn.10093e79
add esp, 8
test eax, eax
jne 0x10030f02
test ebx, ebx
je 0x10030e7e
mov ecx, dword [edi + 0x1b8]
test ecx, ecx
je 0x10030e7e
mov eax, dword [ecx]
push ebx
call dword [eax + 0x3c]
test eax, eax
jne 0x10030e92
call dword [sym.imp.USER32.dll_GetFocus]
test eax, eax
jne 0x10030e92
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x10030eb0
cmp dword [esp + 0xf0], 8
lea edx, [esp + 0xdc]
cmovae edx, dword [esp + 0xdc]
mov ecx, eax
call fcn.1000ef80
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0xa2
mov dword [edi + 0x194], eax
call esi
push 0
push 0
push 0
push 0x56
call esi
push 0
push 2
push 0
push 0x56
call esi
push 0
push 2
push 0
push 0xa2
call esi
push 0x10199228
lea ecx, [edi + 0xc4]
call fcn.100044a0
jmp 0x10030f1d
lea ecx, [edi + 0xc4]
lea eax, [esp + 0xdc]
cmp ecx, eax
je 0x10030f1d
push 0xffffffffffffffff
push 0
push eax
call fcn.10004790
mov ecx, edi
call fcn.10038060
push 1
mov ecx, edi
call fcn.100379f0
lea ecx, [esp + 0xdc]
call fcn.10004470
lea ecx, [esp + 0xf4]
call fcn.10004470
jmp 0x10031c96
cmp eax, 7
je 0x10030f57
add eax, 0xffffffe9
cmp eax, 2
ja 0x10030fcd
cmp dword [ebx + 0x60], 8
lea esi, [ebx + 0x4c]
jb 0x10030f64
mov eax, dword [esi]
jmp 0x10030f66
mov eax, esi
push 0x10199bb0
push eax
call fcn.10094da5
add esp, 8
cmp dword [esi + 0x14], 8
mov dword [esp + 0x28], eax
jb 0x10030f82
mov ecx, dword [esi]
jmp 0x10030f84
mov ecx, esi
push 0x10199bb4
push ecx
call fcn.10094da5
add esp, 8
cmp dword [esi + 0x14], 8
mov ebx, eax
jb 0x10030f9e
mov ecx, dword [esi]
jmp 0x10030fa0
mov ecx, esi
push 0x10199bb8
push ecx
call fcn.10094da5
add esp, 8
cmp dword [esp + 0x28], 0
jne 0x10031a8e
test ebx, ebx
jne 0x10031a8e
test eax, eax
jne 0x10031a8e
mov ebx, dword [esp + 0x24]
lea ecx, [esp + 0x34]
call fcn.10011dc0
xor eax, eax
push 0x206
mov dword [esp + 0x9ec], 5
push eax
mov word [esp + 0x1bc], ax
lea eax, [esp + 0x1be]
push eax
call fcn.10098090
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [esp + 0x3c4], ax
lea eax, [esp + 0x3c6]
push eax
call fcn.10098090
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [esp + 0x5cc], ax
lea eax, [esp + 0x5ce]
push eax
call fcn.10098090
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [esp + 0x7d4], ax
lea eax, [esp + 0x7d6]
push eax
call fcn.10098090
xor esi, esi
add esp, 0xc
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0
cmp dword [edi + 0xa8], esi
jne 0x10031092
mov eax, dword [ebx + 8]
cmp eax, 2
je 0x10031092
cmp eax, 1
je 0x10031092
cmp eax, 3
je 0x10031092
cmp eax, 5
jne 0x10031097
mov esi, 1
cmp dword [ebx + 8], 0x1b
jne 0x1003114f
lea eax, [ebx + 0x1c]
push eax
lea ecx, [esp + 0xb0]
call fcn.10006680
mov byte [esp + 0x9e8], 6
cmp dword [esp + 0xbc], 4
jb 0x1003113b
mov ecx, dword [edi + 0x1b8]
mov eax, dword [ecx]
call dword [eax + 0x18]
cmp dword [edi + 0x58], 2
jne 0x100310f7
cmp dword [esp + 0xc0], 8
lea eax, [esp + 0xac]
cmovae eax, dword [esp + 0xac]
mov ecx, edi
movzx eax, word [eax + 4]
push eax
call fcn.1002f7c0
cmp dword [esp + 0xc0], 8
lea eax, [esp + 0xac]
cmovae eax, dword [esp + 0xac]
mov ecx, edi
movzx eax, word [eax + 6]
push eax
call fcn.1002f7c0
lea ecx, [esp + 0xac]
call fcn.10004470
lea ecx, [esp + 0x34]
mov ebx, 1
call fcn.10011eb0
mov eax, ebx
jmp 0x10031c9b
lea ecx, [esp + 0xac]
mov byte [esp + 0x9e8], 5
call fcn.10004470
test esi, esi
je 0x10031426
push 0x10199228
lea ecx, [esp + 0xb0]
call fcn.10004410
push dword [esp + 0x1c]
mov byte [esp + 0x9ec], 7
call fcn.10036540
mov ecx, dword [edi + 0xf4]
mov esi, eax
mov ecx, dword [ecx + 0x440]
mov dword [esp + 0x2c], esi
mov ebx, dword [ecx]
cmp ebx, dword [ecx + 4]
je 0x100312be
mov dword [esp + 0x28], 1
mov edi, edi
cmp dword [ebx + 0x44], 8
jb 0x100311ab
mov edx, dword [ebx + 0x30]
jmp 0x100311ae
lea edx, [ebx + 0x30]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x100311b0
lea edi, [esp + 0x3bc]
sub edx, esi
add edi, 0xfffffffe
jmp 0x100311d0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100311d0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebx + 0x14], 8
jb 0x100311f4
mov edx, dword [ebx]
jmp 0x100311f6
mov edx, ebx
mov esi, edx
jmp 0x10031200
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10031200
lea edi, [esp + 0x5c4]
sub edx, esi
add edi, 0xfffffffe
jmp 0x10031220
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10031220
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebx + 0x5c], 8
jb 0x10031245
mov edx, dword [ebx + 0x48]
jmp 0x10031248
lea edx, [ebx + 0x48]
mov esi, edx
lea ebx, [ebx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10031250
lea edi, [esp + 0x7cc]
sub edx, esi
add edi, 0xfffffffe
jmp 0x10031270
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10031270
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0xffffffffffffffff
and ecx, 3
push 0
lea eax, [ebx + 0x48]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [esp + 0xb8]
call fcn.10004bd0
mov edi, dword [esp + 0x20]
add ebx, 0x60
mov eax, dword [edi + 0xf4]
mov eax, dword [eax + 0x440]
cmp ebx, dword [eax + 4]
jne 0x100311a0
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0xbc]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x2c]
and ecx, 0xfffffffe
cmp ecx, 2
jbe 0x100312eb
mov eax, dword [eax + 0x2c]
shr eax, 1
mov dword [esp + 0x18], eax
jmp 0x100312f3
mov dword [esp + 0x18], 1
xor ebx, ebx
test esi, esi
je 0x10031328
mov eax, dword [esp + 0x2c]
mov esi, dword [esi]
cmp esi, dword [eax + 4]
je 0x10031328
mov edi, eax
lea eax, [esi + 8]
push 0x101922ac
push eax
call fcn.100112d0
add esp, 8
test al, al
je 0x1003131c
inc ebx
add esi, 0x20
cmp esi, dword [edi + 4]
jne 0x10031306
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov ecx, dword [eax + 0x10]
add esi, dword [esp + 0x14]
lea ecx, [ecx + 0x4c]
call fcn.1000edd0
test eax, eax
je 0x10031344
inc esi
cmp esi, ebx
jge 0x1003140a
push dword [esp + 0x1c]
mov ecx, dword [edi + 0xf4]
call fcn.10013110
mov ecx, dword [edi + 0xf0]
call fcn.10039530
mov eax, dword [edi + 0xf4]
mov dword [esp + 0x18], 0
mov eax, dword [eax + 0x440]
mov esi, dword [eax]
mov dword [esp + 0x20], esi
cmp esi, dword [eax + 4]
je 0x100313cc
mov ebx, dword [esi + 0x58]
shr ebx, 1
test ebx, ebx
jle 0x100313b4
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
push esi
call fcn.10039430
mov ecx, dword [edi + 0xf0]
push eax
call fcn.10039460
inc esi
dec ebx
jne 0x10031392
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x20]
mov eax, dword [edi + 0xf4]
add esi, 0x60
mov eax, dword [eax + 0x440]
mov dword [esp + 0x20], esi
cmp esi, dword [eax + 4]
jne 0x10031385
mov ecx, dword [edi + 0x1b8]
test ecx, ecx
je 0x100313db
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, edi
call fcn.10035720
xor ebx, ebx
cmp dword [edi + 0x1a0], ebx
lea ecx, [esp + 0xac]
setg bl
inc ebx
call fcn.10004470
lea ecx, [esp + 0x34]
call fcn.10011eb0
mov eax, ebx
jmp 0x10031c9b
lea ecx, [esp + 0xac]
mov dword [esp + 0x18], 1
mov byte [esp + 0x9e8], 5
call fcn.10004470
push 0x10199228
lea ecx, [esp + 0xc8]
call fcn.10004410
push 0x10199228
lea ecx, [edi + 0xc4]
mov byte [esp + 0x9ec], 8
call fcn.100044a0
cmp dword [esp + 0x18], 0
je 0x1003157d
lea eax, [esp + 0x3bc]
push eax
lea ecx, [edi + 0xc4]
call fcn.100044f0
mov esi, dword [esp + 0x24]
push 0xffffffffffffffff
push 0
add esi, 0x4c
push esi
lea ecx, [edi + 0xc4]
call fcn.10004bd0
lea eax, [esp + 0x3bc]
push eax
lea ecx, [esp + 0xc8]
call fcn.100044f0
push 0xffffffffffffffff
push 0
push esi
lea ecx, [esp + 0xd0]
call fcn.10004bd0
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x44]
push esi
call fcn.10012b80
mov ecx, dword [esp + 0x44]
push 0x10199228
lea ecx, [ecx + 0x1c]
call fcn.100044a0
mov ecx, dword [esp + 0x44]
add ecx, 0x4c
lea eax, [esp + 0xc4]
cmp ecx, eax
je 0x100314e4
push 0xffffffffffffffff
push 0
push eax
call fcn.10004790
lea eax, [esp + 0x5c4]
push eax
lea ecx, [esp + 0x64]
call fcn.100044a0
mov ebx, dword [esp + 0x1c]
push 0xffffffffffffffff
push 0
lea eax, [ebx + 0x2c]
push eax
lea ecx, [esp + 0x6c]
call fcn.10004bd0
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x7cc]
push eax
lea ecx, [ecx + 0x1c]
call fcn.100044f0
cmp dword [esp + 0x28], 0
mov eax, dword [esp + 0x44]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x14], ecx
mov eax, dword [esp + 0x44]
je 0x1003153c
mov dword [eax + 8], 5
jmp 0x10031564
mov ecx, dword [esi + 8]
mov dword [eax + 8], ecx
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 0x44]
lea edx, [esi + 0x7c]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x44]
add ecx, 0x7c
cmp ecx, edx
je 0x10031564
push 0xffffffffffffffff
push 0
push edx
call fcn.10004790
mov ecx, dword [esp + 0x44]
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x1c]
lea ecx, [ecx + 0x1c]
push eax
call fcn.10004bd0
jmp 0x10031663
mov esi, dword [esp + 0x24]
cmp dword [esi + 8], 0x2f
jne 0x10031592
mov eax, dword [edi + 0xfc]
mov eax, dword [eax + 0x5c]
jmp 0x10031594
xor eax, eax
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x114]
push eax
lea ecx, [esi + 0x4c]
call fcn.1000ff80
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0xd0]
mov byte [esp + 0x9f4], 9
call fcn.10004bd0
lea ecx, [esp + 0x10c]
mov byte [esp + 0x9e8], 8
call fcn.10004470
mov ecx, dword [esp + 0x44]
push esi
call fcn.10012b80
mov edx, dword [esp + 0x44]
lea eax, [esp + 0xc4]
lea ecx, [edx + 0x4c]
cmp ecx, eax
je 0x100315fe
push 0xffffffffffffffff
push 0
push eax
call fcn.10004790
mov edx, dword [esp + 0x44]
mov eax, dword [esi + 8]
mov dword [edx + 8], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esi + 0xc]
mov dword [eax + 0xc], ecx
mov edx, dword [esp + 0x44]
lea eax, [esi + 0x1c]
lea ecx, [edx + 0x1c]
cmp ecx, eax
je 0x1003162a
push 0xffffffffffffffff
push 0
push eax
call fcn.10004790
mov edx, dword [esp + 0x44]
lea eax, [esi + 0x7c]
lea ecx, [edx + 0x7c]
cmp ecx, eax
je 0x10031642
push 0xffffffffffffffff
push 0
push eax
call fcn.10004790
mov edx, dword [esp + 0x44]
mov eax, dword [esi + 0x14]
push 0xffffffffffffffff
mov dword [edx + 0x14], eax
push 0
lea eax, [esp + 0xcc]
push eax
lea ecx, [edi + 0xc4]
call fcn.10004bd0
mov ebx, dword [esp + 0x1c]
mov ecx, dword [edi + 0xfc]
push esi
call fcn.10012b80
lea eax, [ebx + 0x2c]
lea ecx, [esp + 0x60]
cmp ecx, eax
je 0x10031684
push 0xffffffffffffffff
push 0
push eax
call fcn.10004790
lea eax, [ebx + 0x14]
lea ecx, [esp + 0x48]
cmp ecx, eax
je 0x10031699
push 0xffffffffffffffff
push 0
push eax
call fcn.10004790
mov eax, dword [ebx]
mov ecx, dword [edi + 0xf8]
mov dword [esp + 0x34], eax
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [edi + 0xf4]
call fcn.100132f0
lea ecx, [esp + 0x13c]
call fcn.10011dc0
mov ecx, edi
mov byte [esp + 0x9e8], 0xa
call fcn.10038120
push ecx
call fcn.10039d70
mov ecx, eax
call fcn.10068ab0
xor esi, esi
call fcn.10018b10
test eax, eax
je 0x100316ec
push 0x66
jmp 0x10031704
call fcn.100187a0
test eax, eax
je 0x100316f9
push 0x65
jmp 0x10031704
call fcn.100186e0
test eax, eax
je 0x10031710
push 0x67
mov ecx, dword [edi + 0x1b4]
mov eax, dword [ecx]
call dword [eax]
mov esi, eax
push 1
mov ecx, edi
call fcn.100379f0
test esi, esi
jne 0x10031746
mov ebx, dword [esp + 0x44]
cmp dword [0x101ed6ac], esi
jne 0x10031738
push 1
call fcn.10092352
add esp, 4
mov dword [0x101ed6ac], eax
push dword [esp + 0x30]
push ebx
call fcn.10013a10
mov ebx, dword [esp + 0x1c]
call fcn.10006910
mov ecx, eax
call fcn.10029680
cmp dword [ebx + 4], 0
jl 0x1003199e
push dword [esp + 0x44]
mov ecx, dword [edi + 0xfc]
call fcn.10012b80
mov ecx, dword [edi + 0x1b4]
push 0xb
mov eax, dword [ecx]
call dword [eax]
test eax, eax
je 0x1003178b
mov eax, dword [edi + 0xfc]
mov ecx, edi
push dword [eax + 0x5c]
call fcn.10038c80
mov ecx, dword [edi + 0x1b4]
push 0x70
mov eax, dword [ecx]
call dword [eax]
mov ebx, eax
call fcn.10006910
mov dword [eax + 0x1c], ebx
cmp ebx, 2
jne 0x10031813
mov eax, dword [edi + 0xf4]
mov dword [eax + 0x4f8], 5
mov eax, dword [edi + 0xf4]
mov dword [eax + 0x444], 1
mov ecx, dword [edi + 0xf4]
mov eax, dword [edi + 0x108]
mov dword [ecx + 0x50c], eax
xor ecx, ecx
lea ebx, [ebx]
movzx eax, word [ecx + 0x10199b84]
mov word [esp + ecx + 0x1b4], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x100317e0
mov ecx, dword [edi + 0xf4]
lea eax, [esp + 0x1b4]
push eax
call fcn.100130f0
push 0
push 2
jmp 0x10031981
cmp ebx, 1
jne 0x1003197d
mov dword [esp + 0xac], 0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], 0
mov byte [esp + 0x9e8], 0xb
mov ecx, dword [edi + 0x1b4]
push 7
mov eax, dword [ecx]
call dword [eax]
test eax, eax
je 0x1003186e
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xb0]
mov dword [esp + 0x18], 6
call fcn.100127e0
mov ecx, dword [edi + 0x1b4]
push 8
mov eax, dword [ecx]
call dword [eax]
test eax, eax
je 0x10031897
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xb0]
mov dword [esp + 0x18], 2
call fcn.100127e0
mov ecx, dword [edi + 0x1b4]
push 0xd8
mov eax, dword [ecx]
call dword [eax]
test eax, eax
je 0x100318c3
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xb0]
mov dword [esp + 0x18], 0xd
call fcn.100127e0
mov ecx, dword [edi + 0x1b4]
push 9
mov eax, dword [ecx]
call dword [eax]
test eax, eax
je 0x100318ec
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xb0]
mov dword [esp + 0x18], 9
call fcn.100127e0
mov eax, dword [edi + 0xf4]
mov dword [eax + 0x4f8], 5
mov eax, dword [edi + 0xf4]
mov dword [eax + 0x444], 0xffffffff
mov ecx, dword [edi + 0xf4]
mov eax, dword [edi + 0x108]
mov dword [ecx + 0x50c], eax
xor ecx, ecx
movzx eax, word [ecx + 0x10199b90]
mov word [esp + ecx + 0x1b4], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x10031920
mov ecx, dword [edi + 0xf4]
lea eax, [esp + 0x1b4]
push eax
call fcn.100130f0
lea eax, [esp + 0xac]
push eax
push 1
push esi
push dword [edi + 0xfc]
call fcn.10006810
mov ecx, eax
call fcn.100b8550
lea ecx, [esp + 0xac]
mov byte [esp + 0x9e8], 0xa
call fcn.10010090
jmp 0x10031994
push 0
push 0
push esi
push dword [edi + 0xfc]
call fcn.10006810
mov ecx, eax
call fcn.100b8550
mov dword [edi + 0x1b0], 1
mov eax, dword [edi + 0xfc]
mov eax, dword [eax + 0x5c]
add dword [edi + 0x100], eax
cmp dword [edi + 0x100], 0x32
jl 0x100319bd
mov ecx, edi
call fcn.10038270
push dword [edi + 0xf8]
call fcn.10006910
mov ecx, eax
call fcn.10027ec0
test eax, eax
jne 0x100319e3
mov eax, dword [edi + 0xf4]
mov dword [eax + 0x444], 0
mov ecx, dword [edi + 0xf8]
mov eax, dword [ecx]
call dword [eax + 0x2c]
test eax, eax
jne 0x10031a39
mov eax, dword [edi + 0xf4]
push 0x10199228
mov dword [eax + 0x444], 0
mov ecx, dword [edi + 0xf4]
call fcn.100130f0
mov ecx, dword [edi + 0x1b8]
test ecx, ecx
je 0x10031a21
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, edi
call fcn.10036b00
mov ecx, dword [edi + 0x1b8]
test ecx, ecx
je 0x10031a61
mov eax, dword [ecx]
call dword [eax + 0x28]
jmp 0x10031a61
mov ecx, dword [edi + 0x1b8]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, edi
call fcn.100365c0
mov ecx, dword [edi + 0x1b8]
test ecx, ecx
je 0x10031a5a
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, edi
call fcn.10036b00
lea ecx, [esp + 0x13c]
mov ebx, 1
call fcn.10011eb0
lea ecx, [esp + 0xc4]
call fcn.10004470
lea ecx, [esp + 0x34]
call fcn.10011eb0
mov eax, ebx
jmp 0x10031c9b
cmp dword [edi + 0x160], 8
lea ebx, [edi + 0x14c]
jb 0x10031aa1
mov eax, dword [ebx]
jmp 0x10031aa3
mov eax, ebx
push str.EXCEL.exe
push eax
call fcn.10093e79
add esp, 8
test eax, eax
je 0x10031bad
cmp dword [ebx + 0x14], 8
jb 0x10031ac1
mov ebx, dword [ebx]
push 0x10199bbc
push ebx
call fcn.10093e79
add esp, 8
test eax, eax
je 0x10031bad
push esi
lea ecx, [esp + 0x128]
call fcn.10006680
push 0x10199bb0
lea ecx, [esp + 0x110]
mov dword [esp + 0x9ec], 2
call fcn.10004410
push 0x101998cc
lea ecx, [esp + 0xf8]
mov byte [esp + 0x9ec], 3
call fcn.10004410
lea eax, [esp + 0x10c]
push eax
lea eax, [esp + 0xf8]
push eax
lea eax, [esp + 0x12c]
push eax
mov byte [esp + 0x9f4], 4
call fcn.1000eed0
lea ecx, [esp + 0x130]
add esp, 0xc
cmp ecx, eax
je 0x10031b56
push 0xffffffffffffffff
push 0
push eax
call fcn.10004790
lea ecx, [esp + 0xf4]
call fcn.10004470
lea ecx, [esp + 0x10c]
mov byte [esp + 0x9e8], 2
call fcn.10004470
lea ecx, [edi + 0xc4]
lea eax, [esp + 0x124]
cmp ecx, eax
je 0x10031b91
push 0xffffffffffffffff
push 0
push eax
call fcn.10004790
lea ecx, [esp + 0x124]
mov dword [esp + 0x9e8], 0xffffffff
call fcn.10004470
jmp 0x10031c86
mov ecx, dword [edi + 0x1b4]
push 0xb4
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ebx, dword [eax]
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10031bf8
push 0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10031bf8
test ebx, ebx
je 0x10031bf8
mov ecx, dword [edi + 0x1b8]
test ecx, ecx
je 0x10031bf8
mov eax, dword [ecx]
push ebx
call dword [eax + 0x3c]
test eax, eax
jne 0x10031c0c
call dword [sym.imp.USER32.dll_GetFocus]
test eax, eax
jne 0x10031c0c
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x10031c1d
cmp dword [esi + 0x14], 8
jb 0x10031c14
mov esi, dword [esi]
mov edx, esi
mov ecx, eax
call fcn.1000ef80
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0xa2
mov dword [edi + 0x194], eax
call esi
push 0
push 0
push 0
push 0x56
call esi
push 0
push 2
push 0
push 0x56
call esi
push 0
push 2
push 0
push 0xa2
call esi
push 0x10199228
lea ecx, [edi + 0xc4]
call fcn.100044a0
jmp 0x10031c86
lea eax, [ebx + 0x4c]
lea ecx, [edi + 0xc4]
cmp ecx, eax
je 0x10031c86
push 0xffffffffffffffff
push 0
push eax
call fcn.10004790
mov ecx, edi
call fcn.10038060
push 1
mov ecx, edi
call fcn.100379f0
mov eax, 1
mov ecx, dword [esp + 0x9e0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x9c8]
xor ecx, esp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 8