Function at 0x1001783d
Capabilities:
Allocate thread local storage
Contain obfuscated stackstrings
Get session user name
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10076ee8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x11b8
call fcn.10070520
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
cmp dword [ebp + 0x10], 0
jbe 0x10017888
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10017888
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.10012965
pop ecx
pop ecx
jmp 0x1001fe0f
mov dword [ebp - 0x344], 0xfffffffc
mov dword [ebp - 0x344], 0xfffffff7
jmp 0x100178ab
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 7
jle 0x100178d2
mov byte [ebp - 0x107], 0
movzx eax, byte [ebp - 0x107]
test eax, eax
je 0x100178d0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
jmp 0x1001789e
mov byte [ebp - 0x17e], 0
movzx eax, byte [ebp - 0x17e]
test eax, eax
je 0x100178ef
push 0x1a54
call dword [sym.imp.USER32.dll_IsWindow]
cmp dword [ebp + 0x10], 0
jne 0x1001c882
mov dword [ebp - 0x88], 4
cmp dword [ebp - 0x88], 0
je 0x1001794f
mov byte [ebp - 0xf8], 0
movzx eax, byte [ebp - 0xf8]
test eax, eax
je 0x1001794a
push 0x4ae
push 0x1952
push 0x2107
push 0x2607
push 0x544
push 0
push 0
push 0
push 0
push 0x142e
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x10017a38
mov dword [ebp - 0x714], 0xf6fb
mov dword [ebp - 0xadc], 1
mov dword [ebp - 0x88], 0
jmp 0x1001797c
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xd
jl 0x10017a1e
mov dword [ebp - 0xa7c], 6
mov dword [ebp - 0x970], 0x77066959
cmp dword [ebp - 0x88], 0
jne 0x100179cf
mov eax, dword [ebp - 0xa7c]
mov dword [ebp - 0xf0c], eax
mov eax, dword [ebp - 0x714]
sub eax, dword [ebp - 0x714]
sub eax, dword [ebp - 0x88]
je 0x100179cf
and dword [ebp - 0x968], 0
jmp 0x100179d9
mov dword [ebp - 0x968], 1
mov eax, dword [ebp - 0x88]
imul eax, dword [ebp - 0x968]
mov dword [ebp - 0x970], eax
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x970]
je 0x10017a06
mov dword [ebp - 0x978], 1
jmp 0x10017a0d
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0xadc], eax
jmp 0x1001796f
mov byte [ebp - 0x16d], 0
movzx eax, byte [ebp - 0x16d]
test eax, eax
je 0x10017a38
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov byte [ebp - 0xfa], 0
movzx eax, byte [ebp - 0xfa]
test eax, eax
je 0x10017a56
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1000a92d
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x188], 5
mov dword [ebp - 0x374], 0
jmp 0x10017a8a
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 1
jge 0x10017aa6
mov eax, dword [ebp - 0x374]
mov dword [ebp + eax*4 - 0x10c], 0xffffffff
jmp 0x10017a7d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x10c], 0xfffffff8
jmp 0x10017ad4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x10c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10c], 0x11
jne 0x10017b5c
mov dword [ebp - 0x980], 0x65e3edfa
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
mov dword [ebp - 0xe54], eax
mov dword [ebp - 0x188], 0xfffffffd
cmp dword [ebp - 0x188], 0
jne 0x10017b2d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10c], 0
jne 0x10017b2d
and dword [ebp - 0xae4], 0
jmp 0x10017b37
mov dword [ebp - 0xae4], 1
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0xec4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
dec eax
mov dword [ebp - 0x980], eax
jmp 0x10017ab9
mov dword [ebp - 0x188], 0
jmp 0x10017b75
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xffffffea
jg 0x10017b9e
mov byte [ebp - 0x180], 0
movzx eax, byte [ebp - 0x180]
test eax, eax
je 0x10017b9c
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
jmp 0x10017b68
push 3
lea ecx, [ebp - 0xd68]
call fcn.100214a3
and dword [ebp - 4], 0
mov dword [ebp - 0x3cc], 3
mov dword [ebp - 0x284], 0
jmp 0x10017bd2
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 3
jge 0x10017bf4
push dword [ebp - 0x284]
lea ecx, [ebp - 0xd68]
call fcn.10021541
mov dword [eax], 0x77862fd4
jmp 0x10017bc5
mov dword [ebp - 0x3cc], 2
jmp 0x10017c0d
mov eax, dword [ebp - 0x3cc]
dec eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0
jl 0x10017dd3
mov dword [ebp - 0x1d8], 0xfffffff8
mov dword [ebp - 0x1d8], 0
jmp 0x10017c3d
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 2
jg 0x10017db2
mov dword [ebp - 0x28c], 1
mov dword [ebp - 0x28c], 0
jmp 0x10017c6d
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 2
jg 0x10017dad
push 2
lea ecx, [ebp - 0xb98]
call fcn.100214a3
mov byte [ebp - 4], 1
mov dword [ebp - 0x37c], 0
jmp 0x10017ca4
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 2
jge 0x10017cc6
push dword [ebp - 0x37c]
lea ecx, [ebp - 0xb98]
call fcn.10021541
mov dword [eax], 0xfffffff6
jmp 0x10017c97
push 1
lea ecx, [ebp - 0xb98]
call fcn.10021541
and dword [eax], 0
jmp 0x10017cfc
push 1
lea ecx, [ebp - 0xb98]
call fcn.10021541
mov dword [ebp - 0x988], eax
mov eax, dword [ebp - 0x988]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x988]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xb98]
call fcn.10021541
cmp dword [eax], 2
jg 0x10017d99
mov dword [ebp - 0x294], 0xffffffff
mov byte [ebp - 0xfc], 0
movzx eax, byte [ebp - 0xfc]
test eax, eax
je 0x10017d45
push 0x18fd
push 0
push 0x263d
push 0x20e8
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov dword [ebp - 0x294], 2
jmp 0x10017d5e
mov eax, dword [ebp - 0x294]
dec eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0
jl 0x10017d94
mov dword [ebp - 0xaec], 0x14ad38dc
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0xd68]
call fcn.10021541
mov dword [eax], 7
mov dword [ebp - 0xaec], 7
jmp 0x10017d51
jmp 0x10017cd8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb98]
call fcn.10021525
jmp 0x10017c60
jmp 0x10017c30
mov byte [ebp - 0x182], 0
movzx eax, byte [ebp - 0x182]
test eax, eax
je 0x10017dce
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
jmp 0x10017c00
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd68]
call fcn.10021525
cmp dword [0x1061f8fc], 0
jne 0x1001bf5a
push 2
lea ecx, [ebp - 0x488]
call fcn.100214a3
mov dword [ebp - 4], 2
mov dword [ebp - 0x190], 0x3a473eb9
mov dword [ebp - 0x990], 0xfffffffd
mov dword [ebp - 0x3ac], 0
jmp 0x10017e30
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 2
jge 0x10017e52
push dword [ebp - 0x3ac]
lea ecx, [ebp - 0x488]
call fcn.10021541
mov dword [eax], 0x834504cd
jmp 0x10017e23
mov byte [ebp - 0xfe], 0
movzx eax, byte [ebp - 0xfe]
test eax, eax
je 0x10017e6c
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x190], 0
jmp 0x10017e85
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
jg 0x10018023
mov dword [ebp - 0x34], 0xb659d568
mov byte [ebp - 0x179], 0
movzx eax, byte [ebp - 0x179]
test eax, eax
je 0x10017ebc
push 0
push 0x1a
push 0
push 0x799
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov dword [ebp - 0x34], 0
jmp 0x10017ecc
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jg 0x1001801e
mov dword [ebp - 0x1d4], 0x3f7bf48c
mov dword [ebp - 0x1d4], 1
jmp 0x10017ef9
mov eax, dword [ebp - 0x1d4]
dec eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jl 0x10018019
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x990], eax
mov esi, dword [ebp - 0x990]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x488]
call fcn.10021541
add esi, dword [eax]
je 0x10017f61
push 0
lea ecx, [ebp - 0x488]
call fcn.10021541
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x34]
cmp eax, 2
je 0x10017f4c
mov dword [ebp - 0x998], 1
jmp 0x10017f53
and dword [ebp - 0x998], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x488]
call fcn.10021541
mov eax, dword [ebp - 0x1d4]
cmp eax, dword [ebp - 0x190]
jle 0x10017f7b
mov dword [ebp - 0xb30], 1
jmp 0x10017f82
and dword [ebp - 0xb30], 0
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0xe64], eax
mov esi, dword [ebp - 0x34]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x488]
call fcn.10021541
cmp esi, dword [eax]
jle 0x10017faf
mov dword [ebp - 0x9a0], 1
jmp 0x10017fb6
and dword [ebp - 0x9a0], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x488]
call fcn.10021541
mov ecx, dword [ebp - 0x9a0]
cmp ecx, dword [eax]
jle 0x10017fda
mov dword [ebp - 0xb38], 1
jmp 0x10017fe1
and dword [ebp - 0xb38], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x488]
call fcn.10021541
push dword [ebp - 0x190]
lea ecx, [ebp - 0x488]
call fcn.10021541
mov esi, eax
push dword [ebp - 0x34]
lea ecx, [ebp - 0x488]
call fcn.10021541
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x10017eec
jmp 0x10017ec5
jmp 0x10017e78
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x488]
call fcn.10021525
mov dword [ebp - 0xb40], 0x8dd
lea eax, [ebp - 0xb40]
push eax
call fcn.10012913
pop ecx
mov dword [ebp - 0x92c], eax
mov dword [ebp - 0x29c], 0x1f7e2799
mov dword [ebp - 0xecc], 0xcf04b064
mov dword [ebp - 0xe74], 1
mov dword [ebp - 0xed4], 0
mov dword [ebp - 0xe84], 0xfffffff7
mov dword [ebp - 0xedc], 0xa1a1f050
mov dword [ebp - 0xfc8], 7
mov dword [ebp - 0xec8], 0xc1b0fe2c
mov dword [ebp - 0xf54], 0xb6046e74
mov dword [ebp - 0xed0], 0x9172ddb7
mov dword [ebp - 0xfa8], 0x83bbb66e
mov dword [ebp - 0xed8], 4
mov dword [ebp - 0xf5c], 0x4489b467
mov dword [ebp - 0xee0], 0x16de6eab
mov dword [ebp - 0xfc0], 0
mov dword [ebp - 0x29c], 0
jmp 0x100180fe
mov eax, dword [ebp - 0x29c]
dec eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xfffffffe
je 0x10018309
push 2
lea ecx, [ebp - 0xc88]
call fcn.100214a3
mov dword [ebp - 4], 3
mov dword [ebp - 0x1ec], 0xffffffff
mov dword [ebp - 0x9bc], 0x312b9482
mov dword [ebp - 0x384], 0
jmp 0x1001814c
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 2
jge 0x1001816e
push dword [ebp - 0x384]
lea ecx, [ebp - 0xc88]
call fcn.10021541
mov dword [eax], 0x72fd
jmp 0x1001813f
mov dword [ebp - 0x1ec], 0
jmp 0x10018187
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 1
jg 0x100182e8
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xd0], 0
jmp 0x100181b7
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jg 0x10018204
mov dword [ebp - 0x2a4], 0xffffffff
mov dword [ebp - 0x2a4], 0
jmp 0x100181e3
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 1
jg 0x10018202
mov dword [ebp - 0xb48], 0xfffffff8
mov dword [ebp - 0xb48], 0
jmp 0x100181d6
jmp 0x100181aa
mov dword [ebp - 0xd0], 0
jmp 0x1001821d
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jg 0x100182e3
mov dword [ebp - 0x20c], 0xffffffff
mov dword [ebp - 0x20c], 1
jmp 0x1001824d
mov eax, dword [ebp - 0x20c]
dec eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jl 0x100182de
mov dword [ebp - 0x3c4], 0x104272ba
push dword [ebp - 0x20c]
lea ecx, [ebp - 0xc88]
call fcn.10021541
mov esi, eax
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0xc88]
call fcn.10021541
mov eax, dword [eax]
mov dword [esi], eax
mov dword [ebp - 0x3c4], 0
jmp 0x100182a5
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 1
jg 0x100182d9
mov byte [ebp - 0x100], 0
movzx eax, byte [ebp - 0x100]
test eax, eax
je 0x100182d7
push 0x18fd
push 0
push 0x263d
push 0x20e8
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
jmp 0x10018298
jmp 0x10018240
jmp 0x10018210
jmp 0x1001817a
mov eax, dword [ebp - 0x9bc]
dec eax
mov dword [ebp - 0x9bc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc88]
call fcn.10021525
jmp 0x100180f1
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x1d0], 0x673e7ed6
mov dword [ebp - 0x2ac], 0
jmp 0x10018333
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 1
jge 0x1001834f
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0x2b4], 0xff55
jmp 0x10018326
mov dword [ebp - 0x3c], 0xfffffff2
jmp 0x1001835f
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffffc
jge 0x1001837c
mov dword [ebp - 0xb50], 6
cmp dword [ebp - 0xb50], 0
je 0x1001837a
jmp 0x1001837c
jmp 0x10018358
mov dword [ebp - 0x3c], 0
jmp 0x1001838c
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x10018503
mov dword [ebp - 0xb58], 0x6df7
mov dword [ebp - 0xb60], 0xffffffff
mov dword [ebp - 0x38c], 0
jmp 0x100183c3
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 2
jge 0x100183df
mov eax, dword [ebp - 0x38c]
mov dword [ebp + eax*4 - 0xaf8], 0
jmp 0x100183b6
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ebp + ecx*4 - 0x2b4]
cmp ecx, dword [ebp + eax*4 - 0x2b4]
jle 0x10018401
mov dword [ebp - 0x8b8], 1
jmp 0x10018408
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x2b4], 0
je 0x1001843f
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0xeec], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xaf8]
cmp eax, dword [ebp - 0x3c]
jne 0x1001843f
mov dword [ebp - 0x544], 1
jmp 0x10018446
and dword [ebp - 0x544], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xaf8]
cmp dword [ebp - 0x544], eax
jle 0x10018467
mov dword [ebp - 0x4a4], 1
jmp 0x1001846e
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x1d0], eax
imul eax, dword [ebp - 0x4a4], 0xb922
cmp dword [ebp - 0x1d0], eax
jne 0x10018498
mov dword [ebp - 0x8c0], 1
jmp 0x1001849f
and dword [ebp - 0x8c0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x8c0]
sub edx, dword [ebp + ecx*4 - 0x2b4]
add edx, dword [ebp + eax - 0xaf8]
mov dword [ebp - 0xb60], edx
mov dword [ebp - 0x1d0], 0xffffffef
jmp 0x100184db
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0xfffffff5
jl 0x100184fe
mov byte [ebp - 0x171], 0
movzx eax, byte [ebp - 0x171]
test eax, eax
je 0x100184fc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x100184ce
jmp 0x10018385
mov byte [ebp - 0x274], 8
mov byte [ebp - 0x273], 0xd6
mov byte [ebp - 0x272], 0xa
mov byte [ebp - 0x271], 0x2a
mov byte [ebp - 0x270], 7
mov byte [ebp - 0x26f], 0x2c
mov byte [ebp - 0x26e], 3
mov byte [ebp - 0x26d], 0x3f
mov byte [ebp - 0x26c], 0xb
mov byte [ebp - 0x26b], 0x2e
mov byte [ebp - 0x26a], 1
mov byte [ebp - 0x269], 0x1d
mov byte [ebp - 0x268], 0xc
mov byte [ebp - 0x267], 0x32
mov byte [ebp - 0x266], 0
mov byte [ebp - 0x265], 0x10
mov byte [ebp - 0x264], 2
mov byte [ebp - 0x263], 0x33
mov byte [ebp - 0x262], 6
mov byte [ebp - 0x261], 7
mov byte [ebp - 0x260], 9
mov byte [ebp - 0x25f], 0x1d
mov byte [ebp - 0x25e], 4
mov byte [ebp - 0x25d], 0xb
mov byte [ebp - 0x25c], 5
mov byte [ebp - 0x25b], 0x17
mov dword [ebp - 0x4ac], 0x67ce
mov dword [ebp - 0xb68], 0x10007994
cmp dword [ebp - 0x4ac], 0x680c
jle 0x100186c4
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
and dword [ebp - 0x2c4], 0
jmp 0x100185fb
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0x3aac
jge 0x100186c4
and dword [ebp - 0x340], 0
jmp 0x10018621
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0x25dc
jge 0x100186bf
and dword [ebp - 0x2bc], 0
jmp 0x10018647
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0x3f5
jge 0x100186ba
and dword [ebp - 0x348], 0
jmp 0x10018669
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0x2d60
jge 0x100186b8
mov eax, dword [ebp - 0x340]
cdq
idiv dword [ebp - 0x2bc]
imul edx, dword [ebp - 0x348]
mov eax, dword [ebp - 0x2c4]
mov ecx, edx
sar eax, cl
cdq
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xb00], edx
push dword [ebp - 0xb00]
push dword [ebp - 0xb04]
mov ecx, 0x1061e7b8
call fcn.10021267
jmp 0x1001865c
jmp 0x1001863a
jmp 0x10018614
jmp 0x100185ee
mov dword [ebp - 4], 4
cmp dword [ebp - 0x4ac], 0x6632
jge 0x100186e7
mov edx, dword [ebp - 0xb68]
mov ecx, 0x1061e7b8
call fcn.100255e3
jmp 0x10018703
or dword [ebp - 4], 0xffffffff
jmp 0x1001870d
mov dword [ebp - 0xf0], 5
mov dword [ebp - 0xb78], 0x326874be
mov dword [ebp - 0xf0], 0x14
jmp 0x1001873a
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xffffffe4
jl 0x10018966
mov dword [ebp - 0xb70], 0x65969a22
mov dword [ebp - 0xb80], 0x876a47cd
mov dword [ebp - 0x350], 0
jmp 0x10018774
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 2
jge 0x10018790
mov eax, dword [ebp - 0x350]
mov dword [ebp + eax*4 - 0x44c], 0x3fa
jmp 0x10018767
cmp dword [ebp - 0xf0], 0
je 0x1001892f
mov dword [ebp - 0x114], 9
push 1
lea ecx, [ebp - 0xd50]
call fcn.100214a3
mov dword [ebp - 4], 6
mov dword [ebp - 0x2cc], 0
jmp 0x100187d4
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 1
jge 0x100187f6
push dword [ebp - 0x2cc]
lea ecx, [ebp - 0xd50]
call fcn.10021541
mov dword [eax], 1
jmp 0x100187c7
mov dword [ebp - 0x114], 1
jmp 0x1001880f
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jl 0x1001891e
mov dword [ebp - 0x8c8], 7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44c]
mov dword [ebp - 0x8c8], eax
mov eax, dword [ebp - 0x8c8]
cmp eax, dword [ebp - 0xf0]
jle 0x10018853
mov dword [ebp - 0x4b4], 1
jmp 0x1001885a
and dword [ebp - 0x4b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44c]
sub eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x4b4], eax
jl 0x10018881
mov dword [ebp - 0x8d0], 1
jmp 0x10018888
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x8d0]
sub ecx, dword [ebp - 0xb70]
cmp ecx, dword [ebp + eax*4 - 0x44c]
jge 0x100188af
mov dword [ebp - 0x4bc], 1
jmp 0x100188b6
and dword [ebp - 0x4bc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x44c]
add eax, dword [ebp - 0x4bc]
mov ecx, dword [ebp - 0x114]
cmp dword [ebp + ecx*4 - 0x44c], eax
jl 0x100188e4
mov dword [ebp - 0x8d8], 1
jmp 0x100188eb
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp + eax*4 - 0x44c]
add eax, dword [ebp - 0x8d8]
mov dword [ebp - 0xb78], eax
mov esi, dword [ebp - 0xf0]
push 0
lea ecx, [ebp - 0xd50]
call fcn.10021541
mov dword [eax], esi
jmp 0x10018802
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd50]
call fcn.10021525
jmp 0x10018961
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x44c], 0x467356a0
jle 0x1001894e
mov dword [ebp - 0x4c4], 1
jmp 0x10018955
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0xb80], eax
jmp 0x1001872d
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x274]
and eax, 0xb9
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x274]
or ecx, 0xb9
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x274]
mov byte [ebp + eax - 0xc5c], cl
mov dword [ebp - 0x198], 5
mov dword [ebp - 0x358], 0
jmp 0x100189c7
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 1
jge 0x100189e3
mov eax, dword [ebp - 0x358]
mov dword [ebp + eax*4 - 0x124], 0xffffffff
jmp 0x100189ba
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x124], 0xfffffff8
jmp 0x10018a11
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x124]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x124], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x124], 0x11
jne 0x10018c4e
mov dword [ebp - 0x8e0], 0x65e3edfa
mov dword [ebp - 0xb88], 0x154d
cmp dword [ebp - 0xb88], 0xd58
jge 0x10018be0
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x1f4]
push eax
lea eax, [ebp - 0x22c]
push eax
mov ecx, 0x1061e870
call fcn.10020e49
mov ecx, eax
call fcn.10020e49
mov ecx, eax
call fcn.10020e49
push dword [ebp - 0x360]
lea ecx, [ebp - 0xa38]
call fcn.100214a3
mov dword [ebp - 4], 7
and dword [ebp - 0x2d4], 0
jmp 0x10018aa4
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2d4]
cmp eax, dword [ebp - 0x360]
jge 0x10018ad0
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0xa38]
call fcn.10021541
push eax
mov ecx, 0x1061e870
call fcn.10020e49
jmp 0x10018a97
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x214], eax
and dword [ebp - 0x11c], 0
jmp 0x10018af2
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x360]
jge 0x10018bb5
mov eax, dword [ebp - 0x22c]
cmp eax, dword [ebp - 0x1f4]
jl 0x10018b5b
push dword [ebp - 0x11c]
lea ecx, [ebp - 0xa38]
call fcn.10021541
mov ecx, dword [ebp - 0x22c]
cmp ecx, dword [eax]
jl 0x10018b5b
mov eax, dword [ebp - 0x214]
dec eax
mov dword [ebp - 0x214], eax
push dword [ebp - 0x11c]
lea ecx, [ebp - 0xa38]
call fcn.10021541
mov ecx, dword [ebp - 0x22c]
sub ecx, dword [eax]
mov dword [ebp - 0x22c], ecx
jmp 0x10018bb0
mov eax, dword [ebp - 0x1f4]
cmp eax, dword [ebp - 0x22c]
jl 0x10018bb0
push dword [ebp - 0x11c]
lea ecx, [ebp - 0xa38]
call fcn.10021541
mov ecx, dword [ebp - 0x1f4]
cmp ecx, dword [eax]
jl 0x10018bb0
mov eax, dword [ebp - 0x214]
dec eax
mov dword [ebp - 0x214], eax
push dword [ebp - 0x11c]
lea ecx, [ebp - 0xa38]
call fcn.10021541
mov ecx, dword [ebp - 0x1f4]
sub ecx, dword [eax]
mov dword [ebp - 0x1f4], ecx
jmp 0x10018ae5
push 0x1002590f
push dword [ebp - 0x214]
mov ecx, 0x1061e7b8
call fcn.10021043
mov ecx, eax
call fcn.10021037
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa38]
call fcn.10021525
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x124]
mov dword [ebp - 0xf10], eax
mov dword [ebp - 0x198], 0xfffffffd
cmp dword [ebp - 0x198], 0
jne 0x10018c1f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x124], 0
jne 0x10018c1f
and dword [ebp - 0xc64], 0
jmp 0x10018c29
mov dword [ebp - 0xc64], 1
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0xefc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x124]
dec eax
mov dword [ebp - 0x8e0], eax
jmp 0x100189f6
mov dword [ebp - 0x198], 0
jmp 0x10018c67
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0xffffffea
jg 0x10018c90
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x10018c8e
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
jmp 0x10018c5a
mov dword [ebp - 0xd8], 2
and dword [ebp - 0x4cc], 0
jmp 0x10018cb1
mov eax, dword [ebp - 0xd8]
inc eax
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x1a
jae 0x10018d2e
mov eax, dword [ebp - 0xd8]
sub eax, dword [ebp - 0x4cc]
movzx eax, byte [ebp + eax - 0x276]
movsx eax, byte [ebp + eax - 0xc5c]
mov ecx, dword [ebp - 0xd8]
movzx ecx, byte [ebp + ecx - 0x273]
and ecx, eax
mov eax, dword [ebp - 0xd8]
sub eax, dword [ebp - 0x4cc]
movzx eax, byte [ebp + eax - 0x276]
movsx eax, byte [ebp + eax - 0xc5c]
mov edx, dword [ebp - 0xd8]
movzx edx, byte [ebp + edx - 0x273]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0xd8]
movzx eax, byte [ebp + eax - 0x274]
mov byte [ebp + eax - 0xc5c], dl
jmp 0x10018ca3
mov dword [ebp - 0x18], 0x571177e8
mov dword [ebp - 0x45c], 0x92b58efe
mov dword [ebp - 0x930], 0xa04a8f9
mov dword [ebp - 0x18], 0xffffffeb
jmp 0x10018d59
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffed
jg 0x10018d80
mov byte [ebp - 0x181], 0
movzx eax, byte [ebp - 0x181]
test eax, eax
je 0x10018d7e
push 0
push 0xdd9
call dword [sym.imp.USER32.dll_SetMenu]
jmp 0x10018d52
mov dword [ebp - 0x18], 0
jmp 0x10018d90
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff6
je 0x100191e4
push 4
lea ecx, [ebp - 0xba8]
call fcn.100214a3
mov dword [ebp - 4], 8
mov dword [ebp - 0x1a0], 0xffffffff
mov dword [ebp - 0x1b8], 0x2a96950a
mov dword [ebp - 0x2dc], 0
jmp 0x10018ddb
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 4
jge 0x10018dfd
push dword [ebp - 0x2dc]
lea ecx, [ebp - 0xba8]
call fcn.10021541
mov dword [eax], 0xb792
jmp 0x10018dce
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x18]
push 3
lea ecx, [ebp - 0xba8]
call fcn.10021541
imul edi, dword [eax]
cmp edi, esi
jne 0x10018e23
mov dword [ebp - 0x8e8], 1
jmp 0x10018e2a
and dword [ebp - 0x8e8], 0
mov dword [ebp - 0x1a0], 8
mov eax, dword [ebp - 0x1a0]
cmp eax, dword [ebp - 0x8e8]
jg 0x10018e4e
mov dword [ebp - 0x4d4], 1
jmp 0x10018e55
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x1b8], eax
push 1
lea ecx, [ebp - 0xba8]
call fcn.10021541
cmp dword [eax], 0x796840e
jle 0x10018e82
mov dword [ebp - 0x8f0], 1
jmp 0x10018e89
and dword [ebp - 0x8f0], 0
mov esi, dword [ebp - 0x18]
push 3
lea ecx, [ebp - 0xba8]
call fcn.10021541
mov eax, dword [eax]
add eax, dword [ebp - 0x8f0]
neg eax
add eax, esi
je 0x100191c6
mov dword [ebp - 0x224], 0x4286a4
mov dword [ebp - 0x3ec], 0xffffffff
mov dword [ebp - 0x50c], 0xfffffff8
mov dword [ebp - 0xc7c], 2
mov dword [ebp - 0x1b8], 0xd
jmp 0x10018eec
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xc
jge 0x1001910c
mov dword [ebp - 0x1fc], 1
mov dword [ebp - 0x908], 0x2a60d4e0
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0xf18], eax
cmp dword [ebp - 0x1a0], 0
jne 0x10018f29
cmp dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x1b8]
add eax, dword [ebp - 0x224]
je 0x10018f49
cmp dword [ebp - 0x18], 0
je 0x10018f49
mov dword [ebp - 0x4dc], 1
jmp 0x10018f50
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x4dc]
neg eax
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffa
cmp ecx, eax
jl 0x10018f74
mov dword [ebp - 0xc6c], 1
jmp 0x10018f7b
and dword [ebp - 0xc6c], 0
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0xdc4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xdc8], eax
mov eax, dword [ebp - 0x1fc]
sub eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x18]
je 0x10018fad
mov dword [ebp - 0x8f8], 1
jmp 0x10018fb4
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x8f8]
jl 0x10018fcb
mov dword [ebp - 0x4e4], 1
jmp 0x10018fd2
and dword [ebp - 0x4e4], 0
cmp dword [ebp - 0x4e4], 1
jl 0x10018fe7
mov dword [ebp - 0x900], 1
jmp 0x10018fee
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x18], 0
je 0x10019043
cmp dword [ebp - 0x1fc], 0x8a43
je 0x10019018
mov dword [ebp - 0xc74], 1
jmp 0x1001901f
and dword [ebp - 0xc74], 0
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0xdd0], eax
cmp dword [ebp - 0x1fc], 0xf39ab1b5
ja 0x10019043
mov dword [ebp - 0x4ec], 1
jmp 0x1001904a
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x908], eax
imul eax, dword [ebp - 0x4ec], 0x84f7
cmp dword [ebp - 0x908], eax
jge 0x10019071
mov dword [ebp - 0x4f4], 1
jmp 0x10019078
and dword [ebp - 0x4f4], 0
imul eax, dword [ebp - 0x4f4], 0xc99f
cmp eax, dword [ebp - 0x1a0]
jge 0x10019096
mov dword [ebp - 0x910], 1
jmp 0x1001909d
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x224]
cmp dword [ebp - 0x910], eax
jge 0x100190b7
mov dword [ebp - 0x4fc], 1
jmp 0x100190be
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x3ec]
cmp dword [ebp - 0x4fc], eax
jl 0x100190d8
mov dword [ebp - 0x918], 1
jmp 0x100190df
and dword [ebp - 0x918], 0
cmp dword [ebp - 0x918], 0xfffffffc
jle 0x100190f4
mov dword [ebp - 0x504], 1
jmp 0x100190fb
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x50c], eax
jmp 0x10018edf
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jle 0x10019120
mov dword [ebp - 0x920], 1
jmp 0x10019127
and dword [ebp - 0x920], 0
mov dword [ebp - 0x45c], 0xe4e4
mov eax, dword [ebp - 0x45c]
cmp dword [ebp - 0x920], eax
jl 0x10019163
xor eax, eax
inc eax
sub eax, dword [ebp - 0x50c]
cmp eax, dword [ebp - 0xc7c]
jl 0x1001915c
mov dword [ebp - 0x928], 1
jmp 0x10019163
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x1a0]
sub eax, dword [ebp - 0x18]
cmp eax, 0xfffffffe
jne 0x1001917d
mov dword [ebp - 0x514], 1
jmp 0x10019184
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x514]
neg eax
mov dword [ebp - 0x930], eax
mov eax, dword [ebp - 0x930]
add eax, 0x1fb86638
cmp eax, dword [ebp - 0x3ec]
je 0x100191b1
mov dword [ebp - 0x51c], 1
jmp 0x100191b8
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x1a0], eax
jmp 0x100191d0
mov dword [ebp - 0x45c], 0x6c15a2d1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xba8]
call fcn.10021525
jmp 0x10018d89
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xc5c], 0
lea eax, [ebp - 0xc5c]
push eax
lea ecx, [ebp - 0x111c]
call fcn.10021410
mov dword [ebp - 0xbf4], eax
mov eax, dword [ebp - 0xbf4]
mov dword [ebp - 0xc18], eax
mov dword [ebp - 4], 9
mov edx, dword [ebp - 0x92c]
mov ecx, dword [ebp - 0xc18]
call fcn.1000a92d
mov dword [0x1061f8fc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x111c]
call fcn.10021433
and dword [ebp - 0x368], 0
jmp 0x10019258
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0xe
jae 0x10019271
mov eax, dword [ebp - 0x368]
mov byte [ebp + eax - 0xc5c], 0
jmp 0x1001924b
push 3
lea ecx, [ebp - 0x46c]
call fcn.100214a3
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x44], 0
push 1
lea ecx, [ebp - 0xcb8]
call fcn.100214a3
mov byte [ebp - 4], 0xb
mov dword [ebp - 0xa8], 0
jmp 0x100192b6
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x100192d8
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x46c]
call fcn.10021541
mov dword [eax], 1
jmp 0x100192a9
mov dword [ebp - 0xa8], 0
jmp 0x100192f1
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
jge 0x10019313
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xcb8]
call fcn.10021541
mov dword [eax], 0xd9ba5f27
jmp 0x100192e4
mov dword [ebp - 0x960], 0x2199
mov dword [ebp - 0xbbc], 0x100079fc
cmp dword [ebp - 0x960], 0x2534
jle 0x10019426
push 0x1151
push 0x15af
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
and dword [ebp - 0x2e4], 0
jmp 0x1001935f
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0xc7e
jge 0x1001941e
and dword [ebp - 0x370], 0
jmp 0x10019385
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0x5fc7
jge 0x10019419
and dword [ebp - 0x2ec], 0
jmp 0x100193ab
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0x2b6e
jge 0x10019414
mov eax, dword [ebp - 0x2e4]
sub eax, dword [ebp - 0x370]
add eax, dword [ebp - 0x2ec]
cdq
mov dword [ebp - 0xb10], eax
mov dword [ebp - 0xb0c], edx
push dword [ebp - 0xb0c]
push dword [ebp - 0xb10]
lea ecx, [ebp - 0x1194]
call fcn.1000a883
pop ecx
pop ecx
mov dword [ebp - 0xad4], eax
mov ecx, dword [ebp - 0xad4]
call fcn.10020d7c
push eax
call fcn.1005fa61
pop ecx
lea ecx, [ebp - 0x1194]
call fcn.10020d4d
jmp 0x1001939e
jmp 0x10019378
jmp 0x10019352
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x44], 0
jmp 0x10019436
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jg 0x10019869
mov dword [ebp - 0x60], 4
mov dword [ebp - 0x40], 0xffffffff
push 4
lea ecx, [ebp - 0xd5c]
call fcn.100214a3
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xa98], 0xf6dae1d
mov dword [ebp - 0x74], 0
jmp 0x10019479
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1001948f
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xff4], 9
jmp 0x10019472
mov dword [ebp - 0x74], 0
jmp 0x1001949f
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x100194bb
push dword [ebp - 0x74]
lea ecx, [ebp - 0xd5c]
call fcn.10021541
mov dword [eax], 1
jmp 0x10019498
mov byte [ebp - 0x16f], 0
movzx eax, byte [ebp - 0x16f]
test eax, eax
je 0x100194dd
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [ebp - 0x60], 0
jmp 0x100194ed
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jg 0x10019821
mov dword [ebp - 0xd9c], 0xb4d258d0
mov dword [ebp - 0xd98], 0xb4d258d0
mov dword [ebp - 0xd94], 0xb4d258d0
mov dword [ebp - 0xd90], 0xb4d258d0
mov dword [ebp - 0x378], 0
jmp 0x10019538
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 4
jge 0x10019554
mov eax, dword [ebp - 0x378]
mov dword [ebp + eax*4 - 0x10ec], 1
jmp 0x1001952b
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x60]
je 0x10019568
mov dword [ebp - 0xa88], 1
jmp 0x1001956f
and dword [ebp - 0xa88], 0
push dword [ebp - 0x60]
lea ecx, [ebp - 0x46c]
call fcn.10021541
cmp dword [eax], 1
jl 0x1001958e
mov dword [ebp - 0xbac], 1
jmp 0x10019595
and dword [ebp - 0xbac], 0
push dword [ebp - 0x60]
lea ecx, [ebp - 0x46c]
call fcn.10021541
mov esi, dword [ebp - 0x44]
push 1
lea ecx, [ebp - 0x46c]
call fcn.10021541
imul esi, dword [eax]
push dword [ebp - 0x60]
lea ecx, [ebp - 0x46c]
call fcn.10021541
cmp esi, dword [eax]
jge 0x100195d4
mov dword [ebp - 0x938], 1
jmp 0x100195db
and dword [ebp - 0x938], 0
cmp dword [ebp - 0x938], 0x1c587c7a
jg 0x100195f3
mov dword [ebp - 0x524], 1
jmp 0x100195fa
and dword [ebp - 0x524], 0
mov esi, dword [ebp - 0x60]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x46c]
call fcn.10021541
mov edi, dword [eax]
imul edi, dword [ebp - 0x524]
push 0
lea ecx, [ebp - 0xcb8]
call fcn.10021541
imul edi, dword [eax]
sub edi, esi
jne 0x10019649
push dword [ebp - 0x44]
lea ecx, [ebp - 0x46c]
call fcn.10021541
cmp dword [eax], 0
jne 0x10019649
xor eax, eax
inc eax
jne 0x10019649
and dword [ebp - 0x940], 0
jmp 0x10019653
mov dword [ebp - 0x940], 1
mov eax, dword [ebp - 0x940]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0
jmp 0x1001966c
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jg 0x1001981c
mov byte [ebp - 0x177], 0
movzx eax, byte [ebp - 0x177]
test eax, eax
je 0x10019694
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd9c], 0x6082f4e5
mov esi, dword [ebp - 0x40]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x46c]
call fcn.10021541
mov eax, dword [eax]
sub eax, esi
cmp eax, 0x6082f4e5
jle 0x100196cd
mov dword [ebp - 0x52c], 1
jmp 0x100196d4
and dword [ebp - 0x52c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x10ec]
cmp dword [ebp - 0x52c], eax
je 0x100196f5
mov dword [ebp - 0xa90], 1
jmp 0x100196fc
and dword [ebp - 0xa90], 0
push 4
pop eax
shl eax, 0
lea eax, [ebp + eax - 0xff4]
mov dword [ebp - 0x948], eax
push 0
lea ecx, [ebp - 0xcb8]
call fcn.10021541
mov ecx, dword [ebp - 0x948]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x948]
cmp dword [ecx], eax
jg 0x1001973f
mov dword [ebp - 0x534], 1
jmp 0x10019746
and dword [ebp - 0x534], 0
cmp dword [ebp - 0x534], 0xfffffff6
jbe 0x1001975b
mov dword [ebp - 0x950], 1
jmp 0x10019762
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x950], eax
jg 0x10019789
push dword [ebp - 0x44]
lea ecx, [ebp - 0x46c]
call fcn.10021541
cmp dword [eax], 0
jne 0x10019789
and dword [ebp - 0x53c], 0
jmp 0x10019793
mov dword [ebp - 0x53c], 1
cmp dword [ebp - 0x53c], 1
jl 0x100197a8
mov dword [ebp - 0xc20], 1
jmp 0x100197af
and dword [ebp - 0xc20], 0
mov esi, dword [ebp - 0x40]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x46c]
call fcn.10021541
cmp dword [eax], esi
jl 0x100197d0
mov dword [ebp - 0x958], 1
jmp 0x100197d7
and dword [ebp - 0x958], 0
cmp dword [ebp - 0x958], 0xe96f77d9
jbe 0x100197ef
mov dword [ebp - 0x478], 1
jmp 0x100197f6
and dword [ebp - 0x478], 0
push 1
lea ecx, [ebp - 0xd5c]
call fcn.10021541
mov ecx, dword [ebp - 0x478]
mov dword [eax], ecx
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0xa98], eax
jmp 0x10019665
jmp 0x100194e6
mov dword [ebp - 0x40], 2
jmp 0x10019831
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x10019855
mov byte [ebp - 0x104], 0
movzx eax, byte [ebp - 0x104]
test eax, eax
je 0x10019853
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
jmp 0x1001982a
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xd5c]
call fcn.10021525
jmp 0x1001942f
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x960], 0x1e9e
jge 0x10019885
push dword [ebp - 0xbbc]
call fcn.1005fa61
pop ecx
jmp 0x100198a1
mov dword [ebp - 4], 0xb
jmp 0x100198b1
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xcb8]
call fcn.10021525
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x46c]
call fcn.10021525
mov byte [ebp - 0x250], 0xc
mov byte [ebp - 0x24f], 0x86
mov byte [ebp - 0x24e], 6
mov byte [ebp - 0x24d], 0x23
mov byte [ebp - 0x24c], 4
mov byte [ebp - 0x24b], 0x24
mov byte [ebp - 0x24a], 0xb
mov byte [ebp - 0x249], 7
mov byte [ebp - 0x248], 3
mov byte [ebp - 0x247], 0x12
mov byte [ebp - 0x246], 7
mov byte [ebp - 0x245], 0x13
mov byte [ebp - 0x244], 0
mov byte [ebp - 0x243], 0x31
mov byte [ebp - 0x242], 0xd
mov byte [ebp - 0x241], 0x14
mov byte [ebp - 0x240], 9
mov byte [ebp - 0x23f], 0x34
mov byte [ebp - 0x23e], 8
mov byte [ebp - 0x23d], 0xc
mov byte [ebp - 0x23c], 1
mov byte [ebp - 0x23b], 0x1d
mov byte [ebp - 0x23a], 5
mov byte [ebp - 0x239], 0x17
mov byte [ebp - 0x238], 2
mov byte [ebp - 0x237], 0
mov byte [ebp - 0x236], 2
mov byte [ebp - 0x235], 0x70
mov byte [ebp - 0x234], 0xf2
mov byte [ebp - 0x233], 0xa
mov byte [ebp - 0x232], 0
mov dword [ebp - 0xdd8], 1
mov dword [ebp - 0xde0], 0xcdbe8e56
mov dword [ebp - 0xde8], 1
mov dword [ebp - 0xdf0], 0x6210b999
mov dword [ebp - 0xdf8], 0xffffffff
mov dword [ebp - 0xe00], 8
mov dword [ebp - 0xe08], 0xffffffff
push 1
lea ecx, [ebp - 0xe60]
call fcn.100214a3
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x7a4], 2
mov dword [ebp - 0x90], 0
jmp 0x10019a25
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x10019a41
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0xe10], 0xcb63e8e1
jmp 0x10019a18
mov dword [ebp - 0x90], 0
jmp 0x10019a5a
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x10019a7c
push dword [ebp - 0x90]
lea ecx, [ebp - 0xe60]
call fcn.10021541
mov dword [eax], 0xfffffffd
jmp 0x10019a4d
mov eax, dword [ebp - 0x7a4]
inc eax
mov dword [ebp - 0x7a4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe60]
call fcn.10021525
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x250]
and eax, 0xf5
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x250]
or ecx, 0xf5
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x250]
mov byte [ebp + eax - 0xa78], cl
push 3
lea ecx, [ebp - 0xd14]
call fcn.100214a3
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x380], 3
mov dword [ebp - 0x2f4], 0
jmp 0x10019b0d
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 3
jge 0x10019b2f
push dword [ebp - 0x2f4]
lea ecx, [ebp - 0xd14]
call fcn.10021541
mov dword [eax], 0x77862fd4
jmp 0x10019b00
mov dword [ebp - 0x380], 2
jmp 0x10019b48
mov eax, dword [ebp - 0x380]
dec eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0
jl 0x10019d0e
mov dword [ebp - 0x204], 0xfffffff8
mov dword [ebp - 0x204], 0
jmp 0x10019b78
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 2
jg 0x10019ced
mov dword [ebp - 0x2fc], 1
mov dword [ebp - 0x2fc], 0
jmp 0x10019ba8
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 2
jg 0x10019ce8
push 2
lea ecx, [ebp - 0xbb8]
call fcn.100214a3
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x388], 0
jmp 0x10019bdf
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 2
jge 0x10019c01
push dword [ebp - 0x388]
lea ecx, [ebp - 0xbb8]
call fcn.10021541
mov dword [eax], 0xfffffff6
jmp 0x10019bd2
push 1
lea ecx, [ebp - 0xbb8]
call fcn.10021541
and dword [eax], 0
jmp 0x10019c37
push 1
lea ecx, [ebp - 0xbb8]
call fcn.10021541
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x54c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x54c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xbb8]
call fcn.10021541
cmp dword [eax], 2
jg 0x10019cd4
mov dword [ebp - 0x304], 0xffffffff
mov byte [ebp - 0x173], 0
movzx eax, byte [ebp - 0x173]
test eax, eax
je 0x10019c80
push 0x18fd
push 0
push 0x263d
push 0x20e8
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov dword [ebp - 0x304], 2
jmp 0x10019c99
mov eax, dword [ebp - 0x304]
dec eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0
jl 0x10019ccf
mov dword [ebp - 0xaa0], 0x14ad38dc
push dword [ebp - 0x204]
lea ecx, [ebp - 0xd14]
call fcn.10021541
mov dword [eax], 7
mov dword [ebp - 0xaa0], 7
jmp 0x10019c8c
jmp 0x10019c13
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xbb8]
call fcn.10021525
jmp 0x10019b9b
jmp 0x10019b6b
mov byte [ebp - 0x106], 0
movzx eax, byte [ebp - 0x106]
test eax, eax
je 0x10019d09
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
jmp 0x10019b3b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd14]
call fcn.10021525
mov dword [ebp - 0x2c], 2
and dword [ebp - 0x1dc], 0
jmp 0x10019d35
mov eax, dword [ebp - 0x2c]
inc eax
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1f
jae 0x1001b59e
push 1
lea ecx, [ebp - 0xa14]
call fcn.100214a3
mov dword [ebp - 4], 0x12
mov dword [ebp - 0xb8], 0xfffffffd
mov dword [ebp - 0x1c8], 0xf737a9a9
mov dword [ebp - 0x7b4], 0x9687fd07
mov dword [ebp - 0x390], 0
jmp 0x10019d8a
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 1
jge 0x10019dac
push dword [ebp - 0x390]
lea ecx, [ebp - 0xa14]
call fcn.10021541
mov dword [eax], 0xd5e48d32
jmp 0x10019d7d
mov dword [ebp - 0xb8], 0
jmp 0x10019dc5
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jg 0x10019e59
mov dword [ebp - 0x8d4], 0x782
mov dword [ebp - 0xc28], 0xfffffffb
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x1c8], eax
mov esi, dword [ebp - 0x1c8]
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xa14]
call fcn.10021541
cmp dword [eax], esi
je 0x10019e19
mov dword [ebp - 0x554], 1
jmp 0x10019e20
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0xe18], eax
cmp dword [ebp - 0x554], 1
jl 0x10019e41
mov dword [ebp - 0x7ac], 1
jmp 0x10019e48
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x7ac]
mov dword [ebp - 0xc28], eax
jmp 0x10019db8
mov dword [ebp - 0xb8], 0
jmp 0x10019e72
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xffffffe9
je 0x1001a261
mov dword [ebp - 0x96c], 1
mov dword [ebp - 0x30c], 0
jmp 0x10019ea2
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 1
jge 0x10019ebe
mov eax, dword [ebp - 0x30c]
mov dword [ebp + eax*4 - 0x474], 1
jmp 0x10019e95
mov byte [ebp - 0x17b], 0
mov dword [ebp - 0xaa8], 0x2658
cmp dword [ebp - 0xaa8], 0xfed
jge 0x10019fab
and dword [ebp - 0x398], 0
lea eax, [ebp - 0x55c]
push eax
mov ecx, 0x1061e870
call fcn.10020e49
mov dword [ebp - 0x21c], 1
jmp 0x10019f10
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x21c]
cmp eax, dword [ebp - 0x55c]
jg 0x10019fab
mov dword [ebp - 0x3f4], 1
jmp 0x10019f3b
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x55c]
sub eax, dword [ebp - 0x21c]
cmp dword [ebp - 0x3f4], eax
jg 0x10019f60
mov edx, 0x10007a4c
mov ecx, 0x1061e7b8
call fcn.100255e3
jmp 0x10019f2e
mov eax, dword [ebp - 0x21c]
lea eax, [eax + eax - 1]
cmp dword [ebp - 0x398], eax
je 0x10019f90
mov edx, 0x100076a0
mov ecx, 0x1061e7b8
call fcn.100255e3
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
jmp 0x10019f60
and dword [ebp - 0x398], 0
mov edx, 0x10007a50
mov ecx, 0x1061e7b8
call fcn.100255e3
jmp 0x10019f03
movzx eax, byte [ebp - 0x17b]
test eax, eax
je 0x10019fca
push 0
push 0x2e2
push 0x183b
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
mov dword [ebp - 0x1c8], 0
jmp 0x10019fe3
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0x14
jne 0x1001a25c
mov dword [ebp - 0xe8], 0xcb4e76ab
mov dword [ebp - 0x57c], 1
mov dword [ebp - 0xe8], 0
jmp 0x1001a01d
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jg 0x1001a257
mov dword [ebp - 0x3a0], 1
mov dword [ebp - 0x314], 0
jmp 0x1001a04d
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 3
jge 0x1001a069
mov eax, dword [ebp - 0x314]
mov dword [ebp + eax*4 - 0xe70], 0
jmp 0x1001a040
mov dword [ebp - 0x3a0], 0
jmp 0x1001a082
mov eax, dword [ebp - 0x3a0]
dec eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0
jl 0x1001a252
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xa14]
call fcn.10021541
cmp dword [eax], 0
jne 0x1001a0b1
mov dword [ebp - 0x8dc], 1
jmp 0x1001a0b8
and dword [ebp - 0x8dc], 0
mov dword [ebp - 0x96c], 0x6e1ee67b
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x96c]
cmp ecx, dword [ebp + eax - 0x474]
jne 0x1001a0e3
mov dword [ebp - 0x564], 1
jmp 0x1001a0ea
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x7b4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7b4]
cmp ecx, dword [ebp + eax - 0x474]
jne 0x1001a117
mov dword [ebp - 0x56c], 1
jmp 0x1001a11e
and dword [ebp - 0x56c], 0
push 0
lea ecx, [ebp - 0xa14]
call fcn.10021541
mov ecx, dword [ebp - 0x56c]
cmp ecx, dword [eax]
jge 0x1001a141
mov dword [ebp - 0x574], 1
jmp 0x1001a148
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x8dc]
cmp eax, dword [ebp - 0x574]
jne 0x1001a162
mov dword [ebp - 0xbcc], 1
jmp 0x1001a169
and dword [ebp - 0xbcc], 0
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xa14]
call fcn.10021541
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xe70]
add eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0x57c]
jge 0x1001a1a0
mov dword [ebp - 0x7bc], 1
jmp 0x1001a1a7
and dword [ebp - 0x7bc], 0
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xa14]
call fcn.10021541
mov eax, dword [eax]
sub eax, dword [ebp - 0x7bc]
cmp eax, 3
jg 0x1001a1d1
mov dword [ebp - 0x9d4], 1
jmp 0x1001a1d8
and dword [ebp - 0x9d4], 0
mov eax, dword [ebp - 0x57c]
cmp dword [ebp - 0x9d4], eax
jl 0x1001a1f2
mov dword [ebp - 0x584], 1
jmp 0x1001a1f9
and dword [ebp - 0x584], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xe70]
cmp dword [ebp - 0x584], eax
jl 0x1001a219
mov dword [ebp - 0xab0], 1
jmp 0x1001a220
and dword [ebp - 0xab0], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x474], 1
mov byte [ebp - 0x108], 0
movzx eax, byte [ebp - 0x108]
test eax, eax
je 0x1001a24d
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x1001a075
jmp 0x1001a010
jmp 0x10019fd6
jmp 0x10019e65
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa14]
call fcn.10021525
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x250]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x2c], eax
jne 0x1001a82b
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x250]
inc eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x78], 0xf9986e3e
mov dword [ebp - 0x58c], 0xdebf889e
mov dword [ebp - 0x59c], 8
mov dword [ebp - 0x5a4], 0xfc80ae7b
mov dword [ebp - 0x31c], 0x6b933888
mov dword [ebp - 0x98], 0
jmp 0x1001a2e5
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x1001a301
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x3fc], 0xbf390197
jmp 0x1001a2d8
mov dword [ebp - 0x98], 0
jmp 0x1001a31a
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x1001a336
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0xe98], 7
jmp 0x1001a30d
mov byte [ebp - 0x175], 0
movzx eax, byte [ebp - 0x175]
test eax, eax
je 0x1001a352
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3fc]
mov dword [ebp - 0xe20], eax
cmp dword [ebp - 0x78], 0x1e01
jl 0x1001a37a
mov dword [ebp - 0x7c4], 1
jmp 0x1001a381
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x58c], eax
mov eax, dword [ebp - 0x58c]
cmp eax, dword [ebp - 0x78]
jg 0x1001a3a4
mov dword [ebp - 0x8e4], 1
jmp 0x1001a3ab
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x8e4], eax
jg 0x1001a3c2
mov dword [ebp - 0x594], 1
jmp 0x1001a3c9
and dword [ebp - 0x594], 0
cmp dword [ebp - 0x594], 0x6dd2cc9
jne 0x1001a3e1
mov dword [ebp - 0x7cc], 1
jmp 0x1001a3e8
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x7cc]
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x59c]
add eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x78]
je 0x1001a40e
mov dword [ebp - 0xc30], 1
jmp 0x1001a415
and dword [ebp - 0xc30], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3fc], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3fc]
cmp eax, dword [ebp - 0x78]
jne 0x1001a444
mov dword [ebp - 0x974], 1
jmp 0x1001a44b
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0x5a4], eax
mov eax, dword [ebp - 0x5a4]
cmp eax, dword [ebp - 0x78]
jg 0x1001a46e
mov dword [ebp - 0x7d4], 1
jmp 0x1001a475
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x31c]
imul eax, dword [ebp - 0x78]
imul eax, eax, 0xffff
imul eax, dword [ebp - 0x78]
test eax, eax
jne 0x1001a4b4
cmp dword [ebp - 0x31c], 0
jne 0x1001a4b4
cmp dword [ebp - 0x31c], 0
jne 0x1001a4b4
and dword [ebp - 0x5ac], 0
jmp 0x1001a4be
mov dword [ebp - 0x5ac], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5ac]
mov dword [ebp + eax - 0xe98], ecx
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x250]
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xa0], 0
push 4
lea ecx, [ebp - 0xbc8]
call fcn.100214a3
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x1a8], 8
mov dword [ebp - 0xb0], 0
jmp 0x1001a527
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 4
jge 0x1001a549
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xbc8]
call fcn.10021541
mov dword [eax], 0xf9b2
jmp 0x1001a51a
mov dword [ebp - 0xb0], 0
jmp 0x1001a562
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x1001a57e
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x1018], 9
jmp 0x1001a555
mov dword [ebp - 0xa0], 0xfffffff7
jmp 0x1001a597
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 4
jge 0x1001a6e7
push 2
lea ecx, [ebp - 0x494]
call fcn.100214a3
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x3a8], 0
jmp 0x1001a5ce
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 2
jge 0x1001a5f0
push dword [ebp - 0x3a8]
lea ecx, [ebp - 0x494]
call fcn.10021541
mov dword [eax], 0xd5816210
jmp 0x1001a5c1
push 1
lea ecx, [ebp - 0x494]
call fcn.10021541
and dword [eax], 0
jmp 0x1001a626
push 1
lea ecx, [ebp - 0x494]
call fcn.10021541
mov dword [ebp - 0x8ec], eax
mov eax, dword [ebp - 0x8ec]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x8ec]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x494]
call fcn.10021541
cmp dword [eax], 4
jge 0x1001a65a
push 1
lea ecx, [ebp - 0x494]
call fcn.10021541
push dword [eax]
lea ecx, [ebp - 0xbc8]
call fcn.10021541
mov dword [eax], 0xfff9
jmp 0x1001a602
mov esi, dword [ebp - 0xa0]
push 0
lea ecx, [ebp - 0x494]
call fcn.10021541
cmp dword [eax], esi
jg 0x1001a67d
mov dword [ebp - 0x5b4], 1
jmp 0x1001a684
and dword [ebp - 0x5b4], 0
imul eax, dword [ebp - 0x5b4], 0xf37c
mov dword [ebp - 0x1a8], eax
mov esi, dword [ebp - 0x1a8]
push 1
lea ecx, [ebp - 0x494]
call fcn.10021541
cmp esi, dword [eax]
jle 0x1001a6b7
mov dword [ebp - 0x7dc], 1
jmp 0x1001a6be
and dword [ebp - 0x7dc], 0
push 1
lea ecx, [ebp - 0x494]
call fcn.10021541
mov ecx, dword [ebp - 0x7dc]
mov dword [eax], ecx
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x494]
call fcn.10021525
jmp 0x1001a58a
push 0
lea ecx, [ebp - 0xbc8]
call fcn.10021541
cmp dword [eax], 0
jne 0x1001a705
mov dword [ebp - 0x5bc], 1
jmp 0x1001a70c
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x5bc]
je 0x1001a726
mov dword [ebp - 0x9c4], 1
jmp 0x1001a72d
and dword [ebp - 0x9c4], 0
cmp dword [ebp - 0xa0], 0xabc2
jg 0x1001a745
mov dword [ebp - 0x43c], 1
jmp 0x1001a74c
and dword [ebp - 0x43c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x43c]
mov dword [ebp + eax - 0x1018], ecx
mov eax, dword [ebp - 0x9c4]
sub eax, dword [ebp - 0x43c]
je 0x1001a782
cmp dword [ebp - 0xa0], 0
je 0x1001a782
mov dword [ebp - 0x5c4], 1
jmp 0x1001a789
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0xa0], eax
mov esi, dword [ebp - 0xa0]
push 1
lea ecx, [ebp - 0xbc8]
call fcn.10021541
cmp esi, dword [eax]
jge 0x1001a7b8
mov dword [ebp - 0x7e4], 1
jmp 0x1001a7bf
and dword [ebp - 0x7e4], 0
xor eax, eax
sub eax, dword [ebp - 0x7e4]
jne 0x1001a7db
cmp dword [ebp - 0x1a8], 0
jne 0x1001a7db
and dword [ebp - 0x5cc], 0
jmp 0x1001a7e5
mov dword [ebp - 0x5cc], 1
cmp dword [ebp - 0x5cc], 0x2c39
jle 0x1001a7fd
mov dword [ebp - 0x8f4], 1
jmp 0x1001a804
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x1a8]
imul eax, dword [ebp - 0x8f4]
mov dword [ebp - 0x1a8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc8]
call fcn.10021525
jmp 0x10019d2d
push 4
lea ecx, [ebp - 0x3d8]
call fcn.100214a3
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x80], 0
jmp 0x1001a84f
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1001a865
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x324], 0xfffffffd
jmp 0x1001a848
mov dword [ebp - 0x80], 0
jmp 0x1001a875
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x1001a88e
push dword [ebp - 0x80]
lea ecx, [ebp - 0x3d8]
call fcn.10021541
or dword [eax], 0xffffffff
jmp 0x1001a86e
push 2
lea ecx, [ebp - 0x3d8]
call fcn.10021541
and dword [eax], 0
jmp 0x1001a8c4
push 2
lea ecx, [ebp - 0x3d8]
call fcn.10021541
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp - 0x5d4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x5d4]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x3d8]
call fcn.10021541
cmp dword [eax], 0
jl 0x1001ad26
mov dword [ebp - 0x38], 0xb8c3ad3b
mov dword [ebp - 0x404], 5
mov dword [ebp - 0x460], 1
mov dword [ebp - 0x38], 0
jmp 0x1001a905
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1001ace7
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x3b0], 0xffffffff
mov dword [ebp - 0x614], 0x6f79b347
mov dword [ebp - 0x40c], 0xffffffff
mov dword [ebp - 0x50], 0
jmp 0x1001a944
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jg 0x1001ab5c
mov dword [ebp - 0xab8], 0xffffffff
push 2
lea ecx, [ebp - 0x3d8]
call fcn.10021541
mov eax, dword [eax]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0xe28], eax
push 2
lea ecx, [ebp - 0x3d8]
call fcn.10021541
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xe30], eax
mov eax, 0x1b40
test eax, eax
je 0x1001a9b5
xor eax, eax
inc eax
je 0x1001a9b5
mov dword [ebp - 0x7ec], 1
jmp 0x1001a9bc
and dword [ebp - 0x7ec], 0
cmp dword [ebp - 0x7ec], 0xfffb
jbe 0x1001a9d4
mov dword [ebp - 0x5dc], 1
jmp 0x1001a9db
and dword [ebp - 0x5dc], 0
push 2
lea ecx, [ebp - 0x3d8]
call fcn.10021541
mov ecx, dword [ebp - 0x5dc]
cmp ecx, dword [eax]
jne 0x1001a9fe
mov dword [ebp - 0x97c], 1
jmp 0x1001aa05
and dword [ebp - 0x97c], 0
cmp dword [ebp - 0x97c], 0x446
jl 0x1001aa1d
mov dword [ebp - 0x5e4], 1
jmp 0x1001aa24
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0xab8]
cmp dword [ebp - 0x5e4], eax
jge 0x1001aa3e
mov dword [ebp - 0xbdc], 1
jmp 0x1001aa45
and dword [ebp - 0xbdc], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xe38], eax
mov eax, dword [ebp - 0x404]
cmp eax, dword [ebp - 0x50]
jge 0x1001aa65
mov dword [ebp - 0x7f4], 1
jmp 0x1001aa6c
and dword [ebp - 0x7f4], 0
cmp dword [ebp - 0x7f4], 0x5a2e
jle 0x1001aa84
mov dword [ebp - 0x5ec], 1
jmp 0x1001aa8b
and dword [ebp - 0x5ec], 0
cmp dword [ebp - 0x5ec], 0xffffffff
ja 0x1001aaa0
mov dword [ebp - 0x8fc], 1
jmp 0x1001aaa7
and dword [ebp - 0x8fc], 0
push 2
lea ecx, [ebp - 0x3d8]
call fcn.10021541
mov ecx, dword [ebp - 0x8fc]
cmp ecx, dword [eax]
jge 0x1001aaca
mov dword [ebp - 0x5f4], 1
jmp 0x1001aad1
and dword [ebp - 0x5f4], 0
push 3
lea ecx, [ebp - 0x3d8]
call fcn.10021541
mov ecx, dword [ebp - 0x5f4]
cmp ecx, dword [eax]
jne 0x1001aaf4
mov dword [ebp - 0x5fc], 1
jmp 0x1001aafb
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x324]
mov dword [ebp - 0x7fc], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x7fc]
mov dword [ebp + eax*4 - 0x324], ecx
mov eax, dword [ebp - 0x7fc]
cmp eax, dword [ebp - 0x5fc]
jge 0x1001ab35
mov dword [ebp - 0x9f0], 1
jmp 0x1001ab3c
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x9f0]
mov dword [ebp - 0x614], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x324], 0
je 0x1001ab57
jmp 0x1001ab5c
jmp 0x1001a93d
cmp dword [ebp - 0x50], 0
je 0x1001ab66
cmp dword [ebp - 0x38], 0
mov esi, dword [ebp - 0x50]
push 3
lea ecx, [ebp - 0x3d8]
call fcn.10021541
cmp dword [eax], esi
jl 0x1001ab86
mov dword [ebp - 0x604], 1
jmp 0x1001ab8d
and dword [ebp - 0x604], 0
cmp dword [ebp - 0x604], 5
jg 0x1001aba2
mov dword [ebp - 0x804], 1
jmp 0x1001aba9
and dword [ebp - 0x804], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x324]
mov edi, dword [ebp - 0x3b0]
push 2
lea ecx, [ebp - 0x3d8]
call fcn.10021541
mov ecx, dword [ebp - 0x804]
sub ecx, dword [eax]
imul ecx, edi
cmp ecx, esi
jl 0x1001abe4
mov dword [ebp - 0x60c], 1
jmp 0x1001abeb
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x460]
dec eax
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0xac0], eax
mov esi, dword [ebp - 0x460]
push 2
lea ecx, [ebp - 0x3d8]
call fcn.10021541
add esi, dword [eax]
add esi, dword [ebp - 0x60c]
mov dword [ebp - 0xc38], esi
mov eax, dword [ebp - 0x40c]
dec eax
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0xac0]
cmp eax, dword [ebp - 0xc38]
jl 0x1001ac4c
mov dword [ebp - 0x904], 1
jmp 0x1001ac53
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x904], eax
jge 0x1001ac79
cmp dword [ebp - 0x614], 0
je 0x1001ac79
cmp dword [ebp - 0x38], 0
je 0x1001ac79
mov dword [ebp - 0x80c], 1
jmp 0x1001ac80
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x3b0]
cmp dword [ebp - 0x80c], eax
jge 0x1001ac9a
mov dword [ebp - 0x61c], 1
jmp 0x1001aca1
and dword [ebp - 0x61c], 0
mov esi, dword [ebp - 0x61c]
neg esi
push 2
lea ecx, [ebp - 0x3d8]
call fcn.10021541
sub esi, dword [eax]
sub esi, 0x2da0d3d7
cmp esi, 0x10cbedfa
je 0x1001acd2
mov dword [ebp - 0x984], 1
jmp 0x1001acd9
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x984]
mov dword [ebp - 0x50], eax
jmp 0x1001a8fe
mov dword [ebp - 0x38], 0
jmp 0x1001acf7
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1001ad21
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x1001ad1f
push 0x2c2
push 0xea6
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x1001acf0
jmp 0x1001a8a0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3d8]
call fcn.10021525
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x1dc]
movzx eax, byte [ebp + eax - 0x252]
movsx eax, byte [ebp + eax - 0xa78]
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x24f]
and ecx, eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x1dc]
movzx eax, byte [ebp + eax - 0x252]
movsx eax, byte [ebp + eax - 0xa78]
mov edx, dword [ebp - 0x2c]
movzx edx, byte [ebp + edx - 0x24f]
and edx, eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x1dc]
movzx eax, byte [ebp + eax - 0x252]
movsx eax, byte [ebp + eax - 0xa78]
mov esi, dword [ebp - 0x2c]
movzx ebx, byte [ebp + esi - 0x24f]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x250]
mov byte [ebp + eax - 0xa78], bl
mov dword [ebp - 0xac8], 0x19eb
cmp dword [ebp - 0xac8], 0x1046
jge 0x1001b13a
lea eax, [ebp - 0x444]
push eax
push 0x10007a54
call fcn.1005f77b
pop ecx
pop ecx
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0xbec], eax
mov eax, dword [ebp - 0x444]
dec eax
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0xbec], 0
je 0x1001b13a
lea ecx, [ebp - 0xa08]
call fcn.10020cc5
mov dword [ebp - 4], 0x16
lea edx, [ebp - 0xa08]
mov ecx, 0x1061e870
call fcn.10025941
mov byte [ebp - 0x45], 0
push 0
lea ecx, [ebp - 0xa08]
call fcn.10020d68
movsx eax, byte [eax]
cmp eax, 0x52
jne 0x1001aeae
push 1
lea ecx, [ebp - 0xa08]
call fcn.10020d68
movsx eax, byte [eax]
cmp eax, 0x30
jl 0x1001aeae
push 1
lea ecx, [ebp - 0xa08]
call fcn.10020d68
movsx eax, byte [eax]
cmp eax, 0x39
jg 0x1001aeae
push 0
push 0x43
lea ecx, [ebp - 0xa08]
call fcn.10020d8b
cmp eax, 1
jbe 0x1001aeae
lea ecx, [ebp - 0xa08]
call fcn.10020d87
mov esi, eax
dec esi
push 0
push 0x43
lea ecx, [ebp - 0xa08]
call fcn.10020d8b
cmp eax, esi
jae 0x1001aeae
mov byte [ebp - 0x45], 1
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x1001afb0
push 0
push 0x43
lea ecx, [ebp - 0xa08]
call fcn.10020d8b
mov dword [ebp - 0x624], eax
mov eax, dword [ebp - 0x624]
dec eax
push eax
push 1
lea eax, [ebp - 0x10c4]
push eax
lea ecx, [ebp - 0xa08]
call fcn.10020e04
mov byte [ebp - 4], 0x17
push dword [0x10007c5c]
mov eax, dword [ebp - 0x624]
inc eax
push eax
lea eax, [ebp - 0x10ac]
push eax
lea ecx, [ebp - 0xa08]
call fcn.10020e04
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x10ac]
call fcn.10020d7c
push eax
call fcn.1005fc16
pop ecx
mov dword [ebp - 0xad0], eax
push dword [ebp - 0xad0]
lea eax, [ebp - 0x1164]
push eax
call fcn.10017770
pop ecx
pop ecx
mov dword [ebp - 0xc40], eax
mov eax, dword [ebp - 0xc40]
mov dword [ebp - 0xad8], eax
mov byte [ebp - 4], 0x19
push 0x1002590f
mov edx, dword [ebp - 0xad8]
mov ecx, 0x1061e7b8
call fcn.10025966
lea edx, [ebp - 0x10c4]
mov ecx, eax
call fcn.10025966
mov ecx, eax
call fcn.10021037
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x1164]
call fcn.10020d4d
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x10ac]
call fcn.10020d4d
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x10c4]
call fcn.10020d4d
jmp 0x1001b126
push 0x100076a2
lea ecx, [ebp - 0x100c]
call fcn.10020cd6
mov byte [ebp - 4], 0x1a
push 0x100076a2
lea ecx, [ebp - 0x1048]
call fcn.10020cd6
mov byte [ebp - 4], 0x1b
and dword [ebp - 0x12c], 0
jmp 0x1001afee
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
lea ecx, [ebp - 0xa08]
call fcn.10020d87
cmp dword [ebp - 0x12c], eax
jae 0x1001b0a2
push dword [ebp - 0x12c]
lea ecx, [ebp - 0xa08]
call fcn.10020d68
movsx eax, byte [eax]
cmp eax, 0x30
jl 0x1001b07b
push dword [ebp - 0x12c]
lea ecx, [ebp - 0xa08]
call fcn.10020d68
movsx eax, byte [eax]
cmp eax, 0x39
jg 0x1001b07b
push dword [0x10007c5c]
push dword [ebp - 0x12c]
lea eax, [ebp - 0x11b8]
push eax
lea ecx, [ebp - 0xa08]
call fcn.10020e04
mov dword [ebp - 0xc48], eax
push dword [ebp - 0xc48]
lea ecx, [ebp - 0x1048]
call fcn.10020d28
lea ecx, [ebp - 0x11b8]
call fcn.10020d4d
jmp 0x1001b0a2
push dword [ebp - 0x12c]
lea ecx, [ebp - 0xa08]
call fcn.10020d68
mov al, byte [eax]
movzx eax, al
push eax
lea ecx, [ebp - 0x100c]
call fcn.10020d57
jmp 0x1001afe1
push 0x1002590f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe40], esp
lea eax, [ebp - 0x100c]
push eax
call fcn.10020c9f
call fcn.100176ec
add esp, 0x18
mov dword [ebp - 0xae0], eax
push dword [ebp - 0xae0]
mov edx, 0x10007a58
mov ecx, 0x1061e7b8
call fcn.100255e3
lea edx, [ebp - 0x1048]
mov ecx, eax
call fcn.10025966
mov edx, 0x100076a4
mov ecx, eax
call fcn.100255e3
mov ecx, eax
call fcn.10021155
mov ecx, eax
call fcn.10021037
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x1048]
call fcn.10020d4d
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x100c]
call fcn.10020d4d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa08]
call fcn.10020d4d
jmp 0x1001adea
mov dword [ebp - 0xe0], 0x110c93b4
push 1
lea ecx, [ebp - 0xa20]
call fcn.100214a3
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x32c], 0
jmp 0x1001b171
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 1
jge 0x1001b193
push dword [ebp - 0x32c]
lea ecx, [ebp - 0xa20]
call fcn.10021541
mov dword [eax], 0x7e17f759
jmp 0x1001b164
mov dword [ebp - 0xe0], 0xf
jmp 0x1001b1ac
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0xc
jl 0x1001b1d8
mov dword [ebp - 0xe48], 0xffffffff
mov dword [ebp - 0x814], 0xfffffffe
mov eax, dword [ebp - 0x814]
dec eax
mov dword [ebp - 0x814], eax
jmp 0x1001b19f
mov eax, 0xffffb632
test eax, eax
je 0x1001b3e8
push 1
lea ecx, [ebp - 0xd2c]
call fcn.100214a3
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x3b8], 0
jmp 0x1001b20f
mov eax, dword [ebp - 0x3b8]
inc eax
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 1
jge 0x1001b231
push dword [ebp - 0x3b8]
lea ecx, [ebp - 0xd2c]
call fcn.10021541
mov dword [eax], 1
jmp 0x1001b202
mov dword [ebp - 0xe0], 0x1c
jmp 0x1001b24a
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0xfffffff8
jl 0x1001b3d4
push 3
lea ecx, [ebp - 0xbd8]
call fcn.100214a3
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x334], 0
jmp 0x1001b281
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 3
jge 0x1001b2a0
push dword [ebp - 0x334]
lea ecx, [ebp - 0xbd8]
call fcn.10021541
or dword [eax], 0xffffffff
jmp 0x1001b274
push 0
lea ecx, [ebp - 0xbd8]
call fcn.10021541
mov dword [eax], 0xfffffff3
jmp 0x1001b2d9
push 0
lea ecx, [ebp - 0xbd8]
call fcn.10021541
mov dword [ebp - 0x62c], eax
mov eax, dword [ebp - 0x62c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x62c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xbd8]
call fcn.10021541
cmp dword [eax], 0xd
jge 0x1001b3c0
mov dword [ebp - 0x1e0], 0xe012d2c8
mov dword [ebp - 0x1e0], 0
jmp 0x1001b312
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
jl 0x1001b3bb
mov dword [ebp - 0x3c0], 0xce008fb0
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0xa20]
call fcn.10021541
mov dword [eax], 0x3e13a6c9
mov dword [ebp - 0x3c0], 0
jmp 0x1001b359
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0
jg 0x1001b3b6
mov dword [ebp - 0x33c], 0xfffffffa
mov dword [ebp - 0x33c], 0
jmp 0x1001b385
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0
jg 0x1001b3b4
push 0
lea ecx, [ebp - 0xd2c]
call fcn.10021541
mov dword [ebp - 0x90c], eax
mov eax, dword [ebp - 0x90c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x90c]
mov dword [ecx], eax
jmp 0x1001b378
jmp 0x1001b34c
jmp 0x1001b305
jmp 0x1001b2b5
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xbd8]
call fcn.10021525
jmp 0x1001b23d
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xd2c]
call fcn.10021525
jmp 0x1001b583
mov dword [ebp - 0x64c], 1
mov dword [ebp - 0x634], 0x9e62b560
mov dword [ebp - 0x81c], 0xffffffff
mov dword [ebp - 0x824], 0xfffffffa
mov dword [ebp - 0xc34], 0xffffffff
cmp dword [ebp - 0x64c], 0
jne 0x1001b521
push 0
lea ecx, [ebp - 0xa20]
call fcn.10021541
mov eax, dword [eax]
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x634]
cmp eax, dword [ebp - 0x81c]
je 0x1001b456
mov dword [ebp - 0x914], 1
jmp 0x1001b45d
and dword [ebp - 0x914], 0
mov esi, dword [ebp - 0x81c]
push 0
lea ecx, [ebp - 0xa20]
call fcn.10021541
cmp dword [eax], esi
jg 0x1001b480
mov dword [ebp - 0x63c], 1
jmp 0x1001b487
and dword [ebp - 0x63c], 0
push 0
lea ecx, [ebp - 0xa20]
call fcn.10021541
mov ecx, dword [ebp - 0x63c]
cmp ecx, dword [eax]
jl 0x1001b4ae
xor eax, eax
je 0x1001b4ae
mov dword [ebp - 0x9cc], 1
jmp 0x1001b4b5
and dword [ebp - 0x9cc], 0
cmp dword [ebp - 0x9cc], 0x435e45db
jg 0x1001b4cd
mov dword [ebp - 0x644], 1
jmp 0x1001b4d4
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x824], eax
mov esi, dword [ebp - 0x824]
push 0
lea ecx, [ebp - 0xa20]
call fcn.10021541
sub esi, dword [eax]
jne 0x1001b509
cmp dword [ebp - 0x64c], 0
jne 0x1001b509
and dword [ebp - 0x654], 0
jmp 0x1001b513
mov dword [ebp - 0x654], 1
mov eax, dword [ebp - 0x914]
cmp eax, dword [ebp - 0x654]
jg 0x1001b532
xor eax, eax
inc eax
je 0x1001b532
mov dword [ebp - 0x82c], 1
jmp 0x1001b539
and dword [ebp - 0x82c], 0
cmp dword [ebp - 0x82c], 0xf162c80f
je 0x1001b551
mov dword [ebp - 0x65c], 1
jmp 0x1001b558
and dword [ebp - 0x65c], 0
cmp dword [ebp - 0x65c], 0xa684a08d
je 0x1001b570
mov dword [ebp - 0x98c], 1
jmp 0x1001b577
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x98c]
mov dword [ebp - 0xc34], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa20]
call fcn.10021525
and dword [ebp - 0x1dc], 0
jmp 0x10019d2d
mov dword [ebp - 0x4c], 0xfffffffe
mov dword [ebp - 0x854], 0x68fc786c
mov dword [ebp - 0x4c], 0
jmp 0x1001b5bf
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffe6
jne 0x1001b935
mov dword [ebp - 0x278], 0x542afa01
mov dword [ebp - 0x3b4], 1
mov dword [ebp - 0x3c8], 0xfffffff8
push 1
lea ecx, [ebp - 0xd38]
call fcn.100214a3
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x844], 0
mov dword [ebp - 0xbfc], 0xd39ef5b5
mov dword [ebp - 0x84], 0
jmp 0x1001b628
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1001b64a
push dword [ebp - 0x84]
lea ecx, [ebp - 0xd38]
call fcn.10021541
mov dword [eax], 0x5f19716e
jmp 0x1001b61b
mov dword [ebp - 0x84], 0
jmp 0x1001b663
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x1001b67f
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x1104], 0x9534ce5f
jmp 0x1001b656
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1001b6a6
push 0x18a9
push 0x1c28
push 0x198
call dword [sym.imp.USER32.dll_EnableScrollBar]
cmp dword [ebp - 0x278], 0
jne 0x1001b74a
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0xe50], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0xf30], eax
cmp dword [ebp - 0x3c8], 0
jne 0x1001b6e3
cmp dword [ebp - 0x4c], 0
jne 0x1001b6e3
and dword [ebp - 0x664], 0
jmp 0x1001b6ed
mov dword [ebp - 0x664], 1
cmp dword [ebp - 0x664], 0xfffffffa
jb 0x1001b702
mov dword [ebp - 0x834], 1
jmp 0x1001b709
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0x834], eax
jne 0x1001b723
mov dword [ebp - 0x66c], 1
jmp 0x1001b72a
and dword [ebp - 0x66c], 0
push 0
lea ecx, [ebp - 0xd38]
call fcn.10021541
mov ecx, dword [ebp - 0x66c]
sub ecx, dword [eax]
jne 0x1001b74a
and dword [ebp - 0x91c], 0
jmp 0x1001b754
mov dword [ebp - 0x91c], 1
cmp dword [ebp - 0x91c], 0xfffffffa
jge 0x1001b769
mov dword [ebp - 0x674], 1
jmp 0x1001b770
and dword [ebp - 0x674], 0
cmp dword [ebp - 0x674], 0
ja 0x1001b785
mov dword [ebp - 0x83c], 1
jmp 0x1001b78c
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x278]
cmp eax, dword [ebp - 0x83c]
jge 0x1001b7a6
mov dword [ebp - 0x67c], 1
jmp 0x1001b7ad
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x854]
cmp dword [ebp - 0x67c], eax
jg 0x1001b7c7
mov dword [ebp - 0x9dc], 1
jmp 0x1001b7ce
and dword [ebp - 0x9dc], 0
mov eax, dword [ebp - 0x3c8]
cmp dword [ebp - 0x9dc], eax
jne 0x1001b7e8
mov dword [ebp - 0x684], 1
jmp 0x1001b7ef
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x844]
cmp eax, dword [ebp - 0x278]
jne 0x1001b815
mov dword [ebp - 0x68c], 1
jmp 0x1001b81c
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x68c], eax
jl 0x1001b833
mov dword [ebp - 0x924], 1
jmp 0x1001b83a
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x924]
jge 0x1001b851
mov dword [ebp - 0x694], 1
jmp 0x1001b858
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x3b4]
cmp dword [ebp - 0x694], eax
jle 0x1001b872
mov dword [ebp - 0x84c], 1
jmp 0x1001b879
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x84c]
add eax, 0xfff8
jne 0x1001b898
cmp dword [ebp - 0x3b4], 0
jne 0x1001b898
and dword [ebp - 0xae8], 0
jmp 0x1001b8a2
mov dword [ebp - 0xae8], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1104]
mov dword [ebp - 0xf38], eax
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x4c]
jg 0x1001b8c9
mov dword [ebp - 0x69c], 1
jmp 0x1001b8d0
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x69c], eax
je 0x1001b8e7
mov dword [ebp - 0x994], 1
jmp 0x1001b8ee
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x3c8]
cmp dword [ebp - 0x994], eax
jg 0x1001b908
mov dword [ebp - 0x6a4], 1
jmp 0x1001b90f
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x6a4]
sub eax, dword [ebp - 0x3b4]
mov dword [ebp - 0xbfc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd38]
call fcn.10021525
jmp 0x1001b5b8
mov eax, dword [ebp - 0x854]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x6ac], 0x496d
mov dword [ebp - 0xc60], 0x10007a60
cmp dword [ebp - 0x6ac], 0x4a50
jle 0x1001ba75
and dword [ebp - 0x354], 0
jmp 0x1001b978
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0x1b52
jge 0x1001ba6a
and dword [ebp - 0x3dc], 0
jmp 0x1001b99e
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 0x2d27
jge 0x1001ba65
and dword [ebp - 0x34c], 0
jmp 0x1001b9c4
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0x45ae
jge 0x1001ba60
and dword [ebp - 0x394], 0
jmp 0x1001b9ea
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0x2775
jge 0x1001ba5b
mov eax, dword [ebp - 0x34c]
and eax, dword [ebp - 0x394]
mov ecx, dword [ebp - 0x354]
sub ecx, dword [ebp - 0x3dc]
or eax, ecx
cdq
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0xb18], edx
push dword [ebp - 0xb18]
push dword [ebp - 0xb1c]
lea ecx, [ebp - 0x1134]
call fcn.1000a883
pop ecx
pop ecx
mov dword [ebp - 0xaf0], eax
mov ecx, dword [ebp - 0xaf0]
call fcn.10020d7c
push eax
call fcn.1005fa61
pop ecx
lea ecx, [ebp - 0x1134]
call fcn.10020d4d
jmp 0x1001b9dd
jmp 0x1001b9b7
jmp 0x1001b991
jmp 0x1001b96b
push 0x87c
call dword [sym.imp.USER32.dll_HideCaret]
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0xa78], 0
mov dword [ebp - 4], 0x20
cmp dword [ebp - 0x6ac], 0x4653
jge 0x1001baa2
push dword [ebp - 0xc60]
call fcn.1005fa61
pop ecx
jmp 0x1001babe
or dword [ebp - 4], 0xffffffff
jmp 0x1001bac8
mov dword [ebp - 0xf40], 0
mov byte [ebp - 0x16e], 0
movzx eax, byte [ebp - 0x16e]
test eax, eax
je 0x1001baef
push 0x1132
call dword [sym.imp.GDI32.dll_SaveDC]
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1001bb0b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea eax, [ebp - 0xa78]
push eax
lea ecx, [ebp - 0x114c]
call fcn.10021410
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0xafc]
mov dword [ebp - 0xc04], eax
mov dword [ebp - 4], 0x22
mov edx, dword [ebp - 0x92c]
mov ecx, dword [ebp - 0xc04]
call fcn.1000a92d
mov dword [0x1068152c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114c]
call fcn.10021433
mov dword [ebp - 0x134], 0x3638ecf5
mov dword [ebp - 0x28], 0x6182eac4
mov dword [ebp - 0x414], 0xffffffff
push 3
lea ecx, [ebp - 0x3e8]
call fcn.100214a3
mov dword [ebp - 4], 0x23
mov dword [ebp - 0x85c], 0x7b09b37d
mov dword [ebp - 0x6cc], 0xec1fcc8a
mov dword [ebp - 0x35c], 0
jmp 0x1001bbb7
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 3
jge 0x1001bbd9
push dword [ebp - 0x35c]
lea ecx, [ebp - 0x3e8]
call fcn.10021541
mov dword [eax], 1
jmp 0x1001bbaa
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 0x28]
jg 0x1001bbf9
mov dword [ebp - 0x6b4], 1
jmp 0x1001bc00
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x28], 2
jmp 0x1001bc1c
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1001be8c
mov dword [ebp - 0xc3c], 0x3a7221eb
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3e8]
call fcn.10021541
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3e8]
call fcn.10021541
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3e8]
call fcn.10021541
cmp dword [ebp - 0x85c], 0xa01c
jge 0x1001bc78
cmp dword [ebp - 0x85c], 0
jne 0x1001bc78
and dword [ebp - 0x6bc], 0
jmp 0x1001bc82
mov dword [ebp - 0x6bc], 1
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3e8]
call fcn.10021541
mov ecx, dword [ebp - 0x6bc]
cmp ecx, dword [eax]
jg 0x1001bca6
mov dword [ebp - 0x9b8], 1
jmp 0x1001bcad
and dword [ebp - 0x9b8], 0
imul esi, dword [ebp - 0x9b8], 3
push 2
lea ecx, [ebp - 0x3e8]
call fcn.10021541
imul esi, dword [eax]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3e8]
call fcn.10021541
cmp esi, dword [eax]
je 0x1001bce2
mov dword [ebp - 0x6c4], 1
jmp 0x1001bce9
and dword [ebp - 0x6c4], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3e8]
call fcn.10021541
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6c4]
jg 0x1001bd0d
mov dword [ebp - 0x864], 1
jmp 0x1001bd14
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0x6cc], eax
mov esi, dword [ebp - 0x6cc]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3e8]
call fcn.10021541
cmp esi, dword [eax]
jge 0x1001bd44
mov dword [ebp - 0x934], 1
jmp 0x1001bd4b
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x414], eax
or eax, 0xffffffff
add eax, 0x77ae2718
cmp eax, 0xfff7
ja 0x1001bd72
mov dword [ebp - 0x6d4], 1
jmp 0x1001bd79
and dword [ebp - 0x6d4], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3e8]
call fcn.10021541
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6d4]
je 0x1001bd9d
mov dword [ebp - 0xb08], 1
jmp 0x1001bda4
and dword [ebp - 0xb08], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3e8]
call fcn.10021541
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3e8]
call fcn.10021541
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0xc3c], eax
mov byte [ebp - 0x17f], 0
movzx eax, byte [ebp - 0x17f]
test eax, eax
je 0x1001bdec
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x134], 0
jmp 0x1001be05
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 2
jg 0x1001be87
mov dword [ebp - 0x86c], 0
cmp dword [ebp - 0x86c], 0
je 0x1001be36
cmp dword [ebp - 0x86c], 0
je 0x1001be36
mov dword [ebp - 0x6dc], 1
jmp 0x1001be3d
and dword [ebp - 0x6dc], 0
cmp dword [ebp - 0x6dc], 0x36ea
jge 0x1001be55
mov dword [ebp - 0x99c], 1
jmp 0x1001be5c
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0x414], eax
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1001be82
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
jmp 0x1001bdf8
jmp 0x1001bc15
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3e8]
call fcn.10021525
and dword [ebp - 0x364], 0
jmp 0x1001beb1
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0xf
jae 0x1001bf5a
mov dword [ebp - 0x1e8], 0x7d8a8701
mov dword [ebp - 0x39c], 0
jmp 0x1001bee1
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 2
jge 0x1001befd
mov eax, dword [ebp - 0x39c]
mov dword [ebp + eax*4 - 0xee8], 2
jmp 0x1001bed4
mov dword [ebp - 0x1e8], 0
jmp 0x1001bf16
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jg 0x1001bf47
mov dword [ebp - 0xb14], 0x3ff8
mov dword [ebp - 0xb14], 1
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp + eax*4 - 0xee8], 0
je 0x1001bf45
jmp 0x1001bf09
jmp 0x1001bf09
mov eax, dword [ebp - 0x364]
mov byte [ebp + eax - 0xa78], 0
jmp 0x1001bea4
mov dword [ebp - 0x54], 0
mov dword [ebp - 0xc70], 0x38d06721
mov dword [ebp - 0x3bc], 0
jmp 0x1001bf84
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 4
jge 0x1001bfa0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp + eax*4 - 0xf6c], 1
jmp 0x1001bf77
imul eax, dword [ebp - 0x54], 0xffffffff
test eax, eax
je 0x1001c140
mov dword [ebp - 0xb20], 1
mov dword [ebp - 0x93c], 1
mov dword [ebp - 0x704], 1
mov dword [ebp - 0x54], 0
jmp 0x1001bfda
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jg 0x1001c13e
mov dword [ebp - 0x47c], 0xffffffff
cmp dword [ebp - 0x47c], 0
jne 0x1001c010
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf6c], 0
jne 0x1001c010
and dword [ebp - 0x6e4], 0
jmp 0x1001c01a
mov dword [ebp - 0x6e4], 1
cmp dword [ebp - 0x47c], 0xffff
jb 0x1001c032
mov dword [ebp - 0x874], 1
jmp 0x1001c039
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x6e4]
imul eax, dword [ebp - 0x874]
cmp eax, 0xffffffff
jbe 0x1001c057
mov dword [ebp - 0x6ec], 1
jmp 0x1001c05e
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x93c]
cmp dword [ebp - 0x6ec], eax
jne 0x1001c078
mov dword [ebp - 0xc0c], 1
jmp 0x1001c07f
and dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 0x93c]
mov dword [ebp - 0xf48], eax
cmp dword [ebp - 0x54], 0
jne 0x1001c0aa
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf6c], 0
jne 0x1001c0aa
and dword [ebp - 0x6f4], 0
jmp 0x1001c0b4
mov dword [ebp - 0x6f4], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf6c]
cmp dword [ebp - 0x6f4], eax
jge 0x1001c0d5
mov dword [ebp - 0x87c], 1
jmp 0x1001c0dc
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0xb20]
add eax, dword [ebp - 0x87c]
cmp eax, dword [ebp - 0xc70]
je 0x1001c105
cmp dword [ebp - 0x704], 0
je 0x1001c105
mov dword [ebp - 0x6fc], 1
jmp 0x1001c10c
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x47c]
cmp dword [ebp - 0x6fc], eax
jl 0x1001c126
mov dword [ebp - 0x9c0], 1
jmp 0x1001c12d
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 0x9c0]
mov dword [ebp - 0x704], eax
jmp 0x1001bfd3
jmp 0x1001c154
mov dword [ebp - 0xb2c], 0x22d5
mov dword [ebp - 0xb2c], 0x95f7626a
mov dword [ebp - 0x54], 0
jmp 0x1001c164
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jg 0x1001c181
mov dword [ebp - 0xc14], 1
cmp dword [ebp - 0xc14], 0
je 0x1001c17f
jmp 0x1001c181
jmp 0x1001c15d
mov eax, dword [0x1061f8fc]
cmp eax, dword [ebp - 0x318]
je 0x1001c19f
mov eax, dword [0x1068152c]
cmp eax, dword [ebp - 0x318]
jne 0x1001c882
mov dword [ebp - 0x14], 0xa48bbca6
mov dword [ebp - 0x1f0], 0xffffffff
mov dword [ebp - 0x41c], 0xfffffffa
mov dword [ebp - 0x14], 0
jmp 0x1001c1ca
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffe3
jne 0x1001c1e7
mov dword [ebp - 0xb34], 0x4b4e1265
cmp dword [ebp - 0xb34], 0
je 0x1001c1e5
jmp 0x1001c1e7
jmp 0x1001c1c3
cmp dword [ebp - 0x14], 0x7e4a
jg 0x1001c1fc
mov dword [ebp - 0x498], 1
jmp 0x1001c203
and dword [ebp - 0x498], 0
cmp dword [ebp - 0x14], 0xfdda
je 0x1001c218
mov dword [ebp - 0x884], 1
jmp 0x1001c21f
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x884]
sub eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jge 0x1001c242
mov dword [ebp - 0x70c], 1
jmp 0x1001c249
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x70c], eax
jl 0x1001c260
mov dword [ebp - 0x944], 1
jmp 0x1001c267
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0x944]
sub eax, dword [ebp - 0x14]
cmp eax, 1
jl 0x1001c281
mov dword [ebp - 0x88c], 1
jmp 0x1001c288
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x498]
add eax, dword [ebp - 0x88c]
cmp eax, 0xfffffffe
je 0x1001c2a5
mov dword [ebp - 0xc44], 1
jmp 0x1001c2ac
and dword [ebp - 0xc44], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf50], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jl 0x1001c2c9
mov dword [ebp - 0x71c], 1
jmp 0x1001c2d0
and dword [ebp - 0x71c], 0
cmp dword [ebp - 0x71c], 0xffffffff
je 0x1001c2e5
mov dword [ebp - 0x9a4], 1
jmp 0x1001c2ec
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1f0]
jg 0x1001c310
xor eax, eax
jne 0x1001c310
and dword [ebp - 0xb3c], 0
jmp 0x1001c31a
mov dword [ebp - 0xb3c], 1
cmp dword [ebp - 0x41c], 0
jne 0x1001c360
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1001c33f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov byte [ebp - 0x17d], 0
movzx eax, byte [ebp - 0x17d]
test eax, eax
je 0x1001c35b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x1001c86a
mov dword [ebp - 0xcc], 1
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x1c0], 0xf4d0c653
push 3
lea ecx, [ebp - 0xbe8]
call fcn.100214a3
mov dword [ebp - 4], 0x24
mov dword [ebp - 0x36c], 0
jmp 0x1001c3ab
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 3
jge 0x1001c3cd
push dword [ebp - 0x36c]
lea ecx, [ebp - 0xbe8]
call fcn.10021541
mov dword [eax], 1
jmp 0x1001c39e
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x724], eax
push 1
lea ecx, [ebp - 0xbe8]
call fcn.10021541
mov ecx, dword [ebp - 0x724]
mov dword [eax], ecx
cmp dword [ebp - 0x724], 0
jne 0x1001c41b
mov dword [ebp - 0x734], 1
jmp 0x1001c422
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0xf58], eax
imul eax, dword [ebp - 0x14], 3
add eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x1f0]
jg 0x1001c44c
mov dword [ebp - 0x894], 1
jmp 0x1001c453
and dword [ebp - 0x894], 0
imul eax, dword [ebp - 0x894], 0x1450
test eax, eax
jbe 0x1001c46d
mov dword [ebp - 0x72c], 1
jmp 0x1001c474
and dword [ebp - 0x72c], 0
imul eax, dword [ebp - 0x72c], 0xe0ec
cmp eax, 0xa412
jge 0x1001c491
mov dword [ebp - 0x94c], 1
jmp 0x1001c498
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0xcc]
imul eax, dword [ebp - 0x94c]
cmp dword [ebp - 0x734], eax
jl 0x1001c4b9
mov dword [ebp - 0x89c], 1
jmp 0x1001c4c0
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x89c]
neg eax
cmp eax, dword [ebp - 0x14]
je 0x1001c4d9
mov dword [ebp - 0x73c], 1
jmp 0x1001c4e0
and dword [ebp - 0x73c], 0
cmp dword [ebp - 0x73c], 0xffffffff
jle 0x1001c4f5
mov dword [ebp - 0x9c8], 1
jmp 0x1001c4fc
and dword [ebp - 0x9c8], 0
cmp dword [ebp - 0x9c8], 1
jne 0x1001c511
mov dword [ebp - 0x744], 1
jmp 0x1001c518
and dword [ebp - 0x744], 0
imul eax, dword [ebp - 0x744], 0xbdb6
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xcc], 0xd
jmp 0x1001c53e
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xffffffee
jl 0x1001c85b
mov dword [ebp - 0x1f8], 0x949e3b93
mov dword [ebp - 0x1c0], 0x1b
jmp 0x1001c56e
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 8
jle 0x1001c856
mov dword [ebp - 0xc68], 0xffffffff
mov dword [ebp - 0x3a4], 0
jmp 0x1001c59e
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 4
jge 0x1001c5ba
mov eax, dword [ebp - 0x3a4]
mov dword [ebp + eax*4 - 0xf80], 0x66c3c348
jmp 0x1001c591
push 1
lea ecx, [ebp - 0xbe8]
call fcn.10021541
cmp dword [eax], 0xffffffff
jne 0x1001c5d8
mov dword [ebp - 0x764], 1
jmp 0x1001c5df
and dword [ebp - 0x764], 0
push 4
pop eax
shl eax, 1
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax - 0xf80]
cmp ecx, dword [ebp - 0x27c]
jle 0x1001c602
mov dword [ebp - 0x8a4], 1
jmp 0x1001c609
and dword [ebp - 0x8a4], 0
mov esi, dword [ebp - 0x8a4]
neg esi
push 1
lea ecx, [ebp - 0xbe8]
call fcn.10021541
cmp esi, dword [eax]
jne 0x1001c62e
mov dword [ebp - 0xc1c], 1
jmp 0x1001c635
and dword [ebp - 0xc1c], 0
mov dword [ebp - 0x1f0], 0x1bd9f019
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0xf9c], eax
cmp dword [ebp - 0xcc], 1
jge 0x1001c666
mov eax, 0xfff7
test eax, eax
jne 0x1001c666
and dword [ebp - 0x74c], 0
jmp 0x1001c670
mov dword [ebp - 0x74c], 1
mov eax, dword [ebp - 0x1f8]
imul eax, dword [ebp - 0x74c]
cmp eax, dword [ebp - 0x1f8]
jle 0x1001c691
mov dword [ebp - 0x954], 1
jmp 0x1001c698
and dword [ebp - 0x954], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf80]
cmp dword [ebp - 0x954], eax
jl 0x1001c6b8
mov dword [ebp - 0x754], 1
jmp 0x1001c6bf
and dword [ebp - 0x754], 0
cmp dword [ebp - 0x754], 0xf1cc
jle 0x1001c6d7
mov dword [ebp - 0x8ac], 1
jmp 0x1001c6de
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x8ac]
dec eax
je 0x1001c6fc
mov eax, 0x8462c7dc
test eax, eax
je 0x1001c6fc
mov dword [ebp - 0x75c], 1
jmp 0x1001c703
and dword [ebp - 0x75c], 0
cmp dword [ebp - 0x75c], 0xfffffff9
jb 0x1001c718
mov dword [ebp - 0x9b4], 1
jmp 0x1001c71f
and dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x9b4]
je 0x1001c736
mov dword [ebp - 0x8b4], 1
jmp 0x1001c73d
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x764]
cmp eax, dword [ebp - 0x8b4]
jl 0x1001c757
mov dword [ebp - 0x76c], 1
jmp 0x1001c75e
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x41c]
cmp dword [ebp - 0x76c], eax
jle 0x1001c778
mov dword [ebp - 0x95c], 1
jmp 0x1001c77f
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x95c], eax
jl 0x1001c796
mov dword [ebp - 0x774], 1
jmp 0x1001c79d
and dword [ebp - 0x774], 0
cmp dword [ebp - 0x774], 0x224f
jg 0x1001c7b5
mov dword [ebp - 0x8bc], 1
jmp 0x1001c7bc
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x8bc]
je 0x1001c7ce
cmp dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x27c]
cmp eax, dword [ebp - 0x1f8]
jg 0x1001c7e8
mov dword [ebp - 0x77c], 1
jmp 0x1001c7ef
and dword [ebp - 0x77c], 0
cmp dword [ebp - 0x77c], 0xe77d
je 0x1001c807
mov dword [ebp - 0x9d0], 1
jmp 0x1001c80e
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0x9d0], eax
jne 0x1001c828
mov dword [ebp - 0xb44], 1
jmp 0x1001c82f
and dword [ebp - 0xb44], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xfa4], eax
mov dword [ebp - 0x14], 2
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf80]
mov dword [ebp - 0xc68], eax
jmp 0x1001c561
jmp 0x1001c531
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbe8]
call fcn.10021525
mov ecx, dword [ebp + 0xc]
call fcn.10020d7c
push eax
push dword [ebp + 8]
call fcn.10012965
pop ecx
pop ecx
jmp 0x1001fe0f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x200], 4
mov dword [ebp - 0x200], 0
jmp 0x1001c8ae
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0xb
jle 0x1001ca05
mov dword [ebp - 0xd4], 0xeede0b40
mov dword [ebp - 0xd4], 0xffffffe2
jmp 0x1001c8de
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x13
jg 0x1001ca00
mov dword [ebp - 0x208], 0x2cf4
mov dword [ebp - 0x964], 0xfffffff8
mov dword [ebp - 0xc24], 1
mov eax, dword [ebp - 0xd4]
imul eax, dword [ebp - 0x200]
cmp eax, 0xc8210466
ja 0x1001c929
mov dword [ebp - 0x784], 1
jmp 0x1001c930
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x208]
cmp eax, dword [ebp - 0x784]
je 0x1001c94a
mov dword [ebp - 0xb4c], 1
jmp 0x1001c951
and dword [ebp - 0xb4c], 0
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x208]
jne 0x1001c96b
mov dword [ebp - 0x8c4], 1
jmp 0x1001c972
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x208]
cmp eax, dword [ebp - 0x8c4]
jg 0x1001c98c
mov dword [ebp - 0x78c], 1
jmp 0x1001c993
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0x964], eax
cmp dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x208]
cmp eax, dword [ebp - 0xd4]
jg 0x1001c9c0
mov dword [ebp - 0x794], 1
jmp 0x1001c9c7
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x794], eax
jle 0x1001c9e1
mov dword [ebp - 0x8cc], 1
jmp 0x1001c9e8
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x208]
imul eax, dword [ebp - 0x8cc]
mov dword [ebp - 0xc24], eax
jmp 0x1001c8d1
jmp 0x1001c8a1
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1001ca23
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp dword [ebp - 0x280], 0
je 0x1001fe0d
mov eax, dword [ebp - 0x280]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1001fe0d
mov dword [ebp - 0x210], 4
mov dword [ebp - 0xccc], 0xedb5cabf
mov dword [ebp - 0xcc8], 0xedb5cabf
mov dword [ebp - 0xcc4], 0xedb5cabf
mov dword [ebp - 0xcc0], 0xedb5cabf
lea ecx, [ebp - 0x435]
call fcn.10021550
push eax
lea eax, [ebp - 0xcbc]
push eax
lea eax, [ebp - 0xccc]
push eax
lea ecx, [ebp - 0x10cc]
call fcn.10021636
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd74]
call fcn.100214ff
mov dword [ebp - 4], 0x25
push 3
lea ecx, [ebp - 0xa50]
call fcn.100214a3
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x8c], 0
jmp 0x1001cae6
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x1001cb05
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xa50]
call fcn.10021541
and dword [eax], 0
jmp 0x1001cad9
mov dword [ebp - 0x8c], 0
jmp 0x1001cb1e
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1001cb3a
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xeac], 0xffffffff
jmp 0x1001cb11
cmp dword [ebp - 0x210], 0
jne 0x1001cb55
cmp dword [ebp - 0x210], 0
je 0x1001cb55
and dword [ebp - 0xb54], 0
jmp 0x1001cb5f
mov dword [ebp - 0xb54], 1
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0xfac], eax
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0xfb4], eax
push 0
lea ecx, [ebp - 0xa50]
call fcn.10021541
mov dword [ebp - 0x79c], eax
push 0
lea ecx, [ebp - 0xd74]
call fcn.10021541
mov ecx, dword [ebp - 0x79c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x79c]
cmp dword [eax], 0x93e0
jg 0x1001cbbb
mov dword [ebp - 0x9d8], 1
jmp 0x1001cbc2
and dword [ebp - 0x9d8], 0
cmp dword [ebp - 0x9d8], 0xfffb
jb 0x1001ce28
push 3
lea ecx, [ebp - 0xd44]
call fcn.100214a3
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x94], 0
jmp 0x1001cbfc
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x1001cc18
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x218], 3
jmp 0x1001cbef
mov dword [ebp - 0x94], 0
jmp 0x1001cc31
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x1001cc53
push dword [ebp - 0x94]
lea ecx, [ebp - 0xd44]
call fcn.10021541
mov dword [eax], 0xfffffffb
jmp 0x1001cc24
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x1001cdfd
mov esi, 0xb608
sub esi, dword [ebp - 0x210]
push 0
lea ecx, [ebp - 0xa50]
call fcn.10021541
cmp esi, dword [eax]
jg 0x1001cc86
mov dword [ebp - 0x540], 1
jmp 0x1001cc8d
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x540]
sub eax, 0x6261e884
cmp eax, 0xfffffff7
jbe 0x1001ccaa
push 0
lea ecx, [ebp - 0xa50]
call fcn.10021541
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x218]
mov dword [ebp - 0x548], eax
push 1
lea ecx, [ebp - 0xd44]
call fcn.10021541
mov ecx, dword [ebp - 0x548]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x218]
cmp dword [ebp - 0x548], eax
jle 0x1001ccf3
mov dword [ebp - 0x450], 1
jmp 0x1001ccfa
and dword [ebp - 0x450], 0
push 2
lea ecx, [ebp - 0xa50]
call fcn.10021541
mov ecx, dword [ebp - 0x450]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x218]
cmp eax, dword [ebp - 0x450]
jl 0x1001cd30
mov dword [ebp - 0x550], 1
jmp 0x1001cd37
and dword [ebp - 0x550], 0
push 0
lea ecx, [ebp - 0xd74]
call fcn.10021541
mov eax, dword [eax]
cmp eax, dword [ebp - 0x550]
jg 0x1001cd5a
mov dword [ebp - 0x558], 1
jmp 0x1001cd61
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xb63e91cb
jbe 0x1001cd85
mov dword [ebp - 0x560], 1
jmp 0x1001cd8c
and dword [ebp - 0x560], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x218]
cmp eax, dword [ebp - 0x560]
jle 0x1001cdb3
cmp dword [ebp - 0x424], 0
jne 0x1001cdb3
and dword [ebp - 0x568], 0
jmp 0x1001cdbd
mov dword [ebp - 0x568], 1
cmp dword [ebp - 0x568], 0x9b95520f
jbe 0x1001cdd5
mov dword [ebp - 0x570], 1
jmp 0x1001cddc
and dword [ebp - 0x570], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x218]
add eax, dword [ebp - 0x570]
je 0x1001cdfd
mov dword [ebp - 0x578], 1
jmp 0x1001ce04
and dword [ebp - 0x578], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x578]
mov dword [ebp + eax - 0xeac], ecx
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xd44]
call fcn.10021525
jmp 0x1001ce40
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x1001ce40
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov byte [ebp - 0x170], 0
movzx eax, byte [ebp - 0x170]
test eax, eax
je 0x1001ce5d
push 0xebc
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xa50]
call fcn.10021525
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd74]
call fcn.10021525
mov eax, dword [ebp - 0x280]
mov ecx, dword [ebp - 0x280]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1e4], ecx
mov dword [ebp - 0xcf4], 0x713b9102
mov dword [ebp - 0xcf0], 0x713b9102
mov dword [ebp - 0xcec], 0x713b9102
mov dword [ebp - 0xce8], 0x713b9102
lea ecx, [ebp - 0x451]
call fcn.10021550
push eax
lea eax, [ebp - 0xce4]
push eax
lea eax, [ebp - 0xcf4]
push eax
lea ecx, [ebp - 0x105c]
call fcn.10021636
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe80]
call fcn.100214ff
mov dword [ebp - 4], 0x28
mov dword [ebp - 0xc4c], 1
mov dword [ebp - 0x288], 0
jmp 0x1001cf17
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 1
jge 0x1001cf33
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0x1b0], 1
jmp 0x1001cf0a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1b0], 0
jmp 0x1001cf61
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1b0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1b0], 3
jg 0x1001cfda
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x1b0]
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1b0]
lea ecx, [ebp - 0xe80]
call fcn.10021541
cmp dword [eax], esi
jge 0x1001cfa6
mov dword [ebp - 0x580], 1
jmp 0x1001cfad
and dword [ebp - 0x580], 0
cmp dword [ebp - 0x580], 0xfffffff8
jle 0x1001cfc2
mov dword [ebp - 0x588], 1
jmp 0x1001cfc9
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0xc4c], eax
jmp 0x1001cf46
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe80]
call fcn.10021525
mov eax, dword [ebp - 0x1e4]
cmp dword [eax], 0x4550
jne 0x1001fe0d
mov eax, dword [ebp - 0x1e4]
cmp dword [eax + 0x74], 0
jbe 0x1001fe0d
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e4]
cmp dword [ecx + eax + 0x78], 0
je 0x1001fe0d
mov dword [ebp - 0xfbc], 0x64a6847d
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1001d048
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
mov byte [ebp - 0x172], 0
movzx eax, byte [ebp - 0x172]
test eax, eax
je 0x1001d06c
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x18c], 1
mov dword [ebp - 0x610], 0xfffffffd
mov dword [ebp - 0xfc4], 5
mov dword [ebp - 0xfcc], 8
mov dword [ebp - 0xf94], 1
mov dword [ebp - 0xf90], 1
mov dword [ebp - 0xf8c], 1
mov dword [ebp - 0xf88], 1
mov dword [ebp - 0xf14], 0x871eb1c2
mov dword [ebp - 0xec0], 0xfffffffc
mov dword [ebp - 0xdc0], 0xb650
mov dword [ebp - 0xdcc], 0xfffffffd
mov dword [ebp - 0x620], 5
mov dword [ebp - 0x18c], 0xfffffff3
jmp 0x1001d110
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0xffffffe7
jge 0x1001d536
push 1
lea ecx, [ebp - 0x9b0]
call fcn.100214a3
mov dword [ebp - 4], 0x29
mov dword [ebp - 0x458], 0xfffffff7
mov dword [ebp - 0x608], 0x33b8fba3
mov dword [ebp - 0xb64], 0xfffffffd
mov dword [ebp - 0x290], 0
jmp 0x1001d168
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 1
jge 0x1001d18a
push dword [ebp - 0x290]
lea ecx, [ebp - 0x9b0]
call fcn.10021541
mov dword [eax], 0xdb22124f
jmp 0x1001d15b
push 0
lea ecx, [ebp - 0x9b0]
call fcn.10021541
mov dword [eax], 0xffffffeb
jmp 0x1001d1c3
push 0
lea ecx, [ebp - 0x9b0]
call fcn.10021541
mov dword [ebp - 0x590], eax
mov eax, dword [ebp - 0x590]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x590]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x9b0]
call fcn.10021541
cmp dword [eax], 0xffffffea
jg 0x1001d522
mov dword [ebp - 0x13c], 0x70cd5099
push 3
lea ecx, [ebp - 0xe90]
call fcn.100214a3
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x298], 0
jmp 0x1001d20d
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 3
jge 0x1001d22f
push dword [ebp - 0x298]
lea ecx, [ebp - 0xe90]
call fcn.10021541
mov dword [eax], 1
jmp 0x1001d200
mov dword [ebp - 0x13c], 0
jmp 0x1001d248
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x1a
jl 0x1001d50e
mov dword [ebp - 0x42c], 0x3847d228
mov dword [ebp - 0x470], 0x411d7fea
mov dword [ebp - 0x5f0], 0xfffffffe
mov dword [ebp - 0xc2c], 0x79116971
cmp dword [ebp - 0x42c], 0x90350d8a
jbe 0x1001d29e
mov eax, 0x58ef
test eax, eax
je 0x1001d29e
mov dword [ebp - 0x598], 1
jmp 0x1001d2a5
and dword [ebp - 0x598], 0
mov eax, 0xf23e5250
sub eax, dword [ebp - 0x598]
cmp eax, 0x3e80c654
jge 0x1001d2c3
mov dword [ebp - 0x5a0], 1
jmp 0x1001d2ca
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x18c]
cmp eax, dword [ebp - 0x458]
jne 0x1001d2fc
mov dword [ebp - 0x5a8], 1
jmp 0x1001d303
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x5a8]
add eax, 0xe
cmp eax, 0x67e6aa16
je 0x1001d31f
mov dword [ebp - 0x5b0], 1
jmp 0x1001d326
and dword [ebp - 0x5b0], 0
push 0
lea ecx, [ebp - 0x9b0]
call fcn.10021541
mov ecx, dword [ebp - 0x5b0]
sub ecx, dword [eax]
jne 0x1001d349
mov dword [ebp - 0xb5c], 1
jmp 0x1001d350
and dword [ebp - 0xb5c], 0
push 4
pop eax
imul eax, eax, 0x7617
test eax, eax
je 0x1001d385
mov dword [ebp - 0x5b8], 0
imul eax, dword [ebp - 0x13c], 0xfff8
mov dword [ebp - 0x5b8], eax
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0x470], eax
jmp 0x1001d39c
mov dword [ebp - 0x5c0], 0x4e78
mov eax, dword [ebp - 0x5c0]
inc eax
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0xc2c], 0
jne 0x1001d482
mov eax, dword [ebp - 0x13c]
neg eax
cmp eax, 4
jge 0x1001d3c2
mov dword [ebp - 0x5d0], 1
jmp 0x1001d3c9
and dword [ebp - 0x5d0], 0
mov esi, dword [ebp - 0x13c]
inc esi
push 0
lea ecx, [ebp - 0x9b0]
call fcn.10021541
cmp esi, dword [eax]
jge 0x1001d3ed
mov dword [ebp - 0x5c8], 1
jmp 0x1001d3f4
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x42c]
cmp dword [ebp - 0x5c8], eax
jg 0x1001d40e
mov dword [ebp - 0x5d8], 1
jmp 0x1001d415
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x5d0]
cmp eax, dword [ebp - 0x5d8]
je 0x1001d42f
mov dword [ebp - 0x5e0], 1
jmp 0x1001d436
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x5e0], eax
jne 0x1001d450
mov dword [ebp - 0x5e8], 1
jmp 0x1001d457
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x5e8]
lea eax, [ecx + eax + 0x61ec5c5f]
mov dword [ebp - 0x458], eax
mov eax, 0xa04d97f6
test eax, eax
jne 0x1001d482
and dword [ebp - 0x5f8], 0
jmp 0x1001d48c
mov dword [ebp - 0x5f8], 1
mov dword [ebp - 0x5f0], 0xfffffff7
mov eax, dword [ebp - 0x5f0]
cmp eax, dword [ebp - 0x5f8]
jl 0x1001d4b0
mov dword [ebp - 0x600], 1
jmp 0x1001d4b7
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0x608], eax
mov esi, dword [ebp - 0x608]
push 0
lea ecx, [ebp - 0x9b0]
call fcn.10021541
add esi, dword [eax]
mov dword [ebp - 0x610], esi
jne 0x1001d4ee
or eax, 0xffffffff
jne 0x1001d4ee
and dword [ebp - 0x618], 0
jmp 0x1001d4f8
mov dword [ebp - 0x618], 1
mov eax, dword [ebp - 0x618]
sub eax, 0xfffe
mov dword [ebp - 0xb64], eax
jmp 0x1001d23b
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0xe90]
call fcn.10021525
jmp 0x1001d19f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9b0]
call fcn.10021525
jmp 0x1001d103
mov eax, dword [ebp - 0x620]
dec eax
mov dword [ebp - 0x620], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e4]
mov edx, dword [ebp - 0x1c4]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xf4], edx
mov dword [ebp - 0xa4], 0xec01e6e2
mov dword [ebp - 0x1c], 0x7279c90e
mov dword [ebp - 0xdc], 9
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0xce0], 0x94bf7d6
mov dword [ebp - 0xcdc], 0x94bf7d6
mov dword [ebp - 0xcd8], 0x94bf7d6
mov dword [ebp - 0xcd4], 0x94bf7d6
lea ecx, [ebp - 0x43d]
call fcn.10021550
push eax
lea eax, [ebp - 0xcd0]
push eax
lea eax, [ebp - 0xce0]
push eax
lea ecx, [ebp - 0x10f4]
call fcn.10021636
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xca0]
call fcn.100214ff
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x7c], 0x1717c264
mov dword [ebp - 0x3f0], 0
mov dword [ebp - 0x700], 3
mov dword [ebp - 0x9c], 0
jmp 0x1001d61c
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x1001d638
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x194], 0x1791e6e4
jmp 0x1001d60f
mov dword [ebp - 0x9c], 0
jmp 0x1001d651
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jge 0x1001d66d
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x258], 0x9118158f
jmp 0x1001d644
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xf20], eax
mov eax, dword [ebp - 0xa4]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x194], eax
cmp dword [ebp - 0xa4], 0
jne 0x1001d6ae
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x194], 0
jne 0x1001d6ae
and dword [ebp - 0x628], 0
jmp 0x1001d6b8
mov dword [ebp - 0x628], 1
mov eax, dword [ebp - 0xa4]
imul eax, dword [ebp - 0x628]
cmp eax, 1
jbe 0x1001d6de
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x1001d6de
xor eax, eax
jne 0x1001d6de
and dword [ebp - 0x630], 0
jmp 0x1001d6e8
mov dword [ebp - 0x630], 1
cmp dword [ebp - 0x630], 0xfffffffa
jae 0x1001d6fd
mov dword [ebp - 0x638], 1
jmp 0x1001d704
and dword [ebp - 0x638], 0
cmp dword [ebp - 0x638], 0x8b922806
ja 0x1001d72b
cmp dword [ebp - 0x1c], 0
je 0x1001d72b
cmp dword [ebp - 0xdc], 0
je 0x1001d72b
mov dword [ebp - 0x640], 1
jmp 0x1001d732
and dword [ebp - 0x640], 0
cmp dword [ebp - 0x640], 4
jge 0x1001d747
mov dword [ebp - 0x648], 1
jmp 0x1001d74e
and dword [ebp - 0x648], 0
cmp dword [ebp - 0x648], 0xa296
jge 0x1001d766
mov dword [ebp - 0x650], 1
jmp 0x1001d76d
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x650]
jle 0x1001d794
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x194], 0
jne 0x1001d794
and dword [ebp - 0x658], 0
jmp 0x1001d79e
mov dword [ebp - 0x658], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x658], eax
jne 0x1001d7b5
mov dword [ebp - 0x660], 1
jmp 0x1001d7bc
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x660]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x668], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x668]
mov dword [ebp + eax - 0x258], ecx
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x668]
jg 0x1001d801
mov dword [ebp - 0x670], 1
jmp 0x1001d808
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x670], eax
jg 0x1001d81f
mov dword [ebp - 0x678], 1
jmp 0x1001d826
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x678], eax
jl 0x1001d849
cmp dword [ebp - 0xdc], 0
je 0x1001d849
mov dword [ebp - 0x680], 1
jmp 0x1001d850
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x680]
dec eax
cmp eax, dword [ebp - 0xdc]
jge 0x1001d86b
mov dword [ebp - 0x688], 1
jmp 0x1001d872
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x688], eax
jg 0x1001d88c
mov dword [ebp - 0x690], 1
jmp 0x1001d893
and dword [ebp - 0x690], 0
cmp dword [ebp - 0x690], 0
je 0x1001d8ad
or eax, 0xffffffff
je 0x1001d8ad
mov dword [ebp - 0xc78], 1
jmp 0x1001d8b4
and dword [ebp - 0xc78], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xdd4], eax
cmp dword [ebp - 0xa4], 0x6a25
jge 0x1001d8d8
mov dword [ebp - 0x698], 1
jmp 0x1001d8df
and dword [ebp - 0x698], 0
push 0
lea ecx, [ebp - 0xca0]
call fcn.10021541
mov ecx, dword [ebp - 0x698]
cmp ecx, dword [eax]
je 0x1001d902
mov dword [ebp - 0x6a0], 1
jmp 0x1001d909
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xf28], eax
cmp dword [ebp - 0x14c], 0xb9d6240
jge 0x1001d92b
cmp dword [ebp - 0x7c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x258]
cmp eax, dword [ebp - 0xa4]
je 0x1001d94c
mov dword [ebp - 0x6a8], 1
jmp 0x1001d953
and dword [ebp - 0x6a8], 0
push 0
lea ecx, [ebp - 0xca0]
call fcn.10021541
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6a8]
jg 0x1001d976
mov dword [ebp - 0x6b0], 1
jmp 0x1001d97d
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x14c]
imul eax, dword [ebp - 0x6b0]
mov ecx, dword [ebp - 0x3f0]
sub ecx, eax
je 0x1001db67
mov dword [ebp - 0x144], 0xff98e47b
mov dword [ebp - 0x220], 0x7725eff8
mov dword [ebp - 0xbf0], 0
cmp dword [ebp - 0x144], 0
jne 0x1001dabb
cmp dword [ebp - 0x220], 0
je 0x1001d9e1
cmp dword [ebp - 0xa4], 0
je 0x1001d9e1
mov dword [ebp - 0x6b8], 1
jmp 0x1001d9e8
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x6b8], eax
je 0x1001da02
mov dword [ebp - 0x6c0], 1
jmp 0x1001da09
and dword [ebp - 0x6c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x194]
cmp dword [ebp - 0x6c0], eax
jle 0x1001da2a
mov dword [ebp - 0x6c8], 1
jmp 0x1001da31
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x6c8], eax
jle 0x1001da4b
mov dword [ebp - 0x6d0], 1
jmp 0x1001da52
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x144]
cmp eax, dword [ebp - 0x6d0]
jge 0x1001da69
cmp dword [ebp - 0x220], 0
je 0x1001da7e
cmp dword [ebp - 0x220], 0
je 0x1001da7e
mov dword [ebp - 0x6d8], 1
jmp 0x1001da85
and dword [ebp - 0x6d8], 0
cmp dword [ebp - 0x6d8], 0xd0c81cf0
ja 0x1001da9d
mov dword [ebp - 0x6e0], 1
jmp 0x1001daa4
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x6e0], eax
jle 0x1001dabb
and dword [ebp - 0xb6c], 0
jmp 0x1001dac5
mov dword [ebp - 0xb6c], 1
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0xddc], eax
mov eax, dword [ebp - 0xbf0]
mov dword [ebp - 0xf70], eax
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x7c], 0xffffffe3
jmp 0x1001daf7
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 7
jne 0x1001db62
mov dword [ebp - 0xde4], 0x363bf156
mov dword [ebp - 0x144], 0
jmp 0x1001db20
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 3
jg 0x1001db60
mov dword [ebp - 0x6e8], 0x32f891d9
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x1001db51
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [ebp - 0x6e8]
inc eax
mov dword [ebp - 0x6e8], eax
jmp 0x1001db13
jmp 0x1001daf0
jmp 0x1001e002
mov dword [ebp - 0x400], 0x1ab120da
mov dword [ebp - 0xdac], 0x9dd6bbca
mov dword [ebp - 0xda8], 0x9dd6bbca
mov dword [ebp - 0xda4], 0x9dd6bbca
mov dword [ebp - 0xda0], 0x9dd6bbca
mov dword [ebp - 0xbf8], 0xffffffff
mov dword [ebp - 0x3f8], 0xed801979
mov dword [ebp - 0x7a0], 0
mov dword [ebp - 0x2a0], 0
jmp 0x1001dbd0
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 3
jge 0x1001dbec
mov eax, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0xc94], 0xf5e9e648
jmp 0x1001dbc3
mov dword [ebp - 0x1c], 0
jmp 0x1001dbfc
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jg 0x1001dff5
mov dword [ebp - 0x728], 0xd71d57ad
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x194]
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x6f0]
mov dword [ebp + eax*4 - 0x194], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x258]
cmp dword [ebp - 0x6f0], eax
jne 0x1001dc4e
mov dword [ebp - 0xb74], 1
jmp 0x1001dc55
and dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x258], 0
jne 0x1001dc6b
mov eax, 0x4511
test eax, eax
je 0x1001dc80
cmp dword [ebp - 0xdc], 0
je 0x1001dc80
mov dword [ebp - 0x6f8], 1
jmp 0x1001dc87
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 0x1239eb3e
jle 0x1001dcab
mov dword [ebp - 0x708], 1
jmp 0x1001dcb2
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x258]
add eax, dword [ebp - 0x708]
mov dword [ebp - 0x400], eax
je 0x1001dcdf
mov eax, 0x755e
test eax, eax
je 0x1001dcdf
mov dword [ebp - 0x710], 1
jmp 0x1001dce6
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x258]
cmp dword [ebp - 0x710], eax
jge 0x1001dd04
mov dword [ebp - 0x718], 1
jmp 0x1001dd0b
and dword [ebp - 0x718], 0
cmp dword [ebp - 0x718], 0
jne 0x1001dd20
mov dword [ebp - 0x720], 1
jmp 0x1001dd27
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x258]
cmp dword [ebp - 0x720], eax
jg 0x1001dd45
mov dword [ebp - 0x434], 1
jmp 0x1001dd4c
and dword [ebp - 0x434], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x434]
mov dword [ebp + eax - 0xdac], ecx
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x728], eax
cmp dword [ebp - 0x728], 1
jne 0x1001dd80
mov dword [ebp - 0x730], 1
jmp 0x1001dd87
and dword [ebp - 0x730], 0
cmp dword [ebp - 0x730], 0x8cf6
jne 0x1001dd9f
mov dword [ebp - 0x738], 1
jmp 0x1001dda6
and dword [ebp - 0x738], 0
cmp dword [ebp - 0x738], 0xf1449e4c
jbe 0x1001ddbe
mov dword [ebp - 0x740], 1
jmp 0x1001ddc5
and dword [ebp - 0x740], 0
push 0
lea ecx, [ebp - 0xca0]
call fcn.10021541
mov ecx, dword [ebp - 0x740]
cmp ecx, dword [eax]
jle 0x1001ddee
mov eax, 0x3882c1f1
test eax, eax
jne 0x1001ddee
and dword [ebp - 0x748], 0
jmp 0x1001ddf8
mov dword [ebp - 0x748], 1
cmp dword [ebp - 0x748], 0
jl 0x1001de0d
mov dword [ebp - 0x750], 1
jmp 0x1001de14
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x750]
mov dword [ebp - 0xbf8], eax
mov eax, 0x2c121480
cmp eax, 0xfffffffd
ja 0x1001de36
mov dword [ebp - 0x758], 1
jmp 0x1001de3d
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x3f8]
cmp dword [ebp - 0x758], eax
jl 0x1001de57
mov dword [ebp - 0x760], 1
jmp 0x1001de5e
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x1001de79
mov dword [ebp - 0x768], 1
jmp 0x1001de80
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x768]
sub eax, 0x2e6b
test eax, eax
jg 0x1001de9b
mov dword [ebp - 0x770], 1
jmp 0x1001dea2
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0
je 0x1001ded0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x258], 0
je 0x1001ded0
mov dword [ebp - 0x778], 1
jmp 0x1001ded7
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x778]
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x3f8]
cmp eax, dword [ebp - 0x1c]
jge 0x1001defa
mov dword [ebp - 0x780], 1
jmp 0x1001df01
and dword [ebp - 0x780], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc94]
add eax, dword [ebp - 0x780]
cmp eax, 0x1cd9
jne 0x1001df26
mov dword [ebp - 0x788], 1
jmp 0x1001df2d
and dword [ebp - 0x788], 0
cmp dword [ebp - 0x788], 0x21b6
jg 0x1001df45
mov dword [ebp - 0xb7c], 1
jmp 0x1001df4c
and dword [ebp - 0xb7c], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x258]
mov dword [ebp - 0xf1c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc94], 0xfffffff9
je 0x1001df77
mov dword [ebp - 0x790], 1
jmp 0x1001df7e
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x14c]
add eax, dword [ebp - 0x790]
jne 0x1001df98
mov dword [ebp - 0x798], 1
jmp 0x1001df9f
and dword [ebp - 0x798], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc94]
cmp dword [ebp - 0x798], eax
jne 0x1001dfbf
mov dword [ebp - 0xc00], 1
jmp 0x1001dfc6
and dword [ebp - 0xc00], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x258]
mov dword [ebp - 0xdec], eax
mov eax, dword [ebp - 0x400]
imul eax, dword [ebp - 0xdc]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xc94], eax
jmp 0x1001dbf5
mov eax, dword [ebp - 0x7a0]
inc eax
mov dword [ebp - 0x7a0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca0]
call fcn.10021525
mov eax, 0xffff
mov word [ebp - 0xac], ax
mov dword [ebp - 0xfb0], 0
mov byte [ebp - 0x174], 0
movzx eax, byte [ebp - 0x174]
test eax, eax
je 0x1001e044
push 0x1132
call dword [sym.imp.GDI32.dll_SaveDC]
mov byte [ebp - 0x145], 0
movzx eax, byte [ebp - 0x145]
test eax, eax
je 0x1001e060
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
or dword [ebp - 0x1b4], 0xffffffff
push 1
lea ecx, [ebp - 0xa2c]
call fcn.100214a3
mov dword [ebp - 4], 0x2c
mov dword [ebp - 0xdf4], 0xfffffffa
mov dword [ebp - 0xb4], 0
jmp 0x1001e09e
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x1001e0c0
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xa2c]
call fcn.10021541
mov dword [eax], 0x3ae35568
jmp 0x1001e091
mov dword [ebp - 0xb4], 0
jmp 0x1001e0d9
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x1001e0f5
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x11a0], 0x563ffaf0
jmp 0x1001e0cc
push 0
lea ecx, [ebp - 0xa2c]
call fcn.10021541
mov dword [eax], 0x16
jmp 0x1001e12e
push 0
lea ecx, [ebp - 0xa2c]
call fcn.10021541
mov dword [ebp - 0x7a8], eax
mov eax, dword [ebp - 0x7a8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x7a8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa2c]
call fcn.10021541
cmp dword [eax], 0xffffffe3
jle 0x1001e25a
mov dword [ebp - 0x2b0], 0x9ea9831
mov dword [ebp - 0x7b0], 1
mov dword [ebp - 0x2a8], 0
jmp 0x1001e171
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 4
jge 0x1001e18d
mov eax, dword [ebp - 0x2a8]
mov dword [ebp + eax*4 - 0x11c8], 0x88d0d3f7
jmp 0x1001e164
push 0
lea ecx, [ebp - 0xa2c]
call fcn.10021541
cmp dword [eax], 0
je 0x1001e1a4
jmp 0x1001e25a
mov dword [ebp - 0x2b0], 3
jmp 0x1001e1bd
mov eax, dword [ebp - 0x2b0]
dec eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0xffffffe5
je 0x1001e255
mov dword [ebp - 0xf24], 0xffffffff
mov dword [ebp - 0xdfc], 0
mov dword [ebp - 0xf84], 0x4d513c61
push 3
lea ecx, [ebp - 0xea4]
call fcn.100214a3
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0x2b8], 0
jmp 0x1001e212
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 3
jge 0x1001e234
push dword [ebp - 0x2b8]
lea ecx, [ebp - 0xea4]
call fcn.10021541
mov dword [eax], 0x7747bb7a
jmp 0x1001e205
mov eax, dword [ebp - 0x7b0]
dec eax
mov dword [ebp - 0x7b0], eax
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0xea4]
call fcn.10021525
jmp 0x1001e1b0
jmp 0x1001e10a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa2c]
call fcn.10021525
cmp dword [ebp + 0x10], 0
jbe 0x1001e4fe
mov dword [ebp - 0x19c], 0xfb871c7b
mov dword [ebp - 0xe04], 0xad31
mov dword [ebp - 0xb84], 0x278539ae
mov dword [ebp - 0x7f0], 1
mov dword [ebp - 0x2c0], 0
jmp 0x1001e2b4
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 4
jge 0x1001e2d0
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0xdbc], 0xc64a6847
jmp 0x1001e2a7
mov dword [ebp - 0x19c], 0
jmp 0x1001e2e9
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 3
jg 0x1001e4d4
mov dword [ebp - 0x5c], 0x443250e6
mov dword [ebp - 0x2c8], 0
jmp 0x1001e316
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 1
jge 0x1001e332
mov eax, dword [ebp - 0x2c8]
mov dword [ebp + eax*4 - 0xf2c], 0x4f9dbc9b
jmp 0x1001e309
mov dword [ebp - 0x5c], 0
jmp 0x1001e342
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jg 0x1001e4c2
mov dword [ebp - 0x154], 0xb288586f
mov eax, dword [ebp - 0x5c]
cmp dword [ebp + eax*4 - 0xdbc], 0
je 0x1001e40d
xor eax, eax
sub eax, dword [ebp - 0x154]
je 0x1001e383
cmp dword [ebp - 0x5c], 0
je 0x1001e383
mov dword [ebp - 0x7b8], 1
jmp 0x1001e38a
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x7b8], eax
jne 0x1001e3a4
mov dword [ebp - 0x7c0], 1
jmp 0x1001e3ab
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x7c0], eax
jg 0x1001e3c2
mov dword [ebp - 0x7c8], 1
jmp 0x1001e3c9
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x7c8]
jl 0x1001e3e0
mov dword [ebp - 0x7d0], 1
jmp 0x1001e3e7
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0xdbc], 0
cmp dword [ebp - 0x7d0], 0
jg 0x1001e40d
mov dword [ebp - 0x7d8], 1
jmp 0x1001e414
and dword [ebp - 0x7d8], 0
cmp dword [ebp - 0x7d8], 4
jbe 0x1001e429
mov dword [ebp - 0x7e0], 1
jmp 0x1001e430
and dword [ebp - 0x7e0], 0
cmp dword [ebp - 0x7e0], 0xfffffff8
jl 0x1001e445
mov dword [ebp - 0x7e8], 1
jmp 0x1001e44c
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x7e8]
sub eax, dword [ebp - 0x5c]
je 0x1001e482
mov byte [ebp - 0x176], 0
movzx eax, byte [ebp - 0x176]
test eax, eax
je 0x1001e480
push 0
push 0x396
push 0x2436
push 0x10b7
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
jmp 0x1001e4bd
mov dword [ebp - 0x154], 3
jmp 0x1001e49b
mov eax, dword [ebp - 0x154]
dec eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0
jl 0x1001e4bd
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0xdbc]
mov ecx, dword [ebp - 0x154]
mov dword [ebp + ecx*4 - 0xdbc], eax
jmp 0x1001e48e
jmp 0x1001e33b
mov eax, dword [ebp - 0x7f0]
inc eax
mov dword [ebp - 0x7f0], eax
jmp 0x1001e2dc
mov eax, dword [ebp - 0xb84]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1001e4f9
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0xac], ax
jmp 0x1001f176
mov dword [ebp - 0xe0c], 0xfffffff6
mov byte [ebp - 0x14d], 0
movzx eax, byte [ebp - 0x14d]
test eax, eax
je 0x1001e534
push 0x229b
push 0x174b
push 0x167d
push 0xcfc
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov byte [ebp - 0x178], 0
movzx eax, byte [ebp - 0x178]
test eax, eax
je 0x1001e553
push 0
push 0x1c76
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
mov dword [ebp - 0x228], 0x2cb13638
mov dword [ebp - 0x2d0], 0
jmp 0x1001e576
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 2
jge 0x1001e592
mov eax, dword [ebp - 0x2d0]
mov dword [ebp + eax*4 - 0x10dc], 0xfffffffa
jmp 0x1001e569
mov dword [ebp - 0x228], 0x3342eb9
mov dword [ebp - 0x228], 0
jmp 0x1001e5b5
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 1
jg 0x1001e5f2
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x1001e5d6
call dword [sym.imp.USER32.dll_EndMenu]
mov byte [ebp - 0x17a], 0
movzx eax, byte [ebp - 0x17a]
test eax, eax
je 0x1001e5f0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1001e5a8
mov eax, dword [0x106814c0]
and eax, 1
jne 0x1001e629
mov eax, dword [0x106814c0]
or eax, 1
mov dword [0x106814c0], eax
mov dword [ebp - 4], 0x2e
mov ecx, 0x1068150c
call fcn.10021553
push 0x1007803b
call fcn.1005fa37
pop ecx
or dword [ebp - 4], 0xffffffff
push 4
lea ecx, [ebp - 0xeb8]
call fcn.100214a3
mov dword [ebp - 4], 0x2f
mov dword [ebp - 0x2d8], 0
jmp 0x1001e656
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 4
jge 0x1001e678
push dword [ebp - 0x2d8]
lea ecx, [ebp - 0xeb8]
call fcn.10021541
mov dword [eax], 8
jmp 0x1001e649
mov byte [ebp - 0x15d], 0
movzx eax, byte [ebp - 0x15d]
test eax, eax
je 0x1001e69a
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov byte [ebp - 0x17c], 0
movzx eax, byte [ebp - 0x17c]
test eax, eax
je 0x1001e6bb
push 0
push 0x1e05
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeb8]
call fcn.10021525
movzx eax, byte [0x1061f8f8]
test eax, eax
je 0x1001ebb9
mov ecx, 0x1068150c
call fcn.10021618
movzx eax, al
test eax, eax
jne 0x1001ebb9
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x848]
push eax
mov ecx, 0x1068150c
call fcn.10021621
lea eax, [ebp - 0xfd0]
push eax
mov ecx, 0x1068150c
call fcn.1002160a
push eax
lea ecx, [ebp - 0x848]
call fcn.10021490
movzx eax, al
test eax, eax
je 0x1001ebb9
mov dword [ebp - 0x20], 0xef20fe6e
mov dword [ebp - 0x24], 0xfffffff8
push 3
lea ecx, [ebp - 0xcac]
call fcn.100214a3
mov dword [ebp - 4], 0x30
mov dword [ebp - 0x230], 0xfffffff8
mov dword [ebp - 0x2e0], 0
jmp 0x1001e773
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 3
jge 0x1001e795
push dword [ebp - 0x2e0]
lea ecx, [ebp - 0xcac]
call fcn.10021541
mov dword [eax], 0x77e06985
jmp 0x1001e766
cmp dword [ebp - 0x20], 0
je 0x1001e812
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xe14], eax
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
jle 0x1001e7bf
mov dword [ebp - 0x7f8], 1
jmp 0x1001e7c6
and dword [ebp - 0x7f8], 0
cmp dword [ebp - 0x7f8], 0
ja 0x1001e7db
mov dword [ebp - 0x800], 1
jmp 0x1001e7e2
and dword [ebp - 0x800], 0
cmp dword [ebp - 0x800], 1
je 0x1001e7fd
mov eax, 0x221e
test eax, eax
jne 0x1001e7fd
and dword [ebp - 0x808], 0
jmp 0x1001e807
mov dword [ebp - 0x808], 1
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x808]
jg 0x1001e81c
cmp dword [ebp - 0x24], 0
je 0x1001eb2e
mov dword [ebp - 0xd08], 0xe4e91208
mov dword [ebp - 0xd04], 0xe4e91208
mov dword [ebp - 0xd00], 0xe4e91208
mov dword [ebp - 0xcfc], 0xe4e91208
lea ecx, [ebp - 0x42d]
call fcn.10021550
push eax
lea eax, [ebp - 0xcf8]
push eax
lea eax, [ebp - 0xd08]
push eax
lea ecx, [ebp - 0x10d4]
call fcn.10021636
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa44]
call fcn.100214ff
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x20], 0
jmp 0x1001e88d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x1001eafb
mov dword [ebp - 0x2e8], 0
jmp 0x1001e8b0
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 3
jge 0x1001e8cc
mov eax, dword [ebp - 0x2e8]
mov dword [ebp + eax*4 - 0xd20], 0xfffffff9
jmp 0x1001e8a3
mov dword [ebp - 0x24], 0
jmp 0x1001e8dc
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x1001e946
mov dword [ebp - 0x2f0], 0xbf079684
mov dword [ebp - 0x2f0], 0
jmp 0x1001e905
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 3
jg 0x1001e944
mov byte [ebp - 0x165], 0
movzx eax, byte [ebp - 0x165]
test eax, eax
je 0x1001e92d
push 0
push 0x61d
call dword [sym.imp.USER32.dll_EndPaint]
push dword [ebp - 0x24]
lea ecx, [ebp - 0xa44]
call fcn.10021541
cmp dword [eax], 0
je 0x1001e942
jmp 0x1001e8f8
jmp 0x1001e8f8
jmp 0x1001e8d5
mov dword [ebp - 0x24], 3
jmp 0x1001e956
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1001eaf6
mov dword [ebp - 0x408], 0xfffffff6
mov eax, dword [ebp - 0x408]
dec eax
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0xf34], eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa44]
call fcn.10021541
mov eax, dword [eax]
sub eax, 0x4fb7
jne 0x1001e9b3
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd20], 0
jne 0x1001e9b3
and dword [ebp - 0x810], 0
jmp 0x1001e9bd
mov dword [ebp - 0x810], 1
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa44]
call fcn.10021541
mov eax, dword [eax]
cmp eax, dword [ebp - 0x810]
jne 0x1001e9e2
xor eax, eax
jne 0x1001e9e2
and dword [ebp - 0x818], 0
jmp 0x1001e9ec
mov dword [ebp - 0x818], 1
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa44]
call fcn.10021541
mov eax, dword [eax]
cmp eax, dword [ebp - 0x818]
jg 0x1001ea10
mov dword [ebp - 0x820], 1
jmp 0x1001ea17
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x820], eax
jge 0x1001ea2e
mov dword [ebp - 0x828], 1
jmp 0x1001ea35
and dword [ebp - 0x828], 0
cmp dword [ebp - 0x828], 0xe07a
jge 0x1001ea4d
mov dword [ebp - 0x830], 1
jmp 0x1001ea54
and dword [ebp - 0x830], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd20]
cmp dword [ebp - 0x830], eax
jge 0x1001ea75
mov dword [ebp - 0x838], 1
jmp 0x1001ea7c
and dword [ebp - 0x838], 0
cmp dword [ebp - 0x838], 0xfffffffa
jge 0x1001ea91
mov dword [ebp - 0x410], 1
jmp 0x1001ea98
and dword [ebp - 0x410], 0
push 1
lea ecx, [ebp - 0xcac]
call fcn.10021541
mov ecx, dword [ebp - 0x410]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd20]
cmp dword [ebp - 0x410], eax
jl 0x1001eace
mov dword [ebp - 0x840], 1
jmp 0x1001ead5
and dword [ebp - 0x840], 0
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa44]
call fcn.10021541
mov ecx, dword [ebp - 0x840]
sub ecx, dword [eax]
mov dword [ebp - 0x230], ecx
jmp 0x1001e94f
jmp 0x1001e886
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x1001eb1d
push 0x68a
push 0x66d
call dword [sym.imp.GDI32.dll_SetROP2]
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xa44]
call fcn.10021525
jmp 0x1001eb96
mov dword [ebp - 0x230], 0x1d
jmp 0x1001eb47
mov eax, dword [ebp - 0x230]
dec eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 3
jl 0x1001eb96
mov dword [ebp - 0x20], 0xfffffffc
jmp 0x1001eb60
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xe
jg 0x1001eb94
mov dword [ebp - 0x24], 0xffffffeb
jmp 0x1001eb76
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1b
je 0x1001eb92
push 1
lea ecx, [ebp - 0xcac]
call fcn.10021541
cmp dword [eax], 0
je 0x1001eb90
jmp 0x1001eb92
jmp 0x1001eb6f
jmp 0x1001eb59
jmp 0x1001eb3a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcac]
call fcn.10021525
lea ecx, [ebp - 0x848]
call fcn.1002164a
mov eax, dword [eax + 4]
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0xffffffff
jne 0x1001f176
mov ecx, 0x1068150c
call fcn.1002168e
mov ecx, dword [ebp - 0xf4]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x1068150c
call fcn.10021692
mov dword [ebp - 0x300], 0xa48bbca6
mov dword [ebp - 0xe1c], 1
mov dword [ebp - 0xf98], 0xfffffff6
mov dword [ebp - 0xe24], 0x18a52733
mov dword [ebp - 0xf3c], 0x14b58e17
mov dword [ebp - 0xe2c], 0xa1245c81
mov dword [ebp - 0x850], 5
mov dword [ebp - 0x2f8], 0
jmp 0x1001ec43
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 2
jge 0x1001ec5f
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0x1094], 0xfffffffa
jmp 0x1001ec36
mov dword [ebp - 0x300], 0x17
jmp 0x1001ec78
mov eax, dword [ebp - 0x300]
dec eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0xfffffff6
je 0x1001ed1e
mov dword [ebp - 0xe4], 0x47dc4b4e
mov dword [ebp - 0xe4], 4
jmp 0x1001eca8
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x1c
jg 0x1001ece0
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x1001ecde
push 0
push 0
push 0x1929
push 0x19ab
push 0
push 0x7fa
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
jmp 0x1001ec9b
mov dword [ebp - 0xe4], 0x10
jmp 0x1001ecf9
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x1c
jne 0x1001ed19
mov dword [ebp - 0xc08], 0x55595070
cmp dword [ebp - 0xc08], 0
je 0x1001ed17
jmp 0x1001ed19
jmp 0x1001ecec
jmp 0x1001ec6b
mov eax, dword [ebp - 0x850]
inc eax
mov dword [ebp - 0x850], eax
and dword [ebp - 0x1ac], 0
jmp 0x1001ed41
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0x1ac]
cmp ecx, dword [eax + 0x18]
jae 0x1001f176
mov dword [ebp - 0x860], 0xe2949f4f
mov dword [ebp - 0x418], 3
mov dword [ebp - 0xb8c], 1
mov dword [ebp - 0xb9c], 0xe9734172
mov dword [ebp - 0xbc], 0
jmp 0x1001ed97
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x1001edb3
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0xb28], 0xdbe8
jmp 0x1001ed8a
mov dword [ebp - 0xbc], 0
jmp 0x1001edcc
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x1001ede8
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x1054], 0xdeb77278
jmp 0x1001edbf
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xb28], 0x26bdde0b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb28]
mov dword [ebp - 0xfb8], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1054], 7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb28], 7
jne 0x1001ee39
mov dword [ebp - 0x858], 1
jmp 0x1001ee40
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0x860], eax
mov eax, dword [ebp - 0x860]
sub eax, 3
mov ecx, 0x3e8e
sub ecx, eax
mov dword [ebp - 0x418], ecx
mov eax, dword [ebp - 0x418]
cmp eax, dword [ebp - 0xb8c]
jle 0x1001ee7c
mov dword [ebp - 0xc10], 1
jmp 0x1001ee83
and dword [ebp - 0xc10], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0x1c4]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x1ac]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x868], eax
cmp dword [ebp - 0x868], 0
je 0x1001f171
mov dword [ebp - 0x308], 0x68ec0ae9
mov dword [ebp - 0x308], 0xfffffff7
jmp 0x1001eedd
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 6
jge 0x1001ef1f
mov dword [ebp - 0xa80], 0x57bf
cmp dword [ebp - 0xa80], 0
je 0x1001eefb
jmp 0x1001ef1f
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x1001ef1d
push 0x20ed
push 0x1c8e
call dword [sym.imp.GDI32.dll_SetMapMode]
jmp 0x1001eed0
mov byte [ebp - 0xfb], 0
movzx eax, byte [ebp - 0xfb]
test eax, eax
je 0x1001ef48
push 0
push 0xb07
push 0x1cf9
push 0x23e7
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov eax, dword [ebp - 0x868]
mov ecx, dword [ebp - 0x1c4]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x1074]
call fcn.10021410
mov dword [ebp - 4], 0x32
mov dword [ebp - 0x1a4], 0xfffffff9
mov dword [ebp - 0xe34], 5
mov dword [ebp - 0xf44], 0x90ef307d
mov dword [ebp - 0xe3c], 9
push 3
lea ecx, [ebp - 0xf08]
call fcn.100214a3
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x870], 0x531d
mov dword [ebp - 0xc4], 0
jmp 0x1001efc5
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x1001efe1
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0xef8], 3
jmp 0x1001efb8
mov dword [ebp - 0xc4], 0
jmp 0x1001effa
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x1001f019
push dword [ebp - 0xc4]
lea ecx, [ebp - 0xf08]
call fcn.10021541
and dword [eax], 0
jmp 0x1001efed
mov dword [ebp - 0x1a4], 2
jmp 0x1001f032
mov eax, dword [ebp - 0x1a4]
dec eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
jl 0x1001f0d3
mov dword [ebp - 0x310], 0xdd03248c
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp + eax*4 - 0xef8]
mov ecx, dword [ebp - 0x1a4]
mov dword [ebp + ecx*4 - 0xef8], eax
mov dword [ebp - 0x310], 4
jmp 0x1001f07c
mov eax, dword [ebp - 0x310]
dec eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0xfffffff9
jg 0x1001f0ce
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1001f0a3
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov byte [ebp - 0xff], 0
movzx eax, byte [ebp - 0xff]
test eax, eax
je 0x1001f0cc
push 0
push 0xb07
push 0x1cf9
push 0x23e7
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
jmp 0x1001f06f
jmp 0x1001f025
mov eax, dword [ebp - 0x870]
inc eax
mov dword [ebp - 0x870], eax
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0xf08]
call fcn.10021525
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1074]
call fcn.1000a92d
mov dword [ebp - 0x878], eax
movzx eax, byte [0x1061f8f8]
test eax, eax
je 0x1001f11f
mov ecx, 0x1068150c
call fcn.10021618
movzx eax, al
test eax, eax
jne 0x1001f13f
lea eax, [ebp - 0x878]
push eax
mov ecx, 0x1068150c
call fcn.10021650
mov ecx, dword [ebp - 0x1ac]
mov dword [eax], ecx
mov byte [0x1061f8f8], 1
cmp dword [ebp - 0x1b4], 0xffffffff
jne 0x1001f162
mov eax, dword [ebp - 0x878]
cmp eax, dword [ebp - 0x318]
jne 0x1001f162
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x1b4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1074]
call fcn.10021433
jmp 0x1001ed34
mov dword [ebp - 0x68], 1
mov dword [ebp - 0xa8c], 1
mov dword [ebp - 0x68], 0xffffffee
jmp 0x1001f197
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x12
jg 0x1001f318
mov dword [ebp - 0x15c], 0xaa9ac70c
mov dword [ebp - 0x888], 0xc41fd9d0
mov dword [ebp - 0xa94], 0x4b81230b
mov dword [ebp - 0x15c], 0xa
jmp 0x1001f1d8
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffe3
jg 0x1001f313
mov dword [ebp - 0xa84], 0xe3d3b0cf
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xfa0], eax
cmp dword [ebp - 0xa84], 0
jne 0x1001f210
cmp dword [ebp - 0x68], 0
jne 0x1001f210
and dword [ebp - 0x880], 0
jmp 0x1001f21a
mov dword [ebp - 0x880], 1
mov eax, dword [ebp - 0x880]
sub eax, 0xe7ad
mov dword [ebp - 0xa8c], eax
xor eax, eax
inc eax
jne 0x1001f239
mov eax, 0x6711db60
test eax, eax
je 0x1001f240
cmp dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x888], eax
mov eax, dword [ebp - 0x888]
cmp eax, dword [ebp - 0x15c]
jne 0x1001f267
xor eax, eax
je 0x1001f267
mov dword [ebp - 0x890], 1
jmp 0x1001f26e
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x890]
sub eax, 0x7c422d5f
sub eax, dword [ebp - 0x15c]
imul eax, eax, 0x7c2f
cmp eax, 0xffff
ja 0x1001f298
mov dword [ebp - 0x898], 1
jmp 0x1001f29f
and dword [ebp - 0x898], 0
cmp dword [ebp - 0x898], 0x74006310
jg 0x1001f2b7
mov dword [ebp - 0x8a0], 1
jmp 0x1001f2be
and dword [ebp - 0x8a0], 0
cmp dword [ebp - 0x8a0], 3
jae 0x1001f2d3
mov dword [ebp - 0x8a8], 1
jmp 0x1001f2da
and dword [ebp - 0x8a8], 0
cmp dword [ebp - 0x8a8], 0xffffffff
jl 0x1001f2ef
mov dword [ebp - 0x8b0], 1
jmp 0x1001f2f6
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x8b0]
jne 0x1001f305
cmp dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xa94], eax
jmp 0x1001f1cb
jmp 0x1001f190
cmp dword [ebp + 0x10], 0
jne 0x1001f347
cmp dword [ebp - 0x1b4], 0xffffffff
je 0x1001f347
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0x1c4]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x1b4]
mov ax, word [ecx + eax*2]
mov word [ebp - 0xac], ax
mov dword [ebp - 0xec], 0
mov dword [ebp - 0x1bc], 1
mov dword [ebp - 0x330], 0xdeabfd09
mov dword [ebp - 0x320], 0
jmp 0x1001f37e
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 4
jge 0x1001f39a
mov eax, dword [ebp - 0x320]
mov dword [ebp + eax*4 - 0x9ec], 0x432a
jmp 0x1001f371
mov dword [ebp - 0xec], 0
jmp 0x1001f3b3
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 7
jg 0x1001f854
mov dword [ebp - 0x30], 0x20002526
mov dword [ebp - 0xc0], 0x33d2afdd
mov dword [ebp - 0x30], 3
jmp 0x1001f3e1
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1001f829
mov dword [ebp - 0x4c0], 0xc34ccbb2
mov dword [ebp - 0xa9c], 0x1536c745
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x9ec], 0
jle 0x1001f418
mov dword [ebp - 0x4a8], 1
jmp 0x1001f41f
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x30], 0x64c7b7f6
je 0x1001f434
mov dword [ebp - 0x49c], 1
jmp 0x1001f43b
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x9ec]
cmp dword [ebp - 0x49c], eax
jne 0x1001f462
cmp dword [ebp - 0x1bc], 0
je 0x1001f462
mov dword [ebp - 0x4a0], 1
jmp 0x1001f469
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
sub eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0xec]
jle 0x1001f486
mov dword [ebp - 0x4b0], 1
jmp 0x1001f48d
and dword [ebp - 0x4b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9ec]
add eax, dword [ebp - 0x4a8]
cmp eax, dword [ebp - 0x4b0]
jge 0x1001f4b4
mov dword [ebp - 0x4b8], 1
jmp 0x1001f4bb
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x9ec]
add eax, dword [ebp - 0x4b8]
je 0x1001f600
mov dword [ebp - 0x328], 0x94be3d0e
mov dword [ebp - 0x4e8], 0x848308fa
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0xe44], eax
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0xec]
je 0x1001f517
mov dword [ebp - 0x4c8], 1
jmp 0x1001f51e
and dword [ebp - 0x4c8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x4c8]
neg ecx
cmp ecx, dword [ebp + eax - 0x9ec]
jl 0x1001f540
mov dword [ebp - 0x4d0], 1
jmp 0x1001f547
and dword [ebp - 0x4d0], 0
cmp dword [ebp - 0x4d0], 0xfffffff7
jne 0x1001f55c
mov dword [ebp - 0x4d8], 1
jmp 0x1001f563
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0
je 0x1001f599
cmp dword [ebp - 0x328], 0
je 0x1001f599
mov dword [ebp - 0x4e0], 1
jmp 0x1001f5a0
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x328]
mov ecx, dword [ebp - 0x4e8]
sub ecx, 0x7458f5e2
imul ecx, dword [ebp - 0x30]
lea eax, [ecx + eax + 0xb50f]
sub eax, dword [ebp - 0x1bc]
cmp eax, 0xfffc
jae 0x1001f5eb
cmp dword [ebp - 0x328], 0
je 0x1001f5eb
mov dword [ebp - 0x4f0], 1
jmp 0x1001f5f2
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0xa9c], eax
jmp 0x1001f63e
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x1001f629
push 0xeb2
push 0x2605
push 0x6f2
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9ec], 0
je 0x1001f63e
jmp 0x1001f3da
mov dword [ebp - 0x1bc], 0
jmp 0x1001f657
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jg 0x1001f824
mov dword [ebp - 0xaa4], 0xfffffffa
mov dword [ebp - 0x530], 0x5d282856
mov dword [ebp - 0xab4], 0xffffffff
mov dword [ebp - 0xc0], 0
jmp 0x1001f69b
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jg 0x1001f81f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9ec], 0
je 0x1001f6e3
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x9ec]
mov dword [ebp - 0xaa4], eax
mov eax, 0x4870
add eax, 0xffff
cmp eax, 3
jbe 0x1001f6e3
mov dword [ebp - 0x4f8], 1
jmp 0x1001f6ea
and dword [ebp - 0x4f8], 0
mov eax, 0xfff8
sub eax, dword [ebp - 0x4f8]
cmp eax, dword [ebp - 0xc0]
jle 0x1001f709
mov dword [ebp - 0x500], 1
jmp 0x1001f710
and dword [ebp - 0x500], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x9ec]
cmp dword [ebp - 0x500], eax
jg 0x1001f730
mov dword [ebp - 0x508], 1
jmp 0x1001f737
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0xc0], 0
je 0x1001f761
cmp dword [ebp - 0xc0], 0
je 0x1001f761
mov dword [ebp - 0xaac], 1
jmp 0x1001f768
and dword [ebp - 0xaac], 0
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0xf4c], eax
imul eax, dword [ebp - 0xab4], 0xd6f9
cmp eax, dword [ebp - 0x30]
jne 0x1001f798
cmp dword [ebp - 0x330], 0
je 0x1001f798
mov dword [ebp - 0x510], 1
jmp 0x1001f79f
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x9ec]
cmp eax, dword [ebp - 0x510]
jle 0x1001f7bd
mov dword [ebp - 0x518], 1
jmp 0x1001f7c4
and dword [ebp - 0x518], 0
cmp dword [ebp - 0x518], 0
jne 0x1001f7df
cmp dword [ebp - 0xec], 0
jne 0x1001f7df
and dword [ebp - 0x520], 0
jmp 0x1001f7e9
mov dword [ebp - 0x520], 1
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x9ec]
cmp eax, dword [ebp - 0x520]
jg 0x1001f807
mov dword [ebp - 0x528], 1
jmp 0x1001f80e
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x530], eax
jmp 0x1001f68e
jmp 0x1001f64a
jmp 0x1001f3da
mov byte [ebp - 0x103], 0
movzx eax, byte [ebp - 0x103]
test eax, eax
je 0x1001f84f
push 0
push 0
push 0xd1c
push 0x1ef3
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x1001f3a6
movzx eax, word [ebp - 0xac]
cmp eax, 0xffff
je 0x1001fe0d
movzx eax, word [ebp - 0xac]
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ebp - 0x1c4]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0xabc]
mov ecx, dword [ebp - 0x1c4]
add ecx, dword [eax]
mov dword [ebp - 0xc8], ecx
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0xf4]
jbe 0x1001fe05
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e4]
mov edx, dword [ebp - 0xf4]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0xc8], edx
jae 0x1001fe05
mov eax, dword [0x106814c0]
and eax, 2
jne 0x1001f8ff
mov eax, dword [0x106814c0]
or eax, 2
mov dword [0x106814c0], eax
mov dword [ebp - 4], 0x34
push 0x7fb
call fcn.1004c430
pop ecx
mov byte [0x1068149c], al
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xac4], 0x1d33
cmp dword [ebp - 0xac4], 0x489
jge 0x1001fb19
lea ecx, [ebp - 0xa68]
call fcn.10020cc5
mov dword [ebp - 4], 0x35
lea edx, [ebp - 0xa68]
mov ecx, 0x1061e870
call fcn.10025941
push 0x100076a2
lea ecx, [ebp - 0x117c]
call fcn.10020cd6
mov byte [ebp - 4], 0x36
push 0x100076a2
lea ecx, [ebp - 0xd8c]
call fcn.10020cd6
mov byte [ebp - 4], 0x37
push 0
lea ecx, [ebp - 0xa68]
call fcn.10020d68
mov al, byte [eax]
movzx eax, al
push eax
lea ecx, [ebp - 0xd8c]
call fcn.10020d57
mov dword [ebp - 0x1cc], 1
lea ecx, [ebp - 0xa68]
call fcn.10020d87
cmp eax, 2
jb 0x1001f9c6
push 1
lea ecx, [ebp - 0xa68]
call fcn.10020d68
mov al, byte [eax]
movzx eax, al
push eax
lea ecx, [ebp - 0xd8c]
call fcn.10020d57
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x64], 2
jmp 0x1001f9d6
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
lea ecx, [ebp - 0xa68]
call fcn.10020d87
cmp dword [ebp - 0x64], eax
jae 0x1001fad0
push dword [ebp - 0x64]
lea ecx, [ebp - 0xa68]
call fcn.10020d68
movsx esi, byte [eax]
mov eax, dword [ebp - 0x64]
dec eax
push eax
lea ecx, [ebp - 0xa68]
call fcn.10020d68
movsx eax, byte [eax]
cmp eax, esi
jne 0x1001fa3f
push dword [ebp - 0x64]
lea ecx, [ebp - 0xa68]
call fcn.10020d68
movsx esi, byte [eax]
mov eax, dword [ebp - 0x64]
dec eax
dec eax
push eax
lea ecx, [ebp - 0xa68]
call fcn.10020d68
movsx eax, byte [eax]
cmp eax, esi
jne 0x1001fa3f
jmp 0x1001f9cf
push dword [ebp - 0x64]
lea ecx, [ebp - 0xa68]
call fcn.10020d68
movsx esi, byte [eax]
mov eax, dword [ebp - 0x64]
dec eax
push eax
lea ecx, [ebp - 0xa68]
call fcn.10020d68
movsx eax, byte [eax]
cmp eax, esi
jne 0x1001fa9f
mov eax, dword [ebp - 0x1cc]
dec eax
dec eax
push eax
lea ecx, [ebp - 0xd8c]
call fcn.10020d68
movsx esi, byte [eax]
mov eax, dword [ebp - 0x1cc]
sub eax, 3
push eax
lea ecx, [ebp - 0xd8c]
call fcn.10020d68
movsx eax, byte [eax]
cmp eax, esi
jne 0x1001fa9f
jmp 0x1001f9cf
push dword [ebp - 0x64]
lea ecx, [ebp - 0xa68]
call fcn.10020d68
mov al, byte [eax]
movzx eax, al
push eax
lea ecx, [ebp - 0xd8c]
call fcn.10020d57
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
jmp 0x1001f9cf
push 0x1002590f
lea edx, [ebp - 0xd8c]
mov ecx, 0x1061e7b8
call fcn.10025966
mov ecx, eax
call fcn.10021037
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0xd8c]
call fcn.10020d4d
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x117c]
call fcn.10020d4d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa68]
call fcn.10020d4d
mov byte [ebp - 0x70], 0
mov byte [ebp - 0x6f], 0xc8
mov byte [ebp - 0x6e], 2
mov byte [ebp - 0x6d], 8
mov byte [ebp - 0x6c], 1
mov byte [ebp - 0x6b], 0
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x70]
and eax, 0xac
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x70]
or ecx, 0xac
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x70]
mov byte [ebp + eax - 0x164], cl
mov dword [ebp - 0x58], 2
and dword [ebp - 0x420], 0
jmp 0x1001fb7e
mov eax, dword [ebp - 0x58]
inc eax
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 6
jae 0x1001fbfc
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x420]
movzx eax, byte [ebp + eax - 0x72]
movsx eax, byte [ebp + eax - 0x164]
mov ecx, dword [ebp - 0x58]
movzx ecx, byte [ebp + ecx - 0x6f]
and ecx, eax
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x420]
movzx eax, byte [ebp + eax - 0x72]
movsx eax, byte [ebp + eax - 0x164]
mov edx, dword [ebp - 0x58]
movzx edx, byte [ebp + edx - 0x6f]
and edx, eax
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x420]
movzx eax, byte [ebp + eax - 0x72]
movsx eax, byte [ebp + eax - 0x164]
mov esi, dword [ebp - 0x58]
movzx ebx, byte [ebp + esi - 0x6f]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x58]
movzx eax, byte [ebp + eax - 0x70]
mov byte [ebp + eax - 0x164], bl
jmp 0x1001fb76
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x164], 0
mov eax, dword [0x106814c0]
and eax, 4
jne 0x1001fc48
mov eax, dword [0x106814c0]
or eax, 4
mov dword [0x106814c0], eax
mov dword [ebp - 4], 0x38
lea eax, [ebp - 0x164]
push eax
mov ecx, 0x10681538
call fcn.10021410
push 0x1007802c
call fcn.1005fa37
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x338], 0
jmp 0x1001fc5e
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 4
jae 0x1001fc77
mov eax, dword [ebp - 0x338]
mov byte [ebp + eax - 0x164], 0
jmp 0x1001fc51
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x16c], eax
movsx eax, byte [0x1068149c]
mov ecx, dword [ebp - 0x16c]
movsx ecx, byte [ecx]
cmp ecx, eax
je 0x1001fca6
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
jmp 0x1001fc83
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
push dword [ebp - 0x16c]
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xfe8]
call fcn.10025b03
mov dword [ebp - 4], 0x39
push 0x10681538
lea ecx, [ebp - 0xfe8]
call fcn.1002143d
lea eax, [ebp - 0xe4c]
push eax
lea ecx, [ebp - 0xfe8]
call fcn.10021462
push dword [eax]
lea eax, [ebp - 0xebc]
push eax
lea ecx, [ebp - 0xfe8]
call fcn.1002144e
push dword [eax]
lea ecx, [ebp - 0x108c]
call fcn.10025b2c
mov byte [ebp - 4], 0x3a
lea eax, [ebp - 0x108c]
push eax
call fcn.1000ab17
pop ecx
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
je 0x1001fdb1
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x1030]
call fcn.10021410
mov byte [ebp - 4], 0x3b
lea edx, [ebp - 0xacc]
lea ecx, [ebp - 0x1030]
call fcn.1000a9d4
movzx eax, al
test eax, eax
je 0x1001fd81
push 0
push dword [ebp - 0xacc]
push 0
push dword [ebp - 0x428]
call fcn.1001783d
add esp, 0x10
mov dword [ebp - 0xc8], eax
jmp 0x1001fda0
push 1
push 0
lea eax, [ebp - 0x1030]
push eax
push dword [ebp - 0x428]
call fcn.1001783d
add esp, 0x10
mov dword [ebp - 0xc8], eax
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x1030]
call fcn.10021433
jmp 0x1001fde7
cmp dword [ebp + 0x10], 0
jne 0x1001fdc7
mov ecx, dword [ebp + 0xc]
call fcn.10020d7c
mov dword [ebp - 0x538], eax
jmp 0x1001fdd1
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x538], eax
push dword [ebp - 0x538]
push dword [ebp + 8]
call fcn.10012965
pop ecx
pop ecx
mov dword [ebp - 0xc8], eax
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x108c]
call fcn.100213c9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfe8]
call fcn.10021433
mov eax, dword [ebp - 0xc8]
jmp 0x1001fe0f
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret