Function at 0x10017c91
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
mov eax, 0x10065492
call fcn.10064a48
sub esp, 0x17c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x50], dl
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], 0x642c70bb
mov dword [ebp - 0x4c], 0x7bc75286
mov dword [ebp - 0x2c], 0x5e00fe1c
mov dword [ebp - 0x2c], 0xfffffffa
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x2c], 0x4185a1fa
mov dword [ebp - 0x2c], 0xbe39e3cf
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x2c], 0x673e7ed6
mov dword [ebp - 0x2c], 0xc01e6e2b
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x2c], 0xa8b060d2
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x2c], 0xd39c7c6f
xor edi, edi
mov dword [ebp - 0x2c], 0xfffffff7
inc edi
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0xb9228064
mov dword [ebp - 0x2c], 0xfffffffa
push edi
call fcn.10009c88
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x40], 0xfff9
mov dword [ebp - 0x34], ebx
jmp 0x10017d67
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x16c]
mov dword [eax + ecx*4], 0xab5c2947
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jl 0x10017d54
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x40]
call fcn.10009ce4
push 2
mov eax, 0x1006b87c
lea ecx, [ebp - 0x60]
pop esi
push esi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], eax
call fcn.10009c88
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0xfffffffc
push edi
call fcn.10009c88
mov dword [ebp - 0x14], ebx
jmp 0x10017dc5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x60]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10017db5
mov dword [ebp - 0x14], ebx
jmp 0x10017de2
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x154]
mov dword [eax + ecx*4], 0xed38bc6a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10017dcf
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x10017ea4
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10017e0e
push ebx
push ebx
push 0x1d26
push 0x186e
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x18]
cmp dword [ecx + edx*4], eax
jl 0x10017e22
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], 0x76d2
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x30], edi
mov edi, dword [ebp - 0x60]
push 0
mov eax, dword [ecx + eax*4]
xor ecx, ecx
cmp eax, dword [edi + edx*4]
mov edx, edi
mov edi, dword [ebp - 0x30]
setne cl
xor eax, eax
cmp ecx, dword [edx + esi*4]
setne al
xor ecx, ecx
cmp eax, 0xfffffff9
setne cl
add ecx, dword [edx + edi*4]
imul ecx, dword [edx + ebx*4]
pop ebx
sub ecx, 0xe8ce
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, dword [edx]
mov ecx, dword [ebp - 0x4c]
setge al
mov dword [edx + ecx*4], eax
dec dword [ebp - 0x18]
jns 0x10017df3
xor edi, edi
inc edi
mov dword [ebp - 0x18], ebx
jmp 0x1001806f
mov dword [ebp - 0x1c], 0xea3d8810
mov dword [ebp - 0x24], 0xa4ad
mov dword [ebp - 0x48], 0x23e821d2
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], ebx
jl 0x1001806c
mov dword [ebp - 0x30], 0x61f6604c
mov dword [ebp - 0x54], 0x9e5f9c6a
mov dword [ebp - 0x34], ebx
jmp 0x10017ef8
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xac], 5
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x10017ee7
mov dword [ebp - 0xac], edi
cmp dword [ebp - 0xac], ebx
jl 0x10017fe1
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ebx
jmp 0x10017f2c
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x9c], 0x3b26d5d6
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x10017f1b
mov dword [ebp - 0x98], ebx
jmp 0x10017f46
mov dword [ebp - 0x40], edi
inc dword [ebp - 0x1c]
inc dword [ebp - 0x98]
cmp dword [ebp - 0x98], edi
jle 0x10017f3a
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xac]
imul eax, dword [ebp - 0x30]
test eax, eax
jne 0x10017f69
mov edx, ebx
cmp dword [ebp - 0x98], ebx
je 0x10017f6b
mov edx, edi
mov eax, dword [ebp - 0x90]
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, 0x3daac8a6
jne 0x10017f86
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x14], ebx
jne 0x10017fae
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x48], ebx
je 0x10017fb1
mov dword [ebp - 0x40], edi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x60]
mov edi, dword [ebp - 0x40]
push 1
cmp edi, dword [edx]
mov eax, dword [edx + eax*4]
sete cl
add eax, ecx
mov ecx, dword [ebp - 0x2c]
pop edi
sub eax, dword [ecx + 4]
mov dword [edx + esi*4], eax
dec dword [ebp - 0xac]
jns 0x10017f16
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x60]
imul ecx, dword [eax + ecx*4], 0x2c27
mov eax, dword [ebp - 0x4c]
sub ecx, eax
mov eax, dword [ebp - 0xac]
add eax, ecx
mov ecx, dword [ebp - 0x14]
add ecx, eax
mov eax, dword [ebp - 0x48]
cmp ecx, eax
mov eax, dword [ebp - 0x60]
setg dl
cmp dword [eax + esi*4], edx
jle 0x10018031
mov edx, ebx
cmp dword [ebp - 0xac], ebx
je 0x10018033
mov edx, edi
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x60]
imul ecx, ecx, 9
mov dword [eax], ecx
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x154]
mov dword [eax], 0xfffffffa
dec dword [ebp - 0x14]
jns 0x10017ed4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x10017eac
lea ecx, [ebp - 0x154]
call fcn.10009ce4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.10009ce4
mov eax, dword [0x1006b87c]
mov dword [ebp - 0x14], 0xeeda5852
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 0xcd5fec46
mov dword [ebp - 0x18], 0xffffffff
push 3
pop esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x2c], 0x20b73903
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x48], 4
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x14], ebx
jl 0x100180f6
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, 0x10000
setne cl
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x24], 0xffffffff
mov eax, edi
jl 0x100180f8
mov eax, ebx
mov dword [ebp - 0x18], eax
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
neg ecx
cmp ecx, eax
setge dl
imul edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
cmp edx, dword [ebp - 0x24]
jge 0x1001814d
cmp dword [ebp - 0x1c], ebx
je 0x1001814d
mov dword [ebp - 0x30], 0x78b7
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10018148
push ebx
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
dec dword [ebp - 0x30]
jmp 0x100181ad
mov dword [ebp - 0x24], 0x40b36fe0
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x30], 0xef61160d
mov dword [ebp - 0x30], 0x35c241e9
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x30]
inc eax
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x1c]
jl 0x1001817e
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x14]
add eax, 4
imul eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
je 0x1001819e
mov edx, ebx
cmp dword [ebp - 0x24], ebx
je 0x100181a0
mov edx, edi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x14], 0xdd688769
mov dword [ebp - 0x18], 0x3b7c
mov dword [ebp - 0x30], 0xe469209a
mov dword [ebp - 0x30], 0xacb2d505
mov dword [ebp - 0x30], 0x996fd0fe
push 4
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
call fcn.10009c88
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x1c], ebx
jmp 0x10018210
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], 0xb56bf5ee
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100181fd
cmp dword [ebp - 0x14], ebx
je 0x100182a9
mov eax, dword [ebp - 0x14]
mov ecx, 0x9403132d
mov eax, dword [ebp - 0x18]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
inc eax
add eax, ecx
cmp edi, eax
mov eax, dword [ebp - 0x18]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x14]
je 0x10018256
mov eax, ebx
cmp dword [ebp - 0x18], ebx
je 0x10018258
mov eax, edi
xor ecx, ecx
cmp eax, 0xfffffffb
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, eax
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
sub edx, ecx
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x46983c17
setle al
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, 0xffffffff
setne cl
mov dword [ebp - 0x30], ecx
mov ecx, ebx
cmp dword [ebp - 0x30], ebx
je 0x100182ab
mov ecx, edi
mov eax, dword [ebp - 0x100]
xor edx, edx
push 6
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
sub eax, 0x3c94
neg eax
pop ecx
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x40]
setge cl
xor edx, edx
cmp ecx, 0x760b
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x100]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
call fcn.10009ce4
cmp byte [ebp - 0x50], 0
je 0x10018352
cmp dword [ebp - 0x34], edi
jne 0x10018352
mov ecx, dword [ebp + 8]
mov eax, 0x1006b87c
mov dword [ecx + 8], 4
mov dword [ecx + 0xc], eax
mov eax, 0xf825e7a6
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0x4902314a
mov dword [ebp - 0x1c], 0xd4e2b79d
mov dword [ebp - 0x24], 0x6e85fcb4
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x4c], 0x3680
cmp dword [ebp - 0x4c], 0x3a03
jle 0x100183cf
mov esi, ebx
mov dword [ebp - 0x30], ebx
mov edi, esi
mov esi, 0x7153
mov eax, edi
mov ecx, 0x1060cf38
cdq
push edx
push eax
call fcn.100144da
dec edi
dec esi
jne 0x100183a7
mov esi, dword [ebp - 0x30]
inc esi
mov dword [ebp - 0x30], esi
cmp esi, 0x7f30
jl 0x100183a0
xor edi, edi
push 3
inc edi
pop esi
mov dword [ebp - 4], edi
cmp dword [ebp - 0x4c], 0x350d
jge 0x100183ea
mov edx, 0x10007d50
mov ecx, 0x1060cf38
call fcn.10016dcb
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x100184f3
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x8c], ebx
jne 0x100184f3
mov dword [ebp - 0x30], 0x1a57
cmp dword [ebp - 0x30], 0x1b1d
jle 0x1001844a
mov esi, ebx
mov edi, ebx
mov eax, esi
mov ecx, 0x1060cf38
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.100144da
inc edi
cmp edi, 0x4e9e
jl 0x1001841e
inc esi
cmp esi, 0x424d
jl 0x1001841c
xor edi, edi
push 3
inc edi
pop esi
mov byte [ebp - 0x1d], bl
mov dword [ebp - 4], esi
cmp dword [ebp - 0x30], 0x169f
jge 0x10018468
mov edx, 0x10007db8
mov ecx, 0x1060cf38
call fcn.10016dcb
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x1d], 0
je 0x1001847d
push 0x11db
call dword [sym.imp.USER32.dll_GetKeyState]
dec dword [ebp - 0x18]
jmp 0x100183f1
mov eax, dword [ebp - 0x18]
xor ecx, ecx
add eax, dword [ebp - 0x18]
cmp eax, 0xb9c2
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x14]
cmp edx, edi
setl cl
sub ecx, eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x24], ebx
je 0x10018596
cmp dword [ebp - 0x18], ebx
je 0x10018596
mov dword [ebp - 0x14], ebx
jmp 0x1001858c
mov dword [ebp - 0x24], ebx
jmp 0x10018584
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x8c], ebx
je 0x10018568
mov eax, dword [ebp - 0x14]
mov edx, edi
cmp dword [ebp + eax*4 - 0x8c], ebx
jne 0x1001856a
mov edx, ebx
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle cl
mov dword [ebp + eax*4 - 0x8c], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x1001854e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10018549
jmp 0x100186a9
mov dword [ebp - 0x2c], 0xfffffffd
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x54], 0x26cefc6e
push esi
call fcn.10009c88
mov dword [ebp - 0x18], ebx
jmp 0x100185cd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb0], 0x465392fb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100185bc
mov dword [ebp - 0x18], ebx
jmp 0x100185ea
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xf4]
mov dword [eax + ecx*4], 0x6a672252
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100185d7
mov dword [ebp - 0x18], 0x1d
cmp dword [ebp - 0x18], 0xc
jl 0x1001869e
mov esi, dword [ebp - 0xf4]
mov dword [ebp - 0x2c], 0xda259c42
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x1c], ebx
jmp 0x10018626
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcc], 0xaf833954
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10018615
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xcc]
mov edx, dword [ebp - 0xb0]
neg eax
sbb eax, eax
neg eax
imul edx, eax
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0xcc]
setg cl
xor edx, edx
cmp ecx, eax
setge dl
xor eax, eax
add edx, dword [esi + 4]
cmp edx, 0xffffffff
setl al
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], 8
jmp 0x1001868b
mov ecx, dword [ebp - 0x54]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setge dl
mov dword [ebp - 0x38], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x16
jg 0x10018678
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xc
jge 0x10018606
lea ecx, [ebp - 0xf4]
call fcn.10009ce4
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x3c], eax
jge 0x10018e37
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x124]
add esi, dword [ebp - 0x48]
push 2
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x28], esi
call fcn.10009c88
mov dword [ebp - 0x1c], 0x57976326
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x100186ef
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x124]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100186e0
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], ebx
jl 0x1001873c
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0x4c], 0xec79cf18
xor ecx, ecx
mov dword [ebp - 0x38], 0x17f2
mov eax, dword [ebp - 0x30]
cmp eax, 0xffffffff
setne cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
sub eax, dword [edx + 4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x1c]
jns 0x10018703
lea ecx, [ebp - 0x124]
call fcn.10009ce4
cmp dword [ebp - 0x3c], 0
jle 0x1001883d
mov eax, dword [ebp - 0x48]
mov edx, dword [esi]
add esi, eax
mov dword [ebp - 0x54], edx
mov ecx, dword [esi]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 2
mov dword [ebp - 0x2c], ecx
jge 0x10018786
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xdc], 0xb1cecb45
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1001876c
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x24]
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], edi
jg 0x100187c6
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x100187a5
push 0xaab
call dword [sym.imp.GDI32.dll_SaveDC]
mov ecx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xdc], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x10018791
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x24], 0x2e91a049
add esi, eax
mov dword [ebp - 0x24], 4
cmp dword [ebp - 0x24], 0x15
jle 0x10018825
mov dword [ebp - 0x1c], 0x14768c0a
mov dword [ebp - 0x1c], ebx
jmp 0x100187f9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbc], 2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100187e8
mov dword [ebp - 0x1c], ebx
jmp 0x10018814
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbc], 0x9ed080c1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10018803
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x15
jg 0x100187dc
mov eax, dword [ebp - 0x48]
test ecx, ecx
jne 0x1001882c
lea esi, [esi + eax*2]
add esi, edx
dec dword [ebp - 0x3c]
mov dword [ebp - 0x28], esi
jne 0x10018754
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x3c], 8
lea ecx, [ebp - 0x130]
push 2
call fcn.10009c88
push 2
lea ecx, [ebp - 0x10c]
mov dword [ebp - 4], 5
call fcn.10009c88
mov byte [ebp - 4], 6
mov dword [ebp - 0x38], 0xfffffff6
push 2
mov dword [ebp - 0x1c], 0x44401d1b
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x10018892
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x130]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1001887f
mov dword [ebp - 0x14], ebx
jmp 0x100188af
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10c]
mov dword [eax + ecx*4], 0x41fc9a57
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1001889c
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x100188c9
push ebx
push 0x1bf1
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0x3c], ebx
jmp 0x10018975
push 4
lea ecx, [ebp - 0x13c]
call fcn.10009c88
mov dword [ebp - 0x14], ebx
jmp 0x100188f4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd4], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100188e3
mov dword [ebp - 0x14], ebx
jmp 0x10018912
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x13c]
mov dword [eax + ecx*4], 0x1ece3051
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100188ff
mov eax, dword [ebp - 0x1c]
mov edx, 0xd0fa
mov ecx, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xd4], ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x10c]
mov dword [eax], edx
xor eax, eax
cmp ecx, edx
setne al
xor edx, edx
neg eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
lea ecx, [ebp - 0x13c]
setg dl
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x13c]
mov dword [eax + 4], edx
call fcn.10009ce4
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 8
je 0x100188d1
lea ecx, [ebp - 0x10c]
call fcn.10009ce4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x130]
call fcn.10009ce4
mov esi, dword [esi]
mov dword [ebp - 0x38], 0x421
cmp dword [ebp - 0x38], 0x462
mov dword [ebp - 0x3c], esi
jle 0x100189db
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x1060cf38
or eax, esi
cdq
push edx
push eax
call fcn.100144da
inc edi
cmp edi, 0x3b8a
jl 0x100189b2
inc esi
cmp esi, 0x494c
jl 0x100189b0
mov esi, dword [ebp - 0x3c]
xor edi, edi
inc edi
mov dword [ebp - 4], 7
cmp dword [ebp - 0x38], 0x2ec
jge 0x100189fa
mov edx, 0x10007e34
mov ecx, 0x1060cf38
call fcn.10016dcb
or dword [ebp - 4], 0xffffffff
mov eax, 0xf30836b1
mov ecx, 0xffff
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], 0xf7f3e76e
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x10018a65
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x118], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10018a58
mov dword [ebp - 0x18], ebx
jmp 0x10018a81
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x184], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10018a70
mov dword [ebp - 0x18], ebx
jmp 0x10018a99
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x178], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10018a8c
mov dword [ebp - 0x28], 0xe85a
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x64]
sub ecx, eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x6c]
imul ecx, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x24]
dec dword [ebp - 0x118]
cmp ecx, eax
jne 0x10018ad2
mov dword [ebp - 0x6c], edi
jmp 0x10018adc
mov dword [ebp - 0x6c], ebx
mov ecx, ebx
cmp dword [ebp - 0x24], ebx
je 0x10018ade
mov ecx, edi
xor eax, eax
cmp ecx, 0xfffffff7
setg al
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x24], ebx
jmp 0x10018bd8
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], ebx
jmp 0x10018bcb
mov dword [ebp - 0x38], 0xe879096a
mov dword [ebp - 0x28], ebx
jmp 0x10018b1c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xb8], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x10018b0b
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10018b38
push ebx
push ebx
push 0x1e2
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x70]
test eax, eax
setne cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, 4
sbb ecx, ecx
neg ecx
sub eax, ecx
je 0x10018b78
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x70]
cmp eax, 0x8d73276
sete cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0xb4]
imul ecx, eax
mov eax, dword [ebp - 0xb4]
add ecx, eax
mov eax, dword [ebp - 0x174]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
mov dword [ebp + eax*4 - 0x6c], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x10018aff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x10018af4
mov eax, dword [ebp - 0x48]
add dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], 0x3b26bdde
mov dword [ebp - 0x28], ebx
jmp 0x10018c05
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc4], 5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10018bf4
mov dword [ebp - 0x1c], 0xfffffffd
jmp 0x10018c8e
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], 0xfffffff5
jmp 0x10018c5a
mov dword [ebp - 0x28], 0x9fb023ed
mov dword [ebp - 0x28], ebx
jmp 0x10018c3f
mov dword [ebp - 0x38], 0x9b4e
inc dword [ebp - 0x38]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffef
jne 0x10018c32
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10018c57
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff4
jge 0x10018c26
mov dword [ebp - 0x28], ebx
jmp 0x10018c85
mov dword [ebp - 0x14], ebx
jmp 0x10018c75
cmp dword [ebp - 0xc4], ebx
jne 0x10018c7b
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff4
jg 0x10018c6a
mov dword [ebp - 0x14], 9
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff2
jle 0x10018c65
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffea
jne 0x10018c13
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10018cae
push ebx
push 0x203c
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ebx
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x1d], bl
je 0x10018cd2
cmp byte [ebp - 0x1d], 0
je 0x10018cdf
push 0x1a6c
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [ebp - 0x1d], 0
je 0x10018cdf
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x148]
add dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], edi
push edi
call fcn.10009c88
mov dword [ebp - 0x2c], 0xe0369bd6
mov dword [ebp - 0x28], ebx
jmp 0x10018d13
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x148]
mov dword [eax + ecx*4], 0xf89b5461
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10018d00
mov dword [ebp - 0x1c], 0xffffffe2
jmp 0x10018d54
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x10018d4a
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x148]
cmp dword [ecx + eax*4], 0xafd11d96
sbb eax, eax
inc eax
mov dword [ecx], eax
dec dword [ebp - 0x28]
jns 0x10018d30
mov dword [ebp - 0x2c], 0x86f8c7b5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff6
jle 0x10018d21
lea ecx, [ebp - 0x148]
call fcn.10009ce4
cmp dword [ebp - 0x54], 0
jne 0x10018e37
cmp byte [ebp - 0x50], 0
je 0x10018d86
cmp dword [ebp - 0x34], edi
jne 0x10018d86
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp + 8]
lea eax, [esi + eax*4]
add dword [ecx + 8], eax
mov ecx, dword [ebp - 0x44]
push esi
mov eax, dword [ecx]
add ecx, dword [ebp - 0x48]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx]
add ecx, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x44], ecx
call fcn.100494ad
pop ecx
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x7c]
lea eax, [ebp - 0xc0]
mov dword [ebp - 0xc0], ebx
push eax
push esi
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
call fcn.100197dc
mov eax, dword [ebp - 0x3c]
mov esi, ebx
mov ecx, dword [ebp - 0x7c]
test eax, eax
jle 0x10018e16
mov eax, esi
and eax, 0x80000001
jns 0x10018ddf
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x2c]
add eax, esi
add eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x54]
jmp 0x10018df4
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x3c]
cmp word [ecx + edx*2], bx
jne 0x10018df1
mov eax, dword [ebp - 0x44]
mov word [ecx + edx*2], di
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x38]
mov byte [esi + edx], al
inc esi
mov eax, dword [ebp - 0x3c]
cmp esi, eax
jl 0x10018dd1
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov eax, dword [ebp - 0x38]
mov dword [esi + 4], eax
test ecx, ecx
je 0x10018e3a
push ecx
call fcn.1004dd2d
pop ecx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
jmp 0x10018e3a
mov esi, dword [ebp + 8]
mov dword [ebp + 8], 0xfffffffc
lea ecx, [ebp - 0x160]
push edi
call fcn.10009c88
push 3
lea ecx, [ebp - 0xe8]
mov dword [ebp - 4], 9
call fcn.10009c88
mov dword [ebp + 8], ebx
jmp 0x10018e79
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x160]
mov dword [eax + ecx*4], 2
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x10018e66
mov dword [ebp + 8], ebx
jmp 0x10018e96
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xe8]
mov dword [eax + ecx*4], 0xc6338430
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x10018e83
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x10018eb6
push ebx
push 0x1787
push 0xa7d
call dword [sym.imp.GDI32.dll_CreatePen]
mov ecx, dword [ebp - 0xe8]
dec dword [ecx + 8]
lea ecx, [ebp - 0xe8]
call fcn.10009ce4
lea ecx, [ebp - 0x160]
call fcn.10009ce4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret