Function at 0x1001856a
Capabilities:
Create process on windows
Enumerate gui resources
Get disk size
Get file system object information
Get keyboard layout
Log keystrokes
Query service status
Resume thread

Disassembly:
mov eax, 0x1006798a
call fcn.10066d38
sub esp, 0x81c
push ebx
xor ebx, ebx
mov dword [ebp - 0xa4], ecx
inc ebx
mov byte [ebp - 0x51], dl
xor ecx, ecx
mov dword [ebp - 0x44], ebx
push esi
mov byte [ebp - 0xd], cl
mov esi, 0x1b97
push edi
mov edi, 0xb6c
cmp byte [ebp - 0xd], cl
je 0x100185af
push esi
push edi
push 0x781
call dword [sym.imp.USER32.dll_EnableScrollBar]
xor ecx, ecx
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x100185c6
push ecx
push 0x2688
call dword [sym.imp.USER32.dll_KillTimer]
xor ecx, ecx
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x100185e1
push esi
push edi
push 0x781
call dword [sym.imp.USER32.dll_EnableScrollBar]
xor ecx, ecx
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x100185f8
push ecx
push 0x2688
call dword [sym.imp.USER32.dll_KillTimer]
xor ecx, ecx
push 8
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0x516a205b
mov dword [ebp - 0x1c], ecx
jmp 0x1001861b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x24c], 0xc4779d44
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1001860a
push 6
pop edi
mov dword [ebp - 0x2c], 0xb
mov edx, 0xfff8
push 2
pop esi
cmp dword [ebp - 0x2c], edi
jl 0x10018724
mov dword [ebp - 0x34], 0x8cccddd1
mov dword [ebp - 0x1c], ecx
jmp 0x10018658
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xac], 0x54c3c69a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10018647
mov dword [ebp - 0xa8], ecx
jmp 0x10018672
mov dword [ebp - 0x34], 9
dec dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], 0xfffffff7
je 0x10018665
cmp dword [ebp - 0x2c], ecx
je 0x1001869c
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x10018691
push ecx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x30], eax
jmp 0x10018710
mov dword [ebp - 0x40], edx
xor edx, edx
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], 0xffff
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
push 4
setge dl
xor ecx, ecx
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp edx, eax
pop eax
setl cl
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x2c]
jl 0x100186ec
cmp dword [ebp - 0x30], 0
je 0x100186ec
mov eax, ebx
jmp 0x100186ee
xor eax, eax
cmp edi, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setl cl
mov dword [ebp - 0x24c], ecx
dec dword [ebp - 0x2c]
mov edx, 0xfff8
push 0
pop ecx
cmp dword [ebp - 0x2c], edi
jge 0x1001863b
mov dword [ebp - 0x30], 0x8a1f
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x30]
sub eax, 7
push 0xffffffffffffffff
mov eax, 0xfffa
pop edi
je 0x100187ca
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0xededb5ca
cmp dword [ebp - 0x18], ecx
je 0x100187af
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setle dl
xor ecx, ecx
cmp edx, edi
setle cl
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, dword [ebp - 0x30]
jg 0x10018792
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x30]
je 0x100187ad
mov ecx, ebx
jmp 0x100187af
xor ecx, ecx
mov eax, dword [ebp - 0x30]
inc ecx
xor edx, edx
cmp ecx, eax
setne dl
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
sub ecx, eax
mov dword [ebp - 0x28], ecx
jmp 0x100187ff
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x100187e0
push 0x23b3
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
xor ecx, ecx
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x100187ff
push ecx
push 0x1076
push 0x15d2
push 0xe1d
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
mov dword [ebp - 0x44], ebx
lea ecx, [ebp - 0x188]
push 3
call fcn.1000db36
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x3c], 0xbdb88dcf
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x14], edx
jmp 0x1001883a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x188]
mov dword [eax + ecx*4], 0xfdf99ff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10018827
push 4
mov dword [ebp - 0x14], edx
pop ecx
jmp 0x10018855
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x294], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10018848
mov dword [ebp - 0x288], edx
jmp 0x100189e4
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], edx
jl 0x100189d8
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x34], edi
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x10018895
push 0x1c0f
push 0x19cd
call dword [sym.imp.GDI32.dll_SetMapMode]
xor edx, edx
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], esi
jg 0x100189cf
xor edi, edi
push esi
lea ecx, [ebp - 0x410]
call fcn.1000db36
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x1c], edi
jmp 0x100188ca
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x410]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x100188bb
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x188]
mov edx, dword [ebp - 0x188]
mov eax, dword [eax + ecx*4]
mov dword [edx + esi*4], eax
test eax, eax
jne 0x10018994
cmp dword [ebp - 0x14], edi
jne 0x10018918
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x188]
cmp dword [eax + ecx*4], edi
sete dl
xor eax, eax
cmp edx, 0xfffffff7
setne al
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x3c]
je 0x1001891b
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
test eax, eax
setle cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
je 0x10018943
mov ecx, dword [ebp - 0x14]
mov esi, edi
mov eax, dword [ebp - 0x188]
cmp dword [eax + ecx*4], edi
je 0x10018945
mov esi, ebx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x188]
push 8
mov eax, dword [ecx + eax*4]
add eax, dword [ecx + 4]
mov edx, dword [ecx + edx*4]
add eax, esi
add edx, 0x21e1d82c
sub edx, eax
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
sete cl
add ecx, eax
mov eax, dword [ebp - 0x410]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
sub ecx, eax
pop eax
add ecx, eax
cmp ecx, 0x4d41
mov ecx, edi
je 0x10018996
mov ecx, ebx
mov eax, dword [ebp - 0x288]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x410]
call fcn.1000dbb8
inc dword [ebp - 0x14]
push 2
pop esi
cmp dword [ebp - 0x14], esi
jle 0x100188a3
xor edx, edx
or edi, 0xffffffff
dec dword [ebp - 0x18]
jns 0x10018874
mov eax, dword [ebp - 0x288]
inc dword [ebp - 0x288]
cmp dword [ebp - 0x288], esi
jle 0x10018865
lea ecx, [ebp - 0x188]
mov dword [ebp - 4], edi
call fcn.1000dbb8
xor ecx, ecx
mov byte [ebp - 0xd], cl
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ecx
jmp 0x10018a1c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x124], 5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10018a0b
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ecx
jl 0x10018ce6
mov dword [ebp - 0x28], 0x1920
cmp dword [ebp - 0x28], 0xa68
jge 0x10018c5c
lea eax, [ebp - 0x80]
push eax
push 0x1000a19c
call fcn.1004d4be
xor eax, eax
xorps xmm0, xmm0
pop ecx
pop ecx
mov dword [ebp - 0x1ac], eax
lea ecx, [ebp - 0x1ac]
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], eax
lea eax, [ebp - 0x608]
push eax
push dword [ebp - 0x80]
movlpd qword [ebp - 0x608], xmm0
call fcn.10024575
mov dword [ebp - 4], ebx
xorps xmm0, xmm0
xor ebx, ebx
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x60], xmm0
cmp dword [ebp - 0x7c], ebx
jl 0x10018af1
jg 0x10018aa4
cmp dword [ebp - 0x80], ebx
jbe 0x10018af1
mov eax, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x1ac]
lea esi, [ecx + eax*8]
push esi
push 0x1000a19c
call fcn.1004d4be
add ebx, dword [esi]
mov eax, dword [ebp - 0x34]
adc edi, dword [esi + 4]
add eax, 1
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
adc ecx, 0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
cmp ecx, dword [ebp - 0x7c]
jl 0x10018ab6
jg 0x10018af7
cmp eax, dword [ebp - 0x80]
jb 0x10018ab6
jmp 0x10018af7
mov ebx, dword [ebp - 0x48]
mov edi, dword [ebp - 0x44]
push 0
push 3
push edi
push ebx
call fcn.10062850
or ecx, ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
je 0x10018b17
push 0x1000a1a4
call fcn.1004d598
pop ecx
lea eax, [ebp - 0x610]
xor ebx, ebx
push eax
push dword [ebp - 0x80]
xorps xmm0, xmm0
mov dword [ebp - 0x1e0], ebx
lea ecx, [ebp - 0x1e0]
movlpd qword [ebp - 0x610], xmm0
mov dword [ebp - 0x1dc], ebx
mov dword [ebp - 0x1d8], ebx
call fcn.10024575
xorps xmm0, xmm0
mov dword [ebp - 0x34], ebx
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x60], xmm0
cmp dword [ebp - 0x7c], ebx
jl 0x10018bd2
jg 0x10018b69
mov eax, dword [ebp - 0x80]
cmp eax, ebx
jbe 0x10018bd5
mov esi, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0x1e0]
sub esi, ecx
mov eax, dword [ebp - 0x60]
mov edi, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
mov ebx, dword [ebp - 0x5c]
mov dword [ebp - 0x3c], eax
jmp 0x10018b8b
mov eax, dword [ebp - 0x3c]
add edx, dword [esi + ecx]
mov dword [ebp - 0x38], edx
adc edi, dword [esi + ecx + 4]
cmp edx, dword [ebp - 0x24]
jne 0x10018ba8
cmp edi, dword [ebp - 0x20]
jne 0x10018ba8
add eax, 1
mov dword [ebp - 0x3c], eax
adc ebx, 0
mov dword [ecx], eax
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ecx + 4], ebx
mov dword [ebp - 0x34], eax
add ecx, 8
cdq
cmp edx, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x3c]
jl 0x10018b8b
jg 0x10018bd2
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x28], eax
jb 0x10018b88
jmp 0x10018bd5
mov eax, dword [ebp - 0x80]
xorps xmm0, xmm0
dec eax
movlpd qword [ebp - 0x60], xmm0
mov edx, dword [ebp - 0x5c]
mov esi, dword [ebp - 0x60]
movlpd qword [ebp - 0x48], xmm0
cmp eax, 2
jl 0x10018c2e
mov ecx, dword [ebp - 0x1e0]
mov edi, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x48]
lea ecx, [ecx + eax*8]
add ecx, 0xfffffff0
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x1ac]
add ebx, dword [ecx + eax*8]
adc edi, dword [ecx + eax*8 + 4]
mov ecx, dword [ebp - 0x34]
cmp ebx, dword [ebp - 0x24]
jne 0x10018c22
cmp edi, dword [ebp - 0x20]
jne 0x10018c22
add esi, dword [ecx]
adc edx, dword [ecx + 4]
dec eax
sub ecx, 8
mov dword [ebp - 0x34], ecx
cmp eax, 2
jge 0x10018c03
push edx
push esi
push 0x1000a0dc
call fcn.1004d076
add esp, 0xc
lea ecx, [ebp - 0x1e0]
call fcn.1000dbb8
or edi, 0xffffffff
lea ecx, [ebp - 0x1ac]
mov dword [ebp - 4], edi
call fcn.1000dbb8
xor ebx, ebx
inc ebx
mov dword [ebp - 0x34], ebx
mov ecx, 0xfb2c41ac
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x124]
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x124]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
neg ecx
mov eax, dword [ebp + eax*4 - 0x124]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x124]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
imul edx, dword [ebp + eax*4 - 0x124]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x124]
cmp edx, eax
setle cl
inc ecx
imul ecx, dword [ebp - 0x124]
mov dword [ebp - 0x120], ecx
dec dword [ebp - 0x18]
jns 0x10018a2e
push 2
pop esi
cmp byte [ebp - 0xd], 0
je 0x10018d01
push 0x1b97
push 0xb6c
push 0x781
call dword [sym.imp.USER32.dll_EnableScrollBar]
push 8
mov dword [ebp - 0x2c], 0x69fdf99f
pop eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffee
jge 0x10018d57
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10018d30
push 0x22e7
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffe6
jmp 0x10018d48
mov dword [ebp - 0x28], 0xd94543be
cmp dword [ebp - 0x28], eax
jne 0x10018d4e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff3
jne 0x10018d39
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffee
jl 0x10018d16
mov dword [ebp - 0x2c], 0xac64a684
mov dword [ebp - 0x2c], 0xffffffeb
jmp 0x10018dc9
push 3
lea ecx, [ebp - 0x5fc]
call fcn.1000db36
xor edx, edx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], edx
jmp 0x10018d91
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x5fc]
mov dword [eax + ecx*4], 0xa3399244
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10018d7e
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], edx
jl 0x10018dbb
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x10018db6
push edx
push 0xcf5
call dword [sym.imp.USER32.dll_GetWindowPlacement]
xor edx, edx
dec dword [ebp - 0x24]
jns 0x10018d9f
lea ecx, [ebp - 0x5fc]
call fcn.1000dbb8
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe5
je 0x10018d67
xor eax, eax
mov dword [ebp - 0x2c], edi
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10018f17
mov dword [ebp - 0x44], 0x7102
mov dword [ebp - 0x44], 0xebb6748f
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], 0x33c63384
mov dword [ebp - 0x44], 0xeb6b9dd9
mov dword [ebp - 0x28], 0x29c1464f
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x44], 0x182abbf9
mov dword [ebp - 0x44], 0x34c865b4
mov dword [ebp - 0x44], 0xd0657689
mov dword [ebp - 0x34], 0xfdad5a51
mov dword [ebp - 0x44], 0x69b2e414
mov dword [ebp - 0x44], 0x73468807
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x44], 0x1a652065
mov dword [ebp - 0x44], 0xd890fc52
mov dword [ebp - 0x1c], 0x8d46758e
mov dword [ebp - 0x18], 0x920a6ff6
mov dword [ebp - 0x1c], eax
jmp 0x10018e68
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x650], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10018e5b
dec dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setle dl
xor eax, eax
cmp dword [ebp - 0x38], edx
jge 0x10018eaf
mov dword [ebp - 0x34], edi
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10018ec1
push eax
push 0xef1
call dword [sym.imp.USER32.dll_ValidateRect]
jmp 0x10018ebf
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10018ec1
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor eax, eax
mov dword [ebp - 0x1c], 0xffffffe3
jmp 0x10018f05
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x10018ee2
push eax
push 0xe98
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x10018f02
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x650], 0xe81d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10018eea
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xf
jne 0x10018eca
push eax
push 0x2688
call dword [sym.imp.USER32.dll_KillTimer]
push esi
lea ecx, [ebp - 0x404]
call fcn.1000db36
mov dword [ebp - 0x3c], 0xfffffff9
xor edx, edx
mov dword [ebp - 0x504], edi
mov dword [ebp - 0x500], edi
mov dword [ebp - 0x4fc], edi
mov dword [ebp - 0x4f8], edi
mov edi, 0xd41e
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x524], eax
mov dword [ebp - 0x520], eax
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x28], 0x55c0c8fb
mov dword [ebp - 0x14], edx
jmp 0x10018f7f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x404]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10018f70
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], esi
jge 0x10018fa1
push 4
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x628], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10018f8f
mov dword [ebp - 0x14], edx
jmp 0x10018fb3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x798], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10018fa6
mov edx, dword [ebp - 0x404]
xor ecx, ecx
mov esi, 0x2f82240c
mov eax, dword [edx + 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [edx]
mov dword [ebp - 0x504], eax
mov eax, dword [edx]
mov dword [ebp - 0x518], ebx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, dword [edx + 4]
mov dword [ebp - 0x628], eax
setge cl
mov dword [ebp - 0x790], esi
xor eax, eax
cmp dword [edx + 4], esi
sete al
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x404]
call fcn.1000dbb8
push 2
lea ecx, [ebp - 0x41c]
call fcn.1000db36
mov dword [ebp - 0x3c], 0xfffffff9
or eax, 0xffffffff
mov dword [ebp - 0x564], eax
xor edx, edx
mov dword [ebp - 0x560], eax
mov dword [ebp - 0x55c], eax
mov dword [ebp - 0x558], eax
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x544], eax
mov dword [ebp - 0x540], eax
mov dword [ebp - 0x53c], eax
mov dword [ebp - 0x538], eax
mov dword [ebp - 0x28], 0x55c0c8fb
mov dword [ebp - 0x14], edx
jmp 0x1001907a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x41c]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001906b
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 2
jge 0x1001909f
push 4
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x664], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001908c
mov dword [ebp - 0x14], edx
jmp 0x100190b1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x738], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100190a4
mov edx, dword [ebp - 0x41c]
xor ecx, ecx
mov eax, dword [edx + 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [edx]
mov dword [ebp - 0x564], eax
mov eax, dword [edx]
mov dword [ebp - 0x538], ebx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, dword [edx + 4]
mov dword [ebp - 0x664], eax
setge cl
mov dword [ebp - 0x730], esi
xor eax, eax
cmp dword [edx + 4], esi
sete al
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x41c]
call fcn.1000dbb8
mov edi, 0xf38c
xor esi, esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], 0x69576881
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x34], 0x1f050678
push 4
mov dword [ebp - 0x28], 0xcefbde28
mov dword [ebp - 0x1c], esi
pop ecx
jmp 0x10019147
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7e4], 0xc0e2632c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10019136
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x18], eax
jne 0x1001916f
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x18], esi
je 0x10019169
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], 0x6eed1e12
push 8
pop eax
cmp dword [ebp - 0x18], eax
push 4
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x7e0], edx
mov eax, dword [ebp - 0x18]
cmp edx, eax
setne cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], 0x69576881
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x34], 0x1f050678
mov dword [ebp - 0x28], 0xcefbde28
mov dword [ebp - 0x1c], esi
pop ecx
jmp 0x100191d2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7b4], 0xc0e2632c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100191c1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x18], eax
jne 0x100191fa
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x18], esi
je 0x100191f4
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], 0x6eed1e12
push 8
pop eax
cmp dword [ebp - 0x18], eax
push ebx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x7b0], edx
mov eax, dword [ebp - 0x18]
cmp edx, eax
setne cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x148]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xbeb0647d
mov dword [ebp - 0x20], 0xae77ab39
mov dword [ebp - 0x24], 0x80444555
mov dword [ebp - 0x3c], 0x7dfe4d9e
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x28], 0xe418a527
call fcn.1000db36
push 2
pop edi
mov dword [ebp - 4], edi
xor ecx, ecx
mov dword [ebp - 0x2c], 0x7a1245c8
mov dword [ebp - 0x34], 0x55ff
mov dword [ebp - 0x1c], 0x7e80a7c6
mov dword [ebp - 0x18], ecx
push 0xfffffffffffffff6
pop esi
cmp dword [ebp - 0x18], ebx
jge 0x100192a4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x148]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1001928e
xor ecx, ecx
mov dword [ebp - 0x18], ecx
jmp 0x100192ba
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x36c], 0x8ca18188
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100192a9
mov eax, dword [ebp - 0x38]
inc dword [ebp - 0x34]
jne 0x100192f9
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x148]
sub edx, dword [eax]
mov eax, dword [ebp - 0x28]
neg edx
mov eax, dword [ebp - 0x3c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
mov eax, dword [ebp - 0x148]
setne cl
mov dword [eax], ecx
xor ecx, ecx
mov edx, ecx
cmp dword [ebp - 0x1c], ecx
je 0x100192fb
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], 0
jne 0x100193b3
mov dword [ebp - 0x30], 0x5f4d0c6
xor edx, edx
mov dword [ebp - 0x28], 0x520a048c
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x34], 0xffffffff
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x148]
add ecx, dword [eax]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setg cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
je 0x1001936d
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
xor edx, edx
test eax, eax
setle dl
neg edx
sub edx, dword [ebp - 0x30]
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
sub ecx, 0x37f4a1d2
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
jmp 0x1001949e
push ebx
lea ecx, [ebp - 0x2b8]
call fcn.1000db36
push 6
pop eax
mov dword [ebp - 0x44], eax
xor edx, edx
mov dword [ebp - 0x3c], 0x8d98c683
mov dword [ebp - 0x14], edx
jmp 0x100193e6
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2b8]
mov dword [eax + ecx*4], 0x70d5dd21
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100193d3
mov dword [ebp - 0x14], edx
jmp 0x100193fd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x25c], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100193f0
mov dword [ebp - 0x14], edx
jmp 0x10019418
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x744], 0x2f47
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10019407
inc dword [ebp - 0x36c]
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2b8]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x148]
setle dl
xor ebx, ebx
cmp dword [eax], edx
mov eax, dword [ebp - 0x1c]
setne bl
xor ecx, ecx
cmp ebx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x25c]
mov eax, dword [ebp - 0x148]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x3c]
sub ecx, eax
cmp ecx, 0x9adb
setg dl
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2b8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, dword [eax]
setg cl
mov dword [ebp - 0x744], ecx
lea ecx, [ebp - 0x2b8]
call fcn.1000dbb8
xor ebx, ebx
inc ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x148]
call fcn.1000dbb8
push ebx
lea ecx, [ebp - 0x194]
call fcn.1000db36
push 3
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x434]
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x24], 0x49e864ad
mov dword [ebp - 0x20], 0x7762969f
push eax
call fcn.1000db36
mov dword [ebp - 0x30], esi
xor edx, edx
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x14], edx
jmp 0x10019501
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x194]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100194f1
mov dword [ebp - 0x14], edx
jmp 0x1001951b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x434]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001950b
mov dword [ebp - 0x14], edx
jmp 0x10019537
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x37c], 0x98a8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10019526
mov eax, dword [ebp - 0x194]
cmp dword [eax], edx
jne 0x10019614
mov dword [ebp - 0x3c], 0xe44f
mov eax, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x194]
mov esi, dword [edi]
imul eax, esi, 0xbec7
cmp eax, esi
jg 0x1001956c
mov ecx, edx
test esi, esi
je 0x1001956e
mov ecx, ebx
xor eax, eax
cmp ecx, esi
setl al
xor ecx, ecx
cmp eax, esi
setne cl
xor edx, edx
cmp ecx, 0x5fdfda84
setge dl
xor eax, eax
cmp edx, esi
setge al
cmp eax, esi
jle 0x1001959f
xor eax, eax
cmp dword [ebp - 0x3c], eax
mov edi, dword [ebp - 0x194]
je 0x100195a1
mov eax, ebx
mov ecx, dword [ebp - 0x24]
xor edx, edx
imul eax, eax, 0x7ed4
mov esi, dword [edi]
cmp eax, dword [edi]
mov eax, dword [ebp - 0x20]
setge dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, 0xae2
setne al
xor ecx, ecx
cmp eax, esi
setg cl
xor eax, eax
cmp ecx, esi
setl al
xor ecx, ecx
cmp eax, esi
setle cl
xor eax, eax
sub ecx, 0xfff8
cmp ecx, 0x499e98c5
setge al
xor edx, edx
cmp eax, 0xfffffffd
mov eax, dword [ebp - 0x434]
sete dl
xor ecx, ecx
cmp edx, dword [eax]
setl cl
xor esi, esi
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], esi
jne 0x10019616
mov edx, esi
jmp 0x10019618
xor esi, esi
mov edx, ebx
mov eax, dword [ebp - 0x378]
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, 0x1dab
je 0x10019633
mov eax, dword [ebp - 0x378]
push 0x18
or edi, 0xffffffff
pop eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], eax
jmp 0x100196a8
mov dword [ebp - 0x2c], 0x9a040d4f
mov dword [ebp - 0x1c], esi
jmp 0x1001965b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x64], 9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1001964d
dec dword [ebp - 0x64]
xor edx, edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setg dl
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x2c], esi
jmp 0x100196a0
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x194]
mov dword [eax + ecx*4], 0xc2a7322e
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jl 0x1001968d
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffef
jne 0x10019641
lea ecx, [ebp - 0x434]
call fcn.1000dbb8
lea ecx, [ebp - 0x194]
mov dword [ebp - 4], edi
call fcn.1000dbb8
push 2
pop esi
push esi
lea ecx, [ebp - 0x348]
call fcn.1000db36
push 4
pop eax
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x44], 0xb3c692be
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], cl
je 0x10019735
push 0x19ed
push 0x17a3
push ecx
push ecx
push 0x111b
push 0x1c48
push 0x602
push 0xf57
push 0x855
push 0x24a
push 0x6ba
push 0x163a
push 0x187a
call dword [sym.imp.GDI32.dll_StretchDIBits]
xor ecx, ecx
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x10019748
push ecx
push ecx
call dword [sym.imp.USER32.dll_EnumWindows]
xor ecx, ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x44], 0x275ff444
mov dword [ebp - 0x44], 0x18bc698d
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x1c], ecx
jmp 0x10019779
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5ec], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x1001976c
mov dword [ebp - 0x2c], 0xe
cmp dword [ebp - 0x2c], 0xfffffff4
jne 0x10019970
push esi
lea ecx, [ebp - 0x1c8]
call fcn.1000db36
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x30], esi
push 3
call fcn.1000db36
mov dword [ebp - 0x20], 0xffff
xor edx, edx
mov dword [ebp - 0x28], 0x20f2d627
mov dword [ebp - 0x18], edx
jmp 0x100197d3
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c8]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100197c4
mov dword [ebp - 0x18], edx
jmp 0x100197f0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44c]
mov dword [eax + ecx*4], 0xe75cb554
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100197dd
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], edx
jl 0x10019945
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], 0x25e6
cmp dword [ebp - 0x28], 0x6b8
jge 0x100198c0
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xc4], edx
push eax
push 0x1000a0e4
call fcn.1004d4be
pop ecx
xor eax, eax
pop ecx
mov ecx, dword [ebp - 0xc4]
mov ebx, eax
mov esi, eax
mov edi, eax
test ecx, ecx
je 0x10019899
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x9c]
push eax
push 0x1000a0c8
call fcn.1004d4be
mov edx, dword [ebp - 0x9c]
pop ecx
pop ecx
mov ecx, ebx
call fcn.100109b9
cmp dword [ebp - 0x9c], esi
mov ebx, eax
mov ecx, dword [ebp - 0xc4]
cmovg esi, dword [ebp - 0x9c]
inc edi
push 0
pop eax
cmp edi, ecx
jb 0x10019856
mov eax, esi
cdq
idiv ebx
sub eax, ecx
and eax, 0x80000001
jns 0x100198ac
dec eax
or eax, 0xfffffffe
inc eax
je 0x100198b5
push 0x1000a1a8
jmp 0x100198ba
push 0x1000a1b0
call fcn.1004d598
pop ecx
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c8]
push 1
mov eax, dword [ecx + eax*4]
imul eax, dword [ecx + edx*4]
xor ecx, ecx
mov edx, dword [ebp - 0x40]
cmp eax, dword [edx + 4]
mov eax, dword [ebp - 0x24]
setle cl
xor ebx, ebx
mov dword [eax + 8], ecx
mov dword [ebp - 0x38], 0xd72276b
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c8]
mov eax, dword [eax + ecx*4]
add eax, 0x2d3f
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov eax, dword [ebp - 0x1c8]
setg bl
mov eax, dword [eax + edx*4]
xor edx, edx
dec eax
cmp ebx, eax
mov eax, dword [ebp - 0x20]
pop ebx
setle dl
xor ecx, ecx
cmp edx, eax
push 0
setne cl
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x30]
pop edx
jns 0x10019814
push 2
pop esi
or edi, 0xffffffff
lea ecx, [ebp - 0x44c]
call fcn.1000dbb8
push 4
pop eax
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], al
call fcn.1000dbb8
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff4
je 0x1001978f
xor ecx, ecx
dec dword [ebp - 0x3c]
mov dword [ebp - 0x514], edi
mov dword [ebp - 0x510], edi
mov dword [ebp - 0x50c], edi
mov dword [ebp - 0x508], edi
mov dword [ebp - 0x44], edi
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x100199af
push ecx
push 0x11ff
push 0x172
push 0x1845
call dword [sym.imp.GDI32.dll_MoveToEx]
xor ecx, ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x100199c3
push ecx
call edi
xor ecx, ecx
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0x534], eax
mov dword [ebp - 0x530], eax
mov dword [ebp - 0x52c], eax
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x2e8]
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x30], 0xc44d4e2b
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x40], eax
push ebx
call fcn.1000db36
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x34], 0x158e
mov dword [ebp - 0x38], 0xa65c8bb6
mov dword [ebp - 0x1c], esi
jmp 0x10019a41
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2e8]
mov dword [eax + ecx*4], 0x3e8ea471
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10019a2e
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, 0xa0d0
push 8
setle cl
xor edx, edx
cmp ecx, 0x69161d59
setg dl
sub edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setge cl
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, ebx
setg cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x20], esi
je 0x10019ac1
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2e8]
xor ecx, ecx
cmp dword [eax], esi
sete cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x40], eax
jg 0x10019adc
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
test eax, eax
setg cl
cmp ecx, 0xfffffff7
sbb ecx, ecx
xor edx, edx
neg ecx
sub ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x2e8]
lea ecx, [ebp - 0x2e8]
setge dl
sub edx, dword [eax]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x30], edx
call fcn.1000dbb8
movdqa xmm0, xmmword [0x1000a540]
lea ecx, [ebp - 0x6bc]
push ecx
lea eax, [ebp - 0x6ac]
mov dword [ebp - 0x28], 0x55c0c8fb
push eax
push ecx
lea ecx, [ebp - 0x464]
movdqu xmmword [ebp - 0x6bc], xmm0
call fcn.1000db92
mov esi, dword [ebp - 0x464]
xor edx, edx
mov dword [ebp - 0x18], 0x925ef2c3
xor ecx, ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x38], 0x37c2b42d
mov eax, dword [esi + 8]
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x28], 0xb64d
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
test eax, eax
push 0xfffffffffffffffb
setg cl
xor eax, eax
cmp dword [esi + 8], ecx
pop ecx
setg al
sub ecx, dword [esi + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add eax, dword [esi + 8]
cmp ecx, eax
jle 0x10019c8a
mov dword [ebp - 0x30], 0x403ca955
mov dword [ebp - 0x3c], 0x68e0133d
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 3
jge 0x10019bd5
push 4
pop ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x78c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10019bc2
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov edx, dword [esi + 8]
mov ecx, edx
mov eax, dword [ebp - 0x18]
sub ecx, eax
imul ecx, edx
xor edx, edx
test ecx, ecx
jne 0x10019c0d
mov eax, edx
cmp dword [ebp - 0x30], edx
je 0x10019c0f
mov eax, ebx
mov dword [ebp - 0x3c], eax
cmp dword [esi + 8], edx
jne 0x10019c4c
mov eax, dword [ebp - 0x38]
cmp dword [esi + 8], edx
je 0x10019c2a
cmp dword [ebp - 0x34], 0x1289665f
mov eax, ebx
jg 0x10019c2c
mov eax, edx
add eax, 0xffff0005
xor ecx, ecx
cmp eax, 0xc8da536b
setge cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x24], eax
jl 0x10019c4e
mov edx, ebx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x464]
sete cl
xor edx, edx
imul ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x30]
imul eax, ecx
cmp eax, dword [esi + 8]
mov eax, dword [ebp - 0x784]
setg dl
xor ecx, ecx
cmp edx, eax
sete cl
neg ecx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
jmp 0x10019ca0
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], dl
je 0x10019ca0
push 0x140c
push edx
push edx
push edx
call dword [sym.imp.GDI32.dll_CombineRgn]
lea ecx, [ebp - 0x464]
call fcn.1000dbb8
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x1c], edx
jmp 0x10019ccd
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5f0], 0x624039b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x10019cbc
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], dl
je 0x10019ce5
push 0x25c9
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], edx
jl 0x10019d0e
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x10019d09
push edx
push 0x1ade
push 0xa3d
call dword [sym.imp.USER32.dll_AttachThreadInput]
xor edx, edx
dec dword [ebp - 0x24]
jns 0x10019ced
push 2
mov dword [ebp - 0x14], edx
pop esi
jmp 0x10019d29
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x348]
mov dword [eax + ecx*4], 0xd41e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10019d16
mov dword [ebp - 0x14], 0x3532fe22
cmp dword [ebp - 0x14], edx
jne 0x10019db7
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xe7528ace
sbb eax, eax
xor ecx, ecx
inc eax
test eax, eax
setle cl
test ecx, ecx
js 0x10019d55
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub eax, 0xa07b
mov eax, edx
je 0x10019d69
mov eax, ebx
mov ecx, dword [ebp - 0x14]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
cmp ecx, 0xd162c5d1
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, 0xf0a0cd95
setle dl
cmp eax, edx
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x14]
jne 0x10019db5
mov dword [ebp - 0x28], 0x4ccf97a2
mov dword [ebp - 0x28], ebx
jmp 0x10019f2c
xor edx, edx
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x24], 0x77c83be7
mov dword [ebp - 0x34], 0x4870e7c
mov dword [ebp - 0x1c], edx
jmp 0x10019de1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x98], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10019dd4
mov dword [ebp - 0x14], edx
jmp 0x10019f22
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], 0xfffffffd
cmp dword [ebp - 0x18], 0xffffffec
jne 0x10019e9f
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x10019e3b
push 0x19f3
push 0xc5c
push 0x1692
push 0x275
push 0x1a52
push 0x892
push 0x1603
push 0x4c
push 0x1e42
call dword [sym.imp.GDI32.dll_Arc]
mov eax, dword [ebp - 0x18]
mov ecx, 0x804524be
cmp ecx, eax
push 0
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x3fb18ba7
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x94]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [ebp - 0x18]
cmp eax, edx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x94]
setl cl
sub edx, ecx
xor ecx, ecx
cmp eax, edx
pop edx
setge cl
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffec
je 0x10019e02
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], edx
jl 0x10019f1f
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x3c]
inc dword [ebp - 0x3c]
test eax, eax
je 0x10019ebb
cmp dword [ebp - 0x24], edx
je 0x10019ebb
mov edx, ebx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x98]
cmp eax, edx
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
add ecx, dword [ebp + eax*4 - 0x98]
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x98]
test eax, eax
mov eax, dword [ebp - 0x30]
setne cl
mov eax, dword [ebp + eax*4 - 0x98]
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x30]
jns 0x10019ea7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1a
jle 0x10019dee
xor ecx, ecx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], esi
jge 0x10019f4b
push 4
pop edx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x588], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10019f39
mov dword [ebp - 0x14], ecx
jmp 0x10019f5d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7a4], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10019f50
mov esi, dword [ebp - 0x348]
mov eax, dword [esi + 4]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], cl
je 0x10019f93