Function at 0x1001c30c
Capabilities:
Create process on windows
Delete registry key
Get disk information
Get system information on windows

Disassembly:
mov eax, 0x10089bca
call fcn.100891c0
sub esp, 0x158
push ebx
mov dword [ebp - 0x54], edx
xor edx, edx
push esi
push edi
inc edx
mov edi, ecx
mov dword [ebp - 0x14], edx
xor ebx, ebx
mov dword [ebp - 0x34], 0xee3199f2
push 3
mov dword [ebp - 0x28], 0x24be18a1
mov dword [ebp - 0x14], ebx
pop ecx
jmp 0x1001c34c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x60], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001c342
mov dword [ebp - 0x14], ebx
jmp 0x1001c364
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x44], 0x2fe22364
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001c356
mov dword [ebp - 0x40], 2
push 0xfffffffffffffffc
pop esi
cmp dword [ebp - 0x40], ebx
jl 0x1001c570
mov dword [ebp - 0x20], 0xd3bed162
mov dword [ebp - 0x24], 0xcd95ff79
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x60], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
cmp eax, edx
setl cl
cmp ecx, 0xce4b0ad8
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 9
mov eax, dword [ebp - 0x40]
setg cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x40]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x44]
setge cl
xor edx, edx
cmp ecx, 0xfffffffe
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
or eax, 0xffffffff
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
inc eax
imul eax, eax, 0x1a7e
cmp eax, 0x5ad3
setg cl
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0xfffa
jb 0x1001c42e
cmp dword [ebp - 0x14], ebx
je 0x1001c42e
xor eax, eax
inc eax
jmp 0x1001c430
mov eax, ebx
cmp eax, dword [ebp - 0x40]
jg 0x1001c443
dec dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
jmp 0x1001c557
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x18], 0xb64e3176
push 1
call fcn.1001a36d
xor edx, edx
mov dword [ebp - 0x2c], ebx
inc edx
jmp 0x1001c46f
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x7c]
mov dword [eax + ecx*4], 0x26eb
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1001c45f
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x60], ebx
je 0x1001c4c4
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x24], ebx
jne 0x1001c498
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov ecx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jne 0x1001c4c6
mov ecx, ebx
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
cmp dword [ebp - 0x60], ebx
je 0x1001c52e
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 0xc157b4c7
mov dword [ebp - 0x14], 0x1b
jmp 0x1001c526
mov dword [ebp - 0x1c], edx
mov ecx, 0xcb3f04bf
mov eax, dword [ebp - 0x1c]
sub eax, 0x11f6f1e4
cmp ecx, eax
push 1
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
neg eax
cmp esi, eax
mov eax, dword [ebp - 0x3c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
imul eax, edx
pop edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 6
jge 0x1001c4e3
jmp 0x1001c54f
mov byte [ebp - 0x35], bl
cmp byte [ebp - 0x35], bl
je 0x1001c54a
push ebx
push ebx
push ebx
push ebx
push 0xe19
push edx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp dword [ebp - 0x14], ebx
jne 0x1001c565
lea ecx, [ebp - 0x7c]
call fcn.1001ac0d
dec dword [ebp - 0x40]
push 1
pop edx
jns 0x1001c37c
jmp 0x1001c56d
lea ecx, [ebp - 0x7c]
call fcn.1001ac0d
xor edx, edx
inc edx
cmp byte [ebp + 8], bl
je 0x1001ca18
push 2
lea ecx, [ebp - 0xc4]
call fcn.1001a36d
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x134]
mov dword [ebp - 0x18], 0xfffffff9
push 1
call fcn.1001a36d
mov byte [ebp - 4], 1
mov dword [ebp + 8], ebx
jmp 0x1001c5b9
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xc4]
mov dword [eax + ecx*4], 0xfff7
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x1001c5a6
mov dword [ebp + 8], ebx
jmp 0x1001c5d7
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x134]
mov dword [eax + ecx*4], 0x1208373b
inc dword [ebp + 8]
cmp dword [ebp + 8], 1
jl 0x1001c5c4
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 1
jg 0x1001c6f0
mov esi, dword [ebp - 0xc4]
movdqa xmm0, xmmword [0x100081a0]
lea eax, [ebp - 0x150]
mov dword [ebp + 8], 4
lea ecx, [ebp - 0x94]
mov dword [ebp + 8], 0xfffffffe
push dword [ebp + 8]
movdqu xmmword [ebp - 0x160], xmm0
push eax
lea eax, [ebp - 0x160]
mov dword [ebp - 0x94], ebx
push eax
push ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
call fcn.1001b9f9
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x118]
mov dword [ebp + 8], 7
push 4
call fcn.1001a36d
xor ecx, ecx
mov dword [ebp + 8], ebx
mov dword [ebp + 8], ebx
inc ecx
jmp 0x1001c66e
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x64], 0x468a07c6
inc dword [ebp + 8]
cmp dword [ebp + 8], ecx
jl 0x1001c660
mov dword [ebp + 8], ebx
jmp 0x1001c689
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x144], 6
inc dword [ebp + 8]
cmp dword [ebp + 8], ecx
jl 0x1001c678
mov dword [ebp + 8], ebx
jmp 0x1001c6a6
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x118]
mov dword [eax + ecx*4], 0xbf0bb9a6
inc dword [ebp + 8]
cmp dword [ebp + 8], 4
jl 0x1001c693
xor eax, eax
mov dword [ebp - 0x64], ebx
cmp dword [esi + 4], ebx
setne al
xor ecx, ecx
cmp eax, 0xd1f28301
mov eax, dword [ebp - 0x118]
sete cl
mov dword [eax], ecx
lea ecx, [ebp - 0x118]
call fcn.1001ac0d
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 1
call fcn.1001ac0d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jle 0x1001c5f0
lea ecx, [ebp - 0x134]
call fcn.1001ac0d
or eax, 0xffffffff
lea ecx, [ebp - 0xc4]
mov dword [ebp - 4], eax
call fcn.1001ac0d
push 2
lea ecx, [ebp - 0x100]
call fcn.1001a36d
xor edx, edx
inc edx
mov dword [ebp + 8], edx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], 0x33fd52a4
mov dword [ebp + 8], ebx
jmp 0x1001c741
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], 0x9f9b
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x1001c72e
mov dword [ebp + 8], ebx
cmp dword [ebp + 8], edx
jg 0x1001c790
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp dword [ebp + 8], ebx
jne 0x1001c760
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x100]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [ebp + 8]
cmp dword [ebp + 8], 1
jle 0x1001c74f
lea ecx, [ebp - 0x100]
call fcn.1001ac0d
cmp byte [edi], 0
je 0x1001c83c
mov dword [ebp + 8], 5
mov dword [ebp - 0x28], 1
mov dword [ebp + 8], ebx
jmp 0x1001c82f
mov dword [ebp - 0x1c], 0x66a07563
mov dword [ebp - 0x18], ebx
jmp 0x1001c7d4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x88], 0x568d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001c7c3
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x88]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x84]
cmp eax, 1
setle cl
cmp ecx, 0x7ab6
je 0x1001c810
cmp dword [ebp - 0x1c], ebx
je 0x1001c810
xor esi, esi
inc esi
jmp 0x1001c812
mov esi, ebx
mov ecx, dword [ebp - 0x84]
xor edx, edx
mov eax, dword [ebp + 8]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, esi
setge al
mov dword [ebp - 0x28], eax
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x14
je 0x1001c7b7
push ebx
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov dword [ebp - 0x20], 0x1713b910
lea ecx, [ebp - 0x10c]
push 4
call fcn.1001a36d
push 3
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], 7
mov dword [ebp + 8], ebx
jmp 0x1001c870
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x50], 1
inc dword [ebp + 8]
cmp dword [ebp + 8], ecx
jl 0x1001c862
mov dword [ebp + 8], ebx
jmp 0x1001c88d
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x10c]
mov dword [eax + ecx*4], 0x1b1b552b
inc dword [ebp + 8]
cmp dword [ebp + 8], 4
jl 0x1001c87a
mov dword [ebp - 0x20], 0xffffffe2
jmp 0x1001c9fe
mov dword [ebp + 8], 0x62751c76
mov dword [ebp - 0x1c], 0xa83afd47
mov dword [ebp + 8], 0xede048ff
mov dword [ebp + 8], 0xb31915e3
mov dword [ebp + 8], 0xf8c547fc
mov dword [ebp - 0x34], 0xe9ee
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x1001c8da
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp + 8], ebx
jmp 0x1001c9f1
push 1
lea ecx, [ebp - 0xdc]
call fcn.1001a36d
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x1c], 0x39956a21
mov dword [ebp - 0x54], 0xb4db
push 2
call fcn.1001a36d
mov dword [ebp - 0x14], ebx
jmp 0x1001c926
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xdc]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1001c913
mov dword [ebp - 0x14], ebx
jmp 0x1001c944
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], 0xef1f3e16
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001c931
mov ecx, dword [ebp + 8]
xor edx, edx
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
setg dl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 8]
mov eax, dword [ebp + eax*4 - 0x50]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
add eax, 0xfc35
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x48]
sub ecx, eax
mov eax, dword [ebp + 8]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp + eax*4 - 0x50], ecx
lea ecx, [ebp - 0x150]
inc dword [ebp - 0x34]
call fcn.1001ac0d
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 3
call fcn.1001ac0d
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jle 0x1001c8e2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jne 0x1001c89f
lea ecx, [ebp - 0x10c]
call fcn.1001ac0d
jmp 0x1001d177
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x20], 0x520ea0c8
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x28], 0xfffffffb
push edx
call fcn.1001a36d
push 1
lea ecx, [ebp - 0xf4]
mov dword [ebp - 4], 5
call fcn.1001a36d
xor edx, edx
mov dword [ebp + 8], ebx
inc edx
jmp 0x1001ca63
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xa0]
mov dword [eax + ecx*4], ebx
inc dword [ebp + 8]
cmp dword [ebp + 8], edx
jl 0x1001ca54
mov dword [ebp + 8], ebx
jmp 0x1001ca80
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xf4]
mov dword [eax + ecx*4], 0xeded
inc dword [ebp + 8]
cmp dword [ebp + 8], edx
jl 0x1001ca6d
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
je 0x1001ca98
cmp dword [ebp - 0x14], ebx
jne 0x1001ca9d
cmp dword [ebp - 0x20], ebx
je 0x1001ca9f
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
push 8
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
pop edi
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
sub edx, ecx
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
add edx, eax
mov eax, dword [ebp - 0xa0]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
cmp edi, eax
sbb eax, eax
neg eax
sub eax, 0x9c1464f1
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
cmp edx, edi
jbe 0x1001cb1f
mov eax, dword [ebp - 0xf4]
cmp dword [eax], ebx
jne 0x1001cb1f
mov eax, ebx
jmp 0x1001cb22
xor eax, eax
inc eax
cmp eax, dword [ebp - 0x20]
mov byte [ebp + 0xb], bl
jle 0x1001cb3a
cmp byte [ebp + 0xb], 0
je 0x1001cb47
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommState]
jmp 0x1001cb47
cmp byte [ebp + 0xb], 0
je 0x1001cb47
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea ecx, [ebp - 0xf4]
call fcn.1001ac0d
or eax, 0xffffffff
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], eax
call fcn.1001ac0d
mov dword [ebp - 0x14], 0xfffffffb
lea ecx, [ebp - 0xac]
mov dword [ebp + 8], esi
push 3
call fcn.1001a36d
mov dword [ebp - 0x28], 1
mov eax, 0xadb5d230
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x1c], 0xe2278150
mov dword [ebp - 0x18], ebx
jmp 0x1001cbbd
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xac]
mov dword [eax + ecx*4], 0x521fafbf
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001cbaa
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jne 0x1001cbdd
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
jmp 0x1001cc12
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x1001cc0f
push 0x13d0
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe6
jl 0x1001cbf1
push 2
mov dword [ebp + 8], ebx
pop edx
jmp 0x1001cc77
mov dword [ebp - 0x14], ebx
jmp 0x1001cc6f
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x18], ebx
jmp 0x1001cc42
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x140], 0x19716e28
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001cc31
mov dword [ebp - 0x20], ebx
jmp 0x1001cc60
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xac]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1001cc4d
inc dword [ebp - 0x140]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1001cc25
inc dword [ebp + 8]
cmp dword [ebp + 8], edx
jle 0x1001cc20
mov dword [ebp + 8], ebx
cmp dword [ebp + 8], edx
jne 0x1001cd19
mov dword [ebp - 0x18], 0x12fd89d6
mov dword [ebp - 0x1c], 1
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0x1af53c8c
mov ecx, 0x5b50
setle al
imul eax, dword [ebp - 0x18]
sub ecx, eax
dec ecx
add ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x128], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, 1
setl cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0x85d5fca4
setne cl
xor eax, eax
cmp ecx, 0x2a1d
setle al
xor ecx, ecx
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
cmp eax, edx
setg cl
mov dword [ebp - 0x18], ecx
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
je 0x1001cc88
lea ecx, [ebp - 0xac]
call fcn.1001ac0d
mov dword [ebp - 0x1c], ebx
mov dword [ebp + 8], 0xfffffff9
mov dword [ebp - 0x24], 0xa0a9
mov dword [ebp + 8], ebx
jmp 0x1001cd48
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x30], 0xfffffffe
inc dword [ebp + 8]
cmp dword [ebp + 8], 1
jl 0x1001cd3a
mov dword [ebp - 0x30], edi
jmp 0x1001cda9
or eax, 0xffffffff
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0x13
jmp 0x1001cd75
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x1001cd72
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffc
jge 0x1001cd62
mov dword [ebp - 0x14], 0x15
jmp 0x1001cda0
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x1001cd9d
push ebx
push ebx
push 0x1101
call esi
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffea
je 0x1001cd84
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x1c
jge 0x1001cd53
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov dword [ebp + 8], 1
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
push 4
setne cl
xor edx, edx
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp + 8], edx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
sub edx, dword [ebp + 8]
cmp edx, eax
setl cl
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x70]
call fcn.1001a36d
mov dword [ebp + 8], 0x369
mov edi, 0xfff9
mov dword [ebp - 0x24], 0x712c5197
mov dword [ebp - 0x2c], 0x18a8
mov dword [ebp - 0x18], ebx
jmp 0x1001ce31
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x70]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1001ce25
mov eax, dword [ebp - 0x70]
cmp dword [eax + 8], ebx
jne 0x1001ce48
cmp dword [eax + 0xc], ebx
jne 0x1001ce48
mov ecx, ebx
jmp 0x1001ce4b
xor ecx, ecx
inc ecx
mov eax, dword [ebp + 8]
xor edx, edx
mov esi, dword [ebp - 0x70]
mov eax, dword [esi]
add eax, ecx
cmp eax, dword [esi + 4]
mov eax, dword [ebp + 8]
setle dl
xor ecx, ecx
add edx, dword [esi + 4]
cmp edx, eax
setge cl
cmp ecx, dword [esi + 0xc]
jl 0x1001cf25
mov dword [ebp - 0x20], 0xa4d1
mov dword [ebp - 0x24], ebx
mov dword [ebp + 8], 6
jmp 0x1001ced9
mov dword [ebp - 0x28], 0xfffffffe
xor ecx, ecx
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x20]
imul edx, dword [esi + 0xc]
mov eax, dword [ebp - 0x24]
shl edx, 2
cmp edx, eax
sete cl
xor edx, edx
cmp ecx, dword [esi + 0xc]
setg dl
xor eax, eax
cmp edx, 0x314a
setne al
mov dword [ebp - 0x1c], eax
dec dword [ebp + 8]
cmp dword [ebp + 8], 0xffffffe9
jle 0x1001ce86
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 1
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edi
mov eax, dword [ebp - 0x24]
setne cl
sub ecx, edx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, dword [esi + 0xc]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
or edi, 0xffffffff
mov dword [ebp - 0x24], ecx
jmp 0x1001cf40
mov dword [ebp + 8], 1
or edi, 0xffffffff
mov dword [ebp - 0x28], edi
xor ecx, ecx
mov eax, dword [ebp + 8]
cmp eax, 0xfffffff9
setg cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x70]
call fcn.1001ac0d
mov dword [ebp - 0x24], 0x3638ecf5
xor ecx, ecx
mov dword [ebp + 8], 0xb6182eac
mov dword [ebp - 0x18], 0xd68
mov dword [ebp + 8], 1
mov eax, dword [ebp - 0x24]
cmp eax, 0xfffffffa
setl cl
mov dword [ebp + 8], ecx
cmp dword [ebp + 8], ebx
je 0x1001cf98
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x18], 0x9934b0b4
sbb eax, eax
inc eax
mov dword [ebp + 8], eax
jmp 0x1001cffd
xor edx, edx
mov dword [ebp - 0x24], 0x168f
mov dword [ebp - 0x28], 0xfffffffd
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp + 8]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
cmp ecx, 0x9d44
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp + 8], ecx
push 3
lea ecx, [ebp - 0xe8]
call fcn.1001a36d
push 6
pop esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x34], 0x40c3
push 2
call fcn.1001a36d
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp + 8], 0x7f4a1d2d
mov dword [ebp - 0x24], 0xb2faa963
push 2
call fcn.1001a36d
mov dword [ebp + 8], ebx
jmp 0x1001d05e
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xe8]
mov dword [eax + ecx*4], 0xb4e1
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x1001d04b
push 2
mov dword [ebp + 8], ebx
pop edx
jmp 0x1001d07f
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xd0]
mov dword [eax + ecx*4], 1
inc dword [ebp + 8]
cmp dword [ebp + 8], edx
jl 0x1001d06c
mov dword [ebp + 8], ebx
jmp 0x1001d09c
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xb8]
mov dword [eax + ecx*4], 0x905f4d0c
inc dword [ebp + 8]
cmp dword [ebp + 8], edx
jl 0x1001d089
mov eax, dword [ebp - 0xe8]
cmp dword [eax], ebx
jne 0x1001d10d
cmp dword [eax + 8], 0x418a5273
jl 0x1001d0de
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 0xd0]
mov dword [eax], 0xfff6
mov eax, dword [ebp - 0x1c]
cmp eax, 0xfffffffb
setle cl
mov dword [ebp + 8], ecx
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], ebx
je 0x1001d0de
xor ecx, ecx
inc ecx
jmp 0x1001d0e0
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
add ecx, 0xffff36c8
cmp ecx, eax
setge dl
add edx, 5
cmp edx, dword [ebp - 0x34]
jge 0x1001d101
cmp dword [ebp - 0x24], ebx
jne 0x1001d101
mov eax, ebx
jmp 0x1001d104
xor eax, eax
inc eax
add eax, 0xfffffff8
jne 0x1001d10d
mov eax, ebx
jmp 0x1001d110
xor eax, eax
inc eax
xor ecx, ecx
cmp eax, edi
mov eax, dword [ebp - 0xb8]
sete cl
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xb8]
call fcn.1001ac0d
lea ecx, [ebp - 0xd0]
call fcn.1001ac0d
lea ecx, [ebp - 0xe8]
call fcn.1001ac0d
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x54]
mov eax, dword [edx]
cmp dword [ecx], ebx
je 0x1001d152
xor eax, eax
inc eax
jmp 0x1001d154
mov eax, ebx
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [ecx]
mov dword [ecx], ebx
cmp dword [ecx], ebx
jne 0x1001d16f
cmp dword [edx], ebx
je 0x1001d172
xor ebx, ebx
inc ebx
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret