Function at 0x10009ec2
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1006bc73
call fcn.1006b700
sub esp, 0x13c
push ebx
push esi
push edi
mov dword [ebp - 0x24], 0xec7e318b
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x2c], 0xdef9eed1
xor esi, esi
mov byte [ebp - 0x3d], dl
mov dword [ebp - 0x30], edi
inc esi
mov dword [ebp - 0x20], ebx
jmp 0x10009f03
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x50], 0xc75b57fd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10009ef5
mov dword [ebp - 0x50], 0x13
jmp 0x1000a0ff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x4c], 0x1b16
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], 0xfffffffd
mov dword [ebp - 0x20], ebx
jmp 0x10009f3f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x80], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10009f31
mov dword [ebp - 0x1c], ebx
jmp 0x1000a0f2
mov dword [ebp - 0x14], 0x25fa5fef
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x38], 0x8e0133d4
mov dword [ebp - 0x28], 0xfcbc842
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x1000a0a4
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 0x14]
cmp eax, 0xf29855ee
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
add ecx, 0x9481
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x80]
cmp eax, edx
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x80]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
mov eax, dword [ebp + eax*4 - 0x80]
add eax, edx
sub eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
neg eax
jne 0x10009fdd
mov eax, dword [ebp - 0x24]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10008ff0]
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x130]
mov dword [ebp - 0x38], 0xf5f
push eax
push ebx
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x94], ebx
movdqu xmmword [ebp - 0x130], xmm0
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
call fcn.1000c7e5
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x10], ebx
jmp 0x1000a03b
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x1000a02f
cmp dword [ebp - 0x10], ebx
je 0x1000a068
cmp dword [ebp - 0x24], ebx
jne 0x1000a068
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x94]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x80]
imul eax, ecx
lea ecx, [ebp - 0x94]
inc eax
sub eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
call fcn.1000bce3
dec dword [ebp - 0x14]
jns 0x10009f7f
mov dword [ebp - 0x20], ebx
jmp 0x1000a0e9
mov dword [ebp - 0x38], 0x77424270
xor ecx, ecx
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
cmp eax, 0xf96
setge cl
xor edx, edx
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x80]
cmp eax, edx
setle cl
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x1000a0a9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x10009f4d
dec dword [ebp - 0x50]
cmp dword [ebp - 0x50], 9
jne 0x10009f14
mov eax, dword [0x100725dc]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0xe7f13bcf
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x34], 0x28e48792
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x34], 0xffff
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], ebx
jmp 0x1000a146
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x68], 0x5540d7f8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1000a138
push 4
mov dword [ebp - 0x68], ebx
pop esi
jmp 0x1000a1c9
push esi
lea ecx, [ebp - 0xc0]
call fcn.1000bc61
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0xa3d58e56
mov dword [ebp - 0x10], ebx
jmp 0x1000a189
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000a176
mov dword [ebp - 0x10], ebx
jmp 0x1000a1a4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x144], 0xbe776e9f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1000a193
mov eax, dword [ebp - 0xc0]
lea ecx, [ebp - 0xc0]
or dword [ebp - 4], 0xffffffff
mov dword [eax + 0xc], 0xffffffee
call fcn.1000bce3
inc dword [ebp - 0x68]
cmp dword [ebp - 0x68], 0x15
jl 0x1000a154
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov esi, dword [ebp + 8]
setle dl
xor eax, eax
xor ecx, ecx
inc ecx
cmp edx, ecx
mov dword [esi], ebx
mov dword [esi + 4], ebx
setle al
mov dword [esi + 8], ebx
mov dword [ebp - 0x34], eax
mov eax, 0x5b0b56ce
mov dword [ebp - 0x1c], 0xac204e2d
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x24], 0x36a5b5cf
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0x17
mov dword [esi + 0xc], ebx
jge 0x1000a2af
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x1c], ecx
jl 0x1000a258
mov eax, ecx
cmp dword [ebp - 0x24], ebx
jne 0x1000a25a
mov eax, ebx
xor ecx, ecx
cmp eax, 0x66de6b93
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
mov dword [ebp - 0x104], edx
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setg cl
cmp ecx, dword [ebp - 0x34]
jle 0x1000a28c
cmp dword [ebp - 0x24], ebx
jne 0x1000a28c
mov eax, ebx
jmp 0x1000a28f
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
neg ecx
push 1
sbb ecx, ecx
neg ecx
add eax, ecx
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
pop ecx
jl 0x1000a249
dec dword [ebp - 0x3c]
cmp byte [ebp - 0x3d], 0
mov eax, dword [ebp - 0x38]
je 0x1000a2cd
cmp eax, ecx
jne 0x1000a2cd
mov dword [esi + 8], 4
mov dword [esi + 0xc], 0x100725dc
cmp edi, eax
jge 0x1000ab30
mov dword [ebp - 0x20], 0x622ba394
mov esi, 0x100725e0
mov dword [ebp - 0x20], ebx
jmp 0x1000a2f7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x9c], 0xffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000a2e6
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000a314
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x20], ebx
jmp 0x1000a32a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x9c], 0xffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000a319
test edi, edi
jle 0x1000a74c
jmp 0x1000a33c
xor ecx, ecx
inc ecx
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0x2c], eax
push 0xfffffffffffffff8
pop eax
mov edi, dword [esi]
mov dword [ebp - 0x1c], 0xca4f833f
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x10], ebx
jmp 0x1000a388
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x60], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000a37e
mov dword [ebp - 0x10], ebx
jmp 0x1000a39c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000a392
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000a3c8
push 0x5ad
push 0x55a
push 0x2641
push 0xc7d
push ebx
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jg 0x1000a50d
jmp 0x1000a3d9
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x120]
push 2
call fcn.1000bc61
xor edi, edi
lea ecx, [ebp - 0xa8]
inc edi
push edi
mov dword [ebp - 4], edi
call fcn.1000bc61
mov dword [ebp - 0x24], 0xeacb2d50
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x10], ebx
jmp 0x1000a424
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1000a415
xor edx, edx
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x1000a441
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xa8]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1000a432
mov dword [ebp - 0x10], ebx
jmp 0x1000a458
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1000a44b
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x60], ebx
je 0x1000a4c9
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ecx]
lea eax, [edx + 1]
mov dword [ecx], eax
test edx, edx
je 0x1000a4c9
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
cmp ecx, eax
setle dl
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], ebx
jne 0x1000a497
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0x24], 0x7c39c9d9
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax]
inc dword [ebp - 0x3c]
cmp ecx, eax
jge 0x1000a4c9
xor edi, edi
inc edi
mov edx, edi
jmp 0x1000a4ce
xor edi, edi
mov edx, ebx
inc edi
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp edx, eax
setne cl
cmp edi, ecx
lea ecx, [ebp - 0xa8]
sbb eax, eax
neg eax
mov dword [ebp - 0x134], eax
call fcn.1000bce3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.1000bce3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1000a3d6
mov edi, dword [ebp - 0x4c]
add esi, 4
mov dword [ebp - 0x20], esi
test edi, edi
jne 0x1000a51d
add esi, 8
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0xe0648261
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x4c], 2
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xb
jge 0x1000a704
mov dword [ebp - 0x28], 0x2d9e
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x14], ebx
jmp 0x1000a55f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000a552
xor ecx, ecx
mov dword [ebp - 0x14], ebx
inc ecx
jmp 0x1000a57a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x84], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000a56d
cmp dword [ebp - 0x28], ebx
jne 0x1000a587
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
imul ecx, eax
mov dword [ebp - 0xdc], ecx
mov eax, dword [ebp - 0x10]
imul eax, ecx
mov dword [ebp - 0x84], eax
test eax, eax
je 0x1000a6da
mov dword [ebp - 0x14], 0xdca2
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0xf
cmp dword [ebp - 0x10], 0x1d
jg 0x1000a6f4
xor esi, esi
inc esi
mov dword [ebp - 0x3c], 0x379a1d12
cmp dword [ebp - 0x14], ebx
je 0x1000a5ef
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000a6cb
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
jmp 0x1000a6cb
mov dword [ebp - 0x34], 0x3703acb6
mov dword [ebp - 0x24], 0x4f69a750
mov dword [ebp - 0x14], 0xfffffffb
jmp 0x1000a6c1
push 4
lea ecx, [ebp - 0xd8]
call fcn.1000bc61
mov dword [ebp - 0x28], ebx
jmp 0x1000a62e
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xd8]
mov dword [eax + ecx*4], 0xc72b752b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1000a61b
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0xd8]
xor eax, eax
cmp dword [edi + 0xc], esi
setle al
xor edx, edx
cmp dword [edi + 0xc], eax
mov eax, dword [ebp - 0xdc]
setle dl
sub edx, dword [edi + 0xc]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
test ecx, ecx
jle 0x1000a681
mov eax, ebx
cmp dword [edi + 0xc], ebx
je 0x1000a683
mov eax, esi
mov ecx, dword [ebp - 0x14]
xor edx, edx
imul ecx, eax
sub ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
sub ecx, 0xffff
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
test ecx, ecx
lea ecx, [ebp - 0xd8]
setns al
mov dword [ebp - 0xe0], eax
call fcn.1000bce3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x19
jne 0x1000a609
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1d
jle 0x1000a5cb
jmp 0x1000a6f4
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000a6f4
push ebx
push 0xaa6
push 0xa25
call dword [sym.imp.USER32.dll_GetScrollInfo]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xb
jl 0x1000a53f
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffff
jne 0x1000a710
mov eax, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x1c], 0x7326
inc eax
cmp dword [ebp - 0x10], eax
jne 0x1000a726
cmp dword [ebp - 0x1c], ebx
jne 0x1000a726
mov eax, ebx
xor edx, edx
cmp eax, 0x4f9f0102
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, edx
setl cl
add esi, dword [ebp - 0x2c]
dec dword [ebp - 0x30]
mov dword [ebp - 0x10], ecx
jne 0x1000a339
mov edi, dword [esi]
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x1c], 0xfffffffb
push 2
call fcn.1000bc61
xor edx, edx
inc edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], 0x4defc72f
push 6
mov dword [ebp - 0x30], 0xfffffffe
pop eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], ebx
jmp 0x1000a797
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xb4]
mov dword [eax + ecx*4], 0x932e3ca3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000a784
mov dword [ebp - 0x14], ebx
jmp 0x1000a7b0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x58], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000a7a2
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
je 0x1000a7c0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
imul ecx, edx, 0x3d47
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xb4]
setge dl
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xb4]
cmp dword [eax + 4], ebx
sete cl
xor edx, edx
cmp ecx, 0x6e1ee67b
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x58], ebx
je 0x1000a81e
xor eax, eax
inc eax
jmp 0x1000a820
mov eax, ebx
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0xb4]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
call fcn.1000bce3
mov eax, dword [esi + 4]
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x10], 0xffff
add esi, 8
mov dword [ebp - 0x28], 0x9ba07e4f
mov dword [ebp - 0x30], 0xca27289f
push 2
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], esi
call fcn.1000bc61
mov dword [ebp - 0x2c], 0x21a3
cmp dword [ebp - 0x2c], 0x737
jge 0x1000a8c2
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x98]
push eax
push 0x100076b4
call fcn.1005486b
mov ecx, dword [ebp - 0x98]
mov esi, dword [ebp - 0x54]
cmp ecx, esi
cmovl esi, ecx
lea eax, [esi + esi]
sub ecx, eax
add ecx, dword [ebp - 0x54]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
push eax
push esi
push 0x100076b4
call fcn.10054a60
mov esi, dword [ebp - 0x20]
add esp, 0x18
push 2
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x1000a8dd
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], 0x530c4e2b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000a8ca
mov dword [ebp - 0x14], ebx
jmp 0x1000a8f8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xfc], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000a8e7
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x34e6
jle 0x1000a916
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x10]
je 0x1000aa05
mov dword [ebp - 0x30], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x2c], 0x27a4ef21
inc ecx
mov dword [ebp - 0x14], ebx
jmp 0x1000a952
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x48], 0x12afd77c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000a944
mov dword [ebp - 0x14], ebx
jmp 0x1000a96d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x114], 0x5015e0c0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000a95c
dec dword [ebp - 0x48]
je 0x1000a9c7
cmp dword [ebp - 0xf4], ebx
jne 0x1000a986
mov edx, ebx
cmp dword [ebp - 0x28], ebx
je 0x1000a988
mov edx, ecx
mov eax, dword [ebp - 0xf4]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x48]
cmp edx, eax
setg cl
xor eax, eax
cmp eax, ecx
mov eax, dword [ebp - 0x48]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0xcc]
setne dl
mov dword [eax], edx
mov dword [ebp - 0x110], edx
cmp edx, 0xf7cd
jge 0x1000a9c7
xor eax, eax
inc eax
jmp 0x1000a9c9
mov eax, ebx
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
sub edx, eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xf8]
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
cmp ecx, 0x415e40c8
setl al
add eax, 0x64fef537
mov dword [ebp - 0x2c], eax
jmp 0x1000aa42
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000aa1f
push 0x1059
push 0x23d6
push ebx
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
mov dword [ebp - 0x10], ebx
jmp 0x1000aa3c
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000aa39
push ebx
push 0x639
call dword [sym.imp.USER32.dll_GetWindowRect]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x12
jle 0x1000aa24
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000aa57
push 0x7c6
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0xcc]
call fcn.1000bce3
cmp dword [ebp - 0x34], 0
jne 0x1000ab29
cmp byte [ebp - 0x3d], 0
je 0x1000aa83
xor eax, eax
inc eax
cmp dword [ebp - 0x38], eax
jne 0x1000aa83
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x10]
add dword [ecx + 8], eax
mov eax, dword [esi]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 4]
add esi, 8
push edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], esi
call fcn.1004edf1
pop ecx
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x74]
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], ebx
push eax
push edi
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
call fcn.1000bf84
mov esi, dword [ebp - 0x74]
mov ecx, ebx
test edi, edi
jle 0x1000ab0a
mov eax, ecx
and eax, 0x80000001
jns 0x1000aad4
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x2c]
add eax, ecx
add eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x34]
jmp 0x1000aae9
lea eax, [edx + 1]
cdq
idiv edi
cmp word [esi + edx*2], bx
jne 0x1000aae6
xor eax, eax
inc eax
mov word [esi + edx*2], ax
mov eax, dword [ebp - 0x20]
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x30]
mov byte [ecx + edx], al
inc ecx
cmp ecx, edi
jl 0x1000aac6
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov dword [ecx], edi
mov dword [ecx + 4], eax
test esi, esi
je 0x1000ab2e
push esi
call fcn.10054b31
pop ecx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov esi, dword [ebp + 8]
jmp 0x1000ab30
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x28], 0xb1c2
inc edi
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x30], 0xffffffff
push 3
call fcn.1000bc61
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x38], 0x49dcb7be
mov dword [ebp - 0x34], 0xd47e1325
mov dword [ebp + 8], ebx
jmp 0x1000ab7d
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xf0]
mov dword [eax + ecx*4], ebx
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x1000ab6e
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x3c], ebx
je 0x1000aba3
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
mov eax, dword [ebp - 0xf0]
setl cl
add ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x28]
jne 0x1000abd5
mov dword [ebp + 8], edi
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp + 8], eax
jmp 0x1000abdb
mov dword [ebp + 8], ebx
dec dword [ebp + 8]
lea ecx, [ebp - 0xf0]
call fcn.1000bce3
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret