Function at 0x10018f0c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1008239d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2e8
push ebx
push esi
push edi
mov edi, 0x7ca0029b
mov dword [esp + 0x58], ecx
mov dword [esp + 0x10], edi
xor ebx, ebx
mov dword [esp + 0x18], 0xe974a520
mov ecx, 0xa3888451
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov dword [esp + 0xc8], edx
sbb eax, eax
inc eax
mov dword [esp + 0x18], eax
jne 0x10018f74
cmp dword [esp + 0x18], ebx
jne 0x10018f74
mov ecx, ebx
jmp 0x10018f77
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x10]
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x10]
mov ecx, 0xd853
setge dl
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
cmp ecx, 0x1b17
setne dl
sub edx, dword [esp + 0x10]
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
neg edx
sbb edx, edx
inc edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], ebx
jmp 0x1001900b
mov dword [esp + 0x10], ebx
jmp 0x10019000
mov dword [esp + 0x30], 6
mov dword [esp + 0x18], 0xb
jmp 0x10018ff5
mov dword [esp + 0x30], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x18
je 0x10018fe9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10018fd7
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffe8
jle 0x10018fd1
mov dword [esp + 0x14], 0xac204e2d
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 0x1b
jle 0x10019103
mov esi, 0x4952f341
mov dword [esp + 0x18], 0xfffffffd
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x10019057
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x104], 0x8753
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10019044
mov dword [esp + 0x10], ebx
jmp 0x10019077
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xcc], 0x6c65b0b5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x10019064
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x108], esi
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, 0xfffe
setne dl
cmp eax, edx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, esi
setge cl
cmp ecx, dword [esp + 0x18]
jne 0x100190c5
cmp dword [esp + 0x108], ebx
jne 0x100190c5
mov edx, ebx
jmp 0x100190c8
xor edx, edx
inc edx
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x14]
setl cl
sub ecx, eax
jne 0x100190e1
cmp dword [esp + 0x14], ebx
je 0x100190e5
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x30], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x1b
jg 0x1001902e
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov dword [esp + 0x2c], 0x6aabecba
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x30], 0xd77f1724
cmp dword [esp + 0x2c], 0xfffffff8
jl 0x1001920d
mov dword [esp + 0x18], 0x5efa
lea ecx, [esp + 0x164]
push 2
call fcn.10016f4f
mov dword [esp + 0x24], ebx
jmp 0x10019170
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x164]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x1001915a
cmp dword [esp + 0x18], 0xfffb
push 4
sbb eax, eax
xor edx, edx
neg eax
test eax, eax
mov eax, dword [esp + 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
cmp ecx, eax
pop ecx
setge dl
imul edx, dword [esp + 0x2c]
sub edx, 0x3d87e3bc
neg edx
sbb edx, edx
xor eax, eax
inc edx
inc eax
sub eax, edx
cmp eax, ecx
jg 0x100191c8
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + 0x164]
mov dword [eax + 4], edx
mov eax, dword [esp + 0x18]
test eax, eax
setns cl
xor eax, eax
cmp ecx, 1
setge al
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x8c9f
lea ecx, [esp + 0x164]
setge al
mov dword [esp + 0x30], eax
call fcn.100177aa
jmp 0x1001924a
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], bl
je 0x1001922e
push ebx
push 0x1bd4
push 0x1086
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], bl
je 0x1001924a
push 0xb23
push ebx
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_Polygon]
mov dword [esp + 0x18], 0xe974a520
mov ecx, 0xa3888451
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [esp + 0x18], eax
jne 0x10019278
cmp dword [esp + 0x18], ebx
jne 0x10019278
mov edx, ebx
jmp 0x1001927b
xor edx, edx
inc edx
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x10]
mov edx, 0xd853
setge cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x10]
setne cl
mov dword [esp + 0x30], ecx
xor ecx, ecx
cmp dword [esp + 0x30], eax
setge cl
xor edx, edx
cmp ecx, 0x1b17
setne dl
sub edx, dword [esp + 0x10]
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
neg edx
sbb edx, edx
inc edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x2c], ebx
jmp 0x1001954d
mov dword [esp + 0x10], ebx
jmp 0x1001953e
push 2
lea ecx, [esp + 0x210]
call fcn.10016f4f
mov dword [esp + 0x2fc], ebx
lea ecx, [esp + 0x1f4]
mov dword [esp + 0x24], 0x19d29be1
mov dword [esp + 0x28], 0xfffffff9
mov dword [esp + 0x28], 0xaafe30f5
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x28], 0xe7ccc895
mov dword [esp + 0x28], 0xfe662db8
push 2
call fcn.10016f4f
push 2
mov byte [esp + 0x300], 1
mov dword [esp + 0x18], ebx
pop edx
jmp 0x10019361
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20c]
mov dword [eax + ecx*4], 0x6482
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001934b
mov dword [esp + 0x14], ebx
jmp 0x10019383
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1f4]
mov dword [eax + ecx*4], 0x8d963785
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001936d
mov dword [esp + 0x24], 1
cmp dword [esp + 0x24], ebx
jl 0x1001949a
mov dword [esp + 0x20], 0x45db34e6
lea ecx, [esp + 0x1e0]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], 0xb7d8cf4c
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], ebx
push 1
call fcn.10016f4f
push 3
lea ecx, [esp + 0x180]
mov byte [esp + 0x300], 2
call fcn.10016f4f
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x100193fa
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1e0]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x100193e4
mov dword [esp + 0x14], ebx
jmp 0x1001941c
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x17c]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10019406
mov dword [esp + 0x20], ebx
jmp 0x1001944c
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x10019448
push 0x6c0
push 0x46b
push ebx
call dword [sym.imp.USER32.dll_InflateRect]
xor edx, edx
inc edx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jle 0x10019429
mov eax, dword [esp + 0x17c]
inc dword [eax + 8]
mov dword [esp + 0x20], ebx
jmp 0x1001946a
mov dword [esp + 0x30], edx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jle 0x10019462
lea ecx, [esp + 0x17c]
call fcn.100177aa
lea ecx, [esp + 0x1e0]
mov byte [esp + 0x2fc], 1
call fcn.100177aa
dec dword [esp + 0x24]
jns 0x1001939b
mov dword [esp + 0x18], 0xe
jmp 0x100194ae
cmp dword [esp + 0x18], ebx
jne 0x100194b5
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 1
je 0x100194a4
lea ecx, [esp + 0x1f4]
call fcn.100177aa
or dword [esp + 0x2fc], 0xffffffff
lea ecx, [esp + 0x20c]
call fcn.100177aa
mov dword [esp + 0x30], 6
mov dword [esp + 0x18], 0xb
jmp 0x10019533
mov dword [esp + 0x28], 0xa8c6
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x10019509
push ebx
push 0x4fa
call esi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x10019527
push ebx
push 0x663
push ebx
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov dword [esp + 0x30], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x18
je 0x100194e7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x100192e7
dec dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0xffffffe8
jle 0x100192de
mov dword [esp + 0x38], 0xfffffffc
mov dword [esp + 0x24], ebx
jmp 0x10019576
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x48], 1
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x10019566
cmp dword [esp + 0x4c], ebx
jne 0x100195e3
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x38], 0x83cc47d1
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
cmp dword [esp + 0x4c], ebx
je 0x100195b4
cmp dword [esp + 0x38], ebx
je 0x100195b4
xor edx, edx
inc edx
jmp 0x100195b6
mov edx, ebx
mov eax, dword [esp + 0x4c]
xor ecx, ecx
cmp edx, eax
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
setne cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
cmp ecx, 0xfffd
je 0x100195e3
mov edx, ebx
jmp 0x100195e6
xor edx, edx
inc edx
mov eax, dword [esp + 0x4c]
xor ecx, ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, edx
setne cl
cmp ecx, dword [esp + 0x4c]
jle 0x1001961f
mov dword [esp + 0x34], 0x26fb
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x10019619
push 0x1551
push ebx
push ebx
call edi
inc dword [esp + 0x34]
jmp 0x10019634
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x10019634
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x34], 1
mov dword [esp + 0x40], 0xb416c28c
mov dword [esp + 0x34], 0x99b96bc7
push 0xfffffffffffffff8
mov dword [esp + 0x38], 0x9ea4087b
pop eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], 0x7c08a59c
push 4
mov dword [esp + 0x30], 0xf93b76f0
mov dword [esp + 0x18], ebx
pop ecx
jmp 0x1001968c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x64], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10019680
mov dword [esp + 0x14], ebx
jmp 0x100196ab
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xfc], 0xb6c411e6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10019698
inc dword [esp + 0x70]
jne 0x10019763
mov dword [esp + 0x38], ebx
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x6c]
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x68], 1
jge 0x100196dd
cmp dword [esp + 0x64], ebx
jne 0x100196dd
mov ecx, ebx
jmp 0x100196e0
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x68]
add eax, ecx
mov dword [esp + 0x34], eax
cmp dword [esp + 0x34], 0xd890fc52
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x6c]
mov eax, dword [esp + 0x70]
cmp eax, ecx
mov eax, dword [esp + 0x6c]
setge dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [esp + 0x34], ecx
mov ecx, 0x9172c2e8
mov eax, dword [esp + 0x34]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x68]
sub eax, dword [esp + 0x34]
neg eax
sbb eax, eax
inc eax
cmp eax, 0xe0c28056
sbb eax, eax
neg eax
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [esp + 0xfc], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x70]
mov eax, dword [esp + 0x40]
imul eax, dword [esp + 0x68], 0xffff
test eax, eax
jne 0x10019763
mov eax, ebx
jmp 0x10019766
xor eax, eax
inc eax
mov dword [esp + 0x34], eax
cmp dword [esp + 0x34], ebx
jne 0x10019777
mov eax, dword [esp + 0xfc]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
dec edx
neg edx
push 2
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x120]
inc dword [esp + 0x30]
mov dword [esp + 0x3c], 0xfffffffc
mov dword [esp + 0x18], 0x642c70bb
call fcn.10016f4f
push 3
mov dword [esp + 0x18], ebx
pop edx
jmp 0x100197d7
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x80], 0xfffffff6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x100197c4
mov dword [esp + 0x14], ebx
jmp 0x100197f9
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], 0xb14151c8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x100197e3
mov dword [esp + 0x14], ebx
jmp 0x10019819
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x80], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10019806
mov dword [esp + 0x14], 2
cmp dword [esp + 0x14], ebx
jl 0x100198fd
mov dword [esp + 0x18], 0xffffffff
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x1001984c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [esp + 0x18], 2
cmp dword [esp + 0x18], ebx
jl 0x100198f3
mov esi, dword [esp + 0x11c]
mov dword [esp + 0x30], 0xfffffff9
mov eax, dword [esp + 0x18]
cmp dword [esp + eax*4 + 0x80], ebx
je 0x100198d7
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x80]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x88]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp dword [esp + eax*4 + 0x80], ebx
je 0x100198a5
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x84]
xor edx, edx
mov ecx, dword [esp + 0x18]
cmp eax, 1
mov eax, dword [esp + 0x88]
setle dl
imul ecx, edx
xor edx, edx
cmp eax, ecx
setl dl
cmp dword [esp + 0x88], edx
jle 0x100198d7
xor eax, eax
inc eax
jmp 0x100198d9
mov eax, ebx
xor ecx, ecx
add eax, 6
cmp eax, 0xd0f0
setne cl
mov dword [esi + 4], ecx
dec dword [esp + 0x18]
jns 0x10019865
dec dword [esp + 0x14]
jns 0x10019831
lea ecx, [esp + 0x11c]
call fcn.100177aa
mov dword [esp + 0x24], ebx
jmp 0x1001991f
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x50], 1
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x1001990f
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x224]
mov dword [esp + 0x28], 0x7730f94f
mov dword [esp + 0x28], 0x9532bb11
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], 0xc23afc37
mov dword [esp + 0x28], 0xe3580d41
mov dword [esp + 0x28], 0xfffffff6
push 2
call fcn.10016f4f
mov dword [esp + 0x34], 0xfffffff9
mov dword [esp + 0x24], ebx
jmp 0x10019990
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x224]
mov dword [eax + ecx*4], 0x8b5131d8
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x1001997a
dec dword [esp + 0x34]
lea ecx, [esp + 0x224]
call fcn.100177aa
cmp dword [esp + 0x54], ebx
jne 0x10019a0d
mov eax, dword [esp + 0x54]
mov dword [esp + 0x38], 0x83cc47d1
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
cmp dword [esp + 0x54], ebx
je 0x100199de
cmp dword [esp + 0x38], ebx
je 0x100199de
xor edx, edx
inc edx
jmp 0x100199e0
mov edx, ebx
mov eax, dword [esp + 0x54]
xor ecx, ecx
cmp edx, eax
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
setne cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
cmp ecx, 0xfffd
je 0x10019a0d
mov edx, ebx
jmp 0x10019a10
xor edx, edx
inc edx
mov eax, dword [esp + 0x54]
xor ecx, ecx
cmp eax, edx
setne cl
cmp ecx, dword [esp + 0x54]
jle 0x10019f06
mov dword [esp + 0x24], 0x8ade19d2
mov dword [esp + 0x24], ebx
jmp 0x10019a46
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x2c8], 0xfffffffe
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jl 0x10019a33
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x10019a61
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [esp + 0x24], ebx
jmp 0x10019a77
mov dword [esp + 0x34], 0x34e6
dec dword [esp + 0x34]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jle 0x10019a67
mov dword [esp + 0x30], 0x26fb
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x10019a9a
push 0x1551
push ebx
push ebx
call edi
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 0x74]
mov dword [esp + 0x20], 0x1d11
mov dword [esp + 0x14], 0x89a278c0
mov dword [esp + 0x18], 0x9f42c60e
push 2
call fcn.10016f4f
mov dword [esp + 0x2fc], 3
mov dword [esp + 0x3c], 0xbc8b421d
mov dword [esp + 0x34], 0x5297f1ff
mov dword [esp + 0x24], ebx
jmp 0x10019af9
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x74]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x10019ae6
mov ecx, dword [esp + 0x2c]
xor edx, edx
mov eax, dword [esp + 0x2c]
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
imul ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x10019b2d
cmp dword [esp + 0x20], ebx
jne 0x10019b2d
mov eax, ebx
jmp 0x10019b30
xor eax, eax
inc eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
sub ecx, eax
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x74]
neg ecx
mov dword [esp + 0x44], esi
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, edx
mov dword [esi + 4], edx
setg al
xor edx, edx
imul ecx, eax, 0xc12a
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x14], 1
cmp dword [esp + 0x14], ebx
jl 0x10019eec
push 4
pop ecx
push ecx
mov dword [esp + 0x44], 0xffffffff
lea ecx, [esp + 0x18c]
mov dword [esp + 0x2c], 0x1ae9c7d4
call fcn.10016f4f
push 4
pop eax
mov byte [esp + 0x2fc], al
lea ecx, [esp + 0x140]
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x3c], 0xfffd
push 1
call fcn.10016f4f
push 4
mov byte [esp + 0x300], 5
mov dword [esp + 0x14], ebx
pop edx
jmp 0x10019c03
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x188]
mov dword [eax + ecx*4], 0xb1cc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10019bed
xor edx, edx
mov dword [esp + 0x10], ebx
inc edx
jmp 0x10019c28
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10019c12
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x74]
cmp dword [eax + ecx*4], ebx
je 0x10019c5f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x74]
cmp dword [eax + ecx*4], ebx
jne 0x10019c57
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x74]
cmp dword [eax + ecx*4], ebx
mov eax, ebx
je 0x10019c59
mov eax, edx
cmp eax, dword [esp + 0x20]
jg 0x10019c61
mov edx, ebx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x74]
mov dword [eax + ecx*4], edx
lea eax, [edx + 0xd857]
imul eax, dword [esp + 0x20]
test eax, eax
je 0x10019e70
push dword [esp + 0x58]
movdqa xmm0, xmmword [0x10007f00]
lea eax, [esp + 0x2bc]
push eax
lea eax, [esp + 0x2b0]
mov dword [esp + 0x94], ebx
push eax
push ebx
lea ecx, [esp + 0x9c]
mov dword [esp + 0xa0], ebx
movdqu xmmword [esp + 0x2b8], xmm0
mov dword [esp + 0xa4], ebx
call fcn.100184f1
mov dword [esp + 0x10], 6
mov dword [esp + 0x38], 0xf3ae864e
mov dword [esp + 0x38], 0x7713999e
mov dword [esp + 0x38], 0x42fb88b
mov dword [esp + 0x18], 9
cmp dword [esp + 0x18], 0xffffffec
jl 0x10019da4
mov edi, dword [esp + 0x8c]
xor edx, edx
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
cmp dword [esi + 4], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x74]
setg dl
mov dword [esp + 0x34], edx
mov dword [eax + ecx*4], edx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x24]
mov dword [edi + 8], edx
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x24]
setne dl
sub esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp esi, eax
mov eax, dword [esp + 0x40]
setl cl
cmp ecx, 0x8160a871
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
setl cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setle cl
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x34]
sub ecx, eax
je 0x10019db9
cmp dword [esp + 0x28], ebx
je 0x10019dd2
mov esi, dword [esp + 0x44]
inc dword [esp + 0x3c]
lea ecx, [esp + 0x8c]
call fcn.100177aa
jmp 0x10019ec2
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x10019dd2
push ebx
push ebx
push 0x1b99
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
cmp dword [esp + 0x40], ebx
je 0x10019df8
cmp dword [esp + 0x20], ebx
jne 0x10019df3
mov eax, dword [esp + 0x8c]
xor ecx, ecx
cmp dword [eax + 4], ebx
setne cl
cmp ecx, dword [esp + 0x38]
jg 0x10019df8
xor ecx, ecx
inc ecx
jmp 0x10019dfa
mov ecx, ebx
mov eax, dword [esp + 0x38]
add ecx, 0xf11eae52
xor edx, edx
mov esi, dword [esp + 0x44]
cmp ecx, eax
mov eax, dword [esp + 0x38]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x8c]
setne cl
imul ecx, dword [eax + 0xc]
mov eax, dword [esp + 0x188]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x10]
add edx, dword [eax + 8]
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x38]
sub edx, dword [eax + 4]
neg edx
sbb edx, edx
imul ecx, dword [esp + 0x20]
inc edx
xor eax, eax
sub ecx, edx
cmp ecx, dword [esi + 4]
setl al
mov dword [esi + 4], eax
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffec
jge 0x10019d00
jmp 0x10019da4
mov dword [esp + 0x3c], 0x1c0e03a8
mov dword [esp + 0x40], 0x4566f38f
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x14]
neg edx
mov eax, dword [esp + 0x74]
sbb edx, edx
neg edx
mov dword [eax + ecx*4], edx
mov dword [esp + 0x40], edx
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x140]
mov dword [eax], ecx
lea ecx, [esp + 0x140]
call fcn.100177aa
lea ecx, [esp + 0x188]
mov byte [esp + 0x2fc], 3
call fcn.100177aa
dec dword [esp + 0x14]
jns 0x10019b94
or dword [esp + 0x2fc], 0xffffffff
lea ecx, [esp + 0x74]
call fcn.100177aa
inc dword [esp + 0x30]
jmp 0x1001a57f
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x23c]
mov dword [esp + 0x18], 0x6d64bda9
mov esi, 0xffff
mov dword [esp + 0x38], 0x40c88307
push 4
mov dword [esp + 0x40], esi
pop eax
mov dword [esp + 0x28], 0xf73ecb6a
mov dword [esp + 0x28], 0xfffffff9
mov dword [esp + 0x28], 0xfffffffe
push eax
call fcn.10016f4f
mov dword [esp + 0x2fc], 6
push 4
mov dword [esp + 0x34], ebx
mov dword [esp + 0x28], ebx
pop edx
jmp 0x10019f79
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x23c]
mov dword [eax + ecx*4], 0x330c202e
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edx
jl 0x10019f63
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x20]
jge 0x1001a04c
mov dword [esp + 0x2c], 0x664d
mov dword [esp + 0x28], 1
mov dword [esp + 0x28], 0xc78ef8a6
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], al
je 0x10019fc5
push 0x1367
push ebx
push 0x1d62
push 0x1512
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp dword [esp + 0x20], ebx
jne 0x10019fe8
mov eax, dword [esp + 0x2c]
xor ecx, ecx
mov edx, ebx
cmp edx, eax
setg cl
sub ecx, dword [esp + 0x2c]
sub ecx, esi
mov dword [esp + 0x28], ecx
jne 0x10019fe8
mov ecx, ebx
jmp 0x10019feb
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x20]
add eax, 0x30c4e2bf
add eax, ecx
xor ecx, ecx
cmp eax, 0xf5e3
mov eax, dword [esp + 0x20]
setne cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, dword [esp + 0x2c]
neg edx
sbb edx, edx
add edx, 0x11e368c0
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x18]
inc edx
add edx, dword [esp + 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [esp + 0x2c]
add edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
cmp edx, eax
setne cl
mov dword [esp + 0x28], ecx
jmp 0x1001a1e9
push 2
lea ecx, [esp + 0xec]
call fcn.10016f4f
mov byte [esp + 0x2fc], 7
mov dword [esp + 0x24], ebx
jmp 0x1001a07e
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], 0xe8aff65c
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x1001a068
mov dword [esp + 0x18], 0xffffffec
cmp dword [esp + 0x18], 0x17
jge 0x1001a1dd
mov edi, dword [esp + 0xe8]
push dword [esp + 0x58]
movdqa xmm0, xmmword [0x10007ec0]
lea eax, [esp + 0x29c]
push eax
lea eax, [esp + 0x290]
mov dword [esp + 0x3c], 0x16e0
push eax
mov dword [esp + 0x4c], 0xfffffff8
lea ecx, [esp + 0xe4]
mov dword [esp + 0x34], 1
push ebx
movdqu xmmword [esp + 0x298], xmm0
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
call fcn.100184f1
mov eax, dword [esp + 0x18]
mov dword [esp + 0x38], eax
cmp dword [esp + 0x38], ebx
je 0x1001a13c
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x38], eax
jne 0x1001a12a
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x34]
cmp dword [edi + 4], ebx
je 0x1001a13c
xor eax, eax
inc eax
jmp 0x1001a13e
mov eax, ebx
xor edx, edx
cmp eax, dword [edi + 4]
mov eax, dword [esp + 0xe8]
setge dl
xor ecx, ecx
mov esi, dword [eax]
mov eax, dword [esp + 0x3c]
cmp edx, eax
sete cl
lea eax, [esi - 0xffff]
add eax, ecx
jne 0x1001a16c
test esi, esi
jne 0x1001a16c
mov eax, ebx
jmp 0x1001a16f
xor eax, eax
inc eax
xor edx, edx
cmp eax, 0x2102
mov eax, dword [esp + 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x34]
setg cl
xor edx, edx
cmp ecx, 5
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x40]
setne cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp dword [esp + 0x28], eax
mov eax, dword [esp + 0xd8]
setne cl
xor edx, edx
cmp ecx, dword [edi + 4]
setne dl
xor ecx, ecx
cmp edx, dword [eax]
setg cl
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0xd8]
call fcn.100177aa
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x17
jl 0x1001a09f
lea ecx, [esp + 0xe8]
call fcn.100177aa
dec dword [esp + 0x30]
lea ecx, [esp + 0x23c]
or dword [esp + 0x2fc], 0xffffffff
call fcn.100177aa
push 8
pop esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x24], ebx
jmp 0x1001a28c
push 4
pop eax
push eax
lea ecx, [esp + 0x15c]
call fcn.10016f4f
mov dword [esp + 0x14], ebx
jmp 0x1001a237
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1ec], 0xde0b4074
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001a224
push 4
mov dword [esp + 0x18], ebx
pop edx
jmp 0x1001a259
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x158]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001a247
mov ecx, dword [esp + 0x158]
mov dword [ecx + 4], ebx
mov eax, dword [ecx + 4]
inc dword [ecx + 4]
cmp dword [ecx + 4], 2
mov dword [esp + eax*4 + 0x1ec], ebx
jl 0x1001a269
lea ecx, [esp + 0x158]
call fcn.100177aa
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xffffffe2
jne 0x1001a20e
push dword [esp + 0x58]
movdqa xmm0, xmmword [0x10007ee0]
lea eax, [esp + 0x2ac]
push eax
mov byte [esp + 0x26], bl
lea eax, [esp + 0x2a0]
mov dword [esp + 0x18], 0xb3ae3556
lea ecx, [esp + 0xc4]
push eax
mov dword [esp + 0x44], 0xb818f8f6
mov dword [esp + 0x48], 0xfffffff8
mov dword [esp + 0x34], 0xa2fc53d
push ebx
movdqu xmmword [esp + 0x2a8], xmm0
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
call fcn.100184f1
mov dword [esp + 0x2fc], esi
mov dword [esp + 0x10], 0xfffffff1
cmp dword [esp + 0x10], 0xe
je 0x1001a556
mov esi, dword [esp + 0xbc]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x30], 0x1c17c774
mov dword [esp + 0x24], ebx
jmp 0x1001a345
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x5c], 0x73eb905d
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x1001a335
mov dword [esp + 0x18], ebx
jmp 0x1001a4dc
push 1
lea ecx, [esp + 0xb4]
call fcn.10016f4f
push 4
pop eax
mov byte [esp + 0x2fc], 9
lea ecx, [esp + 0x194]
mov dword [esp + 0x30], 3
push eax
call fcn.10016f4f
mov dword [esp + 0x14], ebx
jmp 0x1001a39f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xb0]
mov dword [eax + ecx*4], 0x6d2e8588
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1001a389
push 4
mov dword [esp + 0x18], ebx
pop edx
jmp 0x1001a3c5
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x194]
mov dword [eax + ecx*4], 0x3ae4c7ba
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001a3af
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x1001a3e2
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 0xb0]
mov dword [eax], ebx
mov dword [esp + 0x20], 0xe4562513
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x1001a406
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esp + 0x20], ebx
jmp 0x1001a49b
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x2c], ebx
jmp 0x1001a43e
mov dword [esp + 0x30], 1
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0xb0]
mov eax, dword [eax]
mov dword [esp + eax*4 + 0x5c], ecx
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 1
jle 0x1001a41d
mov eax, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0xb0]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x5c]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
dec ecx
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 6
setl al
xor edx, edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x30]
add eax, 0x27a2
cmp ecx, eax
mov eax, dword [esp + 0x194]
setge dl
mov dword [eax], edx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 1
jle 0x1001a40f
mov eax, dword [esp + 0xb0]
inc dword [eax]
cmp dword [eax], 1
jle 0x1001a3eb
lea ecx, [esp + 0x194]
call fcn.100177aa
lea ecx, [esp + 0xb0]
mov byte [esp + 0x2fc], 8
call fcn.100177aa
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jle 0x1001a355
mov eax, dword [esp + 0x5c]
xor edx, edx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x60]
cmp ecx, eax
mov eax, dword [esp + 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x30], ecx
cmp dword [esp + 0x38], ebx
jne 0x1001a521
cmp dword [esp + 0x18], ebx
jne 0x1001a521
mov eax, ebx
jmp 0x1001a524
xor eax, eax
inc eax
mov dword [esp + 0x38], eax
xor edx, edx
mov eax, dword [esp + 0x38]
sub eax, 0x6e57c533
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x3c]
cmp ecx, eax
setge dl
mov dword [esi + 4], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xe
jne 0x1001a323
or dword [esp + 0x2fc], 0xffffffff
lea ecx, [esp + 0xbc]
call fcn.100177aa
cmp byte [esp + 0x1e], 0
je 0x1001a57f
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov dword [esp + 0x10], 0xfffffffe
lea ecx, [esp + 0x170]
mov dword [esp + 0x30], 1
push 2
call fcn.10016f4f
mov dword [esp + 0x14], ebx
jmp 0x1001a5b6
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x260], 0x4be76d23
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001a5a3
mov dword [esp + 0x14], ebx
jmp 0x1001a5d9
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x170]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001a5c3
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jne 0x1001a62f
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x10]
inc ecx
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.GDI32.dll_SetPolyFillMode]
imul eax, ecx
test eax, eax
je 0x1001a633
mov byte [esp + 0x1e], bl
cmp byte [esp + 0x1e], 0
je 0x1001a759
push 0x975
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
jmp 0x1001a759
mov ecx, ebx
jmp 0x1001a5f5
mov dword [esp + 0x2c], 1
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x1001a759
mov dword [esp + 0x20], 0xfffffff9
mov dword [esp + 0x30], 0xd88101ae
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], 2
jg 0x1001a739
mov esi, dword [esp + 0x170]
mov dword [esp + 0x18], 0xffffffff
xor ecx, ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x260]
cmp eax, 0x279e56e
setle cl
xor edx, edx
add ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [esp + 0x30], ecx
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + eax*4 + 0x260]
sub edx, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
cmp edx, eax
setle cl
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x30]
mov dword [esi + 4], eax
mov dword [esp + 0x18], ebx
jmp 0x1001a723
mov byte [esp + 0x1e], bl
cmp byte [esp + 0x1e], 0
je 0x1001a6fc
push 0x23c3
push ebx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov dword [esp + 0x2c], ebx
jmp 0x1001a718
mov byte [esp + 0x1e], bl
cmp byte [esp + 0x1e], 0
je 0x1001a714
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 2
jle 0x1001a702
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x1001a6e5
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jle 0x1001a673
mov byte [esp + 0x1e], bl
cmp byte [esp + 0x1e], 0
je 0x1001a74f
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
dec dword [esp + 0x10]
jns 0x1001a64d
lea ecx, [esp + 0x170]
call fcn.100177aa
mov dword [esp + 0x14], 0x7ca0029b
mov eax, 0xf825e7a6
mov dword [esp + 0x1a0], eax
mov dword [esp + 0x1a4], eax
mov dword [esp + 0x1a8], eax
mov dword [esp + 0x1ac], eax
mov dword [esp + 0x28], 5
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x3c], 0x4d073ff8
mov dword [esp + 0x34], 0xfffc
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], 0x4b5a
mov dword [esp + 0x30], 1
inc dword [esp + 0x34]
mov eax, dword [esp + 0x1a4]
push 4
pop ecx
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
cmp eax, ecx
setl dl
mov dword [esp + 0x3c], edx
mov dword [esp + 0x10], 0xe974a520
mov dword [esp + 0x28], 0xbca6
mov byte [esp + 0x1e], bl
cmp byte [esp + 0x1e], 0
je 0x1001a824
push 0x10e5
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [esp + 0x1e], bl
cmp byte [esp + 0x1e], 0
je 0x1001a84a
push 0x2301
push 0xcff
push 0x1cd7
push 0x1114
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x18], 0x3ae35568
mov dword [esp + 0x30], 0x43eb6069
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x28], 0xd62a04f7
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x18], 0xe
jmp 0x1001a909
mov dword [esp + 0x38], 0xd3f7
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x28], 0xffffffff
cmp dword [esp + 0x18], ebx
je 0x1001a8b0
mov eax, dword [esp + 0x18]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
cmp eax, 0x8b01
setle cl
xor edx, edx
mov dword [esp + 0x3c], ecx
mov esi, dword [esp + 0x30]
sub esi, dword [esp + 0x18]
add esi, dword [esp + 0x38]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x3c]
cmp eax, ecx
setl dl
xor eax, eax
cmp esi, edx
setg al
neg eax
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x28], eax
cmp dword [esp + 0x34], ebx
jne 0x1001a914
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffffb
je 0x1001a87f
push 1
lea ecx, [esp + 0x204]
call fcn.10016f4f
mov dword [esp + 0x28], 0x12b57e8b
mov dword [esp + 0x28], 0x4b5c
mov dword [esp + 0x28], 0x12aa53f0
mov dword [esp + 0x28], 0x678e
mov dword [esp + 0x28], 0x574b
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], 3
mov dword [esp + 0x10], ebx
jmp 0x1001a972
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x200]
mov dword [eax + ecx*4], 0x99ac
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1001a95c
push 4
mov dword [esp + 0x14], ebx
pop ecx
jmp 0x1001a995
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2e0], 0x2edc7555
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1001a982
mov dword [esp + 0x10], ebx
jmp 0x1001a9b4
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2d4], 2
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001a9a1
mov dword [esp + 0x10], ebx
jmp 0x1001a9d4
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x10c], 0xeeb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001a9c1
inc dword [esp + 0x10c]
lea ecx, [esp + 0x200]
call fcn.100177aa
mov dword [esp + 0x10], 0xfffffffe
lea ecx, [esp + 0x128]
mov dword [esp + 0x30], 1
push 2
call fcn.10016f4f
mov dword [esp + 0x20], ebx
jmp 0x1001aa25
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x254], 0x4be76d23
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x1001aa12
mov dword [esp + 0x20], ebx
jmp 0x1001aa48
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1001aa32
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jne 0x1001aa98
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x10]
inc ecx
mov eax, dword [esp + 0x10]
imul eax, ecx
test eax, eax
je 0x1001aa9c
mov byte [esp + 0x1e], bl
cmp byte [esp + 0x1e], 0
je 0x1001abc2
push 0x975
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
jmp 0x1001abc2
mov ecx, ebx
jmp 0x1001aa64
mov dword [esp + 0x2c], 1
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x1001abc2
mov dword [esp + 0x20], 0xfffffff9
mov dword [esp + 0x30], 0xd88101ae
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], 2
jg 0x1001aba2
mov esi, dword [esp + 0x128]
mov dword [esp + 0x18], 0xffffffff
xor ecx, ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x254]
cmp eax, 0x279e56e
setle cl
xor edx, edx
add ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [esp + 0x30], ecx
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + eax*4 + 0x254]
sub edx, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
cmp edx, eax
setle cl
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x30]
mov dword [esi + 4], eax
mov dword [esp + 0x18], ebx
jmp 0x1001ab8c
cmp dword [esp + 0x18], 2
jle 0x1001ab4e
mov byte [esp + 0x1e], bl
cmp byte [esp + 0x1e], 0
je 0x1001abb8
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
dec dword [esp + 0x10]
jns 0x1001aab6
lea ecx, [esp + 0x128]
call fcn.100177aa
mov dword [esp + 0x24], ebx
mov eax, 0xf825e7a6
mov dword [esp + 0x1b0], eax
mov dword [esp + 0x1b4], eax
mov dword [esp + 0x1b8], eax
mov dword [esp + 0x1bc], eax
mov dword [esp + 0x28], 5
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x3c], 0x4d073ff8
mov dword [esp + 0x34], 0xfffc
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], 0x4b5a
mov dword [esp + 0x30], 1
inc dword [esp + 0x34]
mov eax, dword [esp + 0x1b4]
push 4
pop ecx
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
cmp eax, ecx
mov ecx, 0xa3888451
setl dl
mov dword [esp + 0x3c], edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [esp + 0x10], eax
jne 0x1001ac84
cmp dword [esp + 0x10], ebx
jne 0x1001ac84
mov edx, ebx
jmp 0x1001ac87
xor edx, edx
inc edx
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, edx
mov esi, 0xd853
mov eax, dword [esp + 0x14]
setge cl
xor edx, edx
sub esi, ecx
cmp esi, eax
mov eax, dword [esp + 0x14]
push 3
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
cmp ecx, 0x1b17
lea ecx, [esp + 0x138]
setne dl
sub edx, dword [esp + 0x18]
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
neg edx
sbb edx, edx
inc edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x28], eax
call fcn.10016f4f
push 4
mov dword [esp + 0x300], 0xa
lea ecx, [esp + 0x270]
pop eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0xfffffff6
push eax
call fcn.10016f4f
mov byte [esp + 0x2fc], 0xb
mov dword [esp + 0x20], ebx
jmp 0x1001ad35
cmp dword [esp + 0x20], 3
jl 0x1001ad22