Function at 0x1001951c
Capabilities:
Accept command line arguments
Log keystrokes

Disassembly:
mov eax, 0x1006501b
call fcn.10064688
sub esp, 0x298
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x174]
push 0xfffffffffffffff6
pop edi
mov dword [ebp - 0x34], 0xffff
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0xffffffff
push 2
mov dword [ebp - 0x70], edx
call fcn.1001b277
xor ebx, ebx
lea ecx, [ebp - 0x180]
xor esi, esi
mov dword [ebp - 4], ebx
inc esi
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x30], 0xffffffff
push esi
call fcn.1001b277
mov dword [ebp - 0x18], ebx
jmp 0x10019592
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x174]
mov dword [eax + ecx*4], 0x9eed08e1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001957f
mov dword [ebp - 0x18], ebx
jmp 0x100195b0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x180]
mov dword [eax + ecx*4], 0x9cc02768
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001959d
mov eax, dword [ebp - 0x28]
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x174]
setg cl
xor edx, edx
mov dword [eax + 4], ecx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
imul ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x180]
lea ecx, [ebp - 0x180]
setge dl
mov dword [eax], edx
call fcn.1001b2f9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.1001b2f9
mov dword [ebp - 0x18], 0xfffffff9
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x14], 0x85a7b051
mov dword [ebp - 0x24], 0xffff
mov dword [ebp - 0x3c], 0xffffffff
push 3
call fcn.1001b277
mov dword [ebp - 0x28], ebx
jmp 0x1001964b
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x130]
mov dword [eax + ecx*4], 0x22a1efe0
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10019638
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
dec eax
neg eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0xff63
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp esi, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0xfffffff3
jmp 0x100196fc
mov dword [ebp - 0x28], 5
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x100196af
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x24], ebx
je 0x100196b7
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jne 0x100196e5
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x130]
setge dl
cmp edx, dword [eax + 8]
mov edx, ebx
jl 0x100196e7
mov edx, esi
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x130]
sete cl
mov dword [eax], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 5
jle 0x1001969a
lea ecx, [ebp - 0x130]
call fcn.1001b2f9
mov eax, dword [0x1060f6b0]
test al, 1
jne 0x100197a0
or eax, esi
mov dword [0x1060f6b0], eax
push ebx
mov dword [ebp - 4], esi
push ebx
mov dword [0x1060f700], ebx
mov dword [0x1060f704], ebx
call fcn.1001d477
mov dword [0x1060f700], eax
mov dword [0x1060f708], ebx
mov dword [0x1060f710], ebx
mov byte [ebp - 4], 3
mov ecx, 0x1060f708
mov dword [ebp - 0xcc], eax
lea eax, [ebp - 0xcc]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x1ac]
mov dword [0x1060f71c], 0x3f800000
push eax
mov dword [0x1060f70c], ebx
call fcn.1001d24f
push 0x10066061
mov dword [0x1060f714], 7
mov dword [0x1060f718], 8
call fcn.1004f6ec
or dword [ebp - 4], 0xffffffff
pop ecx
imul eax, dword [ebp - 0x4c], 0x2710
add eax, dword [ebp - 0x70]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
call fcn.1001b33b
push 3
pop ecx
mov eax, dword [eax]
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x24], 0x725245f5
mov dword [ebp - 0x14], 0xe209
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], ebx
jmp 0x100197e9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf4], 0xd4f2887c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100197d8
mov dword [ebp - 0x18], ebx
jmp 0x100197fd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x48], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100197f3
mov dword [ebp - 0x20], 0xe
jmp 0x10019842
mov dword [ebp - 0x2c], 0x6df3
mov dword [ebp - 0x2c], 0xffffffff
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001983f
push 0x14c6
push ebx
push ebx
push 0x25a1
push 0x1493
push ebx
push 0x1977
call dword [sym.imp.GDI32.dll_GetDIBits]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x12
je 0x1001980b
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 2
jg 0x10019992
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c160]
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x1f0]
mov dword [ebp - 0x9c], ebx
push eax
push ebx
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x98], ebx
movdqu xmmword [ebp - 0x1f0], xmm0
mov dword [ebp - 0x94], ebx
call fcn.1001dc74
mov dword [ebp - 4], 4
mov dword [ebp - 0x34], 0xffff
dec dword [ebp - 0x34]
je 0x100198ae
mov edi, esi
cmp dword [ebp - 0x48], ebx
jne 0x100198b0
mov edi, ebx
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0xf4]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov ecx, dword [ebp - 0x20]
setg dl
xor eax, eax
cmp edx, 5
setne al
cmp eax, 0xfffffffe
sbb eax, eax
inc eax
imul eax, edi
sub ecx, eax
mov eax, dword [ebp - 0xf0]
imul ecx, eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xf4]
add eax, eax
cmp eax, ecx
jg 0x100198f6
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf4]
mov edi, dword [ebp - 0x9c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, 3
neg eax
sbb eax, eax
inc eax
add eax, dword [edi + 0xc]
je 0x100199b9
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c0e0]
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0xb8], ebx
push eax
push ebx
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xb4], ebx
movdqu xmmword [ebp - 0x1c0], xmm0
mov dword [ebp - 0xb0], ebx
call fcn.1001dc74
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xb8]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [edi + 0xc], eax
cmp dword [ebp - 0x24], ebx
je 0x100199af
call fcn.1001b2f9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.1001b2f9
push 0xfffffffffffffff6
pop edi
cmp dword [ebp - 0x3c], 0
je 0x10019c75
mov dword [ebp - 0x28], 0x13dd33a4
mov dword [ebp - 0x28], 0x17
jmp 0x10019ab2
call fcn.1001b2f9
jmp 0x10019a71
mov dword [ebp - 0x28], 0x5b8c
cmp dword [ebp - 0x28], 0x5e29
jle 0x10019a0d
mov edi, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x34], 0x7f28
mov dword [ebp - 0x2c], ebx
mov eax, ebx
mov ecx, 0x1060e618
and eax, edi
cdq
push edx
push eax
call fcn.1001b046
inc ebx
cmp ebx, 0x581d
jl 0x100199db
dec edi
dec dword [ebp - 0x34]
push 0
pop ebx
jne 0x100199d8
mov edi, dword [ebp - 0x30]
inc edi
mov dword [ebp - 0x30], edi
cmp edi, 0xa36
jl 0x100199ce
mov dword [ebp - 0x24], 2
cmp dword [ebp - 0x24], ebx
jl 0x10019a34
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10019a2f
push 0x10f5
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
dec dword [ebp - 0x24]
jns 0x10019a19
mov byte [ebp - 4], 5
cmp dword [ebp - 0x28], 0x5883
jge 0x10019a71
mov edx, 0x100089d8
mov ecx, 0x1060e618
call fcn.1001d551
jmp 0x10019a71
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
push 0xfffffffffffffff6
pop edi
call fcn.1001b2f9
inc dword [ebp - 0x20]
jmp 0x1001984b
cmp byte [ebp - 0x19], 0
je 0x10019aaf
push 0x156b
push ebx
push ebx
push ebx
push ebx
push 0xd8d
push 0xb2a
push 0x1c0
call dword [sym.imp.USER32.dll_ScrollWindowEx]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe5
mov byte [ebp - 0x19], bl
jge 0x10019a8b
cmp byte [ebp - 0x19], 0
je 0x10019ac9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], 0xad313dd3
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x14], 0x26128f3b
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x3c], 0x245c2f1f
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], 0x8185f187
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x38], 0xfffffff9
mov dword [ebp - 0x34], 2
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x28], ebx
jmp 0x10019b31
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1b0], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10019b20
mov dword [ebp - 0x28], 0xffffffec
jmp 0x10019c66
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c190]
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp - 0x1d0]
mov dword [ebp - 0x18], 0xae8c9f36
push eax
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x118]
push ebx
movdqu xmmword [ebp - 0x1d0], xmm0
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], ebx
call fcn.1001dc74
push esi
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 4], 7
call fcn.1001b277
mov dword [ebp - 0x14], ebx
jmp 0x10019bb2
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1a8]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10019ba3
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
sub ecx, 0xab76
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add eax, 0x56e700d6
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp dword [ebp - 0x18], ecx
jg 0x10019bf7
mov dword [ebp - 0x14], 0xa0246c38
jmp 0x10019c27
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], 0x5b3659ea
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x10019c1e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2a4], 0x51efdb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10019c0d
dec dword [ebp - 0x3c]
mov dword [ebp - 0x14], 0xfffffffe
jmp 0x10019c43
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], 0xf0bd907c
dec dword [ebp - 0x34]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 5
jl 0x10019c30
lea ecx, [ebp - 0x1a8]
call fcn.1001b2f9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x118]
call fcn.1001b2f9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffee
jg 0x10019b42
jmp 0x1001afa8
mov eax, dword [0x1060f6b0]
test al, 2
jne 0x10019d0d
or eax, 2
mov dword [0x1060f6b0], eax
push ebx
mov dword [ebp - 4], 8
push ebx
mov dword [0x1060f6e0], ebx
mov dword [0x1060f6e4], ebx
call fcn.1001d477
mov dword [0x1060f6e0], eax
mov dword [0x1060f6e8], ebx
mov dword [0x1060f6f0], ebx
mov byte [ebp - 4], 0xa
mov ecx, 0x1060f6e8
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0xbc]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x19c]
mov dword [0x1060f6fc], 0x3f800000
push eax
mov dword [0x1060f6ec], ebx
call fcn.1001d24f
push 0x1006605c
mov dword [0x1060f6f4], 7
mov dword [0x1060f6f8], 8
call fcn.1004f6ec
or dword [ebp - 4], 0xffffffff
pop ecx
mov dword [ebp - 0x18], 0x647
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x24], 0x77ab3921
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x18], ebx
jne 0x10019d5c
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp eax, 0x132d7af2
setl cl
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, ebx
jne 0x10019d5e
mov eax, esi
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], ebx
je 0x10019da3
mov eax, dword [ebp - 0x14]
sub eax, 0xffbe
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xbc01
setg cl
xor eax, eax
add ecx, dword [ebp - 0x24]
cmp ecx, 0x61e7ff51
setne al
add eax, dword [ebp - 0x18]
mov eax, esi
jne 0x10019da5
mov eax, ebx
cmp eax, dword [ebp - 0x18]
je 0x10019db1
mov ecx, esi
cmp dword [ebp - 0x20], ebx
jne 0x10019db3
mov ecx, ebx
mov eax, dword [ebp - 0x18]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
add edx, 0x5fb737c0
cmp eax, edx
mov eax, dword [ebp - 0x24]
setg cl
xor edx, edx
cmp ecx, eax
setle dl
xor eax, eax
add edx, dword [ebp - 0x14]
cmp edx, 0xfffffff9
setg al
xor edx, edx
cmp eax, 0x88dd0bb2
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
add edx, 0xae07
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x24]
jne 0x10019e19
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], 0xecf58a41
jmp 0x10019f6d
push 3
lea ecx, [ebp - 0x100]
call fcn.1001b277
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x24], ebx
jmp 0x10019e45
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], 0xbdec
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10019e32
mov dword [ebp - 0x24], ebx
jmp 0x10019e5d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xdc], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10019e50
mov edi, dword [ebp - 0x100]
xor eax, eax
cmp dword [edi + 4], ebx
setne al
xor edx, edx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x100]
setge dl
sub edx, dword [eax]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setl cl
cmp ecx, dword [ebp - 0xdc]
jle 0x10019ea7
cmp dword [ebp - 0x18], ebx
jne 0x10019ea7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], 0xaada
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
neg eax
je 0x10019ec5
mov ecx, esi
cmp dword [ebp - 0x28], ebx
jne 0x10019ec7
mov ecx, ebx
xor eax, eax
cmp ecx, dword [edi + 4]
setle al
sub eax, dword [edi + 4]
neg eax
sbb eax, eax
inc eax
add eax, dword [edi + 4]
je 0x10019f52
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], ebx
jmp 0x10019ef5
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x148], 0x9e0795b1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10019ee4
mov dword [ebp - 0x24], 0xfffffff6
jmp 0x10019f1a
mov dword [ebp - 0x34], 0xe56f6324
inc dword [ebp - 0x34]
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffd
jle 0x10019f04
cmp dword [edi + 4], ebx
je 0x10019f38
mov eax, dword [ebp - 0x144]
mov ecx, esi
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x18], ebx
jne 0x10019f3a
mov ecx, ebx
xor eax, eax
cmp ecx, esi
setl al
sub eax, dword [ebp - 0x144]
imul eax, eax, 0xe6d5
mov dword [ebp - 0x2c], eax
jmp 0x10019f62
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10019f62
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea ecx, [ebp - 0x100]
call fcn.1001b2f9
xorps xmm0, xmm0
movdqu xmmword [ebp - 0xac], xmm0
mov dword [ebp - 0x14], 0xfffffff8
push 8
pop edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x34], 0x6950a4ba
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x34], 0x96840eb4
mov dword [ebp - 0x28], ebx
jmp 0x10019fa8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x22c], esi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10019f9b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
je 0x10019fe4
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setl dl
add edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x228]
je 0x10019fdb
mov eax, esi
cmp dword [ebp - 0x14], ebx
jne 0x10019fdd
mov eax, ebx
mov edx, esi
cmp eax, dword [ebp - 0x14]
je 0x10019fe6
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], ebx
je 0x10019fff
mov edx, esi
cmp dword [ebp - 0x2c], ebx
jne 0x1001a001
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edx
lea eax, [ebp - 0x4c]
push eax
setg cl
mov dword [ebp - 0x34], ecx
call fcn.1001b39d
mov eax, dword [eax]
mov dword [ebp - 0x18], 0x6951ad38
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x2c], 0x53061ece
mov dword [ebp - 0x38], 0xf0ddd9cd
mov dword [ebp - 0x38], 0xdacd7d39
mov dword [ebp - 0x24], 0x9a7b
mov dword [ebp - 0x20], 0x5ec3
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], ebx
jmp 0x1001a062
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x74], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001a054
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x14], 0xffff
mov dword [ebp - 0x30], 0xc767dbf1
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffe
je 0x1001a0dc
mov eax, dword [ebp - 0x24]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
sub ecx, eax
xor eax, eax
cmp eax, ecx
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x74]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], 0xa95534fd
ja 0x1001a0d8
cmp dword [ebp - 0x20], ebx
je 0x1001a0dc
mov eax, esi
jmp 0x1001a0de
mov eax, ebx
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
cmp byte [ebp + 0xc], 0
mov dword [ebp - 0x2c], eax
jne 0x1001a100
mov edi, dword [ebp - 0x28]
test edi, edi
jne 0x1001acbe
mov dword [ebp - 0x14], ebx
jmp 0x1001a10f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x78], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001a105
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x78], eax
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001a129
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dl, byte [ebp + 0xc]
lea eax, [ebp - 0x294]
mov ecx, dword [ebp - 0x4c]
push eax
call fcn.1000d635
mov esi, eax
lea edi, [ebp - 0xac]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x18], ebx
inc esi
jmp 0x1001a165
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x40], 0x5b9b55bb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001a157
push 3
mov dword [ebp - 0x18], ebx
pop ecx
jmp 0x1001a17f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x84], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1001a172
mov dword [ebp - 0x40], ecx
jmp 0x1001a35a
push 2
lea ecx, [ebp - 0x10c]
call fcn.1001b277
push 2
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x1001a1bb
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10c]
mov dword [eax + ecx*4], 0x417be18
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1001a1a8
mov edi, dword [ebp - 0x10c]
mov dword [edi + 4], edx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1001a1e2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x23c], 0x9c2329b6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001a1d1
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], ebx
jl 0x1001a286
mov dword [ebp - 0x14], 0x9facd4a7
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x14], ebx
jmp 0x1001a218
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x150], 0x6eda
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1001a207
mov eax, dword [edi + 4]
mov eax, dword [ebp + eax*4 - 0x84]
neg eax
je 0x1001a25d
mov eax, dword [edi + 4]
mov edx, esi
mov dword [ebp + eax*4 - 0x84], 0x2ef51ae9
mov dword [ebp - 0x14], 0x18a5c428
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x20], 0xffffffff
jge 0x1001a25f
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
push 2
setge cl
sub ecx, dword [ebp - 0x150]
neg ecx
pop edx
sbb ecx, ecx
inc ecx
add ecx, dword [edi + 4]
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x20]
jns 0x1001a1f4
mov dword [ebp - 0x20], ebx
jmp 0x1001a33a
mov dword [ebp - 0x18], 0x95848308
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x1001a337
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001a2b6
push ebx
push 0xd20
call dword [sym.imp.USER32.dll_EndPaint]
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x84], ebx
jne 0x1001a2cc
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x84]
imul eax, dword [ebp - 0x20], 0xfffd
add eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setge dl
cmp edx, dword [ebp + eax*4 - 0x84]
jge 0x1001a302
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10c]
cmp ecx, dword [eax]
setg dl
mov dword [ebp - 0x234], edx
dec dword [ebp - 0x18]
jns 0x1001a2a1
push 2
pop edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x1001a28e
dec dword [edi + 4]
jns 0x1001a1c9
lea ecx, [ebp - 0x10c]
call fcn.1001b2f9
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 5
jl 0x1001a18c
cmp byte [ebp + 0xc], 0
je 0x1001a5d1
cmp dword [ebp - 0xa4], 0
je 0x1001a5d1
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x20], 0xb743d837
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x24], 0x5006
cmp dword [ebp - 0x24], 0x51c3
mov dword [ebp - 0xe4], eax
jle 0x1001a416
mov eax, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov dword [ebp - 0x30], ebx
cdq
idiv edi
mov dword [ebp - 0x2c], ebx
mov edi, ebx
mov eax, edx
mov dword [ebp - 0x18], eax
cdq
lea ecx, [ebp - 0x254]
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.1000d5ba
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001a3d9
mov eax, dword [eax]
push eax
call fcn.1004f716
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x254]
call fcn.1001b6c7
mov eax, dword [ebp - 0x18]
inc edi
cmp edi, 0x6e01
jl 0x1001a3bc
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x30], edi
cmp edi, 0x6269
jl 0x1001a3af
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x25dd
jl 0x1001a3aa
mov dword [ebp - 0x18], 0xd004dde9
cmp dword [ebp - 0x24], 0x4cd8
jge 0x1001a431
push 0x10008a3c
call fcn.1004f716
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x124]
push 3
call fcn.1001b277
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x14], ebx
jmp 0x1001a45e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x124]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001a44e
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x20]
jne 0x1001a484
mov eax, esi
cmp dword [ebp - 0x20], ebx
jne 0x1001a486
mov eax, ebx
mov dword [ebp - 0x14], eax
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x14], 0xffff
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x20]
jle 0x1001a4ba
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, esi
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, eax
setne dl
xor ecx, ecx
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp edx, eax
mov eax, dword [ebp - 0x124]
setl cl
mov dword [ebp - 0x2c], ecx
mov dword [eax + 8], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x2c]
setle cl
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ebx
je 0x1001a60a
mov dword [ebp - 0x24], 0x7ab8
mov dword [ebp - 0x18], ebx
jmp 0x1001a57c
mov dword [ebp - 0x30], 0x660f181e
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], ebx
jmp 0x1001a52a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x54], 0xa0e1c2a9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001a51c
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001a54a
push esi
push 0x63a
push 0xe3a
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], ebx
jne 0x1001a56a
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe7
jge 0x1001a50a
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov esi, dword [ebp - 0x124]
setle dl
xor ecx, ecx
add edx, dword [esi + 8]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
mov eax, 0x6e32111c
setne cl
sub eax, dword [esi + 8]
sub eax, ecx
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x14], eax
or dword [ebp - 4], 0xffffffff
call fcn.1001b2f9
mov eax, dword [ebp - 0xa4]
xor esi, esi
mov dword [ebp - 0xe0], eax
inc esi
cmp dword [ebp - 0x28], 0
jne 0x1001acbe
cmp dword [ebp - 0xac], 0
jle 0x1001acbe
push 0xfffffffffffffffe
pop edi
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0xc8]
push 4
call fcn.1001b277
mov dword [ebp - 0x2c], 0xe76373a4
mov dword [ebp - 0x14], ebx
jmp 0x1001a702
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xffffffec
jne 0x1001a582
mov dword [ebp - 0x30], 0x44aa
cmp dword [ebp - 0x30], 0x4720
jle 0x1001a672
mov esi, ebx
mov edi, ebx
mov ebx, 0x71f1
mov eax, edi
mov ecx, 0x1060e618
cdq
push edx
push eax
call fcn.1001b046
add edi, esi
dec ebx
jne 0x1001a630
inc esi
cmp esi, 0x6fbc
jl 0x1001a629
push 0x2397
push 0x1353
push 0x224
push 0x14a2
push 0xb12
push ebx
push ebx
push ebx
push ebx
push 0xa
call dword [sym.imp.USER32.dll_DrawStateW]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001a687
push ebx
push 0x1c8c
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0x30], 0x4377
jge 0x1001a6c7
mov edx, 0x10008a7c
mov ecx, 0x1060e618
call fcn.1001d551
jmp 0x1001a6c7
mov dword [ebp - 4], 0xd
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001a6e7
push 0x1585
push 0xfb3
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
dec dword [ebp - 0x18]
jmp 0x1001a60d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc8]
mov dword [eax + ecx*4], 0x285ce96b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001a6ef
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001a71e
push ebx
push 0xdba
push ebx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
cmp dword [ebp - 0x18], ebx
je 0x1001a759
cmp dword [ebp - 0x18], esi
jle 0x1001a735
mov eax, dword [ebp - 0xc8]
mov edx, esi
cmp dword [eax + 8], ebx
jne 0x1001a737
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, edi
mov ecx, dword [ebp - 0xc8]
setne al
add eax, dword [ecx]
jne 0x1001a766
cmp dword [ecx + 8], ebx
jne 0x1001a766
jmp 0x1001a75f
mov ecx, dword [ebp - 0xc8]
cmp dword [ecx + 8], ebx
mov ecx, ebx
je 0x1001a768
mov ecx, esi
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0xc8]
call fcn.1001b2f9
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c0f0]
lea eax, [ebp - 0x1d0]
push eax
lea eax, [ebp - 0x1e0]
mov dword [ebp - 0x90], ebx
push eax
push ebx
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x8c], ebx
movdqu xmmword [ebp - 0x1e0], xmm0
mov dword [ebp - 0x88], ebx
call fcn.1001dc74
push 3
lea ecx, [ebp - 0x168]
mov dword [ebp - 4], 0x10
call fcn.1001b277
push 3
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x1001a7fc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x168]
mov dword [eax + ecx*4], 0xacb8f2ba
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1001a7e9
mov dword [ebp - 0x18], ebx
jmp 0x1001a817
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x13c], 0x198ab79
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1001a806
mov eax, dword [ebp - 0x90]
mov dword [eax], ebx
cmp dword [eax], 5
jne 0x1001aa75
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x14], ebx
jmp 0x1001a847
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5c], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001a839
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x1001aa68
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x14], 0x746a1c17
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], esi
jg 0x1001aa60
mov dword [ebp - 0x2c], 0x70c5
cmp dword [ebp - 0x2c], 0x712e
jle 0x1001a8ea
mov ecx, ebx
mov dword [ebp - 0x14], ebx
mov eax, ebx
mov dword [ebp - 0x30], ebx
mov edi, ebx
cdq
idiv edi
mov dword [ebp - 0x20], ebx
and edx, ecx
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x20]
mov ecx, 0x1060e618
or eax, edx
cdq
push edx
push eax
call fcn.1001b046
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0xc28
jl 0x1001a89a
mov eax, dword [ebp - 0x30]
inc edi
mov ecx, dword [ebp - 0x14]
cmp edi, 0x444f
jl 0x1001a88f
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x4684
jl 0x1001a88d
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x2e17
jl 0x1001a888
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
lea ecx, [ebp - 0x15c]
call fcn.1001b277
mov byte [ebp - 4], 0x13
cmp dword [ebp - 0x2c], 0x6de3
jge 0x1001a939
mov edx, 0x10008ad0
mov ecx, 0x1060e618
call fcn.1001d551
jmp 0x1001a939
mov dword [ebp - 4], 0x12
push 0xfffffffffffffff6
mov dword [ebp - 0x20], 0xffffffff
pop edi
mov dword [ebp - 0x14], ebx
jmp 0x1001a962
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x15c]
mov dword [eax + ecx*4], 0xae8b0121
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001a94f
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001a977
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x5c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x5c]
mov eax, dword [ebp - 0x90]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x168]
setle dl
xor ecx, ecx
mov dword [ebp - 0x138], edx
cmp dword [eax + 4], edx
mov eax, dword [ebp - 0x15c]
setl cl
cmp edi, ecx
mov dword [eax], ecx
sbb eax, eax
inc eax
cmp eax, 0xb15d3e99
mov eax, dword [ebp - 0x24]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x5c]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp dword [ebp - 0x14], ecx
jge 0x1001a9df
mov edx, esi
cmp dword [ebp - 0x20], ebx
jne 0x1001a9e1
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x5c]
cmp eax, edx
mov eax, dword [ebp - 0x18]
setle cl
imul ecx, dword [ebp + eax*4 - 0x5c]
test ecx, ecx
je 0x1001aa35
mov dword [ebp - 0x20], ebx
jmp 0x1001aa2d
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x13c]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x138], ecx
mov dword [ebp - 0x14], ebx
jmp 0x1001aa24
cmp dword [ebp - 0x138], ebx
jne 0x1001aa2a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x1001aa19
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x1001aa00
jmp 0x1001aa49
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001aa49
push 0xa4d
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], 0x11
call fcn.1001b2f9
inc dword [ebp - 0x24]
jmp 0x1001a86a
dec dword [ebp - 0x18]
jmp 0x1001a850
mov eax, dword [ebp - 0x90]
inc dword [eax]
jmp 0x1001a824
lea ecx, [ebp - 0x168]
call fcn.1001b2f9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
call fcn.1001b2f9
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0x969ac54c
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1001aac0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x21c], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001aaaf
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001aadb
push ebx
push 0x1dd9
call dword [sym.imp.USER32.dll_EndPaint]
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], 0xa1654207
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x14], 0x1aad
cmp dword [ebp - 0x14], 0x1e37
jle 0x1001ab79
mov dword [ebp - 0x30], ebx
mov edi, ebx
mov ecx, ebx
mov ebx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
mov eax, edi
shl eax, cl
mov ecx, 0x1060e618
or eax, ebx
cdq
push edx
push eax
call fcn.1001b046
mov ecx, dword [ebp - 0x2c]
inc ecx
mov dword [ebp - 0x2c], ecx
cmp ecx, 0x34e
jl 0x1001ab3d
inc edi
push 0
pop ebx
cmp edi, 0x385
jl 0x1001ab35
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x16cc
jl 0x1001ab33
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c180]
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0xd8], ebx
push eax
push ebx
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0xd4], ebx
movdqu xmmword [ebp - 0x210], xmm0
mov dword [ebp - 0xd0], ebx
call fcn.1001dc74
mov dword [ebp - 4], 0x15
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x14], 0x1a82
jge 0x1001ac02
mov edx, 0x10008b20
mov ecx, 0x1060e618
call fcn.1001d551
jmp 0x1001ac02
mov eax, dword [ebp - 0xd8]
lea ecx, [ebp - 0xd8]
or dword [ebp - 4], 0xffffffff
mov dword [eax], 0x13
call fcn.1001b2f9
mov ecx, dword [ebp - 0xa8]
test ecx, ecx
je 0x1001acbe
cmp dword [ebp - 0xac], 0
je 0x1001acbe
call fcn.100194dc
mov edi, eax
mov dword [ebp - 0x18], 0xea5d6c05
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], 0xffffffec
jmp 0x1001acad
push esi
lea ecx, [ebp - 0x198]
call fcn.1001b277
mov dword [ebp - 0x14], 0xc66f5a9c
mov dword [ebp - 0x14], ebx
jmp 0x1001ac7d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x198]
mov dword [eax + ecx*4], 0xe0b4074d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001ac6a
mov dword [ebp - 0x14], ebx
jmp 0x1001ac9a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x198]
mov dword [eax + ecx*4], 0x8d3c891c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001ac87
lea ecx, [ebp - 0x198]
call fcn.1001b2f9
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe5
je 0x1001ac52
lea eax, [ebp - 0x4c]
push eax
call fcn.1001b39d
mov dword [eax], edi
mov dword [ebp - 0x14], 0x13dd33a4
mov dword [ebp - 0x14], 0x17
jmp 0x1001acf8
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001acf5
push 0x156b
push ebx
push ebx
push ebx
push ebx
push 0xd8d
push 0xb2a
push 0x1c0
call dword [sym.imp.USER32.dll_ScrollWindowEx]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe5
jge 0x1001acce
mov dword [ebp - 0x18], 0x5df3
cmp dword [ebp - 0x18], 0x61a1
jle 0x1001ad9c
push ebx
push 0x1c8c
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
mov dword [ebp - 0x34], ebx
mov edi, ebx
mov dword [ebp - 0x14], ebx
mov ecx, edi
mov dword [ebp - 0x30], 0x3ca8
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x2c], ecx
mov eax, edi
or eax, ecx
lea ecx, [ebp - 0x284]
cdq
push edx
push eax
call fcn.1000d5ba
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001ad51
mov eax, dword [eax]
push eax
call fcn.1004f716
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x284]
call fcn.1001b6c7
mov ecx, dword [ebp - 0x2c]
dec ecx
dec dword [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
jne 0x1001ad35
mov edi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x18dc
jl 0x1001ad26
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp eax, 0x52bf
jl 0x1001ad21
push ebx
push ebx
push 0x10aa
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
mov dword [ebp - 0x34], 0x5bc3
cmp dword [ebp - 0x34], 0x5f79
jle 0x1001adf8
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x2c], ebx
and eax, edi
lea ecx, [ebp - 0x26c]
cdq
push edx
push eax
call fcn.1000d5ba
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001adcd
mov eax, dword [eax]
push eax
call fcn.1004f716
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x26c]
call fcn.1001b6c7
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x243f
jl 0x1001adb3
inc edi
cmp edi, 0x4ab3
jl 0x1001adae
mov byte [ebp - 0x19], bl
cmp dword [ebp - 0x34], 0x59b7
jge 0x1001ae0f
push 0x10008be0
call fcn.1004f716
pop ecx
cmp byte [ebp - 0x19], 0
je 0x1001ae1d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0x18], 0x5a57
jge 0x1001ae31
push 0x10008b90
call fcn.1004f716
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
call fcn.10014fb6
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c170]
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0x200]
mov dword [ebp - 0x68], ebx
push eax
push ebx
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x64], ebx
movdqu xmmword [ebp - 0x200], xmm0
mov dword [ebp - 0x60], ebx
call fcn.1001dc74
mov dword [ebp - 4], 0x1c
lea ecx, [ebp - 0x18c]
mov dword [ebp - 0x14], 0xf8c7b5c6
push esi
call fcn.1001b277
mov dword [ebp - 0x18], ebx
jmp 0x1001aea0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x44], 0x69bd697e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001ae92
mov dword [ebp - 0x18], ebx
jmp 0x1001aeba
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18c]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001aeaa
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x44], eax
test eax, eax
je 0x1001af1d
mov eax, dword [ebp - 0x68]
cmp dword [eax + 0xc], ebx
je 0x1001aef7
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov edx, esi
cmp eax, 0xb9c2
mov eax, dword [ebp - 0x44]
setge cl
cmp ecx, esi
sbb ecx, ecx
inc ecx
add eax, ecx
jne 0x1001aef9
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x68]
cmp dword [ecx], 0xfffffffd
sete al
imul eax, dword [ecx]
cmp eax, 0x4cc5
jle 0x1001af20
jmp 0x1001af22
mov ecx, dword [ebp - 0x68]
mov esi, ebx
xor eax, eax
cmp dword [ecx], esi
setge al
imul eax, dword [ecx + 8]
xor ecx, ecx
cmp eax, 0x78e60d74
mov eax, dword [ebp - 0x18c]
setl cl
mov dword [eax], ecx
lea ecx, [ebp - 0x18c]
call fcn.1001b2f9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.1001b2f9
cmp dword [ebp - 0x3c], 0
jne 0x1001afa8
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x1001afa8
mov dword [ebp - 0x38], 0x3905c809
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001af79
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1001af8b
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov edx, dword [ebp - 0x70]
mov ecx, esi
call fcn.10019512
mov esi, eax
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0xe8], esi
call fcn.1001b33b
mov dword [eax], esi
mov eax, dword [ebp + 8]
lea esi, [ebp - 0xe8]
mov ecx, dword [ebp - 0xc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret