Function at 0x1001aeec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
push ebx
xor ebx, ebx
mov dword [ebp - 0x90], edx
mov dword [ebp - 8], ebx
push esi
mov dword [ebp - 0x2c], 0x2b46
push edi
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x10], ebx
jmp 0x1001af23
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x50], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001af15
push 1
mov dword [ebp - 8], ebx
pop esi
jmp 0x1001b01b
mov dword [ebp - 0xc], 0x97eede0b
mov dword [ebp - 0x10], ebx
jmp 0x1001af51
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x98], 0x38ca
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001af40
mov dword [ebp - 0xc], 0xfffffffa
jmp 0x1001b00e
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x20], 0xa9b27fa
mov dword [ebp - 0x10], ebx
jmp 0x1001af7f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001af75
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 8], ebx
je 0x1001afe4
mov eax, dword [ebp - 0xc]
xor edx, edx
imul eax, dword [ebp - 0xc]
cmp eax, 0xb653
mov eax, dword [ebp - 0xc]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, 0x2104
jl 0x1001afb3
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
cmp ecx, eax
mov eax, dword [ebp - 8]
setl dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x20]
setne cl
sub edx, ecx
sub edx, eax
mov eax, esi
jne 0x1001afe6
mov eax, ebx
xor edx, edx
cmp eax, 0x66ef3b06
mov eax, dword [ebp - 0x6c]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x6c]
jne 0x1001b005
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x4c], eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe9
je 0x1001af62
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1b
je 0x1001af34
cmp dword [ebp - 8], ebx
je 0x1001b030
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0x3899
jl 0x1001b077
cmp dword [ebp - 8], ebx
jne 0x1001b077
mov dword [ebp - 0x1c], 0x9c906054
mov dword [ebp - 8], ebx
jmp 0x1001b058
cmp dword [ebp - 0x4c], ebx
jne 0x1001b05e
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x10
jle 0x1001b050
mov dword [ebp - 8], 0xe
jmp 0x1001b06f
cmp dword [ebp - 0x1c], ebx
jne 0x1001b0c1
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff4
jge 0x1001b067
jmp 0x1001b0c1
mov dword [ebp - 8], ebx
jmp 0x1001b0bc
mov dword [ebp - 0xc], 3
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], ebx
jl 0x1001b0a3
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001b09e
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
dec dword [ebp - 0xc]
jns 0x1001b08b
mov dword [ebp - 0xc], ebx
jmp 0x1001b0b4
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x50], ebx
jne 0x1001b0b9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jle 0x1001b0a8
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x1001b07c
mov dword [ebp - 8], 9
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x10], ebx
jmp 0x1001b0e5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x94], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001b0d4
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001b107
push ebx
push 0x165a
call edi
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 8]
jge 0x1001b120
mov edx, esi
cmp dword [ebp - 8], ebx
jne 0x1001b122
mov edx, ebx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 8]
mov esi, dword [ebp - 8]
sub esi, eax
mov eax, dword [ebp - 8]
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp edx, eax
setl cl
xor edx, edx
imul ecx, dword [ebp - 8]
mov eax, dword [ebp - 8]
add esi, ecx
cmp esi, eax
mov eax, dword [ebp - 8]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
add ecx, 0xa6d8a72
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0xc], 0xb2cfb631
mov dword [ebp - 0x10], ebx
jmp 0x1001b17f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xec], 0x8c45
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001b16e
xor esi, esi
inc esi
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], ebx
jl 0x1001b1e6
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x1c], 0xc5d9b4e9
mov dword [ebp - 0x14], ebx
jmp 0x1001b1bf
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001b1bc
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1001b1a3
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0xec]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xec], ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0xc]
jns 0x1001b190
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001b20b
push ebx
push 0xfa4
push 0x448
push ebx
push 0x16ac
push 0x2529
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 8
pop eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xc], 0xd8d1
mov dword [ebp - 0x18], 0x3607a988
mov dword [ebp - 8], 0xa94fe874
mov dword [ebp - 0x14], 0x2bb6
mov dword [ebp - 0x10], ebx
jmp 0x1001b245
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x78], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001b23b
mov eax, dword [ebp - 0xc]
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x78], ecx
mov eax, dword [ebp - 0xc]
imul eax, ecx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov ecx, dword [ebp - 0xc]
setg dl
sub ecx, 0xb4aad9dd
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
setg al
cmp esi, eax
sbb eax, eax
neg eax
cmp eax, 0x198a
jne 0x1001b39a
mov dword [ebp - 0x24], 0x1510
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], 0xfffffffc
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jne 0x1001b30c
dec dword [ebp - 0xc]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
neg eax
push 0
sbb eax, eax
neg eax
mov eax, dword [ebp - 0x20]
pop eax
sete al
xor ecx, ecx
add eax, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
cmp eax, esi
setg cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x24]
test eax, eax
je 0x1001b336
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001b45b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x1001b45b
mov dword [ebp - 0x1c], 0x8616691c
mov dword [ebp - 0x20], 0xa52c43da
mov dword [ebp - 0xc], 0x1a
jmp 0x1001b38f
mov dword [ebp - 0x20], ebx
imul edx, dword [ebp - 0x78], 5
mov eax, dword [ebp - 0x74]
neg edx
sbb edx, edx
inc edx
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
sub ecx, eax
add ecx, 0x6a1e
imul edx, ecx, 9
xor ecx, ecx
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setle cl
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x1d
jg 0x1001b34d
jmp 0x1001b45b
mov dword [ebp - 0x20], 0x5f77832
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x10], ebx
jmp 0x1001b3be
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x108], 0x8cacf640
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001b3ad
mov dword [ebp - 8], ebx
jmp 0x1001b451
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x10], ebx
jmp 0x1001b3e6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x38], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001b3d8
cmp dword [ebp - 0x38], 0xfff7
mov eax, dword [ebp - 0x38]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x14]
setle dl
add ecx, edx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setle cl
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x108]
mov eax, dword [ebp - 0x20]
cmp edx, 0xaa0c7d0b
setne cl
xor edx, edx
sub ecx, eax
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
add ecx, eax
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setle dl
mov dword [ebp - 0x24], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1c
jg 0x1001b3cc
mov dword [ebp - 0x10], 0x897a4a12
mov dword [ebp - 0x10], ebx
jmp 0x1001b474
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x154], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001b467
mov dword [ebp - 0x10], ebx
jmp 0x1001b4a7
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001b495
push 0x220b
call edi
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001b4a4
push ebx
call dword [sym.imp.USER32.dll_CreateIconIndirect]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x1001b47f
mov dword [ebp - 0x24], 0xfff9
mov dword [ebp - 0x10], 0x3638ecf5
mov dword [ebp - 0x10], ebx
jmp 0x1001b4d1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13c], 0x42eb90da
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001b4c0
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001b4e6
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov dword [ebp - 0x10], ebx
jmp 0x1001b517
mov dword [ebp - 0x18], 0xc4530722
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x1001b514
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001b50f
push ebx
push 0x1f19
push ebx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
dec dword [ebp - 0x18]
jns 0x1001b4fa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x1001b4eb
mov dword [ebp - 0x18], 0xebe1552b
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x10], ebx
jmp 0x1001b540
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x164], 0x530de9bf
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1001b52f
mov dword [ebp - 0xc], 0xa
jmp 0x1001b582
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], 0xb
jmp 0x1001b579
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x1c], 0x97f0a290
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff1
jg 0x1001b562
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xc
je 0x1001b54f
mov dword [ebp - 0xc], 0x6bafcb14
mov dword [ebp - 0xc], 0x659d
mov dword [ebp - 0x14], 0xab61b583
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1001b5b6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf0], 0xfa8b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001b5a5
mov eax, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
imul eax, ecx, 0xe3e
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], ebx
jmp 0x1001b607
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001b604
push ebx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1001b5f5
mov dword [ebp - 8], 0x13ec752f
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0x1c], 0xe3c8
mov dword [ebp - 0xc], ebx
jmp 0x1001b648
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x84], 0x270e7ad5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001b637
mov dword [ebp - 0xc], ebx
jmp 0x1001b65d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x70], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x1001b653
mov eax, dword [ebp - 8]
cmp esi, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xab6d
setl cl
imul ecx, dword [ebp - 8]
cmp esi, ecx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 8]
sbb esi, esi
sub ecx, 0xd50f
xor edx, edx
inc esi
cmp ecx, eax
mov eax, dword [ebp - 8]
setge dl
xor ebx, ebx
cmp edx, esi
setle bl
xor ecx, ecx
cmp ebx, eax
setg cl
sub ecx, 0x7863
je 0x1001b6ac
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 8]
cmp eax, ecx
mov eax, dword [ebp - 0x84]
mov ecx, 0xfe04
setge dl
xor ebx, ebx
sub ecx, edx
add eax, ecx
mov ecx, dword [ebp - 0x84]
add ecx, eax
je 0x1001b6f2
cmp dword [ebp - 0x84], ebx
je 0x1001b6f2
xor esi, esi
inc esi
mov dword [ebp - 0x84], esi
mov eax, esi
jmp 0x1001b6fd
xor esi, esi
mov dword [ebp - 0x84], ebx
mov eax, ebx
inc esi
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0xac]
imul ecx, eax
xor eax, eax
cmp ecx, 0x13b1
setle al
xor ecx, ecx
cmp eax, 0xffff0314
mov eax, dword [ebp - 8]
setle cl
imul eax, ecx
test eax, eax
je 0x1001b734
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xac]
sub eax, 0x26ae
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x84], esi
mov dword [ebp - 0xc], 0xfffffffc
mov dword [ebp - 0x1c], 0x5c17
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x10], ebx
jmp 0x1001b785
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa0], 0xffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001b774
mov dword [ebp - 0xc], ebx
jmp 0x1001b7de
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001b7b0
push ebx
push 0x148b
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0xa0]
test eax, eax
setne cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jle 0x1001b790
mov dword [ebp - 0x10], ebx
jmp 0x1001b7f9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf8], 0x35c52658
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001b7e8
mov dword [ebp - 8], 0xbea12209
mov dword [ebp - 0x14], 0x7263b0a6
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1001b826
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe4], 0x7b1b0cad
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1001b815
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001b842
push ebx
push 0x1021
push ebx
call dword [sym.imp.GDI32.dll_GetBitmapBits]
mov eax, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
imul edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp edx, eax
setne cl
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xd8], esi
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
imul ecx, dword [ebp - 8]
add ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 8]
jle 0x1001b892
cmp dword [ebp - 0xd8], ebx
je 0x1001b892
cmp dword [ebp - 8], ebx
je 0x1001b892
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], 0xe2bba6da
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x1c], 0x764457c1
mov dword [ebp - 0x14], 5
jmp 0x1001b979
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x10], ebx
jmp 0x1001b8d8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x118], 0x85e3970c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1001b8c7
mov ecx, dword [ebp - 0xe4]
xor edx, edx
mov eax, dword [ebp - 0xd8]
cmp ecx, eax
mov eax, dword [ebp - 0xe4]
setg dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x114]
imul eax, dword [ebp - 0x20]
cmp eax, esi
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x114]
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0xc]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], ebx
jmp 0x1001b970
mov dword [ebp - 8], ebx
jmp 0x1001b967
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001b964
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jle 0x1001b951
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x1001b94c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x16
jg 0x1001b8bb
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001b99d
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
mov eax, dword [ebp - 0x44]
xor edx, edx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setl dl
xor ecx, ecx
add edx, 7
cmp edx, esi
setg cl
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x44]
cmp ecx, 0xd0b6
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0xffffffff
jle 0x1001b9d9
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x44]
test eax, eax
jne 0x1001b9ed
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x3c], ebx
je 0x1001b9ff
mov ecx, esi
cmp dword [ebp - 0x24], ebx
jne 0x1001ba01
mov ecx, ebx
xor eax, eax
test ecx, ecx
setne al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xf4], eax
test eax, eax
je 0x1001be54
mov dword [ebp - 0xc], ebx
jmp 0x1001ba35
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x34], 0xfff6
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x1001ba27
mov dword [ebp - 0xc], ebx
jmp 0x1001ba4d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x60], 0xf94f3783
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001ba3f
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x58], ebx
cmp dword [ebp - 0x58], 0xfffffffd
je 0x1001bbb9
push 0x189f
push ebx
call fcn.1001ea7f
pop ecx
pop ecx
mov dword [ebp - 0x10], 0xfffffff9
mov eax, 0x5e19f8c5
mov dword [ebp - 0x20], 0xf368a901
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x14], 0xa6fdd8fb
mov dword [ebp - 0x8c], 5
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
push 0xfffffffffffffff7
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x18], ebx
pop edi
jmp 0x1001beb9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x124], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001beac
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 0xffffffe9
jg 0x1001bfbf
mov dword [ebp - 0xc], 5
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x2c], 0x9855eec8
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], 0xdfa
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x18], ebx
jmp 0x1001bf19
cmp dword [ebp - 0x18], esi
jl 0x1001bf08
push 0xfffffffffffffff9
pop edi
push 4
mov dword [ebp - 0x2c], edi
mov dword [ebp - 8], ebx
pop ecx
jmp 0x1001bfda
cmp dword [ebp - 8], ecx
jl 0x1001bfcd