Function at 0x1001b473
Capabilities:
Check os version
Delete file
Query or enumerate registry key
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1008b3a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x228
push ebx
push esi
push edi
mov dword [esp + 0x58], ecx
lea ecx, [esp + 0x64]
push 2
mov dword [esp + 0x88], edx
call fcn.10019689
xor ebx, ebx
lea ecx, [esp + 0x9c]
mov dword [esp + 0x23c], ebx
mov dword [esp + 0x1c], 0x6b8f3d42
mov dword [esp + 0x18], 5
mov dword [esp + 0x34], 0xfffc
push 2
call fcn.10019689
mov dword [esp + 0x14], 0xc63b8821
mov dword [esp + 0x24], 0x9f9f4aec
push 2
mov dword [esp + 0x30], 0xd4463028
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x1001b50c
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x64]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x1001b4fd
mov dword [esp + 0x18], ebx
jmp 0x1001b52e
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x9c]
mov dword [eax + ecx*4], 0x14186e14
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x1001b518
mov eax, dword [esp + 0x64]
xor ecx, ecx
cmp dword [eax], 0xecb302af
sete cl
xor edx, edx
cmp ecx, 0xe74e
setne dl
xor eax, eax
cmp edx, 0xffffffff
setne al
xor edx, edx
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x64]
cmp ecx, dword [eax]
je 0x1001b571
lea eax, [edx + 1]
cmp dword [esp + 0x1c], ebx
jne 0x1001b573
mov eax, ebx
cmp eax, dword [esp + 0x34]
jle 0x1001b583
cmp dword [esp + 0x1c], ebx
je 0x1001b583
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x64]
imul ecx, dword [eax], 0xc3b7
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x64]
mov ecx, 0xffffb96e
sete dl
sub ecx, edx
sub ecx, dword [eax]
mov eax, dword [esp + 0x1c]
sub ecx, eax
mov eax, dword [esp + 0x9c]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x9c]
cmp dword [eax], ebx
jne 0x1001b5f2
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
inc ecx
cmp ecx, eax
sbb eax, eax
neg eax
add eax, 0x2e528fd4
jne 0x1001b5f2
mov edx, ebx
jmp 0x1001b5f7
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [esp + 0x9c]
xor ecx, ecx
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 7
cmp edx, dword [eax]
pop eax
setle cl
cmp ecx, dword [esp + 0x2c]
jl 0x1001b66d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001b720
push 0x18aa
push 0x1da9
push 0x6ca
push ebx
push 0x1bdc
push 0x1130
call esi
push eax
call edi
push eax
push 0x2094
push 0x1ff5
push 0x1e7f
push 0x2020
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
jmp 0x1001b720
xor ecx, ecx
mov dword [esp + 0x34], 0x7d625c2a
inc ecx
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], ebx
jl 0x1001b706
mov edi, 0xf2b6367a
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], 4
jge 0x1001b6b3
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1f8], 0x5bccbf78
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x1001b696
push 7
pop eax
mov dword [esp + 0x200], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x1c], ebx
jmp 0x1001b6fa
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], ecx
jg 0x1001b6f2
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001b6e5
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
inc ecx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ecx
jle 0x1001b6d2
push 7
pop eax
inc dword [esp + 0x14]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jle 0x1001b6c4
dec dword [esp + 0x18]
jns 0x1001b68b
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001b720
push ebx
push 0xbaf
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x9c]
call fcn.1001970b
or dword [esp + 0x23c], 0xffffffff
lea ecx, [esp + 0x64]
call fcn.1001970b
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], 0xfffffffe
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001b75a
push ebx
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov dword [esp + 0x28], 0xfffffffd
cmp dword [esp + 0x28], 0x1a
push 3
pop ecx
jle 0x1001b899
push 7
pop eax
mov dword [esp + 0x30], 0x7df2f4a8
mov dword [esp + 0x30], eax
jmp 0x1001b864
xor eax, eax
lea ecx, [esp + 0x110]
inc eax
mov dword [esp + 0x24], eax
push 2
call fcn.10019689
mov dword [esp + 0x20], ebx
jmp 0x1001b7b5
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x110]
mov dword [eax + ecx*4], 0xa831d26e
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1001b79f
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], 0x1d
jge 0x1001b844
xor edx, edx
inc edx
push 3
mov dword [esp + 0x1c], edx
pop eax
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0xffffffec
jl 0x1001b801
mov ecx, dword [esp + 0x110]
mov dword [esp + 0x34], 6
mov eax, dword [esp + 0x24]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x34]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffec
jge 0x1001b7e3
mov dword [esp + 0x18], 0xffffffee
jmp 0x1001b833
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001b82f
push 0x1413
push 0xefb
push ebx
push 0x1272
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
xor edx, edx
inc edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
je 0x1001b80b
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x1d
jl 0x1001b7ca
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001b854
call dword [sym.imp.USER32.dll_CreateMenu]
lea ecx, [esp + 0x110]
call fcn.1001970b
dec dword [esp + 0x30]
cmp dword [esp + 0x30], 0xffffffe2
jg 0x1001b784
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001b887
push 0x46f
call esi
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0x1a
jg 0x1001b770
push 3
pop ecx
mov dword [esp + 0x30], 9
cmp dword [esp + 0x30], 0xb
jg 0x1001c88f
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, 0xfa6b86d5
jmp 0x1001b8bc
push 3
pop ecx
xor eax, eax
inc eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x24], 0x831713b9
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], 0xfffffffe
jle 0x1001b92d
jmp 0x1001b8db
push 3
pop ecx
push ecx
lea ecx, [esp + 0x138]
call fcn.10019689
push 3
mov dword [esp + 0x24], ebx
pop edx
jmp 0x1001b903
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x134]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x1001b8f1
mov eax, dword [esp + 0x134]
lea ecx, [esp + 0x134]
mov dword [eax + 4], ebx
call fcn.1001970b
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xfffffffe
jg 0x1001b8d8
xor eax, eax
inc eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0x14], 0xfffffff9
mov dword [esp + 0x1c], 0xfffffffd
mov dword [esp + 0x18], 0x8fb8ceff
mov dword [esp + 0x28], 0x911b9c6f
mov dword [esp + 0x24], 0x50dfa014
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1a0], esi
mov dword [esp + 0x1a4], esi
mov dword [esp + 0x1a8], esi
mov dword [esp + 0x1ac], esi
mov dword [esp + 0x34], 0x184bafc8
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
neg esi
mov eax, dword [esp + 0x1c]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
mov eax, 0xb79df948
setl dl
cmp eax, esi
sbb eax, eax
neg eax
cmp edx, eax
jge 0x1001b9b9
cmp dword [esp + 0x1c], ebx
jne 0x1001b9b9
xor ecx, ecx
mov eax, ebx
inc ecx
jmp 0x1001b9be
xor ecx, ecx
inc ecx
mov eax, ecx
inc eax
je 0x1001b9c9
mov eax, ecx
cmp dword [esp + 0x1c], ebx
jne 0x1001b9cb
mov eax, ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x1c]
jl 0x1001b9e1
cmp dword [esp + 0x1c], ebx
jne 0x1001b9e1
mov ecx, ebx
mov eax, dword [esp + 0x1c]
xor edx, edx
add eax, ecx
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setge dl
mov dword [esp + 0x24], edx
cmp dword [esp + 0x24], ebx
je 0x1001ba08
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x28], ebx
je 0x1001ba2b
mov dword [esp + 0x34], 0xfffffffe
mov dword [esp + 0x34], 0xe6286c8a
jmp 0x1001bb62
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], 0x1f13d464
cmp dword [esp + 0x20], ebx
je 0x1001bad2
xor edx, edx
mov dword [esp + 0x24], 0xfffffffb
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x28]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setle dl
xor ecx, ecx
cmp eax, edx
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
setl cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
neg ecx
jne 0x1001ba9d
cmp dword [esp + 0x28], ebx
jne 0x1001ba9d
mov edx, ebx
jmp 0x1001baa2
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x28]
setl cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x2c]
jge 0x1001baca
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], eax
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 2
jle 0x1001bb62
xor edi, edi
mov dword [esp + 0x1c], ebx
jmp 0x1001bb2b
mov eax, dword [esp + 0x1a4]
sub eax, 0x44077424
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], ebx
jne 0x1001bb1a
mov eax, dword [esp + 0x2c]
mov ecx, ebx
neg eax
je 0x1001bb1d
lea ecx, [edi + 1]
mov eax, dword [esp + 0x14]
sub ecx, eax
mov dword [esp + 0x34], ecx
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe4
je 0x1001baed
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001bb51
push ebx
push 0x6da
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jg 0x1001bae7
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 3
pop eax
push eax
lea ecx, [esp + 0xc8]
call fcn.10019689
xor eax, eax
lea ecx, [esp + 0xac]
inc eax
mov dword [esp + 0x23c], eax
lea eax, [esp + 0x1f8]
push dword [esp + 0x58]
movdqa xmm0, xmmword [0x10008080]
push eax
lea eax, [esp + 0x1f0]
mov dword [esp + 0xb4], ebx
push eax
push ebx
movdqu xmmword [esp + 0x1f8], xmm0
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
call fcn.1001ac2d
push 2
lea ecx, [esp + 0xbc]
mov byte [esp + 0x240], 2
call fcn.10019689
xor edx, edx
inc edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x14], ebx
jmp 0x1001bbf8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xb8]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001bbe6
mov esi, dword [esp + 0xb8]
xor eax, eax
cmp dword [esi + 4], ebx
sete al
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], 0xfffffff0
jmp 0x1001bd10
mov dword [esp + 0x24], 0x8f738f58
mov dword [esp + 0x2c], 0xfffffff7
mov dword [esp + 0x34], 0xfffffffc
mov dword [esp + 0x24], ebx
jmp 0x1001bcb2
mov dword [esp + 0x14], 0xed55c59c
mov dword [esp + 0x20], edx
cmp dword [esp + 0x20], ebx
je 0x1001bc7c
mov eax, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0xac]
mov ecx, dword [esi + 4]
cmp dword [eax + 4], ecx
mov eax, dword [esp + 0xb8]
sete dl
add edx, dword [eax]
add edx, ecx
je 0x1001bc79
xor edx, edx
inc edx
mov eax, edx
jmp 0x1001bc7e
xor edx, edx
inc edx
mov eax, ebx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
or eax, 0xffffffff
imul ecx, dword [esp + 0x24]
sub eax, ecx
je 0x1001bca2
mov eax, edx
cmp dword [esp + 0x14], ebx
jne 0x1001bca4
mov eax, ebx
mov dword [esp + 0x34], eax
cmp dword [esp + 0x20], ebx
jne 0x1001bcb9
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xffffffe3
jne 0x1001bc3d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001bd09
push 0x21d7
push 0x16d3
push 0x1e9e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x37b
push 0x4de
push 0xb54
push 0xc51
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
inc dword [esp + 0x28]
push 1
pop edx
cmp dword [esp + 0x28], 0xb
jne 0x1001bc1f
lea ecx, [esp + 0xb8]
call fcn.1001970b
xor eax, eax
lea ecx, [esp + 0xac]
inc eax
mov byte [esp + 0x23c], al
call fcn.1001970b
xor edx, edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x1001bd5d
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x94], 0x35568345
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001bd4a
mov dword [esp + 0x24], ebx
jmp 0x1001bd7c
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x94], 0xffffffff
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edx
jl 0x1001bd69
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001bd9e
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1236
push ebx
call edi
xor edx, edx
inc edx
push 3
mov dword [esp + 0x18], ebx
pop esi
jmp 0x1001bdbd
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc4]
mov dword [eax + ecx*4], 0x62f63069
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001bda7
mov dword [esp + 0x1c], 8
mov dword [esp + 0x2c], 0xfffffff7
mov dword [esp + 0x14], ebx
jmp 0x1001bde9
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x40], 0x6e83
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001bdd9
cmp dword [esp + 0x40], ebx
jne 0x1001be3f
mov eax, dword [esp + 0x40]
xor ecx, ecx
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x40]
cmp eax, 0xde6b
setle cl
xor edx, edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov eax, dword [esp + 0x40]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x40]
setge cl
imul eax, ecx
test eax, eax
jne 0x1001be3c
mov eax, ebx
jmp 0x1001be41
xor edx, edx
inc edx
mov eax, edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x40], ebx
je 0x1001bf27
mov dword [esp + 0x18], 0xffffffff
mov eax, 0xb3533b01
mov dword [esp + 0x14], 0xc2f00273
mov dword [esp + 0x2c], 0xc1a1fd29
mov dword [esp + 0x180], eax
mov dword [esp + 0x184], eax
mov dword [esp + 0x188], eax
mov dword [esp + 0x18c], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x40]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [esp + 0x18]
je 0x1001bead
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
setne dl
sub edx, dword [esp + 0x18]
jne 0x1001bedc
cmp dword [esp + 0x18], ebx
jne 0x1001bedc
mov eax, ebx
jmp 0x1001bedf
xor eax, eax
inc eax
mov dword [esp + 0x14], eax
xor edx, edx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setg dl
mov dword [esp + 0x2c], edx
cmp dword [esp + 0x2c], ebx
jne 0x1001bf00
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x184], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001bf52
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1001bf52
mov dword [esp + 0x1c], ebx
jmp 0x1001bf4b
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001bf47
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffef
jg 0x1001bf2d
mov dword [esp + 0x24], 0xffffffef
jmp 0x1001c856
mov dword [esp + 0x28], 0xc0ce695e
lea ecx, [esp + 0xd0]
mov dword [esp + 0x14], 0x35555d5d
mov dword [esp + 0x2c], 0xdcede6a6
mov dword [esp + 0x2c], 0x5b818e96
push 4
call fcn.10019689
xor eax, eax
inc eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x2c], 0xfffffffa
mov dword [esp + 0x20], 0xdcdedc29
mov dword [esp + 0x18], 0x8019
mov dword [esp + 0x1c], ebx
jmp 0x1001bfc2
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x48], 0xb770a77c
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x1001bfb2
push 3
mov dword [esp + 0x20], ebx
pop ecx
jmp 0x1001bfe5
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x140], 0x5a0349b8
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1001bfd2
mov dword [esp + 0x1c], ebx
jmp 0x1001c007
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xd0]
mov dword [eax + ecx*4], 0x431bb57c
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x1001bff1
mov dword [esp + 0x1c], ebx
jmp 0x1001c024
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x5c], 0xde87
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001c014
mov eax, dword [esp + 0x48]
mov ecx, 0x8552ad14
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x54]
cmp ecx, eax
mov eax, dword [esp + 0x28]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
mov dword [esp + 0x28], ecx
cmp dword [esp + 0x28], ebx
jne 0x1001c05f
mov edx, ebx
jmp 0x1001c064
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [esp + 0x4c]
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, dword [esp + 0x14]
je 0x1001c07f
cmp dword [esp + 0x50], ebx
jne 0x1001c07f
mov edx, ebx
jmp 0x1001c084
xor eax, eax
lea edx, [eax + 1]
mov dword [esp + 0x148], edx
xor ecx, ecx
mov eax, dword [esp + 0x50]
cmp edx, eax
setle cl
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x28]
sub edx, eax
mov eax, dword [esp + 0x14]
cmp edx, eax
setle cl
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x34]
cmp eax, 0xa21d
setle cl
mov dword [esp + 0x2c], ecx
cmp dword [esp + 0x2c], 5
jge 0x1001c0ea
cmp dword [esp + 0x20], ebx
jne 0x1001c0ea
mov eax, ebx
jmp 0x1001c0ed
xor eax, eax
inc eax
push 3
pop ecx
cmp ecx, eax
push 0xfffffffffffffff6
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xfffffffd
pop eax
setg cl
imul ecx, dword [esp + 0x48]
neg ecx
sbb ecx, ecx
inc ecx
cmp eax, ecx
mov eax, dword [esp + 0x60]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [esp + 0xd0]
sete cl
sub ecx, 0xd979
mov esi, dword [eax]
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov eax, dword [esp + 0x20]
cmp eax, 7
mov eax, dword [esp + 0x14]
setge cl
xor edx, edx
sub ecx, esi
cmp ecx, esi
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x5c78859b
setne al
xor ecx, ecx
cmp eax, 0x60ee
mov eax, 0xc96aae11
setle cl
cmp eax, ecx
sbb eax, eax
neg eax
cmp eax, dword [esp + 0x60]
jl 0x1001c184
cmp dword [esp + 0x148], ebx
je 0x1001c184
xor eax, eax
lea edx, [eax + 1]
jmp 0x1001c186
mov edx, ebx
mov eax, dword [esp + 0x5c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xd0]
setg cl
xor edx, edx
cmp ecx, dword [eax + 8]
setg dl
xor ecx, ecx
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x18]
imul edx, dword [esp + 0x34]
mov eax, dword [esp + 0x60]
cmp edx, eax
setle cl
cmp ecx, 4
jne 0x1001c1ca
cmp dword [esp + 0x50], ebx
jne 0x1001c1ca
xor edx, edx
mov ecx, ebx
inc edx
jmp 0x1001c1cf
xor edx, edx
inc edx
mov ecx, edx
mov eax, dword [esp + 0x48]
imul eax, ecx
test eax, eax
je 0x1001c1e3
cmp dword [esp + 0x148], ebx
jne 0x1001c1e5
mov edx, ebx
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x48]
neg ecx
sbb ecx, ecx
add eax, 0xffff
inc ecx
add ecx, eax
mov eax, dword [esp + 0x18]
add ecx, edx
xor edx, edx
cmp ecx, eax
lea ecx, [esp + 0xd0]
setle dl
mov dword [esp + 0x50], edx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
call fcn.1001970b
mov dword [esp + 0x18], 0xd3860a42
mov dword [esp + 0x28], 0xb9f9b31
mov dword [esp + 0x28], 0xffffffe2
cmp dword [esp + 0x28], 0xffffffe8
jne 0x1001c382
push 3
pop ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ecx
jg 0x1001c36d
push 2
pop esi
xor eax, eax
inc eax
push ecx
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x12c]
call fcn.10019689
push 3
mov dword [esp + 0x18], ebx
pop edx
jmp 0x1001c28c
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], 9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001c276
mov dword [esp + 0x18], 0xffffffe9
jmp 0x1001c2e9
mov dword [esp + 0x14], 0xffffffff
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001c2bd
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1236
push ebx
call edi
mov dword [esp + 0x14], ebx
jmp 0x1001c2df
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001c2db
push ebx
push 0xc6b
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x1001c2c3
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jle 0x1001c29c
mov dword [esp + 0x18], esi
cmp dword [esp + 0x18], ebx
jl 0x1001c350
mov dword [esp + 0x14], 0x3dda37bb
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001c321
push ebx
push ebx
push 0x2325
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov dword [esp + 0x14], esi
cmp dword [esp + 0x14], ebx
jl 0x1001c34a
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x128]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov eax, dword [esp + 0x18]
dec dword [esp + 0x14]
jns 0x1001c32b
dec dword [esp + 0x18]
jns 0x1001c2fa
lea ecx, [esp + 0x128]
call fcn.1001970b
inc dword [esp + 0x20]
push 3
pop ecx
cmp dword [esp + 0x20], ecx
jle 0x1001c259
cmp dword [esp + 0x28], ebx
jne 0x1001c382
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0xffffffe8
je 0x1001c244
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x24]
neg eax
jne 0x1001c39b
cmp dword [esp + 0xa8], ebx
jne 0x1001c39b
mov ecx, ebx
jmp 0x1001c3a0
xor eax, eax
lea ecx, [eax + 1]
mov dword [esp + 0x18], 0x44b0
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
imul eax, dword [esp + 0x30], 0x3826
cmp eax, 0x56ebf4d3
setge dl
xor ecx, ecx
imul edx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
cmp edx, eax
mov eax, dword [esp + 0x30]
setge cl
add ecx, eax
mov eax, dword [esp + 0xc4]
mov dword [eax], ecx
mov eax, dword [esp + 0x24]
add eax, ecx
imul eax, dword [esp + 0x14]
test eax, eax
je 0x1001c84b
push 2
mov dword [esp + 0x1c], 0x25b9b55b
mov dword [esp + 0x18], ebx
pop esi
jmp 0x1001c41c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x218], 0xfffffff9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001c409
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 0x1c
jle 0x1001c4a3
xor eax, eax
inc eax
mov dword [esp + 0x28], 0x1f20
dec dword [esp + 0x28]
mov dword [esp + 0x28], ebx
jmp 0x1001c492
mov dword [esp + 0x20], 0xbd4dfbd6
mov dword [esp + 0x20], ebx
jmp 0x1001c488
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x14], ebx
jmp 0x1001c47e
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001c47a
push eax
push 0x1075
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
xor eax, eax
inc eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], eax
jle 0x1001c45e
inc dword [esp + 0x20]
cmp dword [esp + 0x20], eax
jle 0x1001c450
inc dword [esp + 0x28]
cmp dword [esp + 0x28], eax
jle 0x1001c442
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x1c
jg 0x1001c430
mov dword [esp + 0x1c], 0x1d
cmp dword [esp + 0x1c], 0xfffffff9
jle 0x1001c71a
push 3
pop edi
movdqa xmm0, xmmword [0x10007fd0]
lea ecx, [esp + 0x70]
push 0xfffffffffffffff6
pop eax
push dword [esp + 0x58]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1dc]
push eax
mov dword [esp + 0x30], edi
lea eax, [esp + 0x1d0]
mov dword [esp + 0x28], 0x17ca4e8
push eax
mov dword [esp + 0x40], 0xe6286c8a
mov dword [esp + 0x38], 0x9329bfae
mov dword [esp + 0x44], 0xc259dba5
push ebx
movdqu xmmword [esp + 0x1d8], xmm0
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
call fcn.1001ac2d
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x28]
inc edx
mov eax, dword [esp + 0x28]
mov ecx, edx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
sub ecx, eax
cmp ecx, dword [esp + 0x20]
jne 0x1001c5c9
mov dword [esp + 0x20], edx
mov dword [esp + 0x34], 0xfffffffe
mov dword [esp + 0x34], 0x421ad7ba
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], eax
cmp dword [esp + 0x20], ebx
jne 0x1001c577
cmp dword [esp + 0x14], ebx
jne 0x1001c577
mov edx, ebx
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x8b47
setne dl
xor ecx, ecx
sub edx, 9
cmp eax, edx
mov eax, dword [esp + 0x14]
setg cl
xor edx, edx
cmp ecx, 0xdd9a
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x20]
setg cl
sub eax, ecx
mov dword [esp + 0x34], eax
jmp 0x1001c6af
mov eax, 0xcb7b
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe4], eax
mov dword [esp + 0xe8], eax
mov dword [esp + 0x18], 0xbbbfefa2
mov dword [esp + 0x38], 0xef321248
mov dword [esp + 0x2c], edx
mov dword [esp + 0x98], 0x7be8
mov dword [esp + 0x14], ebx
jmp 0x1001c61e
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x208], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001c60f
inc dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xdc]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x28], 0xfff7
je 0x1001c663
cmp dword [esp + 0x98], ebx
jne 0x1001c665
mov edx, ebx
mov eax, dword [esp + 0x38]
xor ecx, ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x70]
push 2
mov esi, dword [eax + 8]
mov eax, dword [esp + 0x2c]
cmp edx, eax
mov eax, dword [esp + 0xe0]
sete cl
xor edx, edx
cmp ecx, 0xfff7
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x30]
setge cl
imul ecx, esi
imul ecx, esi
pop esi
imul eax, ecx
mov dword [esp + 0x208], eax
lea ecx, [esp + 0x70]
call fcn.1001970b
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001c6e0
push ebx
push 0xc65
push 0x1448
push 0x1576
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
mov dword [esp + 0x18], ebx
jmp 0x1001c6ff
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xc4]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x1001c6e6
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff9
jg 0x1001c4b9
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [esp + 0x28], 0x68206240
lea ecx, [esp + 0x158]
mov dword [esp + 0x20], 8
mov dword [esp + 0x2c], 0xfffffff8
push esi
call fcn.10019689
push 3
pop eax
push 4
lea ecx, [esp + 0xf0]
mov byte [esp + 0x240], al
call fcn.10019689
mov dword [esp + 0x14], 0xc29478c9
mov dword [esp + 0x18], ebx
jmp 0x1001c77b
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x158]
mov dword [eax + ecx*4], 0x1e6e2bf
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1001c765
mov dword [esp + 0x18], ebx
jmp 0x1001c79d
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xec]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1001c787
mov dword [esp + 0x28], 0x1b
jmp 0x1001c7cc
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001c7c8
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
dec dword [esp + 0x28]
cmp dword [esp + 0x28], 0xfffffffd
jl 0x1001c7ae
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xec]
mov eax, dword [esp + 0x158]
dec dword [ecx + 0xc]
xor ecx, ecx
cmp dword [eax], 0x441791e6
setne cl
mov dword [eax], ecx
lea ecx, [esp + 0xec]
call fcn.1001970b
xor eax, eax
lea ecx, [esp + 0x158]
inc eax
mov byte [esp + 0x23c], al
call fcn.1001970b
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001c852
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1001c852
xor eax, eax
inc eax
mov dword [esp + 0x14], eax
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xffffffea
je 0x1001bf5f
or dword [esp + 0x23c], 0xffffffff
lea ecx, [esp + 0xc4]
call fcn.1001970b
inc dword [esp + 0x30]
mov esi, 0xfa6b86d5
cmp dword [esp + 0x30], 0xb
jle 0x1001b8b9
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x20], 0xdbc37078
or eax, 0xffffffff
mov dword [esp + 0x30], 0xf737a9a9
mov dword [esp + 0x190], eax
mov dword [esp + 0x194], eax
mov dword [esp + 0x198], eax
mov dword [esp + 0x19c], eax
push 3
mov dword [esp + 0x28], 5
mov dword [esp + 0x18], ebx
pop ecx
jmp 0x1001c8e2
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x104], 0x7c9d5fac
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1001c8cf
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x10c]
mov eax, dword [esp + 0x20]
cmp eax, 1
mov eax, dword [esp + 0x30]
setl cl
xor edx, edx
cmp ecx, eax
push 7
setle dl
xor ecx, ecx
pop eax
sub edx, eax
mov eax, dword [esp + 0x10c]
cmp eax, edx
mov eax, dword [esp + 0x104]
setl cl
add eax, ecx
jne 0x1001c93a
cmp dword [esp + 0x20], ebx
jne 0x1001c93a
mov eax, ebx
jmp 0x1001c93d
xor eax, eax
inc eax
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [esp + 0x19c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x24], 0xc
jmp 0x1001c9a5
mov dword [esp + 0x30], 6
jmp 0x1001c99a
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001c97d
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001c996
push 0xc21
push ebx
push ebx
push 0x142a
call edi
dec dword [esp + 0x30]
cmp dword [esp + 0x30], 0xfffffff7
jge 0x1001c962
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xfffffffd
jle 0x1001c958
xor edx, edx
inc edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x18], 0xf47a6de
mov dword [esp + 0x14], ebx
jmp 0x1001c9d5
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x44], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001c9c9
mov eax, dword [esp + 0x1c]
mov ecx, edx
sub eax, 0x56915a13
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x18], eax
cmp dword [esp + 0x1c], ebx
jne 0x1001c9fb
mov ecx, ebx
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x44], ebx
jle 0x1001ca09
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x1c]
imul eax, ecx, 0x37b1
xor ecx, ecx
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x1c]
test eax, eax
setle cl
add ecx, dword [esp + 0x1c]
cmp ecx, edx
je 0x1001cab9
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 0x12
jg 0x1001cb97
mov dword [esp + 0x38], ebx
mov dword [esp + 0x18], 0xffffffe8
jmp 0x1001ca87
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001ca7d
push 0xc9e
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp dword [esp + 0x38], ebx
jne 0x1001ca8e
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x18
jg 0x1001ca64
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001caa9
push ebx
push ebx
push 0x1c48
call esi
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x12
jle 0x1001ca56
jmp 0x1001cb94
push 2
lea ecx, [esp + 0x120]
call fcn.10019689
mov dword [esp + 0x38], 0xa74b4fbf
mov dword [esp + 0x14], ebx
jmp 0x1001cae8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x11c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001cad5
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 0x19
jne 0x1001cb6e
xor ecx, ecx
inc ecx
mov dword [esp + 0x38], 0x1494
mov dword [esp + 0x14], ebx
jmp 0x1001cb1a
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1c4], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1001cb0b
mov dword [esp + 0x1c], 0xb
jmp 0x1001cb5c
mov dword [esp + 0x14], ebx
jmp 0x1001cb43
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x80], 0x499e98c5
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1001cb30
mov eax, dword [esp + 0x11c]
mov dword [esp + 0x38], ecx
cmp dword [eax], ebx
jne 0x1001cb63
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffed
je 0x1001cb2a
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x19
je 0x1001cafd
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001cb88
push ebx
push 0x1903
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [esp + 0x11c]
call fcn.1001970b
xor edx, edx
inc edx
mov dword [esp + 0x2c], 0x1f782a18
push 8
pop eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], 0xfffffff7
mov dword [esp + 0x14], ebx
jmp 0x1001cbc8
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x3c], 0x6e83
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001cbb8
cmp dword [esp + 0x3c], ebx
jne 0x1001cc1e
mov eax, dword [esp + 0x3c]
xor ecx, ecx
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
cmp eax, 0xde6b
setle cl
xor edx, edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov eax, dword [esp + 0x3c]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x3c]
setge cl
imul eax, ecx
test eax, eax
jne 0x1001cc1b
mov eax, ebx
jmp 0x1001cc20
xor edx, edx
inc edx
mov eax, edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x3c]
cmp dword [esp + 0x3c], ebx
je 0x1001cd06
mov dword [esp + 0x18], 0xffffffff
mov eax, 0xb3533b01
mov dword [esp + 0x14], 0xc2f00273
mov dword [esp + 0x2c], 0xc1a1fd29
mov dword [esp + 0x1b0], eax
mov dword [esp + 0x1b4], eax
mov dword [esp + 0x1b8], eax
mov dword [esp + 0x1bc], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [esp + 0x18]
je 0x1001cc8c
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
setne dl
sub edx, dword [esp + 0x18]
jne 0x1001ccbb
cmp dword [esp + 0x18], ebx
jne 0x1001ccbb
mov eax, ebx
jmp 0x1001ccbe
xor eax, eax
inc eax
mov dword [esp + 0x14], eax
xor edx, edx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setg dl
mov dword [esp + 0x2c], edx
cmp dword [esp + 0x2c], ebx
jne 0x1001ccdf
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1b4], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001cd2d
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1001cd2d
mov dword [esp + 0x1c], ebx
jmp 0x1001cd26
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001cd22
push ebx
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffef
jg 0x1001cd0c
push 3
pop eax
mov dword [esp + 0x38], 0xfffffff7
lea ecx, [esp + 0xf8]
mov dword [esp + 0x38], 0x8939f5fa
push eax
call fcn.10019689
mov dword [esp + 0x23c], 4
lea eax, [esp + 0x1e8]
push dword [esp + 0x80]
movdqa xmm0, xmmword [0x10008070]
lea ecx, [esp + 0x8c]
push eax
lea eax, [esp + 0x1e0]
mov dword [esp + 0x2c], 0xb5131d8b
push eax
mov dword [esp + 0x38], 0xffffffff
push ebx
movdqu xmmword [esp + 0x1e8], xmm0
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
call fcn.1001ac2d
push 3
mov dword [esp + 0x18], ebx
pop edx
jmp 0x1001cdd1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0x580d416d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001cdbb
mov esi, dword [esp + 0xf8]
xor ecx, ecx
mov eax, dword [esi + 4]
cmp eax, dword [esi]
setl cl
xor eax, eax
cmp ecx, dword [esi + 8]
setl al
cmp dword [esi + 8], eax
je 0x1001cdfb
cmp dword [esp + 0x2c], ebx
je 0x1001ce07
cmp dword [esi + 4], ebx
je 0x1001ce07
xor eax, eax
lea edx, [eax + 1]
jmp 0x1001ce09
mov edx, ebx
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
add eax, dword [esi + 8]
cmp eax, dword [esi + 4]
push 7
setg cl
xor eax, eax
cmp ecx, edx
pop ecx
setg al
cmp ecx, eax
mov eax, dword [esp + 0x2c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov dword [esi + 8], edx
setl cl
xor eax, eax
xor edx, edx
inc eax
cmp ecx, eax
mov eax, dword [esp + 0x88]
setl dl
add edx, 0xfffb
mov dword [eax], edx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001ce6f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
lea ecx, [esp + 0x88]
call fcn.1001970b
or esi, 0xffffffff
lea ecx, [esp + 0xf8]
mov dword [esp + 0x23c], esi
call fcn.1001970b
mov dword [esp + 0x7c], ebx
lea ecx, [esp + 0x14c]
xor eax, eax
mov dword [esp + 0x24], 0x43250e6d
inc eax
mov dword [esp + 0x18], 0xc4ab274b
mov dword [esp + 0x30], eax
push 3
mov dword [esp + 0x2c], eax
pop eax
push eax
call fcn.10019689
push 3
mov dword [esp + 0x18], ebx
pop edx
jmp 0x1001cedf
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14c]
mov dword [eax + ecx*4], 5
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001cec9
xor ecx, ecx
inc ecx
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
neg eax
mov dword [esp + 0x18], eax
je 0x1001cf3a
mov dword [esp + 0x18], ecx
mov edx, ecx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
imul eax, dword [esp + 0x18]
imul eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x30], ebx
jne 0x1001cf3c
mov edx, ebx
mov eax, dword [esp + 0x14c]
xor ecx, ecx
push 2
cmp edx, dword [eax + 4]
setg cl
mov dword [eax], ecx
pop eax
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], ebx
jl 0x1001d002
mov dword [esp + 0x2c], 0xff57440e
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], ebx
jl 0x1001cfd8
mov dword [esp + 0x14], 0x3abefa02
mov dword [esp + 0x38], 0xfffffff9
mov dword [esp + 0x18], ebx
jmp 0x1001cfa6
mov dword [esp + 0x38], 0x6095610a
mov dword [esp + 0x38], 0x38f738f5
mov dword [esp + 0x38], 0xfffffffb
dec dword [esp + 0x2c]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], eax
jle 0x1001cf86
mov dword [esp + 0x14], ebx
jmp 0x1001cfcc
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001cfc8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push 2
pop eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], eax
jle 0x1001cfb2
dec dword [esp + 0x28]
jns 0x1001cf70
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001cff8
push ebx
push 0xf93
push 0x145
push ebx
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
push 2
pop eax
dec dword [esp + 0x30]
jns 0x1001cf5e
lea ecx, [esp + 0x14c]
call fcn.1001970b
mov dword [esp + 0x14], ebx
jmp 0x1001d023
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x220], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001d014
mov eax, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x34]
imul eax, dword [esp + 0x20]
push ebx
imul ecx, eax, 0xfffe
mov eax, dword [esp + 0x38]
cmp eax, ecx
mov eax, dword [esp + 0x24]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x30]
setne cl
mov dword [esp + 0x3c], ecx
xor ecx, ecx
cmp eax, dword [esp + 0x3c]
lea eax, [esp + 0x80]
push eax
setge cl
imul ecx, dword [esp + 0x28]
mov dword [esp + 0x40], ecx
call fcn.100206f4
mov dword [esp + 0x2c], 0xdbc37078
mov dword [esp + 0x38], 0xf737a9a9
mov dword [esp + 0x178], esi
pop ecx
mov dword [esp + 0x178], esi
pop ecx
mov dword [esp + 0x178], esi
mov dword [esp + 0x17c], esi
push 3
mov dword [esp + 0x24], 5
mov dword [esp + 0x18], ebx
pop ecx
jmp 0x1001d0d9
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x164], 0x7c9d5fac
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1001d0c6
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x16c]
mov eax, dword [esp + 0x24]
cmp eax, 1
mov eax, dword [esp + 0x30]
setl cl
xor edx, edx
cmp ecx, eax
push 7
setle dl
xor ecx, ecx
pop eax
sub edx, eax
mov eax, dword [esp + 0x16c]
cmp eax, edx
mov eax, dword [esp + 0x164]
setl cl
add eax, ecx
jne 0x1001d131
cmp dword [esp + 0x24], ebx
jne 0x1001d131
mov eax, ebx
jmp 0x1001d134
xor eax, eax
inc eax
mov dword [esp + 0x17c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], 0xc
jmp 0x1001d19a
mov dword [esp + 0x30], 6
jmp 0x1001d18f
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001d172
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001d18b
push 0xc21
push ebx
push ebx
push 0x142a
call edi
dec dword [esp + 0x30]
cmp dword [esp + 0x30], 0xfffffff7
jge 0x1001d153
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffffd
jle 0x1001d149
mov dword [esp + 0x20], 0x64a6847d
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], 0xfffffffc
jle 0x1001d1f1
xor ecx, ecx
inc ecx
mov dword [esp + 0x38], 0x9924
mov dword [esp + 0x34], 0xfffffffa
mov dword [esp + 0x14], ebx
jmp 0x1001d1dc
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1c0], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1001d1cd
dec dword [esp + 0x34]
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffffc
jg 0x1001d1b7
mov eax, dword [esp + 0x84]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x58]
mov edi, edx
mov esi, eax
call fcn.1001b401
mov ecx, dword [esp + 0x234]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret