Function at 0x10011f84
Capabilities:
Resume thread

Disassembly:
mov eax, 0x1005fd71
call fcn.1005f130
sub esp, 0xb4
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x100123f0
push 0x7c
pop eax
push 2
pop esi
xor ebx, ebx
mov dword [ebp - 0x2c], 0x97030000
mov ecx, ebx
mov word [ebp - 0x28], 0xe7dc
push 4
mov word [ebp - 0x30], ax
mov dword [ebp - 0x40], ecx
pop edi
cmp esi, 2
jne 0x10011fd3
mov ecx, edi
mov esi, edi
mov dword [ebp - 0x40], ecx
jmp 0x10012007
movzx edx, byte [ebp + esi - 0x2b]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x2e]
movzx eax, word [ebp + eax*2 - 0x30]
mov ecx, eax
and eax, edx
or ecx, edx
lea edx, [ebp - 0x40]
sub ecx, eax
movzx eax, byte [ebp + esi - 0x2c]
push ecx
push ecx
mov word [ebp + eax*2 - 0x30], cx
call fcn.100124b0
pop ecx
pop ecx
mov ecx, dword [ebp - 0x40]
add esi, 2
cmp esi, 6
jb 0x10011fc5
xor eax, eax
mov word [ebp - 0x2e], ax
mov dword [ebp - 0x24], 0x6c65
cmp dword [ebp - 0x24], 0x6c86
jle 0x10012059
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, ebx
mov edi, ebx
mov eax, esi
mov ecx, 0x1007bf18
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.1000448f
inc edi
cmp edi, 0x1ee2
jl 0x10012030
inc esi
cmp esi, 0x2cb
jl 0x1001202e
push 4
pop edi
mov dword [ebp - 0x14], 0x2e91a049
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x3c], 1
mov byte [ebp - 0x1e], bl
mov dword [ebp - 0x18], 0x23f1
cmp dword [ebp - 0x18], 0x2645
jle 0x100120d8
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0xc0]
push edx
push eax
call fcn.10001a75
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100120a0
mov eax, dword [eax]
push eax
call fcn.10048743
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xc0]
call fcn.10004a80
inc edi
cmp edi, 0x70dd
jl 0x10012085
inc esi
cmp esi, 0x368d
jl 0x10012083
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
push 4
pop edi
push 1
push 0x5af5
push 0x5398
lea ecx, [ebp - 0x1e]
call fcn.10011f33
add esp, 0xc
cmp dword [ebp - 0x18], 0x214f
jge 0x10012103
push str.gwn_dtt_tyhbxf_guu_utq_bqpmvj_jctusct_txsu_ilktotp
call fcn.10048743
pop ecx
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0x14
je 0x1001217b
push 3
pop esi
mov dword [ebp - 0x18], 0xc88eb987
mov dword [ebp - 0x48], 0x9f23e525
mov dword [ebp - 0x3c], 0xfffffffd
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
cmp esi, eax
mov eax, dword [ebp - 0x18]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setg dl
xor ebx, ebx
cmp edx, eax
setg bl
xor ecx, ecx
sub ebx, dword [ebp - 0x18]
add ebx, dword [ebp - 0x3c]
add ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp ebx, eax
setle cl
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x14
jne 0x1001210f
xor ebx, ebx
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x6a69
jge 0x1001219a
mov edx, str.ocrv_rfgytsa_kmbrelyqq_ppsm_xgokflpe_yqsouz_nytvvwc_kkwtgq_mzymnlhqi_xwvd_sfg_pnqd_atgszgd_gnjydtpm
mov ecx, 0x1007bf18
call fcn.10006900
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 0x70], 7
mov word [ebp - 0x84], ax
lea ecx, [ebp - 0x84]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x74], ebx
push eax
call fcn.1001029a
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], edi
call fcn.10011cc5
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 6
call fcn.10004bf2
push 2
lea ecx, [ebp - 0x60]
call fcn.10004730
mov byte [ebp - 4], 7
mov dword [ebp - 0x18], 0x14cd4959
mov dword [ebp - 0x14], ebx
jmp 0x10012237
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x60]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001222a
push 3
mov dword [ebp - 0x14], ebx
pop ecx
jmp 0x10012256
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa8], 0x9e6a4137
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10012245
lea eax, [ebp - 0x60]
mov ecx, 0xf8a
push 0x5ded
push eax
call fcn.100135fe
pop ecx
pop ecx
mov dword [ebp - 0x18], edi
jmp 0x100122fe
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], ebx
jl 0x100122f8
mov dword [ebp - 0x24], 0xffffffff
xor edx, edx
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x24]
mov dword [esi + edi*4], eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [esi + edi*4]
setg dl
neg eax
cmp eax, 0xfffffff9
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setle cl
sub ecx, 0x46b4
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], ebx
jmp 0x100122ea
sub esp, 0xc
mov byte [ebp - 0x1f], bl
lea edx, [ebp - 0x1f]
call fcn.10012940
add esp, 0xc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 6
jg 0x100122d6
dec dword [ebp - 0x1c]
jns 0x1001228a
push 4
pop edi
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff4
jle 0x10012278
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 6
call fcn.1000478d
push 9
pop eax
push 2
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], 0x2903dc00
mov dword [ebp - 0x34], 0x7012a02
mov word [ebp - 0x54], ax
pop esi
movzx eax, byte [ebp + esi - 0x3a]
movzx ecx, byte [ebp + esi - 0x37]
movzx eax, word [ebp + eax*2 - 0x54]
mov edx, eax
and eax, ecx
or edx, ecx
sub edx, eax
movzx eax, byte [ebp + esi - 0x38]
add esi, 2
mov word [ebp + eax*2 - 0x54], dx
cmp esi, 8
jb 0x1001232f
xor eax, eax
mov dword [ebp - 0x88], 7
mov word [ebp - 0x4c], ax
lea ecx, [ebp - 0x9c]
mov word [ebp - 0x9c], ax
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x8c], ebx
call fcn.1001029a
xor eax, eax
mov byte [ebp - 4], 8
lea edi, [ebp - 0x54]
mov dword [ebp - 0x44], ebx
stosd dword es:[edi], eax
push 0x18
pop ecx
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x6c]
cdq
idiv ecx
mov esi, eax
test esi, esi
je 0x100123cc
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x9c]
push eax
push 0x2ca6
lea edx, [ebp - 0x44]
call fcn.10012495
mov eax, dword [ebp - 0x44]
add esp, 0xc
inc eax
mov dword [ebp - 0x44], eax
cmp eax, esi
jb 0x100123a6
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x6c]
push eax
call fcn.100156ce
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.10004bf2
lea ecx, [ebp - 0x6c]
call fcn.10015ed7
jmp 0x10012409
mov byte [ebp - 0x1d], 0
cmp byte [ebp - 0x1d], 0
je 0x10012409
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret