Function at 0x1001914e
Capabilities:
Delete file
Delete registry key
Delete registry value
Resolve function by parsing pe exports
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1008bb7d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c8
push ebx
push esi
push edi
push 2
pop esi
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x54]
push esi
mov dword [esp + 0x64], edx
call fcn.10016f88
xor ebx, ebx
mov dword [esp + 0x1dc], ebx
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 0xfa7ad11e
mov dword [esp + 0xc], 0x845925f8
mov dword [esp + 0x1c], 0x9e46
mov dword [esp + 0x10], ebx
jmp 0x100191c9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x54]
mov dword [eax + ecx*4], 0x6240
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x100191b6
mov dword [esp + 0x10], ebx
jmp 0x100191e5
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x50], 0xfffffff6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x100191d5
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x100191fd
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esp + 0x10], 1
cmp dword [esp + 0x10], ebx
jl 0x100194cf
mov eax, dword [esp + 0x54]
mov dword [esp + 0x20], eax
push dword [esp + 0x64]
movdqa xmm0, xmmword [0x10009d90]
lea eax, [esp + 0x1b8]
push eax
lea eax, [esp + 0x1ac]
mov dword [esp + 0x7c], ebx
push eax
push ebx
lea ecx, [esp + 0x84]
mov dword [esp + 0x88], ebx
movdqu xmmword [esp + 0x1b4], xmm0
mov dword [esp + 0x8c], ebx
call fcn.1001873b
mov byte [esp + 0x1dc], 1
lea ecx, [esp + 0x11c]
mov dword [esp + 0xc], 0xa9e1a0
mov dword [esp + 0x18], 0xfffffff8
mov dword [esp + 0xc], ebx
push 3
call fcn.10016f88
mov dword [esp + 0xc], 4
mov dword [esp + 0xc], ebx
jmp 0x100192a9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], 1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10019293
mov edi, dword [esp + 0x74]
mov dword [esp + 0x28], edi
mov dword [edi], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0xc], 0xb41ce094
mov dword [esp + 0xc], ebx
jmp 0x100192df
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xbc], 0x5d9c72
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x100192cc
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x74]
cmp ecx, dword [eax]
mov ecx, 0xfff7
setge dl
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [esp + 0xbc], eax
jne 0x10019314
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
xor edx, edx
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x54]
push 0
mov ecx, dword [eax + ecx*4]
mov eax, dword [esp + 0x14]
add ecx, 0xfffe
cmp ecx, eax
mov eax, dword [esp + 0x58]
setge dl
xor ecx, ecx
cmp edx, dword [eax + esi*4]
mov eax, dword [esp + 0x24]
setle cl
sub ecx, dword [eax + 4]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x58]
cmp dword [ecx + edx*4], eax
mov eax, dword [esp + 0x1c]
pop ecx
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x54]
setge dl
sub edx, dword [edi + 8]
neg edx
sbb edx, edx
inc edx
add edx, dword [eax + esi*4]
mov dword [esp + 0xc], edx
xor edx, edx
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
cmp eax, 0x3de37d66
mov eax, dword [esp + 0x11c]
setl dl
xor ecx, ecx
test edx, edx
mov dword [eax], edx
setne cl
mov eax, dword [esp + 0x50]
mov edx, 0xffff
add eax, ecx
mov ecx, dword [esp + 0x50]
imul ecx, eax
mov dword [esp + 0xc], ecx
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
cmp edx, eax
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x54]
sbb edx, edx
inc edx
imul edx, dword [ecx + esi*4]
xor ecx, ecx
cmp edx, dword [eax + edi*4]
setg cl
xor edx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x50]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [esp + 0xc], ecx
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0xc]
cmp dword [ecx + esi*4], eax
mov eax, dword [esp + 0x54]
setl dl
xor ecx, ecx
cmp edx, dword [eax + edi*4]
setle cl
add ecx, 0xfff9
je 0x10019487
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], 3
jge 0x10019457
mov ecx, 0xffff
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x14c], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10019441
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001946a
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
mov dword [esp + 0x18], 1
cmp dword [esp + 0x18], ebx
jl 0x10019490
dec dword [esp + 0x14c]
dec dword [esp + 0x18]
jns 0x10019478
jmp 0x10019490
cmp dword [esp + 0xbc], ebx
jne 0x100194a6
mov eax, dword [esp + 0x74]
mov edi, dword [esp + 0x28]
push 2
pop esi
inc dword [eax]
cmp dword [eax], 1
jle 0x100192ba
lea ecx, [esp + 0x11c]
call fcn.10017898
lea ecx, [esp + 0x74]
mov byte [esp + 0x1dc], bl
call fcn.10017898
dec dword [esp + 0x10]
push 2
pop esi
jns 0x10019217
or dword [esp + 0x1dc], 0xffffffff
lea ecx, [esp + 0x54]
call fcn.10017898
push 1
lea ecx, [esp + 0xa4]
call fcn.10016f88
mov dword [esp + 0x1dc], esi
mov dword [esp + 0x24], 0x214a9bac
mov dword [esp + 0x10], ebx
jmp 0x10019516
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x9c], 0xc85f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x10019503
mov dword [esp + 0x10], ebx
jmp 0x10019539
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xa0]
mov dword [eax + ecx*4], 0xe76f5020
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x10019523
mov eax, dword [esp + 0xa0]
mov dword [eax], ebx
mov dword [esp + 0x18], 0x52c58fb7
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jl 0x100195d8
push 1
lea ecx, [esp + 0xb4]
call fcn.10016f88
mov dword [esp + 0x1c], 9
mov dword [esp + 0x1c], ebx
mov dword [esp + 0xc], ebx
jmp 0x10019591
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xb0]
mov dword [eax + ecx*4], 0x2ee6d058
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x1001957b
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100195ab
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0xb0]
mov dword [eax], ebx
inc dword [esp + 0x24]
mov eax, dword [esp + 0xb0]
inc dword [eax]
cmp dword [eax], 0
jle 0x100195b4
lea ecx, [esp + 0xb0]
call fcn.10017898
dec dword [esp + 0x18]
jns 0x1001955b
mov eax, dword [esp + 0xa0]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x9c]
mov eax, dword [esp + 0xa0]
inc dword [eax]
cmp dword [eax], 0
jle 0x10019549
or dword [esp + 0x1dc], 0xffffffff
lea ecx, [esp + 0xa0]
call fcn.10017898
push esi
lea ecx, [esp + 0x108]
call fcn.10016f88
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], 0x9c41
mov dword [esp + 0xc], ebx
jmp 0x1001963f
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x104]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001962d
dec dword [esp + 0x10]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x10], ebx
jmp 0x1001968c
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019673
push ebx
push ebx
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x104]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jle 0x10019655
lea ecx, [esp + 0x104]
call fcn.10017898
mov dword [esp + 0x20], 0x2071b18d
mov dword [esp + 0x28], 0xffffffff
cmp dword [esp + 0x20], ebx
je 0x100198a1
mov dword [esp + 0xc], ebx
jmp 0x100196cf
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x38], 5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x100196bf
mov dword [esp + 0x38], 0xb
jmp 0x10019711
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100196fb
push ebx
push ebx
push 0x148
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001970d
push ebx
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
dec dword [esp + 0x38]
cmp dword [esp + 0x38], 0xffffffea
jne 0x100196e0
mov byte [esp + 0x16], bl
lea ecx, [esp + 0x134]
mov dword [esp + 0x10], 1
push esi
call fcn.10016f88
mov dword [esp + 0xc], ebx
jmp 0x1001974d
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x134]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10019737
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, 5
mov eax, dword [esp + 0x10]
setl cl
xor edx, edx
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0xffffffff
setne al
inc eax
neg eax
sbb eax, eax
inc eax
inc eax
jne 0x10019788
cmp dword [esp + 0x10], ebx
jne 0x10019788
xor edx, edx
mov eax, ebx
inc edx
jmp 0x1001978d
xor edx, edx
inc edx
mov eax, edx
mov esi, dword [esp + 0x134]
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x10]
sete cl
add eax, 0xfffffffe
add eax, ecx
mov dword [esi + 4], 0xfffffffe
cmp eax, dword [esp + 0x10]
je 0x100197b5
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100197c3
mov ecx, ebx
cmp dword [esp + 0x10], ebx
je 0x100197c5
mov ecx, edx
mov eax, dword [esp + 0x10]
add eax, 0x7a42ad5e
add eax, ecx
je 0x10019838
mov dword [esp + 0xc], 0xa885c82f
mov dword [esp + 0x18], 0x17854c3e
mov dword [esp + 0x20], edx
dec dword [esp + 0xc]
je 0x100197f3
mov ecx, edx
cmp dword [esi + 4], ebx
jne 0x100197f5
mov ecx, ebx
mov eax, dword [esi + 4]
imul eax, ecx
test eax, eax
jne 0x10019810
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x10], eax
jg 0x10019810
cmp dword [esi + 4], ebx
jne 0x10019810
mov edx, ebx
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x18]
setne cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [esp + 0x18]
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x20]
mov dword [esi + 4], edx
jmp 0x10019858
mov dword [esp + 0xc], 0x1d70
mov dword [esp + 0x20], 0x24d8f3b1
mov dword [esp + 0xc], 0xae69ed99
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001987e
push ebx
push 0x2091
push 0x884
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
lea ecx, [esp + 0x134]
call fcn.10017898
cmp byte [esp + 0x16], 0
je 0x10019ced
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x10019ced
mov dword [esp + 0x10], 0x76820624
lea ecx, [esp + 0xec]
push 1
call fcn.10016f88
mov dword [esp + 0x18], 0x79c4185a
mov dword [esp + 0xc], ebx
jmp 0x100198db
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xec]
mov dword [eax + ecx*4], 0xf55e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x100198c5
mov dword [esp + 0x10], ebx
jmp 0x100198f2
cmp dword [esp + 0x10], ebx
jne 0x100198f9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 9
jge 0x100198e8
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x100199b6
mov dword [esp + 0xc], 6
mov dword [esp + 0x20], 0xffffffff
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xec]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], 0xffffffed
jmp 0x100199a5
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 0xfffffffc
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], ebx
jmp 0x1001999a
mov dword [esp + 0xc], 0xffffffe7
jmp 0x1001998f
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp eax, 0x8064
mov eax, dword [esp + 0x24]
setg cl
xor edx, edx
cmp ecx, 0x193c1de6
setge dl
sub eax, 7
neg eax
sbb eax, eax
inc eax
imul edx, eax
mov dword [esp + 0x28], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xffffffee
jg 0x1001995f
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0xd
jge 0x10019955
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xb
je 0x1001993b
dec dword [esp + 0x10]
jns 0x10019907
lea ecx, [esp + 0xec]
call fcn.10017898
push esi
lea ecx, [esp + 0x114]
call fcn.10016f88
push 1
lea ecx, [esp + 0xfc]
mov dword [esp + 0x1e0], 3
call fcn.10016f88
mov dword [esp + 0x1c], 0xfd52a42b
mov dword [esp + 0xc], ebx
jmp 0x10019a0c
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0x9f9b3198
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x100199f6
mov eax, dword [esp + 0xf8]
lea ecx, [esp + 0xf8]
mov dword [eax], 0xffffffe3
call fcn.10017898
xor ecx, ecx
mov dword [esp + 0x10], ebx
inc ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x24], 0xe8b01213
mov dword [esp + 0x18], ebx
jmp 0x10019a55
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x44], 0x5683
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10019a45
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x10], ebx
jl 0x10019be6
mov eax, 0xc2076acb
mov dword [esp + 0xc4], eax
xor edx, edx
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], eax
mov dword [esp + 0xd0], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x10]
imul ecx, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x44]
cmp eax, ecx
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
sub edx, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x44]
cmp edx, eax
mov eax, dword [esp + 0x44]
setne cl
sub ecx, eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x20], ecx
xor ecx, ecx
cmp dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
sete cl
xor edx, edx
mov eax, dword [esp + eax*4 + 0x44]
cmp eax, ecx
mov eax, dword [esp + 0xc]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x10]
setne cl
cmp ecx, dword [esp + eax*4 + 0x44]
jl 0x10019b08
cmp dword [esp + 0xc4], ebx
jne 0x10019b08
mov eax, ebx
jmp 0x10019b0b
xor eax, eax
inc eax
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], 1
jge 0x10019b33
cmp dword [esp + 0x48], ebx
jne 0x10019b33
mov byte [esp + 0x16], bl
cmp byte [esp + 0x16], 0
je 0x10019b51
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
jmp 0x10019b51
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], 0xfffffffc
cmp dword [esp + 0x20], ebx
jne 0x10019be6
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0x19
jmp 0x10019bd0
mov dword [esp + 0xc], ebx
jmp 0x10019b70
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1b4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x10019b61
mov dword [esp + 0xc], ebx
jmp 0x10019bb3
mov dword [esp + 0x18], ebx
jmp 0x10019b96
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xac], 0xfffffff7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x10019b83
mov eax, dword [esp + 0x24]
mov dword [esp + 0xac], eax
mov dword [esp + 0x1b8], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jle 0x10019b7d
mov byte [esp + 0x16], bl
cmp byte [esp + 0x16], 0
je 0x10019bcc
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xfffffff0
je 0x10019b5b
dec dword [esp + 0x10]
mov eax, 0xc2076acb
jns 0x10019a6e
lea eax, [esp + 0x1a0]
push eax
lea eax, [esp + 0x114]
push eax
push ebx
call fcn.1001ac67
add esp, 0xc
lea ecx, [esp + 0xd4]
push esi
call fcn.10016f88
mov dword [esp + 0x10], ebx
jmp 0x10019c21
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x19c], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x10019c12
mov dword [esp + 0x10], ebx
jmp 0x10019c44
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xd4]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10019c2e
mov esi, dword [esp + 0xd4]
mov dword [esi + 4], ebx
mov byte [esp + 0x16], bl
cmp byte [esp + 0x16], 0
je 0x10019c7a
push ebx
push 0x1de
push 0x1698
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
inc dword [esi + 4]
cmp dword [esi + 4], 0
jle 0x10019c54
mov byte [esp + 0x16], bl
cmp byte [esp + 0x16], 0
je 0x10019cb2
push 0x1704
push 0x3df
push 0x1f50
push 0x2694
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
lea ecx, [esp + 0xd4]
call fcn.10017898
mov eax, dword [esp + 0x110]
xor edx, edx
mov ecx, dword [eax + 4]
lea eax, [ecx + 0x51c76d7b]
cmp eax, ecx
lea ecx, [esp + 0x110]
setg dl
mov dword [esp + 0x28], edx
or dword [esp + 0x1dc], 0xffffffff
call fcn.10017898
mov eax, dword [esp + 0x4c]
cmp dword [eax + 0x10], ebx
jne 0x10019cfd
xor al, al
jmp 0x1001a606
mov dword [esp + 0x20], 1
lea ecx, [esp + 0x128]
push 3
call fcn.10016f88
mov dword [esp + 0xc], ebx
jmp 0x10019d2f
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], 5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10019d19
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x128]
mov dword [eax], ecx
mov byte [esp + 0x16], bl
cmp byte [esp + 0x16], 0
je 0x10019d62
push ebx
push 0x160a
push 0xd71
call edi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
lea ecx, [esp + 0x128]
call fcn.10017898
lea eax, [esp + 0x60]
push eax
push ebx
push 0x767d
push 0x1605
call fcn.1001c6c0
add esp, 0x10
xor ecx, ecx
inc ecx
mov dword [esp + 0x24], ecx
push 2
pop edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0xc], 0xc5021c3a
mov dword [esp + 0x20], 0x1a7ecc24
mov dword [esp + 0x1c], 0xddcd1665
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], 0xd95da228
mov dword [esp + 0x1c], 0x7f609b2b
mov dword [esp + 0xc], 0x885ea6ed
mov dword [esp + 0x1c], 0xe7528ace
mov dword [esp + 0x28], 0x8ea5f34b
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], 0x753f3ac9
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0x7b30498
mov dword [esp + 0x1c], 0xfffffffd
push 8
pop eax
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x2c], 0xcc321a07
mov dword [esp + 0x10], ebx
jmp 0x10019e34
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x198], 0xcce45d76
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10019e21
mov dword [esp + 0x10], ebx
jmp 0x10019e53
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x90], 0x34ccbb24
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10019e40
mov eax, dword [esp + 0x20]
xor edx, edx
cmp eax, 0xfffffff9
mov eax, dword [esp + 0x28]
push 2
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, 0xfddf
setg al
xor edx, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
inc dword [esp + 0x98]
mov esi, dword [esp + 0x98]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
cmp eax, 0xa1804524
setne dl
xor ecx, ecx
sub edx, dword [esp + 0x40]
mov eax, dword [esp + 0x1c]
cmp eax, edx
mov eax, dword [esp + 0x28]
setge cl
xor edx, edx
cmp esi, ecx
pop esi
setle dl
xor ecx, ecx
cmp eax, edx
push esi
setl cl
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov eax, dword [esp + 0x10]
sub eax, esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, 0x5d07a051
setg cl
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xe4]
mov dword [esp + 0x1c], 0x52cb1363
mov dword [esp + 0x14], ebx
call fcn.10016f88
mov dword [esp + 0x1dc], 4
mov dword [esp + 0x24], 0x18c84b7b
mov dword [esp + 0x2c], ebx
mov dword [esp + 0xc], ebx
jmp 0x10019f3f
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xe0]
mov dword [eax + ecx*4], 7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10019f29
mov byte [esp + 0x16], bl
cmp byte [esp + 0x16], 0
je 0x10019f57
push ebx
call dword [sym.imp.USER32.dll_CharNextW]
cmp dword [esp + 0x18], 0xcf54c3c6
ja 0x1001a05d
xor eax, eax
lea ecx, [esp + 0x140]
inc eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x20], 0xfffffffd
push eax
call fcn.10016f88
mov dword [esp + 0xc], ebx
jmp 0x10019fa9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x10019f97
cmp dword [esp + 0x3c], ebx
je 0x10019fba
mov eax, dword [esp + 0x3c]
inc dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0xe0]
mov dword [eax], ecx
jne 0x10019fdf
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x28], ebx
jne 0x10019fdf
mov eax, ebx
jmp 0x10019fe2
xor eax, eax
inc eax
mov ecx, dword [esp + 0x2c]
mov edx, 0xffff
add ecx, eax
mov eax, dword [esp + 0x140]
imul ecx, dword [eax]
xor eax, eax
cmp ecx, edx
mov ecx, dword [esp + 0x28]
setne al
xor edx, edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
setne dl
sub ecx, eax
xor eax, eax
cmp edx, ecx
setg al
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x10], eax
jg 0x1001a034
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov byte [esp + 0x16], bl
cmp byte [esp + 0x16], 0
je 0x1001a04f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [esp + 0x140]
call fcn.10017898
jmp 0x1001a079
mov dword [esp + 0xc], 0x79a97a8d
mov dword [esp + 0x1c], 0xffffffff
dec dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
or dword [esp + 0x1dc], 0xffffffff
lea ecx, [esp + 0xe0]
call fcn.10017898
mov eax, 0xb4e1a362
lea ecx, [esp + 0x180]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x1c], 0x6b0f7383
mov dword [esp + 0x1c], 0x964a53aa
mov dword [esp + 0x1c], 0xfffffff6
push 1
call fcn.10016f88
mov dword [esp + 0x1dc], 5
lea ecx, [esp + 0x174]
mov dword [esp + 0x1c], 0x2b3b7bed
mov dword [esp + 0x1c], ebx
push 3
call fcn.10016f88
xor edx, edx
mov dword [esp + 0x20], 0x21f7d967
mov dword [esp + 0x10], ebx
inc edx
jmp 0x1001a120
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x180]
mov dword [eax + ecx*4], 0x6580849f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001a10a
mov dword [esp + 0x10], ebx
jmp 0x1001a13e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x174]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001a12c
inc dword [esp + 0x20]
lea ecx, [esp + 0x174]
call fcn.10017898
or dword [esp + 0x1dc], 0xffffffff
lea ecx, [esp + 0x180]
call fcn.10017898
mov dword [esp + 0x20], 0x5f84255e
mov dword [esp + 0x1c], 0x656540f2
mov dword [esp + 0x1c], 1
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x16], bl
cmp byte [esp + 0x16], 0
je 0x1001a19d
push ebx
push 0x5939
call fcn.1001a7f8
pop ecx
pop ecx
mov eax, 0xffff
cmp dword [esp + 0x80], ebx
je 0x1001a27c
mov dword [esp + 0xc], 0x28405cef
mov dword [esp + 0x28], 0x90ae735
mov dword [esp + 0x2c], 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 0xffffffff
mov byte [esp + 0x16], bl
cmp byte [esp + 0x16], 0
je 0x1001a1e5
push ebx
call fcn.1001a6dd
pop ecx
mov edx, dword [esp + 0xc]
add edx, 0xa165
sub edx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
neg edx
push 8
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x88]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, esi
pop ecx
setne al
cmp ecx, eax
mov eax, dword [esp + 0xc]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
cmp ecx, dword [esp + 0x20]
jl 0x1001a24b
cmp dword [esp + 0x80], ebx
je 0x1001a24b
xor ecx, ecx
inc ecx
jmp 0x1001a24d
mov ecx, ebx
mov eax, dword [esp + 0xc]
add eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x80]
mov eax, dword [esp + 0x80]
mov eax, dword [esp + 0x1c]
imul eax, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
jmp 0x1001a2b7
mov dword [esp + 0x98], eax
mov byte [esp + 0x16], bl
cmp byte [esp + 0x16], 0
je 0x1001a2a1
push 0x491f
push ebx
push 0x3b87
call fcn.1001a789
add esp, 0xc
push 0x7df9
lea eax, [esp + 0x9c]
push ebx
push eax
call fcn.1001a9fb
add esp, 0xc
mov dword [esp + 0x20], 0x7c7c
push 8
pop eax
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 0xc], ebx
jmp 0x1001a312
mov dword [esp + 0x18], ebx
jmp 0x1001a307
mov byte [esp + 0x16], bl
cmp byte [esp + 0x16], 0
je 0x1001a303
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffea
jg 0x1001a2ee
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x19
jne 0x1001a2e8
mov eax, dword [esp + 0x4c]
cmp dword [eax + 0x14], 0x10
jb 0x1001a327
mov ecx, dword [eax]
jmp 0x1001a329
mov ecx, eax
or edi, 0xffffffff
cmp dword [eax + 0x14], 0x10
mov dword [esp + 0x40], ecx
jb 0x1001a33a
mov edx, dword [eax]
jmp 0x1001a33c
mov edx, eax
mov eax, dword [eax + 0x10]
add eax, edx
cmp ecx, eax
je 0x1001a57d
push 1
lea ecx, [esp + 0x6c]
call fcn.10016f88
lea eax, [esp + 0x68]
mov dword [esp + 0x1dc], 6
push eax
push ebx
lea eax, [esp + 0x178]
mov dword [esp + 0x24], 0xfd52a42b
push 0x4d75
push eax
call fcn.1001cddc
mov eax, dword [esp + 0x78]
add esp, 0x10
mov dword [eax], 0xffffffe3
mov eax, dword [esp + 0x68]
cmp dword [eax], 0xe
jl 0x1001a433
push 8
pop esi
mov dword [esp + 0xc], ebx
jmp 0x1001a3b2
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x30], 0xf506e60b
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x1001a3a2
mov dword [esp + 0x30], ebx
jmp 0x1001a417
mov dword [esp + 0xc], 0x3a3f
xor edx, edx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x30]
cmp eax, ecx
setl dl
cmp edx, 0x5b1510af
jle 0x1001a3e2
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
mov eax, dword [esp + 0x30]
add ecx, esi
cmp ecx, eax
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x68]
setge dl
imul ecx, dword [eax]
imul ecx, edx
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x30]
dec dword [esp + 0x30]
cmp dword [esp + 0x30], edi
jle 0x1001a3bf
mov eax, dword [esp + 0x68]
inc dword [eax]
mov eax, dword [esp + 0x68]
cmp dword [eax], 0xe
jge 0x1001a39c
push 2
pop esi
lea ecx, [esp + 0x68]
mov dword [esp + 0x1dc], edi
call fcn.10017898
mov eax, dword [esp + 0x40]
mov al, byte [eax]
cmp al, 0x30
jl 0x1001a47c
cmp al, 0x39
jg 0x1001a47c
push 0x58b8
lea eax, [esp + 0x64]
push eax
push 0x63e1
lea eax, [esp + 0x4c]
push ebx
push eax
call fcn.1001a964
mov ecx, dword [esp + 0x54]
add esp, 0x14
mov eax, dword [esp + 0x4c]
inc ecx
jmp 0x1001a32c
mov dword [esp + 0x1c], 0x6b0f7383
lea ecx, [esp + 0x158]
mov dword [esp + 0x1c], 0x964a53aa
mov dword [esp + 0x1c], 0xfffffff6
push 1
call fcn.10016f88
mov dword [esp + 0x1dc], 7
lea ecx, [esp + 0x18c]
mov dword [esp + 0x1c], 0x2b3b7bed
mov dword [esp + 0x1c], ebx
push 3
call fcn.10016f88
push 8
pop eax
mov byte [esp + 0x1dc], al
lea eax, [esp + 0x158]
push eax
lea eax, [esp + 0x68]
mov dword [esp + 0x24], 0x21f7d967
push ebx
push eax
call fcn.1001c950
lea eax, [esp + 0x70]
push eax
push 0x35b4
lea eax, [esp + 0x1a0]
push eax
push 0x491b
push ebx
call fcn.1001c9c8
add esp, 0x20
lea ecx, [esp + 0x18c]
inc dword [esp + 0x20]
call fcn.10017898
lea ecx, [esp + 0x158]
mov dword [esp + 0x1dc], edi
call fcn.10017898
mov eax, dword [esp + 0x60]
push 0x5de9
push 0x34fb
push ebx
mov dword [eax], ebx
mov dword [esp + 0x28], 0xa049fe38
call fcn.1001d844
push 0x4929
push 0x4b54
push 0x1b5
push ebx
lea eax, [esp + 0x53]
mov byte [esp + 0x53], bl
push eax
push 0x27af
push 0x5f1a
call fcn.1001a82a
add esp, 0x28
jmp 0x10019cf6
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x164]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], 0x2a2c7c8a
mov dword [esp + 0x1c], 0xa1bf2b29
mov dword [esp + 0x1c], 0xf09cc25f
push esi
call fcn.10016f88
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0xab5457d6
mov dword [esp + 0x10], ebx
jmp 0x1001a5cb
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1c4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001a5bc
mov dword [esp + 0x10], ebx
jmp 0x1001a5ee
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x164]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001a5d8
inc dword [esp + 0x20]
lea ecx, [esp + 0x164]
call fcn.10017898
mov al, 1
mov ecx, dword [esp + 0x1d4]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret