Function at 0x100192e8
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1008b30f
call fcn.1008aa68
sub esp, 0x20c
push ebx
push esi
mov dword [ebp - 0x6c], edx
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x2c], 0x2b29949d
push edi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x10], ebx
jmp 0x1001931e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x19c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10019311
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x19c], ebx
je 0x10019370
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x10019343
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffea
jg 0x1001933a
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], ebx
jl 0x10019381
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x19c], ebx
jne 0x10019381
cmp dword [ebp - 0x194], ebx
jne 0x10019381
dec dword [ebp - 0x1c]
jns 0x10019355
jmp 0x10019381
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x10019381
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
mov eax, 0x4e6d4f28
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
xor eax, eax
inc eax
push eax
call fcn.1001737a
xor edx, edx
mov dword [ebp - 0x10], 0x71c7bf0b
mov dword [ebp - 0x1c], ebx
inc edx
jmp 0x100193c3
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x144]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100193b0
mov dword [ebp - 0x1c], ebx
jmp 0x100193da
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x218], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100193cd
mov eax, dword [ebp - 0x144]
mov dword [eax], 8
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 0x14
jle 0x10019467
mov esi, 0xffff
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x2c], 0x112def90
dec dword [ebp - 0x14]
mov dword [ebp - 0x14], 0x13
jmp 0x10019455
mov dword [ebp - 0x2c], 0xa13b2885
cmp dword [ebp - 0x14], ebx
jne 0x10019426
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x144]
xor edx, edx
cmp dword [eax], 9
mov eax, dword [ebp - 0x14]
setne dl
sub edx, 0x4204
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
cmp esi, ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x25
jne 0x10019414
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x14
jg 0x100193fa
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x144]
call fcn.10017bab
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], ebx
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x20], 0xc1ec2db2
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0xe4], ebx
je 0x100194ca
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x100194f0
push ebx
push ebx
push ebx
push ebx
push 0xcc2
push 1
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x100194f0
mov dword [ebp - 0x20], ebx
jmp 0x100194ea
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xf0], ebx
jne 0x100194f0
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xf0], ebx
jne 0x100194f0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x100194cf
mov dword [ebp - 0x20], 5
mov eax, 0x286e871d
mov dword [ebp - 0x2c], 0xe2095e04
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x20], ebx
jmp 0x1001954b
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x10], ebx
jmp 0x10019542
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x1b8], ebx
jne 0x10019548
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x10019533
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 8
jg 0x10019527
mov dword [ebp - 0x2c], 0xddbc75b1
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x1c], 0xbac04ee7
mov dword [ebp - 0x20], 0x8551b32e
push 2
call fcn.1001737a
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1001958e
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1a8]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001957b
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100195ad
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
imul eax, edx, 0xadb8
test eax, eax
je 0x100195d1
cmp dword [ebp - 0x1c], ebx
je 0x100195d1
xor ecx, ecx
inc ecx
jmp 0x100195d3
mov ecx, ebx
push 0xfffffffffffffffc
pop eax
sub eax, ecx
xor edx, edx
sub eax, dword [ebp - 0x1c]
cmp eax, 0x1eb2391c
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x1c]
jle 0x100195fe
cmp dword [ebp - 0x1c], ebx
je 0x100195fe
xor eax, eax
inc eax
jmp 0x10019600
mov eax, ebx
push 0xfffffffffffffffc
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
neg ecx
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x1c]
add edx, 2
imul edx, dword [ebp - 0x1c]
test edx, edx
je 0x100196a8
push 2
lea ecx, [ebp - 0x190]
call fcn.1001737a
mov dword [ebp - 0x30], 0xd8720725
mov dword [ebp - 0x10], ebx
jmp 0x1001966c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x190]
mov dword [eax + ecx*4], 0x55a61940
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10019659
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001968e
push 0xcfd
push 0x4bc
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [ebp - 0x190]
lea ecx, [ebp - 0x190]
mov eax, dword [eax + 4]
inc eax
mov dword [ebp - 0x30], eax
call fcn.10017bab
jmp 0x100196f7
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xbdae8940
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x20], ebx
jmp 0x100196d2
mov dword [ebp - 0x30], 0xfffffff6
inc dword [ebp - 0x30]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe7
jge 0x100196c5
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], ebx
jl 0x100196f7
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1a8]
cmp dword [eax + ecx*4], ebx
jne 0x100196f7
dec dword [ebp - 0x10]
jns 0x100196e4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a8]
call fcn.10017bab
mov dword [ebp - 0x30], 0x3f0bde8a
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x10], 7
push 3
call fcn.1001737a
xor ecx, ecx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x14], ebx
inc ecx
jmp 0x10019741
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x40], 0xf393
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10019733
mov dword [ebp - 0x14], ebx
jmp 0x1001975e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], 0x9f5ab171
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001974b
cmp dword [ebp - 0x1c], ebx
je 0x1001977e
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0x467b47e0
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
add edx, 0xf9936c13
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, eax
mov eax, dword [ebp - 0x40]
cmp edx, eax
mov eax, dword [ebp - 0x40]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sete dl
xor ecx, ecx
cmp edx, eax
setg cl
imul ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
jne 0x10019817
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
mov ecx, 0xffff
sub ecx, eax
xor eax, eax
test ecx, ecx
setg al
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x40], ebx
je 0x100197fb
xor ecx, ecx
inc ecx
jmp 0x100197fd
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax + 4]
add eax, ecx
cmp dword [ebp - 0x1c], eax
jl 0x10019817
mov ecx, ebx
jmp 0x1001981a
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x120]
xor edx, edx
cmp ecx, dword [eax + 4]
sete dl
sub edx, dword [eax + 4]
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 7
cmp edx, eax
setg cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x120]
call fcn.10017bab
push dword [ebp - 0x34]
movdqa xmm0, xmmword [0x10007d20]
lea eax, [ebp - 0x1d0]
push eax
lea eax, [ebp - 0x1e0]
mov dword [ebp - 0x30], 0xe17c927d
push eax
push ebx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xb0], ebx
movdqu xmmword [ebp - 0x1e0], xmm0
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
call fcn.100189ab
push 3
mov dword [ebp - 0x14], ebx
pop ecx
jmp 0x100198a5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8c], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10019898
mov dword [ebp - 0x14], ebx
jmp 0x100198c0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1f8], 0x1e13
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100198af
mov eax, dword [ebp - 0xb0]
mov dword [eax], ebx
mov dword [ebp - 0x30], 0x42a1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100198ee
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0xb0]
dec dword [eax]
cmp dword [eax], 0xffffffeb
jg 0x100198cd
mov eax, dword [ebp - 0x88]
xor ecx, ecx
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x88]
cmp eax, 6
setle cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0xb0]
mov eax, dword [ecx]
add eax, 0x6b471dfd
cmp eax, dword [ebp - 0x30]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x1f0]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x84], ecx
lea ecx, [ebp - 0xb0]
call fcn.10017bab
push 1
lea ecx, [ebp - 0x138]
call fcn.1001737a
xor edx, edx
inc edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x20], 0xa1fa147b
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x10], ebx
jmp 0x100199ac
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x138]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001999d
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100199d6
push ebx
push 0x1aae
push 0x1632
push 0x4fd
call edi
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
xor edx, edx
inc edx
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x28]
test eax, eax
jne 0x10019a03
mov eax, dword [ebp - 0x138]
xor ecx, ecx
cmp dword [eax], 0x2f38d927
setge cl
xor eax, eax
cmp ecx, 0xeb59
mov ecx, ebx
setle al
cmp eax, dword [ebp - 0x30]
jg 0x10019a05
mov ecx, edx
mov eax, dword [ebp - 0x138]
xor edx, edx
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
lea eax, [ecx + 1]
cmp eax, 0xffff
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, dword [ebp - 0x30]
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x138]
call fcn.10017bab
cmp dword [ebp - 0x60], ebx
jne 0x10019a49
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
xor edx, edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
sub ecx, eax
mov eax, dword [ebp - 0x60]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setle dl
mov dword [ebp - 0x30], edx
xor edx, edx
cmp eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x60]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x60]
cmp eax, 0x705e8c87
mov eax, dword [ebp - 0x60]
setle cl
add eax, ecx
jne 0x10019aa1
cmp dword [ebp - 0x2c], ebx
je 0x10019aab
cmp dword [ebp - 0x2c], ebx
je 0x10019aab
xor ecx, ecx
inc ecx
jmp 0x10019aad
mov ecx, ebx
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x28], 0xa012
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
lea eax, [ecx - 1]
xor ecx, ecx
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x10]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
imul ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x10]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
cmp dword [esi + 0x10], ebx
jne 0x10019afd
xor al, al
jmp 0x1001ab09
xor ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], 0x9e7
mov dword [ebp - 0x28], 0x228d5fea
mov dword [ebp - 0x2c], 0xe80c6548
mov dword [ebp - 0x10], ebx
jmp 0x10019b2e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x204], 0x237f4a7d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10019b1d
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10019b47
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x20], eax
jge 0x10019b5c
mov eax, ebx
cmp dword [ebp - 0x20], ebx
je 0x10019b5e
mov eax, ecx
cmp dword [ebp - 0x20], eax
jge 0x10019b6a
cmp dword [ebp - 0x14], ebx
jne 0x10019b6a
mov ecx, ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
imul eax, ecx, 0x50d8
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x14], ebx
jne 0x10019ba8
cmp dword [ebp - 0x28], ebx
jne 0x10019ba8
mov ecx, ebx
jmp 0x10019bab
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x14]
sub ecx, eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x1fc], ecx
push eax
push ebx
push 0x1eef
push 0x5a55
call fcn.1001bf76
add esp, 0x10
lea ecx, [ebp - 0xa4]
push 2
call fcn.1001737a
xor edx, edx
inc edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], 0x35d56974
mov dword [ebp - 0x10], ebx
jmp 0x10019bff
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xa4]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10019bec
mov eax, dword [ebp - 0xa4]
mov dword [eax], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], 0xb2b058ef
mov dword [ebp - 0x10], ebx
jmp 0x10019c29
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1c0], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10019c1c
mov dword [ebp - 0x20], 0xffffffe4
cmp dword [ebp - 0x20], 0xffffffe2
je 0x10019ce9
push 2
lea ecx, [ebp - 0x114]
call fcn.1001737a
mov dword [ebp - 0x30], 0x5b38
mov dword [ebp - 0x10], ebx
jmp 0x10019c68
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x114]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10019c59
mov eax, dword [ebp - 0xa4]
xor ecx, ecx
mov edx, dword [eax]
mov eax, dword [ebp - 0x1c0]
sub edx, 0xedf6
cmp edx, eax
setl cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x114]
mov esi, dword [eax]
cmp dword [ebp - 0x2c], esi
mov ecx, dword [ebp - 0x114]
jge 0x10019caf
cmp dword [ecx + 4], ebx
je 0x10019caf
xor eax, eax
inc eax
jmp 0x10019cb1
mov eax, ebx
xor edx, edx
cmp dword [ecx + 4], 0x2a3b3f36
setle dl
xor ecx, ecx
cmp esi, eax
setne cl
xor eax, eax
cmp edx, ecx
lea ecx, [ebp - 0x114]
setg al
mov dword [ebp - 0x2c], eax
call fcn.10017bab
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe2
jne 0x10019c40
xor edx, edx
inc edx
mov eax, dword [ebp - 0xa4]
inc dword [eax]
cmp dword [eax], 7
jle 0x10019c0d
mov dword [ebp - 0x14], ebx
jmp 0x10019d20
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa4]
cmp dword [eax + ecx*4], ebx
jne 0x10019d25
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa4]
mov dword [eax + ecx*4], 0x7f4a7d2a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x10019cff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa4]
call fcn.10017bab
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x34], 0x47a6deec
mov dword [ebp - 0x34], 0xd72276b8
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x9a57b5bf
mov dword [ebp - 0x34], 0xce4a6f44
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x2c], 0xa7b445ac
mov dword [ebp - 0x14], 0x18
jmp 0x10019d9b
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10019d89
push 1
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10019d98
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffef
jne 0x10019d74
xor esi, esi
mov dword [ebp - 0x14], ebx
inc esi
cmp dword [ebp - 0x14], 8
jg 0x10019dfe
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0x47c4d145
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x34], 0xa53061ec
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x34], 0xe75cb554
dec dword [ebp - 0x2c]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10019df9
push ebx
push 0x1f0d
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
inc dword [ebp - 0x14]
jmp 0x10019da7
mov dword [ebp - 0x28], 0xfe0a8eac
mov dword [ebp - 0x28], 0xffffffed
cmp dword [ebp - 0x28], 0xffffffe7
push 0xfffffffffffffffb
pop edi
je 0x1001a3d3
jmp 0x10019e1e
xor esi, esi
inc esi
mov eax, 0x4e6d4f28
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x2c], 0xe2095e04
mov dword [ebp - 0x2c], 0xddbc75b1
mov dword [ebp - 0x30], 0x3f0bde8a
mov dword [ebp - 0x30], 0xe17c927d
cmp dword [ebp - 0x50], ebx
jne 0x10019e69
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
xor edx, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
sub ecx, eax
mov eax, dword [ebp - 0x50]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setle dl
mov dword [ebp - 0x30], edx
xor edx, edx
cmp eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x50]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x50]
cmp eax, 0x705e8c87
mov eax, dword [ebp - 0x50]
setle cl
add eax, ecx
jne 0x10019ec1
cmp dword [ebp - 0x2c], ebx
je 0x10019ec8
mov ecx, esi
cmp dword [ebp - 0x2c], ebx
jne 0x10019eca
mov ecx, ebx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x20], 0xa012
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
lea eax, [ecx - 1]
xor ecx, ecx
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x10]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
push esi
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
imul ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x10]
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x184]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xd4e7937
mov dword [ebp - 0x20], 0xbc588e1b
call fcn.1001737a
mov dword [ebp - 4], 2
xor edx, edx
mov dword [ebp - 0x2c], 0xa4ec
inc edx
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x10], ebx
jmp 0x10019f58
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x184]
mov dword [eax + ecx*4], 3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10019f45
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1001a08c
push 3
lea ecx, [ebp - 0x12c]
call fcn.1001737a
xor edx, edx
mov dword [ebp - 0x10], ebx
inc edx
cmp dword [ebp - 0x10], 3
jge 0x10019f9f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x12c]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
jmp 0x10019f88
mov dword [ebp - 0x14], 0x14
cmp dword [ebp - 0x14], 0x3b
jg 0x1001a029
mov edi, dword [ebp - 0x12c]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], 0xf0ed6937
mov dword [ebp - 0x30], 0x1300d3b5
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10019fda
push 0x2507
call dword [sym.imp.USER32.dll_MessageBeep]
xor edx, edx
inc edx
cmp dword [ebp - 0x14], ebx
jne 0x10019fed
mov eax, dword [ebp - 0x2c]
cmp dword [edi + 4], ebx
jne 0x10019fed
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov esi, dword [edi + 4]
xor eax, eax
cmp dword [edi + 4], edx
push 1
setle al
xor ecx, ecx
cmp esi, dword [edi + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x12c]
setne cl
xor edx, edx
cmp ecx, dword [eax]
setg dl
xor eax, eax
cmp edx, esi
pop edx
setne al
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x3b
jle 0x10019fb2
push 0xfffffffffffffffb
pop edi
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001a07f
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x1730
push 0x1f9f
push 0x1fa1
push 0x1539
push 0xec1
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x791
push 0xcdc
push 0xe83
push 0x174f
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
lea ecx, [ebp - 0x12c]
call fcn.10017bab
jmp 0x1001a0cd
mov dword [ebp - 0x10], ebx
jmp 0x1001a09f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x48], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001a091
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x184]
cmp dword [eax], ebx
jne 0x1001a0c0
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x2c], 0xfffffffe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x184]
call fcn.10017bab
push 3
pop esi
mov byte [ebp - 0x21], bl
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0x1c], 0x94b2ab76
mov dword [ebp - 0x30], 0x6128f3b8
push esi
call fcn.1001737a
mov dword [ebp - 4], esi
lea ecx, [ebp - 0xfc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], 0xa928
push esi
call fcn.1001737a
mov byte [ebp - 4], 4
mov eax, 0xffff
mov dword [ebp - 0x70], 0xd571f7fc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 0x6dea2805
mov dword [ebp - 0x2c], 0x48cb009
mov dword [ebp - 0x14], ebx
jmp 0x1001a14b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xd4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001a13b
mov dword [ebp - 0x14], ebx
jmp 0x1001a168
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xfc]
mov dword [eax + ecx*4], 0x6902
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001a155
dec dword [ebp - 0x1c]
xor esi, esi
inc esi
cmp dword [ebp - 0x1c], 0x2f64
jge 0x1001a1ca
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, esi
dec dword [ebp - 0x30]
mov eax, dword [ebp - 0xd4]
or dword [eax + 8], 0xffffffff
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x1c]
imul edx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x1c]
jne 0x1001a1b9
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, esi
setl cl
cmp ecx, 3
mov ecx, ebx
jae 0x1001a1cc
mov ecx, esi
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
cmp esi, ecx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor eax, eax
inc eax
cmp ecx, eax
jl 0x1001a23e
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0x31
jg 0x1001a236
mov eax, dword [ebp - 0xd4]
cmp dword [eax + 4], ebx
jne 0x1001a236
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x31
jle 0x1001a228
dec dword [ebp - 0x2c]
jmp 0x1001a39f
push eax
lea ecx, [ebp - 0x98]
call fcn.1001737a
mov eax, 0xa7dc4cae
xor edx, edx
mov dword [ebp - 0x154], eax
inc edx
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x10], ebx
jmp 0x1001a285
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x98]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001a272
mov esi, dword [ebp - 0xfc]
cmp dword [esi + 8], ebx
je 0x1001a2e7
mov eax, 0xffff
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x98]
mov dword [ecx], edx
test edx, edx
je 0x1001a2d9
mov eax, dword [ebp - 0xd4]
mov dword [eax + 8], edx
mov eax, dword [ecx]
sub eax, 0x7253
cmp dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x98]
jle 0x1001a2d9
cmp dword [ecx], ebx
je 0x1001a2d9
xor eax, eax
lea edx, [eax + 1]
jmp 0x1001a2db
mov edx, ebx
xor eax, eax
cmp edx, dword [ecx]
setne al
mov dword [ebp - 0x30], eax
jmp 0x1001a303
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001a2fd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp - 0xd4]
xor eax, eax
mov dword [edx + 8], 0x6fe0855b
cmp dword [ecx], 0x8f94bbb
setl al
xor ecx, ecx
cmp eax, 0x6fe0855b
setge cl
imul ecx, dword [esi + 8]
test ecx, ecx
jne 0x1001a33c
mov eax, dword [ebp - 0xfc]
cmp dword [eax + 4], ebx
jne 0x1001a33c
mov eax, ebx
jmp 0x1001a33f
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov eax, dword [ebp - 0x70]
add eax, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x2c]
cmp eax, 0xe12f
setle cl
imul eax, ecx, 0x8e76
cmp dword [ebp - 0x1c], eax
jne 0x1001a36c
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x98]
cmp dword [eax], ecx
lea ecx, [ebp - 0x98]
setne dl
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
call fcn.10017bab
lea ecx, [ebp - 0xfc]
call fcn.10017bab
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd4]
call fcn.10017bab
cmp byte [ebp - 0x21], 0
je 0x1001a3c6
push ebx
call fcn.1001ab58
pop ecx
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe7
jne 0x10019e1b
mov dword [ebp - 0x14], 0x1f665683
mov dword [ebp - 0x1c], 0x64ba8b35
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x34], 0xf7828e97
mov dword [ebp - 0x28], ebx
jmp 0x1001a405
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xbc], 0x16e2c9bf
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1001a3f4
xor esi, esi
inc esi
cmp dword [ebp - 0x14], ebx
jne 0x1001a471
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x1c], eax
mov ecx, esi
mov eax, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x34], edx
xor edx, edx
cmp eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
test ecx, ecx
sets al
xor ecx, ecx
cmp eax, 8
setge cl
sub ecx, 0x6e090b64
jne 0x1001a464
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1001a473
mov ecx, esi
mov eax, dword [ebp - 0xbc]
sub ecx, eax
je 0x1001a51a
mov dword [ebp - 0x28], 0xd55a
mov dword [ebp - 0x1c], ebx
jmp 0x1001a4aa
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1001a4a7
push 0x1a5d
push 0x12a5
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1001a48d
cmp dword [ebp - 0x28], ebx
jne 0x1001a4da
mov eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0xbc]
jge 0x1001a4c9
mov eax, dword [ebp - 0xbc]
mov eax, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xbc]
neg ecx
sbb ecx, ecx
sub eax, 5
neg ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x402a
setg al
mov dword [ebp - 0x34], eax
jmp 0x1001a52a
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1001a52a
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1001a53f
push 0x21e9
push ebx
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1001a54f
push ebx
call fcn.1001c7d1
pop ecx
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0x14], 0x10
jb 0x1001a55c
mov esi, dword [eax]
jmp 0x1001a55e
mov esi, eax
cmp dword [eax + 0x14], 0x10
jb 0x1001a568
mov ecx, dword [eax]
jmp 0x1001a56a
mov ecx, eax
mov eax, dword [eax + 0x10]
add eax, ecx
cmp esi, eax
je 0x1001a66d
mov al, byte [esi]
cmp al, 0x30
jl 0x1001a663
cmp al, 0x39
jg 0x1001a663
xor ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], 0x9e7
mov dword [ebp - 0x30], 0x228d5fea
mov dword [ebp - 0x2c], 0xe80c6548
mov dword [ebp - 0x28], ebx
jmp 0x1001a5ba
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x210], 0x237f4a7d
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1001a5a9
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1001a5d9
push 0x25c5
push ebx
call fcn.1001cd6c
pop ecx
pop ecx
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x20], eax
jge 0x1001a5ee
mov eax, ebx
cmp dword [ebp - 0x20], ebx
je 0x1001a5f0
mov eax, ecx
cmp dword [ebp - 0x20], eax
jge 0x1001a5fc
cmp dword [ebp - 0x10], ebx
jne 0x1001a5fc
mov ecx, ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
imul eax, ecx, 0x50d8
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x10], ebx
jne 0x1001a63a
cmp dword [ebp - 0x30], ebx
jne 0x1001a63a
mov ecx, ebx
jmp 0x1001a63f
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x6c]
movsx eax, byte [esi]
mov dword [ebp - 0x208], ecx
imul ecx, dword [edx], 0xa
add ecx, 0xffffffd0
add eax, ecx
inc esi
mov dword [edx], eax
mov eax, dword [ebp - 0x44]
jmp 0x1001a55e
mov eax, dword [ebp - 0x6c]
mov dword [eax], ebx
jmp 0x10019af6
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
push 3
mov dword [ebp - 0x10], 0xfffffffa
mov dword [ebp - 0x28], ebx
pop esi
jmp 0x1001a696
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1ec], 2
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1001a685
mov dword [ebp - 0x1c], ebx
jmp 0x1001a79b
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x14], 0xfffffff2
jmp 0x1001a78e
mov dword [ebp - 0x10], 0x1c
jmp 0x1001a781
mov dword [ebp - 0x20], 5
jmp 0x1001a774
push 2
lea ecx, [ebp - 0xe0]
call fcn.1001737a
mov dword [ebp - 0x28], ebx
jmp 0x1001a6f0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xe0]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1001a6e0
mov eax, dword [ebp - 0xe0]
mov dword [eax], ebx
mov dword [ebp - 0x34], 0xffffffff
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1001a723
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1ec]
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x34], ebx
inc dword [eax]
cmp dword [eax], 2
jle 0x1001a6fe
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1001a766
push 0x42d
push 0xe24
push 0xcf8
push 0x4c4
push ebx
call dword [sym.imp.USER32.dll_SetRect]
lea ecx, [ebp - 0xe0]
call fcn.10017bab
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xf
jle 0x1001a6ce
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x15
jle 0x1001a6c2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff7
jne 0x1001a6b6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1001a6a3
mov dword [ebp - 0x10], 0x514faf14
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x10], ebx
push 2
call fcn.1001737a
xor eax, eax
mov dword [ebp - 4], 5
inc eax
lea ecx, [ebp - 0x178]
push eax
call fcn.1001737a
mov byte [ebp - 4], 6
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x38], ebx
jmp 0x1001a7f3
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x80], 0x2edc7555
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 4
jl 0x1001a7e5
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x660
push ebx
push 0x4f36
call fcn.1001ccc2
xor edx, edx
mov dword [ebp - 0x38], ebx
add esp, 0x14
inc edx
jmp 0x1001a832
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x178]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edx
jl 0x1001a81f
cmp dword [ebp - 0x74], ebx
jne 0x1001a86c
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
add eax, 0x6eed1e11
mov dword [ebp - 0x3c], eax
je 0x1001a84f
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x74], ebx
je 0x1001a85c
cmp dword [ebp - 0x3c], ebx
jne 0x1001a85f
mov eax, dword [ebp - 0x74]
imul eax, dword [ebp - 0x80], 0x5dce
mov ecx, ebx
test eax, eax
je 0x1001a86e
mov ecx, edx
mov eax, dword [ebp - 0x74]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x74]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x74]
setge cl
add eax, ecx
cmp eax, dword [ebp - 0x80]
jne 0x1001a925
mov dword [ebp - 0x2c], 0x892657cf
lea ecx, [ebp - 0x16c]
push esi
call fcn.1001737a
mov dword [ebp - 0x28], ebx
jmp 0x1001a8bb
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x16c]
mov dword [eax + ecx*4], 0x96d56a42
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1001a8a8
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
sub edi, eax
mov eax, dword [ebp - 0x10]
cmp eax, edi
setle cl
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp eax, 0x211e
mov eax, dword [ebp - 0x16c]
setge cl
imul ecx, ecx, 0x2742
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, dword [eax + 4]
mov ecx, dword [ebp - 0x3c]
setg dl
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
mov ecx, 0xddb7
setle al
sub ecx, eax
mov eax, dword [ebp - 0x160]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x16c]
jmp 0x1001aa9e
push dword [ebp - 0x34]
movdqa xmm0, xmmword [0x10007d00]
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp - 0x1d0]
mov dword [ebp - 0x70], 0xffffffff
push eax
push ebx
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0xc8], ebx
movdqu xmmword [ebp - 0x1d0], xmm0
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xc0], ebx
call fcn.100189ab
mov byte [ebp - 4], 7
mov dword [ebp - 0x10], 0x19
jmp 0x1001aa8e
mov eax, 0xffff
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x108]
xor eax, eax
mov dword [ebp - 0x30], 0xfffffff9
inc eax
push eax
call fcn.1001737a
xor edx, edx
mov byte [ebp - 4], 8
mov dword [ebp - 0x28], ebx
inc edx
jmp 0x1001a9bb
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x108]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1001a9ac
mov dword [ebp - 0x3c], 0xfffffff0
cmp dword [ebp - 0x3c], 0xfffffffe
jne 0x1001aa01
cmp dword [ebp - 0x10], 0xffffffe4
jge 0x1001a97b
lea ecx, [ebp - 0xc8]
call fcn.10017bab
lea ecx, [ebp - 0x178]
call fcn.10017bab
lea ecx, [ebp - 0x160]
call fcn.10017bab
mov dword [ebp - 0x28], 0x8a61928c
mov dword [ebp - 0x28], 0xd
jmp 0x1001aadf
cmp byte [ebp - 0x21], 0
je 0x1001aadc
push ebx
push 0x15bb
push ebx
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1c
mov byte [ebp - 0x21], bl
jge 0x1001aac9
cmp byte [ebp - 0x21], 0
je 0x1001ab06
push ebx
push 0xc2f
push 0x25f1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret