Function at 0x100184a1
Capabilities:
Check os version
Query service status
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
push ebx
push edi
mov edi, ecx
mov dword [ebp - 0x7c], edx
xor ebx, ebx
mov dword [ebp - 0xd0], edi
cmp dword [edi + 0x10], ebx
jne 0x100184c5
xor al, al
jmp 0x10019a53
mov dword [ebp - 8], 0xc03342eb
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
mov dword [ebp - 8], ebx
jmp 0x100184e8
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xb8], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x100184d7
mov dword [ebp - 8], 0xfffffffa
jmp 0x100185db
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x30], 0x95342363
mov dword [ebp - 4], ebx
jmp 0x10018519
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xa4], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10018508
cmp dword [ebp - 8], ebx
jne 0x10018533
mov eax, dword [ebp - 0xc]
mov ecx, ebx
mov eax, dword [ebp - 8]
add eax, 0x222e2708
je 0x10018535
mov ecx, edx
mov dword [ebp - 0xa4], ecx
mov eax, dword [ebp - 0x14]
imul eax, ecx
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xc], ebx
jmp 0x100185cf
mov dword [ebp - 0xa4], 0x9934b0b4
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov edx, 0xa720
mov eax, dword [ebp + eax*4 - 0xa4]
test eax, eax
mov eax, dword [ebp - 0x14]
sete bl
sub edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setle cl
sub ebx, ecx
lea ecx, [ebx - 0x62c4df8e]
xor ebx, ebx
mov dword [ebp - 0xa4], ecx
mov eax, dword [ebp - 0xb8]
add eax, ecx
jne 0x100185a0
cmp dword [ebp - 0xa4], ebx
je 0x100185a3
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x100185c9
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100185c4
push ebx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
dec dword [ebp - 0x14]
jns 0x100185b4
inc dword [ebp - 0xc]
xor edx, edx
inc edx
cmp dword [ebp - 0xc], edx
jle 0x1001854f
inc dword [ebp - 8]
cmp dword [ebp - 8], 7
jg 0x100184f9
mov dword [ebp - 8], 0x5c68ec0a
mov dword [ebp - 0x18], 0xd393e75c
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 0xb243
mov dword [ebp - 0x30], 0x4fa3
mov dword [ebp - 4], 0xc5c6
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0xc], ebx
jmp 0x10018636
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x13c], 0xd72276b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10018625
mov dword [ebp - 0xc], ebx
jmp 0x10018652
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x158], 0xa7b445ac
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x10018641
mov dword [ebp - 8], ebx
jmp 0x1001867d
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10018677
push ebx
push ebx
push 0x1eb0
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
dec dword [ebp - 0x18]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe3
jge 0x1001865d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jne 0x10018691
mov eax, dword [ebp - 0x30]
dec dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x158], eax
mov edx, dword [ebp - 0x130]
imul edx, eax
mov eax, dword [ebp - 0x1c]
push esi
cmp edx, eax
setle cl
cmp ecx, 8
sbb eax, eax
inc eax
dec eax
mov dword [ebp - 0x2c], eax
je 0x100186c9
cmp dword [ebp - 8], ebx
je 0x100186c9
xor esi, esi
inc esi
mov eax, esi
jmp 0x100186ce
xor esi, esi
mov eax, ebx
inc esi
xor ecx, ecx
cmp eax, esi
mov eax, dword [ebp - 0x130]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
add eax, edx
cmp eax, 7
setg cl
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0x18], 0xb8bc588e
mov dword [ebp - 0x28], 0x215e1abe
mov dword [ebp - 4], ebx
jmp 0x1001871d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x19c], 0x713b
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001870c
xor eax, eax
mov dword [ebp - 4], ebx
inc eax
jmp 0x1001873f
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x28], 0xffffffff
inc dword [ebp - 0x18]
inc dword [ebp - 4]
cmp dword [ebp - 4], eax
jle 0x1001872b
mov eax, 0x469ad59e
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 8], 0xffff
mov dword [ebp - 0xc], 6
mov dword [ebp - 0x14], 0x4067bc62
mov dword [ebp - 4], 0x65ad6cad
mov dword [ebp - 4], ebx
jmp 0x10018790
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x74], 3
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x10018782
mov eax, dword [ebp - 0x6c]
mov ecx, 0xbb7a1405
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 8]
sbb ecx, ecx
xor edx, edx
add ecx, 0x87223b17
cmp eax, ecx
setne dl
imul edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
sub eax, edx
neg eax
sbb eax, eax
xor edx, edx
inc eax
add eax, dword [ebp - 0x6c]
cmp eax, 0xfffffff6
mov eax, dword [ebp - 0x70]
setne dl
sub edx, 0xd35
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
neg ecx
je 0x100187ee
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
xor edx, edx
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x74]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x6c]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x6c]
setne bl
xor ecx, ecx
cmp ebx, eax
setge cl
inc ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
dec eax
neg eax
sbb eax, eax
xor ebx, ebx
neg eax
add eax, dword [ebp - 0x6c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0x17
jl 0x100188b1
xor esi, esi
mov dword [ebp - 8], 0xbec7a429
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 0xfbecdb59
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xc], 0xfff8
jbe 0x10018887
cmp dword [ebp - 8], ebx
je 0x10018887
lea eax, [esi + 1]
cmp dword [ebp - 0x14], ebx
jne 0x10018889
mov eax, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x100188a8
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x17
jge 0x10018838
xor edx, edx
inc edx
mov dword [ebp - 8], edx
mov dword [ebp - 8], 0x16580849
mov dword [ebp - 4], ebx
jmp 0x100188d1
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x78], 0xac70c309
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x100188c3
mov dword [ebp - 0x78], edx
mov dword [ebp - 8], 0xfffffffe
cmp dword [ebp - 8], 0xffffffee
jg 0x10018989
mov dword [ebp - 4], 0x96711db6
mov dword [ebp - 0x30], 0x99ea5d84
mov dword [ebp - 0x1c], 0x520f3038
mov dword [ebp - 4], ebx
jmp 0x10018912
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x44], 3
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x10018904
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x78]
cmp eax, ecx
setge dl
cmp dword [ebp - 0x44], edx
jle 0x10018935
cmp dword [ebp - 0x78], ebx
je 0x10018935
xor esi, esi
lea eax, [esi + 1]
jmp 0x10018937
mov eax, ebx
xor edx, edx
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setge dl
cmp edx, 0xfff6
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
cmp ecx, 0xffffffff
jbe 0x10018963
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x1c], eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffee
push 1
pop edx
jle 0x100188ea
mov dword [ebp - 0x30], 0x4361a6b7
mov dword [ebp - 8], 0x5299dada
mov dword [ebp - 4], ebx
jmp 0x100189a9
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xf0], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001899c
mov dword [ebp - 8], ebx
jmp 0x100189de
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], ebx
jmp 0x100189d6
mov dword [ebp - 0x18], 0x77ab3921
dec dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0xf0]
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jle 0x100189bf
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x100189b3
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x100189f4
call dword [sym.imp.USER32.dll_WaitMessage]
xor edx, edx
inc edx
mov dword [ebp - 4], 0xb090aec5
mov dword [ebp - 0x24], 0xe3268dd2
mov dword [ebp - 4], 0x13532fe2
mov dword [ebp - 4], ebx
jmp 0x10018a1f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x16c], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10018a0e
mov dword [ebp - 4], edx
cmp dword [ebp - 4], ebx
jl 0x10018a4a
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10018a42
push ebx
push 0x1fbc
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
dec dword [ebp - 4]
jns 0x10018a2d
xor edx, edx
inc edx
mov dword [ebp - 0x28], 7
mov dword [ebp - 8], 0xfffffff6
mov dword [ebp - 0x18], 0x9323d1bc
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], 0x9822cb3a
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x2c], 0x820b275c
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0xc], ebx
jmp 0x10018a90
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x84], 0x9f9b3198
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x10018a7f
mov dword [ebp - 0xc], ebx
jmp 0x10018aab
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x11c], 0xaad9ddce
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10018a9a
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], ebx
jg 0x10018bd9
jmp 0x10018ac2
xor edx, edx
inc edx
mov dword [ebp - 0x2c], 0xfd94fe5f
mov dword [ebp - 0x2c], 0x8d13034d
mov dword [ebp - 0x18], 0x5cbcef05
mov dword [ebp - 0x2c], 0xda37bb00
mov dword [ebp - 0x2c], 0xaf9eb11d
mov dword [ebp - 0x2c], 0xcec51938
mov dword [ebp - 0x18], 8
push 4
mov dword [ebp - 4], 6
mov dword [ebp - 0xc], ebx
pop ecx
jmp 0x10018b13
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1b8], 0x6e348cc3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x10018b02
mov dword [ebp - 0xc], ebx
jmp 0x10018b2a
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x184], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x10018b1d
inc dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x84]
inc dword [ebp - 4]
mov dword [ebp - 0x18], 0xfffffffa
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
sub eax, dword [ebp - 0x1c]
jne 0x10018b62
cmp dword [ebp - 4], ebx
jne 0x10018b62
mov edx, ebx
mov eax, dword [ebp - 0x118]
xor ecx, ecx
cmp eax, edx
setge cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
imul eax, dword [ebp - 0x18], 9
cmp eax, 8
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x180]
jg 0x10018ba2
cmp dword [ebp - 0x2c], ebx
je 0x10018ba2
xor esi, esi
lea edx, [esi + 1]
jmp 0x10018ba4
mov edx, ebx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x84], ecx
xor eax, eax
cmp ecx, edx
sete al
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x11c], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x10018abf
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x18], 0xae4f78d7
mov dword [ebp - 0x18], 0x5d3e9973
mov dword [ebp - 0x18], 0xf77722ab
mov dword [ebp - 0x1c], 0x6a1c3d07
mov dword [ebp - 0xc], ebx
jmp 0x10018c23
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x194], 0x2fe81720
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10018c12
mov dword [ebp - 0xc], ebx
jmp 0x10018c3f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x164], 0x83acdd71
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x10018c2e
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 8]
cmp ecx, eax
push 0xfffffffffffffffb
setge dl
xor ecx, ecx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
test eax, eax
mov dword [ebp - 0x18c], eax
mov eax, 0xd6dbc1c2
sete cl
cmp eax, ecx
sbb eax, eax
neg eax
cmp eax, 2
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
imul ecx, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp ecx, eax
setl dl
add edx, dword [ebp - 8]
mov dword [ebp - 0x18], edx
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 7
setne al
xor edx, edx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, 0xc7ba3f30
setg dl
sub eax, edx
xor edx, edx
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 8]
inc eax
inc edx
mov dword [ebp - 0x1c], eax
pop ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x18], 0x439fcb6e
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 2
jge 0x10018cfe
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x40], edx
inc dword [ebp - 4]
jmp 0x10018cec
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x3c], 0xfffffff1
cmp dword [ebp - 0x3c], 0xc
jne 0x10018e2d
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x18], 0xa051aaf1
mov dword [ebp - 4], ebx
jmp 0x10018d3c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xc0], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10018d2f
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
add eax, ecx
cmp eax, dword [ebp - 0x3c]
jge 0x10018d88
mov dword [ebp - 8], 0xffffffed
jmp 0x10018d80
mov dword [ebp - 0xbc], 0xffffffff
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe4
jle 0x10018d73
jmp 0x10018dc4
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10018da2
push edx
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10018dc4
push 0x1859
push 0x1e9f
push 0x981
push 0x2307
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc0]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setge dl
inc edx
neg edx
sbb edx, edx
inc edx
sub eax, edx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xbc]
cmp eax, ecx
setg dl
cmp dword [ebp - 8], edx
jne 0x10018e0b
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc0], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xc
push 1
pop edx
je 0x10018d15
push 0xfffffffffffffffb
pop ecx
xor edx, edx
mov dword [ebp - 4], ebx
inc edx
jmp 0x10018e43
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x68], 4
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x10018e35
mov dword [ebp - 4], ebx
mov dword [ebp - 4], ebx
jmp 0x10018e88
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xe0], ecx
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xdc], ebx
jmp 0x10018e7c
mov dword [ebp - 0x18], ebx
dec dword [ebp - 0x18]
dec dword [ebp - 0xdc]
cmp dword [ebp - 0xdc], 0xffffffe9
jle 0x10018e70
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffe8
je 0x10018e50
mov dword [ebp - 0x98], ebx
cmp dword [ebp - 0x98], ebx
jg 0x10019458
mov dword [ebp - 8], 0x477862f
mov dword [ebp - 0x24], 0x2dd78f4f
mov dword [ebp - 0x18], 0x3a4c6382
mov dword [ebp - 4], ebx
jmp 0x10018ec4
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x4c], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x10018eba
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], 0xa
je 0x100190fb
mov dword [ebp - 0xc], edx
or eax, 0xffffffff
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x14], 0x35c0
mov dword [ebp - 0xc4], 0x9552053
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x1c], 0x4d441147
mov dword [ebp - 4], ebx
jmp 0x10018f24
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xd8], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10018f17
mov eax, dword [ebp - 8]
mov ecx, ebx
cmp dword [ebp - 0xc], ebx
je 0x10018f36
mov ecx, edx
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 8]
jge 0x10018f52
mov eax, dword [ebp - 0x14]
xor edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp eax, 0x3aaf
setle cl
mov dword [ebp - 0x110], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
cmp edx, eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x4c]
imul edx, eax
mov eax, dword [ebp - 0x14]
cmp edx, eax
setne cl
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xa9ef8169
setne al
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x1001903f
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10018fd0
push ebx
call dword [sym.imp.GDI32.dll_GetObjectType]
xor edi, edi
inc edi
cmp dword [ebp - 0x4c], ebx
jne 0x10018ff3
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x18], ebx
jne 0x10018fff
mov ecx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x10019001
mov ecx, edi
xor eax, eax
cmp ecx, 0x38d0
setg al
cmp eax, dword [ebp - 0xc4]
jle 0x100190d8
cmp dword [ebp - 0x2c], ebx
jne 0x100190d8
cmp dword [ebp - 0x1c], ebx
jne 0x100190d8
mov dword [ebp - 0x1c], 0x9286df49
cmp dword [ebp - 0x1c], ebx
jne 0x100190f8
jmp 0x100190e8
mov dword [ebp - 4], 0xfffffff9
xor edi, edi
mov dword [ebp - 0x38], 0xfffffff7
inc edi
mov dword [ebp - 0x38], 0xb4499c77
mov edx, edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x110]
inc dword [ebp - 4]
cmp eax, ecx
jle 0x1001906b
mov edx, ebx
mov eax, dword [ebp - 0xd4]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], ebx
jne 0x10019087
mov eax, ebx
cmp dword [ebp - 0x4c], ebx
je 0x10019089
mov eax, edi
mov edx, dword [ebp - 0xc]
sub edx, eax
mov eax, dword [ebp - 0xd4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x4c]
cmp eax, 6
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xfffffff9
mov eax, dword [ebp - 0xd4]
setne cl
xor edx, edx
cmp ecx, 0x6f739807
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x38], ecx
jmp 0x10018fd3
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x100190e8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xa
push 1
pop edx
jne 0x10018ed6
xor edx, edx
inc edx
mov dword [ebp - 8], 0x36951ad3
mov dword [ebp - 4], 0xf47a6dee
mov dword [ebp - 4], 0x5dc1b6ea
mov dword [ebp - 0x1c], 0xec352115
mov dword [ebp - 0x1c], 0xca4f0670
push 9
mov dword [ebp - 0x1c], 0xe44fa3fd
pop edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0xc6e5
cmp dword [ebp - 4], ebx
jne 0x100191a4
mov dword [ebp - 4], 0xfffffffc
xor ecx, ecx
mov eax, dword [ebp - 4]
neg eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp eax, 0xd7c8
setle cl
cmp ecx, dword [ebp - 8]
jg 0x10019165
cmp dword [ebp - 4], ebx
jne 0x10019165
mov edx, ebx
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 8]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
inc edx
imul eax, ecx, 0x8217
xor ecx, ecx
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
cmp eax, edx
setle cl
mov dword [ebp - 0x1c], ecx
mov ecx, ebx
cmp dword [ebp - 0x1c], edi
sbb eax, eax
neg eax
sub eax, dword [ebp - 8]
je 0x100191a6
mov ecx, edx
mov eax, dword [ebp - 8]
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x100191c2
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 8], 0x642c70bb
mov dword [ebp - 0xc], ebx
jmp 0x100191df
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x124], 0xfff9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x100191ce
mov dword [ebp - 0xc], ebx
jmp 0x100191f7
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1a8], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x100191ea
mov eax, dword [ebp - 8]
push 0xfffffffffffffffb
mov dword [ebp - 0x124], eax
mov dword [ebp - 8], ebx
pop ecx
jmp 0x10019275
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], 0x1d
cmp dword [ebp - 0x14], 0xfffffff4
jl 0x10019272
mov dword [ebp - 4], 0xc4185a1f
mov dword [ebp - 4], 0xf
jmp 0x10019250
mov dword [ebp - 0x1c], 0xd6f1860e
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1001924a
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_KillTimer]
dec dword [ebp - 0x1c]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a
jle 0x10019231
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10019266
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff4
jge 0x10019221
push 0xfffffffffffffffb
pop ecx
dec dword [ebp - 8]
cmp dword [ebp - 8], ecx
jge 0x1001920e
push 4
mov dword [ebp - 4], ebx
pop edi
cmp dword [ebp - 4], 2
jge 0x10019295
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xb4], edi
inc dword [ebp - 4]
jmp 0x10019280
mov dword [ebp - 0xb4], ebx
jmp 0x10019431
mov byte [ebp - 0x1d], bl
xor ecx, ecx
mov dword [ebp - 8], 0x81c2900
inc ecx
mov dword [ebp - 4], ebx
jmp 0x100192c3
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xc8], 0x1713b910
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x100192b2
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], ebx
jl 0x1001933a
mov dword [ebp - 4], ebx
jmp 0x100192e2
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xac], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x100192d5
mov dword [ebp - 0xa8], ebx
jmp 0x1001932a
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + eax*4 - 0xc8]
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xc8], ecx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10019324
push 0x1221
push ebx
push 0x4d4
push 0xea3
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
inc dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], ebx
jle 0x100192f0
dec dword [ebp - 8]
jns 0x100192d0
xor ecx, ecx
inc ecx
cmp byte [ebp - 0x1d], bl
je 0x10019428
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
jmp 0x10019368
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x34], 0x648261f
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x1001935a
mov dword [ebp - 0x58], ebx
cmp dword [ebp - 0x58], ebx
jle 0x10019476
xor edi, edi
inc edi
cmp dword [ebp - 8], ebx
jne 0x100193db
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
cmp eax, 2
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x58]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x5c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x74f0e4f2
setg al
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jne 0x100193c5
mov edx, ebx
cmp dword [ebp - 8], ebx
je 0x100193c7
mov edx, edi
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp edx, eax
mov edx, ebx
setl cl
cmp ecx, 0x4ef21ddb
jg 0x100193dd
mov edx, edi
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp edx, eax
push ebx
setge cl
xor eax, eax
cmp ecx, edi
push 0x17fb
setg al
xor ecx, ecx
cmp eax, 0x20c256fa
mov eax, dword [ebp - 0x5c]
setne cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 8]
setne dl
sub ecx, edx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0x7db40437
setne al
mov dword [ebp - 0x58], eax
call fcn.10019a97
pop ecx
pop ecx
inc dword [ebp - 0xb4]
push 4
pop edi
cmp dword [ebp - 0xb4], ebx
jle 0x100192a0
inc dword [ebp - 0x98]
push 1
pop edx
cmp dword [ebp - 0x98], ebx
jle 0x10018ea0
mov edi, dword [ebp - 0xd0]
mov dword [ebp - 8], 0x19
cmp dword [ebp - 8], 0xffffffe8
jne 0x100196b4
mov esi, 0x2149
jmp 0x10019522
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], 0xcccaea0a
mov dword [ebp - 4], ebx
jmp 0x1001948c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x80], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10019482
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x34], ecx
test ecx, ecx
je 0x100194f3
mov eax, dword [ebp - 0x58]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x58]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x34]
sub edx, eax
mov eax, dword [ebp - 8]
add eax, edx
cmp eax, 0xffffffff
setle cl
cmp ecx, dword [ebp - 0x50]
jle 0x100194f3
xor edi, edi
inc edi
mov eax, edi
jmp 0x100194f8
xor edi, edi
mov eax, ebx
inc edi
mov ecx, dword [ebp - 0x80]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x80]
cmp ecx, eax
setne dl
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x1c], edx
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], ebx
jle 0x10019473
jmp 0x1001937c
xor edx, edx
inc edx
mov dword [ebp - 0xc], 0x53e1
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x98], 0xffff
ja 0x10019555
mov ecx, ebx
cmp dword [ebp - 0x68], ebx
je 0x10019557
mov ecx, edx
mov eax, dword [ebp - 0x30]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x18]
jg 0x1001966c
cmp dword [ebp - 8], ebx
je 0x1001966c
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x100], esi
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0xf8], esi
mov dword [ebp - 0x1c], 0x1d584d75
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], ebx
jg 0x100196a1
xor edi, edi
mov eax, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x68]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x9c]
test eax, eax
mov eax, dword [ebp - 0x24]
sete dl
xor ecx, ecx
cmp eax, 0xffff
setne cl
imul edx, ecx
dec edx
neg edx
sbb edx, edx
neg edx
dec edx
cmp edx, dword [ebp - 0x98]
jl 0x100195f6
lea edx, [edi + 1]
cmp dword [ebp - 0x104], ebx
jne 0x100195f8
mov edx, ebx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov dword [ebp + eax*4 - 0x90], edx
mov eax, dword [ebp - 0x18]
cmp edx, eax
sete cl
imul eax, ecx, 0xfffa
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 4], ebx
je 0x10019631
cmp dword [ebp - 0x68], ebx
je 0x10019622
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov ecx, 0xfff9
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
sub ecx, eax
xor eax, eax
cmp ecx, 0x4b34d7ae
setl al
xor ecx, ecx
test eax, eax
setle cl
xor eax, eax
cmp ecx, 0xffffffff
setl al
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jle 0x100195aa
jmp 0x100196a1
xor eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], 6
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x98]
cmp ecx, eax
setne dl
mov dword [ebp - 0x24], edx
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x100196a1
push ebx
call fcn.1001b3e3
pop ecx
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe8
je 0x1001951f
mov edi, dword [ebp - 0xd0]
mov eax, dword [ebp - 0x7c]
push 2
pop esi
mov dword [eax], ebx
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x28], 0x25b3
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 4], ebx
jmp 0x100196e9
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x174], 0x7d8a8701
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x100196d8
lea eax, [ebp - 0xf4]
push ebx
push eax
call fcn.1001b546
mov byte [ebp - 0x1d], bl
pop ecx
pop ecx
cmp byte [ebp - 0x1d], bl
je 0x1001970c
push ebx
call fcn.1001b223
pop ecx
cmp dword [edi + 0x14], 0x10
jb 0x10019716
mov ecx, dword [edi]
jmp 0x10019718
mov ecx, edi
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x64], ecx
jb 0x10019725
mov edx, dword [edi]
jmp 0x10019727
mov edx, edi
mov eax, dword [edi + 0x10]
add eax, edx
cmp ecx, eax
je 0x100198d8
push ebx
lea eax, [ebp - 0xec]
mov dword [ebp - 0x48], 0xffffffff
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0xec], ebx
push eax
call fcn.1001b76d
add esp, 0xc
mov dword [ebp - 0x48], ebx
jmp 0x10019773
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x10019770
push ebx
push 0x56fa
call fcn.1001b09c
pop ecx
pop ecx
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 4
jne 0x1001975a
mov eax, dword [ebp - 0x64]
mov al, byte [eax]
cmp al, 0x30
jl 0x100198cc
cmp al, 0x39
jg 0x100198cc
mov dword [ebp - 8], 0xc03342eb
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
mov dword [ebp - 4], ebx
jmp 0x100197b1
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xcc], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x100197a0
mov dword [ebp - 8], 0xfffffffa
jmp 0x100198a3
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x28], 0x95342363
mov dword [ebp - 4], ebx
jmp 0x100197e2
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x8c], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x100197d1
cmp dword [ebp - 8], ebx
jne 0x100197fb
mov eax, dword [ebp - 0xc]
mov ecx, ebx
mov eax, dword [ebp - 8]
add eax, 0x222e2708
je 0x100197fd
mov ecx, edx
mov dword [ebp - 0x8c], ecx
mov eax, dword [ebp - 0x14]
imul eax, ecx
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc], ebx
jmp 0x10019897
mov dword [ebp - 0x8c], 0x9934b0b4
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov edx, 0xa720
mov eax, dword [ebp + eax*4 - 0x8c]
test eax, eax
mov eax, dword [ebp - 0x14]
sete bl
sub edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setle cl
sub ebx, ecx
lea ecx, [ebx - 0x62c4df8e]
xor ebx, ebx
mov dword [ebp - 0x8c], ecx
mov eax, dword [ebp - 0xcc]
add eax, ecx
jne 0x10019868
cmp dword [ebp - 0x8c], ebx
je 0x1001986b
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x10019891
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1001988c
push ebx
call fcn.1001b5fb
pop ecx
dec dword [ebp - 0x14]
jns 0x1001987c
inc dword [ebp - 0xc]
xor edx, edx
inc edx
cmp dword [ebp - 0xc], edx
jle 0x10019817
inc dword [ebp - 8]
cmp dword [ebp - 8], 7
jg 0x100197c2
lea eax, [ebp - 0x64]
push eax
push ebx
lea eax, [ebp - 0x7c]
push 0x5f0f
push eax
call fcn.1001b1b2
mov ecx, dword [ebp - 0x64]
add esp, 0x10
inc ecx
jmp 0x10019718
mov eax, dword [ebp - 0x7c]
mov dword [eax], ebx
xor al, al
jmp 0x10019a52
mov dword [ebp - 0x18], 0xfffffff6
xor ecx, ecx
mov dword [ebp - 0x24], 0x63e8e1b8
inc ecx
push 0xfffffffffffffffc
mov dword [ebp - 0x14], 0xfffffff8
pop edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ebx
jmp 0x10019909
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x60], 0xb8eb5ea2
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x100198fb
mov dword [ebp - 0xc], ebx
jmp 0x10019920
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x14c], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10019913
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
neg eax
sbb eax, eax
neg eax
cmp eax, 0x91023f12
jae 0x10019942
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x60]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x60]
jne 0x1001995e
cmp dword [ebp - 0x60], ebx
jne 0x10019965
cmp dword [ebp - 0x14], ebx
jne 0x10019965
mov ecx, ebx
neg dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
sub edx, 3
cmp eax, edx
mov eax, dword [ebp - 0x60]
setg cl
cmp ecx, 0x8d581621
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x148]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 8]
sete bl
xor ecx, ecx
cmp ebx, eax
setg cl
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], 0x16
cmp dword [ebp - 0x14], 7
jge 0x10019a4f
xor esi, esi
inc esi
mov dword [ebp - 0x28], 0x1cd5ccfd
mov dword [ebp - 0x28], 0xade89b93
mov dword [ebp - 8], 0
jmp 0x10019a3c
mov dword [ebp - 0x28], 0x7160c637
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 4], 0
jmp 0x10019a05
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x12c], 9
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x100199f4
mov eax, dword [ebp - 0x148]
xor edx, edx
cmp eax, esi
mov eax, dword [ebp - 0x12c]
setl dl
sub edx, 0x197b2c3c
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffed
je 0x100199dd
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 7
jl 0x100199c6
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret