Function at 0x1001ac38
Capabilities:
Create process on windows
Create thread
Enumerate gui resources
Get disk size
Get memory capacity

Disassembly:
mov eax, 0x1008a7b0
call fcn.10089da0
sub esp, 0x3a8
push ebx
push esi
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
xor esi, esi
push 0
mov dword [ebp - 0x1c], 0xfffffff9
inc esi
mov dword [ebp - 0x17c], edx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x1c], 0xfffffff3
pop ebx
jmp 0x1001af02
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0xec]
push esi
call fcn.10018d3c
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1001ac9e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x158], 0xfe6e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001ac8d
mov dword [ebp - 0x10], ebx
jmp 0x1001acb8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001aca9
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], ebx
jl 0x1001adf2
push 3
lea ecx, [ebp - 0x234]
call fcn.10018d3c
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], ebx
jmp 0x1001acf5
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x234]
mov dword [eax + ecx*4], 0x8af066b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1001ace2
mov eax, dword [ebp - 0x150]
xor edx, edx
cmp eax, 0xab1d
mov eax, dword [ebp - 0x158]
push 4
setle dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x150]
cmp edx, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x234]
sete cl
imul edx, ecx
xor ecx, ecx
add edx, 0xfffffff6
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x1c]
cmp eax, edx
pop eax
setl cl
xor edx, edx
cmp ecx, 0xfffffff7
setle dl
sub eax, edx
je 0x1001ad52
mov eax, esi
cmp dword [ebp - 0x1c], ebx
jne 0x1001ad54
mov eax, ebx
imul eax, eax, 0xfffffff7
test eax, eax
je 0x1001ad62
mov edx, esi
cmp dword [ebp - 0x1c], ebx
jne 0x1001ad64
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x158]
mov eax, dword [ebp - 0x1c]
add ecx, edx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setg cl
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp + eax*4 - 0x158]
mov eax, dword [ebp - 0xec]
sub ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
mov dword [ebp - 0x14], ebx
jmp 0x1001add8
mov dword [ebp - 0x20], 0xffffffff
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001adba
push ebx
push 0x55a
push ebx
call edi
mov dword [ebp - 0x20], ebx
jmp 0x1001add0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xec]
cmp dword [eax + ecx*4], ebx
jne 0x1001add5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1001adbf
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x1001ada1
lea ecx, [ebp - 0x234]
call fcn.10018dbe
dec dword [ebp - 0x10]
jns 0x1001accd
mov dword [ebp - 0x10], 0xffffffe9
jmp 0x1001aee6
mov dword [ebp - 0x20], 0x35cb5140
mov dword [ebp - 0x20], ebx
jmp 0x1001aed1
push 2
lea ecx, [ebp - 0xd4]
call fcn.10018d3c
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x14], ebx
jmp 0x1001ae39
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xd4]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001ae26
mov eax, dword [ebp - 0xd4]
xor ecx, ecx
mov dword [eax], 0xfffffff2
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xd4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x1c]
add edx, 0xee52
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setl cl
add eax, 0xfffffffb
add eax, ecx
je 0x1001ae7a
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xd4]
cmp dword [eax], esi
jne 0x1001ae8b
mov eax, esi
cmp dword [ebp - 0x1c], ebx
jne 0x1001ae8d
mov eax, ebx
mov ecx, dword [ebp - 0x20]
add ecx, eax
mov eax, dword [ebp - 0xd4]
cmp ecx, dword [eax]
jle 0x1001aea8
mov eax, dword [ebp - 0xec]
cmp dword [eax], ebx
mov eax, ebx
je 0x1001aeaa
mov eax, esi
xor edx, edx
cmp eax, esi
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xd4]
setle cl
mov dword [eax], ecx
lea ecx, [ebp - 0xd4]
call fcn.10018dbe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jg 0x1001ae0d
mov eax, dword [ebp - 0xec]
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffef
je 0x1001adfe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec]
call fcn.10018dbe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1001ac76
push 4
lea ecx, [ebp - 0x18c]
call fcn.10018d3c
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], 0xee76f502
mov dword [ebp - 0x10], 0x5d16df25
mov dword [ebp - 0x1c], 0x439cb61d
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], 0x33356370
mov dword [ebp - 0x38], 0xb323
mov dword [ebp - 0x14], ebx
jmp 0x1001af54
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x64], 0xc6a5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001af46
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], ebx
jl 0x1001b05a
mov dword [ebp - 0x28], 0x2ae45661
xor edx, edx
mov dword [ebp - 0x2c], 0xeb945924
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x64]
mov eax, dword [ebp - 0x60]
add ecx, 0xffff
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x64]
cmp eax, edx
setne cl
sub ecx, 0xfffb
neg ecx
sbb ecx, ecx
add ecx, 0xce78eef3
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp + eax*4 - 0x64]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ebx
je 0x1001aff3
cmp dword [ebp - 0x1c], ebx
je 0x1001aff3
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x64]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
je 0x1001aff3
mov ecx, esi
cmp dword [ebp - 0x1c], ebx
jne 0x1001aff5
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x64]
sub ecx, eax
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
xor edx, edx
inc eax
neg eax
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x64]
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x64]
cmp dword [ebp - 0x28], 0x818264d9
sbb eax, eax
inc eax
cmp eax, ecx
jg 0x1001b042
mov edx, ebx
cmp dword [ebp - 0x28], ebx
je 0x1001b044
mov edx, esi
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
add eax, edx
add ecx, eax
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x10]
jns 0x1001af66
mov dword [ebp - 0x1c], ebx
jmp 0x1001b069
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x64], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1001b05f
mov dword [ebp - 0x30], 0x66e66b6c
lea ecx, [ebp - 0x2e8]
push esi
call fcn.10018d3c
mov dword [ebp - 0x2c], 0x4a90611b
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x24], 0x3f6085e0
mov dword [ebp - 0x14], 0x13d0bb94
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], 0xfffe
mov dword [ebp - 0x38], 0x215cd4dc
mov dword [ebp - 0x10], ebx
jmp 0x1001b0c7
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2e8]
mov dword [eax + ecx*4], 0x977a1245
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001b0b4
mov dword [ebp - 0x10], ebx
jmp 0x1001b0e2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x160], 0xfff839e0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001b0d1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b0fa
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
cmp dword [ebp - 0x20], ebx
je 0x1001b117
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x28]
lea ecx, [ebp - 0x2e8]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], ebx
call fcn.10018dbe
mov dword [ebp - 0x10], 0x125d16df
mov dword [ebp - 0x20], 0x8a062b00
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x2c], 0xd53d2ae4
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x34], 0x23fa9dfe
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], 0xfffffff8
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x10]
je 0x1001b19f
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
cmp eax, 0xb6fb96f
setl dl
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setl cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, 0xfffffff6
setg cl
add eax, 8
add eax, ecx
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b20a
push 0x25cc
push 0xfa6
push ebx
call dword [sym.imp.USER32.dll_InflateRect]
mov dword [ebp - 0x14], ebx
jmp 0x1001b222
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18c]
mov dword [eax + ecx*4], 2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001b20f
push esi
lea ecx, [ebp - 0x2d0]
call fcn.10018d3c
mov dword [ebp - 0x14], ebx
jmp 0x1001b248
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2d0]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001b239
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b26a
push ebx
push ebx
push ebx
push ebx
push 0x373
push esi
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b289
push ebx
push 0x172a
push 0x2a5
push 0x1af8
call dword [sym.imp.KERNEL32.dll_RaiseException]
lea ecx, [ebp - 0x2d0]
call fcn.10018dbe
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], ebx
jl 0x1001b565
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], 0x89e022a5
mov dword [ebp - 0x24], 0xd2cc9105
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x30], 0xb462a77b
mov dword [ebp - 0x30], 0x883e
mov dword [ebp - 0x30], 0x5cbf7935
push 4
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x10], ebx
jmp 0x1001b315
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x140], 0xa29
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001b304
mov dword [ebp - 0x10], ebx
jmp 0x1001b330
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x394], 0xc06e3268
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001b31f
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x13c]
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x140]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, eax
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setne dl
mov dword [ebp - 0x24], edx
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x134]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setl dl
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x140]
setl dl
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x140]
cmp edx, eax
setl cl
sub ecx, 0x4a71b966
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x28]
mov dword [ebp - 0x30], 0x21cd4309
mov dword [ebp - 0x10], 0xe76f5020
mov dword [ebp - 0x14], ebx
jmp 0x1001b3e2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x384], 0xdc85
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001b3d1
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], ebx
jl 0x1001b45f
push 2
lea ecx, [ebp - 0x204]
call fcn.10018d3c
mov dword [ebp - 0x20], 0x35a23e86
mov dword [ebp - 0x14], ebx
jmp 0x1001b420
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x204]
mov dword [eax + ecx*4], 0xafa2fafd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001b40d
mov eax, dword [ebp - 0x204]
mov dword [eax], ebx
mov dword [ebp - 0x20], ebx
jmp 0x1001b44a
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x384]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x37c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x1001b433
lea ecx, [ebp - 0x204]
call fcn.10018dbe
dec dword [ebp - 0x10]
jns 0x1001b3f4
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x30], 0x2ccd2044
mov dword [ebp - 0x30], 0xf79b347d
push 9
pop eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x24], ebx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18c]
cmp dword [eax + ecx*4], ebx
jne 0x1001b4ad
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x18c]
setne dl
imul edx, dword [eax + esi*4]
test edx, edx
je 0x1001b51b
mov dword [ebp - 0x30], 0x5b8b78a
mov dword [ebp - 0x10], ebx
jmp 0x1001b4e4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x39c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001b4d7
mov dword [ebp - 0x10], ebx
jmp 0x1001b500
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3a8], 0x7d6364d6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001b4ef
inc dword [ebp - 0x24]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b52c
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
jmp 0x1001b52c
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b52c
push ebx
push ebx
call dword [sym.imp.GDI32.dll_RectInRegion]
mov dword [ebp - 0x14], 0x19
jmp 0x1001b553
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b550
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x14
jg 0x1001b535
dec dword [ebp - 0x1c]
push 1
pop esi
jns 0x1001b2a4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18c]
call fcn.10018dbe
mov dword [ebp - 0x20], 0xffff
lea ecx, [ebp - 0x288]
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x14], esi
push esi
call fcn.10018d3c
push 2
pop eax
push eax
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 4], eax
call fcn.10018d3c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x24], 0xfffffff6
push esi
call fcn.10018d3c
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x24], 0x36511f0b
mov dword [ebp - 0x1c], ebx
jmp 0x1001b5e4
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x288]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001b5d4
mov dword [ebp - 0x1c], ebx
jmp 0x1001b601
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1a4]
mov dword [eax + ecx*4], 0x7392
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1001b5ee
mov dword [ebp - 0x1c], ebx
jmp 0x1001b61b
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1f8]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001b60c
mov dword [ebp - 0x1c], ebx
jmp 0x1001b632
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x170], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001b625
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x288]
sub edx, 0x4fffb
neg edx
sbb edx, edx
xor ecx, ecx
mov dword [eax], 5
inc edx
mov eax, dword [ebp - 0x28]
cmp edx, eax
setne cl
xor edx, edx
test ecx, ecx
sets dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setne cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1a4]
inc dword [eax]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1a4]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], 0xa75e
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1f8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x170], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1f8]
mov dword [eax], ecx
lea ecx, [ebp - 0x1f8]
call fcn.10018dbe
lea ecx, [ebp - 0x1a4]
call fcn.10018dbe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x288]
call fcn.10018dbe
mov dword [ebp - 0x20], 0x571177e8
mov dword [ebp - 0x14], ebx
jmp 0x1001b71c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x124], 0x1dbe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001b70b
mov dword [ebp - 0x20], 0xffffffff
jmp 0x1001b74d
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1001b74a
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x124], ebx
jne 0x1001b74a
dec dword [ebp - 0x14]
jns 0x1001b739
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x19
jne 0x1001b72a
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x1c], 0xfffffff3
jmp 0x1001b9f6
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0xe0]
push esi
call fcn.10018d3c
mov dword [ebp - 4], 4
mov dword [ebp - 0x10], ebx
jmp 0x1001b792
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf8], 0xfe6e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001b781
mov dword [ebp - 0x10], ebx
jmp 0x1001b7ac
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001b79d
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], ebx
jl 0x1001b8e6
push 3
lea ecx, [ebp - 0x240]
call fcn.10018d3c
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], ebx
jmp 0x1001b7e9
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x240]
mov dword [eax + ecx*4], 0x8af066b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001b7d6
mov eax, dword [ebp - 0xf0]
xor edx, edx
cmp eax, 0xab1d
mov eax, dword [ebp - 0xf8]
push 4
setle dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0xf0]
cmp edx, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x240]
sete cl
imul edx, ecx
xor ecx, ecx
add edx, 0xfffffff6
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x1c]
cmp eax, edx
pop eax
setl cl
xor edx, edx
cmp ecx, 0xfffffff7
setle dl
sub eax, edx
je 0x1001b846
mov eax, esi
cmp dword [ebp - 0x1c], ebx
jne 0x1001b848
mov eax, ebx
imul eax, eax, 0xfffffff7
test eax, eax
je 0x1001b856
mov edx, esi
cmp dword [ebp - 0x1c], ebx
jne 0x1001b858
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0x1c]
add ecx, edx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setg cl
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 0xe0]
sub ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
mov dword [ebp - 0x14], ebx
jmp 0x1001b8cc
mov dword [ebp - 0x20], 0xffffffff
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b8ae
push ebx
push 0x55a
push ebx
call edi
mov dword [ebp - 0x20], ebx
jmp 0x1001b8c4
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe0]
cmp dword [eax + ecx*4], ebx
jne 0x1001b8c9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1001b8b3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x1001b895
lea ecx, [ebp - 0x240]
call fcn.10018dbe
dec dword [ebp - 0x10]
jns 0x1001b7c1
mov dword [ebp - 0x10], 0xffffffe9
jmp 0x1001b9da
mov dword [ebp - 0x20], 0x35cb5140
mov dword [ebp - 0x20], ebx
jmp 0x1001b9c5
push 2
lea ecx, [ebp - 0xc8]
call fcn.10018d3c
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x14], ebx
jmp 0x1001b92d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc8]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001b91a
mov eax, dword [ebp - 0xc8]
xor ecx, ecx
mov dword [eax], 0xfffffff2
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc8]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x1c]
add edx, 0xee52
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setl cl
add eax, 0xfffffffb
add eax, ecx
je 0x1001b96e
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc8]
cmp dword [eax], esi
jne 0x1001b97f
mov eax, esi
cmp dword [ebp - 0x1c], ebx
jne 0x1001b981
mov eax, ebx
mov ecx, dword [ebp - 0x20]
add ecx, eax
mov eax, dword [ebp - 0xc8]
cmp ecx, dword [eax]
jle 0x1001b99c
mov eax, dword [ebp - 0xe0]
cmp dword [eax], ebx
mov eax, ebx
je 0x1001b99e
mov eax, esi
xor edx, edx
cmp eax, esi
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xc8]
setle cl
mov dword [eax], ecx
lea ecx, [ebp - 0xc8]
call fcn.10018dbe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jg 0x1001b901
mov eax, dword [ebp - 0xe0]
mov dword [eax], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffef
je 0x1001b8f2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe0]
call fcn.10018dbe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1001b766
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x14], ebx
jmp 0x1001ba27
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5c], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001ba19
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001ba47
push ebx
xor edi, edi
push ebx
inc edi
push edi
push ebx
call esi
jmp 0x1001ba4a
xor edi, edi
inc edi
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x270]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], 0xb26bdde0
mov dword [ebp - 0x24], ebx
push 3
call fcn.10018d3c
push 3
mov dword [ebp - 0x30], 0x185a1fa1
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x1001bab1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x16c], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001baa0
mov dword [ebp - 0x10], ebx
jmp 0x1001bace
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x270]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001babb
mov dword [ebp - 0x16c], ebx
jmp 0x1001baee
mov dword [ebp - 0x2c], 0x5e00
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x16c]
cmp dword [ebp - 0x16c], 0xffffffee
jle 0x1001badb
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x270]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x270]
call fcn.10018dbe
mov dword [ebp - 0x20], 0xffff
lea ecx, [ebp - 0x258]
mov dword [ebp - 0x10], 0xfffffff8
mov dword [ebp - 0x14], edi
push edi
call fcn.10018d3c
push 2
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 4], 5
call fcn.10018d3c
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1d4]
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0xfffffff6
push edi
call fcn.10018d3c
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x24], 0x36511f0b
mov dword [ebp - 0x1c], ebx
jmp 0x1001bb80
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x258]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001bb70
mov dword [ebp - 0x1c], ebx
jmp 0x1001bb9d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1bc]
mov dword [eax + ecx*4], 0x7392
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1001bb8a
mov dword [ebp - 0x1c], ebx
jmp 0x1001bbb7
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1d4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001bba8
mov dword [ebp - 0x1c], ebx
jmp 0x1001bbce
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x178], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001bbc1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x258]
sub edx, 0x4fffb
neg edx
sbb edx, edx
xor ecx, ecx
mov dword [eax], 5
inc edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
setne cl
xor edx, edx
test ecx, ecx
sets dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setne cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1bc]
inc dword [eax]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1bc]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], 0xa75e
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1d4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x178], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1d4]
mov dword [eax], ecx
lea ecx, [ebp - 0x1d4]
call fcn.10018dbe
lea ecx, [ebp - 0x1bc]
call fcn.10018dbe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.10018dbe
mov dword [ebp - 0x34], 0xfffffff6
lea ecx, [ebp - 0x1ec]
push 2
call fcn.10018d3c
mov dword [ebp - 0x10], 0xaabecba2
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], 0x5b36
mov dword [ebp - 0x14], ebx
jmp 0x1001bcd8
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1ec]
mov dword [eax + ecx*4], 0x13dd33a4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001bcc5
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], ebx
jl 0x1001bd50
mov dword [ebp - 0x24], 0x40ca7005
mov dword [ebp - 0x14], ebx
jmp 0x1001bd03
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x180], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001bcf2
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1ec]
mov ecx, dword [eax + ecx*4]
sub ecx, dword [eax + edx*4]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x2c]
jle 0x1001bd3a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1ec]
cmp dword [eax + ecx*4], ebx
mov eax, ebx
je 0x1001bd3c
mov eax, edi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x180], edi
dec dword [ebp - 0x10]
jns 0x1001bce6
lea ecx, [ebp - 0x1ec]
call fcn.10018dbe
mov dword [ebp - 0x20], 0x571177e8
mov dword [ebp - 0x14], ebx
jmp 0x1001bd78
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x174], 0x1dbe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001bd67
mov dword [ebp - 0x20], 0xffffffff
jmp 0x1001bda9
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1001bda6
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x174], ebx
jne 0x1001bda6
dec dword [ebp - 0x14]
jns 0x1001bd95
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x19
jne 0x1001bd86
mov dword [ebp - 0x20], 0x5a136951
lea ecx, [ebp - 0x210]
push 3
call fcn.10018d3c
push edi
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 7
call fcn.10018d3c
push 3
lea ecx, [ebp - 0x330]
mov byte [ebp - 4], 8
call fcn.10018d3c
mov dword [ebp - 0x1c], ebx
jmp 0x1001bdfa
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x40], 0x8ec0ae97
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001bdec
push 3
mov dword [ebp - 0x1c], ebx
pop edx
jmp 0x1001be1a