Function at 0x10019758
Capabilities:
Get disk information
Log keystrokes

Disassembly:
mov eax, 0x10068074
call fcn.100676e8
sub esp, 0x204
mov eax, dword [0x10613764]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
inc edi
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], ecx
test al, 1
jne 0x100197a2
or eax, edi
mov dword [0x10613764], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.1001b46f
push 0x1006923e
call fcn.1005274c
or dword [ebp - 4], 0xffffffff
pop ecx
jmp 0x100197a4
xor ebx, ebx
push 2
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x18], ebx
pop esi
jmp 0x100197c0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x158], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100197b3
cmp dword [ebp - 0x3c], ebx
je 0x100197e1
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100197f8
push 0x7e8
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
jmp 0x100197f8
mov dword [ebp - 0x3c], ebx
jmp 0x100197f2
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x158], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x20
jg 0x100197e6
imul eax, dword [ebp - 0x54], 0x2710
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x3c], 0xf5540d7f
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x38], 0x8b39
mov dword [ebp - 0x18], ebx
jmp 0x1001982c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x194], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001981b
mov dword [ebp - 0x3c], 0xfffffff0
jmp 0x100198b3
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], 0x992f
mov dword [ebp - 0x18], ebx
jmp 0x1001985b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x108], 0x51ea66e5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001984a
inc dword [ebp - 0x40]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp eax, 0x4b25b3b9
mov dword [ebp - 0x18c], eax
mov edx, dword [ebp - 0x38]
setle cl
mov dword [ebp - 0x108], edx
neg edx
cmp ecx, edx
jle 0x100198a0
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100198b0
push 0x26bf
push 0x1e2b
call dword [sym.imp.GDI32.dll_SetROP2]
jmp 0x100198b0
mov dword [ebp - 0x34], 0xfffffff9
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x108], eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xffffffef
jl 0x1001983b
lea eax, [ebp - 0x5c]
push eax
call fcn.1001b4dc
push esi
lea ecx, [ebp - 0x184]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
call fcn.1001b3ab
mov dword [ebp - 0x20], 0x8d4081c2
mov dword [ebp - 0x18], ebx
jmp 0x100198f2
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x184]
mov dword [eax + ecx*4], 0x1713
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100198df
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], ebx
jl 0x10019919
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10019914
push 0x7e8
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
dec dword [ebp - 0x20]
jns 0x100198ff
lea ecx, [ebp - 0x184]
call fcn.1001b42d
cmp dword [ebp - 0x4c], 0
je 0x10019a4c
mov dword [ebp - 0x18], 0x7ddc85f7
lea ecx, [ebp - 0x12c]
push 3
call fcn.1001b3ab
mov dword [ebp - 0x18], ebx
jmp 0x10019956
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x12c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10019947
mov dword [ebp - 0x18], ebx
jmp 0x10019994
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jne 0x1001997c
mov eax, dword [ebp - 0x12c]
mov dword [eax + 8], edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jge 0x10019961
lea ecx, [ebp - 0x12c]
call fcn.1001b42d
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1c], 0x3f4f46db
push 3
mov dword [ebp - 0x4c], 0x65e3edfa
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x24], ebx
pop ecx
jmp 0x100199d2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x164], 7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x100199c1
mov dword [ebp - 0x24], ebx
jmp 0x100199e9
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1a0], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x100199dc
mov dword [ebp - 0x1c], ebx
jmp 0x10019a07
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10019a04
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x100199f3
cmp dword [ebp - 0x164], ebx
je 0x10019a19
cmp dword [ebp - 0x1c], ebx
jne 0x10019a1b
mov edi, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x160]
mov eax, dword [ebp - 0x4c]
sub edx, edi
sub eax, 0x391cb4e8
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x198], eax
jmp 0x1001b0df
mov dword [ebp - 0x2c], 0xffffffff
lea ecx, [ebp - 0x84]
push esi
call fcn.1001b3ab
mov dword [ebp - 4], edi
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x18], ebx
jmp 0x10019a81
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x84]
mov dword [eax + ecx*4], 0x915bb002
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10019a6e
mov dword [ebp - 0x2c], ebx
jmp 0x10019bf5
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x20], edi
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10019ac8
push 0x1008
push 0xa39
push 0x126f
push 0x102a
push 0x1dab
push 0x1b44
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jne 0x10019b07
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2c]
imul eax, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x28], ebx
je 0x10019b04
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x20], edi
jae 0x10019b1c
mov eax, dword [ebp - 0x84]
mov edx, edi
cmp dword [eax + 4], ebx
jne 0x10019b1e
mov edx, ebx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setl cl
cmp dword [ebp - 0x2c], ecx
jne 0x10019bbe
push 3
lea ecx, [ebp - 0x90]
call fcn.1001b3ab
mov dword [ebp - 0x40], 0x9447610b
mov dword [ebp - 0x18], ebx
jmp 0x10019b59
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x90]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10019b4a
cmp dword [ebp - 0x28], ebx
je 0x10019b91
cmp dword [ebp - 0x20], ebx
jne 0x10019b6c
mov eax, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x24], 0xc29b
xor edx, edx
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x90]
setne dl
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x90]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 4]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jne 0x10019c01
call fcn.1001b42d
jmp 0x10019bf2
mov dword [ebp - 0x40], 0x74c77a5c
cmp dword [ebp - 0x40], ebx
je 0x10019be0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], 3
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], 0xffffffff
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xb
jle 0x10019a8e
jmp 0x10019c06
call fcn.1001b42d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.1001b42d
mov eax, dword [0x10613764]
test al, 2
jne 0x10019ca8
or eax, esi
mov dword [0x10613764], eax
push ebx
mov dword [ebp - 4], esi
push ebx
mov dword [0x10613770], ebx
mov dword [0x10613774], ebx
call fcn.1001d618
mov dword [0x10613770], eax
mov dword [0x10613778], ebx
mov dword [0x10613780], ebx
mov byte [ebp - 4], 4
mov ecx, 0x10613778
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0xa0]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x188]
mov dword [0x1061378c], 0x3f800000
push eax
mov dword [0x1061377c], ebx
call fcn.1001d3f0
push 0x10069239
mov dword [0x10613784], 7
mov dword [0x10613788], 8
call fcn.1005274c
or dword [ebp - 4], 0xffffffff
pop ecx
mov dword [ebp - 0x18], 0x7ddc85f7
lea ecx, [ebp - 0x138]
push 3
call fcn.1001b3ab
mov dword [ebp - 0x18], ebx
jmp 0x10019cd0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x138]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10019cc1
mov dword [ebp - 0x18], ebx
jmp 0x10019d0e
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jne 0x10019cf6
mov eax, dword [ebp - 0x138]
mov dword [eax + 8], edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jge 0x10019cdb
lea ecx, [ebp - 0x138]
call fcn.1001b42d
xorps xmm0, xmm0
movdqu xmmword [ebp - 0xb8], xmm0
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x2c], 0xfffffffe
jmp 0x10019db1
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ebx
jmp 0x10019da9
push 3
lea ecx, [ebp - 0x150]
call fcn.1001b3ab
mov dword [ebp - 0x18], ebx
jmp 0x10019d75
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], 0xef6b8f3d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10019d62
mov eax, dword [ebp - 0x150]
mov eax, dword [eax + 8]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10019d9b
push 0x43b
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
lea ecx, [ebp - 0x150]
call fcn.1001b42d
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jl 0x10019d50
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff4
jg 0x10019d41
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
mov dword [ebp - 0x2c], edi
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x4956e74e
setge al
xor edx, edx
cmp eax, 0x31aa08e
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp eax, edi
setg cl
cmp ecx, edx
jge 0x10019e31
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], 0x43eef7d
mov dword [ebp - 0x18], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
jmp 0x10019eee
mov dword [ebp - 0x24], 0x28ec7df
lea ecx, [ebp - 0x114]
push esi
call fcn.1001b3ab
mov dword [ebp - 0x18], ebx
jmp 0x10019e58
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x114]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10019e49
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x28], ebx
jne 0x10019e68
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x114]
setge cl
mov dword [eax], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
add eax, 0xc16
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], ebx
jmp 0x10019ede
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10019edb
push ebx
push 0x11cf
call dword [sym.imp.USER32.dll_ClientToScreen]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x10019ec6
lea ecx, [ebp - 0x114]
call fcn.1001b42d
lea eax, [ebp - 0x54]
push eax
call fcn.1001b53e
mov ecx, dword [eax]
mov al, byte [ebp + 0xc]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], ecx
test al, al
jne 0x10019f0e
test ecx, ecx
jne 0x1001a2ed
lea ecx, [ebp - 0x200]
mov dl, al
push ecx
mov ecx, dword [ebp - 0x54]
call fcn.1000d965
mov esi, eax
lea edi, [ebp - 0xb8]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x28], 0x38a1
xor edi, edi
mov dword [ebp - 0x24], 0x39281c1d
inc edi
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x1c], 0xdeb47635
mov dword [ebp - 0x18], 0x34c8a1b6
mov dword [ebp - 0x48], 0x409415f9
cmp dword [ebp - 0x28], ebx
je 0x10019f70
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setg dl
xor ecx, ecx
imul edx, edx, 0xc010
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setle cl
cmp ecx, 0xfffffffd
jle 0x10019fac
mov edx, edi
cmp dword [ebp - 0x28], ebx
jne 0x10019fae
mov edx, ebx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
neg ecx
jne 0x10019fd3
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x1c]
add eax, 0x1db4ec4f
imul eax, dword [ebp - 0x28]
test eax, eax
je 0x1001a00a
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001a2a0
push ebx
push ebx
push 0x168
push 0x23c0
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1001a2a0
mov dword [ebp - 0x30], 0xe228
mov dword [ebp - 0x20], 0x22c2
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x1c], ebx
jmp 0x1001a039
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x60], 0x90c99e84
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001a02b
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xfffffff9
jl 0x1001a22c
push edi
lea ecx, [ebp - 0x9c]
call fcn.1001b3ab
mov dword [ebp - 4], 5
mov dword [ebp - 0x28], 0x1d664853
mov dword [ebp - 0x28], ebx
jmp 0x1001a07d
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x9c]
mov dword [eax + ecx*4], 0x7bfbc35c
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1001a06a
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ebx
jg 0x1001a20e
mov dword [ebp - 0x38], 0x3def5731
mov dword [ebp - 0x34], 0xc42121a6
mov dword [ebp - 0x28], ebx
jmp 0x1001a0ab
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x58], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1001a0a1
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
add ecx, 0x405d06f7
je 0x1001a0dd
mov ecx, edi
cmp dword [ebp - 0x30], ebx
jne 0x1001a0df
mov ecx, ebx
xor eax, eax
mov dword [ebp - 0x58], ecx
cmp ecx, 0x676e
setg al
cmp eax, 0x1ea52fa5
jge 0x1001a0f7
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x2c]
xor ecx, ecx
mov edx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x20]
imul edx, eax
mov eax, dword [ebp - 0x24]
sub edx, eax
mov eax, dword [ebp - 0x20]
cmp edx, eax
mov eax, dword [ebp - 0x9c]
setl cl
xor edx, edx
add ecx, dword [eax + esi*4]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x9c]
cmp dword [eax + ecx*4], edi
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x28], 0x1d10
cmp dword [ebp - 0x28], 0x205f
jle 0x1001a19e
push ebx
push ebx
push 0xc42
push ebx
push 0x2201
push ebx
push 0x20e3
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
mov ecx, 0x106126b8
cdq
push edx
push eax
call fcn.1001b17a
inc edi
cmp edi, 0x40b7
jl 0x1001a16d
inc esi
cmp esi, 0x5a2a
jl 0x1001a16b
push 0x1ec2
push ebx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor edi, edi
inc edi
mov dword [ebp - 0x24], ebx
jmp 0x1001a1b7
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x9c]
cmp dword [eax + ecx*4], ebx
jne 0x1001a1bc
inc dword [ebp - 0x34]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1001a1a3
mov byte [ebp - 4], 6
cmp dword [ebp - 0x28], 0x1ca1
jge 0x1001a1ff
mov edx, 0x10008820
mov ecx, 0x106126b8
call fcn.1001d6f2
jmp 0x1001a1ff
mov dword [ebp - 4], 5
inc dword [ebp - 0x2c]
jmp 0x1001a085
mov dword [ebp - 0x28], 9
lea ecx, [ebp - 0x9c]
or dword [ebp - 4], 0xffffffff
call fcn.1001b42d
dec dword [ebp - 0x1c]
jmp 0x1001a041
mov eax, dword [ebp - 0x60]
xor edx, edx
test eax, eax
mov eax, dword [ebp - 0x1c]
sets dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
add ecx, dword [ebp - 0x18]
test ecx, ecx
setle dl
xor eax, eax
sub edx, dword [ebp - 0x20]
test edx, edx
setg al
xor edx, edx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
cmp ecx, 0xc13529c6
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x20]
je 0x1001a28a
mov ecx, edi
cmp dword [ebp - 0x24], ebx
jne 0x1001a28c
mov ecx, ebx
mov eax, dword [ebp - 0x18]
add eax, ecx
imul eax, eax, 0xa9b9
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
sub eax, 0x8f27
imul eax, dword [ebp - 0x48]
add eax, 0x5061d2e8
cmp dword [ebp - 0x1c], eax
je 0x1001a2c8
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + 0xc], 0
mov eax, dword [ebp - 0x18]
push 2
mov dword [ebp - 0x1c], eax
pop esi
je 0x1001a2ed
mov ecx, dword [ebp - 0xb0]
test ecx, ecx
je 0x1001a2ed
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x44], 0x648261f9
mov dword [ebp - 0x1c], 0x1e1e
cmp dword [ebp - 0x1c], 0x20eb
jle 0x1001a36f
mov eax, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 0x7490
mov ecx, ebx
mov dword [ebp - 0x34], ebx
xor eax, ecx
lea ecx, [ebp - 0x1c0]
cdq
push edx
push eax
call fcn.1000d8ea
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001a332
mov eax, dword [eax]
push eax
call fcn.10052776
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x1c0]
call fcn.1001b868
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
inc ecx
mov dword [ebp - 0x34], ecx
cmp ecx, 0x4588
jl 0x1001a318
dec eax
dec dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
jne 0x1001a313
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x383
jl 0x1001a309
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x18], 0x7479
cmp dword [ebp - 0x18], 0x759f
jle 0x1001a3f4
mov eax, ebx
mov dword [ebp - 0x20], ebx
mov ecx, ebx
mov dword [ebp - 0x34], ebx
cdq
idiv ecx
mov dword [ebp - 0x30], ebx
mov eax, edx
mov dword [ebp - 0x48], eax
xor eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x1f0]
cdq
push edx
push eax
call fcn.1000d8ea
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001a3b2
mov eax, dword [eax]
push eax
call fcn.10052776
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x1f0]
call fcn.1001b868
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x11d9
mov eax, dword [ebp - 0x48]
jl 0x1001a397
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x34], ecx
cmp ecx, 0x5080
jl 0x1001a38c
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x4df2
jl 0x1001a387
cmp byte [ebp - 0x11], 0
je 0x1001a406
push ebx
push 0x24bd
call dword [sym.imp.USER32.dll_RemovePropA]
cmp dword [ebp - 0x18], 0x7286
jge 0x1001a41a
push 0x100088b8
call fcn.10052776
pop ecx
cmp dword [ebp - 0x1c], 0x1de3
jge 0x1001a42e
push 0x10008888
call fcn.10052776
pop ecx
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001a447
push ebx
push 0xfdf
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
jne 0x1001ac4f
cmp dword [ebp - 0xb8], ecx
jle 0x1001ac4f
mov dword [ebp - 0x28], 0xd5e48d32
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], 0xfffffff6
jmp 0x1001a51c
mov dword [ebp - 0x1c], 0x665683c8
mov dword [ebp - 0x1c], ebx
jmp 0x1001a50f
mov dword [ebp - 0x34], edi
xor ecx, ecx
mov dword [ebp - 0x34], 5
mov eax, dword [ebp - 0x1c]
sub eax, 0x7296
cmp ecx, eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x34]
je 0x1001a4a9
mov ecx, edi
cmp dword [ebp - 0x28], ebx
jne 0x1001a4ab
mov ecx, ebx
mov eax, dword [ebp - 0x28]
sub ecx, eax
xor eax, eax
cmp ecx, 0x5af9
setge al
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jne 0x1001a4ca
mov eax, ebx
cmp dword [ebp - 0x1c], ebx
je 0x1001a4cc
mov eax, edi
mov dword [ebp - 0x34], ebx
mov edx, dword [ebp - 0x34]
sub edx, eax
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
cmp ecx, eax
setge dl
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], edx
xor edx, edx
cmp dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xe
jle 0x1001a483
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1d
jge 0x1001a474
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x20], ebx
jmp 0x1001a53f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x16c], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1001a532
cmp dword [ebp - 0x18], ebx
je 0x1001a560
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001a577
push 0x7e8
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
jmp 0x1001a577
mov dword [ebp - 0x18], ebx
jmp 0x1001a571
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x16c], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x20
jg 0x1001a565
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x1c], 0x7c3c
cmp dword [ebp - 0x1c], 0x7d2e
mov dword [ebp - 0x44], eax
jle 0x1001a606
push ebx
push ebx
push 0x1c08
call dword [sym.imp.GDI32.dll_SelectPalette]
mov edi, ebx
mov dword [ebp - 0x18], ebx
mov eax, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0x5f24
mov ecx, eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x38], ebx
shl edi, cl
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, 0x106126b8
cdq
push edx
push eax
call fcn.1001b17a
inc ebx
cmp ebx, 0x51f9
jl 0x1001a5bb
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp - 0x18]
dec eax
dec dword [ebp - 0x30]
push 0
mov dword [ebp - 0x34], eax
pop ebx
jne 0x1001a5b1
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x7964
jl 0x1001a5a7
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x3de8
jl 0x1001a5a2
xor edi, edi
inc edi
mov dword [ebp - 4], 0xc
cmp dword [ebp - 0x1c], 0x7aa7
jge 0x1001a625
mov edx, 0x10008938
mov ecx, 0x106126b8
call fcn.1001d6f2
or dword [ebp - 4], 0xffffffff
push 3
lea ecx, [ebp - 0xc4]
call fcn.1001b3ab
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x1c], 0xfdb696
mov dword [ebp - 0x20], ebx
jmp 0x1001a698
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc4]
mov dword [eax + ecx*4], 0xc6a53d06
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1001a685
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], ebx
jl 0x1001a6cc
mov dword [ebp - 0x18], 0xffffffff
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001a6c7
push ebx
push 0x4d3
push 0x12ff
call dword [sym.imp.USER32.dll_AttachThreadInput]
dec dword [ebp - 0x2c]
jns 0x1001a6a6
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
jne 0x1001a6e8
mov ecx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x1001a6ea
mov ecx, edi
mov eax, dword [ebp - 0x18]
imul eax, ecx
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
add eax, 0x35571aa6
neg eax
sbb eax, eax
neg eax
add eax, 7
je 0x1001a785
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x1c], ebx
jmp 0x1001a73b
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001a728
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001a738
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1001a718
mov dword [ebp - 0x2c], ebx
jmp 0x1001a77b
mov dword [ebp - 0x48], 0xe141b6ba
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [ecx + eax*4]
sub eax, dword [ecx + edx*4]
cmp eax, dword [ecx + esi*4]
jge 0x1001a76c
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
push 2
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x2c]
pop esi
cmp dword [ebp - 0x2c], esi
jle 0x1001a745
jmp 0x1001a8b0
mov dword [ebp - 0x38], 0x229e
cmp dword [ebp - 0x38], 0x2397
jle 0x1001a838
mov ecx, ebx
mov dword [ebp - 0x28], ebx
mov eax, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ecx
mov edx, ebx
mov ecx, eax
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x20]
shl eax, cl
mov dword [ebp - 0x20], eax
mov ecx, edx
mov dword [ebp - 0x30], ebx
sar eax, cl
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x30]
shl eax, cl
lea ecx, [ebp - 0x1d8]
cdq
push edx
push eax
call fcn.1000d8ea
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001a7dc
mov eax, dword [eax]
push eax
call fcn.10052776
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x1d8]
call fcn.1001b868
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x16a6
mov eax, dword [ebp - 0x48]
jl 0x1001a7bf
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
inc edx
mov dword [ebp - 0x34], edx
cmp edx, 0x7f43
jl 0x1001a7b5
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x5ebc
jl 0x1001a7a3
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0x5e47
jl 0x1001a79e
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x38], 0x213a
jge 0x1001a84f
push 0x10008980
call fcn.10052776
pop ecx
mov dword [ebp - 0x20], ebx
jmp 0x1001a865
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa8], 0xf8859284
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1001a854
cmp dword [ebp - 0x30], 0x9c1c73b0
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setl dl
sub edx, dword [ebp - 0x2c]
neg edx
sbb edx, edx
inc edx
neg edx
je 0x1001a89a
mov ecx, edi
cmp dword [ebp - 0x18], ebx
jne 0x1001a89c
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
imul eax, ecx
xor ecx, ecx
cmp eax, 0xffffffff
setle cl
mov dword [ebp - 0xa8], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.1001b42d
mov ecx, dword [ebp - 0xb4]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], ebx
jmp 0x1001a8e1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1a8], 0xafcb143e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1001a8d0
mov dword [ebp - 0x1c], ebx
jmp 0x1001a927
mov dword [ebp - 0x30], 0xf390197f
mov dword [ebp - 0x20], ebx
jmp 0x1001a908
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x210], 0xe57ad95e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1001a8f7
mov dword [ebp - 0x30], 3
cmp dword [ebp - 0x30], ebx
jl 0x1001a924
cmp dword [ebp - 0x1c], ebx
jne 0x1001a924
dec dword [ebp - 0x30]
jns 0x1001a91a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
je 0x1001a8eb
mov dword [ebp - 0x1c], 0xffffffe6
cmp dword [ebp - 0x1c], 0xfffffff7
jle 0x1001ab72
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], 0x1e45
cmp dword [ebp - 0x24], 0x210d
jle 0x1001a9dd
push 0x2555
push 0x7c5
push 0x1017
push 0x26b8
push 0x1453
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov ecx, ebx
mov dword [ebp - 0x30], ebx
mov eax, ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov dword [ebp - 0x38], ebx
cdq
idiv edi
mov dword [ebp - 0x48], ebx
mov ebx, ecx
mov edi, dword [ebp - 0x48]
mov ecx, edx
sar ebx, cl
mov eax, ebx
mov ecx, 0x106126b8
xor eax, edi
cdq
push edx
push eax
call fcn.1001b17a
inc edi
cmp edi, 0x30a7
jl 0x1001a991
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
inc edi
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edi
push 0
pop ebx
cmp edi, 0x75a5
jl 0x1001a982
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x6bd0
jl 0x1001a97d
inc ecx
mov dword [ebp - 0x30], ecx
cmp ecx, 0x2d84
jl 0x1001a978
xor edi, edi
inc edi
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x1001ab19
mov dword [ebp - 0x20], ebx
jmp 0x1001a9ff
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf4], 0x898f01ba
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1001a9ee
mov dword [ebp - 0xf4], edi
cmp dword [ebp - 0xf4], ebx
jl 0x1001ab11
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x30], ebx
jl 0x1001ab06
dec dword [ebp - 0x18]
jmp 0x1001a9e0
mov dword [ebp - 4], 0x13
cmp dword [ebp - 0x24], 0x1ac5
jge 0x1001ab38
mov edx, 0x100089b8
mov ecx, 0x106126b8
call fcn.1001d6f2
or dword [ebp - 4], 0xffffffff
inc dword [ebp - 0x1c]
jmp 0x1001a933
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x1001ac4f
cmp dword [ebp - 0x44], 0
je 0x1001ac4f
call fcn.10019722
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x30], 0xfffffff7
push edi
mov dword [ebp - 0x3c], eax
call fcn.1001b3ab
mov dword [ebp - 0x30], 0x2fdad5a5
mov dword [ebp - 0x38], 0x1747
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x20], ebx
jmp 0x1001abd1
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1001abc2
mov dword [ebp - 0x30], ebx
mov ecx, ebx
cmp dword [ebp - 0x30], ebx
je 0x1001abe2
mov ecx, edi
mov eax, dword [ebp - 0x120]
xor edx, edx
test ecx, ecx
sete dl
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp eax, edx
setne cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setg cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
cmp dword [ebp - 0x44], eax
setl cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x120]
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
call fcn.1001b42d
lea eax, [ebp - 0x54]
push eax
call fcn.1001b53e
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov dword [ebp - 0x18], 0x91a049fe
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x38], 0x716b5b38
mov dword [ebp - 0x38], 0x6f25db2b
mov dword [ebp - 0x38], 0xa97f51ef
push esi
call fcn.1001b3ab
mov dword [ebp - 0x20], ebx
jmp 0x1001ac8b
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x178]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1001ac7c
mov dword [ebp - 0x18], 0xffffffe2
jmp 0x1001ad20
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x38], 0x9e71b35
mov dword [ebp - 0x44], 0xffffffff
cmp dword [ebp - 0x1c], ebx
jne 0x1001ad06
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
sub ecx, 0xc54c9751
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setne cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
sub edx, 4
cmp edx, eax
mov eax, ebx
setge cl
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], ebx
je 0x1001ad08
mov eax, edi
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x38]
cmp eax, 0xffffffff
setg cl
mov dword [ebp - 0x44], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe9
jne 0x1001ac9c
lea ecx, [ebp - 0x178]
call fcn.1001b42d
lea ecx, [ebp - 0xb8]
call fcn.10014e87
push esi
lea ecx, [ebp - 0xe8]
call fcn.1001b3ab
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x1c], 0x667a876e
mov dword [ebp - 0x20], ebx
jmp 0x1001ad72
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe8]
mov dword [eax + ecx*4], 0xdf99ff60
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1001ad5f
mov dword [ebp - 0x1c], ebx
jmp 0x1001aeb9
push edi
lea ecx, [ebp - 0x6c]
call fcn.1001b3ab
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x28], 0xc79cf181
mov dword [ebp - 0x20], ebx
jmp 0x1001ada8
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x6c]
mov dword [eax + ecx*4], 0x6a485bf2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1001ad98
mov eax, dword [ebp - 0x6c]
mov dword [eax], edi
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001adc2
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x6c]
dec dword [eax]
jns 0x1001adb2
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], ebx
jl 0x1001aeaa
mov dword [ebp - 0x18], 0xeb200688
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1001ae9e
push esi
lea ecx, [ebp - 0xd0]
call fcn.1001b3ab
mov dword [ebp - 0x20], ebx
jmp 0x1001ae0c
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xd0]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1001adf9
mov esi, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x6c]
cmp dword [eax + ecx*4], ebx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xe8]
setge dl
sub edx, 8
neg edx
mov esi, dword [eax + esi*4]
sbb edx, edx
mov eax, dword [ebp - 0xe8]
inc edx
sub esi, edx
mov edx, dword [ebp - 0x6c]
mov eax, dword [eax]
sub eax, ecx
xor ecx, ecx
imul eax, eax, 0x48dc
cmp eax, dword [edx + edi*4]
mov eax, dword [ebp - 0x44]
setle cl
sub esi, ecx
mov dword [edx + eax*4], esi
mov eax, dword [ebp - 0xd0]
mov dword [eax], ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001ae7d
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov eax, dword [ebp - 0xd0]
dec dword [eax]
jns 0x1001ae6c
lea ecx, [ebp - 0xd0]
call fcn.1001b42d
dec dword [ebp - 0x18]
push 2
pop esi
jns 0x1001ade8
dec dword [ebp - 0x28]
jns 0x1001add5
xor edi, edi
inc edi
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0x15
call fcn.1001b42d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x1001ad7f
or esi, 0xffffffff
lea ecx, [ebp - 0xe8]
mov dword [ebp - 4], esi
call fcn.1001b42d
cmp dword [ebp - 0x4c], 0
jne 0x1001b0df
cmp dword [ebp - 0x3c], 0
je 0x1001b0df
push edi
lea ecx, [ebp - 0x100]
call fcn.1001b3ab
mov dword [ebp - 0x1c], 0x83c7730f
mov dword [ebp - 0x4c], 0x9cc099a5
mov dword [ebp - 0x44], 0x61ac7eb2
mov dword [ebp - 0x24], ebx
jmp 0x1001af1c
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1001af0d
mov dword [ebp - 0x24], ebx
jmp 0x1001af37
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa4], 0xfffffff8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1001af26
mov dword [ebp - 0x1c], ebx
jmp 0x1001af54
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001af51
push ebx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1001af41
mov dword [ebp - 0x1c], esi
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, 0x79cd
setge cl
mov dword [ebp - 0x4c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x100]
mov edx, dword [eax]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, edx
setle al
imul eax, dword [ebp - 0x44]
test eax, eax
jne 0x1001afa6
mov eax, ebx
cmp dword [ebp - 0x4c], ebx
je 0x1001afa8
mov eax, edi
mov dword [ebp - 0xa4], eax
lea ecx, [ebp - 0x100]
call fcn.1001b42d
mov edx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x3c]
call fcn.1001974e
push 4
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x78], eax
call fcn.1001b3ab
push edi
lea ecx, [ebp - 0xdc]
mov dword [ebp - 4], 0x17
call fcn.1001b3ab
mov dword [ebp - 0x30], 0xbc248910
mov dword [ebp - 0x40], 0xfffffff8
mov dword [ebp - 0x44], 0xfffc
mov dword [ebp - 0x44], 0xef6e88f3
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x50], 0xfffffffc
mov dword [ebp - 0x24], ebx
jmp 0x1001b028
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x144]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1001b019
mov dword [ebp - 0x24], ebx
jmp 0x1001b046
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xdc]
mov dword [eax + ecx*4], 0xcc5d9b4e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1001b033
mov eax, dword [ebp - 0xdc]
xor ecx, ecx
mov dword [eax], 9
inc dword [ebp - 0x30]
mov edx, dword [ebp - 0x144]
imul eax, dword [edx + 8], 0x2ded
cmp eax, dword [edx + 4]
setg cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
mov eax, edi
cmp dword [ebp - 0x40], ebx
jne 0x1001b081
mov eax, ebx
add eax, 0x8264
mov dword [edx + 4], eax
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x50]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
dec ecx
jne 0x1001b0a6
cmp dword [ebp - 0x44], ebx
jne 0x1001b0a6
mov edi, ebx
mov eax, dword [ebp - 0xdc]
lea ecx, [ebp - 0xdc]
mov dword [eax], ebx
xor eax, eax
test edi, edi
sets al
mov dword [ebp - 0x50], eax
call fcn.1001b42d
lea ecx, [ebp - 0x144]
mov dword [ebp - 4], esi
call fcn.1001b42d
lea eax, [ebp - 0x5c]
push eax
call fcn.1001b4dc
mov ecx, dword [ebp - 0x78]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x78]
mov ecx, dword [ebp - 0xc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret