Function at 0x1001cb46
Capabilities:
Enumerate gui resources
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x34], edx
xor ecx, ecx
mov dword [ebp - 0x18], 0x336de018
inc ecx
xor ebx, ebx
mov dword [ebp - 0xc], ecx
push edi
mov dword [ebp - 4], ebx
jmp 0x1001cb75
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x54], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001cb6b
push 3
mov dword [ebp - 4], ebx
pop edx
jmp 0x1001cb8d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x6c], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001cb83
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x54]
sub eax, 0x50a4049a
jne 0x1001cbb1
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], ebx
jl 0x1001cbec
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x1001cbe1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
dec dword [ebp - 0xc]
jns 0x1001cbd1
xor ecx, ecx
push 3
inc ecx
pop edx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], 0xe81a7ecc
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 4]
jne 0x1001cc09
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 4]
je 0x1001cc09
mov eax, dword [ebp - 4]
mov eax, ecx
cmp dword [ebp - 4], ebx
jne 0x1001cc12
mov eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, dword [ebp - 0x14]
jle 0x1001cc58
mov dword [ebp - 0xc], ebx
jmp 0x1001cc33
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x10c], 0x6ddcd166
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x1001cc22
mov dword [ebp - 0x14], ebx
jmp 0x1001cc4e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x10c], 0xbdbdf7cd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1001cc3d
jmp 0x1001cd3c
mov dword [ebp - 0x1c], 0xd8ff8cd3
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 4], ebx
jmp 0x1001cc7c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x13c], 0x94486cae
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001cc6b
mov dword [ebp - 4], ebx
jmp 0x1001cc97
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xa0], 0xfffffffb
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001cc86
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x1001ccb0
push 0xeaf
push ebx
call edi
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ebx
jmp 0x1001cd33
mov dword [ebp - 0x10], ebx
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
setge bl
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
cmp ebx, ecx
setle dl
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 1
setge al
xor ecx, ecx
cmp eax, 0xf4c6
setne cl
xor ebx, ebx
mov dword [ebp - 0x13c], ecx
test ecx, ecx
je 0x1001cd1d
cmp dword [ebp - 0x10], ebx
je 0x1001cd1d
xor ecx, ecx
inc ecx
jmp 0x1001cd1f
mov ecx, ebx
mov eax, dword [ebp - 0x10]
sub eax, ecx
xor ecx, ecx
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x10]
inc dword [ebp - 4]
inc ecx
cmp dword [ebp - 4], ecx
je 0x1001ccb5
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, 0xb14898d0
mov dword [ebp - 4], 0x1c1ec2db
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], 0xc309ab83
mov dword [ebp - 0x20], 0x3ec3e1b8
push 8
pop edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ebx
jmp 0x1001cd9f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xf4], 0xa049fe38
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x1001cd8e
push 3
mov dword [ebp - 4], ebx
pop edx
jmp 0x1001ce04
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], edx
cmp dword [ebp - 4], ebx
je 0x1001cdd1
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xf4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], 0x2d517a85
mov eax, dword [ebp - 4]
push 3
mov ecx, dword [ebp + eax*4 - 0xf4]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
setg dl
mov dword [ebp - 0x18], edx
inc dword [ebp - 4]
pop edx
push 1
pop ecx
cmp dword [ebp - 4], edx
jle 0x1001cdad
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x18], 0xb7f609b2
mov dword [ebp - 4], ebx
jmp 0x1001ce30
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x90], 0xb9b55bb2
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001ce1f
mov dword [ebp - 4], ebx
jmp 0x1001ce48
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x60], 0xe2236432
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001ce3a
mov dword [ebp - 0x5c], ebx
cmp dword [ebp - 0x5c], 2
jg 0x1001ce9b
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x8c]
sub edx, eax
mov eax, dword [ebp - 0x58]
cmp edx, eax
mov eax, dword [ebp - 0x90]
setl cl
xor edx, edx
cmp ecx, 0xfffffffb
setge dl
sub edx, eax
mov dword [ebp - 0x18], edx
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 2
jle 0x1001ce56
push 3
pop edx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
jmp 0x1001ceb4
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x144], 0x26bdde0b
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001cea3
mov dword [ebp - 4], ebx
jmp 0x1001ced0
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x84], 0xbe8e56f9
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001cebf
mov dword [ebp - 0x80], 1
cmp dword [ebp - 0x80], ebx
jl 0x1001cf34
mov dword [ebp - 0xc], 0x23ed15d
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001cef9
push ebx
push ebx
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0xc], ebx
jmp 0x1001cf29
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001cf26
push ebx
push 0x12c3
push 0xbc8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
jle 0x1001cefe
dec dword [ebp - 0x80]
jns 0x1001cee1
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001cf4a
push ebx
push 0x3df
push ebx
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov dword [ebp - 0x14], 0xd8169b41
mov dword [ebp - 0x18], 0x7b364fe
mov dword [ebp - 0xc], ebx
jmp 0x1001cf6b
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2c], 0x48261f9c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
jl 0x1001cf5d
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], ebx
jl 0x1001d11b
mov dword [ebp - 4], 0x37d45db3
mov dword [ebp - 0x18], 0x11e9056f
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
jl 0x1001d112
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], 0x15e4
mov dword [ebp - 0x18], 0xe4f9f010
mov dword [ebp - 0x1c], 0x23668f78
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0xc46d767c
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x18], eax
je 0x1001cff5
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
cmp eax, 1
setg cl
cmp ecx, dword [ebp - 4]
jle 0x1001d079
mov dword [ebp - 0x10], ebx
jmp 0x1001d024
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xac], 0x5e3164c1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001d013
mov eax, dword [ebp - 0xac]
xor edx, edx
cmp eax, 0x6dc7
mov eax, dword [ebp - 0xa8]
setle dl
xor ecx, ecx
cmp eax, edx
mov edx, dword [ebp - 0x2c]
setge cl
sub edx, ecx
neg edx
sbb edx, edx
xor eax, eax
add edx, 9
cmp edx, 0xf7f2
setg al
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp eax, edx
setge cl
mov dword [ebp - 0x1c], ecx
jmp 0x1001d109
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0xbb39d90d
mov dword [ebp - 0x10], ebx
jmp 0x1001d09d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x98], 0x6aef
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001d08c
mov eax, dword [ebp - 0x98]
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
setle cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0x58db2edf
mov dword [ebp - 0x18], 0xb43c6211
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
sub edx, eax
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x46fedea8
setl cl
xor edx, edx
cmp eax, ecx
setg dl
xor eax, eax
cmp edx, 0x519c81b9
sete al
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x1c], ebx
jne 0x1001d112
dec dword [ebp - 4]
jns 0x1001cf9a
dec dword [ebp - 0xc]
jns 0x1001cf7d
mov dword [ebp - 0x14], ebx
jmp 0x1001d141
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001d13e
push 0x712b
push 0x6d
push 0x58de
push ebx
call fcn.1002714c
add esp, 0x10
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffeb
jle 0x1001d120
mov dword [ebp - 0x20], 0x3b91
mov dword [ebp - 0x20], 0x8d4081c2
mov dword [ebp - 0x18], 9
mov dword [ebp - 4], ebx
jmp 0x1001d172
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x160], 0xe7937d8e
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1001d161
mov dword [ebp - 4], ebx
jmp 0x1001d18e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x170], 1
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x1001d17d
inc dword [ebp - 0x18]
cmp dword [esi + 0x10], ebx
jne 0x1001d1a3
xor al, al
jmp 0x1001d828
mov dword [ebp - 4], 0xf6af1124
mov dword [ebp - 0x20], 0x89226c31
mov dword [ebp - 4], 6
jmp 0x1001d1f4
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001d1ca
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor edx, edx
imul ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, ecx
setle dl
xor ecx, ecx
cmp edx, 0x91
setg cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
mov dword [ebp - 0x20], eax
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff3
jg 0x1001d1ba
mov eax, dword [ebp - 0x34]
mov dword [eax], ebx
cmp dword [esi + 0x14], 0x10
jb 0x1001d209
mov ecx, dword [esi]
jmp 0x1001d20b
mov ecx, esi
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x38], ecx
jb 0x1001d218
mov edx, dword [esi]
jmp 0x1001d21a
mov edx, esi
mov eax, dword [esi + 0x10]
add eax, edx
cmp ecx, eax
je 0x1001d457
mov al, byte [ecx]
cmp al, 0x30
jl 0x1001d3ae
cmp al, 0x39
jg 0x1001d3ae
mov dword [ebp - 4], 1
mov dword [ebp - 0x24], 0xe81a7ecc
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 4]
jne 0x1001d25a
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 4]
je 0x1001d25a
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], ebx
je 0x1001d264
xor eax, eax
inc eax
jmp 0x1001d266
mov eax, ebx
cmp eax, dword [ebp - 0x24]
jle 0x1001d2a9
push 3
mov dword [ebp - 0xc], ebx
pop ecx
jmp 0x1001d284
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x130], 0x6ddcd166
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001d273
mov dword [ebp - 0x24], ebx
jmp 0x1001d29f
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x130], 0xbdbdf7cd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x1001d28e
jmp 0x1001d38a
mov dword [ebp - 0x18], 0xd8ff8cd3
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 4], ebx
jmp 0x1001d2cd
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x100], 0x94486cae
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1001d2bc
mov dword [ebp - 4], ebx
jmp 0x1001d2e9
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xd4], 0xfffffffb
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001d2d8
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001d300
push 0xeaf
push ebx
call edi
mov dword [ebp - 4], ebx
jmp 0x1001d380
mov dword [ebp - 0x10], ebx
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
setge bl
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
cmp ebx, ecx
setle dl
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 1
setge al
xor ecx, ecx
cmp eax, 0xf4c6
setne cl
xor ebx, ebx
mov dword [ebp - 0x100], ecx
test ecx, ecx
je 0x1001d36d
cmp dword [ebp - 0x10], ebx
je 0x1001d36d
xor ecx, ecx
inc ecx
jmp 0x1001d36f
mov ecx, ebx
mov eax, dword [ebp - 0x10]
sub eax, ecx
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x10]
inc dword [ebp - 4]
cmp dword [ebp - 4], 1
je 0x1001d305
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.1001fbfb
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
call fcn.1001d86d
mov ecx, dword [ebp - 0x38]
add esp, 0x14
inc ecx
jmp 0x1001d20b
mov eax, dword [ebp - 0x34]
mov dword [eax], ebx
mov dword [ebp - 0xc], 0xb7c7ce53
mov dword [ebp - 0xc], ebx
jmp 0x1001d3d0
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x124], 7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001d3bf
push 2
mov dword [ebp - 0xc], ebx
pop esi
jmp 0x1001d42d
mov dword [ebp - 0x28], 0x74dd032
mov dword [ebp - 0x78], 0xfffffffb
mov dword [ebp - 0x28], ebx
jmp 0x1001d414
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001d405
push 0xf6e
call dword [sym.imp.USER32.dll_GetKeyState]
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x124], ebx
jne 0x1001d419
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x1001d3f1
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.1001f18b
add esp, 0xc
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jle 0x1001d3de
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001d19c
push ebx
push 0x4528
push 0x213a
call fcn.1001f146
add esp, 0xc
jmp 0x1001d19c
push 2
mov dword [ebp - 4], 0x622ba394
mov dword [ebp - 4], ebx
pop esi
jmp 0x1001d474
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x74], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001d466
mov dword [ebp - 4], ebx
jmp 0x1001d48f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xbc], 0x7525d2d9
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001d47e
mov dword [ebp - 4], ebx
jmp 0x1001d4f2
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001d4ad
push 0x1c7d
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
mov eax, dword [ebp - 4]
mov ecx, 0x2337
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 4]
mov edx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 4]
sub ecx, eax
xor eax, eax
cmp edx, ecx
setle al
xor ecx, ecx
cmp eax, 0x63e31551
setne cl
xor eax, eax
cmp ecx, 0xfffffffc
setge al
imul eax, dword [ebp - 4]
mov dword [ebp - 0xbc], eax
inc dword [ebp - 4]
xor ecx, ecx
inc ecx
cmp dword [ebp - 4], ecx
jle 0x1001d499
push 0xfffffffffffffffd
mov dword [ebp - 0x14], ebx
pop edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0xc], 0xfffffff8
mov dword [ebp - 4], ebx
jmp 0x1001d519
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x4c], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001d50f
mov dword [ebp - 4], ebx
jmp 0x1001d52d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x44], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x1001d523
mov dword [ebp - 4], ebx
jmp 0x1001d544
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x154], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x1001d537
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jg 0x1001d557
cmp dword [ebp - 0x14], ebx
jne 0x1001d559
mov ecx, ebx
xor eax, eax
cmp ecx, 0x4952
setge al
add eax, dword [ebp - 0x14]
jne 0x1001d56c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
setl bl
xor edx, edx
add ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ebx, eax
mov eax, dword [ebp - 0xc]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor ebx, ebx
cmp ecx, dword [ebp - 0xc]
jge 0x1001d676
cmp dword [ebp - 0x14], ebx
je 0x1001d676
push 3
mov dword [ebp - 4], ebx
pop edx
jmp 0x1001d5c2
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x118], 0x843c6bcf
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001d5b1
mov dword [ebp - 4], ebx
jmp 0x1001d5dd
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xb4], 8
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001d5cc
mov dword [ebp - 0x14], ebx
jmp 0x1001d654
mov dword [ebp - 0x18], 0x51814487
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x114]
sub eax, 0xfffffff7
neg eax
sbb eax, eax
inc eax
cmp edx, eax
sbb eax, eax
neg eax
cmp eax, 0xffffffff
jge 0x1001d622
cmp dword [ebp - 0xc], ebx
je 0x1001d622
xor eax, eax
inc eax
jmp 0x1001d624
mov eax, ebx
mov dword [ebp - 0xb4], eax
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
push 3
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
pop edx
setge cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jle 0x1001d5e7
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x1001d741
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
jmp 0x1001d741
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], 0x6e219e4e
mov dword [ebp - 0x14], ebx
jmp 0x1001d737
mov dword [ebp - 0xc], ebx
jmp 0x1001d6a8
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xe4], 0x8004c3d8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x1001d697
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001d6be
push ebx
call fcn.1001fc88
pop ecx
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4c], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
cmp ecx, eax
setle dl
mov dword [ebp - 0x18], edx
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x4c]
mov dword [ebp - 0x1c], 0xfff7
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 4]
cmp eax, 1
mov eax, dword [ebp - 0x44]
setle dl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xdc]
setle cl
add eax, ecx
mov ecx, dword [ebp - 0xd8]
add ecx, eax
neg ecx
mov dword [ebp - 0x14c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jle 0x1001d692
mov dword [ebp - 0x10], 0xb999fb02
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], 0x2b7b
mov dword [ebp - 0x20], 0x531e
mov dword [ebp - 0x1c], 0x9606
mov dword [ebp - 0x1c], 0x8f497c3
mov dword [ebp - 4], ebx
jmp 0x1001d77a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x30], 0x89a9b8fa
inc dword [ebp - 4]
cmp dword [ebp - 4], 1
jl 0x1001d76c
mov dword [ebp - 4], ebx
jmp 0x1001d793
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x40], 0x707e294
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001d785
cmp dword [ebp - 0x10], ebx
je 0x1001d7b8
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40]
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
sete cl
xor ebx, ebx
mov dword [ebp - 0x30], ecx
inc ebx
mov eax, dword [ebp - 0x40]
mov ecx, ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
neg ecx
cmp ecx, 0xffff
sbb ecx, ecx
xor edx, edx
inc ecx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setl cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x10]
add eax, esi
cmp eax, ecx
mov al, bl
setne dl
add edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret