Function at 0x10016511
Capabilities:
Accept command line arguments
Compare security identifiers
Create thread
Delete file
Delete registry key
Get common file path
Parse pe header
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x10078a2a
call fcn.100777f0
mov eax, 0x175c
call fcn.10075410
push ebx
push esi
push edi
mov dword [ebp - 0x5c], ecx
xor eax, eax
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0xd24]
push 2
mov byte [ebp - 0x61], dl
call fcn.10008dd5
push 0xfffffffffffffffe
xor eax, eax
lea ecx, [ebp - 0xb78]
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 0xfffffffd
pop esi
mov dword [ebp - 0x58], 0x9637
mov dword [ebp - 0x2c], 0x2d800f4d
push 3
mov dword [ebp - 0x2c], 0x76ac116e
mov dword [ebp - 0x34], eax
pop ebx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x2c], 0x37ec
push ebx
call fcn.10008dd5
xor eax, eax
inc eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x4c], 0x2fc23faa
mov dword [ebp - 0x50], 0xfffffff7
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x100165c1
push dword [ebp - 0x20]
lea ecx, [ebp - 0xd24]
call fcn.10008e46
mov dword [eax], 0xd29be1d9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x100165a2
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x100165e1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1078], 0x9310c13f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x100165c9
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x10016607
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb78]
call fcn.10008e46
mov dword [eax], 8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x100165e9
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_CheckMenuItem]
mov edi, dword [sym.imp.GDI32.dll_PatBlt]
cmp dword [ebp - 0x44], eax
je 0x10016683
xor esi, esi
inc esi
mov dword [ebp - 0x44], esi
cmp dword [ebp - 0x44], eax
jl 0x1001673b
mov dword [ebp - 0x10], 0x87cf2e56
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x10016662
push 0x5c6
push 0x2446
push 0x74f
push 0x8a
push 0x1107
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10016674
mov dword [ebp - 0x50], 0x872d9ee1
inc dword [ebp - 0x50]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x10016667
dec dword [ebp - 0x44]
jns 0x10016627
jmp 0x1001673b
xor eax, eax
mov dword [ebp - 0x3c], esi
inc eax
lea ecx, [ebp - 0x15d0]
mov dword [ebp - 0x2c], eax
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x2c], 0xb6fd43dd
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x1310]
push eax
lea eax, [ebp - 0x1320]
mov dword [ebp - 0x2c], 0x664a1160
mov dword [ebp - 0x2c], 0x3e623b47
push eax
movdqu xmmword [ebp - 0x1320], xmm0
call fcn.10008e58
lea ecx, [ebp - 0x1cd]
mov esi, eax
call fcn.10008e55
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x145c]
push dword [esi]
call fcn.10008e17
xor esi, esi
or eax, 0xffffffff
inc esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0x91f9
mov dword [ebp - 0x50], eax
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x10016717
push 0x5eb
push 0x203d
push eax
call ebx
dec dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
lea ecx, [ebp - 0x145c]
setg dl
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x48], eax
call fcn.10008e41
mov eax, dword [ebp - 0x58]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x4c]
mov edx, ecx
inc dword [ebp - 0x4c]
xor ecx, ecx
mov eax, dword [ebp - 0x44]
sub edx, eax
mov eax, dword [ebp - 0x48]
cmp eax, edx
push esi
setge cl
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0xb78]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1070]
mov eax, dword [ebp - 0x34]
call fcn.10008e46
xor edx, edx
cmp dword [eax], edx
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x1070], ecx
lea ecx, [ebp - 0xb78]
call fcn.10008e41
or eax, 0xffffffff
lea ecx, [ebp - 0xd24]
mov dword [ebp - 4], eax
call fcn.10008e41
xor eax, eax
lea ecx, [ebp - 0xd3c]
mov dword [ebp - 0x44], eax
push 2
call fcn.10008dd5
mov dword [ebp - 4], 2
lea ecx, [ebp - 0xb90]
mov dword [ebp - 0x2c], 0xfffffffd
xor eax, eax
mov dword [ebp - 0x58], 0x9637
mov dword [ebp - 0x2c], 0x2d800f4d
mov dword [ebp - 0x2c], 0x76ac116e
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x2c], 0x37ec
push 3
call fcn.10008dd5
mov byte [ebp - 4], 3
xor eax, eax
mov dword [ebp - 0x4c], 0x2fc23faa
mov dword [ebp - 0x50], 0xfffffff7
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10016841
push dword [ebp - 0x20]
lea ecx, [ebp - 0xd3c]
call fcn.10008e46
mov dword [eax], 0xd29be1d9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10016822
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10016863
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf10], 0x9310c13f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1001684a
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1001688b
push dword [ebp - 0x20]
lea ecx, [ebp - 0xb90]
call fcn.10008e46
mov dword [eax], 8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1001686c
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x100168f8
mov dword [ebp - 0x44], esi
cmp dword [ebp - 0x44], eax
jl 0x100169b1
mov dword [ebp - 0x10], 0x87cf2e56
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x100168d7
push 0x5c6
push 0x2446
push 0x74f
push 0x8a
push 0x1107
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100168e9
mov dword [ebp - 0x50], 0x872d9ee1
inc dword [ebp - 0x50]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x100168dc
dec dword [ebp - 0x44]
jns 0x1001689c
jmp 0x100169b1
mov dword [ebp - 0x3c], 0xfffffffe
lea eax, [ebp - 0x1130]
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x1580]
mov dword [ebp - 0x2c], 0xfffffffa
xorps xmm0, xmm0
push eax
mov dword [ebp - 0x2c], 0xb6fd43dd
lea eax, [ebp - 0x1140]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0x664a1160
mov dword [ebp - 0x2c], 0x3e623b47
push eax
movdqu xmmword [ebp - 0x1140], xmm0
call fcn.10008e58
lea ecx, [ebp - 0x1eb]
mov esi, eax
call fcn.10008e55
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x13e4]
push dword [esi]
call fcn.10008e17
xor esi, esi
or eax, 0xffffffff
inc esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0x91f9
mov dword [ebp - 0x50], eax
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x1001698d
push 0x5eb
push 0x203d
push eax
call ebx
dec dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
lea ecx, [ebp - 0x13e4]
setg dl
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x48], eax
call fcn.10008e41
mov eax, dword [ebp - 0x58]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x4c]
mov edx, ecx
inc dword [ebp - 0x4c]
xor ecx, ecx
mov eax, dword [ebp - 0x44]
sub edx, eax
mov eax, dword [ebp - 0x48]
cmp eax, edx
push esi
setge cl
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0xb90]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0xf08]
mov eax, dword [ebp - 0x34]
call fcn.10008e46
xor edx, edx
cmp dword [eax], edx
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0xf08], ecx
lea ecx, [ebp - 0xb90]
call fcn.10008e41
or eax, 0xffffffff
lea ecx, [ebp - 0xd3c]
mov dword [ebp - 4], eax
call fcn.10008e41
push esi
lea ecx, [ebp - 0x67c]
call fcn.10008dd5
push 4
pop eax
mov dword [ebp - 4], eax
or eax, 0xffffffff
mov dword [ebp - 0x1c], 0x53d8da8e
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10016a66
push dword [ebp - 0x10]
lea ecx, [ebp - 0x67c]
call fcn.10008e46
mov dword [eax], 0x5d6c05ba
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10016a48
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x10016aac
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x67c]
push dword [ebp - 0x1c]
call fcn.10008e46
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x67c]
push dword [ebp - 0x1c]
call fcn.10008e46
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x67c]
mov esi, eax
call fcn.10008e46
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x1c]
jns 0x10016a6e
xor esi, esi
inc esi
or eax, 0xffffffff
mov dword [ebp - 0x1c], 0x5befa1e1
lea ecx, [ebp - 0x67c]
mov dword [ebp - 4], eax
call fcn.10008e41
push esi
lea ecx, [ebp - 0x5d8]
call fcn.10008dd5
mov dword [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10016b06
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5d8]
call fcn.10008e46
mov dword [eax], 0x7a7c2039
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10016ae8
xor eax, eax
push eax
lea ecx, [ebp - 0x5d8]
call fcn.10008e46
cmp dword [eax], 0
jne 0x10016c0c
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x10016b2f
push eax
push eax
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x10016b4b
push eax
push 0x2f9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
or eax, 0xffffffff
lea ecx, [ebp - 0x5d8]
mov dword [ebp - 4], eax
call fcn.10008e41
xor eax, eax
mov dword [ebp - 0x1c], eax
or eax, 0xffffffff
mov dword [ebp - 0x30], 0xffff
mov dword [ebp - 0x40], 0x86fa66fa
mov dword [ebp - 0x50], 0xfff8
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x10016bb1
mov ecx, dword [ebp - 0x30]
xor edx, edx
add ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
setge dl
add eax, edx
add ecx, eax
je 0x10016ba8
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
sub edx, 0xf844
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 0x907c4e7d
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x40]
jle 0x10016cb2
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x10016d71
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
jmp 0x10016d71
xor eax, eax
mov dword [ebp - 0x1c], 0x62e08974
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x10016b2d
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10016c43
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2ec], 0x4c000111
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10016c2a
xor eax, eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], eax
jg 0x10016c89
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x5d8]
call fcn.10008e46
xor esi, esi
cmp dword [eax], esi
jne 0x10016c87
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x5d8]
call fcn.10008e46
cmp dword [eax], esi
jne 0x10016c87
inc dword [ebp - 0x2ec]
xor eax, eax
cmp dword [ebp - 0x2ec], eax
jle 0x10016c51
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x10016c9c
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10016c21
xor esi, esi
xor eax, eax
inc esi
jmp 0x10016b2f
mov dword [ebp - 0x20], 0x7bc77562
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x10016d67
mov dword [ebp - 0x3c], 0xdd88ba54
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10016cf6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x59c], 0x9117a540
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10016cde
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x10016d0c
or ecx, 0xffffffff
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x10016d01
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x10016d64
mov dword [ebp - 0x3c], 0x86397847
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x10016d2b
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, 0x2f34f766
mov dword [ebp + eax*4 - 0x59c], 0x4ec6f913
setg cl
xor eax, eax
test ecx, ecx
setns al
mov dword [ebp - 0x3c], eax
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x10016d14
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x20
jne 0x10016ccf
push 2
lea ecx, [ebp - 0xd54]
call fcn.10008dd5
push 6
pop eax
push 2
lea ecx, [ebp - 0x2f8]
mov dword [ebp - 4], eax
call fcn.10008dd5
mov byte [ebp - 4], 7
or ecx, 0xffffffff
mov dword [ebp - 0x18], ecx
xor eax, eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10016dce
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2f8]
call fcn.10008e46
mov dword [eax], 0xec0a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10016dac
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x10016e9c
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x2f8]
mov dword [ebp - 0x3c], 0x1b6eab3c
push dword [ebp - 0x18]
call fcn.10008e46
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2f8]
mov esi, eax
call fcn.10008e46
mov ecx, dword [esi]
push dword [ebp - 0x18]
mov dword [eax], ecx
lea ecx, [ebp - 0x2f8]
call fcn.10008e46
push 6
pop ecx
push dword [ebp - 0x18]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x2f8]
sbb esi, esi
inc esi
call fcn.10008e46
xor ecx, ecx
cmp esi, dword [eax]
setge cl
dec ecx
jne 0x10016e3e
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10016e3e
mov eax, dword [ebp - 0x4c]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2f8]
call fcn.10008e46
mov edx, dword [eax]
mov eax, dword [ebp - 0x4c]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x2f8]
push dword [ebp - 0x18]
call fcn.10008e46
xor ecx, ecx
push 0xffffffffffffffff
cmp dword [eax], 0x9a7b445a
sete cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
pop ecx
setg dl
mov dword [ebp - 0x3c], edx
dec dword [ebp - 0x18]
jns 0x10016dda
xor esi, esi
inc esi
or eax, 0xffffffff
lea ecx, [ebp - 0x2f8]
mov dword [ebp - 0x48], eax
push 6
pop eax
mov byte [ebp - 4], al
call fcn.10008e41
mov dword [ebp - 0x2c], 0xfffffffd
xor eax, eax
mov dword [ebp - 0x44], 0x75b57fd5
mov dword [ebp - 0x50], 0x49dfcf09
mov dword [ebp - 0x10], 0xa5fef9d7
mov dword [ebp - 0x3c], 0xc1b16eb2
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffec
jle 0x10016fb2
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10016f09
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xba8], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10016ef4
xor eax, eax
push 4
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x10016f22
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1098], 0xca955a63
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10016f11
mov dword [ebp - 0x50], 0x950ba1bf
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1094]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
test eax, eax
jne 0x10016f57
mov eax, dword [ebp - 0x1094]
mov eax, dword [ebp - 0x1094]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xba8]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0xba8]
imul eax, dword [ebp - 0xba8]
imul eax, eax, 0xf996
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x10016fa2
push 0x25a6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xffffffec
push 0
pop eax
jg 0x10016ee5
mov dword [ebp - 0x58], 0x9637
lea ecx, [ebp - 0xbc0]
mov dword [ebp - 0x2c], 0x2d800f4d
mov dword [ebp - 0x2c], 0x76ac116e
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 0x2c], 0x37ec
push 3
call fcn.10008dd5
push 8
pop eax
mov byte [ebp - 4], al
xor eax, eax
mov dword [ebp - 0x4c], 0x2fc23faa
mov dword [ebp - 0x50], 0xfffffff7
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1001702a
push dword [ebp - 0x20]
lea ecx, [ebp - 0xd54]
call fcn.10008e46
mov dword [eax], 0xd29be1d9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1001700b
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1001704c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1008], 0x9310c13f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10017033
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10017074
push dword [ebp - 0x20]
lea ecx, [ebp - 0xbc0]
call fcn.10008e46
mov dword [eax], 8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10017055
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1001726f
xor ebx, ebx
inc ebx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x100170df
mov dword [ebp - 0x10], 0x87cf2e56
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x100170c3
push 0x5c6
push 0x2446
push 0x74f
push 0x8a
push 0x1107
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100170d5
mov dword [ebp - 0x50], 0x872d9ee1
inc dword [ebp - 0x50]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x100170c8
dec dword [ebp - 0x1c]
jns 0x10017088
or edi, 0xffffffff
mov eax, dword [ebp - 0x58]
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
mov edx, edi
inc dword [ebp - 0x4c]
mov eax, dword [ebp - 0x1c]
sub edx, eax
mov eax, dword [ebp - 0x48]
cmp eax, edx
push ebx
setge cl
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0xbc0]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1000]
mov eax, dword [ebp - 0x34]
call fcn.10008e46
xor edx, edx
cmp dword [eax], edx
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x1000], ecx
lea ecx, [ebp - 0xbc0]
call fcn.10008e41
lea ecx, [ebp - 0xd54]
mov dword [ebp - 4], edi
call fcn.10008e41
push 9
pop esi
xor eax, eax
mov dword [ebp - 0x50], esi
push 4
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10017175
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x16d8], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001715d
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1001718a
push 0x247e
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
dec dword [ebp - 0x50]
lea ecx, [ebp - 0x700]
push ebx
call fcn.10008dd5
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x1c], 0x53d8da8e
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100171ce
push dword [ebp - 0x10]
lea ecx, [ebp - 0x700]
call fcn.10008e46
mov dword [eax], 0x5d6c05ba
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100171b0
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x10017211
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x700]
push dword [ebp - 0x1c]
call fcn.10008e46
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x700]
push dword [ebp - 0x1c]
call fcn.10008e46
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x700]
mov esi, eax
call fcn.10008e46
mov ecx, dword [esi]
mov dword [eax], ecx
dec dword [ebp - 0x1c]
jns 0x100171d6
mov dword [ebp - 0x1c], 0x5befa1e1
lea ecx, [ebp - 0x700]
mov dword [ebp - 4], edi
call fcn.10008e41
push 4
pop ecx
mov dword [ebp - 0x38], ebx
xor eax, eax
mov dword [ebp - 0x3c], ecx
push 3
pop esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x28], 0xfffffff6
push 2
mov dword [ebp - 0x18], eax
pop edi
cmp dword [ebp - 0x18], edi
jge 0x10017267
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6c8], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1001724f
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1001733d
mov dword [ebp - 0x3c], 0xfffffffe
lea eax, [ebp - 0x1230]
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x1590]
mov dword [ebp - 0x2c], 0xfffffffa
xorps xmm0, xmm0
push eax
mov dword [ebp - 0x2c], 0xb6fd43dd
lea eax, [ebp - 0x1240]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0x664a1160
mov dword [ebp - 0x2c], 0x3e623b47
push eax
movdqu xmmword [ebp - 0x1240], xmm0
call fcn.10008e58
lea ecx, [ebp - 0x1cf]
mov esi, eax
call fcn.10008e55
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x133c]
push dword [esi]
call fcn.10008e17
xor eax, eax
or edi, 0xffffffff
inc eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x91f9
mov dword [ebp - 0x50], edi
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x10017304
push 0x5eb
push 0x203d
push eax
call ebx
dec dword [ebp - 0x34]
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
lea ecx, [ebp - 0x133c]
setg dl
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x48], eax
call fcn.10008e41
xor ebx, ebx
inc ebx
jmp 0x100170e2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1a0], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10017330
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x6c8], eax
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x38]
jge 0x10017356
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x6c4], ebx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x19c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x6c8]
or eax, 0xffffffff
cmp dword [ebp - 0x1a0], eax
sbb eax, eax
neg eax
cmp dword [ebp - 0x38], eax
jl 0x1001739a
xor eax, eax
cmp dword [ebp - 0x1a0], eax
je 0x1001739c
mov ecx, ebx
jmp 0x1001739e
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x38]
add ecx, 0xfff9
xor edx, edx
cmp ecx, eax
setle dl
or ecx, 0xffffffff
xor eax, eax
cmp edx, ecx
setg al
xor ecx, ecx
cmp eax, 0xf7cf
mov eax, dword [ebp - 0x1a0]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
add ecx, 0x4bfd7b7f
cmp ecx, dword [ebp - 0x19c]
jle 0x100173f3
mov edx, ebx
cmp dword [ebp - 0x19c], eax
jne 0x100173f5
mov edx, eax
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x890], ebx
mov dword [ebp - 0x88c], ebx
mov dword [ebp - 0x888], ebx
mov dword [ebp - 0x884], ebx
mov dword [ebp - 0x1c], 0x53aa9ac7
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x1001746d
mov dword [ebp - 0x50], 0xcabfc393
xor edx, edx
mov dword [ebp - 0x50], 5
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x890]
sub ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
mov dword [ebp + eax*4 - 0x890], edx
dec dword [ebp - 0x1c]
jns 0x10017437
xor eax, eax
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x10017492
push 0x7f9
push 0x15e1
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
xor eax, eax
xor esi, esi
mov dword [ebp - 0x34], eax
inc esi
lea ecx, [ebp - 0x5f0]
push esi
call fcn.10008dd5
push 6
mov dword [ebp - 4], 0xa
pop eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100174d9
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5f0]
call fcn.10008e46
mov dword [eax], 0x7a7c2039
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100174bb
xor eax, eax
push eax
lea ecx, [ebp - 0x5f0]
call fcn.10008e46
cmp dword [eax], 0
jne 0x100175e5
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x10017502
push eax
push eax
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1001751a
push eax
push 0x2f9
call ebx
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
or eax, 0xffffffff
lea ecx, [ebp - 0x5f0]
mov dword [ebp - 4], eax
call fcn.10008e41
push edi
lea ecx, [ebp - 0xdcc]
call fcn.10008dd5
mov dword [ebp - 4], 0xb
or eax, 0xffffffff
mov dword [ebp - 0x30], 0xffff
mov dword [ebp - 0x40], 0x86fa66fa
mov dword [ebp - 0x50], 0xfff8
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1001758e
mov ecx, dword [ebp - 0x30]
xor edx, edx
add ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
setge dl
add eax, edx
add ecx, eax
je 0x10017585
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
sub edx, 0xf844
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 0x907c4e7d
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x40]
jle 0x10017689
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x10017748
push eax
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
jmp 0x10017748
xor eax, eax
mov dword [ebp - 0x1c], 0x62e08974
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x10017500
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1001761a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x33c], 0x4c000111
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10017602
xor eax, eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], eax
jg 0x10017660
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x5f0]
call fcn.10008e46
xor esi, esi
cmp dword [eax], esi
jne 0x1001765e
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x5f0]
call fcn.10008e46
cmp dword [eax], esi
jne 0x1001765e
inc dword [ebp - 0x33c]
xor eax, eax
cmp dword [ebp - 0x33c], eax
jle 0x10017628
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x10017673
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x100175fa
xor esi, esi
xor eax, eax
inc esi
jmp 0x10017502
mov dword [ebp - 0x20], 0x7bc77562
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x1001773e
mov dword [ebp - 0x3c], 0xdd88ba54
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100176cd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x66c], 0x9117a540
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100176b5
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x100176e3
or ecx, 0xffffffff
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x100176d8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], eax
jg 0x1001773b
mov dword [ebp - 0x3c], 0x86397847
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x10017702
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, 0x2f34f766
mov dword [ebp + eax*4 - 0x66c], 0x4ec6f913
setg cl
xor eax, eax
test ecx, ecx
setns al
mov dword [ebp - 0x3c], eax
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x100176eb
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x20
jne 0x100176a6
mov dword [ebp - 0x2c], 0xfffffffd
lea ecx, [ebp - 0x30c]
push edi
call fcn.10008dd5
mov byte [ebp - 4], 0xc
or ecx, 0xffffffff
mov dword [ebp - 0x18], ecx
xor eax, eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10017796
push dword [ebp - 0x10]
lea ecx, [ebp - 0x30c]
call fcn.10008e46
mov dword [eax], 0xec0a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10017775
xor eax, eax
or ecx, 0xffffffff
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], eax
jl 0x10017861
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x30c]
mov dword [ebp - 0x3c], 0x1b6eab3c
push dword [ebp - 0x18]
call fcn.10008e46
push dword [ebp - 0x18]
lea ecx, [ebp - 0x30c]
mov esi, eax
call fcn.10008e46
mov ecx, dword [esi]
push dword [ebp - 0x18]
mov dword [eax], ecx
lea ecx, [ebp - 0x30c]
call fcn.10008e46
push 6
pop ecx
push dword [ebp - 0x18]
cmp ecx, dword [eax]
lea ecx, [ebp - 0x30c]
sbb esi, esi
inc esi
call fcn.10008e46
xor ecx, ecx
cmp esi, dword [eax]
setge cl
dec ecx
jne 0x10017806
xor eax, eax
cmp dword [ebp - 0x4c], eax
jne 0x10017806
mov eax, dword [ebp - 0x4c]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x30c]
call fcn.10008e46
mov edx, dword [eax]
mov eax, dword [ebp - 0x4c]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x30c]
push dword [ebp - 0x18]
call fcn.10008e46
xor ecx, ecx
push 0xffffffffffffffff
cmp dword [eax], 0x9a7b445a
sete cl
xor edx, edx
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
pop ecx
setg dl
mov dword [ebp - 0x3c], edx
dec dword [ebp - 0x18]
jns 0x100177a2
or esi, 0xffffffff
lea ecx, [ebp - 0x30c]
mov dword [ebp - 0x48], esi
mov byte [ebp - 4], 0xb
call fcn.10008e41
mov dword [ebp - 0x44], 0x75b57fd5
xor eax, eax
mov dword [ebp - 0x50], 0x49dfcf09
mov dword [ebp - 0x10], 0xa5fef9d7
mov dword [ebp - 0x3c], 0xc1b16eb2
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffec
jle 0x10017967
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100178c2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xbd8], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100178ad
xor eax, eax
push 4
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x100178db
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10b4], 0xca955a63
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100178ca
mov dword [ebp - 0x50], 0x950ba1bf
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10b0]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
test eax, eax
jne 0x10017910
mov eax, dword [ebp - 0x10b0]
mov eax, dword [ebp - 0x10b0]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xbd8]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0xbd8]
imul eax, dword [ebp - 0xbd8]
imul eax, eax, 0xf996
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x10017957
push 0x25a6
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xffffffec
push 0
pop eax
jg 0x100178a1
mov dword [ebp - 0x54], 0x9637
xor ecx, ecx
mov dword [ebp - 0x38], 0x102071b1
inc ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10017998
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdc], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10017980
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x100179b4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2c4], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100179a0
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x10017a1d
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x100179d7
push 0x5e3
push 0x789
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x2c], 0x2d800f4d
lea ecx, [ebp - 0x560]
mov dword [ebp - 0x38], 0x11738ab6
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x44], eax
push ebx
call fcn.10008dd5
mov byte [ebp - 4], 0xd
xor eax, eax
mov dword [ebp - 0x3c], 0x5ee192ef
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x2c], 0x8d75fb74
mov dword [ebp - 0x10], eax
jmp 0x10017abc
mov dword [ebp - 0x50], 0x3880e033
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], eax
jg 0x100179d7
xor ebx, ebx
inc ebx
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0xdc], esi
je 0x10017a91
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x10017a93
mov eax, dword [ebp - 0x38]
mov edx, 0x75da2ca3
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xdc]
sub edx, eax
mov eax, dword [ebp - 0x38]
cmp edx, eax
setl cl
cmp ecx, 0xfffffffc
sbb eax, eax
neg eax
mov dword [ebp - 0x2c4], eax
jne 0x10017a75
mov eax, dword [ebp - 0x2c4]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xdc]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0xdc]
mov eax, dword [ebp - 0xdc]
xor eax, eax
mov dword [ebp - 0x3c], ebx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jle 0x10017a2f
xor eax, eax
jmp 0x100179da
push dword [ebp - 0x10]
lea ecx, [ebp - 0x560]
call fcn.10008e46
mov dword [eax], 0x78d11e8e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10017aa5
imul eax, dword [ebp - 0x38], 3
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x20], 0xe8588d0d
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x38]
cmp eax, 0xeb606930
jne 0x10017c38
mov dword [ebp - 0x2c], esi
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x18], 0x8d7cbae8
mov dword [ebp - 0x50], 0xf3004570
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff0
jg 0x10017e1d
jmp 0x10017b09
xor eax, eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x3f4]
mov dword [ebp - 0x10], ebx
push ebx
call fcn.10008dd5
xor eax, eax
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10017b47
push dword [ebp - 0x10]
lea ecx, [ebp - 0x3f4]
call fcn.10008e46
mov dword [eax], 0x3063d62a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10017b29
xor eax, eax
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x3f4]
push eax
call fcn.10008e46
mov ecx, dword [ebp - 0x3c]
push 0xfffffffffffffff7
pop edx
sub edx, ecx
add edx, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10017c0e
mov dword [ebp - 0x3c], 0x45d44756
push dword [ebp - 0x18]
call fcn.10008e46
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x3f4]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x38]
push dword [ebp - 0x18]
call fcn.10008e46
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x3f4]
mov esi, dword [ebp - 0x20]
push dword [ebp - 0x18]
call fcn.10008e46
mov dword [eax], esi
mov eax, dword [ebp - 0x20]
sub esi, eax
mov dword [ebp - 0x38], esi
je 0x10017bd6
push dword [ebp - 0x18]
lea ecx, [ebp - 0x3f4]
call fcn.10008e46
cmp dword [eax], 0
je 0x10017bd6
mov ecx, ebx
jmp 0x10017bda
xor eax, eax
mov ecx, eax
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
mov ecx, 0xfde7504e
sete al
sub eax, dword [ebp - 0x3c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x50], ecx
inc dword [ebp - 0x18]
xor eax, eax
lea ecx, [ebp - 0x3f4]
cmp dword [ebp - 0x18], eax
jle 0x10017b79
mov byte [ebp - 4], 0xd
call fcn.10008e41
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff0
jle 0x10017b07
jmp 0x10017e1d
push ebx
lea ecx, [ebp - 0x690]
call fcn.10008dd5
mov byte [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x10017c6f
push dword [ebp - 0x30]
lea ecx, [ebp - 0x690]
call fcn.10008e46
mov dword [eax], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x10017c55
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x10017c8f
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x11c], 0x2f9e84eb
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x10017c77
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jge 0x10017caf
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x118], 0xa48b7552
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jl 0x10017c97
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x10017cd1
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xf28], 0
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x10017cb8
xor eax, eax
dec dword [ebp - 0x118]
cmp dword [ebp - 0x4c], eax
je 0x10017d9e
push eax
lea ecx, [ebp - 0x690]
call fcn.10008e46
xor eax, eax
lea ecx, [ebp - 0x560]
push eax
call fcn.10008e46
mov eax, dword [ebp - 0xf28]
lea ecx, [ebp - 0x560]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x11c]
xor eax, eax
push eax
call fcn.10008e46
xor eax, eax
lea ecx, [ebp - 0x690]
push eax
call fcn.10008e46
mov ecx, dword [ebp - 0x44]
xor ebx, ebx
test ecx, ecx
setg bl
xor edx, edx
sub ebx, dword [eax]
mov eax, dword [ebp - 0x118]
cmp eax, ebx
mov eax, dword [ebp - 0xf28]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
add ecx, 0x5bc6281b
je 0x10017d61
cmp dword [ebp - 0x3c], eax
je 0x10017d61
xor ebx, ebx
inc ebx
mov edi, ebx
jmp 0x10017d66
xor ebx, ebx
mov edi, eax
inc ebx
push eax
lea ecx, [ebp - 0x690]
call fcn.10008e46
mov ecx, dword [ebp - 0x11c]
mov esi, eax
add ecx, edi
xor eax, eax
imul edx, ecx, 0xd9bf
mov ecx, dword [ebp - 0x50]
push 2
pop edi
cmp edx, ecx
sete al
xor ecx, ecx
cmp dword [esi], eax
mov esi, ebx
setle cl
xor eax, eax
add ecx, edi
jne 0x10017da0
mov esi, eax
push eax
lea ecx, [ebp - 0x560]
add esi, 0xfffffff9
call fcn.10008e46
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x50]
cmp esi, eax
mov eax, dword [ebp - 0x44]
setl cl
xor ebx, ebx
cmp ecx, eax
setge bl
sub ebx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x20]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
setne dl
xor ecx, ecx
add edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x44]
cmp edx, eax
setl cl
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x118]
test eax, eax
setle cl
add ecx, 0x3abc
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x690]
call fcn.10008e41
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x560]
mov byte [ebp - 4], 0xb
call fcn.10008e41
push 9
mov dword [ebp - 0x2c], 0x76ac116e
lea ecx, [ebp - 0xd6c]
pop esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0x12491e29
mov dword [ebp - 0x2c], 0x9c9fb37b
mov dword [ebp - 0x2c], 0x72c25fcc
push edi
call fcn.10008dd5
xor eax, eax
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10017e89
push dword [ebp - 0x10]
lea ecx, [ebp - 0xd6c]
call fcn.10008e46
mov dword [eax], 0xe1dfe009
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10017e6b
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10017f09
push 3
lea ecx, [ebp - 0xbf0]
call fcn.10008dd5
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x10017ec1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x14f0], 0x603fa75c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10017ea9
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10017ee9
push dword [ebp - 0x18]
lea ecx, [ebp - 0xbf0]
call fcn.10008e46
mov dword [eax], 0x2d714f98
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10017eca
xor eax, eax
push eax
lea ecx, [ebp - 0xbf0]
call fcn.10008e46
lea ecx, [ebp - 0xbf0]
dec dword [eax]
mov byte [ebp - 4], 0x10
call fcn.10008e41
inc dword [ebp - 0x10]
push 8
pop eax
cmp dword [ebp - 0x10], eax
jge 0x10017e8e
lea ecx, [ebp - 0xd6c]
mov byte [ebp - 4], 0xb
call fcn.10008e41
xor eax, eax
lea ecx, [ebp - 0x288]
mov dword [ebp - 0x48], eax
push 8
pop eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x38], 0x7cc73ee4
push ebx
call fcn.10008dd5
mov byte [ebp - 4], 0x12
xor eax, eax
mov dword [ebp - 0x1c], 0x24c6e12c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10017f78
push dword [ebp - 0x18]
lea ecx, [ebp - 0x288]
call fcn.10008e46
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10017f5a
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x10017f98
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1b0], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10017f80
xor eax, eax
mov dword [ebp - 0x18], esi
jmp 0x100180f0
mov dword [ebp - 0x10], 0x785b6478
push 4
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x10017fc9
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x458], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10017fb5
xor eax, eax
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 8
jl 0x100180ce
mov dword [ebp - 0x1c], 0xfffffff6
cmp dword [ebp - 0x1c], eax
je 0x10018000
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x450]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x44]
xor edx, edx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x1c]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setle bl
xor ecx, ecx
sub ebx, 0x52076f46
cmp ebx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp eax, 0x279
mov eax, dword [ebp - 0x18]
setl dl
sub edx, 0xa866
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 1
setge al
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul eax, dword [ebp - 0x44c]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
lea ecx, [ebp - 0x288]
setne dl
xor ebx, ebx
sub edx, dword [ebp - 0x1c]
imul edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setg bl
xor eax, eax
push eax
call fcn.10008e46
xor ecx, ecx
push 8
mov dword [eax], ebx
imul eax, ebx, 0xffff
cmp eax, 0xfffffff7
pop eax
setne cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x44c]
cmp dword [ebp - 0x44c], eax
push 0
pop eax
push 1
pop ebx
jge 0x10017fdc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x100180ed
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x100180e8
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x100180d6
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 7
jge 0x10017fa0
cmp dword [ebp - 0x1b0], eax
je 0x100181bc
push eax
lea ecx, [ebp - 0x288]
call fcn.10008e46
mov eax, dword [ebp - 0x1b0]
lea ecx, [ebp - 0x288]
xor eax, eax
push eax
call fcn.10008e46
xor eax, eax
lea ecx, [ebp - 0x288]
push eax
call fcn.10008e46
xor ebx, ebx
lea ecx, [ebp - 0x288]
cmp dword [eax], 1
setle bl
xor eax, eax
push eax
call fcn.10008e46
sub ebx, dword [eax]
xor eax, eax
inc ebx
cmp dword [ebp - 0x44], ebx
je 0x10018160
cmp dword [ebp - 0x44], eax
jne 0x10018160
xor ebx, ebx
mov edi, eax
inc ebx
jmp 0x10018165
xor ebx, ebx
inc ebx
mov edi, ebx
push eax
lea ecx, [ebp - 0x288]
call fcn.10008e46
mov ecx, dword [ebp - 0x1c]
xor edx, edx
cmp edi, 0xa5b7
mov esi, eax
setle dl
xor eax, eax
cmp ecx, edx
mov ecx, dword [ebp - 0x1c]
setle al
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x1b0]
mov eax, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
add eax, dword [esi]
sub eax, dword [ebp - 0x38]
je 0x100181ba
mov esi, ebx
xor eax, eax
jmp 0x100181c1
xor eax, eax
xor ebx, ebx
mov esi, eax
inc ebx
push eax
lea ecx, [ebp - 0x288]
call fcn.10008e46
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 0xb
mov dword [eax], esi
call fcn.10008e41
mov dword [ebp - 0x30], 0xfffffffe
or esi, 0xffffffff
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x2c], 0xf1d
mov dword [ebp - 0x44], 0xffffffef
jmp 0x10018227
xor eax, eax
mov dword [ebp - 0x3c], 0x88adae8c
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x10018219
push 0x129d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xfffffffd
jne 0x100181fb
push 2
mov dword [ebp - 0x2c], 0x37ec
lea ecx, [ebp - 0x10c0]
pop edi
mov dword [ebp - 0x20], 0xa860
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x1c], 0xac0f
push edi
call fcn.10008dd5
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x2c], 0xb1aa435c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x10018283
push dword [ebp - 0x10]
lea ecx, [ebp - 0x10c0]
call fcn.10008e46
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10018269
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffa
cmp dword [ebp - 0x20], eax
je 0x100183de
push edi
lea ecx, [ebp - 0x7cc]
call fcn.10008dd5
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x4c], 0x95031536
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x100182d8
push dword [ebp - 0x18]
lea ecx, [ebp - 0x7cc]
call fcn.10008e46
and dword [eax], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100182bd
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100182fa
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1684], 0x24f63abe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100182e1
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x100183c4
mov dword [ebp - 0x10], 0xb21a35ca
mov eax, dword [ebp - 0x20]
push ebx
call fcn.10008e46
push ebx
lea ecx, [ebp - 0x7cc]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x10], eax
call fcn.10008e46
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax]
mov dword [ebp - 0x50], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
neg eax
cmp eax, 0xa30a
setg cl
xor eax, eax
sub ecx, 0xfffc
je 0x10018351
mov ecx, ebx
cmp dword [ebp - 0x10], eax
jne 0x10018353
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d8bc0d1
setne al
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x1c]
je 0x10018374
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x10018376
mov edx, ebx
jmp 0x10018378
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x50]
xor ecx, ecx
cmp edx, eax
push 6
sete cl
pop eax
add ecx, eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x1c], 0x11
cmp dword [ebp - 0x1c], 0xe
jne 0x100183c1
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x100183b8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xe
je 0x10018399
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x36
lea ecx, [ebp - 0x7cc]
jg 0x10018302
dec dword [ebp - 0x40]
call fcn.10008e41
jmp 0x1001840d
mov dword [ebp - 0x20], eax
jmp 0x10018408
mov dword [ebp - 0x3c], esi
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x10018402
push 0x64d
push eax
push 0x9ae
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xor eax, eax
mov dword [ebp - 0x3c], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x100183e3
lea ecx, [ebp - 0x10c0]
mov byte [ebp - 4], 0xb
call fcn.10008e41
push 3
lea ecx, [ebp - 0x920]
call fcn.10008dd5
mov byte [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x18], esi
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10018451
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd84], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001843d
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x10018470
push 6
pop edx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd84], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1001845c
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10018486
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd84], 0xf94964a5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10018475
push ecx
mov dword [ebp - 0x40], 0x2fc23faa
lea ecx, [ebp - 0x270]
call fcn.10008dd5
mov byte [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x10], 0x8afa2faf
push 3
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], eax
pop esi
jmp 0x100184c7
push dword [ebp - 0x10]
call fcn.10008e46
mov dword [eax], 0x7ddc85f7
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x270]
cmp dword [ebp - 0x10], esi
jl 0x100184b6
push edi
call fcn.10008e46
mov dword [eax], 0xfffffff0
jmp 0x100185f9
mov dword [ebp - 0x1c], ebx
xor edx, edx
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x4c], 0xfffffff9
mov dword [ebp - 0x50], 0xcc16
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
xor eax, eax
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], eax
je 0x100185b7
mov dword [ebp - 0x44], 0xd6364d64
xor ecx, ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x50], 0xee6d058a
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x44]
cmp eax, edi
setge cl
add ecx, dword [ebp - 0x10]
imul eax, ecx, 0x712c
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x10018561
push edi
lea ecx, [ebp - 0x270]
call fcn.10008e46
cmp dword [eax], 0
jne 0x10018561
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x44], eax
je 0x10018563
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
push ebx
setg cl
xor eax, eax
add ecx, dword [ebp - 0x44]
cmp ecx, 0xfffb
lea ecx, [ebp - 0x270]
setne al
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
call fcn.10008e46
push ebx
lea ecx, [ebp - 0x270]
call fcn.10008e46
mov ecx, dword [ebp - 0x44]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x3c], eax
jmp 0x100185eb
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x100185d5
push eax
push 0x1d21
push eax
push eax
push 0x19f0
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100185e5
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], eax
jne 0x100185eb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x16
jg 0x100185da
push edi
lea ecx, [ebp - 0x270]
call fcn.10008e46
dec dword [eax]
push edi
lea ecx, [ebp - 0x270]
call fcn.10008e46
cmp dword [eax], 0xffffffe8
jge 0x100184e3
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 0x15
call fcn.10008e41
mov dword [ebp - 0x28], 0xfffffff7
push 8
pop eax
mov dword [ebp - 0x20], 0x95e17ca0
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x44], 0xfffffff8
push 4
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x1001865a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x16b8], 0x42c8cdab
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10018649
mov eax, dword [ebp - 0x20]
xor ebx, ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], 0xbdeb
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge bl
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
cmp ebx, ecx
setle al
xor ebx, ebx
mov dword [ebp - 0x20], eax
inc ebx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x1c], eax
jg 0x10018758
or eax, 0xffffffff
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10018700
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xed4], 0x5631cd1a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100186e8
xor eax, eax
mov dword [ebp - 0x20], 0xfffffff6
jmp 0x10018750
mov dword [ebp - 0x2c], 0x20bab1f3
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], eax
jmp 0x10018745
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x1001873b
push 0x113d
push 0x1c14
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
xor eax, eax
mov dword [ebp - 0x3c], 0x9fa18394
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1001871f
inc dword [ebp - 0x18]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x19
jg 0x10018709
jmp 0x100187b5
or eax, 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
sub ecx, 0x64b5ad8e
cmp ecx, eax
setl dl
xor ecx, ecx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x4e19c781
setge al
mov dword [ebp - 0x3c], eax
xor eax, eax
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x100187b5
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 0x2c], esi
or eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x50], 0xfffffffb
mov dword [ebp - 0x50], 0xd0da0bdb
mov dword [ebp - 0x3c], 0xbed162c5
mov dword [ebp - 0x3c], 0x45d764ce
mov dword [ebp - 0x1c], 0xfffffff9
jmp 0x100188b5
lea eax, [ebp - 0x1150]
mov dword [ebp - 0x3c], 0xa73d
push eax
lea eax, [ebp - 0x1160]
mov dword [ebp - 0x50], 0x95da2282
push eax
lea ecx, [ebp - 0x1508]
movdqu xmmword [ebp - 0x1160], xmm0
call fcn.10008e58
lea ecx, [ebp - 0x1fa]
mov esi, eax
call fcn.10008e55
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xc08]
push dword [esi]
call fcn.10008e17
xor eax, eax
mov byte [ebp - 4], 0x17
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], al
je 0x10018848
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0xc08]
neg eax
push 3
sbb eax, eax
neg eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
call fcn.10008e46
push edi
lea ecx, [ebp - 0xc08]
mov esi, eax
call fcn.10008e46
mov ecx, dword [eax]
add ecx, dword [esi]
mov eax, dword [ebp - 0x3c]
imul eax, ecx
xor ecx, ecx
cmp eax, ebx
setle cl
xor eax, eax
cmp ecx, 0x4c266d8f
lea ecx, [ebp - 0xc08]
setge al
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 0x15
call fcn.10008e41
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff7
movdqa xmm0, xmmword [0x10007c60]
jge 0x100187e6
lea eax, [ebp - 0x12b0]
mov dword [ebp - 0x10], 0xea68
push eax
lea eax, [ebp - 0x12c0]
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x3c], 0xc58f5537
lea ecx, [ebp - 0x1620]
mov dword [ebp - 0x50], ebx
push eax
movdqu xmmword [ebp - 0x12c0], xmm0
call fcn.10008e58
lea ecx, [ebp - 0x175]
mov esi, eax
call fcn.10008e55
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xf40]
push dword [esi]
call fcn.10008e17
xor eax, eax
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1001893f
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5ac], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1001892b
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1001895f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf8], 0x3ee76373
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x10018947
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x100189af
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x5ac], 0x80eb
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0xf8]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0xf8], eax
je 0x1001898c
mov eax, ebx
xor edx, edx
cmp eax, ebx
mov eax, dword [ebp - 0x50]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x3c]
jle 0x100189a9
mov edi, eax
push 3
lea ecx, [ebp - 0xf40]
call fcn.10008e46
mov ecx, dword [ebp - 0x4c]
mov esi, eax
xor eax, eax
cmp edi, ecx
mov ecx, dword [ebp - 0x10]
setl al
xor edx, edx
cmp eax, ecx
setne dl
xor ecx, ecx
cmp edx, dword [esi]
setg cl
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0xf40]
mov byte [ebp - 4], 0x15
call fcn.10008e41
xor eax, eax
push 2
mov dword [ebp - 0x20], eax
pop esi
cmp dword [ebp - 0x20], esi
jge 0x10018a18
push dword [ebp - 0x20]
lea ecx, [ebp - 0xdcc]
call fcn.10008e46
mov dword [eax], 0xd29be1d9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100189fa
mov dword [ebp - 0x50], 0xfffffff7
or edi, 0xffffffff
mov dword [ebp - 0x4c], 0x1b583dc0
mov dword [ebp - 0x10], 0x9dade661
mov dword [ebp - 0x3c], 0x7c2076ac
mov dword [ebp - 0x44], 0xcae2fe81
mov dword [ebp - 0x3c], 0x9ae4f78d
mov dword [ebp - 0x3c], 0x4b15d3e9
mov dword [ebp - 0x3c], 0x62a04f77
mov dword [ebp - 0x3c], 0xc89d73ae
mov dword [ebp - 0x3c], 0xd6446bd2
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
jmp 0x10018a7d