Function at 0x10014d05
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005cd1f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x690
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x4a8], 0xfffffff7
mov dword [ebp - 0x4a4], 0xfffffff7
mov dword [ebp - 0x4a0], 0xfffffff7
mov dword [ebp - 0x49c], 0xfffffff7
mov dword [ebp - 0x494], 0x57f451d5
mov dword [ebp - 0x144], 0x4f3f7e81
mov dword [ebp - 0x3e0], 6
mov dword [ebp - 0x25c], 0xfffffff8
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x37c], 0xa66fa4bc
mov dword [ebp - 0x100], 0xfffb
mov dword [ebp - 0x1ec], 0
mov dword [ebp - 0x2c], 0
jmp 0x10014db9
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10014dcf
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x374], 1
jmp 0x10014db2
mov dword [ebp - 0x2c], 0
jmp 0x10014ddf
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10014df5
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x134], 0xfffffff7
jmp 0x10014dd8
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x3e8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x374]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x3e8]
cmp eax, dword [ebp - 0x478]
jg 0x10014e47
mov dword [ebp - 0x2c8], 1
jmp 0x10014e4e
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 0xfffffffc
jg 0x10014e63
mov dword [ebp - 0x168], 1
jmp 0x10014e6a
and dword [ebp - 0x168], 0
mov eax, dword [ebp - 0x128]
add eax, 4
je 0x10014e8a
cmp dword [ebp - 0x128], 0
je 0x10014e8a
mov dword [ebp - 0x250], 1
jmp 0x10014e91
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x168]
cmp eax, dword [ebp - 0x250]
jg 0x10014eab
mov dword [ebp - 0x48c], 1
jmp 0x10014eb2
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x584], eax
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x588], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x558], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, 0x32f
imul ecx, ecx, 0xb807
cmp ecx, dword [ebp + eax - 0x134]
jl 0x10014efc
mov dword [ebp - 0x170], 1
jmp 0x10014f03
and dword [ebp - 0x170], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x4a8]
add ecx, dword [ebp - 0x170]
imul ecx, dword [ebp + eax - 0x134]
test ecx, ecx
jne 0x10014f34
mov dword [ebp - 0x258], 1
jmp 0x10014f3b
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x25c]
imul eax, dword [ebp - 0x258]
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x368]
cmp eax, dword [ebp - 0x3f8]
jg 0x10014f81
mov dword [ebp - 0x178], 1
jmp 0x10014f88
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x178]
jne 0x10014fac
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4a8], 0
jne 0x10014fac
and dword [ebp - 0x180], 0
jmp 0x10014fb6
mov dword [ebp - 0x180], 1
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x180], eax
jne 0x10014fd0
mov dword [ebp - 0x2c4], 1
jmp 0x10014fd7
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x37c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4a8], 0x43
jne 0x10014ffe
mov dword [ebp - 0x188], 1
jmp 0x10015005
and dword [ebp - 0x188], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x134]
cmp dword [ebp - 0x188], eax
jl 0x1001502c
cmp dword [ebp - 0x100], 0
jne 0x1001502c
and dword [ebp - 0x264], 0
jmp 0x10015036
mov dword [ebp - 0x264], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x4a8]
cmp eax, dword [ebp - 0x264]
jl 0x10015056
mov dword [ebp - 0x190], 1
jmp 0x1001505d
and dword [ebp - 0x190], 0
cmp dword [ebp - 0x190], 0x5ce4ec6
jg 0x10015075
mov dword [ebp - 0x320], 1
jmp 0x1001507c
and dword [ebp - 0x320], 0
cmp dword [ebp - 0x320], 0xf55f5dd
jne 0x10015094
mov dword [ebp - 0x198], 1
jmp 0x1001509b
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x198], eax
je 0x100150e1
mov dword [ebp - 0x64], 0
jmp 0x100150b6
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xb
jl 0x100150df
mov byte [ebp - 0x5b], 0
movzx eax, byte [ebp - 0x5b]
test eax, eax
je 0x100150dd
push 0
push 0
push 0x877
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x100150af
jmp 0x100150f8
mov dword [ebp - 0x26c], 0x32c2674d
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x74], 0xfffffff6
mov dword [ebp - 0x1a0], 0x15898f01
mov dword [ebp - 0x11c], 0
jmp 0x10015122
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 2
jge 0x1001513e
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x500], 0xf9986e3e
jmp 0x10015115
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x5a0], eax
cmp dword [ebp - 0x74], 0
je 0x1001516d
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x1a0]
jle 0x1001516d
mov dword [ebp - 0x2d0], 1
jmp 0x10015174
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x2d0], eax
je 0x1001518b
mov dword [ebp - 0x400], 1
jmp 0x10015192
and dword [ebp - 0x400], 0
mov eax, 0x4a52
dec eax
cmp eax, 0xfffffffe
jle 0x100151a9
mov dword [ebp - 0x1a8], 1
jmp 0x100151b0
and dword [ebp - 0x1a8], 0
cmp dword [ebp - 0x1a8], 0
jg 0x100151c5
mov dword [ebp - 0x274], 1
jmp 0x100151cc
and dword [ebp - 0x274], 0
cmp dword [ebp - 0x274], 0x53e1e01b
jge 0x100151e4
mov dword [ebp - 0x1b0], 1
jmp 0x100151eb
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x1b0], eax
je 0x10015202
mov dword [ebp - 0x300], 1
jmp 0x10015209
and dword [ebp - 0x300], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x300]
mov dword [ebp + eax - 0x500], ecx
mov byte [ebp - 0x5c], 0
movzx eax, byte [ebp - 0x5c]
test eax, eax
je 0x1001523a
push 0x6e4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x4bc], 0xfffffff7
mov dword [ebp - 0x4b8], 0xfffffff7
mov dword [ebp - 0x4b4], 0xfffffff7
mov dword [ebp - 0x4b0], 0xfffffff7
mov dword [ebp - 0x3a4], 0x57f451d5
mov dword [ebp - 0x13c], 0x4f3f7e81
mov dword [ebp - 0x41c], 6
mov dword [ebp - 0x28c], 0xfffffff8
mov dword [ebp - 0x154], 1
mov dword [ebp - 0x1b8], 0x15d2
mov dword [ebp - 0x404], str.dspfmfxc_ztdqhe_ticfvz_dqovx_ilopq_nklozidt_bczbig_sbpxc_dfhdkw_tvilyjpau_wtfbybfvz_eforoc_bzzpbh
cmp dword [ebp - 0x1b8], 0x182c
jle 0x10015393
and dword [ebp - 0x8c], 0
jmp 0x100152ce
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x7264
jge 0x1001538d
and dword [ebp - 0xf4], 0
jmp 0x100152f4
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0x2446
jge 0x10015388
and dword [ebp - 0x94], 0
jmp 0x1001531a
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0x584a
jge 0x10015383
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0xf4]
or eax, dword [ebp - 0x94]
cdq
mov dword [ebp - 0x3f4], eax
mov dword [ebp - 0x3f0], edx
push dword [ebp - 0x3f0]
push dword [ebp - 0x3f4]
lea ecx, [ebp - 0x688]
call fcn.10001a55
pop ecx
pop ecx
mov dword [ebp - 0x384], eax
mov ecx, dword [ebp - 0x384]
call fcn.10004f89
push eax
call fcn.100443ac
pop ecx
lea ecx, [ebp - 0x688]
call fcn.10004f7f
jmp 0x1001530d
jmp 0x100152e7
jmp 0x100152c1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x70], 0xffffffff
and dword [ebp - 4], 0
cmp dword [ebp - 0x1b8], 0x1341
jge 0x100153b6
push dword [ebp - 0x404]
call fcn.100443ac
pop ecx
jmp 0x100153d2
or dword [ebp - 4], 0xffffffff
jmp 0x100153dc
mov dword [ebp - 0x3b4], 0xa66fa4bc
mov dword [ebp - 0x110], 0xfffb
mov dword [ebp - 0x27c], 0x88b
mov dword [ebp - 0x458], str.cej_eecowhw_adfezakww_yuhgepv_pwvdrjf_njoyxh_rdqos_arx
cmp dword [ebp - 0x27c], 0xad3
jle 0x100154bb
and dword [ebp - 0x124], 0
jmp 0x1001542a
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xf70
jge 0x100154bb
and dword [ebp - 0x9c], 0
jmp 0x10015450
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x4cde
jge 0x100154b6
mov eax, dword [ebp - 0x124]
cdq
idiv dword [ebp - 0x9c]
mov eax, edx
cdq
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x408], edx
push dword [ebp - 0x408]
push dword [ebp - 0x40c]
lea ecx, [ebp - 0x658]
call fcn.10001a55
pop ecx
pop ecx
mov dword [ebp - 0x38c], eax
mov ecx, dword [ebp - 0x38c]
call fcn.10004f89
push eax
call fcn.100443ac
pop ecx
lea ecx, [ebp - 0x658]
call fcn.10004f7f
jmp 0x10015443
jmp 0x1001541d
mov dword [ebp - 0x1c0], 0
mov dword [ebp - 4], 2
cmp dword [ebp - 0x27c], 0x7ca
jge 0x100154e4
push dword [ebp - 0x458]
call fcn.100443ac
pop ecx
jmp 0x10015500
or dword [ebp - 4], 0xffffffff
jmp 0x1001550a
mov dword [ebp - 0x30], 0
jmp 0x1001551a
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x10015530
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x394], 1
jmp 0x10015513
mov dword [ebp - 0x30], 0
jmp 0x10015540
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x10015556
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x14c], 0xfffffff7
jmp 0x10015539
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x410], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x394]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x410]
cmp eax, dword [ebp - 0x39c]
jg 0x100155a8
mov dword [ebp - 0x2d8], 1
jmp 0x100155af
and dword [ebp - 0x2d8], 0
cmp dword [ebp - 0x2d8], 0xfffffffc
jg 0x100155c4
mov dword [ebp - 0x1c8], 1
jmp 0x100155cb
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x154]
add eax, 4
je 0x100155eb
cmp dword [ebp - 0x154], 0
je 0x100155eb
mov dword [ebp - 0x284], 1
jmp 0x100155f2
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x1c8]
cmp eax, dword [ebp - 0x284]
jg 0x1001560c
mov dword [ebp - 0x498], 1
jmp 0x10015613
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x590], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x568], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, 0x32f
imul ecx, ecx, 0xb807
cmp ecx, dword [ebp + eax - 0x14c]
jl 0x1001565d
mov dword [ebp - 0x1d0], 1
jmp 0x10015664
and dword [ebp - 0x1d0], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x4bc]
add ecx, dword [ebp - 0x1d0]
imul ecx, dword [ebp + eax - 0x14c]
test ecx, ecx
jne 0x10015695
mov dword [ebp - 0x318], 1
jmp 0x1001569c
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x28c]
imul eax, dword [ebp - 0x318]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x3ac]
cmp eax, dword [ebp - 0x464]
jg 0x100156e2
mov dword [ebp - 0x1d8], 1
jmp 0x100156e9
and dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x70]
add eax, dword [ebp - 0x1d8]
jne 0x1001570d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4bc], 0
jne 0x1001570d
and dword [ebp - 0x1e0], 0
jmp 0x10015717
mov dword [ebp - 0x1e0], 1
mov eax, dword [ebp - 0x28c]
cmp dword [ebp - 0x1e0], eax
jne 0x10015731
mov dword [ebp - 0x2e0], 1
jmp 0x10015738
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x3b4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4bc], 0x43
jne 0x1001575f
mov dword [ebp - 0x1e8], 1
jmp 0x10015766
and dword [ebp - 0x1e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14c]
cmp dword [ebp - 0x1e8], eax
jl 0x1001578d
cmp dword [ebp - 0x110], 0
jne 0x1001578d
and dword [ebp - 0x294], 0
jmp 0x10015797
mov dword [ebp - 0x294], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x4bc]
cmp eax, dword [ebp - 0x294]
jl 0x100157b7
mov dword [ebp - 0x1f0], 1
jmp 0x100157be
and dword [ebp - 0x1f0], 0
cmp dword [ebp - 0x1f0], 0x5ce4ec6
jg 0x100157d6
mov dword [ebp - 0x308], 1
jmp 0x100157dd
and dword [ebp - 0x308], 0
cmp dword [ebp - 0x308], 0xf55f5dd
jne 0x100157f5
mov dword [ebp - 0x1f8], 1
jmp 0x100157fc
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x1f8], eax
je 0x10015842
mov dword [ebp - 0x70], 0
jmp 0x10015817
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xb
jl 0x10015840
mov byte [ebp - 0x44], 0
movzx eax, byte [ebp - 0x44]
test eax, eax
je 0x1001583e
push 0
push 0
push 0x877
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x10015810
jmp 0x10015859
mov dword [ebp - 0x29c], 0x32c2674d
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
mov dword [ebp - 0x33c], 0x4a68
mov dword [ebp - 0x338], 0x4a68
mov dword [ebp - 0x334], 0x4a68
mov dword [ebp - 0x330], 0x4a68
mov dword [ebp - 0x20], 0x871c7bf0
mov dword [ebp - 0x518], 1
mov dword [ebp - 0x34], 0
jmp 0x100158a2
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x100158b8
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x364], 0x5ff57440
jmp 0x1001589b
mov dword [ebp - 0x34], 0
jmp 0x100158c8
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x100158de
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x5f8], 0xc7e90690
jmp 0x100158c1
mov dword [ebp - 0x20], 0
jmp 0x100158ee
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x10015acf
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x12c], 1
mov dword [ebp - 0x3bc], 0x5610a143
mov dword [ebp - 0x1c], 0
jmp 0x10015923
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x10015953
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x33c]
mov ecx, dword [ebp - 0x20]
mov dword [ebp + ecx*4 - 0x33c], eax
mov byte [ebp - 0x5a], 0
movzx eax, byte [ebp - 0x5a]
test eax, eax
je 0x10015951
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
jmp 0x1001591c
mov dword [ebp - 0x1c], 3
jmp 0x10015963
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x100159d1
mov dword [ebp - 0xa4], 0xbfc4f27d
mov dword [ebp - 0x52c], 0
mov dword [ebp - 0xa4], 3
jmp 0x10015996
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jl 0x100159cf
mov dword [ebp - 0x200], 0x20452a26
mov byte [ebp - 0x49], 0
movzx eax, byte [ebp - 0x49]
test eax, eax
je 0x100159c0
push 0x2171
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
jmp 0x10015989
jmp 0x1001595c
mov dword [ebp - 0x1c], 0
jmp 0x100159e1
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x10015aca
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x33c]
mov dword [ebp - 0x4f0], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x10015a19
mov dword [ebp - 0x2e8], 1
jmp 0x10015a20
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x2e8]
jl 0x10015a37
mov dword [ebp - 0x428], 1
jmp 0x10015a3e
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4f4], eax
mov eax, dword [ebp - 0x20]
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x33c]
cmp ecx, dword [ebp + eax*4 - 0x33c]
jge 0x10015a6c
mov dword [ebp - 0x208], 1
jmp 0x10015a73
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x208], eax
jle 0x10015a93
cmp dword [ebp - 0x12c], 0
je 0x10015a93
mov dword [ebp - 0x2a4], 1
jmp 0x10015a9a
and dword [ebp - 0x2a4], 0
cmp dword [ebp - 0x2a4], 0x84868fda
je 0x10015ab2
mov dword [ebp - 0x210], 1
jmp 0x10015ab9
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x3bc], eax
jmp 0x100159da
jmp 0x100158e7
cmp dword [ebp - 0x20], 0
je 0x10015c53
mov dword [ebp - 0x20], 0xbd0d
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x33c]
mov dword [ebp - 0x328], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x328]
mov dword [ebp + eax - 0x364], ecx
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x328]
je 0x10015c28
xor eax, eax
inc eax
je 0x10015b85
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp + eax - 0x364]
jne 0x10015b37
mov dword [ebp - 0x218], 1
jmp 0x10015b3e
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x218], eax
jle 0x10015b55
mov dword [ebp - 0x2ac], 1
jmp 0x10015b5c
and dword [ebp - 0x2ac], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x2ac]
neg ecx
cmp ecx, dword [ebp + eax - 0x364]
jle 0x10015b85
cmp dword [ebp - 0x20], 0
je 0x10015b85
mov dword [ebp - 0x220], 1
jmp 0x10015b8c
and dword [ebp - 0x220], 0
cmp dword [ebp - 0x220], 0
je 0x10015ba8
push 3
pop eax
test eax, eax
je 0x10015ba8
mov dword [ebp - 0x2f0], 1
jmp 0x10015baf
and dword [ebp - 0x2f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x364]
cmp dword [ebp - 0x2f0], eax
jle 0x10015bd3
cmp dword [ebp - 0x20], 0
jne 0x10015bd3
and dword [ebp - 0x490], 0
jmp 0x10015bdd
mov dword [ebp - 0x490], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x364]
mov dword [ebp - 0x55c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x364]
mov dword [ebp - 0x564], eax
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x364]
cmp ecx, dword [ebp + eax - 0x364]
jge 0x10015c28
and dword [ebp - 0x228], 0
jmp 0x10015c32
mov dword [ebp - 0x228], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x33c]
cmp dword [ebp - 0x228], eax
jge 0x10015c53
mov dword [ebp - 0x2b4], 1
jmp 0x10015c5a
and dword [ebp - 0x2b4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2b4]
mov dword [ebp + eax - 0x5f8], ecx
movzx eax, byte [0x1416ea3c]
test eax, eax
je 0x10015c8b
mov esi, 0x100755c0
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x100177ff
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x138], 0xfffffffc
mov dword [ebp - 0x434], 0xffffffff
mov dword [ebp - 0x3cc], 0x58a8ce9b
mov dword [ebp - 0x160], 0xfffffffa
mov dword [ebp - 0x474], 0xfffffffa
mov dword [ebp - 0x3d4], 0x8b742d63
mov dword [ebp - 0x14], 0
jmp 0x10015ce1
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10015cf4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x18], 0xfffffff6
jmp 0x10015cda
mov dword [ebp - 0x14], 0
jmp 0x10015d04
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10015d1a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3c4], 0xffffffff
jmp 0x10015cfd
mov dword [ebp - 0x14], 0
jmp 0x10015d2a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10015d40
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x50c], 0xffffffff
jmp 0x10015d23
mov dword [ebp - 0x14], 0
jmp 0x10015d50
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10015d66
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x470], 4
jmp 0x10015d49
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
mov dword [ebp - 0x57c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
mov dword [ebp - 0x4ec], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
mov dword [ebp - 0x58c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
mov dword [ebp - 0x140], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x140]
cmp ecx, dword [ebp + eax - 0x18]
jge 0x10015dc4
mov dword [ebp - 0x230], 1
jmp 0x10015dcb
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x230]
add eax, 0x219252f2
mov dword [ebp - 0x138], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
cmp eax, dword [ebp - 0x138]
jg 0x10015dfa
mov dword [ebp - 0x310], 1
jmp 0x10015e01
and dword [ebp - 0x310], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
cmp dword [ebp - 0x310], eax
je 0x10015e1f
mov dword [ebp - 0x130], 1
jmp 0x10015e26
and dword [ebp - 0x130], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x130]
mov dword [ebp + eax - 0x3c4], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
cmp dword [ebp - 0x130], eax
je 0x10015e57
mov dword [ebp - 0x238], 1
jmp 0x10015e5e
and dword [ebp - 0x238], 0
cmp dword [ebp - 0x238], 1
jg 0x10015e73
mov dword [ebp - 0x2bc], 1
jmp 0x10015e7a
and dword [ebp - 0x2bc], 0
cmp dword [ebp - 0x2bc], 0x9a164e6
jg 0x10015e92
mov dword [ebp - 0x240], 1
jmp 0x10015e99
and dword [ebp - 0x240], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x240]
sub ecx, dword [ebp + eax - 0x18]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x50c], ecx
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
push 4
pop edx
imul edx, edx, 0
mov edx, dword [ebp + edx - 0x18]
sub edx, dword [ebp + ecx - 0x18]
cmp edx, dword [ebp + eax - 0x470]
jne 0x10015ef2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18], 0
je 0x10015ef2
mov dword [ebp - 0x2f8], 1
jmp 0x10015ef9
and dword [ebp - 0x2f8], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x2f8]
sub edx, dword [ebp + ecx - 0x18]
cmp edx, dword [ebp + eax - 0x18]
jl 0x10015f21
mov dword [ebp - 0x248], 1
jmp 0x10015f28
and dword [ebp - 0x248], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x248]
add ecx, 0x2d74
cmp ecx, dword [ebp + eax - 0x470]
jle 0x10015f4f
mov dword [ebp - 0x254], 1
jmp 0x10015f56
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x160], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x160]
sub edx, dword [ebp + ecx - 0x470]
cmp edx, dword [ebp + eax - 0x18]
jne 0x10015fa5
mov dword [ebp - 0x164], 1
jmp 0x10015fac
and dword [ebp - 0x164], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
cmp eax, dword [ebp - 0x164]
jg 0x10015fca
mov dword [ebp - 0x16c], 1
jmp 0x10015fd1
and dword [ebp - 0x16c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
cmp dword [ebp - 0x16c], eax
jle 0x10015ff3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x470], 0
je 0x10016008
mov eax, 0xfff8
test eax, eax
je 0x10016008
mov dword [ebp - 0x174], 1
jmp 0x1001600f
and dword [ebp - 0x174], 0
cmp dword [ebp - 0x174], 0
ja 0x1001602a
cmp dword [ebp - 0x474], 0
jne 0x1001602a
and dword [ebp - 0x17c], 0
jmp 0x10016034
mov dword [ebp - 0x17c], 1
cmp dword [ebp - 0x17c], 9
je 0x10016049
mov dword [ebp - 0x184], 1
jmp 0x10016050
and dword [ebp - 0x184], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x470]
cmp dword [ebp - 0x184], eax
jl 0x10016071
mov dword [ebp - 0x18c], 1
jmp 0x10016078
and dword [ebp - 0x18c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
add eax, dword [ebp - 0x18c]
mov dword [ebp - 0x3d4], eax
mov dword [ebp - 0x594], 0x100755c0
mov dword [ebp - 0x194], 0x4f38
mov dword [ebp - 0x3dc], str.vhr_fslbnrqf_rgxhsj_tyuvwtjr_vfw_hlcupzva_ccmvrp_bwe_bmzqais_spvcdo
cmp dword [ebp - 0x194], 0x529f
jle 0x1001615c
push 0
push 0x20d0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
and dword [ebp - 0x80], 0
jmp 0x100160d8
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x4f0
jge 0x1001615c
and dword [ebp - 0xac], 0
jmp 0x100160f7
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x6153
jge 0x10016157
mov eax, dword [ebp - 0x80]
and eax, dword [ebp - 0xac]
cdq
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x414], edx
push dword [ebp - 0x414]
push dword [ebp - 0x418]
lea ecx, [ebp - 0x628]
call fcn.10001a55
pop ecx
pop ecx
mov dword [ebp - 0x440], eax
mov ecx, dword [ebp - 0x440]
call fcn.10004f89
push eax
call fcn.100443ac
pop ecx
lea ecx, [ebp - 0x628]
call fcn.10004f7f
jmp 0x100160ea
jmp 0x100160d1
mov dword [ebp - 4], 4
cmp dword [ebp - 0x194], 0x4ebc
jge 0x1001617b
push dword [ebp - 0x3dc]
call fcn.100443ac
pop ecx
jmp 0x10016197
or dword [ebp - 4], 0xffffffff
jmp 0x100161a1
mov dword [ebp - 0x4e8], 0xb4ffb871
mov dword [ebp - 0x4e4], 0xb4ffb871
mov dword [ebp - 0x4e0], 0xb4ffb871
mov dword [ebp - 0x4dc], 0xb4ffb871
mov dword [ebp - 0x120], 0x443250e6
mov dword [ebp - 0x59c], 0xfffffff6
mov dword [ebp - 0x19c], 0xf29c8dda
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x4e8], 0xfffffff6
mov dword [ebp - 0x120], 3
jmp 0x10016211
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jl 0x10016293
mov dword [ebp - 0x5a4], 3
mov dword [ebp - 0x5ac], 0x27d2703d
mov dword [ebp - 0x5b4], 9
mov dword [ebp - 0x514], 0xa420452a
mov dword [ebp - 0x4f8], 0x87fce6bb
mov dword [ebp - 0xb4], 0
jmp 0x10016265
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jge 0x10016281
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x600], 1
jmp 0x10016258
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
jmp 0x10016204
mov dword [ebp - 0x53c], 0x100755c4
mov dword [ebp - 0x40], 0x7e2799ac
mov dword [ebp - 0x4ac], 0x211e9a9
mov dword [ebp - 0x108], 0
jmp 0x100162c7
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jge 0x100162e3
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x5e0], 0xfffffff8
jmp 0x100162ba
mov byte [ebp - 0x5d], 0
movzx eax, byte [ebp - 0x5d]
test eax, eax
je 0x100162f7
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [ebp - 0x40], 0x16
jmp 0x10016307
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x17
jge 0x100166c1
mov dword [ebp - 0x48], 0xe8b72fd4
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x68], 0x9265
mov dword [ebp - 0x48], 0
jmp 0x10016336
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xf
jle 0x100166a8
mov dword [ebp - 0x50], 0x467b
mov dword [ebp - 0x1e4], 4
mov dword [ebp - 0xbc], 0
jmp 0x1001636a
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x10016386
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x354], 0x19570a50
jmp 0x1001635d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x354]
mov dword [ebp - 0x504], eax
or eax, 0xffffffff
je 0x100163b0
cmp dword [ebp - 0x40], 0
je 0x100163b0
mov dword [ebp - 0x1a4], 1
jmp 0x100163b7
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x1a4], eax
jne 0x100163d4
mov eax, 0x4a71a6e4
test eax, eax
jne 0x100163d4
and dword [ebp - 0x1ac], 0
jmp 0x100163de
mov dword [ebp - 0x1ac], 1
imul eax, dword [ebp - 0x1ac], 0xfffffff7
push 4
pop ecx
shl ecx, 0
cmp dword [ebp + ecx - 0x354], eax
je 0x10016400
mov dword [ebp - 0x1b4], 1
jmp 0x10016407
and dword [ebp - 0x1b4], 0
cmp dword [ebp - 0x1b4], 0x6efe0cd1
jle 0x1001641f
mov dword [ebp - 0x1bc], 1
jmp 0x10016426
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x1bc]
sub eax, dword [ebp - 0x40]
neg eax
jne 0x10016445
cmp dword [ebp - 0x50], 0
je 0x10016445
mov dword [ebp - 0x1c4], 1
jmp 0x1001644c
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x1c4]
cmp eax, 0xf8b8
je 0x10016469
mov dword [ebp - 0x1cc], 1
jmp 0x10016470
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x50]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x354]
sub ecx, eax
cmp ecx, dword [ebp - 0x40]
jge 0x1001649f
mov dword [ebp - 0x1d4], 1
jmp 0x100164a6
and dword [ebp - 0x1d4], 0
cmp dword [ebp - 0x1d4], 0x3ae5
je 0x100164be
mov dword [ebp - 0x1dc], 1
jmp 0x100164c5
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x1dc]
sub eax, dword [ebp - 0x48]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0x78], 0
jmp 0x100164f6
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jg 0x100166a3
mov dword [ebp - 0x68], 0
jmp 0x10016510
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jg 0x10016683
mov dword [ebp - 0x50], 0
jmp 0x1001652a
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jg 0x1001667e
mov dword [ebp - 0x15c], 0x2ddf
mov dword [ebp - 0x44c], str.azl_oxjin_mwtcvm_zbgyk_kmlxcv_yxdmqvjrz_uhq_dglkx_idvv_bdrtuqic_imiqeufy
cmp dword [ebp - 0x15c], 0x30ab
jle 0x100165fe
and dword [ebp - 0x118], 0
jmp 0x1001656e
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x56bb
jge 0x100165fe
and dword [ebp - 0xc4], 0
jmp 0x10016594
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x24ac
jge 0x100165f9
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0xc4]
sar eax, cl
cdq
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], edx
push dword [ebp - 0x420]
push dword [ebp - 0x424]
lea ecx, [ebp - 0x640]
call fcn.10001a55
pop ecx
pop ecx
mov dword [ebp - 0x3e4], eax
mov ecx, dword [ebp - 0x3e4]
call fcn.10004f89
push eax
call fcn.100443ac
pop ecx
lea ecx, [ebp - 0x640]
call fcn.10004f7f
jmp 0x10016587
jmp 0x10016561
mov byte [ebp - 0x51], 0
movzx eax, byte [ebp - 0x51]
test eax, eax
je 0x10016625
push 0
push 0xa8b
push 0
push 0
push 0x20c5
push 0xa5d
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov dword [ebp - 4], 6
cmp dword [ebp - 0x15c], 0x2dab
jge 0x10016644
push dword [ebp - 0x44c]
call fcn.100443ac
pop ecx
jmp 0x10016660
or dword [ebp - 4], 0xffffffff
jmp 0x1001666a
mov eax, dword [ebp - 0x50]
cmp dword [ebp + eax*4 - 0x354], 0
je 0x10016679
jmp 0x1001667e
jmp 0x10016523
jmp 0x10016509
mov byte [ebp - 0x59], 0
movzx eax, byte [ebp - 0x59]
test eax, eax
je 0x1001669e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x100164ef
jmp 0x1001632f
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x5e0], 0
je 0x100166bc
jmp 0x10016300
jmp 0x10016300
mov byte [0x1416ea3c], 1
mov dword [ebp - 0xf8], 0x17571177
mov dword [ebp - 0x1f4], 0xbeccce1e
mov dword [ebp - 0x544], 7
mov dword [ebp - 0xf8], 0
jmp 0x100166ff
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xffffffe6
jne 0x1001673e
mov byte [ebp - 0x41], 0
movzx eax, byte [ebp - 0x41]
test eax, eax
je 0x1001672f
push 0
push 0x240e
push 0x2293
push 0x26ea
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov eax, dword [ebp - 0x1f4]
dec eax
mov dword [ebp - 0x1f4], eax
jmp 0x100166f2
xor eax, eax
inc eax
imul eax, eax, 0x148
add eax, 0x10075608
mov dword [ebp - 0x30c], eax
xor eax, eax
inc eax
imul eax, eax, 0x1c
add eax, 0x10075608
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x1fc], 0x1b13
mov dword [ebp - 0x3fc], str.aacyhobv_alwtxjpq_dmpx_uprudfjue
cmp dword [ebp - 0x1fc], 0x1b79
jle 0x100168ab
and dword [ebp - 0xd4], 0
jmp 0x1001679d
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x6035
jge 0x10016890
and dword [ebp - 0x104], 0
jmp 0x100167c3
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x51c9
jge 0x1001688b
and dword [ebp - 0xcc], 0
jmp 0x100167e9
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x6747
jge 0x10016886
and dword [ebp - 0xfc], 0
jmp 0x1001680f
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x580c
jge 0x10016881
mov eax, dword [ebp - 0xcc]
imul eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0xd4]
add ecx, dword [ebp - 0x104]
and eax, ecx
cdq
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], edx
push dword [ebp - 0x42c]
push dword [ebp - 0x430]
lea ecx, [ebp - 0x670]
call fcn.10001a55
pop ecx
pop ecx
mov dword [ebp - 0x3ec], eax
mov ecx, dword [ebp - 0x3ec]
call fcn.10004f89
push eax
call fcn.100443ac
pop ecx
lea ecx, [ebp - 0x670]
call fcn.10004f7f
jmp 0x10016802
jmp 0x100167dc
jmp 0x100167b6
jmp 0x10016790
push 0x675
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
mov dword [ebp - 0x34c], 0
mov dword [ebp - 0x348], 0
mov dword [ebp - 0x344], 0
mov dword [ebp - 0x340], 0
mov dword [ebp - 4], 8
cmp dword [ebp - 0x1fc], 0x1a8d
jge 0x100168f2
push dword [ebp - 0x3fc]
call fcn.100443ac
pop ecx
jmp 0x1001690e
or dword [ebp - 4], 0xffffffff
jmp 0x10016918
mov dword [ebp - 0x6c], 0xa35c
mov dword [ebp - 0x234], 0x12a30a4c
mov dword [ebp - 0x7c], 0xf1448112
mov dword [ebp - 0x204], 0x33a1
mov dword [ebp - 0x370], str.nfzbfb_wwm_jhauvghv_tqguze_rcgw_hpvwyge_iwouumt_chby_jzuj_qmgh
cmp dword [ebp - 0x204], 0x3718
jle 0x100169f4
and dword [ebp - 0xdc], 0
jmp 0x1001696a
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x46d6
jge 0x100169f4
and dword [ebp - 0x10c], 0
jmp 0x1001698c
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x3d59
jge 0x100169ef
mov eax, dword [ebp - 0xdc]
or eax, dword [ebp - 0x10c]
cdq
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x438], edx
push dword [ebp - 0x438]
push dword [ebp - 0x43c]
lea ecx, [ebp - 0x6a0]
call fcn.10001a55
pop ecx
pop ecx
mov dword [ebp - 0x36c], eax
mov ecx, dword [ebp - 0x36c]
call fcn.10004f89
push eax
call fcn.100443ac
pop ecx
lea ecx, [ebp - 0x6a0]
call fcn.10004f7f
jmp 0x1001697f
jmp 0x1001695d
mov dword [ebp - 0x380], 0x5c526587
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x204], 0x2ff4
jge 0x10016a1d
push dword [ebp - 0x370]
call fcn.100443ac
pop ecx
jmp 0x10016a39
or dword [ebp - 4], 0xffffffff
jmp 0x10016a43
mov dword [ebp - 0x20c], 0xf03
mov dword [ebp - 0x378], str.euczviv_kjmtepsrr_pfhkadfcv_fzskkclbl_udzrghdth_bgwwcqv_wkielfgw_nymtqpwd_metmzfmyo_lnqo_cncpyc_nmfkrqwe
cmp dword [ebp - 0x20c], 0x10b0
jle 0x10016ada
and dword [ebp - 0xe4], 0
jmp 0x10016a79
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x4e45
jge 0x10016ada
and dword [ebp - 0x114], 0
jmp 0x10016a9b
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x2a9b
jge 0x10016ad8
mov eax, dword [ebp - 0xe4]
xor eax, dword [ebp - 0x114]
cdq
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x444], edx
push dword [ebp - 0x444]
push dword [ebp - 0x448]
mov ecx, 0x10075fb8
call fcn.10004fa9
jmp 0x10016a8e
jmp 0x10016a6c
mov dword [ebp - 0xec], 0
jmp 0x10016af3
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 4
jge 0x10016b0f
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x610], 0xb3bfa32a
jmp 0x10016ae6
mov dword [ebp - 4], 0xc
cmp dword [ebp - 0x20c], 0xc87
jge 0x10016b32
mov edx, dword [ebp - 0x378]
mov ecx, 0x10075fb8
call fcn.1000736a
jmp 0x10016b4e
or dword [ebp - 4], 0xffffffff
jmp 0x10016b58
mov eax, 0x2703d9b9
test eax, eax
je 0x10016b83
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x34c]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x10016b83
mov dword [ebp - 0x214], 1
jmp 0x10016b8a
and dword [ebp - 0x214], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34c], 0
jne 0x10016bc2
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x34c]
imul ecx, dword [ebp + eax - 0x34c]
test ecx, ecx
jne 0x10016bc2
and dword [ebp - 0x21c], 0
jmp 0x10016bcc
mov dword [ebp - 0x21c], 1
mov eax, dword [ebp - 0x214]
imul eax, dword [ebp - 0x21c]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x34c]
add ecx, eax
mov dword [ebp - 0x224], ecx
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x224]
mov dword [ebp + eax - 0x610], ecx
cmp dword [ebp - 0x224], 0x31f145ba
jne 0x10016c19
mov dword [ebp - 0x22c], 1
jmp 0x10016c20
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x22c]
sub eax, 0x288586fd
mov dword [ebp - 0x234], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x234]
cmp ecx, dword [ebp + eax - 0x34c]
jg 0x10016c52
mov dword [ebp - 0x23c], 1
jmp 0x10016c59
and dword [ebp - 0x23c], 0
cmp dword [ebp - 0x23c], 0
je 0x10016c6e
mov dword [ebp - 0x244], 1
jmp 0x10016c75
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x6c], 0
jmp 0x10016c8e
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 7
jle 0x10016d73
mov dword [ebp - 0x510], 0x4f8d
mov dword [ebp - 0x268], 1
mov dword [ebp - 0x84], 0
jmp 0x10016cc5
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x10016ce1
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x574], 0
jmp 0x10016cb8
mov dword [ebp - 0x7c], 0xffffffe4
jmp 0x10016cf1
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xfffffff9
jl 0x10016d21
mov dword [ebp - 0x54c], 9
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0x380]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x574], eax
jmp 0x10016cea
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x574], 1
jne 0x10016d3c
mov dword [ebp - 0x24c], 1
jmp 0x10016d43
and dword [ebp - 0x24c], 0
cmp dword [ebp - 0x24c], 0x4f2c
jne 0x10016d5b
mov dword [ebp - 0x260], 1
jmp 0x10016d62
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x268], eax
jmp 0x10016c87
mov eax, dword [ebp - 0x30c]
mov dword [0x100755c0], eax
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x2b0], 0x72fa5d87
mov dword [ebp - 0x534], 1
mov dword [ebp - 0x24], 0
jmp 0x10016da9
cmp dword [ebp - 0x24], 4
jle 0x1001710b
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x390], 0
cmp dword [ebp - 0x24], 0
je 0x10016dfe
cmp dword [ebp - 0x58], 0
jne 0x10016ddc
mov dword [ebp - 0x270], 1
jmp 0x10016de3
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x270]
jg 0x10016df2
xor eax, eax
je 0x10016dfe
mov dword [ebp - 0x278], 1
jmp 0x10016e05
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x278], eax
je 0x10016e1c
mov dword [ebp - 0x280], 1
jmp 0x10016e23
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x280], eax
jle 0x10016e3a
mov dword [ebp - 0x288], 1
jmp 0x10016e41
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x288]
jne 0x100170e3
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x88], 0
jmp 0x10016e73
cmp dword [ebp - 0x88], 3
jge 0x10016e8f
mov byte [ebp - 0x5e], 0
movzx eax, byte [ebp - 0x5e]
test eax, eax
je 0x10017106
push 0x25df
push 0x14c4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x10016da2
mov dword [ebp - 0x2dc], 0x1f88
mov dword [ebp - 0x398], str.vnzy_jjwv_lyvngsw_nsktxhl
cmp dword [ebp - 0x2dc], 0x2072
jle 0x100171da
and dword [ebp - 0xa0], 0
jmp 0x10017145
cmp dword [ebp - 0xa0], 0x1d4b
jge 0x100171da
and dword [ebp - 0xa8], 0
jmp 0x1001716b
cmp dword [ebp - 0xa8], 0x6b0f
jge 0x100171d5
and dword [ebp - 0xb0], 0
jmp 0x1001718d
jmp 0x10017138
mov eax, dword [ebp - 0x150]
mov dword [0x100755c4], eax
mov dword [ebp - 4], 0xe
cmp dword [ebp - 0x2dc], 0x1e6b
jge 0x10017208
mov edx, dword [ebp - 0x398]
mov ecx, 0x10075fb8
call fcn.1000736a
jmp 0x10017224
or dword [ebp - 4], 0xffffffff
jmp 0x1001722e
mov dword [ebp - 0x28], 0x8c6a53d0
mov dword [ebp - 0xc0], 5
mov dword [ebp - 0x3a8], 7
mov dword [ebp - 0xb8], 0
jmp 0x10017262
cmp dword [ebp - 0xb8], 4
jge 0x1001727e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret