Function at 0x1000a5d4
Capabilities:
Delete registry key
Query environment variable
Query or enumerate registry key
Read .ini file

Disassembly:
mov eax, 0x1006b96f
call fcn.1006b188
sub esp, 0x78c
push ebx
push esi
push edi
push 2
pop eax
mov dword [ebp - 0x4c], ecx
mov edi, 0xd23b6182
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x2f8]
push eax
mov byte [ebp - 0x6d], dl
call fcn.1001803e
xor ebx, ebx
push 2
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x1000a621
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2f8]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000a60e
push 1
pop edx
cmp dword [ebp - 0x10], ebx
je 0x1000a638
mov eax, dword [ebp - 0x10]
mov ecx, edx
cmp eax, dword [ebp - 0x10]
jne 0x1000a63a
mov ecx, ebx
mov eax, dword [ebp - 0x10]
sub ecx, eax
je 0x1000a644
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
cmp eax, 0xb0b4
setne cl
cmp ecx, dword [ebp - 0x10]
jg 0x1000a65e
cmp dword [ebp - 0x10], ebx
jne 0x1000a660
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp eax, edx
mov eax, 0x90da1152
setg cl
cmp eax, ecx
mov eax, dword [ebp - 0x2f8]
sbb ecx, ecx
inc ecx
mov dword [eax + 4], ecx
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], bl
je 0x1000a69d
push ebx
push 0xb03
push ebx
push 0x25f9
push ebx
push 0x1d45
call dword [sym.imp.USER32.dll_DrawTextExW]
lea ecx, [ebp - 0x2f8]
call fcn.10017f89
mov dword [ebp - 0x10], 4
xor ecx, ecx
mov dword [ebp - 0x18], 0x1a0e1c2a
inc ecx
push 2
mov dword [ebp - 0x50], 0x26243a5d
pop esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x1000a6e0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x78], 0x6ce1a812
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000a6d2
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x78]
cmp eax, ecx
mov eax, dword [ebp - 0x78]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
setl dl
xor eax, eax
test edx, edx
setg al
cmp eax, dword [ebp - 0x10]
jge 0x1000a738
cmp dword [ebp - 0x78], ebx
je 0x1000a744
cmp dword [ebp - 0x78], ebx
je 0x1000a744
xor eax, eax
lea edx, [eax + 1]
jmp 0x1000a746
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
mov edx, 0xffff
setge cl
xor eax, eax
cmp ecx, edx
setne al
add eax, 0x5da56ab0
jne 0x1000a766
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x10]
neg eax
push 0xfffffffffffffff7
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax
mov eax, dword [ebp - 0x78]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
add eax, 2
add eax, edx
xor ecx, ecx
xor edx, edx
inc edx
cmp eax, edx
pop eax
setle cl
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x38], eax
jmp 0x1000a7aa
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x37
je 0x1000a7a4
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0xffffffef
jmp 0x1000a833
mov dword [ebp - 0x30], 0x97412df3
mov dword [ebp - 0x50], 0xffffffff
cmp dword [ebp - 0x30], 0xd9637855
sbb eax, eax
inc eax
cmp eax, 0xe662
jg 0x1000a7f2
mov eax, edx
cmp dword [ebp - 0x50], ebx
jne 0x1000a7f4
mov eax, ebx
cmp dword [ebp - 0x24], eax
jg 0x1000a800
mov eax, edx
cmp dword [ebp - 0x50], ebx
jne 0x1000a802
mov eax, ebx
mov edx, dword [ebp - 0x30]
sub edx, eax
mov eax, dword [ebp - 0x30]
neg edx
push 1
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp eax, edx
pop edx
setle cl
mov dword [ebp - 0x40], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffec
jge 0x1000a7cc
mov dword [ebp - 0x20], edi
lea ecx, [ebp - 0x3d0]
push esi
call fcn.1001803e
xor eax, eax
mov dword [ebp - 4], ebx
inc eax
mov dword [ebp - 0x10], 0xffffffff
push eax
lea ecx, [ebp - 0x228]
call fcn.1001803e
xor eax, eax
lea ecx, [ebp - 0x21c]
inc eax
mov byte [ebp - 4], al
push 2
pop eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x58], 0xefbae54f
mov dword [ebp - 0x24], 0x834d56b8
push eax
call fcn.1001803e
push 2
pop eax
push 3
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], al
call fcn.1001803e
lea ecx, [ebp - 0x634]
mov byte [ebp - 4], 3
movdqa xmm0, xmmword [0x10008de0]
lea eax, [ebp - 0x624]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x734]
movdqu xmmword [ebp - 0x634], xmm0
call fcn.1001807a
mov byte [ebp - 4], 4
xor edx, edx
mov dword [ebp - 0x34], 0xb85ae340
inc edx
mov dword [ebp - 0x2c], ebx
jmp 0x1000a8ee
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x228]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1000a8db
push 2
mov dword [ebp - 0x2c], ebx
pop edx
jmp 0x1000a90e
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x21c]
mov dword [eax + ecx*4], 0xab72231b
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1000a8fb
mov dword [ebp - 0x2c], ebx
jmp 0x1000a92b
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2b8]
mov dword [eax + ecx*4], 0x19e77f55
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1000a918
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x228]
cmp dword [eax], ebx
je 0x1000a985
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x1000aae4
push 0x2099
call dword [sym.imp.KERNEL32.dll_TlsFree]
jmp 0x1000aae4
mov dword [ebp - 0x18], 0xfffffff9
lea ecx, [ebp - 0x34c]
push 3
call fcn.1001803e
push 5
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x6b4]
movdqa xmm0, xmmword [0x10008db0]
lea eax, [ebp - 0x6a4]
push ecx
push eax
push ecx
mov dword [ebp - 0x30], 0xde002748
lea ecx, [ebp - 0x50c]
movdqu xmmword [ebp - 0x6b4], xmm0
call fcn.1001807a
push 6
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x310]
xor eax, eax
inc eax
push eax
call fcn.1001803e
mov dword [ebp - 0x2c], ebx
jmp 0x1000a9fd
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34c]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1000a9ea
xor edx, edx
mov dword [ebp - 0x2c], ebx
inc edx
jmp 0x1000aa1e
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x310]
mov dword [eax + ecx*4], 0x84a8a623
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1000aa0b
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, 0x1140ae77
push 5
setge cl
imul ecx, dword [ebp - 0x50]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x58], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
mov eax, dword [ebp - 0x228]
setge dl
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x34c]
setne cl
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
imul ecx, eax
pop eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
sbb eax, eax
neg eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x21c]
mov edx, dword [ebp - 0x310]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2b8]
mov ecx, dword [edx]
mov dword [eax + 4], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x50c]
mov eax, dword [eax + 0xc]
inc eax
cmp eax, 0x405ea325
setge cl
xor eax, eax
neg ecx
cmp ecx, 0x8337
lea ecx, [ebp - 0x310]
setge al
mov dword [edx], eax
call fcn.10017f89
lea ecx, [ebp - 0x50c]
call fcn.10017f89
lea ecx, [ebp - 0x34c]
call fcn.10017f89
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x2b8]
cmp dword [eax + 4], ebx
je 0x1000ab06
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x21c]
add eax, dword [edx]
je 0x1000ab0c
xor eax, eax
lea esi, [eax + 1]
jmp 0x1000ab0e
mov edx, dword [ebp - 0x21c]
mov esi, ebx
mov eax, dword [ebp - 0x228]
xor ecx, ecx
cmp esi, dword [eax]
setle cl
mov dword [edx], ecx
lea ecx, [ebp - 0x734]
call fcn.10017f89
lea ecx, [ebp - 0x2b8]
call fcn.10017f89
lea ecx, [ebp - 0x21c]
call fcn.10017f89
lea ecx, [ebp - 0x228]
call fcn.10017f89
push 2
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x1000ab64
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3d0]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000ab51
mov dword [ebp - 0x2c], 0xcd5
or esi, 0xffffffff
mov dword [ebp - 0x38], 0xfffffff7
xor edx, edx
mov dword [ebp - 0x1c], 0x80c6548a
mov ecx, 0xffff
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x24], 0x64e785c2
mov dword [ebp - 0x34], 0x9a78915c
mov dword [ebp - 0x38], esi
imul eax, dword [ebp - 0x2c], 0xffff
push 6
sub ecx, eax
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
pop ecx
setge dl
xor eax, eax
cmp edx, ecx
setl al
xor edx, edx
imul ecx, eax, 0xfffd
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setg dl
cmp edx, dword [ebp - 0x1c]
jg 0x1000abd3
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x1c], ebx
jne 0x1000abde
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0xffff2afb
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0x3734
cmp dword [ebp - 0x10], ebx
je 0x1000ac0c
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
sub eax, 0xfffffffb
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x38], eax
je 0x1000ac81
mov dword [ebp - 0x40], 7
mov dword [ebp - 0x6c], 0xfffffff6
mov dword [ebp - 0x18], ebx
jmp 0x1000ac43
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x728], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000ac32
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x40]
setge cl
neg ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x724]
setl dl
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
mov dword [ebp - 0x6c], ecx
jmp 0x1000acd6
mov dword [ebp - 0x30], 0x1bbcb567
mov dword [ebp - 0x10], ebx
jmp 0x1000acd0
mov dword [ebp - 0x28], 0xa2a42895
mov dword [ebp - 0x38], 0x5eec0db1
cmp dword [ebp - 0x38], 4
jg 0x1000aca4
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
dec edx
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe5
jge 0x1000ac8d
cmp dword [ebp - 0x20], ebx
je 0x1000acea
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
je 0x1000acea
xor edx, edx
inc edx
mov ecx, edx
jmp 0x1000acef
xor edx, edx
mov ecx, ebx
inc edx
mov eax, dword [ebp - 0x20]
sub ecx, eax
je 0x1000acf9
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, 0xb0b4
setne cl
cmp ecx, dword [ebp - 0x20]
jg 0x1000ad13
cmp dword [ebp - 0x20], ebx
jne 0x1000ad15
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, edx
mov eax, 0x90da1152
setg cl
cmp eax, ecx
mov eax, dword [ebp - 0x3d0]
sbb ecx, ecx
inc ecx
mov dword [eax + 4], ecx
mov dword [ebp - 0x10], 0xfffffff9
mov dword [ebp - 0x50], 0x28f4e1c2
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x50], esi
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x10]
sub edx, eax
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setne cl
xor edx, edx
cmp ecx, eax
setne dl
cmp edx, 0x395e
jl 0x1000ad99
mov dword [ebp - 0x10], ebx
jmp 0x1000ad91
cmp dword [ebp - 0x10], ebx
jne 0x1000adb8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x1000ad89
jmp 0x1000adb8
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x1000adb8
push 0xd1
push ebx
push 0x118c
push 0x129
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x1000add9
push ebx
push 0xb03
push ebx
push 0x25f9
push ebx
push 0x1d45
call dword [sym.imp.USER32.dll_DrawTextExW]
lea ecx, [ebp - 0x3d0]
mov dword [ebp - 4], esi
call fcn.10017f89
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0xd49fcfbc
mov dword [ebp - 0x28], 0x8461e707
push 6
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x1c], 0xb870004d
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x34], 0x4d633c66
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x54], 0xc34f9703
push 2
mov dword [ebp - 0x50], 0x5175
mov dword [ebp - 0x18], ebx
pop ecx
jmp 0x1000ae42
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2d4], 0xeda7da9f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000ae31
cmp dword [ebp - 0x20], ebx
je 0x1000aed6
xor ecx, ecx
mov dword [ebp - 0x18], 0x13e1
mov eax, dword [ebp - 0x20]
add eax, 0x14aae
cmp eax, 0x4f6c
mov eax, dword [ebp - 0x18]
push 6
setge cl
inc eax
add eax, ecx
mov ecx, 0xffff
imul eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
pop edx
setle cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp eax, edx
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
sub eax, ecx
imul ecx, eax, 5
mov eax, dword [ebp - 0x20]
push 2
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setne bl
xor ecx, ecx
cmp ebx, eax
pop eax
setle cl
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
je 0x1000aed4
xor eax, eax
xor ebx, ebx
lea edx, [eax + 1]
jmp 0x1000aed8
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
jne 0x1000aef6
cmp dword [ebp - 0x20], ebx
jne 0x1000aef6
xor edx, edx
mov ecx, ebx
inc edx
jmp 0x1000aefb
xor edx, edx
inc edx
mov ecx, edx
xor eax, eax
push 5
pop esi
cmp ecx, esi
setne al
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], 0xc
cmp dword [ebp - 0x1c], 0xfffffff5
jne 0x1000b190
mov esi, 0x100086dc
jmp 0x1000af23
xor edx, edx
inc edx
push edx
lea ecx, [ebp - 0x1a8]
call fcn.1001803e
mov dword [ebp - 4], 7
push 2
pop eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x30], 0x4c996e15
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], 0x2179
cmp dword [ebp - 0x40], 0xb12
jge 0x1000b01c
call fcn.10052df5
push eax
push 0x100086c4
push 0x100086c8
call fcn.10053bc2
add esp, 0xc
call fcn.10052df5
add eax, 0x20
push eax
push 0x100086d0
push 0x100086d4
call fcn.10053bc2
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
push ecx
lea eax, [ebp - 0x130]
push eax
push ecx
lea eax, [ebp - 0x110]
mov ecx, 0x1065d430
push eax
call fcn.100177fe
pop ecx
mov ecx, eax
call fcn.100177fe
pop ecx
mov ecx, eax
call fcn.100177fe
cmp dword [ebp - 0x110], 0x21
jg 0x1000afe4
push dword [ebp - 0x110]
push ecx
mov edx, esi
mov ecx, 0x1065d378
call fcn.1001c710
pop ecx
mov ecx, eax
call fcn.10017c40
jmp 0x1000b015
cmp dword [ebp - 0x130], 0x21
jg 0x1000aff5
push dword [ebp - 0x130]
jmp 0x1000afcd
cmp dword [ebp - 0x138], 0x21
jg 0x1000b006
push dword [ebp - 0x138]
jmp 0x1000afcd
mov edx, 0x100086e4
mov ecx, 0x1065d378
call fcn.1001c710
push eax
call fcn.1001c8e7
pop ecx
mov dword [ebp - 0x58], 0x2ad9236
xor edx, edx
mov dword [ebp - 0x40], 0x71799991
inc edx
mov dword [ebp - 0x18], 0x2d14a59
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x60], 0x21847726
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x18], ebx
jmp 0x1000b064
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1a8]
mov dword [eax + ecx*4], 0x9942c3b0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000b051
mov eax, dword [ebp - 0x1a8]
cmp dword [eax], ebx
jne 0x1000b112
mov dword [ebp - 0x18], 0xc80f3bba
dec dword [ebp - 0x50]
je 0x1000b0cb
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x1a8]
setge dl
sub ecx, edx
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x58]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x2d0], ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
add edx, ecx
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x24]
jl 0x1000b0cb
xor eax, eax
inc eax
jmp 0x1000b0cd
mov eax, ebx
add eax, 0xffff26f5
sub eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jl 0x1000b0ea
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x58]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x1a8]
setne dl
imul edx, dword [eax]
cmp edx, dword [ebp - 0x24]
jge 0x1000b10f
mov eax, ebx
jmp 0x1000b114
xor edx, edx
inc edx
mov eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xf523
setle al
xor ecx, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1a8]
mov edx, dword [eax]
mov eax, dword [ebp - 0x38]
imul eax, edx
cmp eax, edx
setge cl
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0x1a8]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x38], eax
or dword [ebp - 4], 0xffffffff
call fcn.10017f89
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff5
je 0x1000af20
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], 0x24a8c6a5
mov dword [ebp - 0x30], 0x4feccdf
mov dword [ebp - 0x44], 0x283d3454
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 0x13
jne 0x1000b47b
lea eax, [ebp - 0x4ac]
lea ecx, [ebp - 0x49c]
movdqa xmm0, xmmword [0x10008e00]
push ecx
push ecx
push eax
lea ecx, [ebp - 0x1c0]
movdqu xmmword [ebp - 0x4ac], xmm0
call fcn.1001807a
mov dword [ebp - 4], 8
mov dword [ebp - 0x10], 0xcb03629a
mov dword [ebp - 0x54], 0xb017290b
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x44], 0x195e
cmp dword [ebp - 0x44], 0xcba
jge 0x1000b2b2
lea eax, [ebp - 0x140]
mov ecx, 0x1065d430
push eax
call fcn.100177fe
push ebx
push ebx
lea ecx, [ebp - 0x5d0]
mov dword [ebp - 0x5c0], ebx
mov edi, ebx
mov dword [ebp - 0x5bc], ebx
call fcn.10018797
mov byte [ebp - 4], 9
mov esi, dword [ebp - 0x140]
jmp 0x1000b293
lea edx, [ebp - 0x5d0]
mov ecx, 0x1065d430
dec esi
call fcn.1001d7a3
mov edx, 0x100086f0
lea ecx, [ebp - 0x5d0]
call fcn.1001c921
test al, al
je 0x1000b281
lea eax, [ebp - 0x27c]
mov ecx, 0x1065d430
push eax
call fcn.100177fe
add edi, dword [ebp - 0x27c]
jmp 0x1000b293
push edi
mov ecx, 0x1065d378
call fcn.10017c40
push eax
call fcn.1001c8e7
pop ecx
test esi, esi
jne 0x1000b243
xor eax, eax
mov byte [ebp - 4], 8
push ebx
inc eax
lea ecx, [ebp - 0x5d0]
dec esi
push eax
mov dword [ebp - 0x140], esi
call fcn.10018797
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], ebx
jl 0x1000b44f
mov ebx, dword [ebp - 0x1c0]
mov dword [ebp - 0x50], ebx
push 3
lea ecx, [ebp - 0x340]
call fcn.1001803e
xor ecx, ecx
push 3
mov dword [ebp - 0x18], ecx
pop edx
cmp dword [ebp - 0x18], edx
jge 0x1000b2ff
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x340]
mov dword [eax + ecx*4], 0x66c93ee
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000b2e5
xor ecx, ecx
mov edi, dword [ebp - 0x340]
mov dword [edi + 4], edx
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x44], 0xc3e5f88
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], 0xb6ba
cmp dword [ebp - 0x1c], ecx
jne 0x1000b32b
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c0]
push 0
cmp dword [eax + edx*4], ecx
mov eax, dword [ebp - 0x10]
sete cl
xor edx, edx
imul ecx, ecx, 0x4bb3
cmp ecx, eax
mov eax, dword [ebp - 0x1c0]
pop ecx
setge dl
sub edx, dword [ebx + 4]
neg edx
sbb edx, edx
inc edx
setns cl
xor edx, edx
cmp ecx, dword [eax + esi*4]
mov eax, dword [ebp - 0x54]
setge dl
xor ecx, ecx
imul eax, edx
test eax, eax
je 0x1000b387
cmp dword [ebx + 4], ecx
je 0x1000b387
xor eax, eax
inc eax
jmp 0x1000b389
mov eax, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 3
jg 0x1000b430
mov byte [ebp - 0x39], cl
cmp byte [ebp - 0x39], 0
je 0x1000b3b4
push ecx
push 0x627
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [ebp - 0x10]
mov edx, 0x8c6aee34
mov eax, dword [ebp - 0x1c0]
cmp edx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
inc ecx
add ecx, dword [edi + 4]
add eax, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, 0xd99275a8
neg eax
sbb eax, eax
xor edx, edx
inc eax
sub eax, dword [ebp - 0x30]
mov ecx, dword [edi + 4]
cmp eax, 0xe8ca4045
mov eax, dword [ebp - 0x1c0]
setne dl
xor ebx, ebx
cmp edx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x30]
setg bl
add eax, ebx
mov ebx, dword [ebp - 0x50]
je 0x1000b414
xor eax, eax
cmp dword [ebx + 4], eax
je 0x1000b416
lea ecx, [eax + 1]
jmp 0x1000b418
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x30]
add eax, ecx
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
push 0
pop ecx
jle 0x1000b39f
dec dword [edi + 4]
jns 0x1000b308
lea ecx, [ebp - 0x340]
call fcn.10017f89
dec dword [ebp - 0x10]
jns 0x1000b2cb
xor ebx, ebx
or edi, 0xffffffff
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 4], edi
call fcn.10017f89
inc dword [ebp - 0x20]
lea eax, [ebp - 0x4ac]
cmp dword [ebp - 0x20], 0x13
lea ecx, [ebp - 0x49c]
je 0x1000b1c1
jmp 0x1000b47e
or edi, 0xffffffff
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x1000b490
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
push 2
pop eax
push eax
lea ecx, [ebp - 0x3e8]
call fcn.1001803e
mov dword [ebp - 4], 0xa
xor ecx, ecx
mov dword [ebp - 0x20], 4
inc ecx
mov dword [ebp - 0x18], 0x1a0e1c2a
push 2
mov dword [ebp - 0x50], 0x26243a5d
pop eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x18], ebx
jmp 0x1000b4da
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7c], 0x6ce1a812
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000b4cc
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x7c]
cmp eax, ecx
mov eax, dword [ebp - 0x7c]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
setl dl
xor eax, eax
test edx, edx
setg al
cmp eax, dword [ebp - 0x20]
jge 0x1000b532
cmp dword [ebp - 0x7c], ebx
je 0x1000b53e
cmp dword [ebp - 0x7c], ebx
je 0x1000b53e
xor eax, eax
lea edx, [eax + 1]
jmp 0x1000b540
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
mov edx, 0xffff
setge cl
xor eax, eax
cmp ecx, edx
setne al
add eax, 0x5da56ab0
jne 0x1000b560
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x20]
neg eax
push 0xfffffffffffffff7
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax
mov eax, dword [ebp - 0x7c]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
add eax, 2
add eax, edx
xor ecx, ecx
xor edx, edx
inc edx
cmp eax, edx
pop eax
setle cl
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x28], eax
jmp 0x1000b5a4
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x37
je 0x1000b59e
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0xffffffef
cmp dword [ebp - 0x1c], 0xffffffec
jl 0x1000b633
mov dword [ebp - 0x30], 0x97412df3
mov dword [ebp - 0x50], edi
cmp dword [ebp - 0x30], 0xd9637855
sbb eax, eax
inc eax
cmp eax, 0xe662
jg 0x1000b5ec
mov eax, edx
cmp dword [ebp - 0x50], ebx
jne 0x1000b5ee
mov eax, ebx
cmp dword [ebp - 0x24], eax
jg 0x1000b5fa
mov eax, edx
cmp dword [ebp - 0x50], ebx
jne 0x1000b5fc
mov eax, ebx
mov edx, dword [ebp - 0x30]
sub edx, eax
mov eax, dword [ebp - 0x30]
neg edx
push 1
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp eax, edx
pop edx
setle cl
mov dword [ebp - 0x44], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffec
jge 0x1000b5ca
push 2
mov dword [ebp - 0x18], ebx
pop eax
cmp dword [ebp - 0x18], eax
jge 0x1000b65b
push eax
pop edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3e8]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000b640
xor edx, edx
inc edx
cmp dword [ebp - 0x2c], ebx
je 0x1000b66a
mov eax, dword [ebp - 0x2c]
mov ecx, edx
cmp eax, dword [ebp - 0x2c]
jne 0x1000b66c
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
sub ecx, eax
je 0x1000b676
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp eax, 0xb0b4
setne cl
cmp ecx, dword [ebp - 0x2c]
jg 0x1000b690
cmp dword [ebp - 0x2c], ebx
jne 0x1000b692
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, edx
mov eax, 0x90da1152
setg cl
cmp eax, ecx
mov eax, dword [ebp - 0x3e8]
sbb ecx, ecx
inc ecx
mov dword [eax + 4], ecx
xor eax, eax
inc eax
mov dword [ebp - 0x2c], edi
push eax
lea ecx, [ebp - 0x248]
call fcn.1001803e
push 2
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x238]
pop eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x58], 0xefbae54f
mov dword [ebp - 0x24], 0x834d56b8
push eax
call fcn.1001803e
push 3
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 0xc
call fcn.1001803e
lea ecx, [ebp - 0x6d4]
mov byte [ebp - 4], 0xd
movdqa xmm0, xmmword [0x10008de0]
lea eax, [ebp - 0x6c4]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x710]
movdqu xmmword [ebp - 0x6d4], xmm0
call fcn.1001807a
mov byte [ebp - 4], 0xe
xor edx, edx
mov dword [ebp - 0x34], 0xb85ae340
inc edx
mov dword [ebp - 0x10], ebx
jmp 0x1000b74a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x248]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1000b737
push 2
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x1000b76a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x238]
mov dword [eax + ecx*4], 0xab72231b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1000b757
mov dword [ebp - 0x10], ebx
jmp 0x1000b787
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2a0]
mov dword [eax + ecx*4], 0x19e77f55
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1000b774
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x248]
cmp dword [eax], ebx
je 0x1000b7e1
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x1000b93c
push 0x2099
call dword [sym.imp.KERNEL32.dll_TlsFree]
jmp 0x1000b93c
mov dword [ebp - 0x18], 0xfffffff9
lea ecx, [ebp - 0x358]
push 3
call fcn.1001803e
lea ecx, [ebp - 0x6c4]
mov byte [ebp - 4], 0xf
movdqa xmm0, xmmword [0x10008db0]
lea eax, [ebp - 0x6b4]
push ecx
push eax
push ecx
mov dword [ebp - 0x30], 0xde002748
lea ecx, [ebp - 0x5e8]
movdqu xmmword [ebp - 0x6c4], xmm0
call fcn.1001807a
xor eax, eax
mov byte [ebp - 4], 0x10
inc eax
lea ecx, [ebp - 0x448]
push eax
call fcn.1001803e
mov dword [ebp - 0x10], ebx
jmp 0x1000b855
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x358]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1000b842
xor edx, edx
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x1000b876
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x448]
mov dword [eax + ecx*4], 0x84a8a623
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1000b863
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, 0x1140ae77
push 5
setge cl
imul ecx, dword [ebp - 0x50]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x58], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
cmp eax, ecx
mov eax, dword [ebp - 0x248]
setge dl
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x358]
setne cl
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
imul ecx, eax
pop eax
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
sbb eax, eax
neg eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x238]
mov edx, dword [ebp - 0x448]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [edx]
mov dword [eax + 4], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x5e8]
mov eax, dword [eax + 0xc]
inc eax
cmp eax, 0x405ea325
setge cl
xor eax, eax
neg ecx
cmp ecx, 0x8337
lea ecx, [ebp - 0x448]
setge al
mov dword [edx], eax
call fcn.10017f89
lea ecx, [ebp - 0x5e8]
call fcn.10017f89
lea ecx, [ebp - 0x358]
call fcn.10017f89
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x2a0]
cmp dword [eax + 4], ebx
je 0x1000b95e
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x238]
add eax, dword [edx]
je 0x1000b964
xor eax, eax
lea esi, [eax + 1]
jmp 0x1000b966
mov edx, dword [ebp - 0x238]
mov esi, ebx
mov eax, dword [ebp - 0x248]
xor ecx, ecx
cmp esi, dword [eax]
setle cl
mov dword [edx], ecx
lea ecx, [ebp - 0x710]
call fcn.10017f89
lea ecx, [ebp - 0x2a0]
call fcn.10017f89
lea ecx, [ebp - 0x238]
call fcn.10017f89
lea ecx, [ebp - 0x248]
call fcn.10017f89
mov dword [ebp - 0x20], 0xcd5
xor edx, edx
mov dword [ebp - 0x28], 0xfffffff7
mov ecx, 0xffff
mov dword [ebp - 0x1c], 0x80c6548a
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x24], 0x64e785c2
mov dword [ebp - 0x34], 0x9a78915c
mov dword [ebp - 0x28], edi
imul eax, dword [ebp - 0x20], 0xffff
push 6
sub ecx, eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
pop ecx
setge dl
xor eax, eax
cmp edx, ecx
setl al
xor edx, edx
imul ecx, eax, 0xfffd
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setg dl
cmp edx, dword [ebp - 0x1c]
jg 0x1000ba08
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1c], ebx
jne 0x1000ba13
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0xffff2afb
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0x3734
cmp dword [ebp - 0x10], ebx
je 0x1000ba41
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
sub eax, 0xfffffffb
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x28], eax
je 0x1000bab6
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x54], 0xfffffff6
mov dword [ebp - 0x18], ebx
jmp 0x1000ba78
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6ec], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000ba67
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x44]
setge cl
neg ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x6e8]
setl dl
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
mov dword [ebp - 0x54], ecx
jmp 0x1000bb0b
mov dword [ebp - 0x30], 0x1bbcb567
mov dword [ebp - 0x10], ebx
jmp 0x1000bb05
mov dword [ebp - 0x38], 0xa2a42895
mov dword [ebp - 0x28], 0x5eec0db1
cmp dword [ebp - 0x28], 4
jg 0x1000bad9
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
dec edx
cmp edx, eax
setl cl
mov dword [ebp - 0x38], ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe5
jge 0x1000bac2
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x10], 0xfffffff9
mov dword [ebp - 0x50], 0x28f4e1c2
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x50], edi
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 0x395e
jl 0x1000bb75
mov dword [ebp - 0x10], ebx
jmp 0x1000bb6d
cmp dword [ebp - 0x10], ebx
jne 0x1000bb94
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x1000bb65
jmp 0x1000bb94
mov byte [ebp - 0x39], bl
cmp byte [ebp - 0x39], 0
je 0x1000bb94
push 0xd1
push ebx
push 0x118c
push 0x129
call dword [sym.imp.USER32.dll_MapWindowPoints]
cmp byte [ebp - 0x11], 0
je 0x1000bc3e
mov dword [ebp - 0x24], ebx
xor ecx, ecx
mov dword [ebp - 0x1c], 9
inc ecx
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0xffffffef
jmp 0x1000bc20
mov dword [ebp - 0x30], 0x97412df3
mov dword [ebp - 0x50], edi
cmp dword [ebp - 0x30], 0xd9637855
sbb eax, eax
inc eax
cmp eax, 0xe662
jg 0x1000bbdf
mov eax, ecx
cmp dword [ebp - 0x50], ebx
jne 0x1000bbe1
mov eax, ebx
cmp dword [ebp - 0x24], eax
jg 0x1000bbed
mov eax, ecx
cmp dword [ebp - 0x50], ebx
jne 0x1000bbef
mov eax, ebx
mov edx, dword [ebp - 0x30]
sub edx, eax
mov eax, dword [ebp - 0x30]
neg edx
push 1
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x44], ecx
dec dword [ebp - 0x1c]
pop ecx
cmp dword [ebp - 0x1c], 0xffffffec
jge 0x1000bbbd
push ebx
push 0xb03
push ebx
push 0x25f9
push ebx
push 0x1d45
call dword [sym.imp.USER32.dll_DrawTextExW]
lea ecx, [ebp - 0x3e8]
mov dword [ebp - 4], edi
call fcn.10017f89
mov esi, dword [0x1007260c]
xor ecx, ecx
mov dword [ebp - 0x10], 0xfffffff6
inc ecx
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x18], ebx
jmp 0x1000bc71
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x26c], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000bc64
mov dword [ebp - 0x10], ebx
jmp 0x1000bc88
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x26c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000bc7b
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 0xf
push 0xffffffffffffffe6
pop edi
jg 0x1000bcfd
mov dword [ebp - 0x28], 0x74dd0324
mov dword [ebp - 0x34], 0x7d7c1188
mov dword [ebp - 0x28], ebx
jmp 0x1000bcec
mov dword [ebp - 0x34], 0x6f7fbf21
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 3
jge 0x1000bcd2
push 6
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x51c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000bcbf
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000bce3
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
dec dword [ebp - 0x518]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
je 0x1000bcac
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xf
jle 0x1000bc99
xor ecx, ecx
inc ecx
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
xor ebx, ebx
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x18], ebx
jmp 0x1000bd28
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x22c], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000bd1b
mov dword [ebp - 0x10], ebx
jmp 0x1000bd3f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x22c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000bd32
mov dword [ebp - 0x10], ebx
jmp 0x1000bda3
mov dword [ebp - 0x28], 0x74dd0324
mov dword [ebp - 0x34], 0x7d7c1188
mov dword [ebp - 0x28], ebx
jmp 0x1000bd9b
mov dword [ebp - 0x34], 0x6f7fbf21
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 3
jge 0x1000bd82
push 6
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x594], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000bd6f
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000bd92
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
dec dword [ebp - 0x590]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
je 0x1000bd5c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xf
jle 0x1000bd49
mov dword [ebp - 0x34], 0x5d6c
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000bff0
mov dword [ebp - 0x44], 0x2178
cmp dword [ebp - 0x44], 0xaec
jge 0x1000bfe9
push ebx
push ebx
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
call fcn.10018797
push 0x1000860d
lea ecx, [ebp - 0x4d4]
mov dword [ebp - 4], 0x11
call fcn.10017708
lea eax, [ebp - 0x16c]
mov byte [ebp - 4], 0x12
mov edi, 0x1065d430
push eax
mov ecx, edi
call fcn.100177fe
mov ebx, dword [ebp - 0x16c]
test ebx, ebx
je 0x1000bfbc
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000c005
push ebx
push 0x23e
call dword [sym.imp.USER32.dll_GetSystemMenu]
xor eax, eax
mov edi, 0xc9cd49fc
inc eax
cmp byte [ebp - 0x6d], 0
je 0x1000c7eb