Function at 0x1001bee1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
push ebx
mov dword [ebp - 0x54], edx
push esi
mov dword [ebp - 0x1c], 0xfffffff9
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], 7
mov dword [ebp - 8], 0x36f6dd8d
mov dword [ebp - 8], 0x9881
mov dword [ebp - 0x24], edi
mov dword [ebp - 0xc], ecx
jmp 0x1001bf28
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x128], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001bf1b
mov dword [ebp - 0xc], ecx
jmp 0x1001bf44
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xf4], 0x13d8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x1001bf33
inc dword [ebp - 8]
mov esi, 0x93dda37b
mov dword [ebp - 0x128], esi
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, 9
setg cl
xor eax, eax
cmp edx, ecx
setne al
xor ecx, ecx
sub esi, eax
mov eax, dword [ebp - 0x20]
cmp esi, eax
setl cl
xor eax, eax
cmp ecx, 2
setl al
xor edx, edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
je 0x1001bf9e
cmp dword [ebp - 0xf4], edx
je 0x1001bf9e
xor eax, eax
inc eax
jmp 0x1001bfa0
mov eax, edx
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0xb26bdde0
mov dword [ebp - 0x10], 0x9bac
mov dword [ebp - 0x18], edx
push 3
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 8], edx
pop esi
jmp 0x1001bfd4
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x11c], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x1001bfc3
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x1a
jl 0x1001c0b7
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 8], 0x34f5
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
cmp eax, 0xffff60b1
setl cl
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x15256ee9
setle al
xor ecx, ecx
cmp eax, 1
setl cl
imul ecx, dword [ebp - 0x118]
mov byte [ebp - 1], dl
test ecx, ecx
je 0x1001c059
cmp byte [ebp - 1], 0
je 0x1001c081
push edx
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x1001c07f
cmp byte [ebp - 1], 0
je 0x1001c06b
push edx
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
xor edx, edx
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x1001c081
push 0x164c
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor edx, edx
mov dword [ebp - 0x10], edx
jmp 0x1001c0a1
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x1001c09e
push edx
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
xor edx, edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x1001c086
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1a
jge 0x1001bff2
push 3
pop esi
mov dword [ebp - 8], 0x4801897a
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x14], 0xe327439c
mov dword [ebp - 0x30], edx
mov dword [ebp - 8], edx
jmp 0x1001c0f0
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x50], 0xd21dfe4b
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x1001c0e2
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x8c]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x80]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
je 0x1001c13c
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x1001c156
push edx
push 0x1442
push 0x2153
call dword [sym.imp.GDI32.dll_CreatePen]
xor edx, edx
jmp 0x1001c156
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x14], edx
jmp 0x1001c151
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1001c148
mov dword [ebp - 8], edx
jmp 0x1001c16c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x94], 8
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x1001c15b
xor esi, esi
inc esi
mov dword [ebp - 8], esi
cmp dword [ebp - 8], edx
jl 0x1001c5e7
mov eax, 0x57e6
mov dword [ebp - 0x14], 0x9b54
mov dword [ebp - 0x10], 0xffff
mov dword [ebp - 0x18], 0xd743ccc
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x30], 0xd06de21e
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xc], edx
jmp 0x1001c1d7
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc4], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001c1c6
mov dword [ebp - 0xc], edx
jmp 0x1001c1f3
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xb8], 0x6ef6f0c3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001c1e2
mov dword [ebp - 0xc], edx
jmp 0x1001c20b
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x104], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x1001c1fe
mov eax, dword [ebp - 0x14]
mov ecx, 0x5a2e
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0xbc], edi
mov eax, dword [ebp - 0x10]
sub ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov esi, dword [ebp - 0x14]
setne dl
xor ecx, ecx
sub esi, edx
sub esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp esi, eax
setge cl
xor eax, eax
cmp edi, ecx
setne al
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
jne 0x1001c268
cmp dword [ebp - 0x18], 0
jne 0x1001c268
xor eax, eax
jmp 0x1001c26b
xor eax, eax
inc eax
mov dword [ebp - 0xb8], eax
xor edx, edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 0x2e84cbf7
je 0x1001c34e
mov dword [ebp - 0x10], 0xffffffff
xor edx, edx
inc edx
xor ecx, ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], 0xb1a73b02
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 0x9d7fccea
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], 0xf3d0097e
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x1c], 0x464e
mov dword [ebp - 0x20], 0xee42ac9
mov dword [ebp - 0xc], ecx
jmp 0x1001c2fb
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x140], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001c2ee
mov dword [ebp - 0xc], ecx
jmp 0x1001c317
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x14c], 0x2b81
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001c306
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], ecx
jne 0x1001c339
mov edx, ecx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x14], ecx
inc dword [ebp - 0x20]
jmp 0x1001c435
mov dword [ebp - 0x14], 0
jmp 0x1001c365
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x40], 0x7358
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1001c357
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 2
jg 0x1001c435
mov dword [ebp - 0x14], 0
jmp 0x1001c393
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x58], 0x1d9d30cd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1001c385
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x40]
neg ecx
mov esi, dword [ebp - 0x40]
sbb ecx, ecx
neg ecx
add eax, ecx
imul esi, eax
mov dword [ebp - 0xbc], esi
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x58]
sub edx, 0xf50edc67
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, 6
mov eax, dword [ebp - 0x40]
setg cl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x100]
setg bl
xor edx, edx
cmp esi, eax
mov eax, dword [ebp - 0xa4]
setne dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xa4]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
sete cl
xor edx, edx
cmp ecx, 0x7320
setge dl
xor ecx, ecx
imul edx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setle cl
mov dword [ebp + eax*4 - 0xb8], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x1001c37c
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x10], 1
mov edi, 0x1a049fe3
mov dword [ebp - 0x30], 0xe2cf4565
mov dword [ebp - 0xe4], edi
mov dword [ebp - 0xe0], edi
mov dword [ebp - 0xdc], edi
mov dword [ebp - 0xd8], edi
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x30], 0x38591b6
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x14], 0
jmp 0x1001c48f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xac], 0x13e19f23
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001c47e
mov dword [ebp - 0x14], 0
jmp 0x1001c4da
mov dword [ebp - 0xc], 0x9ed080c1
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1001c4b7
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
mov dword [ebp - 0xc], 0
jmp 0x1001c4d1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe4], 0x365653d4
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x1001c4c0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x1001c49e
inc dword [ebp - 0xac]
mov dword [ebp - 0x30], 9
cmp dword [ebp - 8], 0
jne 0x1001c4fd
cmp dword [ebp - 0x10], 0
jne 0x1001c4fd
xor edx, edx
jmp 0x1001c500
xor edx, edx
inc edx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 8]
dec eax
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x94]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x6c0e263
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setg cl
xor edx, edx
cmp ecx, 0xefbd
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
xor esi, esi
neg eax
inc esi
mov dword [ebp - 0x30], eax
xor edx, edx
mov dword [ebp - 0x18], 0x692beaa3
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
je 0x1001c58b
mov byte [ebp - 1], dl
cmp byte [ebp - 1], dl
je 0x1001c5a2
push edx
push edx
push edx
push edx
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
jmp 0x1001c5a2
mov dword [ebp - 0x20], 0xbb67
mov dword [ebp - 0x30], 6
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], edx
jl 0x1001c5d6
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x1001c5d1
push 0x2614
push edx
push edx
push edx
push edx
push 0x1342
push 0x8ad
call ebx
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
xor edx, edx
dec dword [ebp - 0x10]
jns 0x1001c5aa
dec dword [ebp - 8]
mov eax, 0x57e6
jns 0x1001c186
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x20], 0x45cb81ec
mov dword [ebp - 0x14], 0x19c44d4e
mov dword [ebp - 8], 0xbbbc254e
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 0x36572186
mov dword [ebp - 0x1c], 0x449ef57a
mov dword [ebp - 0x1c], 0x7280dda2
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x10], edx
jmp 0x1001c635
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6c], 0xb2c593c8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001c627
mov dword [ebp - 0x10], edx
jmp 0x1001c651
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x15c], 0x1a770aac
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1001c640
mov eax, dword [ebp - 0x68]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
cmp edx, 0xfffffff7
jne 0x1001c676
cmp dword [ebp - 0x6c], 0
je 0x1001c676
mov edx, esi
jmp 0x1001c678
xor edx, edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x6c], ecx
mov eax, dword [ebp - 0x14]
sub ecx, eax
sub ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 8]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setge dl
xor ecx, ecx
cmp edx, 0x67e7
setge cl
xor ebx, ebx
cmp ecx, eax
setne bl
xor edx, edx
imul ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
shl ebx, 3
cmp ebx, eax
mov eax, dword [ebp - 8]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor ebx, ebx
imul eax, ecx, 0xa0c0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x1001c703
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 8]
inc edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp eax, 0xa66f
setle cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
cmp dword [edi + 0x10], ebx
jne 0x1001c740
xor al, al
jmp 0x1001ce48
mov dword [ebp - 0x14], 0x60b0ceaf
mov dword [ebp - 0x10], 0xde637c5b
mov dword [ebp - 0x1c], edx
mov dword [ebp - 8], ebx
jmp 0x1001c764
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x38], 0xb4456e34
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x1001c756
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x14], ebx
je 0x1001c77a
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x1c], ebx
je 0x1001c866
mov dword [ebp - 0xc], 0x1d68
mov dword [ebp - 0x1c], 0x4d4a788a
cmp dword [ebp - 0x14], ebx
je 0x1001c7af
cmp dword [ebp - 0x38], ebx
jne 0x1001c7a4
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
jne 0x1001c7b1
mov edx, ebx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp eax, edx
setle cl
cmp ecx, dword [ebp - 0xc]
jge 0x1001c818
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 8], ebx
jmp 0x1001c7dd
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xec], 0xfffd
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x1001c7cc
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
je 0x1001c7fd
cmp dword [ebp - 0xec], ebx
je 0x1001c7fd
cmp dword [ebp - 0x14], ebx
je 0x1001c7fd
xor eax, eax
inc eax
jmp 0x1001c7ff
mov eax, ebx
push 0xfffffffffffffff6
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
jmp 0x1001c82b
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001c82b
push 0x1aa8
call dword [sym.imp.USER32.dll_MessageBeep]
mov dword [ebp - 0xc], ebx
jmp 0x1001c85c
mov dword [ebp - 0x10], ebx
jmp 0x1001c847
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001c844
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001c835
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x38], ebx
jne 0x1001c90f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jle 0x1001c830
jmp 0x1001c90f
mov dword [ebp - 0xc], 0x6953c535
mov dword [ebp - 0x18], 0xd3eafca1
mov dword [ebp - 0x20], 8
cmp dword [ebp - 0xc], 0x633b
jl 0x1001c88b
mov esi, edx
cmp dword [ebp - 0x1c], ebx
jne 0x1001c88d
mov esi, ebx
mov eax, dword [ebp - 0xc]
or ecx, 0xffffffff
sub ecx, eax
xor eax, eax
cmp ecx, 0x6cdaa932
setle al
imul eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0xc]
jne 0x1001c8b0
mov eax, ebx
cmp dword [ebp - 0xc], ebx
je 0x1001c8b2
mov eax, edx
mov dword [ebp - 0x18], eax
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
setne dl
add edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
sub esi, eax
mov eax, dword [ebp - 0xc]
cmp esi, ecx
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setl cl
xor edx, edx
cmp ecx, 0x1871
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setg bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor ebx, ebx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x18], 0xf20920a6
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 8], ebx
jmp 0x1001c941
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x48], 0xfffffffc
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x1001c933
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0x149c
call fcn.1001f409
add esp, 0x10
cmp dword [ebp - 0x2c], ebx
jne 0x1001c9d6
mov eax, dword [ebp - 0x2c]
xor edx, edx
imul eax, dword [ebp - 0x48], 3
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setg dl
xor ecx, ecx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
test eax, eax
mov eax, dword [ebp - 0x48]
setns cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setge dl
sub edx, eax
mov eax, 0xfbb9cf7d
cmp eax, edx
mov eax, dword [ebp - 0x28]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 0x28]
jge 0x1001c9b7
cmp dword [ebp - 0x48], ebx
jne 0x1001c9b7
mov ecx, ebx
jmp 0x1001c9ba
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0xe81d
setle al
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
je 0x1001c9d6
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x28], ebx
je 0x1001c9de
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], ebx
jmp 0x1001ca11
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ebx
jl 0x1001ca0e
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001ca09
mov edx, 0x4d0b
xor cl, cl
call fcn.1001ba5f
dec dword [ebp - 0x2c]
jns 0x1001c9f4
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x1001c9ec
lea eax, [ebp - 0x54]
push eax
push ebx
call fcn.1001f4e3
pop ecx
mov dword [ebp - 0xc], 0x15a13695
pop ecx
mov dword [ebp - 8], ebx
jmp 0x1001ca3c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x4c], 0x6ce4a6f4
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x1001ca2e
cmp dword [ebp - 0xc], ebx
jne 0x1001ca75
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, ebx
cmp edx, eax
sete cl
xor edx, edx
imul ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
setne dl
sub edx, 0xc6e5
neg edx
sbb edx, edx
inc edx
cmp edx, dword [ebp - 0xc]
jg 0x1001ca75
mov eax, ebx
jmp 0x1001ca78
xor eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xc], ebx
jmp 0x1001cab4
mov dword [ebp - 0x18], 0xd4431fad
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x4c], ecx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1001cab1
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001caac
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec dword [ebp - 0x18]
jns 0x1001ca9d
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jle 0x1001ca80
cmp dword [edi + 0x14], 0x10
jb 0x1001cac3
mov ecx, dword [edi]
jmp 0x1001cac5
mov ecx, edi
mov esi, 0x198a
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x44], ecx
jb 0x1001cad7
mov edx, dword [edi]
jmp 0x1001cad9
mov edx, edi
mov eax, dword [edi + 0x10]
add eax, edx
cmp ecx, eax
je 0x1001cccd
mov dword [ebp - 0xd4], esi
xor ecx, ecx
mov dword [ebp - 0xd0], esi
inc ecx
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x24], 0x93e9323d
mov dword [ebp - 0x24], 0x6923607a
mov dword [ebp - 0x24], 0xcef054a2
mov dword [ebp - 0x24], 0x2cb3a3fc
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0xad9ddcef
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0x2ca96836
mov dword [ebp - 0x24], 0x1b0ae28d
mov dword [ebp - 0x24], ecx
push 3
mov dword [ebp - 0x24], 0x3d8c5378
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x1001cb73
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x134], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001cb66
mov dword [ebp - 0x10], ebx
jmp 0x1001cb8b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5c], 0xea311c3f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001cb7d
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x1001cbc0
mov dword [ebp - 8], 0xafd94fe5
mov dword [ebp - 8], ebx
jmp 0x1001cbb5
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xd4], 0x6f6d
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x1001cba4
dec dword [ebp - 0x18]
jns 0x1001cb98
inc dword [ebp - 0x5c]
mov eax, dword [ebp - 0x44]
mov al, byte [eax]
cmp al, 0x30
jl 0x1001cc69
cmp al, 0x39
jg 0x1001cc69
push 4
pop eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x7c], ebx
jmp 0x1001cc44
mov dword [ebp - 0x18], 9
mov dword [ebp - 8], ebx
jmp 0x1001cc09
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x110], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x1001cbf8
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x1001cc41
mov dword [ebp - 8], 0x1449c9fb
mov dword [ebp - 8], ebx
jmp 0x1001cc37
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x110], 0xb04800fa
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x1001cc26
dec dword [ebp - 0x18]
jns 0x1001cc1a
dec dword [ebp - 0x7c]
cmp dword [ebp - 0x7c], 0xffffffe5
jl 0x1001cbec
lea eax, [ebp - 0x54]
push eax
push ebx
lea eax, [ebp - 0x44]
push 0x4788
push eax
call fcn.1001f837
mov ecx, dword [ebp - 0x44]
add esp, 0x10
inc ecx
jmp 0x1001caca
mov dword [ebp - 8], ebx
jmp 0x1001cc7c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x3c], 0xfffffff9
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x1001cc6e
mov dword [ebp - 0x3c], 0xb
jmp 0x1001ccbd
mov dword [ebp - 8], 0x47dc4b4e
mov dword [ebp - 8], 0xfffffff0
cmp dword [ebp - 8], 0x18
je 0x1001ccb5
mov byte [ebp - 0x31], bl
lea edx, [ebp - 0x31]
call fcn.1001ba5f
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x18
push 1
pop ecx
jne 0x1001cc9e
cmp dword [ebp - 0x3c], ebx
jne 0x1001ccc3
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xa
jne 0x1001cc8a
mov eax, dword [ebp - 0x54]
mov dword [eax], ebx
jmp 0x1001c739
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x1c], 0x45cb81ec
mov dword [ebp - 0x14], 0x19c44d4e
mov dword [ebp - 8], 0xbbbc254e
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 0x36572186
mov dword [ebp - 0x20], 0x449ef57a
mov dword [ebp - 0x20], 0x7280dda2
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x10], ebx
jmp 0x1001cd1b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x64], 0xb2c593c8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001cd0d
mov dword [ebp - 0x10], ebx
jmp 0x1001cd37
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x16c], 0x1a770aac
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1001cd26
mov eax, dword [ebp - 0x60]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
cmp edx, 0xfffffff7
jne 0x1001cd5c
cmp dword [ebp - 0x64], ebx
je 0x1001cd5c
xor edx, edx
inc edx
jmp 0x1001cd5e
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x64], ecx
mov eax, dword [ebp - 0x14]
sub ecx, eax
sub ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 8]
setge bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 8]
setge cl
xor edx, edx
cmp ecx, 0x67e7
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
shl ecx, 3
cmp ecx, eax
mov eax, dword [ebp - 8]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor ebx, ebx
imul eax, ecx, 0xa0c0
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jne 0x1001cde9
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
cmp eax, 0xa66f
setle cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], 0xe0cf5720
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001ce37
push 0x73c3
push ebx
call fcn.1001cef7
pop ecx
pop ecx
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001ce46
push ebx
call fcn.1001f80a
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret