Function at 0x1001c452
Capabilities:
Check os version
Create pipe
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x100617c7
call fcn.10060ef0
sub esp, 0x2cc
push ebx
push esi
push edi
mov dword [ebp - 0x68], ecx
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], 0xfffc
push 3
mov dword [ebp - 0x3c], 0x758e92ed
pop edi
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x4c], 0x128b
mov dword [ebp - 0x44], 0x57af
push edi
mov dword [ebp - 0x80], edx
call fcn.1000ff33
xor ebx, ebx
lea ecx, [ebp - 0x1c8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], 0x86010944
push 2
call fcn.1000ff33
mov byte [ebp - 4], 1
mov dword [ebp - 0x20], ebx
jmp 0x1001c4da
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1f4], 0x996e1580
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1001c4c9
mov dword [ebp - 0x20], ebx
jmp 0x1001c4f8
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x154]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1001c4e5
mov dword [ebp - 0x20], ebx
jmp 0x1001c515
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c8]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1001c502
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001c52c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov eax, dword [ebp - 0x14]
mov ecx, 0x7adf
mov eax, dword [ebp - 0x14]
xor edx, edx
imul eax, dword [ebp - 0x14]
sub ecx, eax
add ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setle dl
neg edx
neg edx
sbb edx, edx
xor esi, esi
inc edx
inc esi
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 0x4a603d2c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x60], 0x491b
cmp dword [ebp - 0x60], 0x4998
jle 0x1001c61c
mov eax, ebx
mov dword [ebp - 0x3c], eax
mov edi, ebx
mov dword [ebp - 0x2c], ebx
mov ecx, edi
mov edx, ebx
sar eax, cl
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x28], eax
mov edi, edx
mov dword [ebp - 0x38], 0x439c
mov ecx, edi
shl eax, cl
lea ecx, [ebp - 0x280]
cdq
push edx
push eax
call fcn.1000d1e0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001c5d0
mov eax, dword [eax]
push eax
call fcn.1004bc16
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x280]
call fcn.100102bf
mov eax, dword [ebp - 0x28]
dec edi
dec dword [ebp - 0x38]
jne 0x1001c5b4
mov edx, dword [ebp - 0x40]
inc edx
mov dword [ebp - 0x40], edx
cmp edx, 0x21a2
jl 0x1001c5ab
mov edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
inc edi
mov dword [ebp - 0x2c], edi
cmp edi, 0x7e5e
jl 0x1001c59f
inc eax
mov dword [ebp - 0x3c], eax
cmp eax, 0x4df7
jl 0x1001c59a
push 3
pop edi
mov dword [ebp - 0x2c], 0xfffffffb
cmp dword [ebp - 0x60], 0x4643
jge 0x1001c637
push 0x10008b88
call fcn.1004bc16
pop ecx
push 2
lea ecx, [ebp - 0x160]
mov dword [ebp - 4], esi
call fcn.1000ff33
mov dword [ebp - 0x60], 0xfffffffc
mov dword [ebp - 0x28], ebx
jmp 0x1001c662
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x160]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1001c653
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x3c]
sub eax, 0x9842
jne 0x1001c726
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x14], ebx
jne 0x1001c68b
mov edx, ebx
cmp dword [ebp - 0x1e8], ebx
je 0x1001c68d
mov edx, esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, 0xfffffff6
ja 0x1001c6a1
cmp dword [ebp - 0x18], ebx
je 0x1001c6a8
mov eax, esi
cmp dword [ebp - 0x2c], ebx
jne 0x1001c6aa
mov eax, ebx
mov ecx, dword [ebp - 0x24]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x34]
push 9
cmp ecx, eax
pop ecx
setl dl
xor eax, eax
cmp edx, 0x23ee1e16
setle al
cmp ecx, eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x20]
jle 0x1001c6e0
mov eax, esi
cmp dword [ebp - 0x1e8], ebx
jne 0x1001c6e2
mov eax, ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
je 0x1001c6f7
mov eax, esi
cmp dword [ebp - 0x20], ebx
jne 0x1001c6f9
mov eax, ebx
cmp eax, dword [ebp - 0x44]
jg 0x1001c705
mov ecx, ebx
cmp dword [ebp - 0x48], ebx
je 0x1001c707
mov ecx, esi
mov eax, dword [ebp - 0x160]
xor edx, edx
cmp ecx, dword [eax + 4]
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x34]
mov ecx, ebx
jge 0x1001c728
mov ecx, esi
mov eax, dword [ebp - 0x154]
xor edx, edx
cmp ecx, dword [eax + 8]
mov eax, dword [ebp - 0x24]
sete dl
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x60], ecx
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
lea ecx, [ebp - 0x160]
setg dl
mov dword [ebp - 0x20], edx
call fcn.1000ffb5
lea ecx, [ebp - 0x1c8]
call fcn.1000ffb5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x154]
call fcn.1000ffb5
mov eax, dword [0x1060adc0]
test al, 1
jne 0x1001c80f
or eax, esi
mov dword [0x1060adc0], eax
push ebx
mov dword [ebp - 4], 6
push ebx
mov dword [0x1060ad80], ebx
mov dword [0x1060ad84], ebx
call fcn.1001ec96
mov dword [0x1060ad80], eax
mov dword [0x1060ad88], ebx
mov dword [0x1060ad90], ebx
mov byte [ebp - 4], 8
mov ecx, 0x1060ad88
mov dword [ebp - 0xd8], eax
lea eax, [ebp - 0xd8]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x1b0]
mov dword [0x1060ad9c], 0x3f800000
push eax
mov dword [0x1060ad8c], ebx
call fcn.1001ea6e
push 0x10062281
mov dword [0x1060ad94], 7
mov dword [0x1060ad98], 8
call fcn.1004bbec
or dword [ebp - 4], 0xffffffff
pop ecx
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], 0x1355fff
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x34], 0x36c93846
mov dword [ebp - 0x30], 0xe65f
mov dword [ebp - 0x14], ebx
jmp 0x1001c84a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x130], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001c83d
mov dword [ebp - 0x14], ebx
jmp 0x1001c866
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x220], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001c855
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001c882
push esi
push 0x3ad
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
inc dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x130]
cmp eax, edi
mov eax, dword [ebp - 0x28]
setl cl
neg eax
sub eax, ecx
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x130]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x1001c8b8
cmp dword [ebp - 0x3c], ebx
jne 0x1001c8ba
mov esi, ebx
mov eax, dword [ebp - 0x28]
imul eax, esi
cmp eax, dword [ebp - 0x3c]
jne 0x1001c8c8
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x220]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
push 0xfffffffffffffff9
setg dl
imul eax, dword [ebp - 0x68], 0x2710
mov dword [ebp - 0x30], edx
xor ecx, ecx
pop esi
add eax, dword [ebp - 0x80]
inc ecx
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x30], 0x67c28cae
mov dword [ebp - 0x28], ebx
jmp 0x1001c929
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x19c], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x1001c91c
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x2c]
test eax, eax
jne 0x1001c943
mov eax, ebx
cmp dword [ebp - 0x2c], ebx
je 0x1001c945
mov eax, ecx
mov ecx, dword [ebp - 0x2c]
add ecx, eax
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
neg eax
neg ecx
sub eax, ecx
neg eax
sbb eax, eax
inc eax
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x14]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
add eax, 0xfffa
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], ebx
jmp 0x1001c9a1
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001c99e
push ebx
push 0x6d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1001c98a
lea eax, [ebp - 0x84]
push eax
call fcn.1001e385
push 1
lea ecx, [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
call fcn.1000ff33
mov dword [ebp - 0x34], ebx
xor edx, edx
mov dword [ebp - 0x2c], 0xc0d1
inc edx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x30], 0x254f8d3
mov dword [ebp - 0x44], 0xfffffffb
mov dword [ebp - 0x28], ebx
jmp 0x1001ca07
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x90]
mov dword [eax + ecx*4], 0x6da5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x1001c9f4
mov esi, dword [ebp - 0x90]
cmp dword [esi], ebx
je 0x1001ca2d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], 0xffffffff
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x90]
mov eax, edx
jmp 0x1001ca2f
mov eax, ebx
push 9
pop ecx
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, dword [esi]
setg cl
cmp ecx, dword [ebp - 0x2c]
jne 0x1001ca48
cmp dword [ebp - 0x2c], ebx
jne 0x1001ca4a
mov edx, ebx
cmp edx, 9
mov dword [ebp - 0x34], 0xffff
sbb eax, eax
inc eax
neg eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
neg eax
sub eax, ecx
neg eax
sbb eax, eax
inc eax
sub ecx, eax
xor eax, eax
cmp ecx, 0x7440e708
setne al
xor edx, edx
cmp eax, 0xe6da
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
neg edx
cmp eax, edx
setl cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x90]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp dword [edx], ecx
setg al
xor esi, esi
inc esi
cmp eax, esi
jl 0x1001cac9
cmp dword [ebp - 0x30], ebx
mov ecx, ebx
mov edx, dword [ebp - 0x90]
je 0x1001cacb
mov ecx, esi
xor eax, eax
cmp ecx, dword [edx]
setle al
mov dword [ebp - 0x44], eax
mov eax, dword [edx]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x1001caeb
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], ebx
jmp 0x1001cafb
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001cafb
push ebx
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea ecx, [ebp - 0x90]
call fcn.1000ffb5
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x1001cffa
mov dword [ebp - 0x14], 0x7ddc85f7
mov ecx, 0x46158d32
mov dword [ebp - 0xf8], ecx
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0x30], 0x5a06c0f1
mov dword [ebp - 0x44], 0xe8bf
mov dword [ebp - 0x14], 0xfffffffc
cmp dword [ebp - 0x14], 0xb
jne 0x1001ccc5
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x28], ebx
jmp 0x1001cb74
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x118], 0xfffffff8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1001cb63
mov dword [ebp - 0x2c], ebx
jmp 0x1001ccac
mov dword [ebp - 0x28], 0x962ee6d0
mov dword [ebp - 0x28], ebx
jmp 0x1001cc8c
mov dword [ebp - 0x18], 0x5c6eff3d
mov dword [ebp - 0x24], 0xf79b347d
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x1001cc89
mov dword [ebp - 0x20], 0x136ef6f0
mov dword [ebp - 0x20], ebx
jmp 0x1001cbc4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x70], 0x9f8d19c9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1001cbb6
mov dword [ebp - 0x6c], ebx
jmp 0x1001cc54
mov dword [ebp - 0x34], 0xa3c3d214
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], ebx
je 0x1001cbf3
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xf8], edx
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x30]
cmp edx, eax
setne cl
xor eax, eax
sub ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x14]
cmp ecx, esi
setg al
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x20], ebx
jmp 0x1001cc4c
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001cc49
push 0x9a9
push 0x26af
call dword [sym.imp.GDI32.dll_RestoreDC]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x1001cc30
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], edi
jle 0x1001cbd2
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001cc80
push 0x1978
push 0x1d93
push 0x187b
push 0xefc
call dword [sym.imp.GDI32.dll_CreateRectRgn]
dec dword [ebp - 0x18]
jns 0x1001cbaa
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x1001cb90
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xf8], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x1001cb81
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xb
je 0x1001cb54
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], 0x426e
cmp dword [ebp - 0x34], 0x4561
mov dword [ebp - 0xb0], eax
jle 0x1001cd54
mov dword [ebp - 0x18], ebx
mov edx, ebx
mov dword [ebp - 0x3c], ebx
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x24], ebx
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x250]
and eax, edx
and eax, dword [ebp - 0x18]
cdq
push edx
push eax
call fcn.1000d1e0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001cd0b
mov eax, dword [eax]
push eax
call fcn.1004bc16
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x250]
call fcn.100102bf
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x3c]
inc ecx
mov dword [ebp - 0x24], ecx
cmp ecx, 0x3c93
jl 0x1001ccea
inc edi
cmp edi, 0x61ac
jl 0x1001cce5
inc edx
mov dword [ebp - 0x3c], edx
cmp edx, 0x77f3
jl 0x1001cce3
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x207c
jl 0x1001ccde
cmp dword [ebp - 0x34], 0x4240
jge 0x1001cd68
push 0x10008bf0
call fcn.1004bc16
pop ecx
or dword [ebp - 4], 0xffffffff
xor edx, edx
mov dword [ebp - 0x2c], 0x2ba39464
inc edx
mov dword [ebp - 0x14], 0xfffd
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x30], 0x4171b3fe
mov dword [ebp - 0x18], ebx
jmp 0x1001cd9a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x50], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1001cd8c
mov dword [ebp - 0x2c], ebx
mov edi, 0x10609cb8
cmp dword [ebp - 0x2c], ebx
jl 0x1001e224
mov dword [ebp - 0x20], 0x17f75960
mov dword [ebp - 0x28], 0x2ca3c0bf
mov dword [ebp - 0x40], 0xb15b
mov dword [ebp - 0x20], ebx
jmp 0x1001cde2
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x50], ecx
mov dword [ebp - 0x28], 2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1001cdca
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001cdf7
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jg 0x1001cff2
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x1001cf36
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x50]
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
mov dword [ebp - 0x40], ecx
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001cf07
mov dword [ebp - 0x34], 0x10e6
cmp dword [ebp - 0x34], 0x12e0
jle 0x1001cee0
push 0x89b
push 0x1c2f
push ebx
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
mov dword [ebp - 0x18], ebx
mov edx, ebx
mov dword [ebp - 0x3c], ebx
mov esi, ebx
mov ecx, ebx
mov dword [ebp - 0x24], ebx
mov eax, esi
shl eax, cl
mov ecx, edi
and eax, edx
and eax, dword [ebp - 0x18]
cdq
push edx
push eax
call fcn.1000fe1e
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x3c]
inc ecx
mov dword [ebp - 0x24], ecx
cmp ecx, 0x75e
jl 0x1001ce98
inc esi
cmp esi, 0x1bab
jl 0x1001ce93
inc edx
mov dword [ebp - 0x3c], edx
cmp edx, 0x4fb
jl 0x1001ce91
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x389c
jl 0x1001ce8c
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 4], 0xb
cmp dword [ebp - 0x34], 0xe94
jge 0x1001cf03
mov edx, 0x10008c68
mov ecx, edi
call fcn.100118c8
or dword [ebp - 4], 0xffffffff
dec dword [ebp - 0x28]
jmp 0x1001ce14
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x14]
cmp eax, 0x2d14a59
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
add ecx, 0x24956218
cmp ecx, esi
setle dl
imul edx, dword [ebp + eax*4 - 0x50]
imul edx, dword [ebp - 0x50]
test edx, edx
jne 0x1001cf73
cmp dword [ebp - 0x28], ebx
jne 0x1001cf73
mov eax, ebx
jmp 0x1001cf76
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x40]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp eax, ecx
mov eax, dword [ebp - 0x40]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
imul edx, dword [ebp + eax*4 - 0x50]
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0xc5cecce0
je 0x1001cfbe
cmp dword [ebp - 0x38], ebx
jne 0x1001cfbe
mov edx, ebx
jmp 0x1001cfc1
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xfffffffe
setg al
xor edx, edx
imul eax, dword [ebp - 0x30]
imul ecx, eax, 0x5e2
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setne dl
mov dword [ebp - 0x44], edx
inc dword [ebp - 0x20]
jmp 0x1001cdfa
dec dword [ebp - 0x2c]
jmp 0x1001cda7
mov dword [ebp - 0x14], 0xfffffffe
lea ecx, [ebp - 0xbc]
push esi
call fcn.1000ff33
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x28], 0x3c7d7575
mov dword [ebp - 0x24], 0x1af5
cmp dword [ebp - 0x24], 0x1d66
jle 0x1001d0c8
mov dword [ebp - 0x38], ebx
mov ecx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov esi, ebx
mov eax, edi
cdq
idiv esi
mov eax, ecx
lea ecx, [ebp - 0x268]
sub eax, edx
xor eax, dword [ebp - 0x38]
cdq
push edx
push eax
call fcn.1000d1e0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001d074
mov eax, dword [eax]
push eax
call fcn.1004bc16
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x268]
call fcn.100102bf
mov ecx, dword [ebp - 0x18]
inc esi
cmp esi, 0x5b7f
jl 0x1001d050
inc edi
cmp edi, 0x46f3
jl 0x1001d04e
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x5e3a
jl 0x1001d04c
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 0x4915
jl 0x1001d047
push 0xc01
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 3
pop edi
mov dword [ebp - 0x14], ebx
jmp 0x1001d0e0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xbc]
mov dword [eax + ecx*4], 0xcc895931
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1001d0cd
cmp dword [ebp - 0x24], 0x1868
jge 0x1001d0fa
push 0x10008ca8
call fcn.1004bc16
pop ecx
mov dword [ebp - 0x14], ebx
jmp 0x1001d10c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe8], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1001d0ff
mov dword [ebp - 0x14], 0xa
cmp dword [ebp - 0x14], 0x18
jne 0x1001d1c1
mov esi, 0x55145ccb
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1001d141
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x238], 0x29be1d92
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1001d130
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x1001d1b4
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], ebx
jmp 0x1001d1aa
mov dword [ebp - 0x198], esi
mov dword [ebp - 0x194], esi
mov dword [ebp - 0x190], esi
mov dword [ebp - 0x18c], esi
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001d18a
push ebx
push ebx
push 0x1de9
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x238]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
mov dword [ebp - 0x18c], edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x1001d15b
dec dword [ebp - 0x18]
jns 0x1001d14f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x18
je 0x1001d128
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xbc]
cmp dword [eax], ebx
jne 0x1001d207
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0xbc]
setne dl
sub edx, dword [eax]
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
inc edx
imul eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x40]
mov dword [ebp - 0x24], 1
cmp dword [ebp - 0x24], ebx
jne 0x1001d207
mov eax, ebx
jmp 0x1001d20a
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xbc]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
mov esi, dword [eax]
cmp edx, esi
setne cl
xor eax, eax
cmp ecx, esi
setne al
imul eax, eax, 0xef21
test eax, eax
jne 0x1001d23e
test esi, esi
jne 0x1001d23e
mov edx, ebx
jmp 0x1001d241
xor edx, edx
inc edx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0xbc]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xe8], eax
or dword [ebp - 4], 0xffffffff
call fcn.1000ffb5
mov eax, dword [0x1060adc0]
test al, 2
jne 0x1001d2fc
or eax, 2
mov dword [0x1060adc0], eax
push 0x10
pop esi
push ebx
mov dword [ebp - 4], esi
push ebx
mov dword [0x1060ada0], ebx
mov dword [0x1060ada4], ebx
call fcn.1001ec96
mov dword [0x1060ada0], eax
mov dword [0x1060ada8], ebx
mov dword [0x1060adb0], ebx
mov byte [ebp - 4], 0x12
mov ecx, 0x1060ada8
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x11c]
push eax
push esi
push ebx
lea eax, [ebp - 0x1a0]
mov dword [0x1060adbc], 0x3f800000
push eax
mov dword [0x1060adac], ebx
call fcn.1001ea6e
push 0x1006227c
mov dword [0x1060adb4], 7
mov dword [0x1060adb8], 8
call fcn.1004bbec
or dword [ebp - 4], 0xffffffff
pop ecx
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x30], 0x925b0e44
mov dword [ebp - 0x30], 0x2887cf2e
mov dword [ebp - 0x18], ebx
jmp 0x1001d327
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1ac], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1001d316
mov dword [ebp - 0x28], 0x16
jmp 0x1001d33e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jg 0x1001d335
dec dword [ebp - 0x1a8]
lea ecx, [ebp - 0xc8]
xorps xmm0, xmm0
push 1
movdqu xmmword [ebp - 0x114], xmm0
call fcn.1000ff33
xor edx, edx
inc edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x24], 0xac3a6081
mov dword [ebp - 0x20], ebx
jmp 0x1001d382
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc8]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1001d373
mov dword [ebp - 0x20], ebx
jmp 0x1001d396
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x7c], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1001d38c
mov dword [ebp - 0x20], ebx
jmp 0x1001d3b1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x228], 5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1001d3a0
mov eax, dword [ebp - 0xc8]
cmp dword [eax], ebx
je 0x1001d3cb
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x34]
mov eax, edx
jne 0x1001d3cd
mov eax, ebx
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
add eax, 0x9cca3f22
cmp eax, dword [ebp - 0x74]
jle 0x1001d3e4
mov esi, edx
cmp dword [ebp - 0x74], ebx
jne 0x1001d3e6
mov esi, ebx
mov eax, dword [ebp - 0xc8]
xor ecx, ecx
push 6
mov edx, dword [eax]
mov eax, dword [ebp - 0x74]
cmp esi, eax
mov eax, dword [ebp - 0xc8]
setle cl
imul ecx, edx
imul ecx, edx
mov edx, dword [eax]
mov dword [ebp - 0x24], ecx
mov ecx, edx
mov eax, dword [ebp - 0x24]
sub ecx, eax
add ecx, 0x4038a26
xor eax, eax
cmp ecx, edx
setle al
xor ecx, ecx
cmp eax, edx
pop eax
setge cl
sub eax, ecx
je 0x1001d434
test edx, edx
je 0x1001d434
xor eax, eax
inc eax
jmp 0x1001d436
mov eax, ebx
mov edx, dword [ebp - 0x74]
xor ecx, ecx
imul eax, eax, 0xd46
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x34]
setle cl
sub edx, ecx
lea ecx, [ebp - 0xc8]
neg edx
sbb edx, edx
inc edx
add eax, edx
mov dword [ebp - 0x7c], eax
call fcn.1000ffb5
lea eax, [ebp - 0x68]
push eax
call fcn.1001e3e7
xor ecx, ecx
mov esi, dword [eax]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x30], 0xe6e83846
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xabe8f210
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0x247fa990
mov eax, dword [ebp - 0x14]
setge cl
mov dword [ebp - 0x2c], esi
neg ecx
xor edx, edx
cmp eax, ecx
setge dl
xor ecx, ecx
imul edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x24]
je 0x1001d594
mov dword [ebp - 0x14], 0xfffffff8
cmp dword [ebp - 0x14], 0x16
jge 0x1001d5b1
mov dword [ebp - 0x24], 0x40ab
cmp dword [ebp - 0x24], 0x4182
jle 0x1001d545
mov eax, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov esi, ebx
lea ecx, [esi + edi]
sar eax, cl
lea ecx, [ebp - 0x298]
cdq
push edx
push eax
call fcn.1000d1e0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001d510
mov eax, dword [eax]
push eax
call fcn.1004bc16
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x298]
call fcn.100102bf
mov eax, dword [ebp - 0x18]
inc esi
cmp esi, 0x4551
jl 0x1001d4f3
inc edi
cmp edi, 0x1339
jl 0x1001d4f1
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x5eee
jl 0x1001d4ef
mov byte [ebp - 0x19], bl
cmp dword [ebp - 0x24], 0x3cc6
jge 0x1001d55c
push 0x10008d50
call fcn.1004bc16
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x19], 0
je 0x1001d58c
push ebx
push 0x395
push 0x734
push 0xc21
push 0x1c42
push 0x2502
push 0x2486
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
inc dword [ebp - 0x14]
jmp 0x1001d4d0
mov dword [ebp - 0x14], 0x351a9382
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], al
je 0x1001d5b4
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1001d5b4
mov esi, dword [ebp - 0x2c]
mov al, byte [ebp + 0xc]
test al, al
jne 0x1001d5c3
test esi, esi
jne 0x1001d65e
lea ecx, [ebp - 0x2d8]
mov dl, al
push ecx
mov ecx, dword [ebp - 0x68]
call fcn.1001203b
cmp byte [ebp + 0xc], 0
lea edi, [ebp - 0x114]
mov esi, eax
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x1001d65b
cmp dword [ebp - 0x10c], 0
je 0x1001d65b
push 3
mov dword [ebp - 0x18], ebx
pop edi
jmp 0x1001d609
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd4], 0xad313dd3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1001d5f8
mov dword [ebp - 0xd4], 0xffffffff
jmp 0x1001d63a
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001d634
push 0xccf
push 0x657
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
inc dword [ebp - 0xd4]
cmp dword [ebp - 0xd4], 0x11
jl 0x1001d61a
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xa8], eax
mov esi, dword [ebp - 0x2c]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000bdc0]
lea eax, [ebp - 0x1f4]
push eax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x14], ebx
push eax
push ebx
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], ebx
movdqu xmmword [ebp - 0x204], xmm0
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
call fcn.10011de7
mov dword [ebp - 0x14], 0x7e2799ac
cmp dword [ebp - 0x14], ebx
je 0x1001d6cd
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x14], 0xfffffffb
jmp 0x1001d6c5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xb
jne 0x1001d6bc
jmp 0x1001d6ee
mov dword [ebp - 0x30], 0xffffffff
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xe4]
mov dword [eax], ecx
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001d6ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0xe4]
call fcn.1000ffb5
test esi, esi
jne 0x1001df95
cmp dword [ebp - 0x114], esi
jle 0x1001df95
push 4
lea ecx, [ebp - 0x13c]
call fcn.1000ff33
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x24], 0x5a9f
cmp dword [ebp - 0x24], 0x5e80
jle 0x1001d778
mov edi, ebx
mov esi, ebx
mov eax, esi
lea ecx, [ebp - 0x2c8]
xor eax, edi
cdq
push edx
push eax
call fcn.1000d1e0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001d751
mov eax, dword [eax]
push eax
call fcn.1004bc16
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c8]
call fcn.100102bf
inc esi
cmp esi, 0x456f
jl 0x1001d735
inc edi
cmp edi, 0x3f13
jl 0x1001d733
mov dword [ebp - 0x38], 0xa37d
cmp dword [ebp - 0x24], 0x5711
jge 0x1001d793
push 0x10008d70
call fcn.1004bc16
pop ecx
mov dword [ebp - 0x24], 0xe44fa3fd
mov dword [ebp - 0x40], 0xb35f1971
mov dword [ebp - 0x14], ebx
jmp 0x1001d7b7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x98], 0xf47a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001d7a6
mov dword [ebp - 0x14], ebx
jmp 0x1001d7d5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x13c]
mov dword [eax + ecx*4], 0x1ece3051
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001d7c2
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x13c]
mov eax, dword [esi + 4]
neg eax
cmp dword [ebp - 0x98], eax
jne 0x1001d7fe
cmp dword [esi + 4], ebx
je 0x1001d7fe
xor edi, edi
inc edi
jmp 0x1001d800
mov edi, ebx
mov ecx, dword [ebp - 0x94]
xor edx, edx
mov eax, dword [ebp - 0x98]
cmp eax, ecx
mov eax, dword [ebp - 0x94]
setge dl
xor ecx, ecx
cmp eax, edi
setne cl
xor eax, eax
cmp edx, ecx
lea ecx, [ebp - 0x13c]
setl al
mov dword [esi + 4], eax
or esi, 0xffffffff
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x24], 0xfffffffb
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
imul eax, dword [ebp - 0x40], 6
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], esi
call fcn.1000ffb5
mov dword [ebp - 0x14], 0xd837bc75
push 3
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], ebx
pop edi
jmp 0x1001d878
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa4], 0x624039b6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1001d867
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001d898
push ebx
push ebx
push 0x17bd
push 0x1e04
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x1001d9a1
mov dword [ebp - 0x20], 0x1c0f8067
mov dword [ebp - 0x18], ebx
jmp 0x1001d8be
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x64], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1001d8b4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0xa4]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa4], ecx
mov dword [ebp - 0x20], 0x19
jmp 0x1001d98e
mov dword [ebp - 0x18], 0xfffa
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x30], 0x47aa
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x1001d92d
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x20], ebx
je 0x1001d91d
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0xa4], ebx
je 0x1001d91d
xor ecx, ecx
inc ecx
jmp 0x1001d91f
mov ecx, ebx
mov eax, dword [ebp - 0xa0]
add eax, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
je 0x1001d93c
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xa4]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], ebx
jne 0x1001d96e
cmp dword [ebp - 0x30], ebx
jne 0x1001d96e
mov ecx, ebx
jmp 0x1001d971
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0xa0]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x64]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe6
jge 0x1001d8e4
dec dword [ebp - 0x14]
jns 0x1001d8a8
mov dword [ebp - 0x20], 0xb5a5efa2
lea ecx, [ebp - 0x178]
push 4
call fcn.1000ff33
push edi
lea ecx, [ebp - 0x148]
mov dword [ebp - 4], 0x18
call fcn.1000ff33
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x30], 0x3d87e3bc
mov dword [ebp - 0x14], ebx
jmp 0x1001d9ea
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x178]
mov dword [eax + ecx*4], 0x5251c607
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001d9d7
xor esi, esi
mov dword [ebp - 0x14], ebx
inc esi
cmp dword [ebp - 0x14], edi
jge 0x1001da0c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x148]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
jmp 0x1001d9f6
mov eax, dword [ebp - 0x20]
mov edx, esi
cmp dword [ebp - 0x20], ebx
jne 0x1001da18
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x178]
setg cl
xor edx, edx
mov dword [eax], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x148]
setle dl
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x20]
cmp eax, edx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
setle cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001da8f
push 0x7ff
push ebx
push ebx
push 0x250a
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x148]
call fcn.1000ffb5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x178]
call fcn.1000ffb5
mov dword [ebp - 0x18], ebx
jmp 0x1001dabc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5c], 0x831713b9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001daae
mov dword [ebp - 0x5c], 0xfffffffb
jmp 0x1001dad9
mov dword [ebp - 0x30], 0xe8384627
cmp dword [ebp - 0x30], ebx
jne 0x1001dadf
dec dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 0xfffffff5
jle 0x1001daca
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x1001df92
mov dword [ebp - 0x24], 0x122a
cmp dword [ebp - 0x24], 0x14e7
jle 0x1001db65
mov ecx, ebx
mov dword [ebp - 0x18], ebx
mov eax, ebx
mov dword [ebp - 0x38], ebx
mov edi, ebx
add eax, ecx
lea ecx, [ebp - 0x2b0]
xor eax, edi
cdq
push edx
push eax
call fcn.1000d1e0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001db28
mov eax, dword [eax]
push eax
call fcn.1004bc16
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x2b0]
call fcn.100102bf
mov eax, dword [ebp - 0x38]
inc edi
mov ecx, dword [ebp - 0x18]
cmp edi, 0x209e
jl 0x1001db0c
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 0x4a4e
jl 0x1001db0a
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x7573
jl 0x1001db05
push 3
pop edi
cmp dword [ebp - 0x24], 0xe75
jge 0x1001db79
push 0x10008de8
call fcn.1004bc16
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0x20], 0x19ac196a
mov dword [ebp - 0x30], 0x962600bf
mov dword [ebp - 0x48], 0xc9c6c2cf
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 2
jge 0x1001dbb5
push 9
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x58], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001dba5
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
cmp dword [ebp - 0x14], edi
jge 0x1001dbcf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1d4], edx
inc dword [ebp - 0x14]
jmp 0x1001dbbb
mov dword [ebp - 0x14], ebx
mov edi, 0x10609cb8
cmp dword [ebp - 0x14], edx
jg 0x1001de05
mov dword [ebp - 0x30], 0x2d748aee
xor ecx, ecx
mov dword [ebp - 0x30], 0x983ca307
mov dword [ebp - 0x30], 0x27f44fb6
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x1e4], 0xd89188b9
mov dword [ebp - 0x1e0], 0xd89188b9
mov dword [ebp - 0x1dc], 0xd89188b9
mov dword [ebp - 0x1d8], 0xd89188b9
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x58]
cmp eax, 0xdc75
setne cl
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], ebx
jl 0x1001ddfd
mov dword [ebp - 0x30], edx
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 0x30], 0x232c2a4e
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 0x71fda660
push 3
call fcn.1000ff33
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x34], 0x71e6
cmp dword [ebp - 0x34], 0x732e
jle 0x1001dcc9
mov dword [ebp - 0x38], ebx
mov esi, ebx
mov ecx, ebx
mov ebx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov eax, esi
cdq
idiv ecx
mov ecx, edi
and edx, ebx
mov eax, edx
cdq
push edx
push eax
call fcn.1000fe1e
mov ecx, dword [ebp - 0x24]
inc ecx
mov dword [ebp - 0x24], ecx
cmp ecx, 0x10d9
jl 0x1001dc8d
inc esi
push 0
pop ebx
cmp esi, 0x15c3
jl 0x1001dc85
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 0x1f83
jl 0x1001dc83
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x34], 0x6ed1
jge 0x1001dd05
mov edx, 0x10008e14
mov ecx, edi
call fcn.100118c8
jmp 0x1001dd05
mov dword [ebp - 0x18], ebx
jmp 0x1001dd1d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1bc]
mov dword [eax + ecx*4], 0x42d63d2c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001dd0a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x58]
cmp eax, dword [ebp - 0x14]
je 0x1001ddce
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x58], 0xfe0cd1b7
jb 0x1001dd4d
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x58], ebx
jne 0x1001dd4d
mov edx, ebx
jmp 0x1001dd50
xor edx, edx
inc edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x58]
cmp edx, eax
setl cl
mov dword [ebp - 0x1cc], ecx
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x14]
add edx, ecx
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x58]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
cmp ecx, 0x5e97312b
mov eax, dword [ebp + eax*4 - 0x58]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x58], 4
mov eax, dword [ebp - 0x14]
sbb ecx, ecx
xor edx, edx
neg ecx
mov eax, dword [ebp + eax*4 - 0x58]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x58]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
cmp ecx, dword [ebp + eax*4 - 0x58]
jge 0x1001ddce
mov eax, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x58]
cmp eax, 1
setne cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x1bc]
dec dword [ebp - 0x48]
or dword [ebp - 4], 0xffffffff
call fcn.1000ffb5
dec dword [ebp - 0x20]
xor edx, edx
inc edx
jmp 0x1001dc3b
inc dword [ebp - 0x14]
jmp 0x1001dbd7
mov ecx, dword [ebp - 0x4c]
call fcn.1001c406
xor esi, esi
mov dword [ebp - 0x28], 0x3c4ab274
inc esi
mov dword [ebp - 0x2c], eax
push esi
lea ecx, [ebp - 0x128]
call fcn.1000ff33
mov dword [ebp - 4], 0x1e
lea ecx, [ebp - 0x104]
movdqa xmm0, xmmword [0x1000bd70]
mov dword [ebp - 0x38], 0xfffffffd
push 9
pop eax
push dword [ebp + 8]
mov dword [ebp - 0x18], 0xbfa32a17
mov dword [ebp - 0x24], 0x7fce6bb2
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x44], 0xfffe
push eax
push ebx
movdqu xmmword [ebp - 0x214], xmm0
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0xfc], ebx
call fcn.10011de7
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x18], ebx
jmp 0x1001dec2
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x128]
mov dword [eax + ecx*4], 0x7e2f9d44
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001deaf
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x128]
mov dword [eax], ebx
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x28], eax
je 0x1001deec
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov ecx, 0xffff
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x128]
setne dl
mov dword [ebp - 0x30], edx
mov dword [eax], edx
xor edx, edx
cmp dword [ebp - 0x30], 0x254f8d36
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x17c]
jl 0x1001df36
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
neg eax
cmp eax, 0xdae4
jne 0x1001df53
mov eax, dword [ebp - 0x104]
cmp dword [eax + 4], ebx
jne 0x1001df53
mov esi, ebx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp esi, eax
setle cl
xor eax, eax
cmp ecx, 6
lea ecx, [ebp - 0x104]
setl al
mov dword [ebp - 0x18], eax
call fcn.1000ffb5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x128]
call fcn.1000ffb5
lea eax, [ebp - 0x68]
push eax
call fcn.1001e3e7
mov esi, dword [ebp - 0x2c]
mov dword [eax], esi
jmp 0x1001df9a
mov esi, dword [ebp - 0x2c]
mov edi, 0x10609cb8
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x4c], 0x5ec4
cmp dword [ebp - 0x4c], 0x6141
jle 0x1001dff6
mov dword [ebp - 0x48], ebx
mov eax, ebx
mov dword [ebp - 0x34], 0x6a4f
mov dword [ebp - 0x24], eax
mov esi, eax
mov ebx, 0x3db8
mov eax, esi
mov ecx, edi
cdq
push edx
push eax
call fcn.1000fe1e
inc esi
dec ebx
jne 0x1001dfc7
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x48]
add eax, esi
dec dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
jne 0x1001dfc0
inc esi
mov dword [ebp - 0x48], esi
cmp esi, 0x480a
jl 0x1001dfb4
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0x1f
cmp dword [ebp - 0x4c], 0x5ea8
jge 0x1001e019
mov edx, 0x10008e68
mov ecx, edi
call fcn.100118c8
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], 0x7f4a7d2a
mov dword [ebp - 0x44], 0xc0ec0dce
mov dword [ebp - 0x18], ebx
jmp 0x1001e06b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x16c], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001e05a
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x1001e0ac
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001e0a7
push ebx
push 0xd67
push 0x1b7c
push 0x1c35
push 0x87
push 0x1165
push ebx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
dec dword [ebp - 0x14]
jns 0x1001e07d
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x1001e15c
mov dword [ebp - 0x20], 0xc34eea2a
mov dword [ebp - 0x24], 0xfeae2151
mov dword [ebp - 0x24], 0xfffffffc
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x20]
je 0x1001e0e6
cmp dword [ebp - 0x20], ebx
je 0x1001e0e6
xor edx, edx
inc edx
jmp 0x1001e0e8
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, 0x3847
setl al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, 0x86f2
imul eax, dword [ebp - 0x20]
test eax, eax
jne 0x1001e113
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x24], eax
je 0x1001e12c
cmp dword [ebp - 0x30], ebx
je 0x1001e12c
xor edx, edx
inc edx
jmp 0x1001e12e
mov edx, ebx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x16c], ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x14]
jns 0x1001e0bc
lea ecx, [ebp - 0x114]
call fcn.1001850d
cmp dword [ebp - 0x3c], 0
jne 0x1001e224
test esi, esi
je 0x1001e224
mov dword [ebp - 0x4c], 0x4a47
cmp dword [ebp - 0x4c], 0x4add
jle 0x1001e1e4
mov esi, ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x24], 0x1ab6
mov esi, ebx
mov ebx, dword [ebp - 0x64]
mov eax, esi
mov ecx, edi
xor eax, ebx
cdq
push edx
push eax
call fcn.1000fe1e
inc esi
cmp esi, 0x13ce
jl 0x1001e1a0
mov eax, dword [ebp - 0x34]
add ebx, eax
dec dword [ebp - 0x24]
push 0
mov dword [ebp - 0x64], ebx
pop ebx
jne 0x1001e19b
mov esi, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x34], eax
cmp eax, 0xffff998f
jg 0x1001e191
inc esi
mov dword [ebp - 0x48], esi
cmp esi, 0x1bc0
jl 0x1001e18e
mov esi, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x80]
mov ecx, esi
call fcn.1001c448
mov esi, eax
mov dword [ebp - 4], 0x21
cmp dword [ebp - 0x4c], 0x4810
mov dword [ebp - 0xb0], esi
jge 0x1001e212
mov edx, 0x10008e88
mov ecx, edi
call fcn.100118c8
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x84]
push eax
call fcn.1001e385
mov dword [eax], esi
mov eax, dword [ebp + 8]
lea esi, [ebp - 0xb0]
mov ecx, dword [ebp - 0xc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret