Function at 0x10018dac
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1007f9d5
call fcn.1007efe0
sub esp, 0x33c
push ebx
push esi
push edi
mov dword [ebp - 0xec], ecx
lea ecx, [ebp - 0x138]
push 4
mov dword [ebp - 0xe8], edx
call fcn.10016d2b
mov dword [ebp - 0x1c], 0x91b68dee
xor ebx, ebx
mov dword [ebp - 0x14], 0xfffffffd
mov dword [ebp - 0x3c], 0x47d228d5
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x38], 0x6899db22
mov dword [ebp - 0x18], ebx
jmp 0x10018e18
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x138]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10018e09
mov edx, dword [ebp - 0x138]
push 1
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
pop eax
cmp dword [ebp - 0x14], ebx
je 0x10018e83
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, dword [edx + 0xc]
setge cl
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
je 0x10018e55
xor edi, edi
lea eax, [edi + 1]
jmp 0x10018e57
mov eax, ebx
mov dword [ebp - 0x3c], eax
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp eax, 0x86f2
mov eax, dword [ebp - 0x138]
setl dl
xor ecx, ecx
cmp dword [eax + 8], edx
setle cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
xor eax, eax
inc eax
cmp dword [ebp - 0x14], ebx
jne 0x10018e8a
mov edx, ebx
cmp dword [ebp - 0x3c], ebx
je 0x10018e8c
mov edx, eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edx, eax
setg cl
cmp ecx, 0xfffffff7
jg 0x10018ec0
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10018f6f
push 0x32c
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
jmp 0x10018f6f
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x3c], 0xe30f4aed
mov dword [ebp - 0x18], ebx
jmp 0x10018ee7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb4], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10018ed6
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, 6
setl cl
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xac], ebx
jne 0x10018f15
cmp dword [ebp - 0x3c], ebx
jne 0x10018f15
mov ecx, ebx
jmp 0x10018f18
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0xb0]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xac]
setge cl
imul ecx, eax
mov eax, dword [ebp - 0x38]
imul eax, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0xb4], ebx
jne 0x10018f66
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x138]
call fcn.10016dad
push 2
lea ecx, [ebp - 0x180]
call fcn.10016d2b
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 2
jge 0x10018fab
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x180]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10018f96
xor eax, eax
mov dword [ebp - 0x1c], ebx
inc eax
jmp 0x100190e5
mov dword [ebp - 0x40], 0x79536444
mov dword [ebp - 0x24], 0xb607800f
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], ebx
jl 0x100190e2
mov dword [ebp - 0x14], 0x3beb7161
mov dword [ebp - 0x14], ebx
jmp 0x100190c0
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jl 0x100190bd
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jl 0x100190b4
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x180]
cmp dword [eax + ecx*4], 0x6ce028f4
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x180]
mov edx, dword [ebp - 0x28]
mov dword [eax + ecx*4], edx
xor eax, eax
cmp edx, 0x737e0d1b
setge al
cmp eax, 0x95e2de4b
jae 0x10019088
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10019077
push ebx
call esi
push eax
push 0x1ae6
push 0x64f
push 0x24af
push 0x782
push ebx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10019099
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
jmp 0x10019099
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], 0xd8711c0e
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x100190a8
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
dec dword [ebp - 0x18]
jns 0x10019004
xor eax, eax
inc eax
dec dword [ebp - 0x20]
jns 0x10018ff2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x10018fdf
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jl 0x100190d9
dec dword [ebp - 0x24]
dec dword [ebp - 0x14]
jns 0x100190d1
dec dword [ebp - 0x40]
jns 0x10018fd0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10018fb6
lea ecx, [ebp - 0x180]
call fcn.10016dad
push 2
lea ecx, [ebp - 0x258]
call fcn.10016d2b
xor edx, edx
inc edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], ebx
jmp 0x10019124
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x258]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10019111
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x10019247
mov dword [ebp - 0x14], 8
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1001915f
push 0x2c3
push 0x1c96
push ebx
call dword [sym.imp.USER32.dll_InflateRect]
xor edx, edx
inc edx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1001917d
push 0xce7
push 0x26cd
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
xor edx, edx
inc edx
mov dword [ebp - 0x14], ebx
jmp 0x10019235
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], 0x6c849023
mov dword [ebp - 0x24], 0x2305aba9
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], ebx
jl 0x100191f2
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x100191b5
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
je 0x100191c0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x258]
mov eax, dword [eax + ecx*4]
mov ecx, 0x13bc
add eax, 0x184e5a94
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x24], ecx
dec dword [ebp - 0x20]
jns 0x1001919e
xor edx, edx
inc edx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10019232
push 0x2423
push 0x17d9
push 0x1a78
call esi
push eax
call edi
push eax
push 0x77d
push 0x255c
push 0x1d20
push 0xbf1
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
xor edx, edx
inc edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x10019185
dec dword [ebp - 0x18]
jns 0x1001913c
lea ecx, [ebp - 0x258]
call fcn.10016dad
push 4
lea ecx, [ebp - 0x1b0]
call fcn.10016d2b
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x2c], 0x198a
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0x5c6f1bf5
mov dword [ebp - 0x2c], 0xceafd94
mov dword [ebp - 0x2c], 0x6dd8d130
push 2
call fcn.10016d2b
mov dword [ebp - 0x24], 0x815cbcef
mov dword [ebp - 0x18], ebx
jmp 0x100192aa
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x290]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001929a
dec dword [ebp - 0x24]
lea ecx, [ebp - 0x290]
call fcn.10016dad
mov dword [ebp - 0x1c], 0x91b68dee
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x14], 0xfffffffd
mov dword [ebp - 0x24], 8
push 3
call fcn.10016d2b
mov dword [ebp - 0x18], ebx
jmp 0x100192f8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1f8]
mov dword [eax + ecx*4], 0xcecb4571
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100192e5
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001930e
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1f8]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x1f8]
call fcn.10016dad
mov dword [ebp - 0x34], 0x47d228d5
lea ecx, [ebp - 0x240]
push 2
call fcn.10016d2b
xor edx, edx
inc edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], ebx
jmp 0x10019357
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x240]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10019344
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x10019478
mov dword [ebp - 0x14], 8
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001938d
push 0x2c3
push 0x1c96
push ebx
call dword [sym.imp.USER32.dll_InflateRect]
xor edx, edx
inc edx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100193ac
push 0xce7
push 0x26cd
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
xor edx, edx
inc edx
mov dword [ebp - 0x14], ebx
jmp 0x10019466
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], 0x6c849023
mov dword [ebp - 0x24], 0x2305aba9
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], ebx
jl 0x10019422
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100193e5
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
je 0x100193f0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x240]
mov eax, dword [eax + ecx*4]
mov ecx, 0x13bc
add eax, 0x184e5a94
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x24], ecx
dec dword [ebp - 0x20]
jns 0x100193cd
xor edx, edx
inc edx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019463
push 0x2423
push 0x17d9
push 0x1a78
call esi
push eax
call edi
push eax
push 0x77d
push 0x255c
push 0x1d20
push 0xbf1
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
xor edx, edx
inc edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x100193b4
dec dword [ebp - 0x18]
jns 0x10019369
lea ecx, [ebp - 0x240]
call fcn.10016dad
mov dword [ebp - 0x40], 0xfffffff7
lea ecx, [ebp - 0x9c]
push 2
call fcn.10016d2b
xor edx, edx
inc edx
mov byte [ebp - 4], dl
mov dword [ebp - 0x14], ebx
jmp 0x100194b5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x9c]
mov dword [eax + ecx*4], 0xbca63185
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100194a2
mov dword [ebp - 0x14], ebx
jmp 0x100194ce
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x44], 0x9beb0647
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100194c0
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], ebx
jl 0x1001977a
push 0xfffffffffffffff6
pop esi
push 3
lea ecx, [ebp - 0x150]
call fcn.10016d2b
xor edi, edi
mov byte [ebp - 4], 2
inc edi
mov dword [ebp - 0x24], esi
push edi
lea ecx, [ebp - 0x228]
call fcn.10016d2b
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], ebx
jmp 0x10019521
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], 0x8faaaeb9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001950e
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x10019542
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x228]
mov dword [eax + ecx*4], 0x51885a1e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1001952f
mov edi, dword [ebp - 0x150]
mov dword [ebp - 0x3c], edi
mov dword [edi + 4], edx
push 3
lea ecx, [ebp - 0x58]
call fcn.10016d2b
mov byte [ebp - 4], 4
mov dword [ebp - 0x18], ebx
jmp 0x10019576
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x58]
mov dword [eax + ecx*4], 0x707dfe4d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10019566
mov eax, dword [ebp - 0x58]
xor edi, edi
inc edi
mov dword [eax], edi
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x264]
push 2
call fcn.10016d2b
xor edx, edx
mov byte [ebp - 4], 5
mov dword [ebp - 0x18], ebx
inc edx
cmp dword [ebp - 0x18], 2
jge 0x100195b5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x264]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
jmp 0x1001959e
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp dword [eax], 0xf2c9
setge cl
cmp ecx, 0xfdda
je 0x100195d2
mov eax, ebx
cmp dword [ebp - 0x44], ebx
je 0x100195d4
mov eax, edx
cmp dword [ebp - 0x44], eax
je 0x100195e6
mov eax, dword [ebp - 0x150]
mov edi, edx
cmp dword [eax + 8], ebx
jne 0x100195e8
mov edi, ebx
mov esi, dword [ebp - 0x44]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x9c]
push 0xfffffffffffffff6
mov eax, dword [eax + 4]
cmp dword [edx + eax*4], edi
setl cl
imul ecx, eax
pop eax
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [edx + esi*4], eax
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x24]
inc ecx
imul eax, ecx
test eax, eax
je 0x1001963e
mov edi, dword [ebp - 0x3c]
cmp dword [edi + 4], ebx
je 0x1001963e
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019636
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov esi, dword [ebp - 0x58]
jmp 0x10019707
xor edi, edi
lea ecx, [ebp - 0x210]
inc edi
push edi
call fcn.10016d2b
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x10019668
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x210]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10019655
mov eax, dword [ebp - 0x24]
xor edx, edx
mov esi, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x210]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x9c]
setge dl
xor ecx, ecx
cmp edx, dword [eax + esi*4]
setne cl
xor eax, eax
cmp ecx, 0x23d3
setg al
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x44]
mov esi, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x9c]
sub ecx, dword [eax + edx*4]
xor edx, edx
mov eax, dword [ebp - 0x9c]
cmp ecx, 0xbc01
setg dl
add edx, 0xffffe0e1
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, dword [eax + esi*4]
mov eax, dword [ebp - 0x228]
setle cl
xor edx, edx
mov dword [eax], ecx
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov esi, dword [ebp - 0x58]
lea ecx, [ebp - 0x210]
mov eax, dword [ebp - 0x264]
sete dl
sub edx, dword [esi]
neg edx
sbb edx, edx
inc edx
mov dword [eax], edx
call fcn.10016dad
mov edi, dword [ebp - 0x3c]
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 4
call fcn.10016dad
dec dword [esi]
jns 0x10019584
mov eax, dword [ebp - 0x9c]
lea ecx, [ebp - 0x58]
cmp dword [eax], ebx
jne 0x1001973f
mov byte [ebp - 4], 3
call fcn.10016dad
dec dword [edi + 4]
jns 0x10019553
jmp 0x10019744
call fcn.10016dad
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019754
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea ecx, [ebp - 0x228]
call fcn.10016dad
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 1
call fcn.10016dad
dec dword [ebp - 0x44]
push 0xfffffffffffffff6
pop esi
jns 0x100194e2
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], bl
call fcn.10016dad
push 2
pop eax
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x1e0]
push eax
call fcn.10016d2b
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1c8]
mov dword [ebp - 0x2c], 0x292c5eb2
mov dword [ebp - 0x3c], 0xfffffffb
push 2
call fcn.10016d2b
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x18], 0x6aa1c33c
mov dword [ebp - 0x1c], 0xe018
mov dword [ebp - 0x24], 0x716e3113
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x28], 0xe8e23095
push 2
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x1001980c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1e0]
mov dword [eax + ecx*4], 0x485bf25c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100197f9
mov dword [ebp - 0x14], ebx
jmp 0x10019829
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c8]
mov dword [eax + ecx*4], 0xa96141e4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10019816
mov dword [ebp - 0x14], ebx
jmp 0x10019844
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x338], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10019833
xor ecx, ecx
mov dword [ebp - 0x14], ebx
inc ecx
jmp 0x1001985f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xfc], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10019852
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0xfc]
sub eax, dword [ebp - 0x24]
cmp eax, 0x10b5
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1e0]
cmp eax, edx
setl cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setne dl
imul edx, dword [esi + 4]
inc dword [ebp - 0x38]
cmp eax, edx
jl 0x100198b9
cmp dword [ebp - 0x334], ebx
jne 0x100198b9
mov ecx, ebx
jmp 0x100198bc
xor ecx, ecx
inc ecx
inc dword [ebp - 0x18]
xor eax, eax
cmp ecx, 0x6ae4
setne al
xor edi, edi
inc edi
cmp edi, eax
mov eax, dword [ebp - 0x1c8]
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x18]
cmp eax, ecx
lea ecx, [ebp - 0x1c8]
setle dl
imul edx, dword [esi + 4]
inc edx
neg edx
sbb edx, edx
inc edx
cmp edx, 3
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
call fcn.10016dad
lea ecx, [ebp - 0x1e0]
mov byte [ebp - 4], bl
call fcn.10016dad
mov dword [ebp - 0x38], 0x6899db22
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x1c], 0x5e48d327
mov dword [ebp - 0x20], 6
push edi
call fcn.10016d2b
xor edx, edx
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x10019954
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x114]
mov dword [eax + ecx*4], 0x2aee5a98
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10019941
mov dword [ebp - 0x1c], ebx
jmp 0x100199c4
mov dword [ebp - 0x24], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x28], 0x707822e6
mov dword [ebp - 0x2c], 0xe0980db9
mov dword [ebp - 0x28], 0x2278213a
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x114]
push 1
cmp dword [eax], edx
setge cl
xor eax, eax
cmp ecx, 0x69f
mov ecx, dword [ebp - 0x24]
setle al
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x114]
setl dl
mov dword [eax], edx
inc dword [ebp - 0x1c]
pop edx
cmp dword [ebp - 0x1c], 0x15
jle 0x1001995e
lea ecx, [ebp - 0x114]
call fcn.10016dad
mov dword [ebp - 0x18], ebx
jmp 0x100199e9
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1b0]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100199da
xor ecx, ecx
mov dword [ebp - 0x2c], 0x28c176b0
inc ecx
mov dword [ebp - 0x2c], ecx
push 0xfffffffffffffff7
mov dword [ebp - 0x24], 0xc41fd9d0
mov dword [ebp - 0x14], ebx
pop esi
cmp dword [ebp - 0x14], 2
jge 0x10019a1e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x318], esi
inc dword [ebp - 0x14]
jmp 0x10019a09
mov dword [ebp - 0x14], ebx
jmp 0x10019a30
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x294], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10019a23
inc dword [ebp - 0x24]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019a51
push ebx
push ecx
push 0x1ec
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
xor ecx, ecx
inc ecx
mov edx, dword [ebp - 0x1b0]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
je 0x10019aae
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, dword [edx + 0xc]
setge cl
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
je 0x10019a83
xor eax, eax
inc eax
jmp 0x10019a85
mov eax, ebx
mov dword [ebp - 0x34], eax
xor edx, edx
mov eax, dword [ebp - 0x34]
cmp eax, 0x86f2
mov eax, dword [ebp - 0x1b0]
setl dl
xor ecx, ecx
cmp dword [eax + 8], edx
setle cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x14], ebx
jne 0x10019ab7
cmp dword [ebp - 0x34], ebx
jne 0x10019ab7
mov edx, ebx
jmp 0x10019aba
xor edx, edx
inc edx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, esi
jg 0x10019c47
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x34], 0x1bca3396
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x14], ebx
je 0x10019bd8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x14]
jne 0x10019b3b
cmp dword [ebp - 0x14], ebx
jne 0x10019b3b
mov eax, ebx
jmp 0x10019b3e
xor eax, eax
inc eax
mov ecx, 0xfc5c3c3a
cmp ecx, eax
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
xor edx, edx
cmp ecx, 0xfffffffa
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
mov dword [ebp - 0x30], ecx
xor ecx, ecx
cmp dword [ebp - 0x30], eax
setle cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], ebx
je 0x10019b97
xor ecx, ecx
inc ecx
jmp 0x10019b99
mov ecx, ebx
mov eax, dword [ebp - 0x14]
imul eax, ecx
sub eax, 0x7018
add eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 9
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
imul eax, ecx, 0xeeb4
cmp eax, dword [ebp - 0x14]
jl 0x10019bd3
cmp dword [ebp - 0x40], ebx
jne 0x10019bd3
cmp dword [ebp - 0x3c], ebx
je 0x10019bd8
xor ecx, ecx
inc ecx
jmp 0x10019bda
mov ecx, ebx
mov eax, dword [ebp - 0x3c]
add eax, ecx
mov dword [ebp - 0x30], eax
je 0x10019be7
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp eax, 0x88b9
mov eax, dword [ebp - 0x38]
setne dl
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
xor edi, edi
mov dword [ebp - 0x38], ecx
xor edx, edx
mov eax, dword [ebp - 0x38]
inc edi
mov eax, dword [ebp - 0x14]
cmp eax, edi
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019cf9
push 0x32c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
jmp 0x10019cf9
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x34], 0xe30f4aed
mov dword [ebp - 0x18], ebx
jmp 0x10019c6e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc0], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10019c5d
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, 6
setl cl
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xb8], ebx
jne 0x10019c9c
cmp dword [ebp - 0x34], ebx
jne 0x10019c9c
mov ecx, ebx
jmp 0x10019c9f
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0xbc]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xb8]
setge cl
imul ecx, eax
mov eax, dword [ebp - 0x38]
imul eax, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0xc0], ebx
jne 0x10019ced
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0xc0]
xor edi, edi
mov dword [ebp - 0x14], eax
inc edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b0]
call fcn.10016dad
push 4
lea ecx, [ebp - 0xcc]
call fcn.10016d2b
mov dword [ebp - 0x20], 0x22ba3946
mov dword [ebp - 0x14], 0xc15d0d65
mov dword [ebp - 0x28], 0x6e1580eb
mov dword [ebp - 0x18], ebx
jmp 0x10019d42
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10019d2f
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], ebx
jl 0x10019edf
push 3
pop edi
mov dword [ebp - 0x18], 0x92eda8ed
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], ebx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xcc]
push 0
mov eax, dword [ecx + eax*4]
cmp eax, dword [ecx + edx*4]
mov eax, dword [ebp - 0x14]
pop ecx
setg cl
imul eax, ecx
test eax, eax
je 0x10019e50
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], ebx
jl 0x10019e61
mov dword [ebp - 0x18], 0xb44cf59
cmp dword [ebp - 0x18], ebx
je 0x10019e2f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xcc]
cmp dword [eax + ecx*4], ebx
je 0x10019e2f
cmp dword [ebp - 0x24], ebx
je 0x10019e01
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xcc]
cmp dword [eax + ecx*4], ebx
jne 0x10019de8
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xcc]
cmp dword [eax], 0xc9e4
jl 0x10019e01
xor eax, eax
inc eax
jmp 0x10019e03
mov eax, ebx
xor ecx, ecx
cmp eax, 0x5ab1361
mov eax, dword [ebp - 0x24]
sete cl
xor edx, edx
cmp ecx, eax
setl dl
add edx, 0xffff7f0f
neg edx
sbb edx, edx
inc edx
cmp edx, 0xeb25
jg 0x10019e2f
xor eax, eax
inc eax
jmp 0x10019e31
mov eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x14]
jns 0x10019db8
jmp 0x10019e61
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019e61
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call esi
mov dword [ebp - 0x1c], ebx
jmp 0x10019ece
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x18], ebx
jne 0x10019ed3
cmp dword [ebp - 0x34], ebx
je 0x10019e7d
cmp dword [ebp - 0x30], ebx
je 0x10019e7d
xor ecx, ecx
inc ecx
jmp 0x10019e7f
mov ecx, ebx
xor eax, eax
cmp ecx, 0x39802ee
setge al
xor ecx, ecx
cmp eax, 7
setne cl
xor eax, eax
cmp ecx, 0x2184
mov ecx, dword [ebp - 0x34]
setge al
neg ecx
mov dword [ebp - 0x24], eax
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, dword [ebp - 0x24]
setl al
xor ecx, ecx
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
setg cl
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x10019e66
dec dword [ebp - 0x20]
jns 0x10019d61
xor edi, edi
inc edi
lea ecx, [ebp - 0xcc]
call fcn.10016dad
push 4
lea ecx, [ebp - 0x198]
call fcn.10016d2b
push 4
lea ecx, [ebp - 0xe4]
mov dword [ebp - 4], 7
call fcn.10016d2b
mov dword [ebp - 0x20], 0x22ba3946
mov dword [ebp - 0x14], 0xc15d0d65
mov dword [ebp - 0x28], 0x6e1580eb
mov dword [ebp - 0x18], ebx
jmp 0x10019f38
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe4]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10019f25
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], ebx
jl 0x1001a0cf
push 3
pop edi
mov dword [ebp - 0x18], 0x92eda8ed
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], ebx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xe4]
push 0
mov eax, dword [ecx + eax*4]
cmp eax, dword [ecx + edx*4]
mov eax, dword [ebp - 0x14]
pop ecx
setg cl
imul eax, ecx
test eax, eax
je 0x1001a040
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], ebx
jl 0x1001a051
mov dword [ebp - 0x18], 0xb44cf59
cmp dword [ebp - 0x18], ebx
je 0x1001a01f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xe4]
cmp dword [eax + ecx*4], ebx
je 0x1001a01f
cmp dword [ebp - 0x24], ebx
je 0x10019ff1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xe4]
cmp dword [eax + ecx*4], ebx
jne 0x10019fd8
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xe4]
cmp dword [eax], 0xc9e4
jl 0x10019ff1
xor eax, eax
inc eax
jmp 0x10019ff3
mov eax, ebx
xor ecx, ecx
cmp eax, 0x5ab1361
mov eax, dword [ebp - 0x24]
sete cl
xor edx, edx
cmp ecx, eax
setl dl
add edx, 0xffff7f0f
neg edx
sbb edx, edx
inc edx
cmp edx, 0xeb25
jg 0x1001a01f
xor eax, eax
inc eax
jmp 0x1001a021
mov eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x14]
jns 0x10019fa8
jmp 0x1001a051
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001a051
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call esi
mov dword [ebp - 0x1c], ebx
jmp 0x1001a0be
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x18], ebx
jne 0x1001a0c3
cmp dword [ebp - 0x34], ebx
je 0x1001a06d
cmp dword [ebp - 0x30], ebx
je 0x1001a06d
xor ecx, ecx
inc ecx
jmp 0x1001a06f
mov ecx, ebx
xor eax, eax
cmp ecx, 0x39802ee
setge al
xor ecx, ecx
cmp eax, 7
setne cl
xor eax, eax
cmp ecx, 0x2184
mov ecx, dword [ebp - 0x34]
setge al
neg ecx
mov dword [ebp - 0x24], eax
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, dword [ebp - 0x24]
setl al
xor ecx, ecx
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
setg cl
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x1001a056
dec dword [ebp - 0x20]
jns 0x10019f51
xor edi, edi
inc edi
lea ecx, [ebp - 0xe4]
call fcn.10016dad
mov dword [ebp - 0x20], 0xd6c05baf
mov dword [ebp - 0x20], ebx
jmp 0x1001a15a
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xfffffff8
jge 0x1001a157
push 3
lea ecx, [ebp - 0x1ec]
call fcn.10016d2b
mov dword [ebp - 0x24], 0x20e32cf4
mov dword [ebp - 0x18], ebx
jmp 0x1001a125
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1ec]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001a116
mov eax, dword [ebp - 0x1ec]
xor ecx, ecx
inc ecx
mov dword [eax + 4], ecx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x1ec]
call fcn.10016dad
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff8
push 1
pop edi
jl 0x1001a0fd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x19
jle 0x1001a0e6
mov dword [ebp - 0x18], 0x91b68dee
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001a18e
push 0x15f0
push 0x1d14
push 0x93c
push 0x13b0
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, dword [sym.imp.USER32.dll_DefWindowProcA]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001a1ad
push ebx
push ebx
push 0x15f9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x20], 0xd6c05baf
mov dword [ebp - 0x20], ebx
jmp 0x1001a234
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xfffffff8
jge 0x1001a231
push 3
lea ecx, [ebp - 0x204]
call fcn.10016d2b
mov dword [ebp - 0x24], 0x20e32cf4
mov dword [ebp - 0x18], ebx
jmp 0x1001a1ff
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x204]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001a1f0
mov eax, dword [ebp - 0x204]
xor ecx, ecx
inc ecx
mov dword [eax + 4], ecx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x204]
call fcn.10016dad
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff8
push 1
pop edi
jl 0x1001a1d7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x19
jle 0x1001a1c0
mov dword [ebp - 0x28], 0x47d228d5
xor ecx, ecx
mov dword [ebp - 0x14], 0xffffffff
inc ecx
mov dword [ebp - 0x18], ebx
jmp 0x1001a25e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4c], 0xc2e0cf57
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1001a250
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001a27c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
xor ecx, ecx
inc ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1001a37e
mov dword [ebp - 0x38], 0x532bb11a
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], ebx
jl 0x1001a375
mov dword [ebp - 0x40], 0xc9ebf495
mov dword [ebp - 0x18], ebx
jmp 0x1001a2ba
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x84], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001a2ad
mov dword [ebp - 0x80], ebx
jmp 0x1001a33e
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jg 0x1001a33b
mov dword [ebp - 0x1c], 0x1d8b9dbe
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001a2e7
push ebx
push ebx
push ebx
push ebx
push ebx
call edi
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x1001a330
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1001a32b
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4c], ecx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001a326
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
dec dword [ebp - 0x18]
jns 0x1001a2fe
dec dword [ebp - 0x1c]
jns 0x1001a2ef
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1001a2d0
xor ecx, ecx
inc ecx
inc dword [ebp - 0x80]
cmp dword [ebp - 0x80], ebx
jle 0x1001a2c5
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], ebx
jl 0x1001a36c
mov dword [ebp - 0x30], 9
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x4c], ebx
je 0x1001a362
mov eax, ecx
cmp dword [ebp - 0x4c], ebx
jne 0x1001a364
mov eax, ebx
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x40]
jns 0x1001a34b
dec dword [ebp - 0x38]
jns 0x1001a2a1
dec dword [ebp - 0x14]
jns 0x1001a28e
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001a3a5
push 0x15f0
push 0x1d14
push 0x93c
push 0x13b0
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001a3be
push ebx
push ebx
push 0x15f9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push 2
lea ecx, [ebp - 0x70]
call fcn.10016d2b
push 5
pop eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x14], ebx
jmp 0x1001a3f5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x90], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001a3e8
mov dword [ebp - 0x14], ebx
jmp 0x1001a410
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x70]
mov dword [eax + ecx*4], 0x1f2c29a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001a400
mov esi, dword [sym.imp.USER32.dll_IsZoomed]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001a42e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
mov eax, dword [ebp - 0x70]
mov dword [eax], ebx
mov eax, dword [eax]
xor edx, edx
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x27c], ebx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x90]
test eax, eax
mov eax, dword [ebp - 0x1c]
setle dl
sub edx, eax
mov eax, dword [ebp - 0x70]
sub edx, 0xfffffffd
neg edx
mov eax, dword [eax]
sbb edx, edx
inc edx
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x90]
cmp eax, edx
mov eax, dword [ebp - 0x70]
setle cl
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x90], ecx
jl 0x1001a4bc
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x1c], ebx
jmp 0x1001a4b4
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x90]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe4
jg 0x1001a4a2
jmp 0x1001a4e4
mov dword [ebp - 0x18], ebx
jmp 0x1001a4d2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x328], 0xfcc0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1001a4c1
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x88], ebx
mov eax, dword [ebp - 0x70]
inc dword [eax]
cmp dword [eax], 2
jle 0x1001a433
lea ecx, [ebp - 0x70]
call fcn.10016dad
mov dword [ebp - 0x3c], 0xfffffff7
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x20], ebx
push 4
call fcn.10016d2b
mov dword [ebp - 0x18], ebx
jmp 0x1001a530
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x21c]
mov dword [eax + ecx*4], 0x87f2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1001a51d
mov dword [ebp - 0x20], 0xffffffed
jmp 0x1001a588
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0x18], ebx
jmp 0x1001a575
mov dword [ebp - 0x1c], 0xfffffffb
dec dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
jmp 0x1001a56c
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001a569
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x1001a55a
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffea
jne 0x1001a54b
mov eax, dword [ebp - 0x21c]
cmp dword [eax], ebx
jne 0x1001a58e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xb
jne 0x1001a53f
lea ecx, [ebp - 0x21c]
call fcn.10016dad
mov dword [ebp - 0x24], 0x6899db22
xor ecx, ecx
mov dword [ebp - 0x14], 0xffffffff
inc ecx
mov dword [ebp - 0x18], ebx
jmp 0x1001a5bd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x48], 0xc2e0cf57
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1001a5af
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001a5db
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1001a6d4
mov dword [ebp - 0x40], 0x532bb11a
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], ebx
jl 0x1001a6cb
push 2
lea ecx, [ebp - 0x64]
call fcn.10016d2b
push 5
pop eax
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x14], ebx
jmp 0x1001a70b