Function at 0x10019cf3
Capabilities:
Create pipe
Delete registry key
Query environment variable
Set environment variable

Disassembly:
mov eax, 0x10062a34
call fcn.10061f70
sub esp, 0x310
push ebx
mov dword [ebp - 0x18], 0x3606de71
xor ebx, ebx
push esi
mov dword [ebp - 0x28], 0xa306
push edi
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xe4], edx
mov dword [ebp - 0xc8], ecx
mov dword [ebp - 0x1dc], ebx
mov dword [ebp - 0x18], ebx
jmp 0x10019d45
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x50], 0xae355683
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10019d37
push 3
mov dword [ebp - 0x18], ebx
pop ecx
jmp 0x10019d64
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x128], 0xc71bc7dc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10019d53
mov dword [ebp - 0x18], ebx
jmp 0x10019d7f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x25c], 0x2e71cc54
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10019d6e
mov dword [ebp - 0x18], ebx
mov edi, 0xffff
cmp dword [ebp - 0x18], 1
jg 0x10019fde
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x3c], 0xd2a4
mov dword [ebp - 0x44], 0xf0c8c580
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x44], 0x54b0
cmp dword [ebp - 0x44], 0x583f
jle 0x10019e51
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov eax, edi
mov dword [ebp - 0x30], 0x7336
cdq
idiv esi
mov eax, edx
mov dword [ebp - 0x34], eax
mov edi, eax
mov esi, 0x293b
mov eax, edi
lea ecx, [ebp - 0x304]
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10019e01
mov eax, dword [eax]
push eax
call fcn.1004b2d6
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x304]
call fcn.10001f3a
dec edi
dec esi
jne 0x10019de7
mov eax, dword [ebp - 0x34]
dec eax
dec dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
jne 0x10019de0
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x7e66
jl 0x10019dcf
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x450
jl 0x10019dca
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov edi, 0xffff
mov dword [ebp - 0x1c], ebx
jmp 0x10019e67
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a8], 1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10019e56
cmp dword [ebp - 0x44], 0x52fe
jge 0x10019e81
push str.ixxgcqb_dis_tkscc_mqhsaih
call fcn.1004b2d6
pop ecx
or dword [ebp - 4], 0xffffffff
mov edx, edi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x50]
sub edx, eax
mov eax, dword [ebp - 0x50]
imul edx, eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x50]
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0x4c]
test ecx, ecx
jne 0x10019ec9
cmp dword [ebp - 0x50], ebx
jne 0x10019ec9
mov edx, ebx
jmp 0x10019ecc
xor edx, edx
inc edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov esi, dword [ebp + eax*4 - 0x50]
mov dword [ebp - 0x124], esi
mov eax, dword [ebp - 0x4c]
sub edx, eax
mov eax, dword [ebp - 0x28]
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x7747
setne al
xor edx, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
sub edx, dword [ebp + eax*4 - 0x50]
xor eax, eax
cmp esi, edx
setle al
sub eax, dword [ebp - 0x24]
jne 0x10019f1f
cmp dword [ebp - 0x18], ebx
jne 0x10019f1f
mov eax, ebx
jmp 0x10019f22
xor eax, eax
inc eax
mov dword [ebp - 0x258], eax
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setl dl
xor ecx, ecx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
mov dword [ebp + eax*4 - 0x50], ecx
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x50], ebx
je 0x10019f7c
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x19c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setge dl
cmp edx, dword [ebp - 0x19c]
jge 0x10019f7c
xor ecx, ecx
inc ecx
jmp 0x10019f7e
mov ecx, ebx
mov eax, dword [ebp - 0x18]
push 3
mov edx, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x19c]
imul eax, ecx
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x1a8], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x128]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x28]
cmp edx, eax
setl cl
cmp ecx, 0xefecf47a
pop ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x18]
jmp 0x10019d8c
mov dword [ebp - 0x3c], 0x3714
cmp dword [ebp - 0x3c], 0x39f3
jle 0x1001a020
mov esi, ebx
mov edi, ebx
mov eax, esi
mov ecx, 0x1007d9f8
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001bd6
inc edi
cmp edi, 0x262f
jl 0x10019ff2
inc esi
cmp esi, 0x2a96
jl 0x10019ff0
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x3c], 0x363d
jge 0x1001a03f
mov edx, str.feexroje_rsvkhbbbq_pudtejzj_iussdmzjs_ahtc_ctkh_utrvqr_gjsdm_eydvcnagm_nwvv_rarg_ert_topb_eycfnnfr
mov ecx, 0x1007d9f8
call fcn.1000358d
or dword [ebp - 4], 0xffffffff
mov esi, 0xfff7
mov dword [ebp - 0x188], esi
mov dword [ebp - 0x184], esi
mov dword [ebp - 0x180], esi
mov dword [ebp - 0x17c], esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x18], 0x923607a9
mov dword [ebp - 0x40], 0x4a20a298
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x1c], 0x3dda37bb
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x54], 0xab4456e3
mov dword [ebp - 0x3c], 0xea311c3f
mov dword [ebp - 0x18], ebx
jmp 0x1001a0d3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe8], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1001a0c2
mov dword [ebp - 0x18], ebx
jmp 0x1001a0ef
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2b0], 0x9683648b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001a0de
mov dword [ebp - 0x30], 3
cmp dword [ebp - 0x30], ebx
jl 0x1001a292
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x1001a122
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x268], 0xd00693e9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1001a111
dec dword [ebp - 0x3c]
mov dword [ebp - 0x34], 0x4c62
cmp dword [ebp - 0x34], 0x4ebf
jle 0x1001a1a0
push 0x3af
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, ebx
mov esi, ebx
mov eax, ebx
mov dword [ebp - 0x44], ebx
lea ecx, [eax + esi]
mov eax, edi
sar eax, cl
mov ecx, 0x1007d9f8
cdq
push edx
push eax
call fcn.10001bd6
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp eax, 0x47fd
jl 0x1001a151
inc esi
cmp esi, 0x2590
jl 0x1001a14c
inc edi
cmp edi, 0x63de
jl 0x1001a14a
push 0x6d5
push 0x1e2f
push 0x1aed
push 0x2133
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x18], ebx
jmp 0x1001a23c
mov dword [ebp - 0x24], 0x75cf
mov dword [ebp - 0x20], ebx
jmp 0x1001a1df
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0x18]
add edx, dword [ebp + eax*4 - 0x188]
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x20]
setle cl
mov dword [ebp + eax*4 - 0x268], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x1001a1b4
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x1001a239
mov dword [ebp - 0x28], 0xb8319b88
xor ebx, ebx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setle bl
sub ebx, dword [ebp - 0x38]
neg ebx
sbb ebx, ebx
inc ebx
add ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor edx, edx
inc eax
add eax, dword [ebp - 0x28]
cmp eax, ebx
setg dl
xor ecx, ecx
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
cmp edx, eax
setg cl
mov dword [ebp - 0x20], ecx
dec dword [ebp - 0x1c]
jns 0x1001a1ed
xor ebx, ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1001a1a8
mov dword [ebp - 4], 4
cmp dword [ebp - 0x34], 0x4b8a
jge 0x1001a264
mov edx, str.mhvkvuxa_yeo_zgnqiyw
mov ecx, 0x1007d9f8
call fcn.1000358d
or dword [ebp - 4], 0xffffffff
dec dword [ebp - 0x30]
jmp 0x1001a0fc
mov dword [ebp - 0x84], 0x2b035600
mov dword [ebp - 0x80], 0x2802e9d4
mov dword [ebp - 0x7c], 0x30053306
mov dword [ebp - 0x78], 0x3040e03
mov word [ebp - 0x74], 0xd01
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x18], 0x979cd329
push 0xfffffffffffffffe
mov dword [ebp - 0x20], 6
pop esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x1c], ebx
jmp 0x1001a2e7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1e8], 0xa2b82c44
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1001a2d6
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], ebx
jmp 0x1001a3c3
mov dword [ebp - 0x54], 0x1b07fb07
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x38], 0x5dd4d14b
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x30], 2
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x1001a33e
push ebx
push 0x178f
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x18], ebx
jmp 0x1001a3ba
mov dword [ebp - 0x24], 0x3526c715
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], 0xf4dad240
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x1e8], ebx
jne 0x1001a385
dec dword [ebp - 0x30]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setg cl
sub eax, ecx
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x34], 0x29adbd3d
jge 0x1001a39a
cmp dword [ebp - 0x44], ebx
jne 0x1001a39a
mov ecx, ebx
jmp 0x1001a39d
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
sete dl
xor ecx, ecx
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setg cl
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jle 0x1001a343
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jle 0x1001a305
push 0x47
pop eax
mov word [ebp - 0x144], ax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], 0xaa08ecb3
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
inc eax
je 0x1001a438
mov dword [ebp - 0x54], 0x51f1e283
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x1001a430
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 2
pop edi
jmp 0x1001a4bf
mov dword [ebp - 0x3c], 0xbc98072f
mov dword [ebp - 0x1c], ebx
jmp 0x1001a455
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc0], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1001a444
mov eax, dword [ebp - 0xc0]
xor edx, edx
mov ecx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
cmp ecx, eax
push 2
setle dl
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
dec ecx
neg ecx
pop edi
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp ecx, eax
setg bl
sub ebx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x3c]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
setne dl
xor ecx, ecx
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc0]
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, edi
setl al
xor ebx, ebx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0x17
jle 0x1001a5dc
mov dword [ebp - 0x20], ebx
jmp 0x1001a4e2
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x280], 1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1001a4d1
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x1001a5d4
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], ebx
jl 0x1001a51a
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], ebx
jl 0x1001a515
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x280], ebx
jne 0x1001a515
dec dword [ebp - 0x20]
jns 0x1001a504
dec dword [ebp - 0x28]
jns 0x1001a4fc
mov dword [ebp - 0x44], 0x2001
cmp dword [ebp - 0x44], 0x22f9
jle 0x1001a56d
mov eax, ebx
mov dword [ebp - 0x30], ebx
mov esi, ebx
mov ecx, ebx
mov dword [ebp - 0x3c], ebx
add eax, esi
xor eax, ecx
mov ecx, 0x1007d9f8
cdq
push edx
push eax
call fcn.10001bd6
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
inc ecx
mov dword [ebp - 0x3c], ecx
cmp ecx, 0x6b35
jl 0x1001a536
inc esi
cmp esi, 0x7a6d
jl 0x1001a531
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x7616
jl 0x1001a52f
mov byte [ebp - 0x29], bl
mov dword [ebp - 4], 6
cmp dword [ebp - 0x44], 0x1fc6
jge 0x1001a58f
mov edx, str.vulzcqa_ejbkrb_xytagqj_rqnx_mrl
mov ecx, 0x1007d9f8
call fcn.1000358d
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x29], 0
je 0x1001a5a7
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
dec dword [ebp - 0x18]
jmp 0x1001a4eb
inc dword [ebp - 0x1c]
jmp 0x1001a4c2
movzx eax, byte [ebp - 0x84]
mov ecx, edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], ebx
lea esi, [eax*2 + 2]
mov dword [ebp - 0x38], esi
jmp 0x1001a5fa
mov esi, dword [ebp - 0x38]
push 6
pop eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x1c], 0xf34fda0e
mov dword [ebp - 0x48], 0x59f451db
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0xd4], 0xfffffffc
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x28], ebx
jmp 0x1001a650
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x134], 0x5bc98072
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1001a63f
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 3
jg 0x1001a847
mov esi, 0xffff
mov dword [ebp - 0x20], 0x6942a1e9
mov dword [ebp - 0xc4], 0x9a54e587
mov dword [ebp - 0x34], 0xef23e469
mov dword [ebp - 0xac], 0x42b4
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x28], ebx
jmp 0x1001a6a7
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x88], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 1
jl 0x1001a696
mov dword [ebp - 0x20], ebx
jmp 0x1001a7fa
mov dword [ebp - 0xe0], 4
mov dword [ebp - 0x3c], 0xb7c39c9d
mov dword [ebp - 0x54], 8
mov dword [ebp - 0x28], 0xefe0c237
mov dword [ebp - 0x1c8], 0x28e
mov dword [ebp - 0x1c4], 0x28e
mov dword [ebp - 0x1c0], 0x28e
mov dword [ebp - 0x1bc], 0x28e
mov dword [ebp - 0x28], ebx
jmp 0x1001a712
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xb0], 0x9909d073
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 1
jl 0x1001a701
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xfc], ebx
jne 0x1001a76d
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xfc]
dec dword [ebp - 0x30]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x88]
cmp eax, ecx
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
sub eax, edx
add eax, dword [ebp - 0xe0]
cmp eax, 0x7d266845
setle cl
xor eax, eax
cmp ecx, 0xb0969e0c
setne al
cmp eax, edi
jae 0x1001a76d
cmp dword [ebp - 0xb0], ebx
je 0x1001a77a
cmp dword [ebp - 0xd4], ebx
je 0x1001a77a
xor edx, edx
inc edx
jmp 0x1001a77c
mov edx, ebx
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x1c0], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xc4]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x88]
jne 0x1001a7b0
cmp dword [ebp - 0xac], ebx
jne 0x1001a7b0
mov eax, ebx
jmp 0x1001a7b3
xor eax, eax
inc eax
mov dword [ebp - 0x88], eax
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x134]
mov edx, dword [ebp - 0xb0]
sub edx, eax
mov eax, dword [ebp - 0xf8]
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x729c
setne al
mov dword [ebp - 0x130], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x1001a6b5
mov eax, dword [ebp - 0x134]
xor edx, edx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
cmp esi, edx
sbb eax, eax
inc eax
mov dword [ebp - 0x88], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x1001a668
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x38]
cmp ecx, esi
jne 0x1001a9cc
mov eax, 0xfff7
xor esi, esi
mov dword [ebp - 0x198], eax
inc esi
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], 0x923607a9
mov dword [ebp - 0x40], 0x4a20a298
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x18], 0x3dda37bb
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x48], 0xab4456e3
mov dword [ebp - 0x3c], 0xea311c3f
mov dword [ebp - 0x18], ebx
jmp 0x1001a8b0
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd8], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001a8a3
mov dword [ebp - 0x18], ebx
jmp 0x1001a8cb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2c8], 0x9683648b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1001a8ba
mov dword [ebp - 0x34], 3
cmp dword [ebp - 0x34], ebx
jl 0x1001a9b6
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x28], ebx
jmp 0x1001a8fd
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x298], 0xd00693e9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1001a8ec
dec dword [ebp - 0x3c]
mov dword [ebp - 0x20], ebx
jmp 0x1001a9a1
mov dword [ebp - 0x30], 0x75cf
mov dword [ebp - 0x1c], ebx
jmp 0x1001a945
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0xd8]
mov eax, dword [ebp - 0x20]
add edx, dword [ebp + eax*4 - 0x198]
mov eax, dword [ebp - 0x30]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle cl
mov dword [ebp + eax*4 - 0x298], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x1001a91a
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1001a99e
mov dword [ebp - 0x28], 0xb8319b88
xor ebx, ebx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setle bl
sub ebx, dword [ebp - 0x40]
neg ebx
sbb ebx, ebx
inc ebx
add ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
xor edx, edx
inc eax
add eax, dword [ebp - 0x28]
cmp eax, ebx
setg dl
xor ecx, ecx
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x48]
cmp edx, eax
setg cl
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 0x18]
jns 0x1001a952
xor ebx, ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1001a90e
dec dword [ebp - 0x34]
jns 0x1001a8e0
mov ecx, dword [ebp - 0x24]
movzx eax, byte [ebp + ecx - 0x84]
dec ecx
add ecx, eax
lea edx, [eax + 1]
mov dword [ebp - 0x18], edx
jmp 0x1001aa5c
xor esi, esi
inc esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x48], 0x1ca2961c
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x28], ebx
jmp 0x1001aa00
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x2ec], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1001a9ef
mov dword [ebp - 0x28], ebx
jmp 0x1001aa13
cmp dword [ebp - 0x40], ebx
jne 0x1001aa19
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xc
jl 0x1001aa0b
inc dword [ebp - 0x3c]
mov eax, ecx
sub eax, dword [ebp - 0x18]
movzx edx, byte [ebp + ecx - 0x83]
mov dword [ebp - 0x18], ebx
movzx eax, byte [ebp + eax - 0x86]
movzx ecx, word [ebp + eax*2 - 0x144]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
mov eax, dword [ebp - 0x24]
add ecx, edx
movzx eax, byte [ebp + eax - 0x84]
mov word [ebp + eax*2 - 0x144], cx
mov ecx, dword [ebp - 0x24]
add ecx, edi
mov dword [ebp - 0x24], ecx
cmp ecx, 0x12
jb 0x1001a5f7
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x18], 0x417be18
mov dword [ebp - 0x18], ebx
jmp 0x1001aa8a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2c0], 0xe45d764c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1001aa79
mov dword [ebp - 0x18], ebx
jmp 0x1001aaa2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1e0], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001aa95
mov dword [ebp - 0x18], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x38], eax
jge 0x1001aad5
cmp dword [ebp - 0x38], ebx
je 0x1001aad5
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x1001abe1
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetRgnBox]
jmp 0x1001abe1
mov dword [ebp - 0x20], 0xffff
mov dword [ebp - 0xac], 0xbed162c5
mov dword [ebp - 0x40], 0xa0cd95f
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x38], 0xee72c34c
mov dword [ebp - 0x64], 0xc9fe9a5a
mov dword [ebp - 0x30], 0x45ad33d2
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], ebx
jmp 0x1001ab22
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x28c], 0xfffffff7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1001ab11
mov dword [ebp - 0x18], ebx
jmp 0x1001ab3d
mov dword [ebp - 0x40], 0xfffd
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff8
jle 0x1001ab2d
mov dword [ebp - 0x20], ebx
jmp 0x1001abd7
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x48], 0x98b94be3
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0xc4], 0x70cc321a
cmp dword [ebp - 0x40], ebx
je 0x1001aba2
mov eax, dword [ebp - 0x20]
dec dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setg dl
neg eax
sbb eax, eax
inc eax
add edx, eax
add edx, dword [ebp - 0x30]
mov edx, esi
jne 0x1001aba4
mov edx, ebx
mov eax, dword [ebp - 0x284]
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x64]
setge cl
imul edx, dword [ebp - 0x18]
imul edx, ecx
xor ecx, ecx
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xac]
cmp edx, eax
setle cl
mov dword [ebp - 0x2c0], ecx
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x23
jl 0x1001ab4b
xor eax, eax
mov word [ebp - 0x136], ax
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x1c], 0x5a1fa147
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x38], 0x894628ae
mov dword [ebp - 0x40], 0xcceb8a06
mov dword [ebp - 0x18], ebx
jmp 0x1001ac2d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1f4], 0x96673e7e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001ac1c
mov dword [ebp - 0x18], ebx
jmp 0x1001ac46
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x58], 0x18158fb5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001ac38
mov dword [ebp - 0x18], ebx
jmp 0x1001ac61
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2d8], 0x86de1f17
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1001ac50
cmp dword [ebp - 0x34], ebx
je 0x1001ad15
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x34]
cmp eax, 6
mov eax, dword [ebp - 0x58]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x1f0], eax
jl 0x1001aca0
mov eax, esi
cmp dword [ebp - 0x24], ebx
jne 0x1001aca2
mov eax, ebx
mov dword [ebp - 0x34], eax
xor ecx, ecx
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x1f4], edx
mov eax, dword [ebp - 0x58]
cmp edx, eax
mov eax, dword [ebp - 0x58]
setg cl
xor edx, edx
add ecx, 0x4356e3f0
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x58]
add ecx, 0x4bf7d69f
cmp ecx, eax
setne dl
xor ecx, ecx
mov dword [ebp - 0x2d0], edx
mov dword [ebp - 0x38], edx
mov edx, esi
mov eax, dword [ebp - 0x38]
inc dword [ebp - 0x28]
mov dword [ebp - 0x1c], 0xb597
mov eax, dword [ebp - 0x1c]
cmp eax, 0x8459
setl cl
imul ecx, dword [ebp - 0x28]
neg ecx
jne 0x1001ad17
mov edx, ebx
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x58]
jg 0x1001ad2d
mov ecx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x1001ad2f
mov ecx, esi
xor eax, eax
mov dword [ebp - 0x200], 7
cmp ecx, 0xd983
mov dword [ebp - 0x204], ebx
lea ecx, [ebp - 0x214]
setne al
mov dword [ebp - 0x40], eax
xor eax, eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x144]
push eax
call fcn.1001bafd
mov dword [ebp - 4], 8
mov eax, 0xfff7
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], 0x923607a9
mov dword [ebp - 0x40], 0x4a20a298
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x24], 0x3dda37bb
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x48], 0xab4456e3
mov dword [ebp - 0x38], 0xea311c3f
mov dword [ebp - 0x18], ebx
jmp 0x1001adcd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdc], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001adc0
mov dword [ebp - 0x18], ebx
jmp 0x1001ade8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2e0], 0x9683648b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1001add7
push 3
pop ecx
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], ebx
jl 0x1001aed5
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x24], ebx
jmp 0x1001ae19
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x274], 0xd00693e9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1001ae08
dec dword [ebp - 0x38]
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jg 0x1001aecc
mov dword [ebp - 0x34], 0x75cf
mov dword [ebp - 0x1c], ebx
jmp 0x1001ae64
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0xdc]
mov eax, dword [ebp - 0x20]
add edx, dword [ebp + eax*4 - 0x1b8]
mov eax, dword [ebp - 0x34]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle cl
mov dword [ebp + eax*4 - 0x274], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x1001ae39
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], ebx
jl 0x1001aebd
mov dword [ebp - 0x30], 0xb8319b88
xor ebx, ebx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setle bl
sub ebx, dword [ebp - 0x40]
neg ebx
sbb ebx, ebx
inc ebx
add ebx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
xor edx, edx
inc eax
add eax, dword [ebp - 0x30]
cmp eax, ebx
setg dl
xor ecx, ecx
imul edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x48]
cmp edx, eax
setg cl
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 0x24]
jns 0x1001ae71
xor ebx, ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1001ae2d
push 3
pop ecx
dec dword [ebp - 0x28]
jns 0x1001adfc
xor eax, eax
lea edi, [ebp - 0x144]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
jmp 0x1001af01
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x250], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1001aef0
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x1001af16
push ebx
call dword [sym.imp.USER32.dll_RegisterClassW]
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
imul eax, dword [ebp - 0x18]
sub edx, eax
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
inc eax
add eax, edx
je 0x1001af3e
mov eax, esi
cmp dword [ebp - 0x18], ebx
jne 0x1001af40
mov eax, ebx
cmp eax, 0xe44142b9
mov eax, dword [ebp - 0x18]
push dword [ebp - 0xe4]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x28]
imul edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
neg edx
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x244]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x248], eax
call fcn.100144f0
mov byte [ebp - 4], 9
mov eax, 0xb3ae3556
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x20], 0x945d4475
mov dword [ebp - 0x30], 0xc68d18e
push 4
mov dword [ebp - 0x38], 0x294ec24a
mov dword [ebp - 0x18], ebx
pop ecx
jmp 0x1001afd4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11c], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1001afc3
mov dword [ebp - 0x18], ebx
jmp 0x1001afef
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2a8], 0x7d4add7d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1001afde
mov dword [ebp - 0xa4], 7
cmp dword [ebp - 0xa4], 0xffffffed
mov edi, 0x63d62a0
jne 0x1001b2ad
mov dword [ebp - 0x18], 0x905d09ea
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x16c], edi
mov dword [ebp - 0x168], edi
mov dword [ebp - 0x164], edi
mov dword [ebp - 0x160], edi
mov dword [ebp - 0x24], ebx
jmp 0x1001b04c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1fc], 0x6cedda56
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1001b03b
mov dword [ebp - 0x18], 0xe
cmp dword [ebp - 0x18], 0xfffffff1
je 0x1001b2a2
mov dword [ebp - 0x20], 0xfffffff8
mov ecx, 0xae8b0121
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0xa4]
cmp ecx, eax
mov eax, dword [ebp - 0xa4]
sbb ecx, ecx
neg ecx
imul eax, ecx
imul edx, eax, 0xffff
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
xor eax, eax
inc edx
cmp ecx, edx
setl al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], ebx
jl 0x1001b29a
mov dword [ebp - 0x34], 0x1cc545e2
mov dword [ebp - 0x38], 0x7054f86f
mov dword [ebp - 0x44], 0x53f
cmp dword [ebp - 0x44], 0x697
jle 0x1001b12f
mov edi, ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x38], 0x94d
mov eax, edi
lea ecx, [ebp - 0x31c]
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001b106
mov eax, dword [eax]
push eax
call fcn.1004b2d6
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x31c]
call fcn.10001f3a
dec edi
dec dword [ebp - 0x38]
jne 0x1001b0ec
mov edi, dword [ebp - 0x3c]
inc edi
mov dword [ebp - 0x3c], edi
cmp edi, 0x2c87
jl 0x1001b0e2
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 3
jg 0x1001b1b7
mov dword [ebp - 0x24], ebx
jmp 0x1001b14e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xec], 0x8d029b4c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1001b13d
mov eax, dword [ebp - 0x34]
mov ecx, 0xfff6
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x160]
cmp ecx, eax
push 1
sbb esi, esi
xor edx, edx
inc esi
mov dword [ebp - 0xec], esi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x16c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, esi
pop esi
setg al
sub eax, dword [ebp - 0x1c]
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x110], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x1001b138
cmp dword [ebp - 0x44], 0x2c7
jge 0x1001b1cb
push str.fbfewjw_htgfn_srglicaip_fcfgsq_ptyihe_kdsbwpgv
call fcn.1004b2d6
pop ecx
mov dword [ebp - 4], 9
mov dword [ebp - 0x44], 0x4b5d
cmp dword [ebp - 0x44], 0x4b75
jle 0x1001b23e
mov ecx, ebx
mov dword [ebp - 0x24], ebx
mov eax, ebx
mov dword [ebp - 0x34], ebx
mov edi, ebx
cdq
idiv edi
mov dword [ebp - 0x3c], 0x34aa
mov dword [ebp - 0x38], edx
mov eax, ecx
mov ecx, 0x1007d9f8
and eax, edx
cdq
push edx
push eax
call fcn.10001bd6
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x24]
inc edx
dec dword [ebp - 0x3c]
mov dword [ebp - 0x38], edx
jne 0x1001b1fb
mov eax, dword [ebp - 0x34]
inc edi
cmp edi, 0x747d
jl 0x1001b1ee
inc eax
mov dword [ebp - 0x34], eax
cmp eax, 0x5a29
jl 0x1001b1ec
inc ecx
mov dword [ebp - 0x24], ecx
cmp ecx, 0x54bd
jl 0x1001b1e7
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x1001b24e
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x44], 0x4a98
jge 0x1001b28b
mov edx, str.saicdbq_joispgo_atco_uqoti_sbba_ofjeos_vfcygz_wokkt_tyrdwhdvc_xplt_mcs
mov ecx, 0x1007d9f8
call fcn.1000358d
jmp 0x1001b28b
mov dword [ebp - 4], 9
dec dword [ebp - 0x1c]
jmp 0x1001b0b6
dec dword [ebp - 0x18]
jmp 0x1001b059
dec dword [ebp - 0xa4]
jmp 0x1001affe
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], 0xffffffe2
jl 0x1001b3e6
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x38], 0xe448d75f
mov dword [ebp - 0x40], 0x6152d756
mov dword [ebp - 0x24], ebx
jmp 0x1001b2de
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x60], 0x3b9fe29
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1001b2d0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1c], ebx
jne 0x1001b32d
cmp dword [ebp - 0x60], ebx
je 0x1001b32f
mov ebx, esi
xor eax, eax
cmp ebx, 0x91
push 0
setle al
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x5c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
sub eax, edx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x38], 0x7f253abc
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x114]
setle dl
xor ebx, ebx
test edx, edx
sete bl
xor ecx, ecx
cmp ebx, eax
pop ebx
setl cl
xor edx, edx
mov dword [ebp - 0x114], ecx
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x110]
cmp eax, ecx
setg dl
mov dword [ebp - 0xa4], edx
xor edx, edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setg dl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
neg eax
add eax, 0x95f011e7
mov dword [ebp - 0x2a8], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe2
jge 0x1001b2ba
push 0x5c
pop eax
push 2
mov dword [ebp - 0x70], 0xd104a400
mov ecx, ebx
mov word [ebp - 0x6c], 0x9ac0
mov byte [ebp - 0x6a], 0x30
mov word [ebp - 0x68], ax
pop edi
cmp edi, 2
jne 0x1001b40f
push 5
pop ecx
push ecx
pop edi
jmp 0x1001b438
movzx edx, byte [ebp + edi - 0x6f]
mov eax, edi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x72]
movzx ecx, word [ebp + eax*2 - 0x68]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + edi - 0x70]
add ecx, edx
mov word [ebp + eax*2 - 0x68], cx
mov ecx, ebx
add edi, 2
cmp edi, 7
jb 0x1001b403
xor eax, eax
mov dword [ebp - 0x14c], ebx
push 7
mov word [ebp - 0x66], ax
lea ecx, [ebp - 0x15c]
pop edi
mov word [ebp - 0x15c], ax
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x148], edi
call fcn.1001bafd
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], ebx
jmp 0x1001b488
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x178], 0xd1ad67a4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1001b477
mov dword [ebp - 0x18], ebx
jmp 0x1001b55b
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x40], 0xfffffff6
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x20], 0xf
jmp 0x1001b54e
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x1d8], 0xe764939e
mov dword [ebp - 0x1d4], 0xe764939e
mov dword [ebp - 0x1d0], 0xe764939e
mov dword [ebp - 0x1cc], 0xe764939e
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setl dl
sub eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
mov edx, esi
setle cl
mov dword [ebp - 0x1d8], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x174]
inc dword [ebp - 0x174]
cmp eax, esi
mov eax, dword [ebp - 0x34]
cmovle edx, ebx
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x48], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x16
je 0x1001b4b3
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffff
jle 0x1001b496
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x18], 0xae97
mov dword [ebp - 0x24], ebx
jmp 0x1001b585
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x98], 0xfffffff9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1001b574
dec dword [ebp - 0x18]
mov dword [ebp - 0x18], ebx
jmp 0x1001b657
mov dword [ebp - 0x24], ebx
jmp 0x1001b5a8
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x90], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1001b59b
mov dword [ebp - 0x90], ebx
jmp 0x1001b648
mov dword [ebp - 0x40], ebx
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x98], ebx
jne 0x1001b5f4
mov eax, dword [ebp - 0x90]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x98]
cmp eax, 0x3e75cb55
mov eax, dword [ebp - 0x90]
setg cl
cmp ecx, dword [ebp + eax*4 - 0x98]
jle 0x1001b5f4
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x90]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x98]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x98]
mov eax, dword [ebp - 0x98]
cmp eax, ecx
mov eax, dword [ebp - 0x40]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
imul eax, ecx, 0x276b
xor ecx, ecx
cmp eax, 0x3d5943e2
mov eax, dword [ebp - 0x90]
setle cl
mov dword [ebp + eax*4 - 0x98], ecx
inc dword [ebp - 0x90]
cmp dword [ebp - 0x90], esi
jle 0x1001b5b9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1001b596
push 0x5f
pop eax
mov word [ebp - 0xb8], ax
lea ecx, [ebp - 0x22c]
xor eax, eax
mov word [ebp - 0xb4], 0xd600
mov word [ebp - 0xb6], ax
mov word [ebp - 0x22c], ax
lea eax, [ebp - 0xb8]
push eax
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x21c], ebx
call fcn.1001bafd
mov byte [ebp - 4], 0xf
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0x10c], 0xffffffff
mov dword [ebp - 0x108], 0xffffffff
mov dword [ebp - 0x104], 0xffffffff
mov dword [ebp - 0x100], 0xffffffff
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x28], 0x43c6fe23
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x3c], 0x3ab0
cmp dword [ebp - 0x3c], 0x3aec
jle 0x1001b736
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x38], ebx
mov eax, edi
shl eax, cl
mov ecx, 0x1007d9f8
cdq
push edx
push eax
call fcn.10001bd6
mov ecx, dword [ebp - 0x38]
inc ecx
mov dword [ebp - 0x38], ecx
cmp ecx, 0x1afd
jl 0x1001b6ff
inc edi
cmp edi, 0x7a96
jl 0x1001b6fa
push 0x24aa
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x34], 0xee49
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x3c], 0x38c2
jge 0x1001b77a
mov edx, str.nbcu_ddj_dpvsxmeg_ruuuwdpqg_irctgov_eydvt_vnsujbfbc
mov ecx, 0x1007d9f8
call fcn.1000358d
jmp 0x1001b77a
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x40], 0xfa8fad74
mov dword [ebp - 0x48], 0x4549
mov dword [ebp - 0x24], ebx
jmp 0x1001b7a5
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd0], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1001b794
mov eax, dword [ebp - 0x108]
xor edx, edx
test eax, eax
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x34]
setne dl
inc dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xcc]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0xdd93
setne al
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x10c], eax
jle 0x1001b849
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x1001b836
push 0xfbc
push 0xbf0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x1001b859
mov dword [ebp - 0x48], 0x43747c91
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x14c]
cmp dword [ebp - 0x148], 8
lea eax, [ebp - 0x15c]
push ebx
cmovae eax, dword [ebp - 0x15c]
lea ecx, [ebp - 0x244]
push eax
call fcn.1001bb85
cmp eax, 0xffffffff
je 0x1001b89e
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x22c]
push ecx
push esi
push eax
lea ecx, [ebp - 0x244]
call fcn.10015a1b
jmp 0x1001b859
mov ecx, dword [ebp - 0xc8]
lea eax, [ebp - 0x244]
push eax
lea edx, [ebp - 0x214]
call fcn.1001bc28
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x22c]
call fcn.10014cde
push ebx
push esi
lea ecx, [ebp - 0x15c]
call fcn.10014cde
push ebx
push esi
lea ecx, [ebp - 0x244]
call fcn.10014cde
push ebx
push esi
lea ecx, [ebp - 0x214]
call fcn.10014cde
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret