Function at 0x100189e1
Capabilities:
Create pipe
Get session user name
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push ebx
mov dword [ebp - 0x64], edx
or eax, 0xffffffff
push esi
mov dword [ebp - 0xc], 0xfffffffe
xor esi, esi
push edi
inc esi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 4], 8
mov dword [ebp - 0x34], 0x7b568be1
mov dword [ebp - 0x14], 0x5752
push 3
pop edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0xcc702b5b
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], ebx
jmp 0x10018a40
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x94], 0x20bd2ab
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x10018a2f
mov dword [ebp - 8], ebx
jmp 0x10018a58
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x60], 0x57257ea0
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x10018a4a
mov dword [ebp - 8], ebx
jmp 0x10018a6f
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xf8], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x10018a62
mov dword [ebp - 8], ebx
jmp 0x10018a8b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1a0], 0x65392fb3
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x10018a7a
mov eax, dword [ebp - 4]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
je 0x10018aa2
mov eax, esi
cmp dword [ebp - 0xc], ebx
jne 0x10018aa4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
sub ecx, 0xcbbbc254
add ecx, eax
mov eax, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x94]
imul eax, dword [ebp - 0x34]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xf8]
mov eax, dword [ebp - 0xf8]
cmp ecx, eax
setl dl
cmp edx, dword [ebp - 0xec]
jle 0x10018aff
mov eax, dword [ebp - 0xf8]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
inc dword [ebp - 0x60]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp edx, eax
mov eax, dword [ebp - 0xc]
sete cl
xor edx, edx
sub ecx, 5
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setl dl
xor ecx, ecx
add edx, 0x9d05
cmp eax, edx
setge cl
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x28], ebx
jne 0x10018b7f
mov eax, dword [ebp - 0xf8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 4]
sub ecx, eax
neg ecx
sbb ecx, ecx
or eax, 0xffffffff
inc ecx
cmp eax, ecx
sbb eax, eax
xor edx, edx
lea ecx, [eax - 0x59a37449]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, ebx
setl dl
mov dword [ebp - 0x19c], edx
test edx, edx
je 0x10018b81
mov eax, esi
mov dword [ebp - 0x14], eax
mov eax, 0x3556
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], ebx
jmp 0x10018bb6
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1d0], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10018ba9
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], edi
jg 0x10018cd8
mov eax, 0x6986d6
mov dword [ebp - 8], 0xfffffffc
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10018c14
push ebx
push 0xe4f
push 0x168e
push ebx
push 0xd86
push 0x1a00
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10018c23
push ebx
call dword [sym.imp.USER32.dll_CreateIconIndirect]
mov dword [ebp - 8], edi
cmp dword [ebp - 8], ebx
jl 0x10018cc7
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10018c3f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [ebp - 8]
xor ecx, ecx
or edx, 0xffffffff
mov eax, dword [ebp + eax*4 - 0xac]
cmp eax, edx
setne cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xac]
cmp eax, dword [ebp - 0x14]
jne 0x10018c84
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xac]
imul eax, dword [ebp - 0x1cc]
test eax, eax
je 0x10018c84
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xac]
mov eax, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xac]
cmp eax, esi
setle cl
xor edx, edx
add ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xac]
cmp ecx, eax
mov eax, dword [ebp - 0xa8]
setle dl
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
mov dword [ebp - 0x12c], ecx
dec dword [ebp - 8]
jns 0x10018c2f
inc dword [ebp - 4]
mov eax, 0x6986d6
cmp dword [ebp - 4], edi
jle 0x10018bcd
mov dword [ebp - 0x18], 0x48d327cb
or eax, 0xffffffff
mov dword [ebp - 0x18], 0xdb505206
mov dword [ebp - 0x18], 0x83c8fc55
mov dword [ebp - 0x18], 0x7d214c40
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0x7822e6e7
mov dword [ebp - 0x18], 0x971867b8
mov dword [ebp - 0x18], 0x69f30c
mov dword [ebp - 0x18], 0xba47
mov dword [ebp - 0x14], 0xde0980db
mov dword [ebp - 0xc], ebx
jmp 0x10018d33
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1f4], 0xfffffff8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x10018d22
dec dword [ebp - 0x14]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10018d52
call edi
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
mov dword [ebp - 0x18], 0x722a
mov dword [ebp - 8], 0xc558
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
jmp 0x10018d79
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xb8], 0xffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x10018d68
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10018d8c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [ebp - 8], ebx
je 0x10018dab
imul eax, dword [ebp - 8], 0xdcba
mov dword [ebp - 4], eax
mov eax, esi
cmp dword [ebp - 4], ebx
jne 0x10018da4
mov eax, ebx
mov ecx, esi
cmp eax, dword [ebp - 8]
jge 0x10018dad
mov ecx, ebx
mov eax, dword [ebp - 8]
xor edx, edx
mov ebx, dword [sym.imp.USER32.dll_GetDC]
add eax, ecx
cmp eax, 0x4c40
mov eax, dword [ebp - 8]
setne dl
xor ecx, ecx
cmp eax, edx
setne cl
or edx, 0xffffffff
cmp edx, ecx
sbb eax, eax
neg eax
add eax, dword [ebp - 8]
je 0x10018e6d
xor ecx, ecx
mov dword [ebp - 0xc], ecx
jmp 0x10018df6
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1e8], 0xfffffff8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x10018de5
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 2
jg 0x10018ec4
mov dword [ebp - 0xc], ecx
jmp 0x10018e1f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x16c], 0x227
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x10018e0e
inc dword [ebp - 0x16c]
mov dword [ebp - 4], 2
cmp dword [ebp - 4], ecx
jl 0x10018e62
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x10018e5d
push 0xc1e
push 0x202
push 0x2633
push 0x931
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor ecx, ecx
dec dword [ebp - 4]
jns 0x10018e37
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jle 0x10018e09
jmp 0x10018ec1
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x11
je 0x10018ec4
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x10018e8a
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor ecx, ecx
mov dword [ebp - 8], ecx
jmp 0x10018eb3
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x10018ea6
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_EndPage]
xor ecx, ecx
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0xb8]
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jle 0x10018e8f
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x11
jne 0x10018e78
or edx, 0xffffffff
mov dword [ebp - 4], ecx
jmp 0x10018eda
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x9c], 9
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10018ec9
mov dword [ebp - 0x14], 0xb72fd491
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x34], 0xc5b641b4
mov dword [ebp - 0xc], 0xbc1b0fe2
mov dword [ebp - 4], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x18], 0xd9f6c850
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], ecx
jmp 0x10018f17
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x30], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x10018f0d
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
xor ecx, ecx
cmp eax, 6
setle cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x30]
neg ecx
mov dword [ebp - 0x14], eax
sbb ecx, ecx
mov dword [ebp - 0x1c], 0x196a
mov eax, dword [ebp - 0x30]
neg ecx
mov edx, dword [ebp - 0x30]
add eax, ecx
imul edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x30]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, 0x7e280bfe
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x30]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp eax, edx
setge cl
xor edx, edx
mov dword [ebp - 4], ecx
mov dword [ebp - 4], edx
cmp dword [ebp - 4], edx
jl 0x10019088
mov dword [ebp - 8], 0x9a164e6
mov dword [ebp - 0x28], 0x892657cf
mov dword [ebp - 0x14], 0x7420
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, eax
cmp ecx, 0xc09c4f4
je 0x10018fd5
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x30]
cmp eax, esi
setne cl
xor eax, eax
neg ecx
cmp ecx, esi
setge al
cmp dword [ebp - 4], eax
jg 0x10018ffc
cmp dword [ebp - 0x34], edx
je 0x10018ffe
mov edx, esi
mov eax, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp edx, eax
setge cl
xor esi, esi
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xc], esi
jne 0x10019030
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x28]
cmp eax, 0xf376
setle cl
imul edx, ecx
test edx, edx
jne 0x10019057
cmp dword [ebp - 8], esi
jne 0x10019057
mov eax, esi
xor esi, esi
inc esi
jmp 0x1001905c
xor esi, esi
inc esi
mov eax, esi
inc dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x18]
add ecx, eax
mov eax, dword [ebp - 0x14]
cmp eax, ecx
push 0
setne dl
xor eax, eax
cmp edx, 0x20822c3
pop edx
setg al
mov dword [ebp - 0x1c], eax
dec dword [ebp - 4]
jns 0x10018fa6
mov dword [ebp - 4], edx
jmp 0x1001909b
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x48], 0x4cd45360
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001908d
mov dword [ebp - 0x44], esi
cmp dword [ebp - 0x44], edx
jl 0x1001944a
mov eax, 0xcbedfa90
mov dword [ebp - 0x18], 0xc234ac01
mov dword [ebp - 0x1c], 0x5020f89b
mov dword [ebp - 0x14], 0xb40e11a7
mov dword [ebp - 4], esi
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xc], edx
jmp 0x100190f5
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x80], 0x5f70
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x100190e7
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], edx
jl 0x10019283
xor ebx, ebx
inc ebx
or edi, 0xffffffff
mov dword [ebp - 8], 0x52c58fb7
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x18], 0x88acc167
mov dword [ebp - 0x28], 7
mov dword [ebp - 0xc], edx
jmp 0x1001913f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1b8], 0xdaf0b56f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x1001912e
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], edx
jl 0x10019268
mov dword [ebp - 0xc], 0x62ee6d05
mov dword [ebp - 0x14], 7
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], edx
jl 0x1001924b
mov dword [ebp - 0x14], 0xa2e712c5
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x14], 0x550e8f7c
mov dword [ebp - 0x14], 0x97cbb402
mov dword [ebp - 0x20], 0xb6062cf9
mov dword [ebp - 4], edx
jmp 0x100191a4
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x78], 6
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x10019196
mov dword [ebp - 0x78], edx
cmp dword [ebp - 0x78], ebx
jg 0x1001923f
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 0x334adc6f
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x80]
cmp dword [ebp - 0x78], edx
jne 0x100191e4
mov eax, dword [ebp - 8]
mov ecx, edx
neg eax
sbb eax, eax
add eax, 9
cmp eax, dword [ebp - 0x78]
jg 0x100191e6
mov ecx, ebx
mov eax, dword [ebp - 0x78]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x80]
imul eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x80]
sete dl
sub edx, eax
jne 0x10019212
xor esi, esi
cmp dword [ebp - 8], esi
je 0x10019214
mov esi, ebx
mov eax, dword [ebp - 0x78]
xor ecx, ecx
cmp esi, 0xfffffff7
push 0
setge cl
mov edx, dword [ebp + eax*4 - 0x80]
xor eax, eax
cmp ecx, edx
pop edx
setge al
mov dword [ebp - 4], eax
dec dword [ebp - 0x20]
inc dword [ebp - 0x78]
cmp dword [ebp - 0x78], ebx
jle 0x100191b6
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0xc]
jns 0x1001916b
mov dword [ebp - 4], edx
jmp 0x1001925a
mov dword [ebp - 0x14], 0xc7e7c0ce
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jle 0x10019250
dec dword [ebp - 8]
jns 0x10019151
inc dword [ebp - 0x28]
dec dword [ebp - 0x1c]
jns 0x1001910d
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor esi, esi
mov ebx, dword [sym.imp.USER32.dll_GetDC]
inc esi
mov dword [ebp - 4], 0xffffffef
jmp 0x10019299
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], 0xae0512ed
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xc
jle 0x1001928c
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 8], 0x971c1ec2
mov dword [ebp - 0x14], 6
mov dword [ebp - 0xc], edx
jmp 0x100192c7
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x40], 0x91a049fe
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x100192b9
mov dword [ebp - 8], edx
cmp dword [ebp - 8], edx
jl 0x100193ad
xor edi, edi
xor esi, esi
inc edi
xor edx, edx
mov dword [ebp - 0x1c], 0xffff
mov eax, dword [ebp - 8]
test eax, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 8]
imul edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
cmp edx, 0x237f4a7d
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
add ecx, 0x8576
cmp ecx, 0xec0dcee
jne 0x10019327
cmp dword [ebp - 0x14], esi
jne 0x1001932a
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x40]
cmp dword [ebp - 0x1c], esi
jne 0x1001933d
mov ecx, esi
cmp dword [ebp - 0x40], esi
je 0x1001933f
mov ecx, edi
mov eax, dword [ebp - 0x40]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
cmp edi, eax
mov eax, dword [ebp - 8]
sbb edx, edx
xor ecx, ecx
neg edx
mov eax, dword [ebp + eax*4 - 0x40]
cmp eax, edx
setl cl
imul ecx, dword [ebp - 0x1c]
cmp ecx, 0xfffffff9
jge 0x1001936d
mov edx, esi
cmp dword [ebp - 0x14], esi
je 0x1001936f
mov edx, edi
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 8]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setg dl
mov ecx, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 8]
sub ecx, edx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp + eax*4 - 0x40], ecx
dec dword [ebp - 8]
jns 0x100192dd
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor esi, esi
xor edx, edx
inc esi
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x100193c9
push 0xe96
push 0x42
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov eax, dword [ebp - 0x44]
xor ecx, ecx
push 0
mov eax, dword [ebp + eax*4 - 0x9c]
cmp eax, esi
mov eax, dword [ebp - 0x44]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x44]
sete cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x9c]
imul eax, ecx
mov ecx, 0x244d
sub ecx, eax
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x9c]
cmp edx, eax
mov eax, dword [ebp - 0x44]
setge cl
sub ecx, eax
mov eax, dword [ebp - 0x44]
pop edx
mov eax, dword [ebp + eax*4 - 0x9c]
add eax, 0x83ac
add eax, ecx
mov dword [ebp - 0x98], eax
mov eax, 0xcbedfa90
dec dword [ebp - 0x44]
jns 0x100190b2
mov edi, dword [ebp - 0x24]
cmp dword [edi + 0x10], edx
jne 0x10019459
xor al, al
jmp 0x1001a083
push edx
lea eax, [ebp - 0x64]
push 0x7062
push eax
call fcn.1001c291
or eax, 0xffffffff
add esp, 0xc
mov dword [ebp - 0x90], eax
xor ebx, ebx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x14], 0xa9b27fa
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], 0x1c5a3d7f
mov dword [ebp - 0xc], ebx
jmp 0x100194af
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x194], 0x120dd93b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001949e
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x100194d3
push 0x2636
push ebx
push 0x270a
push 0x5bd
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [ebp - 0x88]
xor edx, edx
mov eax, dword [ebp - 0x88]
cmp eax, 5
mov eax, dword [ebp - 0x84]
setle dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jne 0x1001950f
mov eax, ebx
cmp dword [ebp - 0x14], ebx
je 0x10019511
mov eax, esi
xor ecx, ecx
or edx, 0xffffffff
cmp eax, edx
setne cl
sub ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x88]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
setle dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x88]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x88]
setl bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x88]
setle cl
add eax, 0x4c82
add eax, ecx
imul eax, eax, 0xf43b
mov dword [ebp - 0x18c], eax
or eax, 0xffffffff
mov dword [ebp - 0xc], 0xb7c7ce53
xor ebx, ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x18], 0x40b319b
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], ebx
jmp 0x100195c3
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xe8], 0xffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x100195b2
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], 2
jg 0x10019747
push 4
or edi, 0xffffffff
pop ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 0xee491ba6
mov dword [ebp - 0x18], 0x32d38ca8
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0xc8], ecx
mov dword [ebp - 0xc4], ecx
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0x18], 0xd1b4
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 4], ebx
jmp 0x10019628
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xbc], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001961b
mov dword [ebp - 8], 2
cmp dword [ebp - 8], ebx
jl 0x1001971c
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], 0x50fa8fad
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x18], 0x5ef13550
mov dword [ebp - 4], ebx
jmp 0x1001966b
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x204], 0x253d9751
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x1001965a
mov dword [ebp - 4], ebx
jmp 0x10019686
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x15c], 0xbf68
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x10019675
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0xe8], ebx
je 0x100196d0
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, esi
mov eax, dword [ebp + eax*4 - 0xe8]
cmp eax, 0xd271
setne cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0xc]
test eax, eax
setg cl
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], ebx
jne 0x100196d2
mov edx, ebx
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 8]
push 0
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setne dl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0xe8]
cmp edx, eax
mov eax, dword [ebp - 8]
setle bl
xor ecx, ecx
shl ebx, 2
cmp ebx, eax
pop ebx
setne cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x158]
dec dword [ebp - 8]
push 4
pop ecx
jns 0x1001963d
mov dword [ebp - 4], ebx
jmp 0x10019732
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xbc], 8
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x10019721
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jle 0x100195dc
mov edi, dword [ebp - 0x24]
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
push 4
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0xc], ebx
pop ecx
jmp 0x1001976d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1b0], 0x9841
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001975c
mov eax, 0x6f2e
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 4], 0x46158d32
mov dword [ebp - 0x14], 0xc6a3f154
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 4], ebx
jmp 0x100197cb
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x17c], 0x9a20b287
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x100197ba
mov dword [ebp - 4], ebx
jmp 0x100197e6
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x188], 0xb40e11a7
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x100197d5
mov eax, dword [ebp - 0xdc]
xor ecx, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x170]
cmp eax, 0x58905b8b
mov eax, dword [ebp - 4]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 4]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x188], ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x14]
neg edx
sbb edx, edx
lea eax, [edx + 0x10000]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x170]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 4]
jle 0x10019874
mov eax, esi
cmp dword [ebp - 0x170], ebx
jne 0x10019876
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], ebx
jl 0x10019a6d
mov dword [ebp - 0xc], 0xbb6748f6
mov dword [ebp - 0xc], 0x87013dce
mov dword [ebp - 0x18], 0xe2b7
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], ebx
jmp 0x100198c0
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x11c], 0x7f825e7a
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x100198af
mov dword [ebp - 8], ebx
jmp 0x100198d9
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x5c], 0x2a83
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x100198cb
push 2
mov dword [ebp - 8], ebx
pop ecx
jmp 0x100198f3
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x110], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x100198e6
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], ecx
jg 0x1001998e
or edx, 0xffffffff
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 4], ebx
jmp 0x1001992d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x214], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x10019920
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], ebx
jl 0x1001997f
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001996a
push ebx
push 0xfdb
push 0x440
push 0x197a
push 0x20ee
push 0x1096
push 0x1478
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x11c]
dec dword [ebp - 4]
jns 0x1001993b
push 2
pop ecx
or edx, 0xffffffff
dec dword [ebp - 0x5c]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jle 0x10019907
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], 0xffff
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x114], esi
mov dword [ebp - 0xc], ebx
jmp 0x100199d5
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1b0], 0x7fd1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x100199c4
mov dword [ebp - 0xc], ebx
jmp 0x100199ee
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x3c], 0x8c6a53d0
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x100199e0
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], 0xfffffff7
jg 0x10019a54
mov dword [ebp - 0x20], ebx
xor edx, edx
mov dword [ebp - 0x14], 0xe9fb1c03
mov dword [ebp - 0x28], 0xd9d75405
mov dword [ebp - 0x20], ebx
neg dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
sub ecx, 0x61fc2da8
cmp eax, ecx
mov eax, dword [ebp - 0x20]
push 0
setle dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x3c]
setl bl
xor ecx, ecx
cmp eax, ebx
pop ebx
setle cl
xor eax, eax
cmp ecx, 0x1f78
setl al
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff7
jle 0x100199fc
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019a64
push ebx
call fcn.1001c00d
pop ecx
dec dword [ebp - 0x1c]
jns 0x10019892
xor edx, edx
mov dword [ebp - 4], 0xc9a130df
mov dword [ebp - 8], ebx
inc edx
jmp 0x10019a8a
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x38], 0xca63
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x10019a7c
mov dword [ebp - 8], ebx
jmp 0x10019a9e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x2c], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x10019a94
mov dword [ebp - 8], ebx
jmp 0x10019ab9
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x14c], 0xbd2f23d
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x10019aa8
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ebx
jl 0x10019b85
mov dword [ebp - 0x1c], 0x2894ff54
mov dword [ebp - 0x14], 5
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x38], ecx
mov eax, 0x2f3f6085
sub eax, ecx
jne 0x10019b01
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0x1c]
cmp eax, 0xffffffff
setle cl
sub ecx, dword [ebp - 4]
sub ecx, 0xc5ad058b
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x144], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x14], eax
jl 0x10019b5b
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp - 4]
mov dword [ebp - 4], ebx
jmp 0x10019b77
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x38], 0xfffffffe
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x10019b69
dec dword [ebp - 0x2c]
jns 0x10019acb
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019bac
push 0x6ef
push 0x159a
push 0xb39
push 0x14b0
push ebx
call dword [sym.imp.USER32.dll_SetRect]
xor edx, edx
inc edx
cmp dword [edi + 0x14], 0x10
jb 0x10019bb6
mov esi, dword [edi]
jmp 0x10019bb8
mov esi, edi
cmp dword [edi + 0x14], 0x10
jb 0x10019bc2
mov ecx, dword [edi]
jmp 0x10019bc4
mov ecx, edi
mov eax, dword [edi + 0x10]
add eax, ecx
cmp esi, eax
je 0x1001a081
mov dword [ebp - 0x18], 3
mov dword [ebp - 8], ebx
jmp 0x10019bee
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x160], 0x8eac8b13
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x10019bdd
mov dword [ebp - 8], ebx
jmp 0x10019c06
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x58], 0x3fcb50bf
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x10019bf8
mov dword [ebp - 8], ebx
jmp 0x10019c21
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x150], 0x29729cf3
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x10019c10
mov dword [ebp - 8], ebx
jmp 0x10019c3c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1dc], 0xf63588c5
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x10019c2b
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019c55
push ebx
call fcn.1001cb8a
xor edx, edx
pop ecx
inc edx
mov dword [ebp - 0x58], ebx
cmp dword [ebp - 0x58], ebx
jl 0x10019cf0
mov dword [ebp - 0xc], 0x2a1e
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x18], 0x1dfd9475
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], 0xa3735b26
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], 0x956e74e8
mov dword [ebp - 0x18], 0xe043eef7
mov dword [ebp - 4], ebx
jmp 0x10019caa
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1c0], 0xfffffffb
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10019c99
cmp dword [ebp - 0xc], ebx
jne 0x10019cf0
mov dword [ebp - 0xc], ebx
jmp 0x10019ce2
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
jmp 0x10019cd6
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x224], 7
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x10019cc5
inc dword [ebp - 0x14]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jle 0x10019cba
dec dword [ebp - 0x58]
jns 0x10019c61
mov al, byte [esi]
cmp al, 0x30
jl 0x10019e68
cmp al, 0x39
jg 0x10019e68
mov dword [ebp - 0xc], 0x4cd4536
mov dword [ebp - 0x18], 5
mov dword [ebp - 0xc], ebx
jmp 0x10019d23
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x6c], 8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10019d15
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], ebx
jl 0x10019e4f
or edi, 0xffffffff
mov dword [ebp - 0x1c], 0x3314648a
mov dword [ebp - 4], ebx
jmp 0x10019d52
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x54], 0x98311173
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x10019d44
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019d6b
xor cl, cl
call fcn.100185ed
xor edx, edx
inc edx
mov dword [ebp - 0x54], ebx
jmp 0x10019e3a
mov dword [ebp - 0x14], 0xfffffff6
xor edx, edx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x6c]
mov dword [ebp - 0x14], 0xfffffffd
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
cmp eax, ecx
mov eax, dword [ebp - 0x54]
setl dl
add edx, 0x9d5fb08a
neg edx
mov eax, dword [ebp + eax*4 - 0x6c]
sbb edx, edx
xor ecx, ecx
add edx, 2
cmp edx, 0xb818f8f6
setne cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x50]
cmp ecx, eax
mov ecx, dword [ebp - 0x54]
mov eax, 0xfff9
setle dl
cmp eax, edx
sbb eax, eax
neg eax
cmp eax, 1
sbb eax, eax
neg eax
imul ecx, eax
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x6c]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
imul eax, eax, 5
test eax, eax
jne 0x10019df9
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x6c]
cmp eax, ecx
setge dl
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], ebx
je 0x10019e1a
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, edi
setne cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x54]
inc edx
cmp dword [ebp - 0x54], edx
jle 0x10019d73
dec dword [ebp - 0xc]
jns 0x10019d38
mov edi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x64]
movsx eax, byte [esi]
imul ecx, dword [edx], 0xa
add ecx, 0xffffffd0
add eax, ecx
inc esi
mov dword [edx], eax
xor edx, edx
inc edx
jmp 0x10019bb8
mov dword [ebp - 0xc], edx
or esi, 0xffffffff
mov dword [ebp - 0x24], 0x7e71f09a
mov dword [ebp - 0x20], 7
mov dword [ebp - 0xc], 0x13
cmp dword [ebp - 0xc], 0xffffffe7
je 0x10019f2e
mov dword [ebp - 4], 0xfffffffc
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], ebx
jmp 0x10019ead
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xb4], 0xe6e3245f
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10019e9c
mov dword [ebp - 4], ebx
jmp 0x10019eeb
mov dword [ebp - 0x18], edx
xor ecx, ecx
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xb4]
test eax, eax
setne cl
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019ee8
push 0x34a2
push ebx
call fcn.1001a0c8
pop ecx
xor edx, edx
pop ecx
inc edx
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jle 0x10019eb8
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xb4], eax
jge 0x10019f17
mov ecx, ebx
cmp dword [ebp - 0x14], ebx
je 0x10019f19
mov ecx, edx
mov eax, dword [ebp - 0xc]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
dec dword [ebp - 0xc]
jmp 0x10019e83
mov eax, dword [ebp - 0x64]
push 0xfffffffffffffffe
mov dword [eax], ebx
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0x1af6658d
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0x4415e40c
mov dword [ebp - 8], ebx
jmp 0x10019f6b
mov dword [ebp - 0x18], esi
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019f65
mov cl, dl
call fcn.100185ed
xor edx, edx
inc edx
mov eax, dword [ebp - 0x18]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff2
jl 0x10019f4f
mov dword [ebp - 8], 0xffffffe8
cmp dword [ebp - 8], 0xffffffea
jge 0x10019452
mov esi, 0x2df3d37a
mov dword [ebp - 4], 0x887cf2e5
mov dword [ebp - 0x24], 0x5e04a276
mov dword [ebp - 4], ebx
jmp 0x1001a065
mov dword [ebp - 0x108], esi
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x100], esi
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0x24], 0x7276cc72
imul eax, dword [ebp - 0x108], 0x5fe4
test eax, eax
je 0x1001a05d
mov dword [ebp - 0xc], 0xccc89593
mov dword [ebp - 0xc], 0xa
jmp 0x1001a055
mov dword [ebp - 0x1c], 0x7855
cmp dword [ebp - 0x1c], ebx
jne 0x1001a062
mov dword [ebp - 0x24], edx
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x108]
cmp ecx, eax
mov eax, dword [ebp - 8]
setge dl
xor ecx, ecx
cmp eax, 1
setle cl
sub edx, ecx
mov dword [ebp - 0x24], edx
je 0x1001a01d
cmp dword [ebp - 0xc], ebx
je 0x1001a01d
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setg dl
cmp dword [ebp - 0x1c], edx
jne 0x1001a045
cmp dword [ebp - 8], ebx
je 0x1001a045
xor edx, edx
inc edx
mov ecx, edx
jmp 0x1001a04a
xor edx, edx
mov ecx, ebx
inc edx
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x14], ecx
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 6
jge 0x10019fde
jmp 0x1001a062
cmp dword [ebp - 0x14], ebx
jne 0x1001a06f
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xc
je 0x10019f9d
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffea
jl 0x10019f87
jmp 0x10019452
mov al, dl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret