Function at 0x1001aa5e
Capabilities:
Enumerate gui resources
Get file attributes
Query or enumerate registry value
Query service status

Disassembly:
mov eax, 0x100826bf
call fcn.10082230
sub esp, 0x2bc
push ebx
push esi
push edi
push 0xfffffffffffffffa
mov dword [ebp - 0xa4], ecx
xor ebx, ebx
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], ebx
push 3
mov dword [ebp - 0x30], 0xa023703a
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0x14], ebx
pop edi
jmp 0x1001aaa8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x238], 0x600d5493
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001aa97
push 2
mov dword [ebp - 0x10], 0xffffffe2
mov eax, 0xee1c
pop esi
cmp dword [ebp - 0x10], esi
jne 0x1001ab70
mov dword [ebp - 0xd0], eax
xor ecx, ecx
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
cmp eax, 0xb6fd
mov eax, dword [ebp - 0xc4]
mov edx, dword [ebp - 0x10]
setge cl
add eax, ecx
add edx, eax
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
imul eax, ecx, 0xfffe
xor ecx, ecx
test eax, eax
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0xc4]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
sub edx, eax
xor eax, eax
add edx, dword [ebp - 0xc4]
cmp edx, 0x4e6c
setg al
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], ebx
jmp 0x1001ab56
cmp dword [ebp - 0x1c], ebx
jne 0x1001ab5c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jle 0x1001ab4e
inc dword [ebp - 0x10]
mov eax, 0xee1c
cmp dword [ebp - 0x10], esi
je 0x1001aac5
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x1c], ebx
jmp 0x1001ab82
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x238], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001ab75
mov dword [ebp - 0x20], 0xe1757117
mov dword [ebp - 0x20], 0x14
jmp 0x1001abda
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x24], 0xb363f9e9
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x1001abbd
push ebx
push 0x15d2
push ebx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x14], ebx
jmp 0x1001abd2
mov dword [ebp - 0x28], 0x9b79
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jge 0x1001abc2
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1001ab97
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x1f8]
push edi
call fcn.10018cbc
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x1c], ebx
jmp 0x1001ac0d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1f8]
mov dword [eax + ecx*4], 0x4a8c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001abfa
mov dword [ebp - 0x1c], ebx
jmp 0x1001ac24
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x150], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001ac17
mov dword [ebp - 0x10], ebx
jmp 0x1001ac44
mov dword [ebp - 0x28], 0x82a1836c
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14c], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x1001ac2e
mov eax, dword [ebp - 0x10]
mov esi, 0x8a06
mov eax, dword [ebp - 0x14c]
mov edx, esi
mov eax, dword [ebp - 0x10]
sub edx, eax
sub edx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x1f8]
neg edx
sbb edx, edx
inc edx
mov ecx, dword [eax]
add ecx, edx
mov dword [ebp - 0x148], edx
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x1f8]
setl dl
xor eax, eax
cmp edx, 0xe327
setne al
mov dword [ebp - 0x10], eax
call fcn.10019514
mov dword [ebp - 0x10], 0xfffffff8
mov dword [ebp - 0x28], 0xa61bf079
mov dword [ebp - 0x24], 0xb489f7a9
mov dword [ebp - 0x1c], ebx
jmp 0x1001acc3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x120], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1001acb6
mov dword [ebp - 0x1c], ebx
jmp 0x1001acdf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x218], 0x89d2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1001acce
mov dword [ebp - 0x10], ebx
mov ecx, 0xffff
cmp dword [ebp - 0x10], edi
jg 0x1001ad5b
mov esi, 0x9beab1d6
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x120]
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x120]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x120]
cmp ecx, eax
sbb eax, eax
neg eax
cmp esi, eax
mov eax, dword [ebp - 0x10]
sbb ecx, ecx
inc ecx
mov eax, dword [ebp + eax*4 - 0x120]
imul eax, dword [ebp - 0x114]
imul eax, ecx
mov ecx, 0xffff
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x1001acf7
mov esi, 0x8a06
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], 0x24a8c6a5
push 0xfffffffffffffff6
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], 0x7be9fb1c
mov dword [ebp - 0x30], 0x5739
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 0xedd1edb6
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1001ada0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2ac], 0x1078932
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001ad8f
mov dword [ebp - 0x10], 0x17
cmp dword [ebp - 0x10], ecx
jle 0x1001ae55
mov dword [ebp - 0x14], 2
lea ecx, [ebp - 0x1bc]
push 2
call fcn.10018cbc
mov dword [ebp - 0x20], ebx
jmp 0x1001addd
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1bc]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1001adce
cmp dword [ebp - 0x14], ebx
jne 0x1001ae4a
mov dword [ebp - 0x14], ebx
jmp 0x1001ae2a
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], ebx
jl 0x1001ae27
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x1001ae1f
push 0x186e
push 0xc9a
push ebx
push 0x21da
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
mov eax, dword [ebp - 0x20]
dec dword [ebp - 0x20]
jns 0x1001ae00
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jle 0x1001aded
lea ecx, [ebp - 0x1bc]
call fcn.10019514
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff6
jg 0x1001adb5
jmp 0x1001ae55
lea ecx, [ebp - 0x1bc]
call fcn.10019514
inc dword [ebp - 0x28]
mov dword [ebp - 0x30], 0xa023703a
mov dword [ebp - 0x24], 0x97e780ca
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], 0x3631e19e
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x10], ebx
jmp 0x1001ae91
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4c], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001ae83
mov dword [ebp - 0x10], ebx
jmp 0x1001aeac
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa0], 0x58bdfadf
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001ae9b
mov eax, dword [ebp - 0x4c]
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x28]
je 0x1001aed8
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x98]
inc eax
imul ecx, eax
test ecx, ecx
je 0x1001aed8
xor eax, eax
inc eax
jmp 0x1001aeda
mov eax, ebx
add eax, 0x2fc4eb
cmp dword [ebp - 0x4c], eax
jge 0x1001aeea
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 2
jg 0x1001afba
mov dword [ebp - 0x28], 0x289ed5b6
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x1001af29
push 0x19f4
push 0x2499
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x4c]
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x4c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp + eax*4 - 0xa0]
cmp dword [ebp - 0x28], 7
sbb eax, eax
neg eax
add esi, eax
mov eax, dword [ebp - 0x1c]
neg esi
sbb esi, esi
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0xa0]
neg esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x4c]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x4c]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, esi
setl al
mov dword [ebp - 0xa0], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1001af09
mov esi, 0x8a06
push 2
lea ecx, [ebp - 0x168]
call fcn.10018cbc
mov dword [ebp - 0x14], 0xdf2f4a8b
mov dword [ebp - 0x14], ebx
jmp 0x1001afe6
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x168]
mov dword [eax + ecx*4], 0xf0ea75c9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001afd3
mov dword [ebp - 0x14], ebx
jmp 0x1001b010
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x168]
cmp dword [eax + ecx*4], ebx
jne 0x1001b016
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x168]
cmp dword [eax + ecx*4], ebx
jne 0x1001b016
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jle 0x1001aff1
lea ecx, [ebp - 0x168]
call fcn.10019514
mov dword [ebp - 0x14], ebx
jmp 0x1001b037
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x26c], 0x600d5493
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001b026
xor edx, edx
mov dword [ebp - 0x10], 0xfffffffc
inc edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], ebx
jmp 0x1001b05c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6c], 0xe57ad95e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001b04e
mov dword [ebp - 0x6c], 0xc204e2db
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x60], ebx
jg 0x1001b11c
mov dword [ebp - 0x28], 0x361a
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0x6a5b5cf0
mov dword [ebp - 0x14], ebx
jmp 0x1001b09f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x220], 0xcadfb1af
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001b08e
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, 0xffff
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x21c], ecx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x6c]
setne dl
xor ebx, ebx
imul edx, eax
mov eax, dword [ebp - 0x64]
cmp edx, eax
mov eax, dword [ebp - 0x6c]
setne bl
sub ebx, 0xb90f
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x6c]
cmp ecx, eax
mov eax, dword [ebp - 0x6c]
setne dl
imul eax, edx
cmp eax, 0xffff
sbb eax, eax
neg eax
xor ebx, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x6c], eax
jmp 0x1001b1fb
mov dword [ebp - 0x2c], 0xdee94ccb
xor ecx, ecx
mov dword [ebp - 0x1c], 0x5e3970c0
mov dword [ebp - 0x14], 0x744fa755
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x6c], edx
mov eax, dword [ebp - 0x10]
cmp eax, edx
setge cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x6c]
cmp ecx, eax
setge dl
xor eax, eax
cmp eax, edx
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne bl
xor ecx, ecx
sub ebx, 0xd0294e
cmp ebx, eax
setle cl
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
je 0x1001b1eb
mov dword [ebp - 0x14], ebx
jmp 0x1001b1b7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1d4], 0x6abe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001b1a6
cmp dword [ebp - 0x2c], ebx
je 0x1001b1dc
mov eax, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x6c]
imul eax, dword [ebp - 0x1d4], 0xaf71
mov dword [ebp - 0x14], eax
jmp 0x1001b1fb
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x1001b1fb
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x20], 0xffffffe2
jmp 0x1001b517
push edi
lea ecx, [ebp - 0x100]
call fcn.10018cbc
mov dword [ebp - 0x10], ebx
jmp 0x1001b229
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2a0], 0xc93b4e1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1001b218
mov dword [ebp - 0x10], ebx
jmp 0x1001b247
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], 0x4643cdf9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001b234
mov eax, dword [ebp - 0x100]
mov dword [eax], ebx
mov dword [ebp - 0x14], 0xfbb4ebb0
mov dword [ebp - 0x14], ebx
jmp 0x1001b271
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2a0], 0x8ce3e63e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001b260
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x2a0], ebx
jne 0x1001b294
mov eax, dword [ebp - 0x100]
inc dword [eax]
cmp dword [eax], edi
jle 0x1001b254
lea ecx, [ebp - 0x100]
call fcn.10019514
mov eax, 0xee1c
lea ecx, [ebp - 0x1ec]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x30], 0x47dfa860
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x30], ebx
push edi
call fcn.10018cbc
mov dword [ebp - 0x10], 0xca420452
mov dword [ebp - 0x14], ebx
jmp 0x1001b309
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1ec]
mov dword [eax + ecx*4], 0xab274bf9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001b2f6
inc dword [ebp - 0x10]
mov dword [ebp - 0x10], ebx
jmp 0x1001b34d
mov dword [ebp - 0x2c], 2
cmp dword [ebp - 0x2c], ebx
jl 0x1001b34a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1ec]
cmp dword [eax + ecx*4], ebx
jne 0x1001b34a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b345
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
dec dword [ebp - 0x2c]
jns 0x1001b322
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x1001b316
lea ecx, [ebp - 0x1ec]
call fcn.10019514
mov eax, dword [ebp - 0xd8]
xor ecx, ecx
cmp eax, 0xb6fd
mov eax, dword [ebp - 0xd8]
mov edx, dword [ebp - 0x20]
setge cl
add eax, ecx
add edx, eax
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
imul eax, ecx, 0xfffe
xor ecx, ecx
test eax, eax
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0xd8]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
sub edx, eax
xor eax, eax
add edx, dword [ebp - 0xd8]
cmp edx, 0x4e6c
setg al
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], ebx
jmp 0x1001b50a
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0x5e3d1aa1
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 0x99da9727
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0x4d8142c7
mov dword [ebp - 0x24], 0x67c8
mov dword [ebp - 0x10], ebx
jmp 0x1001b42d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x88], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1001b41c
mov dword [ebp - 0x10], ebx
jmp 0x1001b448
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2c8], 0xbbfad0d7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1001b437
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b45e
push ebx
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [ebp - 0x80], ebx
jmp 0x1001b4f8
mov dword [ebp - 0x28], 0x3ccd2466
mov dword [ebp - 0x14], ebx
jmp 0x1001b480
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x34], 0xe1d925b0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1001b472
mov dword [ebp - 0x34], ebx
jmp 0x1001b4ec
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1001b4e3
mov dword [ebp - 0x2c], 0xf5b1b6fd
cmp dword [ebp - 0x80], ebx
jne 0x1001b4e9
mov dword [ebp - 0x28], 0x5fe4
xor edx, edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x80]
cmp ecx, eax
setge dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x2c], edx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffec
je 0x1001b493
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffff1
jle 0x1001b48b
inc dword [ebp - 0x24]
inc dword [ebp - 0x80]
cmp dword [ebp - 0x80], 0x17
jge 0x1001b466
cmp dword [ebp - 0x1c], ebx
jne 0x1001b514
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jle 0x1001b3d2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
je 0x1001b207
mov dword [ebp - 0x1c], ebx
jmp 0x1001b56a
mov dword [ebp - 0x14], 0xf6af1124
mov dword [ebp - 0x14], ebx
jmp 0x1001b557
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b544
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b554
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffee
jle 0x1001b532
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x26c], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001b526
mov dword [ebp - 0x1c], 0x42eb90da
mov dword [ebp - 0x24], 1
cmp dword [ebp - 0x1c], ebx
je 0x1001b60b
mov dword [ebp - 0x14], 0x6535
mov dword [ebp - 0x24], 0x218e9934
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x14], ebx
je 0x1001b5af
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1c]
jl 0x1001b5af
xor ecx, ecx
inc ecx
jmp 0x1001b5b1
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp eax, 1
setle cl
mov dword [ebp - 0x24], ecx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b6b2
push 0xa30
push 0x1cba
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x1001b6b2
mov dword [ebp - 0x28], 0xb09b
mov dword [ebp - 0x24], 0x258d0336
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x1c], ebx
jmp 0x1001b6a8
mov dword [ebp - 0x10], 0x5261fc42
mov dword [ebp - 0x10], 0xfffffff9
jmp 0x1001b640
cmp dword [ebp - 0x28], ebx
jne 0x1001b646
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffff
je 0x1001b638
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jne 0x1001b681
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x24], 0xffffffff
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
neg edx
cmp eax, edx
setne cl
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0x52772010
jge 0x1001b681
mov ecx, ebx
jmp 0x1001b684
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0x3ea3
setl al
xor ecx, ecx
sub eax, 0xfff8
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
setl cl
mov dword [ebp - 0x10], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff9
je 0x1001b628
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b6cc
push 0xc35
push 0x1fde
push ebx
call dword [sym.imp.GDI32.dll_PtInRegion]
mov dword [ebp - 0x20], 0x6579763
mov dword [ebp - 0x1c], 0x94543beb
cmp dword [ebp - 0x20], ebx
je 0x1001b7c1
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], ebx
jmp 0x1001b7b5
mov dword [ebp - 0x2c], 0xd89e1771
lea ecx, [ebp - 0x204]
push edi
call fcn.10018cbc
mov dword [ebp - 0x14], ebx
jmp 0x1001b71d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x204]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001b70a
mov dword [ebp - 0x1c], 0x4696a485
mov dword [ebp - 0x1c], ebx
jmp 0x1001b7a1
mov dword [ebp - 0x10], 0xa0734f09
mov dword [ebp - 0x10], ebx
jmp 0x1001b798
mov dword [ebp - 0x14], 0x6887e0
mov dword [ebp - 0x28], 0x888a
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1001b795
mov dword [ebp - 0x30], 0x12ef
cmp dword [ebp - 0x24], ebx
jne 0x1001b795
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff8
jne 0x1001b73a
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff8
jle 0x1001b72e
lea ecx, [ebp - 0x204]
call fcn.10019514
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x18
jg 0x1001b6f2
jmp 0x1001b7f5
mov dword [ebp - 0x14], ebx
jmp 0x1001b7d3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa8], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1001b7c6
mov dword [ebp - 0x1c], ebx
jmp 0x1001b7ef
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa8], 2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x1001b7de
mov dword [ebp - 0x24], 0x9696
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x30], 0xa756a336
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], ebx
push 2
call fcn.10018cbc
mov dword [ebp - 0x2c], 0xfffa
mov dword [ebp - 0x28], 0x1eb64d0
mov dword [ebp - 0x14], ebx
jmp 0x1001b847
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x210]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001b834
dec dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x2c]
cmp eax, ecx
jge 0x1001b862
xor ecx, ecx
inc ecx
jmp 0x1001b864
mov ecx, ebx
mov eax, dword [ebp - 0x24]
sub ecx, eax
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001b87f