Function at 0x10016c00
Capabilities:
Encode data using xor
Enumerate processes
Query or enumerate registry value
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004dd2e
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x828
mov eax, dword [0x1005d014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov byte [ebp - 0x815], 0
mov byte [ebp - 0x816], 0
mov byte [ebp - 0x817], 0
mov dword [ebp - 0x814], esi
nop
push 0
push 2
mov dword [ebp - 0x810], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0x810]
push eax
push edi
mov dword [ebp - 0x828], edi
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x100178b8
lea eax, [ebp - 0x810]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x100178b8
nop word [eax + eax]
cmp byte [0x10090b94], 0
jne 0x10016d5c
mov dword [ebp - 0x520], 0
lea edx, [ebp - 0x520]
mov dword [ebp - 0x51c], 1
xor esi, esi
mov dword [ebp - 0x518], 2
mov dword [ebp - 0x514], 3
mov dword [ebp - 0x510], 4
mov dword [ebp - 0x50c], 5
mov dword [ebp - 0x508], 6
mov dword [ebp - 0x504], 7
mov dword [ebp - 0x500], 8
mov dword [ebp - 0x4fc], 9
mov dword [ebp - 0x4f8], 0xa
mov dword [ebp - 0x4f4], 0xb
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
mov al, cl
inc esi
sub al, 4
xor byte [ecx + 0x10090b88], al
cmp esi, 0xc
jne 0x10016d40
mov byte [0x10090b94], 1
lea eax, [ebp - 0x7ec]
push 0x10090b88
push eax
call fcn.1003257b
add esp, 8
test eax, eax
jne 0x1001789b
mov byte [ebp - 0x816], 1
cmp byte [ebp - 0x815], al
jne 0x10016ebd
mov dword [ebp - 0x6e8], 0xa0b2b9af
lea edx, [ebp - 0x448]
mov dword [ebp - 0x6e4], 0x3727161
xor esi, esi
mov byte [ebp - 0x6e0], al
mov dword [ebp - 0x6dc], 8
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x444], 1
mov dword [ebp - 0x440], 2
mov dword [ebp - 0x43c], 3
mov dword [ebp - 0x438], 4
mov dword [ebp - 0x434], 5
mov dword [ebp - 0x430], 6
mov dword [ebp - 0x42c], 7
mov eax, dword [edx]
lea ecx, [ebp - 0x6e8]
add ecx, eax
lea edx, [edx + 4]
sub al, 4
inc esi
xor byte [ecx], al
cmp esi, 8
jne 0x10016e03
push 0
lea eax, [ebp - 0x6e8]
mov byte [ebp - 0x6e0], 1
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x10016ebd
lea eax, [ebp - 0x830]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x830]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10016eb7
push 0x410
lea eax, [ebp - 0x428]
push eax
push 0
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x428]
push 0x10091c78
push eax
call fcn.1003257b
add esp, 8
test eax, eax
jne 0x10016eb7
push esi
mov byte [ebp - 0x815], 1
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x10016eb0
push 3
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [ebp - 0x828]
push dword [ebp - 0x808]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1001789b
cmp dword [ebp - 0x814], 0
jle 0x10016ef5
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1001789b
cmp byte [0x10090b82], 0
jne 0x10017052
mov dword [ebp - 0x4c0], 0
lea edx, [ebp - 0x4c0]
mov dword [ebp - 0x4bc], 1
xor esi, esi
mov dword [ebp - 0x4b8], 2
mov dword [ebp - 0x4b4], 3
mov dword [ebp - 0x4b0], 4
mov dword [ebp - 0x4ac], 5
mov dword [ebp - 0x4a8], 6
mov dword [ebp - 0x4a4], 7
mov dword [ebp - 0x4a0], 8
mov dword [ebp - 0x49c], 9
mov dword [ebp - 0x498], 0xa
mov dword [ebp - 0x494], 0xb
mov dword [ebp - 0x490], 0xc
mov dword [ebp - 0x48c], 0xd
mov dword [ebp - 0x488], 0xe
mov dword [ebp - 0x484], 0xf
mov dword [ebp - 0x480], 0x10
mov dword [ebp - 0x47c], 0x11
mov dword [ebp - 0x478], 0x12
mov dword [ebp - 0x474], 0x13
mov dword [ebp - 0x470], 0x14
mov dword [ebp - 0x46c], 0x15
mov dword [ebp - 0x468], 0x16
mov dword [ebp - 0x464], 0x17
mov dword [ebp - 0x460], 0x18
mov dword [ebp - 0x45c], 0x19
mov dword [ebp - 0x458], 0x1a
mov dword [ebp - 0x454], 0x1b
mov dword [ebp - 0x450], 0x1c
mov dword [ebp - 0x44c], 0x1d
mov ecx, dword [edx]
lea edx, [edx + 4]
mov al, cl
inc esi
sub al, 4
xor byte [ecx + 0x10090b64], al
cmp esi, 0x1e
jne 0x10017036
mov byte [0x10090b82], 1
lea eax, [ebp - 0x81c]
push eax
push 0x20019
push 0
push 0x10090b64
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10017518
movaps xmm0, xmmword [0x10059080]
lea edx, [ebp - 0x490]
mov dword [ebp - 0x82c], eax
xor esi, esi
mov dword [ebp - 0x834], 4
movups xmmword [ebp - 0x440], xmm0
mov word [ebp - 0x430], 0xd7f
mov byte [ebp - 0x42e], al
mov dword [ebp - 0x42c], 0x12
mov dword [ebp - 0x490], eax
mov dword [ebp - 0x48c], 1
mov dword [ebp - 0x488], 2
mov dword [ebp - 0x484], 3
mov dword [ebp - 0x480], 4
mov dword [ebp - 0x47c], 5
mov dword [ebp - 0x478], 6
mov dword [ebp - 0x474], 7
mov dword [ebp - 0x470], 8
mov dword [ebp - 0x46c], 9
mov dword [ebp - 0x468], 0xa
mov dword [ebp - 0x464], 0xb
mov dword [ebp - 0x460], 0xc
mov dword [ebp - 0x45c], 0xd
mov dword [ebp - 0x458], 0xe
mov dword [ebp - 0x454], 0xf
mov dword [ebp - 0x450], 0x10
mov dword [ebp - 0x44c], 0x11
nop word [eax + eax]
mov eax, dword [edx]
lea ecx, [ebp - 0x440]
add ecx, eax
lea edx, [edx + 4]
sub al, 4
inc esi
xor byte [ecx], al
cmp esi, 0x12
jne 0x10017170
lea eax, [ebp - 0x834]
mov byte [ebp - 0x42e], 1
push eax
lea eax, [ebp - 0x82c]
push eax
push 0
push 0
lea eax, [ebp - 0x440]
push eax
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001750c
cmp dword [ebp - 0x82c], 0x64
jne 0x10017876
xorps xmm0, xmm0
mov dword [ebp - 0x42c], esi
movups xmmword [ebp - 0x50f], xmm0
lea edx, [ebp - 0x490]
mov dword [ebp - 0x820], eax
movq qword [ebp - 0x4ff], xmm0
xor esi, esi
movaps xmm0, xmmword [0x10059050]
mov dword [ebp - 0x838], 4
mov byte [ebp - 0x510], al
mov dword [ebp - 0x4f7], eax
mov word [ebp - 0x4f3], ax
mov byte [ebp - 0x4f1], al
mov dword [ebp - 0x824], 0x20
movups xmmword [ebp - 0x440], xmm0
mov word [ebp - 0x430], 0xd78
mov byte [ebp - 0x42e], al
mov dword [ebp - 0x490], eax
mov dword [ebp - 0x48c], 1
mov dword [ebp - 0x488], 2
mov dword [ebp - 0x484], 3
mov dword [ebp - 0x480], 4
mov dword [ebp - 0x47c], 5
mov dword [ebp - 0x478], 6
mov dword [ebp - 0x474], 7
mov dword [ebp - 0x470], 8
mov dword [ebp - 0x46c], 9
mov dword [ebp - 0x468], 0xa
mov dword [ebp - 0x464], 0xb
mov dword [ebp - 0x460], 0xc
mov dword [ebp - 0x45c], 0xd
mov dword [ebp - 0x458], 0xe
mov dword [ebp - 0x454], 0xf
mov dword [ebp - 0x450], 0x10
mov dword [ebp - 0x44c], 0x11
nop dword [eax + eax]
mov eax, dword [edx]
lea ecx, [ebp - 0x440]
add ecx, eax
lea edx, [edx + 4]
sub al, 4
inc esi
xor byte [ecx], al
cmp esi, 0x12
jne 0x100172f0
lea eax, [ebp - 0x838]
mov byte [ebp - 0x42e], 1
push eax
lea eax, [ebp - 0x820]
push eax
push 0
push 0
lea eax, [ebp - 0x440]
push eax
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x43c], 0x9a8d9c85
lea edx, [ebp - 0x484]
mov dword [ebp - 0x438], 0x6a5d656e
xor esi, esi
mov dword [ebp - 0x434], 0x6672766a
mov dword [ebp - 0x430], 0xa6564
mov dword [ebp - 0x42c], 0xf
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x480], 1
mov dword [ebp - 0x47c], 2
mov dword [ebp - 0x478], 3
mov dword [ebp - 0x474], 4
mov dword [ebp - 0x470], 5
mov dword [ebp - 0x46c], 6
mov dword [ebp - 0x468], 7
mov dword [ebp - 0x464], 8
mov dword [ebp - 0x460], 9
mov dword [ebp - 0x45c], 0xa
mov dword [ebp - 0x458], 0xb
mov dword [ebp - 0x454], 0xc
mov dword [ebp - 0x450], 0xd
mov dword [ebp - 0x44c], 0xe
mov eax, dword [edx]
lea ecx, [ebp - 0x43c]
add ecx, eax
lea edx, [edx + 4]
sub al, 4
inc esi
xor byte [ecx], al
cmp esi, 0xf
jne 0x10017403
lea eax, [ebp - 0x824]
mov byte [ebp - 0x42d], 1
push eax
lea eax, [ebp - 0x510]
push eax
push 0
push 0
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0x820], 1
jne 0x1001750c
lea ecx, [ebp - 0x510]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10017460
sub ecx, edx
cmp ecx, 1
jbe 0x1001750c
mov dword [ebp - 0x6d8], 0x9a8b8f88
lea edx, [ebp - 0x43c]
mov word [ebp - 0x6d4], 0
xor esi, esi
mov dword [ebp - 0x6d0], 5
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 1
mov dword [ebp - 0x434], 2
mov dword [ebp - 0x430], 3
mov dword [ebp - 0x42c], 4
nop dword [eax]
mov eax, dword [edx]
lea ecx, [ebp - 0x6d8]
add ecx, eax
lea edx, [edx + 4]
sub al, 4
inc esi
xor byte [ecx], al
cmp esi, 5
jne 0x100174d0
lea eax, [ebp - 0x6d8]
mov byte [ebp - 0x6d3], 1
push eax
lea eax, [ebp - 0x510]
push eax
call fcn.1003257b
add esp, 8
test eax, eax
je 0x10017852
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x10090b5e], 0
jne 0x100176ed
mov dword [ebp - 0x4f0], 0
lea edx, [ebp - 0x4f0]
mov dword [ebp - 0x4ec], 1
xor esi, esi
mov dword [ebp - 0x4e8], 2
mov dword [ebp - 0x4e4], 3
mov dword [ebp - 0x4e0], 4
mov dword [ebp - 0x4dc], 5
mov dword [ebp - 0x4d8], 6
mov dword [ebp - 0x4d4], 7
mov dword [ebp - 0x4d0], 8
mov dword [ebp - 0x4cc], 9
mov dword [ebp - 0x4c8], 0xa
mov dword [ebp - 0x4c4], 0xb
mov dword [ebp - 0x4c0], 0xc
mov dword [ebp - 0x4bc], 0xd
mov dword [ebp - 0x4b8], 0xe
mov dword [ebp - 0x4b4], 0xf
mov dword [ebp - 0x4b0], 0x10
mov dword [ebp - 0x4ac], 0x11
mov dword [ebp - 0x4a8], 0x12
mov dword [ebp - 0x4a4], 0x13
mov dword [ebp - 0x4a0], 0x14
mov dword [ebp - 0x49c], 0x15
mov dword [ebp - 0x498], 0x16
mov dword [ebp - 0x494], 0x17
mov dword [ebp - 0x490], 0x18
mov dword [ebp - 0x48c], 0x19
mov dword [ebp - 0x488], 0x1a
mov dword [ebp - 0x484], 0x1b
mov dword [ebp - 0x480], 0x1c
mov dword [ebp - 0x47c], 0x1d
mov dword [ebp - 0x478], 0x1e
mov dword [ebp - 0x474], 0x1f
mov dword [ebp - 0x470], 0x20
mov dword [ebp - 0x46c], 0x21
mov dword [ebp - 0x468], 0x22
mov dword [ebp - 0x464], 0x23
mov dword [ebp - 0x460], 0x24
mov dword [ebp - 0x45c], 0x25
mov dword [ebp - 0x458], 0x26
mov dword [ebp - 0x454], 0x27
mov dword [ebp - 0x450], 0x28
mov dword [ebp - 0x44c], 0x29
mov ecx, dword [edx]
lea edx, [edx + 4]
mov al, cl
inc esi
sub al, 4
xor byte [ecx + 0x10090b34], al
cmp esi, 0x2a
jne 0x100176d1
mov byte [0x10090b5e], 1
lea eax, [ebp - 0x81c]
push eax
push 0x20019
push 0
push 0x10090b34
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001789b
movaps xmm0, xmmword [0x10059080]
lea edx, [ebp - 0x490]
mov dword [ebp - 0x820], eax
xor esi, esi
mov dword [ebp - 0x824], 4
movups xmmword [ebp - 0x440], xmm0
mov word [ebp - 0x430], 0xd7f
mov byte [ebp - 0x42e], al
mov dword [ebp - 0x42c], 0x12
mov dword [ebp - 0x490], eax
mov dword [ebp - 0x48c], 1
mov dword [ebp - 0x488], 2
mov dword [ebp - 0x484], 3
mov dword [ebp - 0x480], 4
mov dword [ebp - 0x47c], 5
mov dword [ebp - 0x478], 6
mov dword [ebp - 0x474], 7
mov dword [ebp - 0x470], 8
mov dword [ebp - 0x46c], 9
mov dword [ebp - 0x468], 0xa
mov dword [ebp - 0x464], 0xb
mov dword [ebp - 0x460], 0xc
mov dword [ebp - 0x45c], 0xd
mov dword [ebp - 0x458], 0xe
mov dword [ebp - 0x454], 0xf
mov dword [ebp - 0x450], 0x10
mov dword [ebp - 0x44c], 0x11
mov eax, dword [edx]
lea ecx, [ebp - 0x440]
add ecx, eax
lea edx, [edx + 4]
sub al, 4
inc esi
xor byte [ecx], al
cmp esi, 0x12
jne 0x10017802
lea eax, [ebp - 0x824]
mov byte [ebp - 0x42e], 1
push eax
lea eax, [ebp - 0x820]
push eax
push 0
push 0
lea eax, [ebp - 0x440]
push eax
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001788f
cmp dword [ebp - 0x820], 0x64
jne 0x1001788f
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
push 0x7d0
mov dword [ebp - 0x814], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100178a1
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001789b
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x814]
lea eax, [ebp - 0x810]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x10016cb0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x816], 0
je 0x10017f86
cmp byte [ebp - 0x817], 0
jne 0x10017f86
mov eax, dword [0x100995a0]
mov byte [ebp - 0x817], 1
test al, 1
jne 0x10017934
or eax, 1
mov dword [0x100995a0], eax
xorps xmm0, xmm0
mov dword [0x100995a4], 0x10054080
push 0x1004dfe0
mov dword [0x100995b4], 0
movups xmmword [0x100995b8], xmm0
mov byte [0x100995a8], 0
mov dword [0x100995ac], 0
call fcn.1002c1e9
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov edi, 7
mov dword [ebp - 0x6cc], 0xaaa1bca5
xor esi, esi
mov dword [ebp - 0x6c8], 0x24550
mov dword [ebp - 0x6c4], 7
lea edx, [ebp - 0x444]
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 1
mov dword [ebp - 0x43c], 2
mov dword [ebp - 0x438], 3
mov dword [ebp - 0x434], 4
mov dword [ebp - 0x430], 5
mov dword [ebp - 0x42c], 6
test edi, edi
je 0x100179c6
nop dword [eax]
mov eax, dword [edx]
lea ecx, [ebp - 0x6cc]
add ecx, eax
lea edx, [edx + 4]
sub al, 4
inc esi
xor byte [ecx], al
cmp esi, edi
jne 0x100179b0
push 1
lea eax, [ebp - 0x6cc]
mov byte [ebp - 0x6c5], 1
push eax
mov eax, dword [0x100995a4]
mov ecx, 0x100995a4
call dword [eax + 0xc]
cmp byte [0x10090d9b], 0
jne 0x10017aae
mov dword [ebp - 0x468], edi
lea edx, [ebp - 0x484]
mov edi, 0xf
mov dword [ebp - 0x484], 0
xor esi, esi
mov dword [ebp - 0x480], 1
mov dword [ebp - 0x47c], 2
mov dword [ebp - 0x478], 3
mov dword [ebp - 0x474], 4
mov dword [ebp - 0x470], 5
mov dword [ebp - 0x46c], 6
mov dword [ebp - 0x464], 8
mov dword [ebp - 0x460], 9
mov dword [ebp - 0x45c], 0xa
mov dword [ebp - 0x458], 0xb
mov dword [ebp - 0x454], 0xc
mov dword [ebp - 0x450], 0xd
mov dword [ebp - 0x44c], 0xe
test edi, edi
je 0x10017aa7
mov ecx, dword [edx]
lea edx, [edx + 4]
mov al, cl
inc esi
sub al, 4
xor byte [ecx + 0x10090d8c], al
cmp esi, edi
jne 0x10017a93
mov byte [0x10090d9b], 1
cmp byte [0x10090d0f], 0
jne 0x10017c9b
mov edi, 0x2b
mov dword [ebp - 0x610], 0
xor esi, esi
mov dword [ebp - 0x60c], 1
mov dword [ebp - 0x608], 2
lea edx, [ebp - 0x610]
mov dword [ebp - 0x604], 3
mov dword [ebp - 0x600], 4
mov dword [ebp - 0x5fc], 5
mov dword [ebp - 0x5f8], 6
mov dword [ebp - 0x5f4], 7
mov dword [ebp - 0x5f0], 8
mov dword [ebp - 0x5ec], 9
mov dword [ebp - 0x5e8], 0xa
mov dword [ebp - 0x5e4], 0xb
mov dword [ebp - 0x5e0], 0xc
mov dword [ebp - 0x5dc], 0xd
mov dword [ebp - 0x5d8], 0xe
mov dword [ebp - 0x5d4], 0xf
mov dword [ebp - 0x5d0], 0x10
mov dword [ebp - 0x5cc], 0x11
mov dword [ebp - 0x5c8], 0x12
mov dword [ebp - 0x5c4], 0x13
mov dword [ebp - 0x5c0], 0x14
mov dword [ebp - 0x5bc], 0x15
mov dword [ebp - 0x5b8], 0x16
mov dword [ebp - 0x5b4], 0x17
mov dword [ebp - 0x5b0], 0x18
mov dword [ebp - 0x5ac], 0x19
mov dword [ebp - 0x5a8], 0x1a
mov dword [ebp - 0x5a4], 0x1b
mov dword [ebp - 0x5a0], 0x1c
mov dword [ebp - 0x59c], 0x1d
mov dword [ebp - 0x598], 0x1e
mov dword [ebp - 0x594], 0x1f
mov dword [ebp - 0x590], 0x20
mov dword [ebp - 0x58c], 0x21
mov dword [ebp - 0x588], 0x22
mov dword [ebp - 0x584], 0x23
mov dword [ebp - 0x580], 0x24
mov dword [ebp - 0x57c], 0x25
mov dword [ebp - 0x578], 0x26
mov dword [ebp - 0x574], 0x27
mov dword [ebp - 0x570], 0x28
mov dword [ebp - 0x56c], 0x29
mov dword [ebp - 0x568], 0x2a
test edi, edi
je 0x10017c94
nop word [eax + eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
mov al, cl
inc esi
sub al, 4
xor byte [ecx + 0x10090ce4], al
cmp esi, edi
jne 0x10017c80
mov byte [0x10090d0f], 1
push 0x10090d8c
push 0x10090ce4
call fcn.100168d0
test al, al
jne 0x10017f80
cmp byte [0x10090d9b], al
jne 0x10017d80
mov edi, 0xf
mov dword [ebp - 0x55c], 0
xor esi, esi
mov dword [ebp - 0x558], 1
mov dword [ebp - 0x554], 2
lea edx, [ebp - 0x55c]
mov dword [ebp - 0x550], 3
mov dword [ebp - 0x54c], 4
mov dword [ebp - 0x548], 5
mov dword [ebp - 0x544], 6
mov dword [ebp - 0x540], 7
mov dword [ebp - 0x53c], 8
mov dword [ebp - 0x538], 9
mov dword [ebp - 0x534], 0xa
mov dword [ebp - 0x530], 0xb
mov dword [ebp - 0x52c], 0xc
mov dword [ebp - 0x528], 0xd
mov dword [ebp - 0x524], 0xe
test edi, edi
je 0x10017d79
mov ecx, dword [edx]
lea edx, [edx + 4]
mov al, cl
inc esi
sub al, 4
xor byte [ecx + 0x10090d8c], al
cmp esi, edi
jne 0x10017d65
mov byte [0x10090d9b], 1
cmp byte [0x10090c48], 0
jne 0x10017f71
mov edi, 0x2c
mov dword [ebp - 0x6c0], 0
xor esi, esi
mov dword [ebp - 0x6bc], 1
mov dword [ebp - 0x6b8], 2
lea edx, [ebp - 0x6c0]
mov dword [ebp - 0x6b4], 3
mov dword [ebp - 0x6b0], 4
mov dword [ebp - 0x6ac], 5
mov dword [ebp - 0x6a8], 6
mov dword [ebp - 0x6a4], 7
mov dword [ebp - 0x6a0], 8
mov dword [ebp - 0x69c], 9
mov dword [ebp - 0x698], 0xa
mov dword [ebp - 0x694], 0xb
mov dword [ebp - 0x690], 0xc
mov dword [ebp - 0x68c], 0xd
mov dword [ebp - 0x688], 0xe
mov dword [ebp - 0x684], 0xf
mov dword [ebp - 0x680], 0x10
mov dword [ebp - 0x67c], 0x11
mov dword [ebp - 0x678], 0x12
mov dword [ebp - 0x674], 0x13
mov dword [ebp - 0x670], 0x14
mov dword [ebp - 0x66c], 0x15
mov dword [ebp - 0x668], 0x16
mov dword [ebp - 0x664], 0x17
mov dword [ebp - 0x660], 0x18
mov dword [ebp - 0x65c], 0x19
mov dword [ebp - 0x658], 0x1a
mov dword [ebp - 0x654], 0x1b
mov dword [ebp - 0x650], 0x1c
mov dword [ebp - 0x64c], 0x1d
mov dword [ebp - 0x648], 0x1e
mov dword [ebp - 0x644], 0x1f
mov dword [ebp - 0x640], 0x20
mov dword [ebp - 0x63c], 0x21
mov dword [ebp - 0x638], 0x22
mov dword [ebp - 0x634], 0x23
mov dword [ebp - 0x630], 0x24
mov dword [ebp - 0x62c], 0x25
mov dword [ebp - 0x628], 0x26
mov dword [ebp - 0x624], 0x27
mov dword [ebp - 0x620], 0x28
mov dword [ebp - 0x61c], 0x29
mov dword [ebp - 0x618], 0x2a
mov dword [ebp - 0x614], 0x2b
test edi, edi
je 0x10017f6a
mov ecx, dword [edx]
lea edx, [edx + 4]
mov al, cl
inc esi
sub al, 4
xor byte [ecx + 0x10090c1c], al
cmp esi, edi
jne 0x10017f56
mov byte [0x10090c48], 1
push 0x10090d8c
push 0x10090c1c
call fcn.100168d0
mov esi, dword [ebp - 0x814]
test esi, esi
jle 0x10017fa4
inc esi
mov dword [ebp - 0x814], esi
cmp esi, 0xb4
jge 0x10017fb1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10016c60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1002bc85
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret