Function at 0x1001bbc0
Capabilities:
Encode data using xor
Get thread local storage value
Identify system language via api
Query or enumerate registry key

Disassembly:
mov eax, 0x10065a3c
call fcn.100651e0
sub esp, 0x214
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 0x54], ecx
inc edi
push 2
mov dword [ebp - 0x24], edi
lea ecx, [ebp - 0xf8]
pop esi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], 0x88a97331
mov dword [ebp - 0x34], 0xffffffff
push esi
mov dword [ebp - 0x44], edx
call fcn.1001d532
xor ebx, ebx
lea eax, [ebp - 0x1d0]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x94]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c4f0]
push eax
lea eax, [ebp - 0x1e0]
mov dword [ebp - 0x30], esi
push eax
push ebx
movdqu xmmword [ebp - 0x1e0], xmm0
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
call fcn.1001ff2f
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x28], 0xfffa
mov dword [ebp - 0x34], 0xeb256cd2
mov dword [ebp - 0x14], ebx
jmp 0x1001bc76
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 0x9e62b560
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001bc63
cmp dword [ebp - 0x24], ebx
je 0x1001bc8b
mov eax, dword [ebp - 0x94]
mov ecx, edi
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x40]
xor edx, edx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, 0xc3f406f6
setg dl
sub eax, edx
cmp eax, dword [ebp - 0x40]
jl 0x1001bcaa
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf8]
xor ecx, ecx
mov eax, dword [eax + 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x30], 0xf3b
cmp eax, 0xfffffff6
setl cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x94]
call fcn.1001d5b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf8]
call fcn.1001d5b4
mov eax, dword [0x10610720]
test al, 1
jne 0x1001bd7b
or eax, edi
mov dword [0x10610720], eax
push ebx
mov dword [ebp - 4], edi
push ebx
mov dword [0x10610700], ebx
mov dword [0x10610704], ebx
call fcn.1001f732
mov dword [0x10610700], eax
mov dword [0x10610708], ebx
mov dword [0x10610710], ebx
mov byte [ebp - 4], 3
mov ecx, 0x10610708
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0xa4]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x19c]
mov dword [0x1061071c], 0x3f800000
push eax
mov dword [0x1061070c], ebx
call fcn.1001f50a
push 0x100667b6
mov dword [0x10610714], 7
mov dword [0x10610718], 8
call fcn.1005023c
or dword [ebp - 4], 0xffffffff
pop ecx
push esi
lea ecx, [ebp - 0x198]
call fcn.1001d532
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1001bda2
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x198]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001bd93
mov dword [ebp - 0x14], ebx
jmp 0x1001bdbe
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001bdbb
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1001bdac
lea ecx, [ebp - 0x198]
call fcn.1001d5b4
imul eax, dword [ebp - 0x54], 0x2710
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
push eax
call fcn.1001d5f6
mov eax, dword [eax]
mov dword [ebp - 0x24], 0xfffffff8
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
mov dword [ebp - 0x38], eax
je 0x1001be05
push ebx
push 0x12ab
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [ebp - 0x24], 3
jmp 0x1001be5f
push edi
lea ecx, [ebp - 0x104]
call fcn.1001d532
mov dword [ebp - 0x14], ebx
jmp 0x1001be32
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], 0x97eede0b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001be1f
mov eax, dword [ebp - 0x104]
mov dword [eax], ebx
cmp dword [ebp - 0x24], ebx
jne 0x1001be51
mov eax, dword [ebp - 0x104]
dec dword [eax]
cmp dword [eax], 0xffffffff
jg 0x1001be3f
lea ecx, [ebp - 0x104]
call fcn.1001d5b4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1c
je 0x1001be0e
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x1001c285
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 0xf
cmp dword [ebp - 0x1c], 0xffffffe5
je 0x1001c11f
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1001be9d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1ec], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001be8c
mov dword [ebp - 0x2c], 0xfffffff6
jmp 0x1001c106
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x28], 0x39956a21
cmp dword [ebp - 0x20], ebx
je 0x1001bf88
mov dword [ebp - 0x28], 0x8abb75da
mov dword [ebp - 0x14], 0x4cd021aa
mov dword [ebp - 0x20], ebx
jmp 0x1001bf5f
mov dword [ebp - 0x34], 0xbf35dd75
mov eax, dword [ebp - 0x1c]
add eax, 0x162f6306
je 0x1001bef3
mov eax, edi
cmp dword [ebp - 0x1c], ebx
jne 0x1001bef5
mov eax, ebx
push 8
pop ecx
sub ecx, eax
xor edx, edx
add ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], ebx
jne 0x1001bf20
mov ecx, ebx
cmp dword [ebp - 0x2c], ebx
je 0x1001bf22
mov ecx, edi
mov eax, dword [ebp - 0x1c]
imul eax, ecx
sub eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
sub eax, 2
neg eax
sbb eax, eax
inc eax
cmp eax, edi
sbb eax, eax
inc eax
add eax, dword [ebp - 0x14]
cmp eax, 0xa83afd4
je 0x1001bf4d
mov edx, edi
cmp dword [ebp - 0x1c], ebx
jne 0x1001bf4f
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xd
jge 0x1001bedb
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001c103
push ebx
push ebx
push 0xd3
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x1001c103
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c510]
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp - 0x1d0]
mov dword [ebp - 0x88], ebx
push eax
push ebx
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x84], ebx
movdqu xmmword [ebp - 0x1d0], xmm0
mov dword [ebp - 0x80], ebx
call fcn.1001ff2f
push esi
lea ecx, [ebp - 0x14c]
mov dword [ebp - 4], 4
call fcn.1001d532
push 3
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 5
call fcn.1001d532
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x20], ebx
jmp 0x1001c00a
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14c]
mov dword [eax + ecx*4], 0x52196db
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1001bff7
mov dword [ebp - 0x20], ebx
jmp 0x1001c027
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x128]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1001c014
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x28]
add ecx, 0x1b059873
cmp eax, ecx
mov eax, dword [ebp - 0x88]
setle dl
mov dword [eax + 8], edx
mov dword [ebp - 0x20], 0x17
cmp dword [ebp - 0x20], 9
jle 0x1001c0de
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x88]
mov esi, dword [ebp - 0x14c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x28], 0x48f
mov ecx, 0xb1beba42
mov dword [esi + 4], ecx
mov dword [eax + 4], ecx
mov dword [ebp - 0x34], 0x38e70e9e
mov dword [ebp - 0x1e4], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp eax, edi
mov eax, dword [ebp - 0x44]
setg cl
xor edx, edx
add ecx, 0x3190c4eb
cmp dword [eax + 0xc], ecx
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
cmp eax, edx
mov eax, dword [ebp - 0x24]
setg cl
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], ebx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jg 0x1001c072
push 2
pop esi
lea ecx, [ebp - 0x128]
call fcn.1001d5b4
lea ecx, [ebp - 0x14c]
call fcn.1001d5b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.1001d5b4
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jne 0x1001beaf
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe5
jne 0x1001be84
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], 0xa6e6f7fb
lea ecx, [ebp - 0x110]
push esi
mov dword [ebp - 0x7c], eax
call fcn.1001d532
push 3
lea ecx, [ebp - 0xc8]
mov dword [ebp - 4], 6
call fcn.1001d532
mov dword [ebp - 0x44], 0x38ca8c98
mov dword [ebp - 0x2c], ebx
jmp 0x1001c166
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xa0], 0x5befa1e1
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1001c155
mov dword [ebp - 0x2c], ebx
jmp 0x1001c183
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x110]
mov dword [eax + ecx*4], 0x53b1dab5
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1001c170
mov dword [ebp - 0x2c], ebx
jmp 0x1001c1a0
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc8]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1001c18d
cmp dword [ebp - 0x1c], ebx
je 0x1001c21a
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
mov dword [ebp - 0x9c], edx
test edx, edx
jne 0x1001c1c8
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], 0xffffffff
mov eax, dword [ebp - 0x1c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setg cl
sub eax, ecx
cmp eax, 0xfffffff6
sbb eax, eax
neg eax
imul ecx, eax, 0xffff
mov eax, dword [ebp - 0x110]
cmp ecx, 0xb844a754
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0xc8]
setge dl
mov dword [eax + 4], edx
test edx, edx
jne 0x1001c227
jmp 0x1001c220
mov eax, dword [ebp - 0xc8]
cmp dword [eax + 8], ebx
jne 0x1001c227
mov edi, ebx
cmp edi, 0xe6966ef3
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x4137d6c5
setle cl
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x44], ecx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001c26a
push 0x10bb
push 0x1e16
call dword [sym.imp.GDI32.dll_SetROP2]
lea ecx, [ebp - 0xc8]
call fcn.1001d5b4
lea ecx, [ebp - 0x110]
call fcn.1001d5b4
jmp 0x1001d266
mov eax, dword [0x10610720]
test al, 2
jne 0x1001c31c
or eax, esi
mov dword [0x10610720], eax
push ebx
mov dword [ebp - 4], 7
push ebx
mov dword [0x106106d0], ebx
mov dword [0x106106d4], ebx
call fcn.1001f732
mov dword [0x106106d0], eax
mov dword [0x106106d8], ebx
mov dword [0x106106e0], ebx
mov byte [ebp - 4], 9
mov ecx, 0x106106d8
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x98]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x1a8]
mov dword [0x106106ec], 0x3f800000
push eax
mov dword [0x106106dc], ebx
call fcn.1001f50a
push 0x100667b1
mov dword [0x106106e4], 7
mov dword [0x106106e8], 8
call fcn.1005023c
or dword [ebp - 4], 0xffffffff
pop ecx
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x14], 0xec2e0cf5
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x14], ebx
jmp 0x1001c341
mov dword [ebp - 0x34], 0x2bb11acc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x14
jg 0x1001c337
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001c362
push ebx
push 0x1414
push 0x109f
push ebx
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
lea eax, [ebp - 0x54]
push eax
call fcn.1001d658
push edi
lea ecx, [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], eax
call fcn.1001d532
mov dword [ebp - 0x28], 0x806aa1c3
mov dword [ebp - 0x28], 0x2b607800
mov dword [ebp - 0x20], ebx
jmp 0x1001c3ba
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], 0xe2de4bf7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1001c3a7
mov dword [ebp - 0x20], ebx
jmp 0x1001c3d1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1b0], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1001c3c4
cmp dword [ebp - 0x1c], ebx
je 0x1001c434
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, ebx
cmp dword [ebp - 0x14], ebx
je 0x1001c3ea
mov eax, edi
mov dword [ebp - 0x14], eax
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x11c]
setl dl
mov dword [eax], edx
test edx, edx
je 0x1001c40d
mov eax, edi
cmp dword [ebp - 0x14], ebx
jne 0x1001c40f
mov eax, ebx
mov dword [ebp - 0x28], eax
xor edx, edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, 0xfffffff7
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, edi
setle cl
cmp ecx, dword [ebp - 0x1c]
jle 0x1001c436
mov eax, ebx
xor ecx, ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x11c]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1ac], eax
call fcn.1001d5b4
mov cl, byte [ebp + 0xc]
test cl, cl
jne 0x1001c491
mov edx, dword [ebp - 0x40]
test edx, edx
jne 0x1001c659
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x28], 0xa0029bf3
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001c4b1
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov cl, byte [ebp + 0xc]
mov dword [ebp - 0x24], 0xc
jmp 0x1001c4e8
mov dword [ebp - 0x14], ebx
jmp 0x1001c4d0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x174], 0x90be4438
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001c4bf
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x174]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe6
jg 0x1001c4ba
lea eax, [ebp - 0x220]
mov dl, cl
mov ecx, dword [ebp - 0x54]
push eax
call fcn.1000d9b5
cmp byte [ebp + 0xc], 0
lea edi, [ebp - 0x70]
mov esi, eax
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x1001c653
cmp dword [ebp - 0x68], 0
je 0x1001c653
xor edi, edi
inc edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], ebx
jmp 0x1001c539
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb0], 0xb55b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001c528
push 2
pop esi
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], ebx
jl 0x1001c5c1
mov dword [ebp - 0x1c], 0x252604
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x28], 0xf8cd3bed
mov dword [ebp - 0x1c], ebx
jmp 0x1001c5b7
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jl 0x1001c58f
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xb0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xb0]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xb0]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0xa8]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1001c564
dec dword [ebp - 0x20]
jns 0x1001c54a
push dword [ebp + 8]
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x78], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0xe0], ebx
push eax
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0xdc], ebx
push eax
push ebx
movdqu xmmword [ebp - 0x1c0], xmm0
mov dword [ebp - 0xd8], ebx
call fcn.1001ff2f
mov dword [ebp - 0x14], 0x4c506d44
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], ebx
jl 0x1001c640
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001c63b
push ebx
push ebx
push 0x1e33
push 0x21a6
push 0x44d
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
dec dword [ebp - 0x14]
jns 0x1001c61b
lea ecx, [ebp - 0xe0]
call fcn.1001d5b4
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x74], eax
jmp 0x1001c659
xor edi, edi
push 2
inc edi
pop esi
mov dword [ebp - 0x14], 0x94801897
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x14], ebx
jmp 0x1001c67c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x50], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001c672
dec dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0x16
cmp dword [ebp - 0x14], 0xffffffe8
jne 0x1001c853
mov dword [ebp - 0x20], 0xa1f05067
mov dword [ebp - 0x28], 0x948214d2
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x30], 0x657cf7a0
mov dword [ebp - 0x2c], ebx
jmp 0x1001c6f9
mov dword [ebp - 0x28], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x24], 0xe0cd1b7e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
cmp eax, edi
setl cl
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffffe
jne 0x1001c6b6
mov dword [ebp - 0x30], ebx
jmp 0x1001c83a
push edi
lea ecx, [ebp - 0xbc]
call fcn.1001d532
mov dword [ebp - 0x24], ebx
jmp 0x1001c72b
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xbc]
mov dword [eax + ecx*4], 0xee8c4b05
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1001c718
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x2c], ebx
jl 0x1001c82c
mov dword [ebp - 0x28], 0x116e
mov dword [ebp - 0x24], ebx
jmp 0x1001c81a
mov dword [ebp - 0x58], 0xffffffff
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001c767
push ebx
push 0x1e41
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0x20], ebx
jmp 0x1001c80e
mov dword [ebp - 0x1c], ebx
jmp 0x1001c802
mov eax, dword [ebp - 0x30]
xor edx, edx
mov esi, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0xbc]
imul esi, dword [eax]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x1c]
sub esi, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, esi
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x50]
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
add eax, 0x4669cc0
je 0x1001c7b8
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0xbc]
cmp dword [eax], ebx
je 0x1001c7c5
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x2c]
cmp edx, eax
setg cl
mov dword [ebp - 0x50], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x1001c777
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x1001c76f
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jle 0x1001c74b
dec dword [ebp - 0x2c]
jns 0x1001c73c
lea ecx, [ebp - 0xbc]
call fcn.1001d5b4
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jle 0x1001c707
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe8
je 0x1001c695
push 2
pop esi
cmp dword [ebp - 0x40], 0
jne 0x1001ce7d
cmp dword [ebp - 0x70], 0
jle 0x1001ce7d
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], ebx
jmp 0x1001c880
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd4], 0xb55b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001c86f
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], ebx
jl 0x1001c905
mov dword [ebp - 0x1c], 0x252604
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x3c], 0xf8cd3bed
mov dword [ebp - 0x1c], ebx
jmp 0x1001c8fb
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jl 0x1001c8d3
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xd4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xd4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xd4]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0xcc]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1001c8a8
dec dword [ebp - 0x20]
jns 0x1001c88e
mov dword [ebp - 0x30], 0x4fd3df75
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x14], 0xec415051
push edi
call fcn.1001d532
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x14], ebx
jmp 0x1001c93e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x158]
mov dword [eax + ecx*4], 0x2095d7c1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001c92b
mov dword [ebp - 0x30], 0xffffffea
jmp 0x1001ca53
mov dword [ebp - 0x24], 0x35f394a2
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x3c], 0xc7a8cf1d
mov dword [ebp - 0x1c], ebx
push edi
call fcn.1001d532
mov dword [ebp - 0x28], 0xf71d
mov dword [ebp - 0x14], ebx
jmp 0x1001c98b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x140]
mov dword [eax + ecx*4], 0x925f321e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001c978
mov dword [ebp - 0x24], 0x12
jmp 0x1001c9ff
mov dword [ebp - 0x3c], 0xffffffff
mov ecx, edi
mov dword [ebp - 0x14], 0xb09f5954
mov dword [ebp - 0x1c], 7
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
sub ecx, eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x3c], 0xedcc590f
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001c9fc
push 0xcb2
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffd
jg 0x1001c999
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
neg ecx
sbb ecx, ecx
neg ecx
lea eax, [ecx + 0xfffc]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
mov eax, dword [ebp - 0x158]
setne cl
mov dword [eax], ecx
lea ecx, [ebp - 0x140]
call fcn.1001d5b4
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xfffffff4
je 0x1001c94f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x158]
call fcn.1001d5b4
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x1c], 0x5c07
cmp dword [ebp - 0x1c], 0x5f46
mov dword [ebp - 0x58], eax
jle 0x1001caea
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], 0xfc2
mov edi, ebx
mov dword [ebp - 0x28], 0x50a9
mov esi, ebx
mov eax, edi
mov ecx, 0x1060f618
xor eax, esi
cdq
push edx
push eax
call fcn.1001d301
inc esi
cmp esi, 0x20da
jl 0x1001caa8
mov ecx, dword [ebp - 0x14]
add edi, ecx
dec dword [ebp - 0x28]
jne 0x1001caa6
mov eax, dword [ebp - 0x30]
add ecx, eax
dec dword [ebp - 0x24]
mov dword [ebp - 0x14], ecx
jne 0x1001ca9d
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x141c
jl 0x1001ca93
xor edi, edi
push 2
inc edi
pop esi
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 4], 0xb
cmp dword [ebp - 0x1c], 0x58ce
jge 0x1001cb10
mov edx, 0x10008ee0
mov ecx, 0x1060f618
call fcn.1001f80c
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], 0x12
jle 0x1001cc7f
mov dword [ebp - 0x14], 0xa810d21d
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1001cb76
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1a4], 0x7e0fa1a8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001cb65
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x14], 0x4fac
cmp dword [ebp - 0x14], 0x5216
jle 0x1001cbc5
mov edi, ebx
mov esi, ebx
lea eax, [esi + edi]
mov ecx, 0x1060f618
cdq
push edx
push eax
call fcn.1001d301
inc esi
cmp esi, 0x1264
jl 0x1001cb92
inc edi
cmp edi, 0x5f27
jl 0x1001cb90
push 0x1576
call dword [sym.imp.USER32.dll_SetFocus]
xor edi, edi
push 2
inc edi
pop esi
cmp byte [ebp - 0x15], 0
je 0x1001cbd8
push ebx
push 0x12c5
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 4], 0xd
cmp dword [ebp - 0x14], 0x4ebc
jge 0x1001cbf7
mov edx, 0x10008f68
mov ecx, 0x1060f618
call fcn.1001f80c
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x30]
jne 0x1001cc0f
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], ebx
jne 0x1001cc34
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1a0], edi
inc dword [ebp - 0x30]
jmp 0x1001cb17
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001cc90
push ebx
push ebx
call dword [sym.imp.USER32.dll_CopyRect]
push 3
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x14], ebx
pop ecx
jmp 0x1001ccac
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1f8], 0x7865925e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001cc9b
mov eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
inc eax
cmp eax, 0xffff
jne 0x1001ccdd
mov dword [ebp - 0x14], ebx
jmp 0x1001ccd3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5c], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001ccc5
dec dword [ebp - 0x5c]
jmp 0x1001cd23
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x14], ebx
jmp 0x1001ccf9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x18c], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001cce8
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001cd1d
push ebx
push 0xe91
push 0x1d83
push 0x1711
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
inc dword [ebp - 0x184]
cmp dword [ebp - 0x6c], 0
je 0x1001ce7d
cmp dword [ebp - 0x58], 0
je 0x1001ce7d
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x34], 0xed3c15d0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x3c], 0xfd06
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001cd61
push ebx
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x6c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x14], eax
call fcn.1001bb81
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0xec]
push edi
mov dword [ebp - 0x40], eax
call fcn.1001d532
push 3
pop esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x30], 0xaf86
mov dword [ebp - 0x34], 0xe80c6548
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x14], ebx
jmp 0x1001cddd
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001cdca
cmp dword [ebp - 0x24], ebx
je 0x1001cdfc
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov dword [ebp - 0x14], edi
setle dl
cmp dword [ebp - 0x24], edx
je 0x1001cdff
mov dword [ebp - 0x14], ebx
dec dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, dword [ebp - 0x14]
setne al
sub eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
test eax, eax
mov eax, dword [ebp - 0xec]
setg cl
mov dword [eax], ecx
lea ecx, [ebp - 0xec]
call fcn.1001d5b4
lea eax, [ebp - 0x54]
push eax
call fcn.1001d658
mov edx, dword [ebp - 0x40]
mov dword [eax], edx
jmp 0x1001ce80
push 3
pop esi
push 4
lea ecx, [ebp - 0x180]
call fcn.1001d532
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x14], ebx
jmp 0x1001ceac
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x180]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001ce99
mov dword [ebp - 0x14], ebx
jmp 0x1001ced1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001cece
push ebx
push 0x1f7a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1001ceb7
lea ecx, [ebp - 0x180]
call fcn.1001d5b4
lea ecx, [ebp - 0x70]
call fcn.100160e8
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], 0xffbefa5f
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], ebx
jmp 0x1001cf10
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x48], 0x574b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001cf02
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov ecx, 0xaa53f0d3
setge dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
mov edx, 0xffff1f04
setl cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x20]
sub edx, eax
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
sub ecx, 7
cmp ecx, 0xa71a
setle al
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
je 0x1001d06a
mov dword [ebp - 0x3c], 0x27420ea1
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x1001d042
mov dword [ebp - 0x14], 0x630971cf
mov dword [ebp - 0x2c], ebx
jmp 0x1001cfd3
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x48], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1001cfc2
mov dword [ebp - 0x20], ebx
jmp 0x1001d034
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setle dl
imul ecx, edx, 5
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
add ecx, dword [ebp - 0x14]
imul eax, dword [ebp - 0x3c], 0xfffffff9
cmp eax, ecx
jle 0x1001d00a
mov edx, edi
cmp dword [ebp - 0x14], ebx
jne 0x1001d00c
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x48]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x48]
cmp eax, edx
setge cl
mov dword [ebp - 0x24], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1001cfdd
dec dword [ebp - 0x1c]
jns 0x1001cfb6
cmp dword [ebp - 0x38], 0
jne 0x1001d266
cmp dword [ebp - 0x40], 0
je 0x1001d266
push esi
lea ecx, [ebp - 0x134]
call fcn.1001d532
mov dword [ebp - 0x38], ebx
jmp 0x1001d16c
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jg 0x1001d042
mov dword [ebp - 0x30], 0x26a2
cmp dword [ebp - 0x30], 0x2917
jle 0x1001d0f0
mov ecx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], ebx
mov edx, ebx
mov dword [ebp - 0x28], 0x73ba
mov dword [ebp - 0x34], edx
mov eax, edx
xor eax, ecx
lea ecx, [ebp - 0x210]
cdq
push edx
push eax
call fcn.1000d93a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001d0b2
mov eax, dword [eax]
push eax
call fcn.10050266
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x210]
call fcn.1001d982
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
add edx, eax
dec dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x34], edx
jne 0x1001d096
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x4035
jl 0x1001d08a
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x5a52
jl 0x1001d087
mov dword [ebp - 0x2c], ebx
jmp 0x1001d134
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x1001d131
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001d111
push 0x1ed0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001d12c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1e16
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
dec dword [ebp - 0x1c]
jns 0x1001d0fd
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1001d0f5
cmp dword [ebp - 0x30], 0x2626
jge 0x1001d14d
push 0x10008fd4
call fcn.10050266
pop ecx
or dword [ebp - 4], 0xffffffff
inc dword [ebp - 0x20]
jmp 0x1001d06d
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x134]
mov dword [eax + ecx*4], 0x2e91a049
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], esi
jl 0x1001d159
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001d181
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x134]
lea ecx, [ebp - 0x134]
mov dword [eax + 4], ebx
call fcn.1001d5b4
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
call fcn.1001bbb6
mov dword [ebp - 0x1c], 0x2e91a04
mov dword [ebp - 0x1c], 0xd
cmp dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x7c], eax
jg 0x1001d20a
mov ecx, 0x24f8
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x14], 0xaa39ed08
mov dword [ebp - 0x3c], 0x65653d42
mov dword [ebp - 0x14], ebx
jmp 0x1001d1fc
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x168], ebx
jne 0x1001d201
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1001d1e7
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffc
jle 0x1001d1bc
mov dword [ebp - 0x1c], ebx
jmp 0x1001d252
mov dword [ebp - 0x38], 0xfffffff9
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001d227
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
mov dword [ebp - 0x38], ebx
jmp 0x1001d249
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001d246
push 0x2669
push edi
push 0x2445
call dword [sym.imp.KERNEL32.dll_OpenProcess]
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff6
jne 0x1001d22c
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffb
jge 0x1001d20f
lea eax, [ebp - 0x60]
push eax
call fcn.1001d5f6
mov ecx, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x7c]
mov ecx, dword [ebp - 0xc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret