Function at 0x10019c21
Capabilities:
Accept command line arguments
Encode data using xor
Encrypt data using speck
Get common file path

Disassembly:
mov eax, 0x10063599
call fcn.10062db0
sub esp, 0x24c
push ebx
push esi
push edi
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], 0xe0648261
mov dword [ebp - 0x24], 0x9034e105
push 2
mov dword [ebp - 0x3c], edx
call fcn.1001b7ad
xor ebx, ebx
or esi, 0xffffffff
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2c], 0x4a276ac1
mov dword [ebp - 0x14], 0x2c160ec2
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], 0x93497140
mov dword [ebp - 0x38], 0xe1c21029
mov dword [ebp - 0x2c], ebx
jmp 0x10019c93
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x12c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10019c84
mov dword [ebp - 0x1c], ebx
jmp 0x10019d83
mov dword [ebp - 0x20], 0x37d45db3
lea ecx, [ebp - 0xc0]
push 4
call fcn.1001b7ad
push 3
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 1
call fcn.1001b7ad
xor edx, edx
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x10019cd8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x48], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10019cce
mov dword [ebp - 0x20], ebx
jmp 0x10019cf1
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10019ce2
mov dword [ebp - 0x20], ebx
jmp 0x10019d0b
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x108]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10019cfc
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jl 0x10019d67
mov ecx, dword [ebp - 0x108]
mov eax, dword [ebp - 0xc0]
mov dword [eax], 0xffff028a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov dword [ecx + 8], ebx
cmp dword [ebp + eax*4 - 0x48], ebx
jne 0x10019d5d
mov eax, dword [ebp - 0xc0]
cmp dword [eax], ebx
mov eax, ebx
je 0x10019d5f
mov eax, edx
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x20]
jns 0x10019d1f
lea ecx, [ebp - 0x108]
call fcn.1001b82f
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], bl
call fcn.1001b82f
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jg 0x10019ca1
cmp dword [ebp - 0x1c], ebx
je 0x10019d94
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x12c]
mov dword [ebp - 0x2c], 0xc01
mov eax, dword [ebp - 0x14]
cmp eax, 0xf09d
mov eax, dword [ebp - 0x2c]
mov esi, dword [edi + 4]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
cmp ecx, esi
setle dl
sub edx, esi
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x24]
mov ecx, dword [edi + 4]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
add eax, ecx
cmp eax, ecx
jg 0x10019e0d
cmp dword [ebp - 0x1c], ebx
jne 0x10019e0d
mov eax, ebx
jmp 0x10019e10
xor eax, eax
inc eax
imul ecx, eax, 0xffff
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
lea ecx, [ebp - 0x12c]
setl dl
or esi, 0xffffffff
mov dword [ebp - 0x38], edx
mov dword [ebp - 4], esi
call fcn.1001b82f
mov eax, dword [0x1060d474]
test al, 1
jne 0x10019ec5
or eax, 1
mov dword [0x1060d474], eax
push ebx
mov dword [ebp - 4], 2
push ebx
mov dword [0x1060d4c0], ebx
mov dword [0x1060d4c4], ebx
call fcn.1001d9ad
mov dword [0x1060d4c0], eax
mov dword [0x1060d4c8], ebx
mov dword [0x1060d4d0], ebx
mov byte [ebp - 4], 4
mov ecx, 0x1060d4c8
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x80]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x16c]
mov dword [0x1060d4dc], 0x3f800000
push eax
mov dword [0x1060d4cc], ebx
call fcn.1001d785
push 0x100642ee
mov dword [0x1060d4d4], 7
mov dword [0x1060d4d8], 8
call fcn.1004ddfc
pop ecx
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], 0xfffffffb
push 3
mov dword [ebp - 0x30], 0xbe1552b9
mov dword [ebp - 0x2c], ebx
pop edi
jmp 0x10019ee9
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x54], 0xa6847dfa
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10019edb
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10019f01
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 0x24], ebx
jmp 0x1001a086
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], ebx
jl 0x1001a083
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x54], ebx
je 0x10019f46
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001a06c
push 0x16d9
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1001a06c
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x50], ebx
je 0x1001a018
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x114]
push 2
call fcn.1001b7ad
mov dword [ebp - 0x2c], ebx
jmp 0x10019f7a
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x114]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x10019f67
mov dword [ebp - 0x2c], ebx
jmp 0x1001a001
mov dword [ebp - 0x30], 0x62da
cmp dword [ebp - 0x20], ebx
jne 0x1001a00b
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x54]
mov eax, dword [ebp - 0x54]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x54]
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
cmp ecx, 0xb288586f
sbb edx, edx
add edx, 0x5e82f4f7
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
xor eax, eax
cmp ecx, 0xef90
setg al
xor edx, edx
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x114]
setl cl
mov dword [eax], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jle 0x10019f85
lea ecx, [ebp - 0x114]
call fcn.1001b82f
jmp 0x1001a033
mov dword [ebp - 0x28], 0x434a938f
cmp dword [ebp - 0x24], ebx
jne 0x1001a02d
cmp dword [ebp - 0x28], ebx
jne 0x1001a02d
mov eax, ebx
jmp 0x1001a030
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x54]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setle cl
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], ebx
jne 0x1001a05b
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x54]
mov dword [ebp - 0x14], 0x5265879a
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x54]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x54], ecx
dec dword [ebp - 0x20]
jns 0x10019f1c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x10019f09
imul eax, dword [ebp - 0x44], 0x2710
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x58]
push eax
call fcn.1001b871
mov edx, dword [eax]
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x24], 0xcb63e8e1
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], ebx
jmp 0x1001a0cf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1c0], 0x26bd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001a0be
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], ebx
jl 0x1001a114
mov dword [ebp - 0x14], 0x18d58162
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x1001a10f
mov dword [ebp - 0x28], 0xffff
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x14], ebx
jne 0x1001a10f
dec dword [ebp - 0x14]
jns 0x1001a0f3
dec dword [ebp - 0x1c]
jns 0x1001a0e0
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0x10
jg 0x1001a184
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001a133
push ebx
push 0xc9e
push ebx
call dword [sym.imp.GDI32.dll_GetBitmapBits]
mov dword [ebp - 0x1c], ebx
jmp 0x1001a172
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], ebx
jmp 0x1001a169
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x1c0], ebx
jne 0x1001a16f
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001a166
push 0x1e91
push 0x25f6
push ebx
call dword [sym.imp.GDI32.dll_OffsetRgn]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x1001a140
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1b
jle 0x1001a138
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x10
jle 0x1001a11d
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x1001a1fe
mov dword [ebp - 0x1c], ebx
jmp 0x1001a19e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1cc], 0x204e2db5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001a18d
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
inc ecx
jmp 0x1001a1b9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x40], 0x57ad95e1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1001a1ab
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001a1d6
push 0x1a3a
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x40], 2
cmp dword [ebp - 0x40], ebx
jl 0x1001a1f3
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x1cc], ebx
jne 0x1001a1f3
dec dword [ebp - 0x40]
jns 0x1001a1e2
mov dword [ebp - 0xa4], edx
jmp 0x1001b4de
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1001a217
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x15c], 0x64a6847d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001a206
mov dword [ebp - 0x24], ebx
jmp 0x1001a25e
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x28], 0x86bd085
mov dword [ebp - 0x14], ebx
jmp 0x1001a255
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x15c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x15c]
cmp edx, eax
setne cl
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x1001a234
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x1001a221
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001a275
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [0x1060d474]
test al, 2
jne 0x1001a30c
or eax, 2
mov dword [0x1060d474], eax
push ebx
mov dword [ebp - 4], 5
push ebx
mov dword [0x1060d490], ebx
mov dword [0x1060d494], ebx
call fcn.1001d9ad
mov dword [0x1060d490], eax
mov dword [0x1060d498], ebx
mov dword [0x1060d4a0], ebx
mov byte [ebp - 4], 7
mov ecx, 0x1060d498
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0xb4]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x168]
mov dword [0x1060d4ac], 0x3f800000
push eax
mov dword [0x1060d49c], ebx
call fcn.1001d785
push 0x100642e9
mov dword [0x1060d4a4], 7
mov dword [0x1060d4a8], 8
call fcn.1004ddfc
pop ecx
mov dword [ebp - 4], esi
xorps xmm0, xmm0
lea ecx, [ebp - 0xd8]
movdqu xmmword [ebp - 0x68], xmm0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x30], 0xd7d0
mov dword [ebp - 0x24], ebx
push 4
call fcn.1001b7ad
mov dword [ebp - 4], 8
mov dword [ebp - 0x14], ebx
jmp 0x1001a35b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xd8]
mov dword [eax + ecx*4], 0x9bd12f8b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001a348
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp eax, 0xc946
setl cl
xor eax, eax
cmp ecx, 0x4039ee49
setge al
cmp eax, dword [ebp - 0x20]
jge 0x1001a387
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
inc ecx
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
sub edx, 0x6193fe69
cmp eax, edx
setne cl
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ebx
je 0x1001a3bb
cmp dword [ebp - 0x20], ebx
je 0x1001a3bb
xor eax, eax
inc eax
jmp 0x1001a3bd
mov eax, ebx
cmp eax, dword [ebp - 0x20]
jl 0x1001a3cc
cmp dword [ebp - 0x14], ebx
je 0x1001a3cc
xor edx, edx
inc edx
jmp 0x1001a3ce
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
inc edx
cmp edx, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
jne 0x1001a3e8
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x20], ebx
jne 0x1001a3fa
mov eax, ebx
cmp dword [ebp - 0x1c], ebx
je 0x1001a3fc
mov eax, edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jne 0x1001a4f9
cmp dword [ebp - 0x1c], ebx
jne 0x1001a4f9
push 2
lea ecx, [ebp - 0xf0]
call fcn.1001b7ad
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x14], ebx
jmp 0x1001a439
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xf0]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001a42a
mov dword [ebp - 0x20], ebx
jmp 0x1001a458
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001a455
push ebx
push ebx
call dword [sym.imp.USER32.dll_UnregisterClassA]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x1001a444
mov eax, dword [ebp - 0xf0]
xor ecx, ecx
mov dword [ebp - 0x1c], 0x6f2ba10f
mov edx, dword [eax]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setge cl
xor eax, eax
cmp edx, ecx
setl al
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
je 0x1001a497
mov dword [ebp - 0x14], 0xf6679856
dec dword [ebp - 0x14]
jmp 0x1001a4f1
mov dword [ebp - 0x20], 0xfffffffb
xor edx, edx
mov dword [ebp - 0x38], ebx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, 0x8b4891
setl dl
xor ecx, ecx
sub eax, edx
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x24]
sub edx, eax
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf0]
sub edx, dword [eax]
mov eax, dword [ebp - 0x20]
cmp edx, eax
mov eax, dword [ebp - 0xd8]
setg cl
xor edx, edx
mov dword [eax], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setge dl
mov dword [ebp - 0x14], edx
lea ecx, [ebp - 0xf0]
jmp 0x1001a533
push edi
lea ecx, [ebp - 0x120]
call fcn.1001b7ad
mov dword [ebp - 0x14], ebx
jmp 0x1001a51d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], 0xa341
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001a50a
mov eax, dword [ebp - 0x120]
lea ecx, [ebp - 0x120]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
call fcn.1001b82f
cmp dword [ebp - 0x24], ebx
jne 0x1001a554
mov eax, dword [ebp - 0xd8]
mov ecx, 0x3e9becc4
mov dword [eax + 4], ecx
cmp dword [ebp - 0x1c], ecx
jne 0x1001a554
mov ecx, ebx
jmp 0x1001a557
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x30]
imul eax, ecx
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], esi
call fcn.1001b82f
mov dword [ebp - 0x14], 0x488f
cmp dword [ebp - 0x14], 0x4906
jle 0x1001a5db
mov dword [ebp - 0x30], ebx
mov edi, ebx
mov esi, ebx
mov ecx, ebx
mov ebx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
mov eax, esi
shl eax, cl
lea ecx, [edi + ebx]
xor eax, ecx
mov ecx, 0x1060c3d8
cdq
push edx
push eax
call fcn.1001b57c
mov ecx, dword [ebp - 0x38]
inc ecx
mov dword [ebp - 0x38], ecx
cmp ecx, 0x51af
jl 0x1001a58d
inc esi
push 0
pop ebx
cmp esi, 0x5c54
jl 0x1001a585
inc edi
cmp edi, 0x584e
jl 0x1001a583
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x7089
jl 0x1001a581
push 3
pop edi
or esi, 0xffffffff
lea eax, [ebp - 0x44]
push eax
call fcn.1001b8d3
mov eax, dword [eax]
mov dword [ebp - 4], 9
cmp dword [ebp - 0x14], 0x46d8
mov dword [ebp - 0x24], eax
jge 0x1001a62c
mov edx, 0x10008b58
mov ecx, 0x1060c3d8
call fcn.1001da87
jmp 0x1001a62c
mov dword [ebp - 4], esi
lea eax, [ebp - 0x16c]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c700]
lea ecx, [ebp - 0x98]
push eax
lea eax, [ebp - 0x17c]
mov dword [ebp - 0x14], 0xfffffff9
push eax
push ebx
movdqu xmmword [ebp - 0x17c], xmm0
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
call fcn.1001e1aa
mov dword [ebp - 4], 0xb
lea eax, [ebp - 0x18c]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c730]
lea ecx, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x19c]
mov dword [ebp - 0x34], 0x13923cc
push eax
push ebx
movdqu xmmword [ebp - 0x19c], xmm0
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
call fcn.1001e1aa
mov dword [ebp - 0x34], 0x6ebf4d39
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0x17
je 0x1001a709
mov esi, dword [ebp - 0x98]
xor edx, edx
mov dword [ebp - 0x34], 0xfffffff6
mov eax, dword [ebp - 0x14]
cmp eax, 1
mov eax, dword [ebp - 0xb0]
setle dl
xor ecx, ecx
add edx, dword [esi + 0xc]
cmp edx, 0x65cd
setge cl
mov dword [eax], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x17
jne 0x1001a6d8
lea ecx, [ebp - 0xb0]
call fcn.1001b82f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.1001b82f
mov al, byte [ebp + 0xc]
test al, al
jne 0x1001a735
mov esi, dword [ebp - 0x24]
test esi, esi
jne 0x1001aad9
lea ecx, [ebp - 0x248]
mov dl, al
push ecx
mov ecx, dword [ebp - 0x44]
call fcn.1000dc15
mov esi, eax
lea edi, [ebp - 0x68]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], 0xf57a7c2
mov dword [ebp - 0x14], ebx
jmp 0x1001a76a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x70], 0x62fd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001a75c
mov dword [ebp - 0x14], ebx
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
jg 0x1001a85a
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x70], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 0x5a4f
cmp dword [ebp - 0x20], 0x5c71
jle 0x1001a835
mov dword [ebp - 0x30], ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov esi, ebx
mov dword [ebp - 0x38], ebx
mov eax, edi
mov dword [ebp - 0x28], ebx
cdq
mov edi, ebx
idiv esi
mov esi, dword [ebp - 0x30]
mov eax, edx
mov dword [ebp - 0x34], eax
mov ecx, edi
sar eax, cl
lea ecx, [ebp - 0x1e4]
or eax, esi
cdq
push edx
push eax
call fcn.1000db9a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001a7e4
mov eax, dword [eax]
push eax
call fcn.1004de26
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x1e4]
call fcn.1001bbfd
mov eax, dword [ebp - 0x34]
inc edi
cmp edi, 0x20cf
jl 0x1001a7c6
mov esi, dword [ebp - 0x38]
mov edi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x38], esi
cmp esi, 0x388e
jl 0x1001a7b4
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x7c08
jl 0x1001a7af
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x2b23
jl 0x1001a7aa
cmp dword [ebp - 0x6c], ebx
jne 0x1001a852
cmp dword [ebp - 0x20], 0x595d
jge 0x1001a84e
push 0x10008bd0
call fcn.1004de26
pop ecx
or dword [ebp - 4], 0xffffffff
inc dword [ebp - 0x14]
jmp 0x1001a773
mov dword [ebp - 0x28], 0x5057
cmp dword [ebp - 0x28], 0x50ca
jle 0x1001a8b6
mov edi, ebx
mov esi, ebx
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x214]
cdq
push edx
push eax
call fcn.1000db9a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001a88c
mov eax, dword [eax]
push eax
call fcn.1004de26
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x214]
call fcn.1001bbfd
inc esi
cmp esi, 0x707c
jl 0x1001a86e
inc edi
cmp edi, 0x52a8
jl 0x1001a86c
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
je 0x1001aabb
cmp dword [ebp - 0x60], 0
je 0x1001aabb
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], ebx
jmp 0x1001a913
cmp byte [ebp - 0x15], 0
je 0x1001a8f5
push ebx
push 0x16a1
push 0x2375
push ebx
push 0x25e5
push 0xfbb
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001a910
push 0x270e
push ebx
push 0x2672
push ebx
call dword [sym.imp.USER32.dll_LoadStringA]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1d
mov byte [ebp - 0x15], bl
jle 0x1001a8d2
cmp byte [ebp - 0x15], 0
je 0x1001a92d
push 0x4b4
call dword [sym.imp.USER32.dll_GetParent]
mov eax, dword [ebp - 0x5c]
push 3
mov dword [ebp - 0x1c], 0xdeb77278
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x14], ebx
pop edi
jmp 0x1001a956
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x138], 0x6ee97341
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001a945
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp eax, 0xffffffff
setle cl
xor eax, eax
sub edx, ecx
cmp eax, edx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, 0xfffffffd
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp - 0x138]
imul eax, edx, 0xa8fe
test eax, eax
je 0x1001a9b0
cmp dword [ebp - 0x1c], ebx
je 0x1001a9b0
xor ecx, ecx
inc ecx
jmp 0x1001a9b2
mov ecx, ebx
mov eax, dword [ebp - 0x138]
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
mov dword [ebp - 0x130], edx
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setl cl
imul eax, ecx, 0xbcd8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], 0xfffffff6
jne 0x1001aab0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x20], 0x1a20
cmp dword [ebp - 0x20], 0x1a91
jle 0x1001aa65
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], 0x60b4
mov esi, dword [ebp - 0x30]
mov edi, ebx
mov eax, edi
lea ecx, [ebp - 0x238]
xor eax, esi
cdq
push edx
push eax
call fcn.1000db9a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001aa26
mov eax, dword [eax]
push eax
call fcn.1004de26
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x238]
call fcn.1001bbfd
inc edi
cmp edi, 0x2953
jl 0x1001aa0a
mov esi, dword [ebp - 0x14]
add dword [ebp - 0x30], esi
dec dword [ebp - 0x38]
jne 0x1001aa05
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x880
jl 0x1001a9fb
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 3
pop edi
mov dword [ebp - 0x14], 0xfffffff2
jmp 0x1001aa8a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001aa87
push 0x1906
push 0x1456
call dword [sym.imp.GDI32.dll_SetROP2]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff9
jg 0x1001aa6e
cmp dword [ebp - 0x20], 0x19da
jge 0x1001aaa4
push 0x10008c80
call fcn.1004de26
pop ecx
or dword [ebp - 4], 0xffffffff
dec dword [ebp - 0x1c]
jmp 0x1001a9db
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x9c], eax
jmp 0x1001aabe
push 3
pop edi
cmp dword [ebp - 0x28], 0x4e94
jge 0x1001aad2
push 0x10008c30
call fcn.1004de26
pop ecx
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x14], ebx
jmp 0x1001aaf6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x258], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001aae5
mov dword [ebp - 0x14], ebx
jmp 0x1001ab88
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c770]
lea eax, [ebp - 0x17c]
mov dword [ebp - 0x34], 0xffffffff
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0x34], 0xb11accba
push eax
mov dword [ebp - 0x34], ebx
lea eax, [ebp - 0x18c]
mov dword [ebp - 0x34], 0x374c
push eax
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x34], 0xb9dbea52
mov dword [ebp - 0x34], 0x92bd42ca
push ebx
movdqu xmmword [ebp - 0x18c], xmm0
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
call fcn.1001e1aa
mov dword [ebp - 0x28], 1
lea ecx, [ebp - 0xe4]
dec dword [ebp - 0x28]
call fcn.1001b82f
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff4
jl 0x1001ab04
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001aba7
push 0x1a3a
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test esi, esi
jne 0x1001b029
cmp dword [ebp - 0x68], esi
jle 0x1001b029
mov dword [ebp - 0x34], 8
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001abd3
push 0x2ac
call dword [sym.imp.USER32.dll_ShowCaret]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001abe9
push ebx
push ebx
push 0x1ca8
call dword [sym.imp.USER32.dll_SetPropA]
push edi
lea ecx, [ebp - 0x150]
call fcn.1001b7ad
mov dword [ebp - 0x14], 0x3a00d0e7
mov dword [ebp - 0x14], ebx
jmp 0x1001ac14
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], 0xccbad86e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001ac01
mov eax, dword [ebp - 0x150]
xor ecx, ecx
cmp dword [eax + 8], 1
setne cl
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], ebx
jmp 0x1001ac44
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001ac41
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1b
jge 0x1001ac30
lea ecx, [ebp - 0x150]
call fcn.1001b82f
mov dword [ebp - 0x28], 0x51eb
cmp dword [ebp - 0x28], 0x54c4
jle 0x1001aca9
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x34], ebx
mov eax, esi
mov ecx, 0x1060c3d8
cdq
idiv ebx
xor edx, edi
mov eax, edx
cdq
push edx
push eax
call fcn.1001b57c
inc ebx
cmp ebx, 0x2458
jl 0x1001ac6c
inc esi
push 0
pop ebx
cmp esi, 0x176b
jl 0x1001ac69
inc edi
cmp edi, 0x1fda
jl 0x1001ac67
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 3
pop edi
mov dword [ebp - 0x1c], 0x71c7
mov dword [ebp - 4], 0x12
cmp dword [ebp - 0x28], 0x4ff4
jge 0x1001accf
mov edx, 0x10008cf8
mov ecx, 0x1060c3d8
call fcn.1001da87
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x28], 0x7e70
cmp dword [ebp - 0x28], 0x8115
jle 0x1001ad0d
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x1060c3d8
and eax, esi
cdq
push edx
push eax
call fcn.1001b57c
inc edi
cmp edi, 0x4840
jl 0x1001ace7
inc esi
cmp esi, 0x7333
jl 0x1001ace5
push 3
pop edi
mov dword [ebp - 0x38], 0xab274bf9
mov dword [ebp - 4], 0x14
cmp dword [ebp - 0x28], 0x7b30
jge 0x1001ad33
mov edx, 0x10008d38
mov ecx, 0x1060c3d8
call fcn.1001da87
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x28], 0xf3f17e2f
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1001ada8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1a8], 0xf145ba13
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001ad97
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001adc3
push ebx
push 0xaf6
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x38], 0x43250e6d
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
neg esi
sbb esi, esi
neg esi
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor eax, eax
cmp esi, ecx
mov ecx, dword [ebp - 0x1c]
setg al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x64], 0
mov dword [ebp - 0x1a4], eax
je 0x1001b026
mov dword [ebp - 0x14], 0x8b13
mov dword [ebp - 0x24], 0x64896e6a
mov dword [ebp - 0x38], 0xefd
cmp dword [ebp - 0x38], 0x107b
jle 0x1001ae8a
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov edi, esi
mov esi, 0x69cc
mov eax, edi
lea ecx, [ebp - 0x1fc]
cdq
push edx
push eax
call fcn.1000db9a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001ae5f
mov eax, dword [eax]
push eax
call fcn.1004de26
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x1fc]
call fcn.1001bbfd
dec edi
dec esi
jne 0x1001ae45
mov esi, dword [ebp - 0x28]
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x18e5
jl 0x1001ae3e
push 3
pop edi
mov dword [ebp - 0x34], 0x2d683a7e
cmp dword [ebp - 0x38], 0xe49
jge 0x1001aea5
push 0x10008de4
call fcn.1004de26
pop ecx
or dword [ebp - 4], 0xffffffff
dec dword [ebp - 0x14]
mov dword [ebp - 0x14], 5
cmp dword [ebp - 0x14], 0x14
jge 0x1001b00c
push 2
pop esi
mov dword [ebp - 0x20], 0x47597a61
mov dword [ebp - 0x24], ebx
jmp 0x1001aed9
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x164], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1001aecc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], 0xfffffff8
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
je 0x1001afed
mov dword [ebp - 0x24], 0xfffffff0
jmp 0x1001afd7
push edi
lea ecx, [ebp - 0xfc]
call fcn.1001b7ad
mov dword [ebp - 0x1c], ebx
jmp 0x1001af3b
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xfc]
mov dword [eax + ecx*4], 0xc556
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001af28
mov dword [ebp - 0x1c], ebx
jmp 0x1001af56
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x220], 0xfffffffa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001af45
mov dword [ebp - 0x20], ebx
jmp 0x1001afc4
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x28], 0xa54e5878
mov dword [ebp - 0x1c], ebx
jmp 0x1001af81
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7c], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001af73
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xfc]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x7c], ebx
jl 0x1001afc1
mov dword [ebp - 0x28], 0xfffffffe
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0xfc]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x28]
dec dword [ebp - 0x7c]
jns 0x1001afa0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x1001af60
lea ecx, [ebp - 0xfc]
call fcn.1001b82f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff8
jge 0x1001af17
mov dword [ebp - 0x160], 0xa1dd7933
jmp 0x1001affc
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001affc
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x14
jl 0x1001aec0
mov ecx, dword [ebp - 0x64]
call fcn.10019beb
mov esi, eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x24], esi
call fcn.1001b8d3
mov dword [eax], esi
jmp 0x1001b029
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x68]
call fcn.10015697
mov dword [ebp - 0x28], 0xfffffffc
xor ecx, ecx
mov dword [ebp - 0x34], 0x76f5020f
inc ecx
mov dword [ebp - 0x38], 0x158d32ff
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 0x80ca9f8d
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1001b07a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1b4], 0x77c8748a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001b069
dec dword [ebp - 0x30]
cmp dword [ebp - 0x28], ebx
jne 0x1001b08a
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], ebx
jne 0x1001b09a
mov ecx, ebx
dec dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x28]
setge cl
xor edx, edx
cmp ecx, 0xffffffff
setne dl
xor ecx, ecx
cmp eax, edx
setne cl
imul eax, ecx, 0xffffc25b
add dword [ebp - 0x1c], eax
cmp dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
jne 0x1001b307
test esi, esi
je 0x1001b307
mov dword [ebp - 0x38], 0x44cc
cmp dword [ebp - 0x38], 0x471e
jle 0x1001b16c
mov eax, ebx
mov dword [ebp - 0x2c], ebx
mov edi, ebx
mov dword [ebp - 0x28], ebx
mov ecx, edi
mov dword [ebp - 0x30], eax
mov edi, eax
mov esi, ebx
shl edi, cl
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
mov ebx, esi
and ebx, edi
mov edi, dword [ebp - 0x34]
mov eax, edi
mov ecx, 0x1060c3d8
xor eax, ebx
cdq
push edx
push eax
call fcn.1001b57c
inc edi
cmp edi, 0x7249
jl 0x1001b11c
mov edi, dword [ebp - 0x30]
inc esi
push 0
pop ebx
cmp esi, 0x3f2a
jl 0x1001b112
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x2902
jl 0x1001b104
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x4729
jl 0x1001b0ff
push ebx
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 4], 0x18
cmp dword [ebp - 0x38], 0x4306
jge 0x1001b18b
mov edx, 0x10008e40
mov ecx, 0x1060c3d8
call fcn.1001da87
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x34], 8
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
push 0xfffffffffffffffd
pop edi
je 0x1001b1ad
push 0x2ac
call dword [sym.imp.USER32.dll_ShowCaret]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b1c3
push ebx
push ebx
push 0x1ca8
call dword [sym.imp.USER32.dll_SetPropA]
mov edx, dword [ebp - 0x3c]
mov ecx, esi
call fcn.10019c17
mov esi, eax
lea ecx, [ebp - 0x8c]
push 2
mov dword [ebp - 0xa4], esi
call fcn.1001b7ad
mov dword [ebp - 0x14], 0x25fa5fef
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x2c], 0xe60e
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x14], ebx
jmp 0x1001b24c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x8c]
mov dword [eax + ecx*4], 0xb299
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001b239
mov eax, dword [ebp - 0x8c]
xor edx, edx
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x8c]
cmp dword [ecx + 4], 0xfffffffa
setl dl
xor eax, eax
cmp edx, dword [ecx]
setg al
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], 0xb545
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x8c]
cmp ecx, dword [eax]
setg dl
xor eax, eax
cmp edx, 0x74307976
setl al
xor ecx, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x34]
setle cl
cmp edi, ecx
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x2c]
test eax, eax
jne 0x1001b2c5
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x3c], ecx
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x28]
test eax, eax
je 0x1001b2ec
mov eax, ecx
cmp dword [ebp - 0x2c], ebx
jne 0x1001b2ee
mov eax, ebx
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x34], eax
call fcn.1001b82f
lea eax, [ebp - 0x58]
push eax
call fcn.1001b871
mov dword [eax], esi
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x3c], 0x607a9881
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x38], 0x3db6
cmp dword [ebp - 0x38], 0x40fd
jle 0x1001b39d
push 0xd81
push 0xf17
push ebx
call dword [sym.imp.USER32.dll_RemoveMenu]
mov edi, ebx
mov dword [ebp - 0x28], ebx
mov esi, ebx
mov dword [ebp - 0x3c], ebx
mov ecx, esi
mov dword [ebp - 0x34], edi
mov esi, edi
mov dword [ebp - 0x30], ebx
shl esi, cl
mov edi, ebx
mov dword [ebp - 0x34], ebx
lea eax, [ebx + edi]
mov ecx, 0x1060c3d8
xor eax, esi
cdq
push edx
push eax
call fcn.1001b57c
inc ebx
cmp ebx, 0x758d
jl 0x1001b358
inc edi
push 0
pop ebx
cmp edi, 0x59be
jl 0x1001b355
mov esi, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x28]
inc esi
mov dword [ebp - 0x3c], esi
cmp esi, 0x6b28
jl 0x1001b347
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x325
jl 0x1001b342
push 3
lea ecx, [ebp - 0xcc]
call fcn.1001b7ad
push 0x1a
pop esi
mov dword [ebp - 4], esi
mov byte [ebp - 4], 0x1b
cmp dword [ebp - 0x38], 0x3c83
jge 0x1001b3cc
mov edx, 0x10008e84
mov ecx, 0x1060c3d8
call fcn.1001da87
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x3c], 0xb275cf8b
inc eax
lea ecx, [ebp - 0x144]
push eax
call fcn.1001b7ad
mov dword [ebp - 0x3c], 0xfbf2b83
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x1c], ebx
jmp 0x1001b430
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1001b41d
mov dword [ebp - 0x1c], ebx
xor ebx, ebx
inc ebx
jmp 0x1001b44e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x144]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1001b43e
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setle dl
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xcc]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ebx
imul ecx, dword [ebp - 0x20]
xor eax, eax
add ecx, dword [ebp - 0x20]
cmp ecx, 4
setl al
xor ecx, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xcc]
cmp dword [eax], 0xa2a4
mov eax, dword [ebp - 0x144]
setg cl
neg ecx
mov dword [eax], ecx
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x144]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
call fcn.1001b82f
lea ecx, [ebp - 0xcc]
call fcn.1001b82f
mov eax, dword [ebp + 8]
lea esi, [ebp - 0xa4]
mov ecx, dword [ebp - 0xc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret