Function at 0x100179ea
Capabilities:
Connect pipe
Query environment variable

Disassembly:
mov eax, 0x1005f36a
call fcn.1005e6e0
sub esp, 0x248
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x2c], 0x270f9e3
push ebx
mov dword [ebp - 0x30], 0x2522abf7
xor ebx, ebx
mov dword [ebp - 0x30], 0x40dfe9f4
mov dword [ebp - 0x34], ebx
push esi
mov dword [ebp - 0x30], 0x81a
cmp dword [ebp - 0x30], 0x9a1
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xc4], edx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x190], ebx
jle 0x10017a9c
mov esi, ebx
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0x20c]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10017a63
mov eax, dword [eax]
push eax
call fcn.10047d34
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x20c]
call fcn.10002050
inc edi
cmp edi, 0xad9
jl 0x10017a44
inc esi
cmp esi, 0x378
jl 0x10017a42
push 0x1f5
push 1
push 0x1869
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x20], 0x509b9552
cmp dword [ebp - 0x30], 0x67a
jge 0x10017ab7
push str.kcnmbdppx_sabwr_wsn_rgtpzrfdu
call fcn.10047d34
pop ecx
or dword [ebp - 4], 0xffffffff
xor ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x20], ebx
jmp 0x10017ad4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x78], 0x93bd5de1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10017ac6
cmp dword [ebp - 0x28], ebx
je 0x10017ae7
dec dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x78]
xor edx, edx
mov dword [ebp - 0x78], 0xf7d9
mov eax, dword [ebp - 0x28]
cmp eax, 0x1585d
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x30], ecx
inc edx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0xa1c1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sub edx, eax
mov eax, dword [ebp - 0x28]
cmp eax, edx
setne cl
imul eax, ecx, 0xf1e2
cmp eax, 0x91f199e1
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], 0x3099cfe0
mov dword [ebp - 0x2c], 0x7c422d5f
mov dword [ebp - 0x34], 0x9305
mov dword [ebp - 0x20], ebx
jmp 0x10017b8c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x6c], 0xf07b4bc6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10017b7e
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x18]
je 0x10017bae
cmp dword [ebp - 0x18], ebx
je 0x10017bae
xor eax, eax
inc eax
jmp 0x10017bb0
mov eax, ebx
push 2
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], ebx
pop esi
jmp 0x10017c82
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x30], 0xcaf1e2cd
mov dword [ebp - 0x1c], ebx
jmp 0x10017be2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x150], 0x520f3038
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10017bd1
mov dword [ebp - 0x1c], ebx
jmp 0x10017bfd
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc0], 0xdefcecb2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x10017bec
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x20], 0xd06721f7
cmp dword [ebp - 0x68], ebx
jne 0x10017c15
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x6c]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x14c], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x6c]
cmp edx, eax
setl cl
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, 0x74006310
setg cl
mov dword [ebp - 0xc0], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10017bbe
push dword [ebp - 0x70]
movdqa xmm0, xmmword [0x1006de30]
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x1bc]
mov dword [ebp - 0xb0], ebx
push eax
push ebx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xac], ebx
movdqu xmmword [ebp - 0x1bc], xmm0
mov dword [ebp - 0xa8], ebx
call fcn.1000f43a
mov dword [ebp - 4], esi
xor edx, edx
mov dword [ebp - 0x20], 0x6d444182
inc edx
mov dword [ebp - 0x34], 0x95998ab5
mov dword [ebp - 0x3c], 0x24f20479
mov dword [ebp - 0x3c], 0x817d1dc6
mov dword [ebp - 0x20], ebx
jmp 0x10017d02
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x194], 0xa955a63a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10017cf1
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], ebx
jl 0x10017e93
mov dword [ebp - 0x30], 0x5925ef2c
mov dword [ebp - 0x3c], 0x7cfaf42
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0x70012af0
mov dword [ebp - 0x3c], 0x8a9017ca
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x28], 0x3edf
cmp dword [ebp - 0x28], 0x3f56
jle 0x10017db1
mov ecx, ebx
mov dword [ebp - 0x2c], ebx
mov edi, ebx
mov dword [ebp - 0x30], ebx
mov esi, ebx
mov eax, edi
mov dword [ebp - 0x34], ebx
cdq
mov edi, ecx
idiv esi
sub edi, edx
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x1007ab78
cdq
push edx
push eax
call fcn.10001bfe
inc ebx
cmp ebx, 0x78e4
jl 0x10017d68
mov edi, dword [ebp - 0x30]
inc esi
mov ecx, dword [ebp - 0x2c]
push 0
pop ebx
cmp esi, 0xb7e
jl 0x10017d5c
inc edi
mov dword [ebp - 0x30], edi
cmp edi, 0x3d35
jl 0x10017d5a
inc ecx
mov dword [ebp - 0x2c], ecx
cmp ecx, 0x5ba5
jl 0x10017d55
push 2
pop esi
mov dword [ebp - 0x3c], 6
mov byte [ebp - 4], 3
cmp dword [ebp - 0x28], 0x3c08
jge 0x10017df5
mov edx, str.lwceyemg_thv_mxlpfpp_bnzy_izytv_hrpmpa_phmef_zxnrmjss_pouqdns
mov ecx, 0x1007ab78
call fcn.100039fb
jmp 0x10017df5
mov dword [ebp - 4], esi
xor edx, edx
mov dword [ebp - 0x3c], 0xfffffffc
inc edx
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x3c], 0xe779066
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x1c], ebx
jmp 0x10017e3c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1dc], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10017e2f
mov dword [ebp - 0x1c], ebx
jmp 0x10017e54
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbc], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10017e47
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
je 0x10017e81
inc dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb0]
push 0
pop ecx
setne cl
cmp dword [eax + 0xc], ecx
jle 0x10017e83
mov edx, ebx
mov eax, dword [ebp - 0x34]
sub edx, eax
mov dword [ebp - 0x34], edx
dec dword [ebp - 0x20]
jmp 0x10017d0e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.1000f047
push 2
pop ecx
push 0x5c
pop edi
mov dword [ebp - 0x58], 0x30017e06
mov esi, ecx
mov byte [ebp - 0x54], cl
mov word [ebp - 0x53], 0x303
mov byte [ebp - 0x51], 0xd
mov byte [ebp - 0x50], bl
mov dword [ebp - 0x4f], 0x5260425
mov byte [ebp - 0x4b], 0xd
mov byte [ebp - 0x4a], cl
mov word [ebp - 0x49], 0x8810
mov word [ebp - 0x10c], di
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], esi
cmp esi, 0x11
jae 0x10018141
mov dword [ebp - 0x20], ebx
jmp 0x10017f01
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1d0], 0xea75c96d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10017ef0
mov dword [ebp - 0x30], 0x746b
cmp dword [ebp - 0x30], 0x7590
jle 0x10017f40
mov edi, ebx
mov esi, ebx
mov eax, esi
mov ecx, 0x1007ab78
or eax, edi
cdq
push edx
push eax
call fcn.10001bfe
inc esi
cmp esi, 0x1ddb
jl 0x10017f1a
inc edi
cmp edi, 0x2144
jl 0x10017f18
mov esi, dword [ebp - 0x28]
mov byte [ebp - 0x21], bl
mov dword [ebp - 4], 5
cmp dword [ebp - 0x30], 0x7363
jge 0x10017f62
mov edx, str.ujgpeoks_hctskfvo_pcwq_drzwisbv_qgctzne_jltcfcqp_sncp_rlijd_zyko_pdvxiq_snuxwroni
mov ecx, 0x1007ab78
call fcn.100039fb
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x21], 0
je 0x10017f74
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10017f88
push 0x2284
call dword [sym.imp.GDI32.dll_EndPage]
movzx eax, byte [ebp - 0x58]
lea eax, [eax*2 + 2]
cmp esi, eax
jne 0x10017fcf
movzx eax, byte [ebp + esi - 0x58]
dec esi
add esi, eax
lea edx, [eax + 1]
mov dword [ebp - 0x2c], edx
jmp 0x10018137
push 3
lea ecx, [ebp - 0xdc]
call fcn.1000efc4
xor eax, eax
inc eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x34], 0x8c9a01c7
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 3
jge 0x1001802a
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xdc]
mov dword [eax + ecx*4], 0x3342eb90
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1001800e
xor eax, eax
inc eax
mov dword [ebp - 0x98], ebx
cmp dword [ebp - 0x98], 2
jg 0x100180ed
mov edi, dword [ebp - 0xdc]
jmp 0x10018048
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
xor edx, edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0xdc]
setge cl
xor edx, edx
cmp ecx, 0xd9ba5f27
setne dl
add edx, dword [eax]
xor eax, eax
cmp dword [edi + 8], edx
sete al
sub eax, 0xb857
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x34]
jge 0x100180a1
cmp dword [ebp - 0x28], ebx
je 0x100180a1
xor edx, edx
inc edx
jmp 0x100180a3
mov edx, ebx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
sete cl
cmp dword [ebp - 0x28], ecx
jne 0x100180bc
cmp dword [ebp - 0x30], ebx
je 0x100180bc
xor eax, eax
inc eax
jmp 0x100180be
mov eax, ebx
add eax, 0xffff71c5
xor edx, edx
cmp eax, 0x565e
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x98]
cmp dword [ebp - 0x98], 2
jle 0x10018045
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x100180fd
push ebx
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
lea ecx, [ebp - 0xdc]
call fcn.1000f047
movzx edx, byte [ebp + esi - 0x57]
mov eax, esi
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
movzx eax, byte [ebp + eax - 0x5a]
movzx eax, word [ebp + eax*2 - 0x118]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + esi - 0x58]
mov word [ebp + eax*2 - 0x118], cx
push 2
pop ecx
add esi, ecx
jmp 0x10017edf
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x2c], ebx
je 0x1001814f
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
add eax, dword [ebp - 0x2c]
imul edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x10018195
mov dword [ebp - 0x2c], 0x67e6aa16
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x100181ac
push ebx
push 0x15a1
call dword [sym.imp.USER32.dll_ClientToScreen]
jmp 0x100181ac
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x34], 8
dec dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x17c], ebx
push 7
mov word [ebp - 0x10a], ax
lea ecx, [ebp - 0x18c]
pop esi
mov word [ebp - 0x18c], ax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x178], esi
call fcn.1000f0bb
mov dword [ebp - 4], esi
xor edx, edx
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x2c], 0x9124c6e1
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmp eax, 0x1fb9
setne dl
xor ecx, ecx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, edx
setle cl
imul eax, ecx, 0x4b26
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
jns 0x10018277
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10018382
push ebx
push 0x17a8
push ebx
push 0x1cc5
push 0x25a6
call dword [sym.imp.GDI32.dll_ExtCreatePen]
jmp 0x10018382
mov dword [ebp - 0x20], 0xffff
mov dword [ebp - 0x34], 0x2ee8b720
mov dword [ebp - 0x1c], ebx
jmp 0x1001829b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x108], 9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1001828a
mov dword [ebp - 0x1c], ebx
jmp 0x100182b7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1c8], 0xb8a8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100182a6
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x100182ce
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp dword [ebp - 0x20], ebx
je 0x100182dd
cmp dword [ebp - 0x18], ebx
je 0x100182dd
xor edx, edx
inc edx
jmp 0x100182df
mov edx, ebx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setne cl
sub ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x28]
je 0x100182ff
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x34], 0x2bb1
sub eax, 0x4a5bf585
je 0x1001836d
mov dword [ebp - 0x28], 0x9c94
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setl dl
cmp edx, 0xe821
jle 0x1001833a
cmp dword [ebp - 0x1c], ebx
jne 0x1001833d
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c4]
imul ecx, eax, 0xf60
mov eax, dword [ebp - 0x104]
cmp ecx, eax
setne dl
mov dword [ebp - 0x1c], edx
jmp 0x10018382
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10018382
push ebx
push 0x1463
call dword [sym.imp.USER32.dll_BeginPaint]
dec dword [ebp - 0x30]
lea edi, [ebp - 0x118]
push dword [ebp - 0xc4]
xor eax, eax
lea ecx, [ebp - 0x1ac]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10001d13
mov byte [ebp - 4], 8
mov dword [ebp - 0x1c], 0xd6c05baf
mov dword [ebp - 0x1c], 0xfffffffd
cmp dword [ebp - 0x1c], 0x11
jl 0x10018557
mov dword [ebp - 0x18], 0xd14cd495
mov ecx, 0xffff06f2
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x38], 0xdb6377f0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
sub ecx, eax
add ecx, dword [ebp - 0x1c]
xor eax, eax
cmp ecx, 4
mov ecx, dword [ebp - 0x1c]
setle al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x18]
jg 0x100184e1
mov dword [ebp - 0x38], 0x20dd93ba
mov dword [ebp - 0x30], 0x1c54
cmp dword [ebp - 0x30], 0x1e15
jle 0x1001845f
mov edi, ebx
mov esi, ebx
mov eax, esi
lea ecx, [ebp - 0x23c]
xor eax, edi
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10018438
mov eax, dword [eax]
push eax
call fcn.10047d34
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x23c]
call fcn.10002050
inc esi
cmp esi, 0x7198
jl 0x1001841c
inc edi
cmp edi, 0x3fa5
jl 0x1001841a
cmp dword [ebp - 0x30], 0x1ad8
jge 0x10018473
push str.foo_qbnhxmgx_qufqm_uvfsw_hizlwjmkk_sfmon_fgvgyuelk_pukrkkokq_bpazyn_kuppcb_nbfayqfr_uuatyfyk_gdj
call fcn.10047d34
pop ecx
mov dword [ebp - 4], 8
mov dword [ebp - 0x20], ebx
jmp 0x10018490
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x158], 0xad5befa1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1001847f
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], ebx
jl 0x1001854f
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x100184c0
push 0xf8a
push 0xdcf
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x158]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
mov dword [ebp - 0x38], edx
dec dword [ebp - 0x18]
jns 0x100184a6
jmp 0x1001854f
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0xf6679856
cmp dword [ebp - 0x30], ebx
jne 0x100184f6
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setge dl
test edx, edx
jns 0x10018513
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
add ecx, 0x68d3
cmp ecx, 0xfffffffd
setle al
imul eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x725dc8ff
setg al
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x1c]
jmp 0x100183b4
push 1
lea ecx, [ebp - 0xe8]
call fcn.1000efc4
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x20], 0xecf54c3c
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x20], ebx
jmp 0x1001858a
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe8]
mov dword [eax + ecx*4], 0xda11525
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x10018577
mov dword [ebp - 0x20], ebx
jmp 0x10018626
mov dword [ebp - 0x1c], 0xc4530722
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x10018605
push 1
lea ecx, [ebp - 0xd0]
call fcn.1000efc4
mov dword [ebp - 0x28], ebx
jmp 0x100185cc
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xd0]
mov dword [eax + ecx*4], 0xccddd1d8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 1
jl 0x100185b9
mov eax, dword [ebp - 0xd0]
mov dword [eax], ebx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe8]
cmp dword [eax + ecx*4], ebx
jne 0x100185f5
mov eax, dword [ebp - 0xd0]
inc dword [eax]
cmp dword [eax], 0
jle 0x100185da
lea ecx, [ebp - 0xd0]
call fcn.1000f047
dec dword [ebp - 0x1c]
jns 0x100185a7
mov dword [ebp - 0x1c], ebx
jmp 0x1001861d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xe8]
mov dword [eax + ecx*4], 0x16a205b2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x1001860a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10018598
mov dword [ebp - 0x38], 0xafbbd0a7
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 8
call fcn.1000f047
push 0x5c
pop eax
mov word [ebp - 0x5c], ax
xor eax, eax
mov byte [ebp - 0x60], bl
mov byte [ebp - 0x5f], 0xfa
mov word [ebp - 0x5a], ax
mov dword [ebp - 0x18], 0xffffffff
push 0xfffffffffffffff6
pop esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], 0x457a23a3
mov dword [ebp - 0x30], 0x9e4a0435
mov dword [ebp - 0x20], ebx
jmp 0x10018686
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x174], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x10018679
push 2
mov dword [ebp - 0x18], ebx
pop edi
cmp dword [ebp - 0x18], 0xfffffff2
jne 0x100187c8
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], 0xf213ed4
mov dword [ebp - 0x1c], ebx
jmp 0x100186c3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x90], 0x6255d580
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100186b2
mov dword [ebp - 0x1c], ebx
jmp 0x100186de
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x124], 0x189d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100186cd
mov eax, dword [ebp - 0x18]
add eax, 0x1e707165
jne 0x100186f4
mov eax, dword [ebp - 0x90]
mov edx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x8c]
sub edx, 0xffff
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setle dl
xor ecx, ecx
cmp edx, 0xac3e
setg cl
sub eax, ecx
je 0x10018744
cmp dword [ebp - 0x90], ebx
je 0x10018744
xor ecx, ecx
inc ecx
jmp 0x10018746
mov ecx, ebx
xor eax, eax
test ecx, ecx
sete al
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x120]
mov edx, dword [ebp - 0x28]
sub edx, eax
mov eax, dword [ebp - 0x90]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
inc ecx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x120]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], 0xb
jmp 0x100187ba
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x100187b7
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe3
je 0x100187a4
dec dword [ebp - 0x18]
jmp 0x10018692
xor eax, eax
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
lea ecx, [ebp - 0x100]
lea eax, [ebp - 0x5c]
mov dword [ebp - 0xf0], ebx
push eax
call fcn.1000f0bb
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], 0x1c097bc8
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 0x9f2ea6da
mov dword [ebp - 0x20], ebx
jmp 0x10018824
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb4], 0xfab0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x10018813
mov eax, dword [ebp - 0x1c]
neg eax
jne 0x10018885
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add edx, 0xdf5e
cmp edx, eax
setle cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x1c]
jge 0x1001885b
cmp dword [ebp - 0x1c], ebx
jne 0x1001885b
mov eax, ebx
jmp 0x1001885e
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
xor edx, edx
mov ecx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp dword [ebp - 0x1c], ecx
jne 0x10018885
mov eax, ebx
jmp 0x10018888
xor eax, eax
inc eax
cmp eax, 0xb09f5954
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0xe755
setg cl
cmp ecx, 0x96e86ff1
jb 0x10018985
mov dword [ebp - 0x18], 0x4939e63a
cmp dword [ebp - 0x18], ebx
jne 0x100188f9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xbcce3f50
jbe 0x100188e5
cmp dword [ebp - 0x28], ebx
jne 0x100188e5
mov eax, ebx
jmp 0x100188e8
xor eax, eax
inc eax
imul eax, eax, 0xe836
cmp eax, dword [ebp - 0x18]
jne 0x100188f6
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x38], 0xcee38976
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jl 0x10018929
cmp dword [ebp - 0x18], ebx
jne 0x10018929
cmp dword [ebp - 0x20], ebx
jne 0x10018929
mov ecx, ebx
jmp 0x1001892c
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x28], ebx
je 0x10018965
xor ecx, ecx
inc ecx
jmp 0x10018967
mov ecx, ebx
mov eax, dword [ebp - 0x20]
add eax, ecx
cmp eax, dword [ebp - 0x28]
je 0x1001897b
cmp dword [ebp - 0x2c], ebx
je 0x1001897b
xor eax, eax
inc eax
jmp 0x1001897d
mov eax, ebx
mov dword [ebp - 0x38], eax
jmp 0x10018a43
push 1
lea ecx, [ebp - 0x13c]
call fcn.1000efc4
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 1
push edi
call fcn.1000efc4
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x100189cf
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x13c]
mov dword [eax + ecx*4], 0x2240
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x100189bc
mov dword [ebp - 0x1c], ebx
jmp 0x100189e9
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x148]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100189da
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
mov eax, dword [ebp - 0x13c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, dword [eax]
setle dl
mov dword [ebp - 0x30], edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
add ecx, eax
mov eax, dword [ebp - 0x148]
mov dword [eax + 4], ecx
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x148]
call fcn.1000f047
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0xc
call fcn.1000f047
mov esi, ebx
mov dword [ebp - 0x20], ebx
cmp esi, edi
jae 0x10018ade
mov dword [ebp - 0x2c], 0x66af
cmp dword [ebp - 0x2c], 0x6854
jle 0x10018ab3
mov ecx, ebx
mov dword [ebp - 0x30], ebx
mov esi, ebx
mov eax, esi
xor eax, ecx
lea ecx, [ebp - 0x1f4]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10018a83
mov eax, dword [eax]
push eax
call fcn.10047d34
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x1f4]
call fcn.10002050
mov ecx, dword [ebp - 0x30]
inc esi
cmp esi, 0x33be
jl 0x10018a67
inc ecx
mov dword [ebp - 0x30], ecx
cmp ecx, 0x5435
jl 0x10018a65
mov esi, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x2c], 0x667f
mov word [ebp + esi*2 - 0x5c], ax
jge 0x10018ace
push str.pxhxmr_flrsx_bkpttsfqs_sgjmpq_ynqppbamw_ptmnrpbn_fgpdxfp
call fcn.10047d34
pop ecx
inc esi
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x20], esi
jmp 0x10018a48
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x34], 0xdf0
cmp dword [ebp - 0x34], 0x1076
jle 0x10018b8f
mov ecx, ebx
mov dword [ebp - 0x30], ebx
mov eax, ebx
mov dword [ebp - 0x1c], ebx
and eax, ecx
mov esi, ebx
mov dword [ebp - 0x28], eax
mov ecx, ebx
mov dword [ebp - 0x20], 0x2244
mov dword [ebp - 0x2c], ecx
xor eax, ecx
lea ecx, [ebp - 0x224]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10018b3e
mov eax, dword [eax]
push eax
call fcn.10047d34
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x224]
call fcn.10002050
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
add ecx, esi
dec dword [ebp - 0x20]
mov dword [ebp - 0x2c], ecx
jne 0x10018b24
inc esi
cmp esi, 0xca7
jl 0x10018b18
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x7892
jl 0x10018b11
inc ecx
mov dword [ebp - 0x30], ecx
cmp ecx, 0x6ef4
jl 0x10018b0c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 0x38], 0x3bf844ba
cmp dword [ebp - 0x34], 0xc45
jge 0x10018baa
push str.czngku_aohuw_fcy_ednc_hmxehb_fapqug_oawoph
call fcn.10047d34
pop ecx
mov dword [ebp - 4], 0xc
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], 1
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
sub ecx, 0xeda5
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
xor ecx, ecx
cmp dword [ebp - 0x38], eax
setle cl
sub ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x18]
jge 0x10018c12
cmp dword [ebp - 0x18], ebx
je 0x10018c12
xor edx, edx
inc edx
jmp 0x10018c14
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
cmp edx, eax
mov eax, dword [ebp - 0x34]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, 0xfffffff7
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10018c66
push ebx
push 0x17a8
push ebx
push 0x1cc5
push 0x25a6
call dword [sym.imp.GDI32.dll_ExtCreatePen]
mov byte [ebp - 0x40], bl
mov word [ebp - 0x3f], 0x1ce
mov byte [ebp - 0x3d], 0x6b
mov dword [ebp - 0x2c], 0x3b1d
cmp dword [ebp - 0x2c], 0x3bfd
jle 0x10018cf5
mov eax, ebx
mov dword [ebp - 0x30], ebx
mov esi, ebx
mov dword [ebp - 0x34], ebx
mov ecx, esi
mov dword [ebp - 0x38], ebx
mov edx, eax
mov esi, ebx
sar edx, cl
mov dword [ebp - 0x20], edx
mov eax, esi
lea ecx, [ebp - 0x254]
xor eax, edx
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10018cb7
mov eax, dword [eax]
push eax
call fcn.10047d34
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x254]
call fcn.10002050
mov edx, dword [ebp - 0x20]
inc esi
cmp esi, 0x7a09
jl 0x10018c9b
mov esi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
inc esi
mov dword [ebp - 0x34], esi
cmp esi, 0x57d9
jl 0x10018c8d
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x429b
jl 0x10018c88
cmp dword [ebp - 0x2c], 0x3920
push 0x5f
pop eax
mov word [ebp - 0x44], ax
jge 0x10018d10
push str.xbhflrb_uegwvzv_bxlds_ffdilv_fgbmoaga_mkluxmszw_hhcred_pxysmo_eldwjmvud
call fcn.10047d34
pop ecx
mov dword [ebp - 4], 0xc
mov esi, edi
mov ecx, ebx
cmp esi, edi
jne 0x10018d25
mov ecx, edi
mov esi, edi
jmp 0x10018d4e
movzx edx, byte [ebp + esi - 0x3f]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x42]
movzx ecx, word [ebp + eax*2 - 0x44]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x40]
add ecx, edx
mov word [ebp + eax*2 - 0x44], cx
mov ecx, ebx
add esi, edi
cmp esi, 4
jb 0x10018d1b
xor eax, eax
xor edx, edx
mov word [ebp - 0x42], ax
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x2c], 0xcf5aa05d
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x30], 0xfffffffc
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setg cl
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
xor ecx, ecx
cmp dword [ebp - 0x38], eax
setle cl
cmp ecx, dword [ebp - 0x18]
jg 0x10018dbe
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp eax, 0xfea0
setge dl
xor ecx, ecx
imul edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setl cl
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], ebx
je 0x10018ede
push edi
lea ecx, [ebp - 0x130]
call fcn.1000efc4
mov dword [ebp - 0x28], 0x7c2657a7
mov dword [ebp - 0x2c], ebx
jmp 0x10018e0f
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x130]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x10018e00
mov dword [ebp - 0x18], ebx
jmp 0x10018ead
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp eax, 0x5412
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x84]
jne 0x10018e3e
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x130]
mov dword [eax], 5
mov dword [ebp - 0x28], 0x585c2c10
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x88]
cmp eax, 1
mov eax, dword [ebp - 0x18]
sete dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x88]
cmp edx, eax
setle cl
sub ecx, 0x4e22
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x10018e1c
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10018ed1
push 0xe8
push 0x884
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea ecx, [ebp - 0x130]
call fcn.1000f047
jmp 0x10018f29
xor ecx, ecx
mov dword [ebp - 0x38], 0x2ffabe4b
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
cmp eax, 0x1ea52fa5
mov eax, dword [ebp - 0x2c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp edi, ecx
mov ecx, 0x6e99
sbb eax, eax
inc eax
sub ecx, eax
sub ecx, 0xbd68e480
add ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
xor eax, eax
mov dword [ebp - 0x15c], 7
mov word [ebp - 0x170], ax
lea ecx, [ebp - 0x170]
lea eax, [ebp - 0x44]
mov dword [ebp - 0x160], ebx
push eax
call fcn.1000f0bb
mov byte [ebp - 4], 0x14
or esi, 0xffffffff
mov dword [ebp - 0x30], 0xffff
xor ecx, ecx
mov dword [ebp - 0x38], 0x1c7bf0b9
inc ecx
mov dword [ebp - 0x18], 0xd2703d9b
mov dword [ebp - 0x28], 0x5362daab
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x3c], 0x7e2f9d44
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x1c], ecx
push 0xfffffffffffffffd
pop edi
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x2c], ebx
jmp 0x10018fb7
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x74], 0xa32a17d0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x10018fa9
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg eax
jne 0x10018fff
cmp dword [ebp - 0x1c], ebx
jne 0x10018ff0
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x34]
sub ecx, eax
mov eax, dword [ebp - 0x18]
imul eax, ecx
xor ecx, ecx
inc ecx
sub eax, dword [ebp - 0x74]
je 0x10018ff0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x44], ebx
push dword [ebp - 0xf0]
cmp dword [ebp - 0xec], 8
lea eax, [ebp - 0x100]
push ebx
cmovae eax, dword [ebp - 0x100]
lea ecx, [ebp - 0x1ac]
push eax
call fcn.100194cd
cmp eax, esi
je 0x10019049
push esi
push ebx
lea ecx, [ebp - 0x170]
push ecx
push 1
push eax
lea ecx, [ebp - 0x1ac]
call fcn.10003f9f
jmp 0x10019005
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xf
jmp 0x1001908c
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x2c], 0x13
jmp 0x10019083
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10019080
push ebx
push 0x15a1
call dword [sym.imp.USER32.dll_ClientToScreen]
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffffe
jne 0x1001906b
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x1001905b
mov ecx, dword [ebp - 0x70]
lea eax, [ebp - 0x1ac]
push eax
lea edx, [ebp - 0x18c]
call fcn.10019570
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x170]
call fcn.100021bc
push ebx
push 1
lea ecx, [ebp - 0x100]
call fcn.100021bc
push ebx
push 1
lea ecx, [ebp - 0x1ac]
call fcn.100021bc
push ebx
push 1
lea ecx, [ebp - 0x18c]
call fcn.100021bc
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret