Function at 0x100184bb
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
mov eax, 0x1007de52
call fcn.1007d3a8
sub esp, 0x21c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x44], edx
push 3
lea ecx, [ebp - 0x1e0]
call fcn.1001673e
xor ebx, ebx
lea ecx, [ebp - 0x180]
push 2
mov dword [ebp - 4], ebx
call fcn.1001673e
push 3
mov dword [ebp - 0x1c], 0x1f782a18
mov dword [ebp - 0x10], ebx
pop esi
jmp 0x10018514
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1e0]
mov dword [eax + ecx*4], 0xa53d06ce
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10018501
mov dword [ebp - 0x10], ebx
jmp 0x10018531
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x180]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001851e
mov eax, dword [ebp - 0x1e0]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x180]
mov dword [eax], ecx
mov dword [ebp - 0x1c], ebx
jmp 0x10018560
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1001855d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommState]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jle 0x1001854d
lea ecx, [ebp - 0x180]
call fcn.100167c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e0]
call fcn.100167c0
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x1c], ebx
jmp 0x1001859d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x98], 1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001858c
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x100185b7
push 0xb01
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 2
jg 0x10018680
push 2
lea ecx, [ebp - 0x138]
call fcn.1001673e
mov dword [ebp - 0x1c], ebx
jmp 0x100185e9
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x138]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100185d6
mov eax, dword [ebp - 0x138]
lea esi, [eax + 4]
mov dword [esi], ebx
mov dword [ebp - 0x28], 0xffffffff
cmp dword [eax], ebx
je 0x1001861f
mov ecx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x98]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
xor eax, eax
cmp dword [esi], ebx
setg al
cmp eax, 5
mov eax, dword [ebp - 0x20]
sbb edx, edx
neg edx
mov ecx, dword [ebp + eax*4 - 0x98]
mov eax, dword [ebp - 0x20]
add ecx, edx
cmp dword [ebp + eax*4 - 0x98], ecx
jle 0x1001864d
cmp dword [esi], ebx
jne 0x1001864d
mov eax, ebx
jmp 0x10018650
xor eax, eax
inc eax
inc dword [esi]
cmp dword [esi], 2
mov dword [ebp - 0x98], eax
jg 0x10018665
mov eax, dword [ebp - 0x138]
jmp 0x100185fa
lea ecx, [ebp - 0x138]
call fcn.100167c0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x100185c4
push 3
pop esi
push dword [ebp - 0x68]
movdqa xmm0, xmmword [0x10007ad0]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0xa4], ebx
push eax
push ebx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xa0], ebx
movdqu xmmword [ebp - 0x218], xmm0
mov dword [ebp - 0x9c], ebx
call fcn.10017c12
xor eax, eax
lea ecx, [ebp - 0x198]
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0xcb50bf34
mov dword [ebp - 0x10], 0x71d976ff
mov dword [ebp - 0x20], 0x2961c0f8
mov dword [ebp - 0x18], 0x44142b91
push eax
call fcn.1001673e
mov dword [ebp - 0x1c], ebx
jmp 0x10018701
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x198]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x100186f2
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x10], eax
jle 0x1001875d
cmp dword [ebp - 0x20], ebx
jne 0x1001874c
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
sub edx, eax
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
imul ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x1001874c
mov ecx, ebx
jmp 0x1001874f
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x198]
cmp ecx, dword [eax]
jle 0x1001875d
mov eax, ebx
jmp 0x10018760
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], ebx
jmp 0x10018772
mov dword [ebp - 0x10], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10018768
lea ecx, [ebp - 0x198]
call fcn.100167c0
mov dword [ebp - 0x2c], 0x7b051af7
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x10], 0xdf37d45d
push esi
call fcn.1001673e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x18], 0x5d1cb6a7
mov dword [ebp - 0x28], 0xa0a9
push 4
call fcn.1001673e
mov dword [ebp - 0x20], ebx
jmp 0x100187d3
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100187c0
mov dword [ebp - 0x20], ebx
jmp 0x100187f0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x168]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x100187dd
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov esi, dword [ebp - 0x10]
sub eax, 0x36126460
cmp eax, 0x4fc2285f
setne cl
xor edx, edx
sub esi, ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
inc ecx
cmp ecx, eax
setg dl
xor ecx, ecx
cmp edx, 0x45fe
setne cl
xor eax, eax
cmp esi, ecx
setl al
imul eax, eax, 0xc2e7
test eax, eax
je 0x10018856
mov dword [ebp - 0x10], ebx
jmp 0x1001884e
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001884b
call dword [sym.imp.USER32.dll_EndMenu]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x17
jle 0x1001883c
jmp 0x10018886
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001886a
push 0x133f
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x10], ebx
jmp 0x10018880
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x120]
cmp dword [eax + ecx*4], ebx
jne 0x10018886
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x1001886f
cmp dword [ebp - 0x10], ebx
jne 0x1001888f
mov edx, ebx
jmp 0x10018892
xor edx, edx
inc edx
cmp dword [ebp - 0x18], ebx
jne 0x100188bd
cmp dword [ebp - 0x28], 0xa12a
jg 0x100188aa
cmp dword [ebp - 0x18], ebx
je 0x100188aa
xor ecx, ecx
inc ecx
jmp 0x100188ac
mov ecx, ebx
xor eax, eax
cmp ecx, 6
setne al
add eax, dword [ebp - 0x18]
jne 0x100188bd
mov eax, ebx
jmp 0x100188c0
xor eax, eax
inc eax
lea ecx, [eax + 4]
mov eax, dword [ebp - 0x120]
add ecx, edx
xor edx, edx
cmp dword [eax + 4], ecx
lea ecx, [ebp - 0x168]
mov eax, dword [ebp - 0x168]
setl dl
mov dword [eax + 8], edx
call fcn.100167c0
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 1
call fcn.100167c0
mov byte [ebp - 0x32], bl
lea ecx, [ebp - 0x1b0]
mov dword [ebp - 0x10], 0xfffffffd
mov dword [ebp - 0x20], 0x6525
push 4
call fcn.1001673e
mov byte [ebp - 4], 3
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x10018937
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1b0]
mov dword [eax + ecx*4], 0xc2f1fcc1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10018924
mov dword [ebp - 0x10], ebx
jmp 0x10018a44
mov dword [ebp - 0x18], 0x5a83d87e
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x24], 6
push 3
call fcn.1001673e
mov dword [ebp - 0x1c], 0xffff
mov dword [ebp - 0x24], ebx
jmp 0x1001897f
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], 0xa73a151c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1001896c
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x20], ebx
je 0x100189b5
cmp dword [ebp - 0x18], ebx
je 0x10018995
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x1b0]
setge dl
mov dword [eax + 0xc], edx
cmp dword [ebp - 0x10], ebx
je 0x100189bd
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
add edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x10]
jle 0x100189e2
cmp dword [ebp - 0x20], ebx
je 0x100189e2
xor eax, eax
inc eax
jmp 0x100189e4
mov eax, ebx
xor edx, edx
cmp eax, 1
mov eax, dword [ebp - 0x10]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x150]
setne cl
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 6
jne 0x10018a36
mov ecx, dword [ebp - 0x150]
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x24]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 6
je 0x10018a1e
lea ecx, [ebp - 0x150]
call fcn.100167c0
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffff
jle 0x10018945
lea ecx, [ebp - 0x1b0]
mov byte [ebp - 4], 1
call fcn.100167c0
push 0x37ec
lea eax, [ebp - 0x32]
push eax
push 0x60f3
push ebx
call fcn.1001b632
mov dword [ebp - 0x18], 3
add esp, 0x10
cmp dword [ebp - 0x18], ebx
jl 0x10018e67
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x10], 3
lea ecx, [ebp - 0x1d4]
push 1
call fcn.1001673e
mov dword [ebp - 0x2c], 0x9ea9831
mov dword [ebp - 0x24], ebx
jmp 0x10018abd
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1d4]
mov dword [eax + ecx*4], 0xdb3ae355
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 1
jl 0x10018aaa
mov eax, dword [ebp - 0x1d4]
lea ecx, [ebp - 0x1d4]
mov dword [eax], ebx
call fcn.100167c0
push 4
pop eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x1c8]
mov dword [ebp - 0x28], 0x974b666a
push eax
call fcn.1001673e
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], 0x5300ce3d
mov dword [ebp - 0x20], ebx
jmp 0x10018b17
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x70], 1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10018b09
mov dword [ebp - 0x20], ebx
jmp 0x10018b32
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c8]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10018b22
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10018b4b
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x24]
cmp eax, 0x4d07ddbf
setl cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
neg eax
je 0x10018b6b
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x1c8]
xor edx, edx
mov dword [eax + 4], 0xbfb66feb
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x70]
dec dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x70]
cmp ecx, eax
lea ecx, [ebp - 0x1c8]
setg dl
add edx, 2
mov dword [ebp - 0x28], edx
call fcn.100167c0
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], ebx
jl 0x10018e31
mov dword [ebp - 0x1c], 0xcea5d6c0
mov dword [ebp - 0x2c], 0x891c5534
mov dword [ebp - 0x1c], 0xffffffed
jmp 0x10018bee
mov dword [ebp - 0x24], 0xeede0b40
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], ebx
jmp 0x10018be5
dec dword [ebp - 0x28]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe6
jge 0x10018bdf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x18
jge 0x10018bc9
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10018c11
push ebx
push ebx
push ebx
push ebx
push 0x24fb
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x1c], 0xd06ce125
mov dword [ebp - 0x24], ebx
jmp 0x10018c2e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc8], 0xfffffff8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 1
jl 0x10018c1d
mov dword [ebp - 0x1c], ebx
jmp 0x10018c46
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc8], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x10018c39
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10018c62
push ebx
push 0x804
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 2
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x24], ebx
jmp 0x10018c85
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xb8], 1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10018c74
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], ebx
jl 0x10018cde
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xb8], ebx
je 0x10018cbf
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb8], ecx
test ecx, ecx
je 0x10018cbf
xor ecx, ecx
inc ecx
jmp 0x10018cc1
mov ecx, ebx
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10018cd9
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
dec dword [ebp - 0x20]
jns 0x10018c96
mov dword [ebp - 0x1c], 0xf
jmp 0x10018d03
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10018d00
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jge 0x10018ce7
mov dword [ebp - 0x24], ebx
jmp 0x10018d1c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x60], 0x4caf14c9
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10018d0e
mov dword [ebp - 0x5c], 3
cmp dword [ebp - 0x5c], ebx
jl 0x10018e28
push 1
lea ecx, [ebp - 0x108]
call fcn.1001673e
mov byte [ebp - 4], 4
mov dword [ebp - 0x2c], 0x49d585ed
mov dword [ebp - 0x24], ebx
jmp 0x10018d5e
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x108]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 1
jl 0x10018d4f
mov eax, dword [ebp - 0x108]
mov dword [eax], ebx
mov dword [ebp - 0x1c], 0x57102d14
mov dword [ebp - 0x2c], 0x33843046
mov dword [ebp - 0x2c], 0x9dd952ea
mov dword [ebp - 0x1c], 0x15
jmp 0x10018dcb
push 3
lea ecx, [ebp - 0x1ec]
call fcn.1001673e
mov dword [ebp - 0x24], ebx
jmp 0x10018daf
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1ec]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10018d9c
mov eax, dword [ebp - 0x1ec]
lea ecx, [ebp - 0x1ec]
dec dword [eax]
call fcn.100167c0
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff8
jne 0x10018d8a
mov eax, dword [ebp - 0x108]
inc dword [eax]
cmp dword [eax], 2
jl 0x10018d6c
lea ecx, [ebp - 0x108]
mov dword [eax], 0x9acf2579
mov byte [ebp - 4], 1
call fcn.100167c0
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xa4]
push 0x248
push ebx
push 0x15f1
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
lea eax, [ebp - 0x31]
mov byte [ebp - 0x31], bl
push eax
call fcn.10019bc9
add esp, 0x10
dec dword [ebp - 0x5c]
jns 0x10018d32
dec dword [ebp - 0x10]
jns 0x10018bb2
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], ebx
jl 0x10018e5e
mov dword [ebp - 0x24], ebx
jmp 0x10018e50
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x64], 0xfffffff7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 1
jl 0x10018e42
dec dword [ebp - 0x64]
dec dword [ebp - 0x10]
jns 0x10018e3d
dec dword [ebp - 0x18]
jns 0x10018a8a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa4]
call fcn.100167c0
cmp dword [edi + 0x10], ebx
jne 0x10018e82
xor al, al
jmp 0x10019a4d
mov dword [ebp - 0x28], 0x692beaa3
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x2c], 0x2d149fe
mov dword [ebp - 0x24], 0xf69f7fd1
push 8
pop eax
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
push 1
call fcn.1001673e
xor ecx, ecx
mov dword [ebp - 4], 5
push 2
inc ecx
mov dword [ebp - 0x1c], ecx
pop edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x30], ebx
jmp 0x10018eef
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xf0], 0x464f16ef
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ecx
jl 0x10018ede
push 3
mov dword [ebp - 0x30], ebx
pop esi
cmp dword [ebp - 0x30], edx
jge 0x10018f0e
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x228], esi
inc dword [ebp - 0x30]
jmp 0x10018efa
push ebx
push 0xd2f
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x30]
push 0x5951
push eax
call fcn.1001c72c
add esp, 0x14
cmp dword [ebp - 0x28], ebx
je 0x10018f93
mov dword [ebp - 0x2c], 0x579253a3
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x2c], 0xfffffffc
push 2
call fcn.1001673e
mov byte [ebp - 4], 6
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x18], ebx
jmp 0x10018f68
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1f8]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10018f58
push 0x6cce
push 0x36b8
lea eax, [ebp - 0xb0]
push ebx
push eax
call fcn.10019a9c
add esp, 0x10
lea ecx, [ebp - 0x1f8]
jmp 0x10019068
push esi
lea ecx, [ebp - 0x114]
call fcn.1001673e
mov dword [ebp - 0x28], 0x9d0863e8
mov dword [ebp - 0x18], ebx
jmp 0x10018fbe
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x114]
mov dword [eax + ecx*4], 0x32e0c280
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10018fab
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10018fd7
push 0x1d00
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xb0]
cmp dword [eax], ebx
jne 0x1001905c
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
neg edx
push 8
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
pop eax
setle cl
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x114]
setle dl
xor ecx, ecx
inc ecx
sub ecx, edx
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x10]
setle dl
mov dword [ebp - 0x28], edx
xor edx, edx
cmp dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xb0]
setg dl
mov ecx, dword [eax]
mov eax, dword [ebp - 0x114]
sub ecx, edx
xor edx, edx
cmp ecx, dword [eax + 4]
setl dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
neg eax
je 0x10019050
cmp dword [ebp - 0x24], ebx
jne 0x1001905c
cmp dword [ebp - 0xf0], ebx
jne 0x1001905c
mov eax, ebx
jmp 0x1001905f
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x114]
call fcn.100167c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.100167c0
mov eax, dword [ebp - 0x44]
xor edx, edx
inc edx
mov dword [eax], ebx
mov dword [ebp - 0x24], 0xd526d2e8
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x100190c1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x58], 0x6986d6db
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100190b3
mov ecx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x24]
add ecx, 0xc17c7747
dec dword [ebp - 0x88]
cmp ecx, eax
mov eax, edx
cmovg eax, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x28], 0x121
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
sub ecx, eax
mov eax, dword [ebp - 0x28]
add eax, ecx
xor ecx, ecx
cmp eax, edx
setge cl
cmp ecx, 0x8345
jge 0x1001914a
mov dword [ebp - 0x10], 0xffffffe6
jmp 0x10019142
mov dword [ebp - 0x28], 0xffffffff
cmp dword [ebp - 0x24], ebx
jne 0x1001918c
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffd
jne 0x10019130
jmp 0x1001918c
push 0x1d
pop eax
mov dword [ebp - 0x28], 0xd711a53f
mov dword [ebp - 0x10], eax
jmp 0x10019163
mov dword [ebp - 0x28], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jne 0x10019159
mov dword [ebp - 0x10], 0xfffffffb
jmp 0x10019186
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10019183
push ebx
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffee
jg 0x10019171
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100191a1
push 0x1e17
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x28], 0x692beaa3
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0x2c], 0x2d149fe
mov dword [ebp - 0x18], 0xf69f7fd1
push 8
pop eax
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
push 1
call fcn.1001673e
xor edx, edx
mov dword [ebp - 4], 7
inc edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x10], ebx
jmp 0x1001920f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd8], 0x464f16ef
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100191fe
mov dword [ebp - 0x10], ebx
jmp 0x10019226
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x220], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10019219
mov dword [ebp - 0x10], ebx
jmp 0x10019244
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc4]
mov dword [eax + ecx*4], 0xa6ff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10019231
cmp dword [ebp - 0x28], ebx
je 0x100192bc
mov dword [ebp - 0x2c], 0x579253a3
lea ecx, [ebp - 0x204]
mov dword [ebp - 0x2c], 0xfffffffc
push 2
call fcn.1001673e
push 8
pop eax
mov byte [ebp - 4], al
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x18], ebx
jmp 0x10019287
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x204]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10019277
push 0x6633
push ebx
push 0x5907
push 0x20b7
lea eax, [ebp - 0xc4]
push eax
push 0x14c7
call fcn.10019c41
add esp, 0x18
lea ecx, [ebp - 0x204]
jmp 0x10019395
push esi
lea ecx, [ebp - 0x12c]
call fcn.1001673e
push ebx
lea eax, [ebp - 0x208]
mov byte [ebp - 4], 9
push eax
push 0x1163
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x28], 0x9d0863e8
push eax
push 0xaac
call fcn.10019b1f
mov byte [ebp - 0x11], bl
add esp, 0x14
cmp byte [ebp - 0x11], 0
je 0x10019304
push ebx
call fcn.1001b8c2
pop ecx
mov eax, dword [ebp - 0xc4]
cmp dword [eax], ebx
jne 0x10019389
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
neg edx
push 8
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
pop eax
setle cl
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x12c]
setle dl
xor ecx, ecx
inc ecx
sub ecx, edx
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x20]
setle dl
mov dword [ebp - 0x28], edx
xor edx, edx
cmp dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc4]
setg dl
mov ecx, dword [eax]
mov eax, dword [ebp - 0x12c]
sub ecx, edx
xor edx, edx
cmp ecx, dword [eax + 4]
setl dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
neg eax
je 0x1001937d
cmp dword [ebp - 0x18], ebx
jne 0x10019389
cmp dword [ebp - 0xd8], ebx
jne 0x10019389
mov eax, ebx
jmp 0x1001938c
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x12c]
call fcn.100167c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.100167c0
xor eax, eax
lea ecx, [ebp - 0x50]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], 0xbd5de1fc
push eax
call fcn.1001673e
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x40], 0x1cc0c7fd
push esi
call fcn.1001673e
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x20], ebx
jmp 0x10019406
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x100193fa
mov dword [ebp - 0x20], ebx
jmp 0x10019424
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x174]
mov dword [eax + ecx*4], 2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10019411
cmp dword [ebp - 0x18], ebx
je 0x100194ce
cmp dword [ebp - 0x1c], ebx
je 0x100194bf
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x10]
test eax, eax
jne 0x10019450
mov eax, dword [ebp - 0x50]
cmp dword [eax], ebx
jne 0x10019450
mov edx, ebx
jmp 0x10019453
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
sub ecx, dword [eax]
xor eax, eax
cmp edx, ecx
setl al
neg eax
cmp eax, 0xf7d9
jg 0x10019474
cmp dword [ebp - 0x18], ebx
jne 0x10019474
mov edx, ebx
jmp 0x10019477
xor edx, edx
inc edx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ebx
jne 0x1001948c
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x50]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x28]
sete dl
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x100194b5
cmp dword [ebp - 0x18], ebx
je 0x100194b5
xor ecx, ecx
inc ecx
jmp 0x100194b7
mov ecx, ebx
mov eax, dword [ebp - 0x50]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
cmp dword [eax], ebx
je 0x100194ce
xor edx, edx
inc edx
jmp 0x100194d0
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ebx
jmp 0x100195ff
mov dword [ebp - 0x18], 0x6352
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x10], ebx
push 1
call fcn.1001673e
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x18], 0x2c2642a2
mov dword [ebp - 0x18], ebx
jmp 0x10019530
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x144]
mov dword [eax + ecx*4], 0xecbc59a6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1001951d
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x174]
neg ecx
sbb ecx, ecx
neg ecx
mov eax, dword [eax]
add eax, ecx
cmp eax, 0xfffffffb
jae 0x10019571
mov eax, dword [ebp - 0x50]
cmp dword [eax], ebx
je 0x10019571
xor ecx, ecx
inc ecx
jmp 0x10019573
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
imul eax, ecx
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x144]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x28]
setg dl
sub edx, eax
mov eax, dword [ebp - 0x2c]
neg edx
sbb edx, edx
add edx, 7
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x28], edx
xor edx, edx
cmp dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x50]
setge dl
xor ecx, ecx
cmp edx, dword [eax]
setne cl
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x144]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffffff6
lea ecx, [ebp - 0x144]
setne al
mov dword [ebp - 0x18], eax
call fcn.100167c0
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x100194e5
lea ecx, [ebp - 0x174]
call fcn.100167c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.100167c0
cmp dword [edi + 0x14], 0x10
jb 0x1001962a
mov ecx, dword [edi]
jmp 0x1001962c
mov ecx, edi
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x3c], ecx
jb 0x10019639
mov edx, dword [edi]
jmp 0x1001963b
mov edx, edi
mov eax, dword [edi + 0x10]
add eax, edx
cmp ecx, eax
je 0x10019904
push 4
lea ecx, [ebp - 0x15c]
call fcn.1001673e
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x10], ebx
jmp 0x10019672
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd4], 1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10019661
mov dword [ebp - 0x10], ebx
jmp 0x10019690
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x15c]
mov dword [eax + ecx*4], 0xe83c773
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1001967d
mov dword [ebp - 0x10], ebx
jmp 0x100196a9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7c], 0xe075257
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001969b
mov esi, dword [ebp - 0x15c]
mov dword [esi + 0xc], ebx
mov dword [ebp - 0x18], 0xad86e52d
lea ecx, [ebp - 0xfc]
push 3
call fcn.1001673e
mov dword [ebp - 0x18], ebx
jmp 0x100196e4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xfc]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100196d1
mov eax, dword [esi + 0xc]
cmp dword [ebp + eax*4 - 0xd4], ebx
jne 0x10019730
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x1001971a
mov ecx, dword [ebp - 0xfc]
mov eax, dword [esi + 0xc]
mov eax, dword [ebp + eax*4 - 0xd4]
mov dword [ecx + 8], eax
dec dword [ebp - 0x18]
jns 0x10019708
lea ecx, [ebp - 0xfc]
call fcn.100167c0
inc dword [esi + 0xc]
cmp dword [esi + 0xc], 2
jle 0x100196b8
jmp 0x1001973b
lea ecx, [ebp - 0xfc]
call fcn.100167c0
mov eax, dword [ebp - 0xd4]
xor edx, edx
mov eax, dword [ebp - 0x15c]
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0xd4]
cmp eax, 1
mov eax, dword [ebp - 0xd4]
setle dl
xor ecx, ecx
neg edx
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 0x74]
jge 0x100197a6
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x10019822
mov dword [ebp - 0x1c], 0x6728ad64
mov dword [ebp - 0x1c], ebx
jmp 0x10019799
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7c], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1001978f
dec dword [ebp - 0x18]
jns 0x10019783
jmp 0x10019822
mov dword [ebp - 0x18], 1
xor edx, edx
push 8
pop eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x74]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, 0x5f87
jne 0x100197e9
cmp dword [ebp - 0x28], ebx
jne 0x100197e9
mov eax, ebx
jmp 0x100197ec
xor eax, eax
inc eax
imul eax, eax, 0xa7fc
test eax, eax
jne 0x100197f9
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
xor ecx, ecx
test eax, eax
setns cl
mov dword [ebp - 0x74], ecx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10019822
push 0x2676
push ebx
push 0x5292
call fcn.1001c168
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15c]
call fcn.100167c0
mov eax, dword [ebp - 0x3c]
mov al, byte [eax]
cmp al, 0x30
jl 0x100198e8
cmp al, 0x39
jg 0x100198e8
mov dword [ebp - 0x38], 0xffffffff
lea ecx, [ebp - 0x18c]
push 3
call fcn.1001673e
mov dword [ebp - 4], 0xd
mov dword [ebp - 0xdc], 0xb3847d22
mov dword [ebp - 0x18], ebx
jmp 0x1001987f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10019870
mov dword [ebp - 0x38], ebx
jmp 0x100198af
push ebx
lea eax, [ebp - 0xdc]
mov dword [ebp - 0x68], ebx
push eax
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.1001ce5f
add esp, 0x14
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff8
jl 0x1001988a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18c]
call fcn.100167c0
push 0x1e40
push 0x33d2
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
call fcn.1001bbfc
mov ecx, dword [ebp - 0x3c]
add esp, 0x14
inc ecx
jmp 0x1001962c
push 0x2167
lea eax, [ebp - 0x44]
push eax
push 0x73e0
push ebx
call fcn.1001d0ad
add esp, 0x10
jmp 0x10018e7b
mov dword [ebp - 0x10], 0x4b811476
lea ecx, [ebp - 0x1bc]
push 3
call fcn.1001673e
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x24], 0x50d8
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], 0x732adaa2
mov dword [ebp - 0x18], ebx
jmp 0x10019948
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1bc]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10019935
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1bc]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
cmp dword [edx + 8], eax
mov eax, 0xdb2b058e
setg cl
cmp eax, ecx
mov eax, dword [ebp - 0x24]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setle dl
cmp edx, 0xfffffff8
jle 0x10019a30
mov dword [ebp - 0x1c], 0x674643a6
mov dword [ebp - 0x18], 0xdf2ffa36
mov dword [ebp - 0x10], ebx
jmp 0x10019a28
push 2
lea ecx, [ebp - 0x1a4]
call fcn.1001673e
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
jmp 0x100199e9
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1a4]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100199d6
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1a4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
lea ecx, [ebp - 0x1a4]
setl dl
mov dword [ebp - 0x20], edx
call fcn.100167c0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x2e
jne 0x100199c1
jmp 0x10019a40
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x40], 0x90ce61fa
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x1bc]
call fcn.100167c0
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret