Function at 0x100183f6
Capabilities:
Accept command line arguments
Delete registry value
Get file size
Query or enumerate registry value
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
push ebx
push esi
push edi
mov edi, 0x571177e8
mov dword [ebp - 0xcc], edx
mov dword [ebp - 0x28], edi
xor edx, edx
xor esi, esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0xe4], ecx
inc esi
mov dword [ebp - 4], edx
jmp 0x10018430
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1a0], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x10018423
push 2
mov dword [ebp - 4], edx
pop ebx
jmp 0x1001844e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x270], 0xf680299
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x1001843d
mov dword [ebp - 0x20], 0xfffffffb
jmp 0x1001849a
mov dword [ebp - 0x28], 0xc0d37ad4
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], edx
jl 0x10018497
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], edx
jmp 0x1001848d
mov dword [ebp - 0x18], 0xf09a2b44
dec dword [ebp - 0x18]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x10018480
dec dword [ebp - 0x28]
jns 0x10018471
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xd
jge 0x1001845c
mov dword [ebp - 4], 0x97f6af11
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 4], edx
jmp 0x100184cb
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x3c], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x100184c1
mov dword [ebp - 4], edx
jmp 0x100184e6
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x248], 0x93506f8a
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x100184d5
push 3
mov dword [ebp - 4], edx
pop ecx
jmp 0x10018660
mov dword [ebp - 0xc], 0x4fddd3f4
mov dword [ebp - 0x14], 0x3e8ce6fc
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], edx
jl 0x10018658
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], edx
jmp 0x1001852d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1d0], 0xe957
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1001851c
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x3c]
dec eax
jne 0x1001855f
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x3c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x3c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x3c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
dec eax
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 4]
cmp ecx, eax
sbb eax, eax
add eax, 0xffffa767
neg eax
sbb eax, eax
inc eax
sub eax, 5
je 0x10018599
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x3c], edx
je 0x10018599
dec dword [ebp - 0x24]
jmp 0x100185c2
mov dword [ebp - 0x18], edx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x100185b9
push 0x1992
push edx
push 0xc0d
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor edx, edx
cmp dword [ebp - 0x18], edx
jne 0x1001864c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, esi
setne al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x18], eax
je 0x100185e8
cmp dword [ebp - 0x24], edx
je 0x100185ed
cmp dword [ebp - 0x28], edx
jne 0x100185ef
mov esi, edx
mov eax, dword [ebp - 0xc]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x3c]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setle dl
cmp esi, 1
sbb ecx, ecx
xor eax, eax
add ecx, 0x7069e5fa
cmp ecx, 0xa002
setg al
add edx, eax
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0xf7f1c74f
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 4]
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor esi, esi
xor edx, edx
mov dword [ebp - 0x244], ecx
inc esi
dec dword [ebp - 0xc]
push 3
pop ecx
jns 0x10018511
cmp dword [ebp - 0x14], edx
jne 0x1001866a
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a
jle 0x100184f7
mov dword [ebp - 0x1c], edi
push 0xfffffffffffffff7
mov dword [ebp - 0x10], 0x13532fe2
mov dword [ebp - 4], edx
pop ecx
jmp 0x10018689
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xb0], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x1001867c
mov dword [ebp - 4], edx
jmp 0x1001869d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x44], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x10018693
mov dword [ebp - 0x10], edx
jmp 0x1001882c
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 4], esi
cmp dword [ebp - 4], edx
jl 0x10018829
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x14], 0xce34aafb
mov dword [ebp - 0x18], 7
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], edx
jl 0x10018789
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x20], edx
jmp 0x10018702
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x94], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x100186f1
mov dword [ebp - 0x90], esi
cmp dword [ebp - 0x90], edx
jl 0x10018780
mov eax, dword [ebp - 4]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x18], edx
jne 0x1001872f
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 4]
push 0
mov eax, dword [ebp + eax*4 - 0xb0]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*4 - 0xb0]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 4]
setne dl
xor ecx, ecx
cmp edx, eax
pop edx
setne cl
mov dword [ebp - 0x20], ecx
dec dword [ebp - 0x90]
jns 0x10018715
dec dword [ebp - 0xc]
jns 0x100186e5
mov dword [ebp - 0x20], edx
jmp 0x10018817
mov dword [ebp - 0x24], 0x80dd333f
mov dword [ebp - 0x1c], 0x1ad04870
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x100187b1
push edx
call dword [sym.imp.USER32.dll_DestroyIcon]
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x1001880f
mov dword [ebp - 0x28], 0x492a4153
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xb0]
test eax, eax
sets cl
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0xc], edx
jne 0x100187e2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xb0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, 0x78833e6f
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x100187b6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x10018791
dec dword [ebp - 4]
jns 0x100186c4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x100186aa
mov ebx, dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov dword [ebp - 0x18], 0xdcec3d7d
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018850
push edx
call ebx
xor edx, edx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018867
push edx
push 0x2442
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x10018879
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x19c], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001886c
mov dword [ebp - 4], edx
jmp 0x10018894
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x250], 0xf680299
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10018883
mov dword [ebp - 0x1c], 0xfffffffb
cmp dword [ebp - 0x1c], 0xd
jl 0x10019216
mov edi, 0xffff6ff3
mov dword [ebp - 4], edx
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x10], edx
jmp 0x100188d7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x40], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100188c9
mov dword [ebp - 4], edx
cmp dword [ebp - 4], edx
jl 0x1001891d
mov dword [ebp - 0x10], 0xfffffff7
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x40], edx
jne 0x1001891d
mov dword [ebp - 0x10], edx
jmp 0x10018913
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018910
push edx
push edx
push edx
push edx
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x100188f9
dec dword [ebp - 4]
jns 0x100188e4
mov dword [ebp - 4], edx
jmp 0x100189d8
push 3
mov dword [ebp - 0x14], 0x8d3a18e4
mov dword [ebp - 0x10], edx
pop ecx
jmp 0x10018941
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x218], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10018934
cmp dword [ebp - 0x14], edx
je 0x1001894e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 4]
cmp eax, ecx
mov eax, dword [ebp - 4]
setge dl
imul ecx, edx, 0xff83
xor edx, edx
cmp eax, ecx
setge dl
mov dword [ebp - 0x214], edx
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, esi
cmp dword [ebp - 0x40], edx
jne 0x10018982
mov eax, edx
xor ecx, ecx
cmp eax, esi
setle cl
xor eax, eax
add ecx, dword [ebp - 0x14]
cmp ecx, 0xffffffff
setge al
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edx
je 0x100189a3
mov ecx, esi
cmp dword [ebp - 0x14], edx
jne 0x100189a5
mov ecx, edx
mov eax, dword [ebp - 0x40]
xor edx, edx
add ecx, 0xffff40c5
cmp ecx, eax
setge dl
mov dword [ebp - 0x18], edx
xor edx, edx
cmp dword [ebp - 0x18], edx
je 0x100189c4
inc dword [ebp - 0x2c]
jmp 0x100189d5
mov byte [ebp - 5], dl
cmp byte [ebp - 5], dl
je 0x100189d5
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jle 0x10018925
mov dword [ebp - 0x24], 0xc0d37ad4
mov dword [ebp - 0x20], 0x1c0f8067
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x10], edx
jmp 0x10018a13
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x280], 0xb6fe6d39
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10018a02
cmp dword [ebp - 0x20], edx
je 0x10018a47
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x20]
je 0x10018a45
xor edx, edx
cmp dword [ebp - 0x24], edx
je 0x10018a47
mov edx, esi
jmp 0x10018a47
xor edx, edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x274]
mov dword [ebp - 0x18], ecx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], dl
je 0x10018a83
push edx
push edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor edx, edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x2c], 0xfaf425f5
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], 0xffffffff
push 2
mov dword [ebp - 0x24], 0x1480146
mov dword [ebp - 4], edx
pop ecx
jmp 0x10018ab4
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x68], 0x57fd5464
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10018aa6
mov dword [ebp - 4], edx
jmp 0x10018acf
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x140], 0x5457d670
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10018abe
mov dword [ebp - 0x68], edx
cmp dword [ebp - 0x68], 0xfffffff6
jne 0x10018b69
push 3
mov dword [ebp - 0x24], 0xfec1b16e
mov dword [ebp - 0x10], edx
pop ecx
jmp 0x10018b01
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x160], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10018af0
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x18], edx
jne 0x10018b1b
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x2c], edx
jne 0x10018b2b
cmp dword [ebp - 0x158], edx
je 0x10018b2d
mov edx, esi
mov eax, dword [ebp - 0x68]
inc edx
imul edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x15c]
cmp edx, eax
mov eax, dword [ebp - 0x13c]
setge cl
xor edx, edx
sub eax, ecx
je 0x10018b54
mov eax, esi
cmp dword [ebp - 0x24], edx
jne 0x10018b56
mov eax, edx
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x68]
cmp dword [ebp - 0x68], 0xfffffff6
je 0x10018ae1
push 2
pop ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], esi
push 3
mov dword [ebp - 0x10], edx
pop eax
cmp dword [ebp - 0x10], eax
jge 0x10018b97
push eax
pop edi
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2a4], 0xcff0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10018b7c
mov edi, 0xffff6ff3
mov dword [ebp - 0x20], edx
jmp 0x10018bec
mov dword [ebp - 0x10], 0xf8256a9e
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x10], edx
jmp 0x10018be4
mov dword [ebp - 0x14], 0x99d9
dec dword [ebp - 0x14]
mov dword [ebp - 0x14], edx
jmp 0x10018bdc
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018bd9
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 2
xor edx, edx
pop ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x10018bc3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x10018bb4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jle 0x10018b9c
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018c02
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], edx
jl 0x10019209
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x28], 7
mov dword [ebp - 0xc], 0x29b85755
mov dword [ebp - 4], 0xfffffff9
mov dword [ebp - 0x14], 0x7d02268f
mov dword [ebp - 0x10], edx
jmp 0x10018c4a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x198], 0xffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10018c39
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, 0xb0b4
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, eax
push 3
setne dl
xor ecx, ecx
pop eax
add edx, eax
mov eax, dword [ebp - 0x20]
cmp edx, eax
mov eax, dword [ebp - 0x28]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x5b2906c9
setl dl
sub ecx, eax
cmp ecx, edx
jne 0x10018c93
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
push 3
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0xc], ecx
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
cmp eax, esi
setge cl
xor edx, edx
add ecx, dword [ebp - 0x14]
je 0x10018d58
push 3
mov dword [ebp - 0x28], 0x37b30477
mov dword [ebp - 0x10], edx
pop ecx
jmp 0x10018cec
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x128], 0xb137d370
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10018cdb
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x14]
dec eax
dec dword [ebp - 0x128]
add ecx, eax
mov eax, dword [ebp - 0x28]
mov ecx, esi
cmove ecx, edx
imul eax, ecx
cmp eax, 0xfffffffb
jne 0x10018d1d
mov eax, esi
cmp dword [ebp - 0x120], edx
jne 0x10018d1f
mov eax, edx
mov ecx, dword [ebp - 0x20]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x28]
setg cl
xor edx, edx
cmp ecx, eax
setg dl
xor ecx, ecx
imul edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0xc], ecx
jmp 0x10018dc0
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x10], edx
jmp 0x10018d71
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd4], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10018d60
cmp dword [ebp - 0x28], edx
jne 0x10018daa
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 4]
neg eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
test eax, eax
mov eax, dword [ebp - 0x14]
sets dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
imul ecx, dword [ebp - 4]
mov eax, edx
test ecx, ecx
je 0x10018dac
mov eax, esi
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edx
jne 0x10018db7
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xd4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 4], 0xc9ff7503
push 2
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0xc], edx
pop ecx
jmp 0x10018dee
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xa8], 0x1020
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x10018ddd
mov dword [ebp - 0xc], edx
jmp 0x10018e09
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc0], 0x9b8bc588
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x10018df8
mov dword [ebp - 0xc], edx
jmp 0x10018e24
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc8], 0xfffffff8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x10018e13
cmp dword [ebp - 0xa8], edx
je 0x10018e6c
mov dword [ebp - 0x14], 0xc29000d4
mov dword [ebp - 0x14], 0xffffffe5
jmp 0x10018e55
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0x14], edx
jne 0x10018e5b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffb
jge 0x10018e41
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xbc], eax
jmp 0x100190b9
push 3
mov dword [ebp - 0x18], 0x2bf35dd7
mov dword [ebp - 0xc], edx
pop ecx
jmp 0x10018e8c
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x11c], 0xd7d2a7e9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x10018e7b
mov dword [ebp - 0xc], edx
jmp 0x10018ea7
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x110], 8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x10018e96
mov dword [ebp - 0xc], edx
jmp 0x10018ec2
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x8c], 0xfff7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x10018eb1
cmp dword [ebp - 4], edx
jne 0x10018f16
mov ecx, dword [ebp - 0x110]
mov eax, dword [ebp - 4]
inc dword [ebp - 0x110]
cmp eax, ecx
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x118]
cmovle esi, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xa8]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp esi, ecx
sete dl
xor esi, esi
add eax, edx
jne 0x10018f15
xor edx, edx
inc esi
jmp 0x10018f18
inc esi
mov edx, esi
inc dword [ebp - 0xc4]
xor ecx, ecx
mov eax, dword [ebp - 0xc4]
cmp eax, edx
mov eax, dword [ebp - 0x118]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x8c]
mov ecx, 0xd0b182bc
setge dl
imul eax, edx
push 8
add eax, 0x69be5411
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x88]
add ecx, 0xffff787d
cmp ecx, eax
pop eax
setg dl
cmp eax, edx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x20]
setl cl
add eax, ecx
cmp eax, dword [ebp - 0x20]
jl 0x100190ad
xor edx, edx
mov dword [ebp - 0x20], edx
jmp 0x100190a2
mov dword [ebp - 0x2c], 0x66
mov dword [ebp - 0x10], edx
jmp 0x10018fc8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x298], 0x1960cc19
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10018fb7
mov dword [ebp - 4], edx
jmp 0x10019096
push 3
mov dword [ebp - 0x10], edx
pop ecx
jmp 0x10018fef
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x230], 0x408cdc70
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10018fde
cmp dword [ebp - 4], edx
je 0x10019035
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0xa8]
sub ecx, eax
mov eax, dword [ebp - 4]
neg ecx
sbb ecx, ecx
mov eax, dword [ebp + eax*4 - 0x88]
inc ecx
add eax, ecx
mov ecx, dword [ebp - 0x290]
sub ecx, eax
mov eax, dword [ebp - 4]
neg ecx
sbb ecx, ecx
mov eax, dword [ebp + eax*4 - 0x88]
inc ecx
sub ecx, eax
mov ecx, esi
jne 0x10019037
mov ecx, edx
mov eax, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x88]
cmp ecx, eax
mov eax, dword [ebp - 4]
setne dl
xor ecx, ecx
add edx, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x88]
cmp edx, eax
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
mov dword [ebp + eax*4 - 0xc0], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edx
je 0x1001908b
mov eax, esi
cmp dword [ebp - 0x22c], edx
jne 0x1001908d
mov eax, edx
mov dword [ebp - 0x114], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jle 0x10018fd6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x10018fab
jmp 0x100190b9
mov dword [ebp - 0x18], 0xf054f525
dec dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x100191f7
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0xeb987642
mov dword [ebp - 0x10], edx
jmp 0x100190e1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x98], 0xe91a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100190d0
mov dword [ebp - 4], edx
jmp 0x100191bc
mov dword [ebp - 0x10], edx
jmp 0x10019101
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x30], 0x84b81147
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100190f3
mov dword [ebp - 0x30], edx
jmp 0x10019195
mov dword [ebp - 0x20], 0x9978f3c
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], edx
jl 0x1001917f
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x98]
test eax, eax
setns cl
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp + eax*4 - 0x98]
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
imul eax, eax, 7
cmp eax, edx
setle cl
xor eax, eax
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x20]
jns 0x10019124
xor edx, edx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10019192
push edx
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor edx, edx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edx
jle 0x1001910e
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], edx
jl 0x100191b9
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x100191b4
push edx
call ebx
xor edx, edx
dec dword [ebp - 0x10]
jns 0x100191a6
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jle 0x100190ee
mov dword [ebp - 4], edx
cmp dword [ebp - 4], edx
jl 0x100191ea
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x100191e5
mov dword [ebp - 0x18], 0xf09a2b44
dec dword [ebp - 0x18]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x100190c1
dec dword [ebp - 0x24]
jns 0x10018c0e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xd
jge 0x100188b0
mov dword [ebp - 0x1c], 0x13638ecf
mov eax, 0xdcda7209
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 4], edx
jmp 0x10019250
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xa0], 0x342eb90d
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001923f
push 3
mov dword [ebp - 4], edx
pop ecx
jmp 0x1001926f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x20c], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x1001925e
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], edx
jl 0x10019347
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], 0x2ff18c9a
mov dword [ebp - 0xc], edx
jmp 0x10019332
mov dword [ebp - 4], 0x1a9565e0
mov dword [ebp - 4], edx
jmp 0x100192b3
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0xa0], edx
jne 0x100192b8
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jle 0x100192a4
mov dword [ebp - 4], esi
cmp dword [ebp - 4], edx
jl 0x1001932f
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0xa0], edx
je 0x100192ea
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0xa0]
mov dword [ebp - 0x204], 0xfffffff9
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0xa0]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x17c], eax
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x1001932a
push 0xe65
push edx
call edi
xor edx, edx
dec dword [ebp - 4]
jns 0x100192c0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jle 0x10019298
dec dword [ebp - 0x1c]
jns 0x10019286
push 3
pop ecx
mov ebx, dword [sym.imp.USER32.dll_EnableScrollBar]
mov dword [ebp - 0x14], 0xfffffff6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0xffffffef
jmp 0x100193c8
mov dword [ebp - 4], edx
jmp 0x10019379
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x2b4], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x10019368
mov dword [ebp - 4], edx
jmp 0x10019392
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x4c], 0xcb03629a
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x10019384
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x4c], edx
jl 0x100193c5
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x100193bd
push 0x2c8
push 0x2366
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
xor edx, edx
dec dword [ebp - 0x4c]
jns 0x1001939f
push 3
pop ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1c
jne 0x10019363
mov dword [ebp - 0xc], esi
mov eax, 0x7736eae1
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x18], 0x553a81f6
cmp dword [ebp - 0xc], edx
je 0x10019400
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x9b37d02
jl 0x10019456
push 2
mov dword [ebp - 0x1c], edx
pop ecx
jmp 0x10019431
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x194], 0xc4df8e3b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10019420
mov dword [ebp - 0xc], edx
jmp 0x1001944c
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x194], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001943b
jmp 0x10019521
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edx
jmp 0x10019487
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x34], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10019479
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
sub ecx, eax
cmp ecx, esi
je 0x100194a5
cmp dword [ebp - 0x34], edx
jne 0x100194a5
mov esi, edx
mov edx, dword [ebp - 0x34]
xor ecx, ecx
mov dword [ebp - 0xf8], edx
mov eax, dword [ebp - 0xc]
cmp esi, eax
setle cl
xor eax, eax
cmp ecx, 3
setne al
xor ecx, ecx
add eax, dword [ebp - 0xc]
xor esi, esi
mov dword [ebp - 0xc], eax
inc esi
mov eax, dword [ebp - 0xc]
cmp eax, esi
mov dword [ebp - 0x138], eax
setle cl
imul ecx, edx
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, 0xffff
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0xf8]
mov eax, dword [ebp - 0x34]
sub ecx, eax
mov dword [ebp - 0xf8], ecx
mov eax, dword [ebp - 0x138]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0xfffc
sbb eax, eax
neg eax
xor edx, edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10019539
push 0x135b
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor edx, edx
mov dword [ebp - 0x10], 0x13638ecf
mov dword [ebp - 0x18], 0xdcec3d7d
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10019559
push edx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor edx, edx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10019570
push edx
push 0x2442
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
xor edx, edx
mov eax, 0xdcda7209
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x10], 0xffffffef
cmp dword [ebp - 0x10], 9
push 2
pop ecx
jl 0x100196ba
push 3
pop eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], edx
jmp 0x100195c3
mov eax, dword [ebp - 0x1c]
push 3
mov dword [ebp + eax*4 - 0x18c], 0xffffffff
inc dword [ebp - 0x1c]
pop eax
cmp dword [ebp - 0x1c], eax
jl 0x100195af
mov dword [ebp - 0xc], edx
jmp 0x10019686
mov dword [ebp - 4], edx
jmp 0x100195e2
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xf4], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x100195d5
push 3
mov dword [ebp - 4], edx
pop eax
cmp dword [ebp - 4], eax
jge 0x1001960d
push eax
pop edx
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe0], 0x44accb24
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x100195f5
xor edx, edx
mov dword [ebp - 0xe8], edx
jmp 0x1001963e
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x1c], edx
jmp 0x10019633
mov eax, dword [ebp - 0xe8]
cmp dword [ebp + eax*4 - 0x18c], edx
jne 0x10019638
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x10019621
inc dword [ebp - 0xe8]
cmp dword [ebp - 0xe8], ecx
jle 0x10019615
push 3
pop eax
mov dword [ebp - 0xd8], edx
cmp dword [ebp - 0xd8], eax
jg 0x10019683
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10019672
push edx
push 0x1348
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 3
xor edx, edx
pop eax
inc dword [ebp - 0xd8]
cmp dword [ebp - 0xd8], eax
jle 0x10019657
push 2
pop ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jle 0x100195d0
mov dword [ebp - 0xc], edx
jmp 0x100196a8
mov eax, dword [ebp - 0xc]
push 3
mov dword [ebp + eax*4 - 0x18c], 0xffffffff
inc dword [ebp - 0xc]
pop eax
cmp dword [ebp - 0xc], eax
jl 0x10019694
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 9
jge 0x100195a7
mov dword [ebp - 4], edx
jmp 0x100196cd
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x78], 0x342eb90d
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x100196bf
mov dword [ebp - 0x2c], 0xfaf425f5
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x24], 0x1480146
mov dword [ebp - 4], edx
jmp 0x100196fd
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x70], 0x57fd5464
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x100196ef
mov dword [ebp - 4], edx
jmp 0x10019718
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x148], 0x5457d670
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10019707
mov dword [ebp - 0x70], edx
jmp 0x1001979a
mov dword [ebp - 0x24], 0xfec1b16e
mov dword [ebp - 0x1c], edx
jmp 0x1001973f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x154], 8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1001972e
mov eax, dword [ebp - 0x14c]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x18], edx
jne 0x10019759
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x2c], edx
jne 0x10019769
cmp dword [ebp - 0x14c], edx
je 0x1001976b
mov edx, esi
mov eax, dword [ebp - 0x70]
inc edx
imul edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x150]
cmp edx, eax
mov eax, dword [ebp - 0x144]
setge cl
xor edx, edx
sub eax, ecx
je 0x10019792
mov eax, esi
cmp dword [ebp - 0x24], edx
jne 0x10019794
mov eax, edx
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0xfffffff6
push 3
pop ecx
je 0x10019722
mov dword [ebp - 4], edx
jmp 0x100197bd
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1f4], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x100197ac
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], edx
jl 0x1001991d
mov dword [ebp - 0x20], 0x2364
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x24], 0xae9a07b3
mov dword [ebp - 0x18], 0xacd4a797
mov dword [ebp - 0x18], 0xb370cc32
mov dword [ebp - 0x1c], edx
jmp 0x1001980e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x200], 0xc9fe9a5a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100197fd
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x20]
jle 0x10019846
cmp dword [ebp - 0x28], edx
je 0x10019846
mov edx, esi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0x2d67
setle cl
xor eax, eax
cmp edx, 0xffffffff
setg al
sub ecx, eax
dec ecx
mov dword [ebp - 0x1f8], ecx
mov eax, dword [ebp - 0x14]
sub eax, ecx
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], 0x2ff18c9a
mov dword [ebp - 0xc], edx
jmp 0x10019908
mov dword [ebp - 4], 0x1a9565e0
mov dword [ebp - 4], edx
jmp 0x1001989b
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x78], edx
jne 0x100198a0
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jle 0x1001988f
mov dword [ebp - 4], esi
cmp dword [ebp - 4], edx
jl 0x10019905
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x78], edx
je 0x100198c6
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x78]
mov dword [ebp - 0x1ec], 0xfffffff9
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x16c], eax
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10019900
push 0xe65
push edx
call edi
xor edx, edx
dec dword [ebp - 4]
jns 0x100198a8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jle 0x10019883
dec dword [ebp - 0x10]
push 3
pop ecx
jns 0x100197ce
mov dword [ebp - 0x14], 0xe0cf
or eax, 0xffffffff
mov dword [ebp - 0x60], eax
mov edi, 0x7a429adb
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0xa79cc099
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x14]
mov dword [ebp - 0x14], edx
jmp 0x100199a7
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x18], 0x5cc48b16
mov dword [ebp - 0x24], 0x5da2
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x1c], edx
jmp 0x10019986
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x224], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10019979
dec dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x220]
cmp eax, esi
push 3
setl cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x14]
pop ecx
cmp dword [ebp - 0x14], 0x19
jne 0x10019950
mov dword [ebp - 0x14], 0xfffffff6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0xffffffef
cmp dword [ebp - 0x14], 0x1c
je 0x10019a37
push 3
pop edi
mov dword [ebp - 4], edx
jmp 0x100199e0
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x2c4], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x100199cf
mov dword [ebp - 4], edx
jmp 0x100199f9
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x50], 0xcb03629a
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x100199eb
mov dword [ebp - 0x50], edi
cmp dword [ebp - 0x50], edx
jl 0x10019a29
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10019a24
push 0x2c8
push 0x2366
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
xor edx, edx
dec dword [ebp - 0x50]
jns 0x10019a06
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1c
jne 0x100199ca
mov edi, 0x7a429adb
mov dword [ebp - 4], edx
jmp 0x10019a49
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1a4], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x10019a3c
mov dword [ebp - 0x14], 0xe0cf
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], 0xa79cc099
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
inc dword [ebp - 0x14]
mov dword [ebp - 0x14], edx
jmp 0x10019aec
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x18], 0x5cc48b16
mov dword [ebp - 0x24], 0x5da2
push 3
pop ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x1c], edx
jmp 0x10019ace
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1dc], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10019ac1
dec dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1d8]
cmp eax, esi
setl cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x19
jne 0x10019a95
push 2
mov dword [ebp - 0x1c], 5
mov dword [ebp - 4], edx
pop ebx
jmp 0x10019b12
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x238], 0xffff
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x10019b01
mov dword [ebp - 4], edx
mov edi, 0x6a48
jmp 0x10019b2e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1c4], edi
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x10019b21
mov dword [ebp - 0x1c], edx
jmp 0x10019b49
mov dword [ebp - 0x18], 0xffffffff
inc dword [ebp - 0x1c0]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x10019b39
mov dword [ebp - 4], edx
jmp 0x10019b64
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x268], 0xf680299
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x10019b53
mov dword [ebp - 0x28], 0xfffffffb
jmp 0x10019f91
mov dword [ebp - 0x24], 0xc0d37ad4
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 5
mov dword [ebp - 4], edx
jmp 0x10019b9c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x288], 0xffff
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x10019b8b
mov dword [ebp - 4], edx
jmp 0x10019bb3
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1b4], edi
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x10019ba6
mov dword [ebp - 0x1c], edx
jmp 0x10019bce
mov dword [ebp - 0x18], 0xffffffff
inc dword [ebp - 0x1b0]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x10019bbe
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], edx
jl 0x10019f8e
mov dword [ebp - 0xd0], edx
mov dword [ebp - 0xc], 0x97f6af11
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 4], edx
jmp 0x10019c13
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xd
jge 0x10019b75
mov eax, dword [ebp - 0xcc]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [ebp - 0xe4]
mov edi, edx
mov esi, eax
call fcn.10018385
add eax, esi
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret