Function at 0x1c3fd00
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x8c
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x1c3fd37
mov eax, 0x100
push eax
push ebx
call fcn.01c96de8
add esp, 8
cmp eax, 0x100
je 0x1c403cd
cmp byte [0x1cf7de4], 0
jne 0x1c3fd4d
call fcn.01c34370
test al, al
je 0x1c403cd
mov edx, dword [ebp + 0x10]
xor esi, esi
cmp byte [0x1cf7de5], 1
adc esi, 1
mov eax, dword [ebp + 8]
test eax, eax
cmovne esi, eax
xorps xmm0, xmm0
movsd qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x34], 0
test ebx, ebx
je 0x1c3fd9b
lea edi, [ebp - 0x3c]
mov ecx, edi
push ebx
mov ebx, edx
call fcn.01c2a460
mov ecx, edi
call fcn.01c33fc0
mov ecx, esi
mov edx, ebx
push edi
call fcn.01c34190
xorps xmm0, xmm0
add esp, 4
movsd qword [ebp - 0x48], xmm0
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x54]
mov edx, esi
call fcn.01c33eb0
cmp byte [ebp - 0x3d], 0
js 0x1c3fe6d
mov word [ebp - 0x48], 0
mov byte [ebp - 0x3d], 0
xorps xmm0, xmm0
movsd qword [ebp - 0x30], xmm0
movzx ecx, word [0x1cf7de6]
xor eax, eax
or cx, word [0x1cf7fe6]
mov dword [ebp - 0x28], 0
mov edx, 0
mov esi, 0
mov ecx, 0
jne 0x1c3fe86
lea edi, [ebp - 0x3c]
movzx ebx, byte [edi + 0xb]
test bl, bl
cmovs ebx, dword [edi + 4]
cmovs edi, dword [edi]
mov dword [ebp - 0x64], edi
and esi, 0x7fffffff
dec esi
test cl, cl
mov edi, 4
cmovs edi, esi
movzx esi, cl
cmovs esi, edx
mov edx, edi
sub edx, esi
cmp edx, ebx
jb 0x1c3feb6
test ebx, ebx
je 0x1c3ff74
test cl, cl
js 0x1c3fe40
lea edi, [ebp - 0x30]
jmp 0x1c3fe43
mov edi, dword [ebp - 0x30]
lea eax, [edi + esi*2]
lea ecx, [ebx + ebx]
push ecx
push dword [ebp - 0x64]
push eax
call fcn.01c994a0
add esp, 0xc
add ebx, esi
cmp byte [ebp - 0x25], 0
js 0x1c3fe81
mov eax, ebx
and al, 0x7f
mov byte [ebp - 0x25], al
lea eax, [edi + ebx*2]
jmp 0x1c3ff6f
mov eax, dword [ebp - 0x48]
mov word [eax], 0
mov dword [ebp - 0x44], 0
jmp 0x1c3fdc5
mov dword [ebp - 0x2c], ebx
jmp 0x1c3fe65
movzx eax, byte [ebp - 0x49]
test al, al
jns 0x1c3fe91
mov eax, dword [ebp - 0x50]
dec eax
lea edx, [ebp - 0x54]
lea esi, [ebp - 0x30]
mov ecx, esi
push eax
push 1
push edx
call fcn.01ccf170
mov cl, byte [esi + 0xb]
mov edx, dword [esi + 4]
mov esi, dword [esi + 8]
mov eax, esi
shr eax, 0x18
jmp 0x1c3fdf9
lea ecx, [ebx + esi]
mov dword [ebp - 0x78], ecx
sub ecx, edi
mov edx, 0x7ffffff6
sub edx, edi
cmp edx, ecx
jb 0x1c41003
test al, al
js 0x1c3fed6
lea eax, [ebp - 0x30]
jmp 0x1c3fed9
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x74], eax
mov ecx, 0x7ffffff7
cmp edi, 0x3ffffff2
ja 0x1c3ff0a
lea eax, [edi + edi]
mov ecx, dword [ebp - 0x78]
cmp ecx, eax
cmova eax, ecx
mov ecx, 5
cmp eax, 5
jb 0x1c3ff0a
or eax, 3
inc eax
mov ecx, eax
js 0x1c41042
mov dword [ebp - 0x6c], ecx
lea eax, [ecx + ecx]
push eax
call fcn.01c9515a
add esp, 4
test esi, esi
mov dword [ebp - 0x68], eax
je 0x1c3ff33
lea ecx, [esi + esi]
push ecx
push dword [ebp - 0x74]
push eax
call fcn.01c994a0
mov eax, dword [ebp - 0x68]
add esp, 0xc
lea eax, [eax + esi*2]
add ebx, ebx
push ebx
push dword [ebp - 0x64]
push eax
call fcn.01c994a0
add esp, 0xc
cmp edi, 4
je 0x1c3ff55
push dword [ebp - 0x74]
call fcn.01c95155
add esp, 4
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x6c]
or eax, 0x80000000
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x2c], eax
lea eax, [ecx + eax*2]
mov word [eax], 0
lea eax, [ebp - 0x30]
movzx ebx, byte [eax + 0xb]
test bl, bl
mov edx, dword [eax]
mov edi, dword [eax + 4]
mov dword [ebp - 0x74], ebx
cmovs ebx, edi
cmovs eax, edx
xor ecx, ecx
test ebx, ebx
je 0x1c40129
xor esi, esi
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x7c], edi
cmp word [eax + ecx*2], 0x5c
je 0x1c40074
add esi, 0xfffffffe
inc ecx
cmp ebx, ecx
jne 0x1c3ff9d
xor ecx, ecx
mov dword [ebp - 0x6c], 0
xor edi, edi
xor edx, edx
mov eax, ecx
mov ecx, edi
test ebx, ebx
je 0x1c4012b
cmp edi, dword [ebp - 0x6c]
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x78], eax
jae 0x1c40b2b
mov esi, ebx
sub esi, eax
jb 0x1c4102a
cmp byte [ebp - 0x74], 0
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x64]
cmovns ecx, eax
mov dword [ebp - 0x64], ecx
cmp esi, 0x7ffffff8
jae 0x1c4102d
mov eax, esi
cmp esi, 4
jbe 0x1c40039
mov esi, eax
or esi, 3
inc esi
mov dword [ebp - 0x6c], eax
js 0x1c41048
lea eax, [esi + esi]
push eax
call fcn.01c9515a
add esp, 4
mov dword [ebp - 0x74], eax
mov dword [edi], eax
or esi, 0x80000000
mov dword [edi + 8], esi
mov eax, dword [ebp - 0x6c]
mov dword [edi + 4], eax
mov edx, dword [ebp - 0x68]
jmp 0x1c4003f
mov byte [edi + 0xb], al
mov dword [ebp - 0x74], edi
mov ecx, dword [ebp - 0x78]
cmp ebx, ecx
mov ebx, dword [ebp - 0x74]
je 0x1c40064
mov esi, eax
mov eax, dword [ebp - 0x64]
lea eax, [eax + ecx*2]
lea ecx, [esi + esi]
push ecx
push eax
push ebx
call fcn.01c994a0
mov eax, esi
mov edx, dword [ebp - 0x68]
add esp, 0xc
mov word [ebx + eax*2], 0
add edi, 0xc
mov ecx, edi
jmp 0x1c4012b
xor ecx, ecx
cmp eax, esi
je 0x1c3ffb2
cmp esi, 2
je 0x1c3ffb2
neg esi
xor ecx, ecx
mov dword [ebp - 0x6c], 0
xor edi, edi
xor edx, edx
sar esi, 1
mov eax, esi
sub eax, ecx
mov dword [ebp - 0x70], eax
cmp edi, dword [ebp - 0x6c]
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x78], ecx
jae 0x1c40ca4
mov ebx, dword [ebp - 0x74]
test bl, bl
movzx eax, bl
cmovs eax, dword [ebp - 0x7c]
sub eax, ecx
jb 0x1c41024
mov ecx, dword [ebp - 0x70]
cmp eax, ecx
cmovb ecx, eax
test bl, bl
mov ebx, ecx
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x64]
cmovns ecx, eax
cmp ebx, 0x7ffffff8
jae 0x1c41027
cmp ebx, 5
jae 0x1c40e1f
mov byte [edi + 0xb], bl
mov edx, edi
test ebx, ebx
jne 0x1c40e51
jmp 0x1c40e6b
add ecx, 0xc
test edx, edx
je 0x1c40112
push edx
mov edi, ecx
call fcn.01c95155
mov ecx, edi
add esp, 4
mov edx, esi
jmp 0x1c4012b
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
cmp edx, 0xe
mov eax, 0xe
cmovb eax, edx
jmp 0x1c4015f
xor edx, edx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x68], edx
movzx eax, word [0x1cf7de6]
or ax, word [0x1cf7fe6]
je 0x1c40222
mov al, byte [ebp - 0x25]
test al, al
js 0x1c40116
movzx ecx, al
cmp al, 0xe
mov eax, 0xe
cmovb eax, ecx
movzx eax, al
lea ecx, [ebp - 0x30]
test eax, eax
je 0x1c4017c
lea edx, [eax + eax]
xor esi, esi
movzx edi, word [ecx + esi]
cmp di, word [esi + str.REGISTRYUSER_]
jne 0x1c401a9
add esi, 2
cmp edx, esi
jne 0x1c40168
cmp eax, 0xe
mov ecx, 3
sbb ecx, 0
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x68]
sub eax, edx
sar eax, 2
imul eax, eax, 0xaaaaaaab
mov dword [ebp - 0x90], eax
cmp eax, ecx
jae 0x1c401b0
xor eax, eax
jmp 0x1c40244
mov ecx, 2
jmp 0x1c40187
movzx ebx, byte [ebp - 0x3d]
test bl, bl
mov dword [ebp - 0x7c], ecx
jns 0x1c40f07
mov ebx, 0x7fffffff
and ebx, dword [ebp - 0x40]
dec ebx
mov eax, dword [ebp - 0x44]
cmp eax, ebx
je 0x1c40f2a
mov esi, dword [ebp - 0x48]
mov ebx, eax
lea eax, [ebx + 1]
mov dword [ebp - 0x44], eax
mov dword [esi + ebx*2], 0x5c
xor eax, eax
mov ecx, edx
jmp 0x1c40a1a
push dword [eax - 0xc]
mov ebx, eax
call fcn.01c95155
mov eax, ebx
add esp, 4
add eax, 0xfffffff4
cmp eax, edi
je 0x1c4020c
cmp byte [eax - 1], 0
jns 0x1c401fd
jmp 0x1c401ee
mov al, 1
jmp 0x1c40247
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x40], eax
movsd xmm0, qword [ebp - 0x54]
movsd qword [ebp - 0x48], xmm0
jmp 0x1c40242
cmp byte [ebp - 0x3d], 0
movzx eax, byte [ebp - 0x49]
js 0x1c40fc0
test al, al
jns 0x1c40210
lea ecx, [ebp - 0x48]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
call fcn.01c27280
mov al, 1
mov esi, dword [ebp - 0x70]
cmp byte [ebp - 0x25], 0
jns 0x1c4025c
push dword [ebp - 0x30]
mov edi, eax
call fcn.01c95155
mov eax, edi
add esp, 4
cmp byte [ebp - 0x49], 0
mov edx, dword [ebp - 0x68]
jns 0x1c40277
push dword [ebp - 0x54]
mov edi, eax
call fcn.01c95155
mov eax, edi
mov edx, dword [ebp - 0x68]
add esp, 4
xor ebx, ebx
test al, al
je 0x1c4037d
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
cmp byte [ebp - 0x3d], 0
js 0x1c4029c
lea eax, [ebp - 0x48]
jmp 0x1c4029f
mov eax, dword [ebp - 0x48]
push eax
lea esi, [ebp - 0x54]
push esi
call sub.ntdll.dll_RtlInitUnicodeString
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
sub esp, 0x1c
xorps xmm0, xmm0
movups xmmword [esp + 0xc], xmm0
lea eax, [ebp - 0x30]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.ntdll.dll_NtCreateKey
test eax, eax
js 0x1c40340
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x68]
sub eax, edx
je 0x1c4035a
sar eax, 2
imul esi, eax, 0xaaaaaaab
push dword [ebp - 0x58]
call sub.ntdll.dll_NtClose
mov ecx, dword [ebp - 0x68]
cmp esi, 1
mov eax, esi
adc eax, 0
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x88], esi
lea eax, [esi - 1]
mov dword [ebp - 0x98], eax
xor edi, edi
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x64], 0
xor esi, esi
jmp 0x1c4070d
mov edx, dword [ebp - 0x68]
jmp 0x1c4037a
xor ebx, ebx
mov edi, dword [ebp - 0x64]
mov edx, dword [ebp - 0x68]
jmp 0x1c4036a
push eax
call sub.ntdll.dll_NtClose
mov edx, dword [ebp - 0x68]
jmp 0x1c40368
xor edi, edi
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x58]
test ecx, ecx
je 0x1c4034f
mov dword [ecx], eax
mov bl, 1
test edi, edi
je 0x1c4037a
push edi
call fcn.01c95155
mov edx, dword [ebp - 0x68]
add esp, 4
mov esi, dword [ebp - 0x70]
test edx, edx
jne 0x1c40394
jmp 0x1c403a9
push dword [esi - 0xc]
call fcn.01c95155
mov edx, dword [ebp - 0x68]
add esp, 4
add esi, 0xfffffff4
cmp esi, edx
je 0x1c403a0
cmp byte [esi - 1], 0
jns 0x1c40391
jmp 0x1c40383
push edx
call fcn.01c95155
add esp, 4
cmp byte [ebp - 0x3d], 0
jns 0x1c403ba
push dword [ebp - 0x48]
call fcn.01c95155
add esp, 4
cmp byte [ebp - 0x31], 0
jns 0x1c403cf
push dword [ebp - 0x3c]
call fcn.01c95155
add esp, 4
jmp 0x1c403cf
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
mov eax, ebx
add esp, 0x8c
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x1c4034a
mov esi, dword [ebp - 0x64]
cmp esi, edi
je 0x1c403e6
push dword [esi]
call sub.ntdll.dll_NtDeleteKey
add esi, 4
cmp esi, edi
jne 0x1c403f4
cmp dword [ebp - 0x64], edi
je 0x1c40418
mov esi, dword [ebp - 0x64]
push dword [esi]
call sub.ntdll.dll_NtClose
add esi, 4
cmp esi, edi
jne 0x1c4040a
test ebx, ebx
js 0x1c40345
mov edi, dword [ebp - 0x64]
mov edx, dword [ebp - 0x68]
jmp 0x1c4035c
cmp ebx, 0x7ffffff7
je 0x1c41039
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x6c], eax
mov edi, 0x7ffffff7
cmp ebx, 0x3ffffff2
ja 0x1c4046b
lea eax, [ebx + ebx]
lea ecx, [ebx + 1]
cmp ecx, eax
cmova eax, ecx
mov edi, 5
cmp eax, 5
jb 0x1c4046b
or eax, 3
inc eax
mov edi, eax
js 0x1c4103c
lea eax, [edi + edi]
push eax
call fcn.01c9515a
add esp, 4
mov esi, eax
test ebx, ebx
je 0x1c40492
lea eax, [ebx + ebx]
push eax
push dword [ebp - 0x6c]
push esi
call fcn.01c994a0
add esp, 0xc
cmp ebx, 4
je 0x1c4049d
push dword [ebp - 0x6c]
call fcn.01c95155
add esp, 4
mov dword [ebp - 0x48], esi
or edi, 0x80000000
mov dword [ebp - 0x40], edi
jmp 0x1c405be
cmp ebx, 4
je 0x1c40fde
mov eax, ebx
inc al
and al, 0x7f
mov byte [ebp - 0x3d], al
lea esi, [ebp - 0x48]
jmp 0x1c405c4
mov dword [ebp - 0x94], edx
lea ecx, [ebx + edx]
mov dword [ebp - 0x84], ecx
sub ecx, edi
mov edx, 0x7ffffff6
sub edx, edi
cmp edx, ecx
jb 0x1c40ffa
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x7c], ecx
test al, al
jns 0x1c404f8
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x7c], eax
mov esi, 0x7ffffff7
cmp edi, 0x3ffffff2
ja 0x1c40529
lea eax, [edi + edi]
mov ecx, dword [ebp - 0x84]
cmp ecx, eax
cmova eax, ecx
mov esi, 5
cmp eax, 5
jb 0x1c40529
or eax, 3
inc eax
mov esi, eax
js 0x1c4100c
lea eax, [esi + esi]
push eax
call fcn.01c9515a
add esp, 4
test ebx, ebx
mov dword [ebp - 0x80], eax
je 0x1c4054f
lea ecx, [ebx + ebx]
push ecx
push dword [ebp - 0x7c]
push eax
call fcn.01c994a0
mov eax, dword [ebp - 0x80]
add esp, 0xc
lea eax, [eax + ebx*2]
mov ecx, dword [ebp - 0x94]
add ecx, ecx
push ecx
push dword [ebp - 0x6c]
push eax
call fcn.01c994a0
add esp, 0xc
cmp edi, 4
je 0x1c40577
push dword [ebp - 0x7c]
call fcn.01c95155
add esp, 4
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x48], ecx
or esi, 0x80000000
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x44], eax
lea eax, [ecx + eax*2]
mov word [eax], 0
movzx ebx, byte [ebp - 0x3d]
test bl, bl
jns 0x1c404ae
mov ebx, dword [ebp - 0x40]
mov eax, 0x7fffffff
and ebx, eax
dec ebx
mov eax, dword [ebp - 0x44]
cmp eax, ebx
je 0x1c4042b
mov esi, dword [ebp - 0x48]
mov ebx, eax
lea eax, [ebx + 1]
mov dword [ebp - 0x44], eax
mov dword [esi + ebx*2], 0x5c
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x60], 0xffffffff
cmp byte [ebp - 0x3d], 0
lea edi, [ebp - 0x48]
jns 0x1c405e5
mov edi, dword [ebp - 0x48]
push edi
call fcn.01c96aca
add esp, 4
cmp eax, 0x7ffffff8
mov ebx, dword [ebp + 0x10]
jae 0x1c40ff7
cmp eax, 5
mov dword [ebp - 0x6c], edi
jae 0x1c40610
mov byte [ebp - 0x49], al
lea esi, [ebp - 0x54]
test eax, eax
jne 0x1c40640
jmp 0x1c40653
mov ebx, eax
or ebx, 3
inc ebx
js 0x1c40ffd
mov edi, eax
lea eax, [ebx + ebx]
push eax
call fcn.01c9515a
add esp, 4
mov esi, eax
mov dword [ebp - 0x54], eax
or ebx, 0x80000000
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], edi
mov ebx, dword [ebp + 0x10]
mov eax, edi
mov edi, eax
add eax, eax
push eax
push dword [ebp - 0x6c]
push esi
call fcn.01c994a0
mov eax, edi
add esp, 0xc
mov edi, dword [ebp - 0x78]
mov word [esi + eax*2], 0
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
cmp byte [ebp - 0x49], 0
lea eax, [ebp - 0x54]
jns 0x1c40670
mov eax, dword [ebp - 0x54]
push eax
lea esi, [ebp - 0x18]
push esi
call sub.ntdll.dll_RtlInitUnicodeString
mov dword [ebp - 0x30], 0x18
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x5c]
push ecx
push eax
push eax
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
lea eax, [ebp - 0x60]
push eax
call sub.ntdll.dll_NtCreateKey
mov ebx, eax
cmp byte [ebp - 0x49], 0
jns 0x1c406be
push dword [ebp - 0x54]
call fcn.01c95155
add esp, 4
test ebx, ebx
mov esi, dword [ebp - 0x74]
js 0x1c403ed
cmp esi, dword [ebp - 0x98]
je 0x1c406f7
cmp dword [ebp - 0x5c], 1
je 0x1c406e1
push dword [ebp - 0x60]
call sub.ntdll.dll_NtClose
jmp 0x1c406fd
cmp edi, dword [ebp - 0x8c]
jae 0x1c407aa
mov eax, dword [ebp - 0x60]
mov dword [edi], eax
add edi, 4
jmp 0x1c406fd
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x68]
inc esi
cmp esi, dword [ebp - 0x90]
je 0x1c40402
cmp esi, dword [ebp - 0x88]
je 0x1c40ff4
lea eax, [esi + esi*2]
movzx edx, byte [ecx + eax*4 + 0xb]
test dl, dl
mov dword [ebp - 0x78], edi
js 0x1c4072d
lea eax, [ecx + eax*4]
jmp 0x1c40734
mov edx, dword [ecx + eax*4 + 4]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x6c], eax
movzx eax, byte [ebp - 0x3d]
mov edi, 4
mov ebx, eax
test al, al
jns 0x1c40754
mov edi, dword [ebp - 0x40]
mov ecx, 0x7fffffff
and edi, ecx
dec edi
mov ebx, dword [ebp - 0x44]
mov ecx, edi
sub ecx, ebx
cmp ecx, edx
mov dword [ebp - 0x74], esi
jb 0x1c404c8
test edx, edx
je 0x1c40597
lea esi, [ebp - 0x48]
test al, al
jns 0x1c40775
mov esi, dword [ebp - 0x48]
lea eax, [esi + ebx*2]
lea ecx, [edx + edx]
push ecx
push dword [ebp - 0x6c]
push eax
mov edi, edx
call fcn.01c994a0
add esp, 0xc
add ebx, edi
cmp byte [ebp - 0x3d], 0
js 0x1c407a1
mov eax, ebx
and al, 0x7f
mov byte [ebp - 0x3d], al
lea eax, [esi + ebx*2]
jmp 0x1c40592
mov dword [ebp - 0x44], ebx
jmp 0x1c40799
xor eax, eax
jmp 0x1c407ff
mov ecx, dword [ebp - 0x64]
sub edi, ecx
sar edi, 2
lea eax, [edi + 1]
cmp eax, 0x40000000
jae 0x1c4100f
mov edx, dword [ebp - 0x8c]
sub edx, ecx
mov esi, edx
sar esi, 1
cmp esi, eax
cmovbe esi, eax
cmp edx, 0x7ffffffc
mov eax, 0x3fffffff
cmovae esi, eax
test esi, esi
je 0x1c407a6
cmp esi, 0x40000000
jae 0x1c4103f
lea eax, [esi*4]
push eax
call fcn.01c9515a
add esp, 4
mov dword [ebp - 0x6c], eax
lea eax, [eax + edi*4]
mov ecx, dword [ebp - 0x60]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x64]
cmp dword [ebp - 0x78], ecx
je 0x1c40855
mov edx, dword [ebp - 0x78]
mov ecx, dword [edx - 4]
add edx, 0xfffffffc
mov dword [eax - 4], ecx
mov ecx, dword [ebp - 0x64]
add eax, 0xfffffffc
cmp edx, ecx
jne 0x1c40815
mov dword [ebp - 0x64], eax
test ecx, ecx
je 0x1c40838
push ecx
call fcn.01c95155
add esp, 4
mov ecx, dword [ebp - 0x6c]
lea eax, [ecx + esi*4]
mov dword [ebp - 0x8c], eax
lea edi, [ecx + edi*4]
add edi, 4
mov ecx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x74]
jmp 0x1c40700
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x78]
jmp 0x1c4082b
cmp ebx, 0x7ffffff7
je 0x1c41006
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x64], eax
mov edi, 0x7ffffff7
cmp ebx, 0x3ffffff2
ja 0x1c4089d
lea eax, [ebx + ebx]
lea ecx, [ebx + 1]
cmp ecx, eax
cmova eax, ecx
mov edi, 5
cmp eax, 5
jb 0x1c4089d
or eax, 3
inc eax
mov edi, eax
js 0x1c41009
lea eax, [edi + edi]
push eax
call fcn.01c9515a
add esp, 4
mov esi, eax
test ebx, ebx
je 0x1c408c4
lea eax, [ebx + ebx]
push eax
push dword [ebp - 0x64]
push esi
call fcn.01c994a0
add esp, 0xc
cmp ebx, 4
je 0x1c408cf
push dword [ebp - 0x64]
call fcn.01c95155
add esp, 4
mov dword [ebp - 0x48], esi
or edi, 0x80000000
mov dword [ebp - 0x40], edi
mov edx, dword [ebp - 0x68]
mov edi, dword [ebp - 0x7c]
jmp 0x1c409fb
cmp ebx, 4
je 0x1c40fb0
mov eax, ebx
inc al
and al, 0x7f
mov byte [ebp - 0x3d], al
lea esi, [ebp - 0x48]
jmp 0x1c40a01
add ecx, ebx
mov dword [ebp - 0x88], ecx
sub ecx, edi
mov edx, 0x7ffffff6
sub edx, edi
cmp edx, ecx
jb 0x1c40ff1
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x80], ecx
test al, al
jns 0x1c40929
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x80], eax
mov esi, 0x7ffffff7
cmp edi, 0x3ffffff2
ja 0x1c4095a
lea eax, [edi + edi]
mov ecx, dword [ebp - 0x88]
cmp ecx, eax
cmova eax, ecx
mov esi, 5
cmp eax, 5
jb 0x1c4095a
or eax, 3
inc eax
mov esi, eax
js 0x1c41000
lea eax, [esi + esi]
push eax
call fcn.01c9515a
add esp, 4
test ebx, ebx
mov dword [ebp - 0x84], eax
je 0x1c40986
lea ecx, [ebx + ebx]
push ecx
push dword [ebp - 0x80]
push eax
call fcn.01c994a0
mov eax, dword [ebp - 0x84]
add esp, 0xc
lea eax, [eax + ebx*2]
mov ecx, dword [ebp - 0x64]
add ecx, ecx
push ecx
push dword [ebp - 0x6c]
push eax
call fcn.01c994a0
add esp, 0xc
cmp edi, 4
je 0x1c409ab
push dword [ebp - 0x80]
call fcn.01c95155
add esp, 4
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x48], ecx
or esi, 0x80000000
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x44], eax
lea eax, [ecx + eax*2]
mov edx, dword [ebp - 0x68]
mov edi, dword [ebp - 0x7c]
mov word [eax], 0
movzx ebx, byte [ebp - 0x3d]
test bl, bl
jns 0x1c408e6
mov ebx, dword [ebp - 0x40]
mov eax, 0x7fffffff
and ebx, eax
dec ebx
mov eax, dword [ebp - 0x44]
cmp eax, ebx
je 0x1c4085d
mov esi, dword [ebp - 0x48]
mov ebx, eax
lea eax, [ebx + 1]
mov dword [ebp - 0x44], eax
mov dword [esi + ebx*2], 0x5c
mov eax, dword [ebp - 0x78]
inc eax
mov ecx, dword [ebp - 0x74]
add ecx, 0xc
cmp edi, eax
je 0x1c40abd
cmp dword [ebp - 0x90], eax
je 0x1c40fee
mov dword [ebp - 0x78], eax
movzx eax, byte [ecx + 0xb]
mov esi, ecx
mov dword [ebp - 0x64], eax
test al, al
jns 0x1c40a3e
mov eax, dword [ecx + 4]
mov dword [ebp - 0x64], eax
mov esi, dword [ecx]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x74], ecx
movzx eax, byte [ebp - 0x3d]
mov edi, 4
mov ebx, eax
test al, al
jns 0x1c40a61
mov edi, dword [ebp - 0x40]
mov ecx, 0x7fffffff
and edi, ecx
dec edi
mov ebx, dword [ebp - 0x44]
mov ecx, edi
sub ecx, ebx
mov esi, dword [ebp - 0x64]
cmp ecx, esi
mov ecx, esi
jb 0x1c40900
test ecx, ecx
mov edi, dword [ebp - 0x7c]
je 0x1c409d4
lea esi, [ebp - 0x48]
test al, al
jns 0x1c40a87
mov esi, dword [ebp - 0x48]
lea eax, [esi + ebx*2]
mov edi, ecx
add ecx, ecx
push ecx
push dword [ebp - 0x6c]
push eax
call fcn.01c994a0
add esp, 0xc
add ebx, edi
cmp byte [ebp - 0x3d], 0
js 0x1c40ab8
mov eax, ebx
and al, 0x7f
mov byte [ebp - 0x3d], al
mov edi, dword [ebp - 0x7c]
lea eax, [esi + ebx*2]
mov edx, dword [ebp - 0x68]
jmp 0x1c409cf
mov dword [ebp - 0x44], ebx
jmp 0x1c40aaa
lea eax, [edi + edi*2]
lea eax, [edx + eax*4]
mov ecx, dword [ebp - 0x70]
cmp eax, ecx
je 0x1c40ad6
shl edi, 2
lea ebx, [edi + edi*2]
mov esi, edx
mov edi, edx
jmp 0x1c40b1f
mov eax, ecx
mov esi, edx
mov edi, edx
jmp 0x1c40200
push dword [edi]
call fcn.01c95155
add esp, 4
lea eax, [edi + ebx]
mov ecx, dword [eax + 8]
mov dword [edi + 8], ecx
movsd xmm0, qword [eax]
movsd qword [edi], xmm0
lea eax, [edi + ebx]
add eax, 0xc
mov byte [eax - 1], 0
mov word [eax - 0xc], 0
add edi, 0xc
add esi, 0xc
mov ecx, dword [ebp - 0x70]
cmp eax, ecx
mov eax, ecx
je 0x1c40200
cmp byte [edi + 0xb], 0
jns 0x1c40aeb
jmp 0x1c40ae1
xor eax, eax
jmp 0x1c40b8f
mov eax, edi
sub eax, edx
sar eax, 2
imul esi, eax, 0xaaaaaaab
lea eax, [esi + 1]
cmp eax, 0x15555556
jae 0x1c41030
mov ecx, dword [ebp - 0x6c]
sub ecx, edx
sar ecx, 2
imul ecx, ecx, 0xaaaaaaab
lea edx, [ecx + ecx]
cmp edx, eax
cmova eax, edx
cmp ecx, 0xaaaaaaa
mov ecx, 0x15555555
cmovb ecx, eax
test ecx, ecx
mov ebx, dword [ebp - 0x74]
mov dword [ebp - 0x70], esi
je 0x1c40b27
cmp ecx, 0x15555556
jae 0x1c41045
shl ecx, 2
lea eax, [ecx + ecx*2]
push eax
call fcn.01c9515a
add esp, 4
test bl, bl
movzx esi, bl
cmovs esi, dword [ebp - 0x7c]
mov dword [ebp - 0x6c], esi
sub esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x68]
jb 0x1c41033
test bl, bl
lea ecx, [ebp - 0x30]
mov ebx, dword [ebp - 0x64]
cmovns ebx, ecx
mov dword [ebp - 0x64], ebx
cmp esi, 0x7ffffff8
jae 0x1c41036
mov ebx, esi
mov ecx, dword [ebp - 0x70]
lea ecx, [ecx + ecx*2]
lea ecx, [eax + ecx*4]
cmp esi, 4
mov dword [ebp - 0x70], ecx
jbe 0x1c40c06
mov esi, ebx
or ebx, 3
inc ebx
js 0x1c4104b
lea eax, [ebx + ebx]
push eax
call fcn.01c9515a
add esp, 4
mov edx, eax
mov ecx, dword [ebp - 0x70]
mov dword [ecx], eax
or ebx, 0x80000000
mov dword [ecx + 8], ebx
mov dword [ecx + 4], esi
mov edx, dword [ebp - 0x68]
mov ebx, esi
jmp 0x1c40c0b
mov byte [ecx + 0xb], bl
mov eax, ecx
mov esi, dword [ebp - 0x78]
cmp dword [ebp - 0x6c], esi
je 0x1c40c35
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x64]
lea eax, [eax + esi*2]
lea ecx, [ebx + ebx]
push ecx
push eax
push dword [ebp - 0x74]
call fcn.01c994a0
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x68]
add esp, 0xc
mov word [eax + ebx*2], 0
mov esi, ecx
cmp edi, edx
je 0x1c400fe
xorps xmm0, xmm0
mov eax, edi
mov esi, ecx
mov ecx, dword [eax - 4]
mov dword [esi - 4], ecx
movsd xmm1, qword [eax - 0xc]
movsd qword [esi - 0xc], xmm1
movsd qword [eax - 0xc], xmm0
mov dword [eax - 4], 0
add eax, 0xfffffff4
add esi, 0xfffffff4
cmp eax, edx
jne 0x1c40c4c
mov ecx, dword [ebp - 0x70]
jmp 0x1c40c93
push dword [edi - 0xc]
call fcn.01c95155
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x68]
add esp, 4
add edi, 0xfffffff4
cmp edi, edx
je 0x1c400fe
cmp byte [edi - 1], 0
jns 0x1c40c88
jmp 0x1c40c77
mov dword [ebp - 0x6c], 0
jmp 0x1c40d14
mov eax, edi
sub eax, edx
sar eax, 2
imul ecx, eax, 0xaaaaaaab
mov eax, ecx
mov dword [ebp - 0x84], ecx
lea ebx, [ecx + 1]
cmp ebx, 0x15555556
jae 0x1c41012
mov eax, dword [ebp - 0x6c]
sub eax, edx
sar eax, 2
imul eax, eax, 0xaaaaaaab
lea ecx, [eax + eax]
cmp ecx, ebx
cmova ebx, ecx
cmp eax, 0xaaaaaaa
mov eax, 0x15555555
cmovae ebx, eax
test ebx, ebx
mov dword [ebp - 0x80], ebx
je 0x1c40c9b
cmp ebx, 0x15555556
jae 0x1c41015
lea eax, [ebx*4]
lea eax, [eax + eax*2]
push eax
call fcn.01c9515a
add esp, 4
mov dword [ebp - 0x6c], eax
mov ebx, dword [ebp - 0x74]
test bl, bl
movzx eax, bl
cmovs eax, dword [ebp - 0x7c]
sub eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x64]
jb 0x1c4101b
mov edx, dword [ebp - 0x70]
cmp eax, edx
cmovb edx, eax
test bl, bl
lea eax, [ebp - 0x30]
cmovns ecx, eax
cmp edx, 0x7ffffff8
jae 0x1c4101e
mov ebx, edx
mov eax, dword [ebp - 0x84]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x6c]
lea eax, [edx + eax*4]
cmp ebx, 5
mov dword [ebp - 0x74], eax
jae 0x1c40d6c
mov byte [eax + 0xb], bl
mov edx, eax
test ebx, ebx
jne 0x1c40da1
jmp 0x1c40dbe
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x70], ebx
or ebx, 3
inc ebx
js 0x1c41021
lea eax, [ebx + ebx]
push eax
call fcn.01c9515a
add esp, 4
mov edx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], edx
or ebx, 0x80000000
mov dword [eax + 8], ebx
mov ebx, dword [ebp - 0x70]
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x78]
lea eax, [ecx + eax*2]
lea ecx, [ebx + ebx]
push ecx
push eax
push edx
call fcn.01c994a0
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x74]
add esp, 0xc
mov word [edx + ebx*2], 0
mov ebx, eax
mov edx, dword [ebp - 0x68]
cmp edi, edx
xorps xmm1, xmm1
mov ecx, eax
je 0x1c40e7c
mov eax, edi
mov ebx, ecx
mov ecx, dword [eax - 4]
mov dword [ebx - 4], ecx
movsd xmm0, qword [eax - 0xc]
movsd qword [ebx - 0xc], xmm0
movsd qword [eax - 0xc], xmm1
mov dword [eax - 4], 0
add eax, 0xfffffff4
add ebx, 0xfffffff4
cmp eax, edx
jne 0x1c40dda
jmp 0x1c40e17
push dword [edi - 0xc]
call fcn.01c95155
mov edx, dword [ebp - 0x68]
add esp, 4
add edi, 0xfffffff4
cmp edi, edx
je 0x1c40e79
cmp byte [edi - 1], 0
jns 0x1c40e10
jmp 0x1c40e02
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x70], ebx
or ebx, 3
inc ebx
js 0x1c41018
lea eax, [ebx + ebx]
push eax
call fcn.01c9515a
add esp, 4
mov edx, eax
mov dword [edi], eax
or ebx, 0x80000000
mov dword [edi + 8], ebx
mov ebx, dword [ebp - 0x70]
mov dword [edi + 4], ebx
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x78]
lea eax, [ecx + eax*2]
lea ecx, [ebx + ebx]
push ecx
push eax
push edx
call fcn.01c994a0
mov edx, dword [ebp - 0x64]
add esp, 0xc
mov word [edx + ebx*2], 0
add edi, 0xc
mov edx, dword [ebp - 0x68]
jmp 0x1c40e9f
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x80]
lea eax, [eax + eax*2]
mov edi, ecx
mov ecx, dword [ebp - 0x6c]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x6c], eax
add edi, 0xc
test edx, edx
je 0x1c40e9d
push edx
call fcn.01c95155
add esp, 4
mov edx, ebx
movzx ebx, byte [ebp - 0x25]
test bl, bl
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x7c], eax
cmovs ebx, eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x64], ecx
cmovs eax, ecx
lea ecx, [esi + 1]
cmp ebx, ecx
jbe 0x1c3ffbd
je 0x1c40f00
lea esi, [esi*2 + 2]
mov dword [ebp - 0x78], ecx
cmp word [eax + esi], 0x5c
je 0x1c40eeb
add esi, 2
inc ecx
cmp ebx, ecx
jne 0x1c40ed4
mov ecx, dword [ebp - 0x78]
jmp 0x1c3ffbd
add eax, esi
je 0x1c40ee3
cmp esi, 0xfffffffe
mov ecx, dword [ebp - 0x78]
jne 0x1c40096
jmp 0x1c3ffbd
mov eax, ecx
jmp 0x1c3ffc9
cmp ebx, 4
je 0x1c40f1d
mov eax, ebx
inc al
and al, 0x7f
lea esi, [ebp - 0x48]
mov byte [esi + 0xb], al
jmp 0x1c401de
mov ebx, 4
lea eax, [ebp - 0x48]
mov dword [ebp - 0x64], eax
jmp 0x1c40f49
cmp ebx, 0x7ffffff7
je 0x1c4104e
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x64], eax
mov edi, 0x7ffffff7
cmp ebx, 0x3ffffff2
ja 0x1c40f6a
lea eax, [ebx + ebx]
lea ecx, [ebx + 1]
cmp ecx, eax
cmova eax, ecx
mov edi, 5
cmp eax, 5
jb 0x1c40f6a
or eax, 3
inc eax
mov edi, eax
js 0x1c41051
lea eax, [edi + edi]
push eax
call fcn.01c9515a
add esp, 4
mov esi, eax
test ebx, ebx
je 0x1c40f91
lea eax, [ebx + ebx]
push eax
push dword [ebp - 0x64]
push esi
call fcn.01c994a0
add esp, 0xc
cmp ebx, 4
je 0x1c40f9c
push dword [ebp - 0x64]
call fcn.01c95155
add esp, 4
mov dword [ebp - 0x48], esi
or edi, 0x80000000
mov dword [ebp - 0x40], edi
mov edx, dword [ebp - 0x68]
jmp 0x1c401d8
mov ebx, 4
lea eax, [ebp - 0x48]
mov dword [ebp - 0x64], eax
jmp 0x1c4087c
test al, al
cmovs eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 0x54]
cmovns edx, ecx
lea ecx, [ebp - 0x48]
push eax
push edx
call fcn.01c27320
jmp 0x1c40242
mov ebx, 4
lea eax, [ebp - 0x48]
mov dword [ebp - 0x6c], eax
jmp 0x1c4044a
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3