Function at 0x1000f224
Capabilities:
Accept command line arguments
Check os version
Contain obfuscated stackstrings
Create process on windows
Create thread
Delete registry value
Extract resource via kernel32 functions
Get common file path
Get file system object information
Get geographical location
Get graphical window text
Get system information on windows
Get thread local storage value
Identify system language via api
Log keystrokes via polling
Parse pe header
Query environment variable
Read .ini file

Disassembly:
mov eax, 0x10081543
call fcn.10080abc
mov eax, 0x159c
call fcn.1007cc90
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ecx
mov edi, 0xd41
mov byte [ebp - 0x6d], dl
mov dword [ebp - 0x3c], edi
lea ecx, [ebp - 0xac4]
inc ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x3c], 0xf5af8b51
mov dword [ebp - 0x60], 0x9dbea522
mov dword [ebp - 0x34], ebx
push 3
call fcn.1000e8cf
xor eax, eax
lea ecx, [ebp - 0x13f0]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10e0]
movdqa xmm0, xmmword [0x1000a9e0]
push eax
lea eax, [ebp - 0x10f0]
push eax
movdqu xmmword [ebp - 0x10f0], xmm0
call fcn.1000e94e
lea ecx, [ebp - 0x188]
mov esi, eax
call fcn.1000e94b
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1360]
push dword [esi]
call fcn.1000e911
mov byte [ebp - 4], bl
xor eax, eax
mov dword [ebp - 0x5c], 0xb7a14055
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1000f2ea
push dword [ebp - 0x28]
lea ecx, [ebp - 0xac4]
call fcn.1000e93c
or dword [eax], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1000f2ce
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1000f30c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x7ac], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1000f2f3
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_CopyRect]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1000f31f
push eax
push eax
call ebx
dec dword [ebp - 0x7a8]
mov esi, 0x11accbad
mov eax, dword [ebp - 0x7a8]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x34]
neg eax
neg eax
push 2
sbb eax, eax
xor edx, edx
neg eax
sub esi, eax
mov eax, dword [ebp - 0x60]
cmp ecx, eax
lea ecx, [ebp - 0xac4]
setg dl
sub esi, edx
call fcn.1000e93c
mov edx, dword [ebp - 0x34]
xor ecx, ecx
add edx, dword [ebp - 0x34]
imul edx, esi
mov dword [eax], esi
mov eax, dword [ebp - 0x30]
cmp edx, eax
setle cl
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x1360]
call fcn.1000e937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac4]
call fcn.1000e937
mov dword [ebp - 0x3c], edi
lea ecx, [ebp - 0xa10]
xor edi, edi
inc edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x3c], 0xf5af8b51
mov dword [ebp - 0x60], 0x9dbea522
mov dword [ebp - 0x34], edi
push 3
call fcn.1000e8cf
lea eax, [ebp - 0x11e0]
mov dword [ebp - 4], 2
movdqa xmm0, xmmword [0x1000a9e0]
lea ecx, [ebp - 0x1420]
push eax
lea eax, [ebp - 0x11f0]
push eax
movdqu xmmword [ebp - 0x11f0], xmm0
call fcn.1000e94e
lea ecx, [ebp - 0x222]
mov esi, eax
call fcn.1000e94b
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1354]
push dword [esi]
call fcn.1000e911
mov byte [ebp - 4], 3
xor eax, eax
mov dword [ebp - 0x5c], 0xb7a14055
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1000f435
push dword [ebp - 0x28]
lea ecx, [ebp - 0xa10]
call fcn.1000e93c
or dword [eax], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1000f419
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1000f457
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x730], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1000f43e
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1000f464
push eax
push eax
call ebx
dec dword [ebp - 0x72c]
mov esi, 0x11accbad
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x34]
neg eax
neg eax
push 2
sbb eax, eax
xor edx, edx
neg eax
sub esi, eax
mov eax, dword [ebp - 0x60]
cmp ecx, eax
lea ecx, [ebp - 0xa10]
setg dl
sub esi, edx
call fcn.1000e93c
mov edx, dword [ebp - 0x34]
xor ecx, ecx
add edx, dword [ebp - 0x34]
imul edx, esi
mov dword [eax], esi
mov eax, dword [ebp - 0x30]
cmp edx, eax
setle cl
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x1354]
call fcn.1000e937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa10]
call fcn.1000e937
mov dword [ebp - 0x3c], 0xd41
lea ecx, [ebp - 0xc80]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x3c], 0xf5af8b51
mov dword [ebp - 0x60], 0x9dbea522
mov dword [ebp - 0x34], edi
push 3
call fcn.1000e8cf
lea eax, [ebp - 0x1100]
mov dword [ebp - 4], 4
movdqa xmm0, xmmword [0x1000a9e0]
lea ecx, [ebp - 0x1430]
push eax
lea eax, [ebp - 0x1110]
push eax
movdqu xmmword [ebp - 0x1110], xmm0
call fcn.1000e94e
lea ecx, [ebp - 0x187]
mov esi, eax
call fcn.1000e94b
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x12ac]
push dword [esi]
call fcn.1000e911
mov byte [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x5c], 0xb7a14055
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1000f57b
push dword [ebp - 0x28]
lea ecx, [ebp - 0xc80]
call fcn.1000e93c
or dword [eax], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1000f55f
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1000f59d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x790], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1000f584
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1000f5aa
push eax
push eax
call ebx
dec dword [ebp - 0x78c]
mov esi, 0x11accbad
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x34]
neg eax
neg eax
push 2
sbb eax, eax
xor edx, edx
neg eax
sub esi, eax
mov eax, dword [ebp - 0x60]
cmp ecx, eax
lea ecx, [ebp - 0xc80]
pop ebx
setg dl
push ebx
sub esi, edx
call fcn.1000e93c
mov edx, dword [ebp - 0x34]
xor ecx, ecx
add edx, dword [ebp - 0x34]
imul edx, esi
mov dword [eax], esi
mov eax, dword [ebp - 0x30]
cmp edx, eax
setle cl
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x12ac]
call fcn.1000e937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc80]
call fcn.1000e937
push ebx
lea ecx, [ebp - 0x290]
call fcn.1000e8cf
xor eax, eax
mov dword [ebp - 4], 6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000f656
push dword [ebp - 0x10]
lea ecx, [ebp - 0x290]
call fcn.1000e93c
mov dword [eax], 0x1824a8c6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000f638
xor eax, eax
push eax
lea ecx, [ebp - 0x290]
call fcn.1000e93c
and dword [eax], 0
jmp 0x1000f6b7
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1000f689
push 0x455
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1000f6a9
push 0x232d
push 0x117d
push 0x153c
call dword [sym.imp.KERNEL32.dll_HeapCreate]
xor eax, eax
push eax
lea ecx, [ebp - 0x290]
call fcn.1000e93c
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x290]
push eax
call fcn.1000e93c
cmp dword [eax], 0xffffffe2
jl 0x1000f667
xor eax, eax
lea ecx, [ebp - 0x290]
push eax
call fcn.1000e93c
mov esi, eax
lea ecx, [ebp - 0x290]
xor eax, eax
push eax
call fcn.1000e93c
mov ecx, dword [esi]
xor ebx, ebx
push edi
cmp ecx, dword [eax]
lea ecx, [ebp - 0x290]
setle bl
call fcn.1000e93c
or esi, 0xffffffff
lea ecx, [ebp - 0x290]
mov dword [ebp - 4], esi
mov dword [eax], ebx
call fcn.1000e937
mov dword [ebp - 0x20], 0xfe1ca29
xor eax, eax
push 7
pop edi
mov dword [ebp - 0x10], edi
xor ebx, ebx
mov dword [ebp - 0x42c], eax
inc ebx
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000f767
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6c0], 0x9e46ed4d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000f74f
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x1000f7da
cmp dword [ebp - 0x20], 0xfffffff8
jge 0x1000f78b
mov eax, dword [ebp - 0x20]
sub eax, 0x68cb
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x20]
jg 0x1000f78b
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1000f78d
mov eax, ebx
cmp ebx, eax
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setge dl
xor eax, eax
sub edx, dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x1000f7ae
cmp dword [ebp - 0x20], eax
je 0x1000f7ae
mov eax, ebx
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1000f7c0
mov eax, dword [ebp - 0x42c]
xor eax, eax
cmp dword [ebp - 0x42c], eax
je 0x1000f7ce
mov eax, dword [ebp - 0x42c]
mov eax, dword [ebp - 0x42c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
inc eax
imul eax, dword [ebp - 0x420]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x42c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x20], 0xfffffffe
jg 0x1000f806
mov eax, dword [ebp - 0x42c]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0xfffffffc
setle cl
cmp ecx, dword [ebp - 0x18]
je 0x1000f81d
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1000f81f
mov eax, ebx
xor edx, edx
cmp eax, ebx
push 4
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp edx, eax
mov eax, dword [ebp - 0x42c]
setge cl
xor edx, edx
cmp ecx, eax
lea ecx, [ebp - 0x3d8]
setle dl
mov dword [ebp - 0x6c0], edx
mov dword [ebp - 0x30], edx
call fcn.1000e8cf
xor eax, eax
mov dword [ebp - 4], edi
push 3
mov dword [ebp - 0x28], eax
pop ebx
cmp dword [ebp - 0x28], ebx
jge 0x1000f87e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x157c], 8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x1000f866
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1000f894
push dword [ebp - 0x28]
call fcn.1000e93c
mov dword [eax], 0xca4f833f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
lea ecx, [ebp - 0x3d8]
jl 0x1000f883
push ebx
call fcn.1000e93c
push 2
pop edi
mov dword [eax], edi
jmp 0x1000f925
xor eax, eax
mov dword [ebp - 0x18], 0x76942a1e
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1000f8c7
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
xor eax, eax
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], eax
jl 0x1000f8f1
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1000f8ec
push 0x14e3
push eax
push 0x175
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1000f8cf
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], eax
jl 0x1000f917
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1000f912
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x1000f8f9
push ebx
lea ecx, [ebp - 0x3d8]
call fcn.1000e93c
dec dword [eax]
push ebx
lea ecx, [ebp - 0x3d8]
call fcn.1000e93c
cmp dword [eax], 0
jge 0x1000f8ad
push ebx
lea ecx, [ebp - 0x3d8]
call fcn.1000e93c
xor ebx, ebx
lea ecx, [ebp - 0x3d8]
push edi
cmp dword [eax], 0x6b471dfd
setne bl
call fcn.1000e93c
lea ecx, [ebp - 0x3d8]
mov dword [ebp - 4], esi
mov dword [eax], ebx
call fcn.1000e937
mov dword [ebp - 0x3c], 0xd41
lea ecx, [ebp - 0x584]
push edi
call fcn.1000e8cf
xor eax, eax
mov dword [ebp - 4], 8
xor ebx, ebx
mov dword [ebp - 0x10], eax
inc ebx
cmp dword [ebp - 0x10], edi
jge 0x1000f9ae
push dword [ebp - 0x10]
lea ecx, [ebp - 0x584]
call fcn.1000e93c
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000f994
xor eax, eax
push eax
lea ecx, [ebp - 0x584]
call fcn.1000e93c
mov dword [eax], 0xfffffff3
jmp 0x1000fa3a
push edi
lea ecx, [ebp - 0xe8c]
call fcn.1000e8cf
push 9
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1000f9fc
push dword [ebp - 0x10]
lea ecx, [ebp - 0xe8c]
call fcn.1000e93c
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000f9e1
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1000fa16
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1000fa13
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1000fa01
lea ecx, [ebp - 0xe8c]
mov byte [ebp - 4], 8
call fcn.1000e937
xor eax, eax
lea ecx, [ebp - 0x584]
push eax
call fcn.1000e93c
inc dword [eax]
xor eax, eax
lea ecx, [ebp - 0x584]
push eax
call fcn.1000e93c
cmp dword [eax], 4
jne 0x1000f9c2
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1000fa62
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
lea ecx, [ebp - 0x584]
mov dword [ebp - 4], esi
call fcn.1000e937
mov dword [ebp - 0x64], ebx
xor eax, eax
mov dword [ebp - 0x24], 0x7ddc85f7
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffec
je 0x1000fb1d
jmp 0x1000fa8d
xor eax, eax
mov dword [ebp - 0x30], 0x1462ccd2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000fab4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7b0], 0x796d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000fa9c
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1000fac0
mov eax, dword [ebp - 0x24]
mov ecx, ebx
jmp 0x1000fac2
mov ecx, eax
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sub eax, ecx
sub eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
je 0x1000faf9
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1000fafb
mov edx, ebx
jmp 0x1000fafd
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setle cl
add ecx, dword [ebp - 0x7b0]
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffec
jne 0x1000fa8b
mov dword [ebp - 0x3c], 0xf5af8b51
lea ecx, [ebp - 0xcc]
push edi
call fcn.1000e8cf
mov dword [ebp - 4], 0xa
mov eax, 0xffff
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x10], 3
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x1000fb6d
push dword [ebp - 0x28]
lea ecx, [ebp - 0xcc]
call fcn.1000e93c
mov dword [eax], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1000fb53
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x1000fb8d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x744], 0x6488a973
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1000fb75
xor eax, eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x1000fd90
jmp 0x1000fb9d
xor eax, eax
mov dword [ebp - 0x34], 0x225189d9
lea ecx, [ebp - 0xa28]
mov dword [ebp - 0x5c], 0x5b4d633c
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x5c], 0x464f6128
push edi
call fcn.1000e8cf
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x10], eax
jmp 0x1000fbdf
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa28]
call fcn.1000e93c
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000fbcc
push dword [ebp - 0x24]
lea ecx, [ebp - 0xcc]
call fcn.1000e93c
cmp dword [eax], 0
je 0x1000fc13
push dword [ebp - 0x24]
lea ecx, [ebp - 0xcc]
call fcn.1000e93c
push dword [ebp - 0x24]
lea ecx, [ebp - 0xcc]
call fcn.1000e93c
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0xcc]
push dword [ebp - 0x24]
call fcn.1000e93c
push dword [ebp - 0x24]
lea ecx, [ebp - 0xcc]
call fcn.1000e93c
mov edx, dword [ebp - 0x18]
mov esi, eax
mov ecx, dword [ebp - 0x24]
xor eax, eax
cmp ecx, edx
lea ecx, [ebp - 0xcc]
setge al
imul eax, dword [ebp - 0x18]
add eax, dword [esi]
mov dword [ebp - 0x740], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x24]
call fcn.1000e93c
mov edx, dword [ebp - 0x10]
mov esi, eax
mov ecx, dword [ebp - 0x24]
xor eax, eax
cmp edx, ecx
setge al
xor ecx, ecx
cmp dword [esi], eax
setg cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0xcc]
push dword [ebp - 0x24]
call fcn.1000e93c
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0xcc]
push dword [ebp - 0x24]
call fcn.1000e93c
push dword [ebp - 0x24]
lea ecx, [ebp - 0xcc]
call fcn.1000e93c
mov dword [ebp - 0x34], 0x71e9942c
lea ecx, [ebp - 0xcc]
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0x740], eax
push dword [ebp - 0x24]
call fcn.1000e93c
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp dword [eax], ecx
lea ecx, [ebp - 0xcc]
sete dl
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x24]
call fcn.1000e93c
mov ecx, dword [ebp - 0x34]
xor edx, edx
cmp ecx, dword [eax]
setge dl
xor eax, eax
mov dword [ebp - 0x5c], edx
cmp dword [ebp - 0x5c], eax
jne 0x1000fd07
mov edi, eax
cmp dword [ebp - 0x24], eax
je 0x1000fd09
mov edi, ebx
push dword [ebp - 0x24]
lea ecx, [ebp - 0xcc]
call fcn.1000e93c
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp edi, ecx
mov esi, eax
mov ecx, dword [ebp - 0x18]
setle dl
xor ebx, ebx
cmp edx, ecx
setle bl
sub ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
neg ebx
push dword [ebp - 0x24]
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setge cl
xor ebx, ebx
cmp ecx, dword [esi]
lea ecx, [ebp - 0xcc]
setl bl
call fcn.1000e93c
xor ecx, ecx
cmp ebx, dword [eax]
setl cl
xor ebx, ebx
mov dword [ebp - 0x5c], ecx
inc ebx
push ebx
lea ecx, [ebp - 0xa28]
call fcn.1000e93c
mov ecx, dword [ebp - 0x5c]
mov byte [ebp - 4], 0xa
mov dword [eax], ecx
lea ecx, [ebp - 0xa28]
call fcn.1000e937
dec dword [ebp - 0x24]
push 2
pop edi
jns 0x1000fb9b
or esi, 0xffffffff
lea ecx, [ebp - 0xcc]
mov dword [ebp - 4], esi
call fcn.1000e937
mov dword [ebp - 0x44], 0x9dbea522
lea ecx, [ebp - 0x5b4]
push ebx
call fcn.1000e8cf
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000fde3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5b4]
call fcn.1000e93c
mov dword [eax], 0x1713b910
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000fdc5
xor eax, eax
mov dword [ebp - 0x18], eax
push 0xfffffffffffffffa
pop ecx
cmp dword [ebp - 0x18], eax
jg 0x1000fe94
jmp 0x1000fdf6
xor eax, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], eax
jmp 0x1000fe0b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1324], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1000fdfe
push dword [ebp - 0x18]
lea ecx, [ebp - 0x5b4]
call fcn.1000e93c
mov ecx, dword [ebp - 0x1320]
push dword [ebp - 0x18]
imul ecx, dword [eax]
xor eax, eax
cmp ecx, 0x55059b8b
lea ecx, [ebp - 0x5b4]
setge al
mov dword [ebp - 0x30], eax
call fcn.1000e93c
mov ecx, dword [ebp - 0x30]
xor ebx, ebx
push dword [ebp - 0x18]
cmp dword [eax], ecx
lea ecx, [ebp - 0x5b4]
setge bl
call fcn.1000e93c
mov dword [eax], ebx
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x1000fe82
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5b4]
call fcn.1000e93c
cmp dword [eax], 0
jne 0x1000fe80
dec dword [ebp - 0x10]
jns 0x1000fe68
xor eax, eax
inc dword [ebp - 0x18]
push 1
pop ebx
push 0xfffffffffffffffa
pop ecx
cmp dword [ebp - 0x18], eax
jle 0x1000fdf4
lea ecx, [ebp - 0x5b4]
mov dword [ebp - 4], esi
call fcn.1000e937
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0xbc0]
push 4
call fcn.1000e8cf
push 3
pop esi
push esi
lea ecx, [ebp - 0x540]
mov dword [ebp - 4], 0xd
call fcn.1000e8cf
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1000fef3
push dword [ebp - 0x28]
lea ecx, [ebp - 0xbc0]
call fcn.1000e93c
and dword [eax], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1000fed7
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], esi
jge 0x1000ff16
push dword [ebp - 0x28]
lea ecx, [ebp - 0x540]
call fcn.1000e93c
and dword [eax], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1000fefb
xor eax, eax
push eax
lea ecx, [ebp - 0x540]
call fcn.1000e93c
mov dword [eax], esi
jmp 0x1000ff70
xor eax, eax
mov dword [ebp - 0x30], 0x9da4d073
push eax
call fcn.1000e93c
lea ecx, [ebp - 0xbc0]
push dword [eax]
call fcn.1000e93c
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1000ff62
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
xor eax, eax
push eax
lea ecx, [ebp - 0x540]
call fcn.1000e93c
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x540]
push eax
call fcn.1000e93c
lea ecx, [ebp - 0x540]
cmp dword [eax], 0
jge 0x1000ff26
call fcn.1000e937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc0]
call fcn.1000e937
push esi
lea ecx, [ebp - 0xbd8]
call fcn.1000e8cf
lea eax, [ebp - 0x11a0]
mov dword [ebp - 4], 0xf
movdqa xmm0, xmmword [0x1000a9e0]
lea ecx, [ebp - 0x13a8]
push eax
lea eax, [ebp - 0x11b0]
push eax
movdqu xmmword [ebp - 0x11b0], xmm0
call fcn.1000e94e
lea ecx, [ebp - 0x1dd]
mov esi, eax
call fcn.1000e94b
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1384]
push dword [esi]
call fcn.1000e911
xor eax, eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0xe9c]
push 3
call fcn.1000e8cf
mov byte [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], 0x39ecf4a
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0x20], 0xa32a17d0
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x3c], 0xf88
mov dword [ebp - 0x48], 5
mov dword [ebp - 0x34], 0x885c
mov dword [ebp - 0x58], 0xfff6
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10010076
push dword [ebp - 0x28]
lea ecx, [ebp - 0xe9c]
call fcn.1000e93c
mov dword [eax], 0xca2cb51d
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10010057
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10010098
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1448], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1001007f
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xa
jne 0x1001013c
push 9
pop esi
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x1001012f
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jg 0x1001012a
push 3
lea ecx, [ebp - 0x10ac]
call fcn.1000e8cf
xor eax, eax
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100100fc
push dword [ebp - 0x10]
lea ecx, [ebp - 0x10ac]
call fcn.1000e93c
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100100e1
xor eax, eax
dec dword [ebp - 0x5c]
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10010111
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
lea ecx, [ebp - 0x10ac]
mov byte [ebp - 4], 0x11
call fcn.1000e937
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x100100c5
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x100100ba
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xa
je 0x100100a8
mov eax, dword [ebp - 0x60]
xor ecx, ecx
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x58]
inc dword [ebp - 0x48]
mov eax, dword [ebp - 0x34]
push 3
pop esi
cmp eax, esi
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1448]
setle dl
xor ecx, ecx
cmp eax, ebx
setge cl
xor eax, eax
cmp ecx, edx
lea ecx, [ebp - 0xe9c]
setne al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 0x10
call fcn.1000e937
mov dword [ebp - 0x1c], 0xb110c93b
mov dword [ebp - 0x30], 0xfffe
mov dword [ebp - 0x1c], 0xfffffffc
cmp dword [ebp - 0x1c], 0xffffffeb
jle 0x10010358
xor eax, eax
mov dword [ebp - 0x2c], 0xdf98a59c
mov dword [ebp - 0x58], 0xfffffffe
mov dword [ebp - 0x2c], 0xfffffffd
cmp dword [ebp - 0x2c], eax
jl 0x1001034b
push esi
lea ecx, [ebp - 0x7a0]
call fcn.1000e8cf
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x5c], 0x2e77e815
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10010218
push dword [ebp - 0x10]
lea ecx, [ebp - 0x7a0]
call fcn.1000e93c
mov dword [eax], 0x4ebb0cb8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100101fa
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10010328
movdqa xmm0, xmmword [0x1000aa00]
lea eax, [ebp - 0x1120]
push eax
lea eax, [ebp - 0x1130]
push eax
lea ecx, [ebp - 0x1418]
movdqu xmmword [ebp - 0x1130], xmm0
call fcn.1000e94e
lea ecx, [ebp - 0x189]
mov esi, eax
call fcn.1000e94b
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x62c]
push dword [esi]
call fcn.1000e911
push 3
pop esi
push esi
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 0x14
call fcn.1000e93c
and dword [eax], 0
jmp 0x10010302
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10010294
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push esi
lea ecx, [ebp - 0x62c]
call fcn.1000e93c
lea ecx, [ebp - 0x7a0]
push dword [eax]
call fcn.1000e93c
push dword [ebp - 0x18]
lea ecx, [ebp - 0x7a0]
call fcn.1000e93c
mov edx, dword [ebp - 0x2c]
xor ecx, ecx
add edx, dword [eax]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x5c], ecx
cmp dword [ebp - 0x5c], eax
je 0x100102d7
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x7a0]
call fcn.1000e93c
push esi
lea ecx, [ebp - 0x62c]
imul eax, dword [eax], 0x509c
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x58], eax
call fcn.1000e93c
inc dword [eax]
push esi
lea ecx, [ebp - 0x62c]
call fcn.1000e93c
cmp dword [eax], edi
jle 0x10010282
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 0x13
call fcn.1000e937
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x10010220
lea ecx, [ebp - 0x7a0]
mov byte [ebp - 4], 0x10
call fcn.1000e937
inc dword [ebp - 0x2c]
jns 0x100101d6
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffeb
jg 0x100101b8
mov dword [ebp - 0x5c], 0xb7a14055
xor eax, eax
mov dword [ebp - 0x28], ebx
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x34], 0x25c5395f
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], 0xffffffea
jmp 0x10010532
mov dword [ebp - 0x10], 8
lea ecx, [ebp - 0xd40]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0x43253674
mov dword [ebp - 0x58], 0x12afbcae
push ebx
call fcn.1000e8cf
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x2c], eax
jmp 0x100103dd
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xd40]
call fcn.1000e93c
mov dword [eax], 0xb13309e6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x100103c6
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jg 0x100103f7
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x100103fa
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x10]
jg 0x100104bf
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x60], eax
xor ecx, ecx
mov dword [ebp - 0x5c], 0xffffffff
mov eax, 0xffff
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x5c], 0x89d38951
mov eax, dword [ebp - 0x5c]
cmp eax, ebx
setge cl
xor eax, eax
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0xd40]
push eax
call fcn.1000e93c
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [eax]
je 0x10010456
xor eax, eax
cmp dword [ebp - 0x60], eax
je 0x10010458
mov eax, ebx
xor ecx, ecx
cmp eax, edi
mov eax, dword [ebp - 0x60]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, 0xffff41d0
setne cl
sub eax, ecx
je 0x10010487
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x10010489
mov esi, ebx
jmp 0x1001048b
xor eax, eax
mov esi, eax
inc dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
setle dl
xor ebx, ebx
cmp edx, esi
setge bl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setl dl
dec eax
add ebx, edx
add eax, ebx
xor ebx, ebx
mov dword [ebp - 0x18], eax
inc ebx
jmp 0x10010504
push edi
lea ecx, [ebp - 0xa40]
call fcn.1000e8cf
xor eax, eax
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x10], eax
jmp 0x100104e3
push dword [ebp - 0x10]
call fcn.1000e93c
mov dword [eax], ebx
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xa40]
cmp dword [ebp - 0x10], edi
jl 0x100104d6
push ebx
call fcn.1000e93c
lea ecx, [ebp - 0xa40]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
call fcn.1000e937
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10010520
push eax
push 0x1d6a
push eax
push 0x26bf
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
lea ecx, [ebp - 0xd40]
mov byte [ebp - 4], 0x10
call fcn.1000e937
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1d
jg 0x10010397
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10010557
push dword [ebp - 0x28]
lea ecx, [ebp - 0xbd8]
call fcn.1000e93c
or dword [eax], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10010543
push edi
lea ecx, [ebp - 0x1014]
call fcn.1000e8cf
mov byte [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1001059c
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1014]
call fcn.1000e93c
mov dword [eax], 0xfffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001057e
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x100105ca
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100105c1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x410], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100105a9
xor eax, eax
inc dword [ebp - 0x410]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x100105a1
lea ecx, [ebp - 0x1014]
mov byte [ebp - 4], 0x10
call fcn.1000e937
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x10010600
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x760], 0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x100105e8
xor eax, eax
mov dword [ebp - 0x10], 0xf43b7c7c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10010629
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12c4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10010610
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1001063b
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1001065d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12c4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10010644
xor eax, eax
mov dword [ebp - 0x18], 0xfd3df75d
mov dword [ebp - 0x10], eax
jmp 0x1001067a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xef0], 0xc590f023
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10010669
push 0xfffffffffffffffa
mov dword [ebp - 0x18], 0xffffffec
pop edx
jmp 0x100106b4
mov dword [ebp - 0x30], 0x11c1
xor ecx, ecx
mov dword [ebp - 0x58], ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
cmp eax, ebx
setle cl
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xef0], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jge 0x1001068b
xor eax, eax
lea ecx, [ebp - 0xa58]
mov byte [ebp - 0x3d], al
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x5c], 0xfffffffc
push edi
call fcn.1000e8cf
mov byte [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1001070e
push dword [ebp - 0x10]
lea ecx, [ebp - 0xa58]
call fcn.1000e93c
mov dword [eax], 0x9753589f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100106f0
xor eax, eax
mov edi, ebx
cmp dword [ebp - 0x18], eax
jne 0x10010717
mov edi, eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xa58]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x5c], eax
xor eax, eax
push eax
call fcn.1000e93c
mov edx, dword [ebp - 0x5c]
mov esi, eax
mov ecx, dword [ebp - 0x18]
xor eax, eax
cmp edx, ecx
setl al
xor ecx, ecx
add eax, edi
cmp eax, ebx
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setle bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x18]
setl cl
sub eax, ecx
lea ecx, [ebp - 0xa58]
cmp eax, 0xf3e76e5b
sbb eax, eax
neg eax
mov dword [esi], eax
dec dword [ebp - 0x60]
mov byte [ebp - 4], 0x10
call fcn.1000e937
cmp byte [ebp - 0x3d], 0
je 0x10010964
push 3
lea ecx, [ebp - 0x170]
call fcn.1000e8cf
mov byte [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x34], 0x2a67f8b4
mov dword [ebp - 0x48], 0xf9150fae
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x100107eb
push dword [ebp - 0x28]
lea ecx, [ebp - 0x170]
call fcn.1000e93c
mov dword [eax], 0x83066c93
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x100107cc
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x28], eax
inc ebx
cmp dword [ebp - 0x28], ebx
jge 0x1001080e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x400], 0x826f393
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x100107f6
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10010824
push 0x1fa6
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push ebx
lea ecx, [ebp - 0x170]
call fcn.1000e93c
cmp dword [eax], 0
je 0x100108ce
push ebx
lea ecx, [ebp - 0x170]
call fcn.1000e93c
push ebx
lea ecx, [ebp - 0x170]
call fcn.1000e93c
push ebx
lea ecx, [ebp - 0x170]
imul edi, dword [eax], 0x7001
neg edi
sbb edi, edi
neg edi
call fcn.1000e93c
mov ecx, dword [ebp - 0x34]
mov esi, eax
xor eax, eax
cmp edi, ecx
mov ecx, dword [ebp - 0x48]
setl al
xor edx, edx
cmp eax, ecx
setl dl
xor ecx, ecx
cmp dword [esi], edx
setge cl
xor eax, eax
cmp ecx, dword [ebp - 0x34]
jge 0x10010897
mov esi, ebx
cmp dword [ebp - 0x400], eax
jne 0x10010899
mov esi, eax
push ebx
lea ecx, [ebp - 0x170]
call fcn.1000e93c
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
imul ecx, esi
cmp ecx, dword [eax]
lea ecx, [ebp - 0x170]
setle bl
xor eax, eax
push eax
call fcn.1000e93c
sub ebx, dword [eax]
je 0x100108cb
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x100108d2
xor ebx, ebx
inc ebx
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0x170]
call fcn.1000e93c
xor edx, edx
lea ecx, [esi + 0xffff]
cmp dword [eax], ecx
setle dl
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
add eax, 0x7e0f
je 0x1001090d
push ebx
lea ecx, [ebp - 0x170]
call fcn.1000e93c
cmp dword [eax], 0
je 0x1001090d
mov esi, ebx
jmp 0x10010911
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0x170]
call fcn.1000e93c
mov ecx, dword [ebp - 0x400]
xor ebx, ebx
add ecx, esi
cmp ecx, dword [eax]
lea ecx, [ebp - 0x170]
setge bl
xor eax, eax
inc eax
push eax
call fcn.1000e93c
xor ecx, ecx
cmp ebx, dword [eax]
setne cl
add ecx, 0x1c58
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0x10
call fcn.1000e937
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CopyRect]
push 3
lea ecx, [ebp - 0x230]
call fcn.1000e8cf
xor ebx, ebx
mov byte [ebp - 4], 0x1a
inc ebx
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x18], 0x1d102278
mov dword [ebp - 0x10], eax
jmp 0x1001099a
push dword [ebp - 0x10]
call fcn.1000e93c
mov dword [eax], 0x62d5e48d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
lea ecx, [ebp - 0x230]
jl 0x10010989
push ebx
call fcn.1000e93c
push ebx
lea ecx, [ebp - 0x230]
mov dword [eax], 5
call fcn.1000e93c
mov edi, dword [sym.imp.GDI32.dll_GetObjectW]
cmp dword [eax], 6
je 0x10010af6
mov eax, 0xdcba86ba
mov dword [ebp - 0x7e0], eax
mov dword [ebp - 0x7dc], eax
mov dword [ebp - 0x7d8], eax
mov dword [ebp - 0x7d4], eax
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x100109fd
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push ebx
lea ecx, [ebp - 0x230]
call fcn.1000e93c
mov ecx, dword [ebp - 0x7dc]
cmp ecx, dword [eax]
je 0x10010a43
push ebx
lea ecx, [ebp - 0x230]
call fcn.1000e93c
mov esi, eax
lea ecx, [ebp - 0x230]
xor eax, eax
push eax
call fcn.1000e93c
mov ecx, dword [eax]
xor eax, eax
cmp ecx, dword [esi]
jne 0x10010a3f
cmp dword [ebp - 0x7dc], eax
jne 0x10010a43
mov esi, eax
jmp 0x10010a45
mov esi, ebx
push ebx
lea ecx, [ebp - 0x230]
call fcn.1000e93c
xor edx, edx
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x7dc]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setl dl
xor eax, eax
add edx, 0x5725d367
cmp edx, 0xfffb
setne al
cmp dword [ebp - 0x34], eax
jge 0x10010a93
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10010ace
push eax
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x10010ace
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 9
jl 0x10010ace
push 9
pop ebx
mov dword [ebp - 0x30], 0xffffffff
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10010aba
push eax
push 0x1c8a
push eax
call edi
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x18]
push 0
pop eax
cmp dword [ebp - 0x18], ebx
jge 0x10010aa1
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp - 0x230]
call fcn.1000e93c
push ebx
lea ecx, [ebp - 0x230]
inc dword [eax]
call fcn.1000e93c
cmp dword [eax], 6
mov eax, 0xdcba86ba
jne 0x100109d2
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0x10
call fcn.1000e937
dec dword [ebp - 0x75c]
mov esi, 0x11accbad
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x24]
neg eax
neg eax
push 2
sbb eax, eax
xor edx, edx
neg eax
sub esi, eax
mov eax, dword [ebp - 0x44]
cmp ecx, eax
lea ecx, [ebp - 0xbd8]
pop ebx
setg dl
push ebx
sub esi, edx
call fcn.1000e93c
mov edx, dword [ebp - 0x24]
xor ecx, ecx
add edx, dword [ebp - 0x24]
imul edx, esi
mov dword [eax], esi
mov eax, dword [ebp - 0x64]
cmp edx, eax
setle cl
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x1384]
call fcn.1000e937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbd8]
call fcn.1000e937
push ebx
lea ecx, [ebp - 0x2a8]
call fcn.1000e8cf
xor eax, eax
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10010bb1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2a8]
call fcn.1000e93c
mov dword [eax], 0x1824a8c6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10010b93
xor eax, eax
push eax
lea ecx, [ebp - 0x2a8]
call fcn.1000e93c
and dword [eax], 0
jmp 0x10010c12
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10010be4
push 0x455
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10010c04
push 0x232d
push 0x117d
push 0x153c
call dword [sym.imp.KERNEL32.dll_HeapCreate]
xor eax, eax
push eax
lea ecx, [ebp - 0x2a8]
call fcn.1000e93c
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x2a8]
push eax
call fcn.1000e93c
cmp dword [eax], 0xffffffe2
jl 0x10010bc2
xor eax, eax
lea ecx, [ebp - 0x2a8]
push eax
call fcn.1000e93c
mov esi, eax
lea ecx, [ebp - 0x2a8]
xor eax, eax
push eax
call fcn.1000e93c
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x2a8]
setle bl
xor eax, eax
inc eax
push eax
call fcn.1000e93c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a8]
mov dword [eax], ebx
call fcn.1000e937
push 2
lea ecx, [ebp - 0x284]
call fcn.1000e8cf
xor eax, eax
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10010caa
push dword [ebp - 0x10]
lea ecx, [ebp - 0x284]
call fcn.1000e93c
mov dword [eax], 0x1824a8c6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10010c8b
xor eax, eax
push eax
lea ecx, [ebp - 0x284]
call fcn.1000e93c
and dword [eax], 0
jmp 0x10010d0b
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10010cdd
push 0x455
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10010cfd
push 0x232d
push 0x117d
push 0x153c
call dword [sym.imp.KERNEL32.dll_HeapCreate]
xor eax, eax
push eax
lea ecx, [ebp - 0x284]
call fcn.1000e93c
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x284]
push eax
call fcn.1000e93c
cmp dword [eax], 0xffffffe2
jl 0x10010cbb
xor eax, eax
lea ecx, [ebp - 0x284]
push eax
call fcn.1000e93c
mov esi, eax
lea ecx, [ebp - 0x284]
xor eax, eax
push eax
call fcn.1000e93c
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, dword [eax]
lea ecx, [ebp - 0x284]
setle bl
xor eax, eax
inc eax
push eax
call fcn.1000e93c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x284]
mov dword [eax], ebx
call fcn.1000e937
push 0xfffffffffffffffa
mov dword [ebp - 0x3c], 0x44696a48
lea ecx, [ebp - 0xeac]
pop eax
xor ebx, ebx
mov dword [ebp - 0x30], 0x94543beb
inc ebx
mov dword [ebp - 0x58], 4
mov dword [ebp - 0x3c], eax
push ebx
call fcn.1000e8cf
lea eax, [ebp - 0x1220]
mov dword [ebp - 4], 0x1d
movdqa xmm0, xmmword [0x1000a9f0]
lea ecx, [ebp - 0x13b8]
push eax
lea eax, [ebp - 0x1230]
push eax
movdqu xmmword [ebp - 0x1230], xmm0
call fcn.1000e94e
lea ecx, [ebp - 0x221]
mov esi, eax
call fcn.1000e94b
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x12dc]
push dword [esi]
call fcn.1000e911
mov byte [ebp - 4], 0x1e
xor eax, eax
mov dword [ebp - 0x3c], 0xe1c2e937
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10010e16
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x14f8], 0x67a8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10010dfd
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10010e32
push dword [ebp - 0x28]
lea ecx, [ebp - 0xeac]
call fcn.1000e93c
mov dword [eax], 9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10010e1b
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x12dc]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x58], eax
dec dword [ebp - 0x34]
call fcn.1000e937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeac]
call fcn.1000e937
push 0xfffffffffffffffa
mov dword [ebp - 0x3c], 0x44696a48
lea ecx, [ebp - 0x106c]
pop eax
mov dword [ebp - 0x30], 0x94543beb
mov dword [ebp - 0x58], 4
mov dword [ebp - 0x3c], eax
push ebx
call fcn.1000e8cf
lea eax, [ebp - 0x1140]
mov dword [ebp - 4], 0x1f
movdqa xmm0, xmmword [0x1000a9f0]
lea ecx, [ebp - 0x1488]
push eax
lea eax, [ebp - 0x1150]
push eax
movdqu xmmword [ebp - 0x1150], xmm0
call fcn.1000e94e
lea ecx, [ebp - 0x191]
mov esi, eax
call fcn.1000e94b
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x133c]
push dword [esi]
call fcn.1000e911
mov byte [ebp - 4], 0x20
xor eax, eax
mov dword [ebp - 0x3c], 0xe1c2e937
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10010f0b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1510], 0x67a8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10010ef2
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10010f27
push dword [ebp - 0x28]
lea ecx, [ebp - 0x106c]
call fcn.1000e93c
mov dword [eax], 9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10010f10
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x133c]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x58], eax
dec dword [ebp - 0x34]
call fcn.1000e937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x106c]
call fcn.1000e937
push 2
pop esi
mov dword [ebp - 0x3c], 0x27cb3f4f
lea ecx, [ebp - 0x102c]
push esi
call fcn.1000e8cf
push esi
lea ecx, [ebp - 0xec0]
mov dword [ebp - 4], 0x21
call fcn.1000e8cf
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0xa70]
mov dword [ebp - 0x3c], 0xeb2391cb
mov dword [ebp - 0x18], 0x23dd972c
push 3
call fcn.1000e8cf
xor eax, eax
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10010fc6
push dword [ebp - 0x24]
lea ecx, [ebp - 0x102c]
call fcn.1000e93c
mov dword [eax], 0xfffffffe
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10010fa8
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10010fec
push dword [ebp - 0x24]
lea ecx, [ebp - 0xec0]
call fcn.1000e93c
mov dword [eax], 0xe7d214c4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10010fce
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10011014
push dword [ebp - 0x24]
lea ecx, [ebp - 0xa70]
call fcn.1000e93c
mov dword [eax], 0xfa5d8720
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10010ff5
xor eax, eax
dec dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
jmp 0x10011064
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], 0xd8d955a6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10011050
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10b0], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10011038
xor eax, eax
push eax
lea ecx, [ebp - 0xa70]
call fcn.1000e93c
push 0
dec dword [eax]
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], 0x1b
jg 0x1001101c
lea ecx, [ebp - 0xa70]
call fcn.1000e937
lea ecx, [ebp - 0xec0]
call fcn.1000e937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x102c]
call fcn.1000e937
push 0xfffffffffffffffa
mov dword [ebp - 0x3c], 0x44696a48
lea ecx, [ebp - 0xed4]
pop eax
mov dword [ebp - 0x30], 0x94543beb
mov dword [ebp - 0x58], 4
mov dword [ebp - 0x3c], eax
push ebx
call fcn.1000e8cf
lea eax, [ebp - 0x11c0]
mov dword [ebp - 4], 0x24
movdqa xmm0, xmmword [0x1000a9f0]
lea ecx, [ebp - 0x1470]
push eax
lea eax, [ebp - 0x11d0]
push eax
movdqu xmmword [ebp - 0x11d0], xmm0
call fcn.1000e94e
lea ecx, [ebp - 0x1ed]
mov esi, eax
call fcn.1000e94b
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x12f4]
push dword [esi]
call fcn.1000e911
mov byte [ebp - 4], 0x25
xor eax, eax
mov dword [ebp - 0x3c], 0xe1c2e937
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1001113d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1528], 0x67a8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10011124
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x10011159
push dword [ebp - 0x28]
lea ecx, [ebp - 0xed4]
call fcn.1000e93c
mov dword [eax], 9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x10011142
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x12f4]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x58], eax
dec dword [ebp - 0x34]
call fcn.1000e937
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xed4]
call fcn.1000e937
mov dword [ebp - 0x30], ebx
xor eax, eax
mov dword [ebp - 0x44], 4
mov dword [ebp - 0x48], 8
push 2
mov dword [ebp - 0x34], 0x6b59229a
mov dword [ebp - 0x10], eax
pop esi
jmp 0x100111b7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf04], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100111a6
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x34]
cmp eax, 0xec541651
jb 0x100111d0
mov edx, ebx
jmp 0x100111d4
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
sub eax, esi
cmp eax, 0xfffffff9
setg cl
xor eax, eax
mov dword [ebp - 0xf00], ecx
imul ecx, edx
sub ecx, 0x1bb05c1
cmp ecx, 6
setl al
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10011219
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1001123b