Function at 0x1001bb1e
Capabilities:
Create thread
Delete file
Delete registry key
Get common file path
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], 0x8901f2c
push 1
mov edi, edx
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xc], ebx
pop esi
jmp 0x1001bb50
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xdc], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x1001bb43
mov dword [ebp - 4], esi
cmp dword [ebp - 4], ebx
jl 0x1001bc02
mov dword [ebp - 0xc], 0xfffffffc
mov dword [ebp - 0xc], ebx
jmp 0x1001bb7f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xbc], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001bb6e
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 4]
cmp dword [ebp - 0xbc], ebx
je 0x1001bbb7
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xdc]
mov eax, dword [ebp - 4]
cmp eax, ecx
mov eax, dword [ebp - 0xb8]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], ebx
jl 0x1001bbf9
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x1001bbf4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
dec dword [ebp - 0xc]
jns 0x1001bbe5
dec dword [ebp - 4]
jns 0x1001bb62
mov dword [ebp - 4], 2
mov dword [ebp - 0x3c], 0xffff
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x40], 0xa67d
mov dword [ebp - 0xc], ebx
jmp 0x1001bc3b
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x4c], 0xa8e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x1001bc2d
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
jl 0x1001bd19
mov dword [ebp - 0x30], 0xd947597a
mov dword [ebp - 0x24], 0xc9d94031
mov dword [ebp - 0x10], 0x4186
mov dword [ebp - 0x30], 0x9b8842b4
mov dword [ebp - 0xc], ebx
jmp 0x1001bc7e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xe0], 0xa4d9a54e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x1001bc6d
mov eax, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x4c]
sub eax, 0xcac3
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], esi
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 0xffff
sbb eax, eax
xor edx, edx
lea ecx, [eax + 0xa]
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 4]
setg dl
cmp dword [ebp + eax*4 - 0x4c], edx
je 0x1001bce0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x4c]
test eax, eax
sete cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x3c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
dec dword [ebp - 4]
jns 0x1001bc4c
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x2c], 0xf2b6
sub eax, 0xbccb
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x3ae35568
mov dword [ebp - 0x38], 0x7ab61b58
mov dword [ebp - 4], 0xe76f5020
mov dword [ebp - 0xc], 0xd4309642
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x20], ebx
jmp 0x1001bd80
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x170], 0xdc85
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1001bd6f
mov dword [ebp - 4], ebx
jmp 0x1001bedf
mov dword [ebp - 0x14], esi
mov edx, esi
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x1c], 0x79a20b28
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jne 0x1001bdae
mov edx, ebx
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x164]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0xc], ebx
jne 0x1001bdfd
mov dword [ebp - 0x20], 5
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x170], 0x1540
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 4]
dec eax
imul eax, dword [ebp - 0x18]
test eax, eax
je 0x1001be57
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x30], 0xd06de21e
mov dword [ebp - 0x30], 4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xc], eax
jmp 0x1001bedc
mov dword [ebp - 0x14], ebx
jmp 0x1001be6d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x114], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001be5c
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x1001be8f
push ebx
push 0x2144
push ebx
push ebx
push 0x129
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 0x110], ebx
jne 0x1001beae
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
je 0x1001bea2
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x170]
cmp eax, esi
setg cl
xor edx, edx
imul ecx, dword [ebp - 0x18]
cmp ecx, 5
setne dl
imul eax, dword [ebp - 0x44], 0xf7c1
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 4]
push 3
pop ecx
cmp dword [ebp - 4], ecx
jle 0x1001bd8e
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], 0x92758e92
mov dword [ebp - 0x3c], 0xfffffff6
mov dword [ebp - 0x44], 0x88a9
mov dword [ebp - 0x24], 8
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x40], 0xb4ff
mov dword [ebp - 0xc], 0xfffffffe
mov dword [ebp - 4], ebx
jmp 0x1001bf3e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xa8], 0x4e1a
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x1001bf2d
mov dword [ebp - 4], ebx
jmp 0x1001bf55
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xf0], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x1001bf48
cmp dword [ebp - 0xa4], ebx
je 0x1001bfdc
mov dword [ebp - 0x24], esi
mov dword [ebp - 0xc], ebx
jmp 0x1001bf7b
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x120], 0x8edfe012
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001bf6a
mov eax, dword [ebp - 0xa4]
xor edx, edx
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x3c], esi
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setne dl
cmp edx, 0xda62
je 0x1001bfcb
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xec], esi
mov dword [ebp - 0x24], esi
jmp 0x1001c12e
mov dword [ebp - 0x28], 9
mov dword [ebp - 0xc], 0x941993e3
mov dword [ebp - 0x14], 0x120b879b
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], 6
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x1001c12e
mov dword [ebp - 0xc], ebx
jmp 0x1001c028
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x64], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x1001c01a
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0xa0]
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x64]
cmp eax, 0xfffffff9
mov eax, dword [ebp - 0x60]
setl cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sete bl
xor edx, edx
mov dword [ebp + eax*4 - 0xf0], 0xe1580eb6
mov eax, dword [ebp - 0x24]
cmp ebx, eax
mov eax, dword [ebp - 0x60]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x3c]
sub eax, 0xe1580eb6
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
cmp eax, dword [ebp - 0x20]
jl 0x1001c0b0
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xf0], ebx
mov eax, esi
jne 0x1001c0b2
mov eax, ebx
mov ecx, dword [ebp - 0x20]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x60]
cmp ecx, eax
setg dl
neg edx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
cmp eax, dword [ebp - 0x24]
je 0x1001c0e7
cmp dword [ebp - 0xe8], ebx
jne 0x1001c0e7
mov eax, ebx
cmp dword [ebp - 0xec], ebx
je 0x1001c0e9
mov eax, esi
add dword [ebp - 4], eax
xor edx, edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x44]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setg dl
sub edx, eax
sub edx, 0x18828597
mov dword [ebp - 0x1c], edx
dec dword [ebp - 0x18]
jns 0x1001c015
mov dword [ebp - 0x40], 0xd0ae446f
mov dword [ebp - 0x1c], 0xa87
mov dword [ebp - 0x1c], 0xcd53bc6e
mov dword [ebp - 4], ebx
jmp 0x1001c159
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x158], 0xc0ae9714
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001c148
mov dword [ebp - 4], ebx
jmp 0x1001c174
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1c8], 0xfffffffb
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001c163
dec dword [ebp - 0x1c]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001c1a3
push ebx
push 0xd09
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov dword [ebp - 4], ebx
mov dword [ebp - 4], ebx
jmp 0x1001c1bc
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xd4], 0xfffffff6
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1001c1ab
mov dword [ebp - 4], ebx
jmp 0x1001c1d8
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1b0], 0xfffffff9
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x1001c1c7
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001c1ef
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
mov dword [ebp - 4], ebx
jmp 0x1001c2b1
mov dword [ebp - 0x44], 0xcadfb1a
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001c213
push ebx
push 0x15e3
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0xd4], ebx
je 0x1001c2a5
mov dword [ebp - 0x2c], ebx
xor ecx, ecx
mov dword [ebp - 0x1c], 0x52027495
mov dword [ebp - 0x1c], 0x22a5bc42
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xd4]
cmp eax, 0xfffc
mov eax, dword [ebp - 4]
setne cl
xor edx, edx
cmp ecx, 0x986e
mov eax, dword [ebp + eax*4 - 0xd4]
setl dl
imul eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
neg ecx
sub eax, ecx
neg eax
sbb eax, eax
inc eax
cmp eax, 0xffff
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0xd4], edx
mov eax, dword [ebp - 4]
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x44]
mov dword [ebp - 0x1b0], ecx
jmp 0x1001c2ae
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x44], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jle 0x1001c1f7
mov dword [ebp - 4], ebx
jmp 0x1001c2d1
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x104], 0xfffffffc
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x1001c2c0
mov dword [ebp - 0xc], 0xce9d05ba
mov dword [ebp - 0x24], 0x60cbeb96
cmp dword [ebp - 0xc], 0x84217059
mov eax, dword [ebp - 0xc]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 7
mov eax, dword [ebp - 0xc]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setg dl
sub edx, 0x15f2fe73
cmp edx, 1
mov edx, dword [ebp - 0xc]
sbb eax, eax
neg eax
sub edx, eax
mov eax, dword [ebp - 0xc]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 1
setge cl
imul eax, dword [ebp - 0xc]
cmp eax, ecx
jl 0x1001c395
mov dword [ebp - 0xc], ebx
jmp 0x1001c34e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x12c], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001c33d
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001c365
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x12c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
cmp ecx, 0x45cb
setg dl
add eax, edx
mov dword [ebp - 0x12c], eax
jmp 0x1001c3a9
mov dword [ebp - 0x1c], 0xfff8
mov dword [ebp - 0x2c], 0xccedb775
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
push 2
mov dword [ebp - 4], ebx
pop edx
jmp 0x1001c3c2
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x154], 0x25f1a37c
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001c3b1
mov dword [ebp - 0xc], 0x1a
cmp dword [ebp - 0xc], 0xffffffef
jle 0x1001c9fb
mov dword [ebp - 0x14], 0xc85f70ad
mov dword [ebp - 0x1c], 0x5e314a5e
mov dword [ebp - 0x2c], 0x90c6d21c
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x24], 0xfd03b15a
mov dword [ebp - 4], ebx
jmp 0x1001c417
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x160], 0xe780ca9f
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001c406
mov dword [ebp - 4], ebx
jmp 0x1001c42e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1a0], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001c421
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 1
jne 0x1001c51a
mov dword [ebp - 0x20], 0x58d32ffa
mov dword [ebp - 0x44], 0xb28787d
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 0x1462ccd2
mov dword [ebp - 0x20], 0xfffffff6
jmp 0x1001c4ab
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x18], 0x1d
cmp dword [ebp - 0x18], ebx
jle 0x1001c494
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001c489
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jg 0x1001c478
push 2
pop edx
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001c4a8
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 2
pop edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jne 0x1001c465
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x3c], edx
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp eax, 0xffffffff
setl cl
imul eax, ecx, 0xfffd
cmp dword [ebp - 0x24], eax
jle 0x1001c4e6
cmp dword [ebp - 0x3c], ebx
je 0x1001c4e6
xor ecx, ecx
inc ecx
jmp 0x1001c4e8
mov ecx, ebx
mov eax, dword [ebp - 0x14]
sub eax, 7
neg eax
sbb eax, eax
inc eax
add eax, ecx
cmp dword [ebp - 0x160], eax
jg 0x1001c500
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x3c], 0xfffffff9
push 2
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
pop edx
je 0x1001c440
mov dword [ebp - 4], 0x1738ab65
mov dword [ebp - 0x20], ebx
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x20], ebx
jmp 0x1001c587
mov dword [ebp - 0x14], 0xd3f46721
mov dword [ebp - 0x14], ebx
jmp 0x1001c561
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x180], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001c550
dec dword [ebp - 0x17c]
mov dword [ebp - 0x14], ebx
jmp 0x1001c57e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x148], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x1001c572
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff1
jne 0x1001c544
mov dword [ebp - 0x20], 0xe7631615
mov dword [ebp - 0x14], 0x42c70bb7
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1001c5bf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc8], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001c5ae
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x1001c6e4
mov dword [ebp - 4], 0xff55e00f
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], ebx
jmp 0x1001c68b
mov dword [ebp - 0x18], 0x478c9dff
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], 0xe1a0e1c2
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], 1
cmp dword [ebp - 0x28], ebx
jne 0x1001c610
cmp dword [ebp - 4], ebx
jne 0x1001c610
mov edx, ebx
jmp 0x1001c613
xor edx, edx
inc edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
push 2
sete cl
sub ecx, 0x7857
neg ecx
pop edx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xc8]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xc8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xc8]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x18], ebx
jmp 0x1001c683
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], ebx
jl 0x1001c680
dec dword [ebp - 0x24]
dec dword [ebp - 0x28]
jns 0x1001c678
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x1001c670
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jle 0x1001c5e7
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x1001c6db
mov dword [ebp - 0x28], ebx
jmp 0x1001c6b8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0xc8]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc8], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jle 0x1001c6a1
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001c6d6
push ebx
push 0xb54
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
push 2
pop edx
dec dword [ebp - 0x18]
jns 0x1001c69c
dec dword [ebp - 0x14]
jns 0x1001c5d1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x14], 0xf7bf
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x3c], 0xfffe
mov dword [ebp - 0x24], 0xd3e99730
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x2c], 0xffffffff
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001c732
push 0xae3
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 1
setg al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
sub eax, 0xc71b
imul eax, dword [ebp - 0x24]
test eax, eax
jne 0x1001c771
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x91a8
push 2
setne cl
pop edx
sub ecx, edx
je 0x1001c798
cmp dword [ebp - 0x18], ebx
je 0x1001c798
xor eax, eax
inc eax
jmp 0x1001c79a
mov eax, ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0x2e71cc54
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x14], ebx
jmp 0x1001c7c1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8c], 0x3eb905d0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001c7b0
mov dword [ebp - 4], edx
cmp dword [ebp - 4], ebx
jl 0x1001c951
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x24], 0xfffffffe
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x38]
sub ecx, eax
mov dword [ebp - 0x104], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 4]
test eax, eax
jne 0x1001c831
cmp dword [ebp - 0x24], ebx
jne 0x1001c831
mov eax, ebx
jmp 0x1001c834
xor eax, eax
inc eax
cmp dword [ebp - 4], eax
jg 0x1001c846
cmp dword [ebp - 0xf8], ebx
je 0x1001c846
xor edx, edx
inc edx
jmp 0x1001c848
mov edx, ebx
mov eax, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x8c]
cmp eax, edx
sete cl
cmp ecx, dword [ebp - 0xc]
je 0x1001c887
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], ebx
jl 0x1001c948
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001c87d
call dword [sym.imp.USER32.dll_EndMenu]
dec dword [ebp - 0x20]
jns 0x1001c86e
jmp 0x1001c948
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], 0x68b63c96
mov eax, dword [ebp - 0x104]
sub ecx, eax
mov eax, dword [ebp - 0x18]
sub ecx, eax
imul ecx, dword [ebp - 0x18]
xor eax, eax
cmp ecx, 8
setge al
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x20], 0x2d9b
cmp dword [ebp - 0x20], ebx
je 0x1001c929
mov eax, dword [ebp - 0x40]
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov eax, dword [ebp - 4]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x8c]
cmp edx, eax
setne cl
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x10]
imul ecx, eax
cmp ecx, dword [ebp - 0xc]
jge 0x1001c8f4
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88]
xor ecx, ecx
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x8c]
mov eax, dword [ebp - 0x24]
test eax, eax
setle cl
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ebx
je 0x1001c929
cmp dword [ebp - 0x18], ebx
je 0x1001c929
xor ecx, ecx
inc ecx
jmp 0x1001c92b
mov ecx, ebx
mov eax, dword [ebp - 0xc]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
dec dword [ebp - 4]
jns 0x1001c7d3
mov eax, dword [ebp - 0x8c]
xor edx, edx
mov dword [ebp - 0x18], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setne dl
xor ecx, ecx
cmp edx, 0x14f04b5a
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
add edx, 0x64400d43
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x38]
jle 0x1001c9a2
cmp dword [ebp - 0x88], ebx
je 0x1001c9a2
xor eax, eax
inc eax
jmp 0x1001c9a4
mov eax, ebx
add eax, 0x9f13
xor ecx, ecx
test eax, eax
setle cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
sbb eax, eax
inc eax
cmp eax, 0xfffffff8
mov eax, dword [ebp - 0x8c]
sbb edx, edx
inc edx
cmp edx, eax
setne cl
cmp ecx, 0x2beb
jl 0x1001c9e2
cmp dword [ebp - 0x84], ebx
jne 0x1001c9e2
mov eax, ebx
jmp 0x1001c9e5
xor eax, eax
inc eax
mov dword [ebp - 0x150], eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffef
push 2
pop edx
jg 0x1001c3d8
push 8
pop esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x40], 0x981ff29a
mov dword [ebp - 0x10], ebx
jmp 0x1001ca1e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x198], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001ca0d
mov dword [ebp - 0x10], ebx
jmp 0x1001caad
mov dword [ebp - 0x38], 0x3c69aed2
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], ebx
jl 0x1001caaa
mov dword [ebp - 4], ebx
jmp 0x1001ca4e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x7c], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001ca40
mov dword [ebp - 4], ebx
jmp 0x1001ca69
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x10c], 0xfffffffd
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001ca58
mov dword [ebp - 0x78], edx
cmp dword [ebp - 0x78], ebx
jl 0x1001ca9c
mov eax, dword [ebp - 0x78]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x198]
cmp eax, 0xc751
setge cl
xor eax, eax
test ecx, ecx
setns al
mov dword [ebp - 0x108], eax
dec dword [ebp - 0x78]
jns 0x1001ca76
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x38]
jns 0x1001ca3b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x1001ca2c
mov dword [ebp - 0xc], esi
mov eax, 0xc6f0d4a7
mov dword [ebp - 0x38], 0xfffffffc
xor esi, esi
mov dword [ebp - 0x38], 0xfffffff7
inc esi
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x10], ebx
jmp 0x1001caee
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x48], 0x1928c176
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001cae0
mov dword [ebp - 0x48], ebx
jmp 0x1001cd6e
mov dword [ebp - 4], ebx
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1001cb22
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x80], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001cb14
mov dword [ebp - 0xc], edx
mov dword [ebp - 0xc], 0xfffffff0
cmp dword [ebp - 0xc], 9
jl 0x1001cd6b
mov dword [ebp - 0x10], ebx
jmp 0x1001cb4e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5c], 0xffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001cb40
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001cb68
push 0xf57
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [ebp - 0xc], ebx
jne 0x1001cc2f
mov eax, dword [ebp - 0x48]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x5c]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [ebp - 0x48]
cmp edx, eax
mov eax, dword [ebp - 0x5c]
setge cl
xor edx, edx
cmp ecx, 0x68dacb31
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 4]
setne dl
sub eax, edx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
sub eax, 0x39c0
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xdf11
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x80]
setne cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setne bl
xor ecx, ecx
imul edx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x48]
setg cl
add eax, ecx
xor ecx, ecx
cmp eax, 0xd579deb4
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x48]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setge dl
sub edx, eax
xor eax, eax
cmp edx, 2
setg al
xor ebx, ebx
cmp eax, 0xeb7bfbc3
je 0x1001cc26
mov eax, esi
cmp dword [ebp - 0x68], ebx
jne 0x1001cc28
mov eax, ebx
cmp eax, dword [ebp - 0x5c]
mov eax, ebx
je 0x1001cc31
mov eax, esi
add eax, 0xfffffffd
je 0x1001ccf9
mov dword [ebp - 0x10], ebx
jmp 0x1001cc4c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x90], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001cc3f
mov dword [ebp - 4], 3
cmp dword [ebp - 4], ebx
jl 0x1001cd5b
mov dword [ebp - 0x2c], 0x22c2
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 4]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
mov eax, dword [ebp + eax*4 - 0x74]
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x74]
cmp ecx, 0xb0debf6
jg 0x1001cc8d
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x74]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x2c], ebx
je 0x1001ccc9
mov edx, esi
cmp dword [ebp - 0x5c], ebx
jne 0x1001cccb
mov edx, ebx
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001ccee
push esi
push 0x136f
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
dec dword [ebp - 4]
jns 0x1001cc61
jmp 0x1001cd5b
mov dword [ebp - 0x44], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 8
jae 0x1001cd37
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 0xac5da298
mov eax, dword [ebp - 0x44]
setne cl
xor edx, edx
cmp ecx, 0xf019d465
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, esi
setne cl
cmp ecx, 0x7411
jne 0x1001cd39
mov eax, ebx
mov ecx, dword [ebp - 0x48]
imul ecx, eax
mov eax, esi
sub eax, ecx
je 0x1001cd4c
mov edx, esi
cmp dword [ebp - 0x5c], ebx
jne 0x1001cd4e
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x70], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 9
push 2
pop edx
jge 0x1001cb3b
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0x16
jne 0x1001cafb
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001cd88
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x18], 0x17ca4e86
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x28], 0xcb7be74f
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
jmp 0x1001cdb3
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x54], 0x5b57
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001cda5
mov dword [ebp - 4], ebx
jmp 0x1001cdcc
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x34], 7
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001cdbe
mov dword [ebp - 4], ebx
jmp 0x1001cde3
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x18c], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1001cdd6
mov dword [ebp - 0x34], ebx
jmp 0x1001d026
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 4], ebx
jmp 0x1001ce27
mov dword [ebp - 0xc], 0x2b29949d
mov dword [ebp - 0xc], ebx
jmp 0x1001ce1e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x54], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x1001ce10
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jle 0x1001ce04
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x54]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp + eax*4 - 0x54]
imul eax, dword [ebp - 0x10], 0x6d54
cmp eax, 0xb474
mov eax, dword [ebp - 0x34]
setne cl
imul edx, ecx
imul ecx, edx, 0x6fdd
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setle bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor edx, edx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + eax*4 - 0x54]
mov eax, dword [ebp - 0x28]
add eax, 2
cmp eax, ecx
mov eax, dword [ebp - 0x34]
setg dl
xor ebx, ebx
cmp dword [ebp + eax*4 - 0x54], edx
jne 0x1001ceb1
mov eax, ebx
cmp dword [ebp - 0x34], ebx
je 0x1001ceb3
mov eax, esi
mov dword [ebp - 0x18], 0x8f4f
xor edx, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x50]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x54]
cmp edx, eax
setne cl
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], ebx
je 0x1001cf8f
push 2
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x1001cf12
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb0], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001cf05
mov eax, dword [ebp - 0x34]
xor ecx, ecx
sub eax, dword [ebp - 0x50]
cmp eax, 0x3212
mov eax, dword [ebp - 0x34]
setne cl
xor ebx, ebx
cmp ecx, 0x251f81f1
mov edx, dword [ebp + eax*4 - 0x54]
mov eax, dword [ebp - 4]
setg bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor ebx, ebx
cmp edx, ecx
jle 0x1001cf53
mov edx, esi
cmp dword [ebp - 0xac], ebx
jne 0x1001cf55
mov edx, ebx
mov eax, dword [ebp - 0xac]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x30]
cmp eax, edx
mov eax, dword [ebp - 0xac]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xac]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x54]
setge cl
imul eax, ecx
mov dword [ebp - 0x40], eax
jmp 0x1001d023
mov dword [ebp - 0x40], 0x42427020
mov dword [ebp - 0x10], ebx
jmp 0x1001cfa8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1d8], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1001cf9b
mov dword [ebp - 0x18], ebx
jmp 0x1001d01e
mov dword [ebp - 0x1c], 0xd3184ba
mov dword [ebp - 0x40], 0x1fe44aad
mov dword [ebp - 4], ebx
jmp 0x1001cfcc
inc dword [ebp - 0x1c]
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jle 0x1001cfc6
mov dword [ebp - 0x28], ebx
jmp 0x1001d016
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x54]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x54]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x54]
sub eax, ecx
jne 0x1001d008
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x54]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x54], 0xfff7
mov eax, ebx
jne 0x1001d00a
mov eax, esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x1001cfd6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1001cfb3
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x1001cdf1
mov dword [ebp - 0xf4], 0xe1757117
mov dword [ebp - 4], 0xe387fb0b
mov dword [ebp - 0x1c], 0x228d5fea
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x40], 0xd08f4923
mov eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 0x12
je 0x1001d10c
mov esi, 0x2ae8
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x134], esi
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x10], ebx
jmp 0x1001d093
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001d086
mov eax, dword [ebp - 0x9c]
xor edx, edx
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x9c]
cmp ecx, eax
setl dl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 4]
sub eax, 0xee05243b
neg eax
sbb eax, eax
add eax, 0xffff7c16
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 4]
mov dword [ebp - 0x40], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x12
jne 0x1001d069
lea eax, [ebp - 0xf4]
push eax
push 0x2bf
push ebx
call fcn.1001fbd0
mov dword [ebp - 0xc], 9
add esp, 0xc
mov dword [ebp - 0x10], ebx
jmp 0x1001d13e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1c0], 0xb9b5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1001d12d
mov dword [ebp - 0xc], ebx
jmp 0x1001d158
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x1c0], ebx
jne 0x1001d15e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x1001d149
mov eax, edi
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [ebp - 0xe4]
mov esi, edx
mov edi, eax
call fcn.1001baac
add eax, esi
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret