Function at 0x10019dfd
Capabilities:
Create thread
Delete registry key
Get geographical location
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
push ebx
push esi
mov dword [ebp - 0x10], 0xffffffff
xor ebx, ebx
push edi
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 0xffffffe4
push 3
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0xa0], ecx
pop edi
jl 0x10019fbf
mov esi, 0x74aa0d72
mov dword [ebp - 8], 0xeec5
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x84], esi
mov edx, dword [ebp - 8]
mov dword [ebp - 0x88], edx
cmp dword [ebp - 0x10], 0xd1b9849b
mov ecx, dword [ebp - 8]
sbb eax, eax
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
add ecx, edx
sub ecx, dword [ebp - 8]
add ecx, dword [ebp - 8]
cmp ecx, 0xeea5
setne al
cmp eax, dword [ebp - 0x10]
jle 0x10019f7c
mov dword [ebp - 0xc], 0xfffffffd
xor ecx, ecx
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
test eax, eax
setns cl
xor eax, eax
cmp ecx, 0x7c71
setg al
cmp dword [ebp - 8], eax
jg 0x10019ed9
mov dword [ebp - 0x18], 0x1718bc69
mov dword [ebp - 0xc], ebx
jmp 0x10019ed2
dec dword [ebp - 0x18]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jle 0x10019ecc
jmp 0x10019f2f
mov dword [ebp - 0xc], ebx
jmp 0x10019f2a
mov dword [ebp - 8], ebx
jmp 0x10019f06
mov dword [ebp - 0x14], 0xf19716e2
mov dword [ebp - 0x14], ebx
jmp 0x10019efe
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x90], ebx
jne 0x10019f03
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x10019eef
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x10019ee3
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10019f27
push ebx
push 0x129e
push ebx
push ebx
push 0x261a
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jle 0x10019ede
cmp dword [ebp - 0x1c], ebx
jne 0x10019f5a
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xb8f3be
setg cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
cmp eax, dword [ebp - 0xc]
je 0x10019f5a
mov ecx, ebx
jmp 0x10019f5d
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x84]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x88], ecx
jmp 0x10019f96
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10019f91
push 0xc57
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp dword [ebp - 0x1c], ebx
jne 0x10019fbf
mov dword [ebp - 8], ebx
jmp 0x10019fac
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x90], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x10019f9b
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe4
jge 0x10019e3a
mov dword [ebp - 0x2c], 0x4504cd45
mov dword [ebp - 0x10], 5
mov dword [ebp - 0x14], ebx
jmp 0x10019fe3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x140], 0x8e97eede
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10019fd2
inc dword [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], edi
mov edi, dword [sym.imp.USER32.dll_GetDC]
jg 0x1001a02d
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001a024
push 0x25eb
push ebx
push 0x1bef
push 0x1a80
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x1001a000
lea eax, [ebp - 0x2c]
push eax
push ebx
call fcn.1001dc8e
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 8], 0xbac64a68
inc ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1001a060
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x30], 0xdba33992
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001a052
mov dword [ebp - 8], ebx
jmp 0x1001a08f
mov dword [ebp - 0x10], 0xda5043c4
mov dword [ebp - 0x10], ebx
jmp 0x1001a087
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x30], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001a076
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1d
jne 0x1001a06a
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
sub edx, eax
mov eax, dword [ebp - 8]
cmp edx, eax
mov eax, dword [ebp - 0xc]
sete cl
xor edx, edx
cmp ecx, 0xfe924f63
push 2
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0xc]
setge bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setg dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 8]
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
mov dword [ebp - 0xc], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0xc]
sub edx, eax
mov eax, dword [ebp - 8]
cmp edx, eax
setne cl
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 0x4504cd45
dec dword [ebp - 0x10]
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], 0x13
pop ecx
je 0x1001a1dc
xor ebx, ebx
mov dword [ebp - 0xc], 0xea983111
mov dword [ebp - 0xc], 0xfffffffd
jmp 0x1001a1c5
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x14], ebx
jmp 0x1001a167
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x118], 0x3244d513
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001a156
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001a183
push ebx
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_SetPropA]
push 2
pop ecx
mov dword [ebp - 0x14], 0xffffffe6
jmp 0x1001a1bc
mov dword [ebp - 0x1c], 0x7dcd66a0
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
jl 0x1001a1b9
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001a1b1
push 0x1244
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
dec dword [ebp - 0x1c]
jns 0x1001a19b
push 2
pop ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe7
jg 0x1001a18c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x16
je 0x1001a14a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x13
jne 0x1001a13a
mov dword [ebp - 0x2c], 3
xor ebx, ebx
cmp dword [ebp - 0x2c], 0x13
je 0x1001aae8
jmp 0x1001a1f4
push 2
pop ecx
mov dword [ebp - 0x18], 0xef6f0c3d
mov dword [ebp - 0x1c], 0xa0197cbb
mov dword [ebp - 8], ebx
jmp 0x1001a218
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x9c], 0xf70ad6f2
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x1001a207
mov dword [ebp - 8], ebx
jmp 0x1001a231
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x38], 1
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x1001a223
mov dword [ebp - 8], ebx
jmp 0x1001a24c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xa8], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x1001a23b
mov dword [ebp - 8], ebx
jmp 0x1001a265
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x60], 0x2044653f
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x1001a257
mov dword [ebp - 0x38], ebx
jmp 0x1001a345
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 8], ebx
jmp 0x1001a2e1
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], ebx
jl 0x1001a2a2
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a29a
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
dec dword [ebp - 0xc]
jns 0x1001a289
push 2
pop ecx
mov dword [ebp - 0xc], ebx
jmp 0x1001a2d9
mov dword [ebp - 0x10], 0xfffffff7
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x9c], ebx
jne 0x1001a2de
mov dword [ebp - 0x10], ebx
jmp 0x1001a2d0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9c], 0x7e780ca9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001a2bf
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jle 0x1001a2a7
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jle 0x1001a27e
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], ebx
jne 0x1001a30e
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x38]
push 0
pop ecx
push 2
mov eax, dword [ebp + eax*4 - 0x9c]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov eax, dword [ebp - 8]
setns cl
xor edx, edx
cmp ecx, eax
pop ecx
setg dl
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x1c], edx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jle 0x1001a272
mov dword [ebp - 0x1c], 0xea983111
mov dword [ebp - 0x20], 0x720e
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a373
push ebx
push 1
push 0x1428
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a387
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [ebp - 0x1c], 0xfffffffd
jmp 0x1001aad1
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], ebx
jmp 0x1001a3b0
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xe4], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001a39f
mov dword [ebp - 0xc], ebx
jmp 0x1001a3cc
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xbc], 0xfffffff9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001a3bb
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], ebx
jl 0x1001a4cd
push 2
pop edi
mov dword [ebp - 0x14], ebx
jmp 0x1001a3f8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x70], 0x5a654fdd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001a3ea
mov dword [ebp - 0x68], edi
cmp dword [ebp - 0x68], ebx
jl 0x1001a4a8
mov dword [ebp - 8], 0x449c9fb3
mov dword [ebp - 0x18], 4
mov dword [ebp - 8], edi
cmp dword [ebp - 8], ebx
jl 0x1001a43a
mov eax, dword [ebp - 0x68]
cmp dword [ebp + eax*4 - 0xe4], ebx
jne 0x1001a43a
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xb4], eax
dec dword [ebp - 8]
jns 0x1001a420
mov dword [ebp - 8], ebx
jmp 0x1001a49a
mov dword [ebp - 0x18], 0xffffffff
xor edx, edx
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x68]
imul ecx, eax, 9
mov eax, dword [ebp - 0x6c]
cmp ecx, eax
setge dl
cmp dword [ebp - 8], edx
jne 0x1001a46b
cmp dword [ebp - 8], ebx
je 0x1001a46b
xor eax, eax
inc eax
jmp 0x1001a46d
mov eax, ebx
imul eax, eax, 0x8e48
sub eax, dword [ebp - 8]
jne 0x1001a480
cmp dword [ebp - 8], ebx
jne 0x1001a480
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x18], eax
jl 0x1001a491
cmp dword [ebp - 0x18], ebx
jne 0x1001a491
mov eax, ebx
jmp 0x1001a494
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x1001a43f
dec dword [ebp - 0x68]
jns 0x1001a40a
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a4be
push 0x1381
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
dec dword [ebp - 0x10]
jns 0x1001a3e5
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0x860b4ffb
mov dword [ebp - 0x14], ebx
jmp 0x1001a4f1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf0], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001a4e0
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a512
push ebx
push 0x1d11
push 0x463
push ebx
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
push 2
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x1001a529
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xf0], ebx
jne 0x1001a52e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x1001a51a
mov dword [ebp - 0x14], ebx
jmp 0x1001a544
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x130], 0x3244d513
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001a533
mov dword [ebp - 0x14], 0x75b57fd5
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], 0x10
cmp dword [ebp - 0x14], 0x12
je 0x1001a5e7
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x18], 0xf996f377
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jge 0x1001a593
cmp dword [ebp - 0xc], ebx
je 0x1001a593
cmp dword [ebp - 0x10], ebx
je 0x1001a593
xor eax, eax
inc eax
jmp 0x1001a595
mov eax, ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
sub ecx, eax
imul ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], 0xe
jmp 0x1001a5d5
mov dword [ebp - 0x18], 0x204795ed
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a5cf
push 0x19ad
push ebx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
dec dword [ebp - 0x18]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 5
jl 0x1001a5b3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x12
jne 0x1001a565
push 2
pop edx
push 0xfffffffffffffffa
mov byte [ebp - 1], bl
pop ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], ebx
jmp 0x1001a5ff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x48], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001a5f5
mov dword [ebp - 8], ebx
jmp 0x1001a61d
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 8]
neg ecx
mov dword [ebp + eax*4 - 0x48], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jle 0x1001a60a
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], edx
jg 0x1001a682
mov dword [ebp - 0x18], 0x9968cb66
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x48], 1
jg 0x1001a663
cmp dword [ebp - 8], ebx
je 0x1001a663
xor edx, edx
inc edx
jmp 0x1001a665
mov edx, ebx
mov eax, dword [ebp - 8]
xor ecx, ecx
mov dword [ebp + eax*4 - 0x48], edx
mov eax, dword [ebp - 0x18]
cmp edx, eax
setne cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jle 0x1001a62a
cmp byte [ebp - 1], 0
je 0x1001a77e
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], 0xf3ccd246
mov dword [ebp - 8], 0x23b4709b
mov dword [ebp - 0x28], 0xc4e2bf5
mov dword [ebp - 0xc], 0xfffffff9
mov dword [ebp - 0x20], 0x77cccaea
mov dword [ebp - 0x20], 0x9a023703
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 0x2c78ef8a
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x20], 0xe5c7
mov dword [ebp - 0x20], 0xec253d5a
push 4
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0xc], ebx
pop ecx
jmp 0x1001a6f7
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x150], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001a6ea
mov dword [ebp - 0xc], ebx
jmp 0x1001a712
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x160], 0xa3f0bde8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001a701
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
cmp ecx, 0x245f
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
add ecx, 0x866
je 0x1001a751
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
sub eax, 0x37d45db3
je 0x1001a76a
cmp dword [ebp - 0x28], ebx
jne 0x1001a76a
mov eax, ebx
jmp 0x1001a76d
xor eax, eax
inc eax
push ebx
mov dword [ebp - 0xc], eax
dec dword [ebp - 0x18]
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_SetPropA]
push 2
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ebx
pop ecx
jmp 0x1001a797
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x80], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001a789
xor ecx, ecx
mov dword [ebp - 0xc], ebx
inc ecx
jmp 0x1001a7ae
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x3c], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001a7a4
cmp dword [ebp - 0x7c], ebx
je 0x1001a80f
mov dword [ebp - 0x14], 0x5ae649f6
xor ecx, ecx
mov dword [ebp - 0x28], 0x3d6c1dfe
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
test eax, eax
setg cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x7c]
imul eax, ecx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setge dl
imul edx, dword [ebp - 0x7c]
mov dword [ebp - 0x14], edx
xor edx, edx
mov ecx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
cmp edx, 0xcdf11bbb
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
jmp 0x1001a827
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a821
call esi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], 0xffffffe6
jmp 0x1001aac4
mov eax, 0xb4e1a362
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xc], 0xfffffffc
mov dword [ebp - 0x18], 0xa82e77e8
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], 3
cmp dword [ebp - 0xc], ebx
jl 0x1001a925
mov dword [ebp - 8], 0x189d
mov dword [ebp - 0x10], 0xc2a41b87
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x58]
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
dec eax
neg eax
sbb eax, eax
neg eax
imul eax, dword [ebp - 0xc]
test eax, eax
jne 0x1001a8a9
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x28], 0x3b03c3fa
jl 0x1001a8c1
cmp dword [ebp - 0x58], ebx
jne 0x1001a8c1
mov ecx, ebx
jmp 0x1001a8c4
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x20]
sub ecx, eax
sub ecx, dword [ebp - 0x10]
jne 0x1001a8d7
cmp dword [ebp - 0x58], ebx
jne 0x1001a8d7
mov ecx, ebx
jmp 0x1001a8da
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 8]
add ecx, 0xffffa933
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x50]
setle dl
xor ebx, ebx
sub edx, 2
cmp edx, eax
mov eax, dword [ebp - 0xc]
setge bl
mov ecx, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0xc]
imul ecx, ebx
xor ebx, ebx
mov dword [ebp + eax*4 - 0x58], ecx
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001a91c
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
dec dword [ebp - 0xc]
jns 0x1001a86c
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a935
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 2
mov dword [ebp - 0x18], 0x7dcd66a0
pop ecx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], ebx
jl 0x1001aac1
mov byte [ebp - 0x21], bl
mov dword [ebp - 0xc], 0x801897a4
mov dword [ebp - 0xc], ebx
jmp 0x1001a96b
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xb0], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001a95a
mov dword [ebp - 0xc], ebx
jmp 0x1001a986
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xfc], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001a975
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a9a8
push 0x2237
push ebx
push ebx
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], ebx
jl 0x1001aaa8
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 8], ebx
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x28], 0x483b
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a9e0
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
mov dword [ebp - 0x10], ebx
jmp 0x1001aa95
mov dword [ebp - 8], 0xb0fe2cf4
mov dword [ebp - 0x20], 0x9d012742
mov dword [ebp - 0x20], 4
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov dword [ebp - 0xf4], 0x67bb
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0xb0]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb0], ecx
mov dword [ebp - 8], ecx
mov ecx, 0xc5c3c3ae
mov eax, dword [ebp - 0xc]
neg eax
cmp eax, 7
sbb eax, eax
neg eax
cmp ecx, eax
mov eax, dword [ebp - 8]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0xc]
setl dl
add edx, 0xffff334c
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0xc]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001aa92
push 0x22ee
push 0x2eb
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jle 0x1001a9e8
dec dword [ebp - 0xc]
jns 0x1001a9b8
cmp byte [ebp - 0x21], 0
je 0x1001aab5
push ebx
call fcn.1001b5b7
pop ecx
dec dword [ebp - 0x18]
push 2
pop ecx
jns 0x1001a94b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe7
jg 0x1001a833
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x16
je 0x1001a393
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x13
jne 0x1001a1f1
push 2
mov dword [ebp - 8], 0xeaa32b1c
mov dword [ebp - 8], ebx
pop ecx
jmp 0x1001ab05
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x78], 0xfffffffe
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x1001aaf7
mov dword [ebp - 8], ebx
jmp 0x1001ab20
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x10c], 5
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x1001ab0f
mov dword [ebp - 8], ebx
jmp 0x1001ab3c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xd8], 0x7cec
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x1001ab2b
xor edi, edi
mov dword [ebp - 8], ebx
inc edi
cmp dword [ebp - 8], edi
jg 0x1001ad05
push 8
pop esi
mov dword [ebp - 0xc], 0xabbf9acf
xor edx, edx
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0x66969e96
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
sub ecx, 0x52a5ae63
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0xc]
neg edx
sbb edx, edx
inc edx
imul eax, edx
xor edx, edx
cmp eax, 0xc1464f16
mov eax, dword [ebp - 8]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, 0x47d1afd0
je 0x1001abb3
mov ecx, edi
cmp dword [ebp - 0x78], ebx
jne 0x1001abb5
mov ecx, ebx
mov eax, dword [ebp - 8]
sub ecx, eax
dec ecx
je 0x1001ac54
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffe
jne 0x1001abd5
cmp dword [ebp - 0xc], ebx
jne 0x1001abd7
mov eax, ebx
cmp eax, dword [ebp - 0xc]
jl 0x1001abe3
mov edx, edi
cmp dword [ebp - 0xc], ebx
jne 0x1001abe5
mov edx, ebx
mov dword [ebp - 0x10], 0x5290ce96
xor ecx, ecx
mov eax, dword [ebp - 0x10]
cmp eax, edx
setle cl
cmp ecx, dword [ebp - 0x74]
jle 0x1001ac14
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1001ac9c
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x1001ac9c
mov dword [ebp - 0x18], 0x430688cd
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
push 2
setle dl
pop eax
cmp eax, edx
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
neg eax
cmp eax, 0x16c28cbd
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
jmp 0x1001ac9c
mov dword [ebp - 0x18], 0xa227283a
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0x18], 0x111919b1
mov dword [ebp - 0x1c], ebx
jmp 0x1001ac93
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x124], 0xade45a91
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1001ac82
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xd8], ebx
je 0x1001acd7
mov eax, dword [ebp - 0x78]
xor edx, edx
cmp eax, 0x4f7d9fd5
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xd8]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
imul eax, edx
test eax, eax
mov eax, edi
jne 0x1001acd9
mov eax, ebx
mov dword [ebp - 0x10], eax
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x108], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x1001ab54
mov eax, dword [ebp - 0xa4]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [ebp - 0xa0]
mov edi, edx
mov esi, eax
call fcn.10019d8b
add eax, esi
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret