Function at 0x10025d63
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080bed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x738
push esi
push edi
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10025ded
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x460], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
mov ecx, dword [ebp - 0x204]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jg 0x10025dd3
mov dword [ebp - 0x400], 1
jmp 0x10025dda
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x470]
mov ecx, dword [ebp - 0x400]
mov dword [eax], ecx
jmp 0x10028fee
push 2
lea ecx, [ebp - 0x450]
call fcn.100170df
and dword [ebp - 4], 0
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0x10c], 0
jmp 0x10025e21
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 2
jge 0x10025e43
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x450]
call fcn.10017169
mov dword [eax], 0x2e0c
jmp 0x10025e14
mov dword [ebp - 0xa0], 0
jmp 0x10025e5c
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jg 0x10025f10
mov dword [ebp - 0x20], 0xbb11accb
mov dword [ebp - 0x20], 0
jmp 0x10025e80
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jg 0x10025ed1
push dword [ebp - 0x20]
lea ecx, [ebp - 0x450]
call fcn.10017169
mov esi, eax
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x450]
call fcn.10017169
mov ecx, dword [esi]
mov dword [eax], ecx
mov byte [ebp - 0x83], 0
movzx eax, byte [ebp - 0x83]
test eax, eax
je 0x10025ecf
push 0x21c0
push 0x1261
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
jmp 0x10025e79
mov dword [ebp - 0x20], 0
jmp 0x10025ee1
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jg 0x10025f0b
push dword [ebp - 0x20]
lea ecx, [ebp - 0x450]
call fcn.10017169
mov esi, eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x450]
call fcn.10017169
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x10025eda
jmp 0x10025e4f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call fcn.10017164
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x4cc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4d4], eax
mov dword [ebp - 0x8c], 0xcff0ea75
mov dword [ebp - 0x110], 0x8f8256a9
mov dword [ebp - 0x680], 1
mov dword [ebp - 0x4c8], 0x999d94b4
mov dword [ebp - 0x3b0], 0x21f1eb32
mov dword [ebp - 0x6b4], 0xfffffffb
mov dword [ebp - 0x658], 0
mov dword [ebp - 0x3a0], 0xffffffff
mov dword [ebp - 0xdc], 0xfffffffe
mov dword [ebp - 0x420], 0xffffffff
mov dword [ebp - 0x8c], 0
jmp 0x10025fae
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xffffffeb
jge 0x10026339
mov dword [ebp - 0x1b8], 0xfffffffd
push 2
lea ecx, [ebp - 0x45c]
call fcn.100170df
mov dword [ebp - 4], 1
mov dword [ebp - 0x3c0], 0x5900b088
mov dword [ebp - 0x3c], 0
jmp 0x10025ff3
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1002600c
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x45c]
call fcn.10017169
and dword [eax], 0
jmp 0x10025fec
mov dword [ebp - 0x3c], 0
jmp 0x1002601c
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x10026032
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x508], 0x37c57f39
jmp 0x10026015
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
push 1
lea ecx, [ebp - 0x45c]
call fcn.10017169
push 1
lea ecx, [ebp - 0x45c]
call fcn.10017169
mov eax, dword [ebp - 0xdc]
add eax, 0xfffffff7
mov dword [ebp - 0x478], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x478]
mov dword [ebp + eax - 0x508], ecx
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x6e8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x508]
sub eax, 0x4073
sub eax, dword [ebp - 0x3c0]
cmp eax, dword [ebp - 0x1b8]
jl 0x100260b3
mov dword [ebp - 0x408], 1
jmp 0x100260ba
and dword [ebp - 0x408], 0
push 1
lea ecx, [ebp - 0x45c]
call fcn.10017169
mov eax, dword [eax]
add eax, dword [ebp - 0x408]
cmp eax, dword [ebp - 0xdc]
jle 0x100260e3
mov dword [ebp - 0x410], 1
jmp 0x100260ea
and dword [ebp - 0x410], 0
cmp dword [ebp - 0x410], 0
je 0x100262ee
mov dword [ebp - 0xac], 1
mov dword [ebp - 0x110], 0
jmp 0x1002611a
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xc
jg 0x1002612f
mov dword [ebp - 0xac], 0xc4eb0a11
jmp 0x1002610d
cmp dword [ebp - 0xac], 0xffffffff
jg 0x10026144
mov dword [ebp - 0x198], 1
jmp 0x1002614b
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x420], eax
jg 0x10026165
mov dword [ebp - 0x418], 1
jmp 0x1002616c
and dword [ebp - 0x418], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x508]
cmp dword [ebp - 0x418], eax
jl 0x1002618d
mov dword [ebp - 0x388], 1
jmp 0x10026194
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x420]
cmp dword [ebp - 0x388], eax
jge 0x100261ae
mov dword [ebp - 0x390], 1
jmp 0x100261b5
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x198]
cmp eax, dword [ebp - 0x390]
jne 0x100261d8
cmp dword [ebp - 0x8c], 0
je 0x100261d8
mov dword [ebp - 0x1a0], 1
jmp 0x100261df
and dword [ebp - 0x1a0], 0
cmp dword [ebp - 0x1a0], 1
jne 0x100261f4
mov dword [ebp - 0x398], 1
jmp 0x100261fb
and dword [ebp - 0x398], 0
cmp dword [ebp - 0x398], 0xc84a
jg 0x10026213
mov dword [ebp - 0x1a8], 1
jmp 0x1002621a
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x1b0], eax
push 1
lea ecx, [ebp - 0x45c]
call fcn.10017169
mov ecx, dword [ebp - 0x1b0]
mov dword [eax], ecx
cmp dword [ebp - 0x1b0], 0
je 0x10026265
cmp dword [ebp - 0xac], 0
je 0x10026265
mov dword [ebp - 0x3a8], 1
jmp 0x1002626c
and dword [ebp - 0x3a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x508]
cmp eax, dword [ebp - 0x3a8]
jl 0x10026293
cmp dword [ebp - 0xac], 0
jne 0x10026293
and dword [ebp - 0x1c0], 0
jmp 0x1002629d
mov dword [ebp - 0x1c0], 1
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x3b0]
sub eax, dword [ebp - 0x1c0]
cmp eax, 0xfffffffd
jne 0x100262c6
mov dword [ebp - 0x17c], 1
jmp 0x100262cd
and dword [ebp - 0x17c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x17c]
mov dword [ebp + eax - 0x508], ecx
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x4c8], eax
jmp 0x10026325
mov dword [ebp - 0x3b8], 0x863e3202
mov eax, dword [ebp - 0x3b8]
cmp dword [ebp - 0x3b8], eax
jg 0x10026312
mov dword [ebp - 0x1c8], 1
jmp 0x10026319
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x3c0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x45c]
call fcn.10017164
jmp 0x10025fa1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1f4], eax
mov dword [ebp - 0x128], 0xffffffff
mov dword [ebp - 0x4d8], 0xffffffff
mov dword [ebp - 0x660], 0x3f17e2f9
mov dword [ebp - 0x6bc], 6
mov dword [ebp - 0x4d0], 0x1f145ba1
mov dword [ebp - 0x6d4], 0x86fd5d70
mov dword [ebp - 0x534], 0x4ccfd66c
mov dword [ebp - 0x608], 0xfffffffc
mov dword [ebp - 0x4f8], 6
mov dword [ebp - 0x4f0], 0
mov dword [ebp - 0x4e0], 3
mov dword [ebp - 0x4e8], 0x68fdadf8
push 1
lea ecx, [ebp - 0x5e4]
call fcn.100170df
mov dword [ebp - 4], 2
mov dword [ebp - 0x1d0], 0xabef
mov dword [ebp - 0xe8], 0
jmp 0x100263f1
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 1
jge 0x10026410
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x5e4]
call fcn.10017169
or dword [eax], 0xffffffff
jmp 0x100263e4
mov dword [ebp - 0x128], 0
jmp 0x10026429
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x16
jge 0x100264de
mov dword [ebp - 0x60c], 0xffffffff
mov dword [ebp - 0x614], 0x443250e6
mov dword [ebp - 0x61c], 0xc4ab274b
mov dword [ebp - 0x624], 0x5c9e53e5
mov dword [ebp - 0x62c], 0x7d2703d9
mov dword [ebp - 0x634], 0x5362daab
mov dword [ebp - 0x63c], 0x35ca4204
mov dword [ebp - 0x644], 3
mov dword [ebp - 0x64c], 0xa32a17d0
mov dword [ebp - 0x654], 1
mov dword [ebp - 0x65c], 0x29c8ddac
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x670], 1
mov dword [ebp - 0x674], 0xfffffffb
mov dword [ebp - 0x67c], 9
mov eax, dword [ebp - 0x1d0]
dec eax
mov dword [ebp - 0x1d0], eax
jmp 0x1002641c
cmp dword [ebp - 0x4d0], 0
jne 0x10026552
cmp dword [ebp - 0x4d8], 1
jg 0x100264f7
cmp dword [ebp - 0x4e0], 0
imul eax, dword [ebp - 0x4e8], 0x69ed
cmp eax, dword [ebp - 0x4f0]
jl 0x10026515
mov dword [ebp - 0x3c8], 1
jmp 0x1002651c
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x4f8]
cmp dword [ebp - 0x3c8], eax
jne 0x10026536
mov dword [ebp - 0x1d8], 1
jmp 0x1002653d
and dword [ebp - 0x1d8], 0
cmp dword [ebp - 0x1d8], 0x8bee6dab
jb 0x10026552
and dword [ebp - 0x3d0], 0
jmp 0x1002655c
mov dword [ebp - 0x3d0], 1
mov eax, dword [ebp - 0x534]
cmp eax, dword [ebp - 0x3d0]
jle 0x10026576
mov dword [ebp - 0x1e0], 1
jmp 0x1002657d
and dword [ebp - 0x1e0], 0
push 0
lea ecx, [ebp - 0x5e4]
call fcn.10017169
mov ecx, dword [ebp - 0x1e0]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5e4]
call fcn.10017164
mov eax, dword [ebp + 8]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], 0x65c2dd7
mov dword [ebp - 0xf0], 0
jmp 0x100265cd
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 4
jge 0x100265e9
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x43c], 2
jmp 0x100265c0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x43c], 0
jmp 0x10026614
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x43c]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x43c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x43c], 0xb
jle 0x10026782
mov dword [ebp - 0x464], 0xffffffff
mov dword [ebp - 0x46c], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x43c]
cmp dword [ebp + eax - 0x43c], ecx
jne 0x10026662
mov dword [ebp - 0x3d8], 1
jmp 0x10026669
and dword [ebp - 0x3d8], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x43c], 0x5bfb66fe
jle 0x10026687
mov dword [ebp - 0x1e8], 1
jmp 0x1002668e
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x1e8]
lea eax, [eax + ecx + 0x36632064]
cmp eax, 0xffffffff
je 0x100266be
mov dword [ebp - 0x3e0], 1
jmp 0x100266c5
and dword [ebp - 0x3e0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x43c]
mov ecx, dword [ebp - 0x3e0]
add ecx, 0x649f
sub eax, ecx
sub eax, 0x4f5a
je 0x100266fb
cmp dword [ebp - 0x158], 0
je 0x100266fb
mov dword [ebp - 0x1f0], 1
jmp 0x10026702
and dword [ebp - 0x1f0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x43c]
cmp dword [ebp - 0x1f0], eax
jle 0x10026722
mov dword [ebp - 0x3e8], 1
jmp 0x10026729
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x464]
imul eax, dword [ebp - 0x3e8]
add eax, 0x35c0
je 0x1002674e
xor eax, eax
inc eax
je 0x1002674e
mov dword [ebp - 0x1f8], 1
jmp 0x10026755
and dword [ebp - 0x1f8], 0
cmp dword [ebp - 0x1f8], 0xffffffff
jle 0x1002676a
mov dword [ebp - 0x3f0], 1
jmp 0x10026771
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x46c], eax
jmp 0x100265fb
mov dword [ebp - 0x6e4], 0x177e8edf
mov dword [ebp - 0x6e0], 0x177e8edf
mov dword [ebp - 0x6dc], 0x177e8edf
mov dword [ebp - 0x6d8], 0x177e8edf
mov dword [ebp - 0x118], 0
jmp 0x100267c3
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 4
jge 0x100267df
mov eax, dword [ebp - 0x118]
mov dword [ebp + eax*4 - 0x600], 0
jmp 0x100267b6
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x600], 0
jmp 0x1002680d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x600]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x600], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x600], 3
jg 0x10026852
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x10026836
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov byte [ebp - 0x82], 0
movzx eax, byte [ebp - 0x82]
test eax, eax
je 0x10026850
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
jmp 0x100267f2
mov dword [ebp - 0x60], 0xc865b49d
mov dword [ebp - 0x174], 1
mov dword [ebp - 0x160], 0xc00eadd5
mov dword [ebp - 0x580], 0xf888c554
mov dword [ebp - 0x57c], 0xf888c554
mov dword [ebp - 0x578], 0xf888c554
mov dword [ebp - 0x574], 0xf888c554
lea ecx, [ebp - 0x161]
call fcn.10008a53
push eax
lea eax, [ebp - 0x570]
push eax
lea eax, [ebp - 0x580]
push eax
lea ecx, [ebp - 0x730]
call fcn.10017178
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x544]
call fcn.1001713e
mov dword [ebp - 4], 3
mov dword [ebp - 0x32c], 0xd6cd
cmp dword [ebp - 0x60], 1
jae 0x100268ed
mov dword [ebp - 0x3a4], 1
jmp 0x100268f4
and dword [ebp - 0x3a4], 0
mov dword [ebp - 0x160], 0xfbb9cf7d
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x160], eax
jg 0x10026915
mov dword [ebp - 0x3f8], 1
jmp 0x1002691c
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x3f8], eax
jne 0x10026933
mov dword [ebp - 0x20c], 1
jmp 0x1002693a
and dword [ebp - 0x20c], 0
push 0
lea ecx, [ebp - 0x544]
call fcn.10017169
mov ecx, dword [ebp - 0x20c]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x60]
jge 0x10026960
mov dword [ebp - 0x208], 1
jmp 0x10026967
and dword [ebp - 0x208], 0
cmp dword [ebp - 0x208], 0xfffffffb
jg 0x1002697c
mov dword [ebp - 0x310], 1
jmp 0x10026983
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x310], eax
jl 0x1002699d
mov dword [ebp - 0x210], 1
jmp 0x100269a4
and dword [ebp - 0x210], 0
cmp dword [ebp - 0x210], 0x3068
je 0x100269bc
mov dword [ebp - 0x41c], 1
jmp 0x100269c3
and dword [ebp - 0x41c], 0
push 0
lea ecx, [ebp - 0x544]
call fcn.10017169
mov ecx, dword [ebp - 0x41c]
cmp ecx, dword [eax]
jge 0x100269e6
mov dword [ebp - 0x218], 1
jmp 0x100269ed
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x174]
sub eax, dword [ebp - 0x218]
imul eax, eax, 0x2bc8
cmp eax, 1
jl 0x10026a10
mov dword [ebp - 0x4a0], 1
jmp 0x10026a17
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x60], 0
je 0x10026a3b
cmp dword [ebp - 0x60], 0
je 0x10026a3b
mov dword [ebp - 0x324], 1
jmp 0x10026a42
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
add eax, dword [ebp - 0x60]
mov dword [ebp - 0x220], eax
push 0
lea ecx, [ebp - 0x544]
call fcn.10017169
mov ecx, dword [ebp - 0x220]
mov dword [eax], ecx
mov eax, dword [ebp - 0x220]
sub eax, 0x69438ed5
neg eax
cmp dword [ebp - 0x3a4], eax
je 0x10026a87
mov dword [ebp - 0x228], 1
jmp 0x10026a8e
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x228]
sub eax, 0x479e
jne 0x10026aa2
cmp dword [ebp - 0x174], 0
cmp dword [ebp - 0x160], 0xffff
jne 0x10026aba
mov dword [ebp - 0x230], 1
jmp 0x10026ac1
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x32c]
cmp dword [ebp - 0x230], eax
jle 0x10026adb
mov dword [ebp - 0x3e4], 1
jmp 0x10026ae2
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
inc eax
cmp eax, 0xfffffffb
jle 0x10026afa
mov dword [ebp - 0x238], 1
jmp 0x10026b01
and dword [ebp - 0x238], 0
cmp dword [ebp - 0x238], 0xfffffffd
je 0x10026b16
mov dword [ebp - 0x334], 1
jmp 0x10026b1d
and dword [ebp - 0x334], 0
cmp dword [ebp - 0x334], 0
jne 0x10026b3c
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x10026b3a
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
jmp 0x10026b50
mov byte [ebp - 0x56], 0
movzx eax, byte [ebp - 0x56]
test eax, eax
je 0x10026b50
push 0
call dword [sym.imp.USER32.dll_CharNextW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x544]
call fcn.10017164
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x39c], 4
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x4a8], 0x11378331
push 1
lea ecx, [ebp - 0x518]
call fcn.100170df
mov dword [ebp - 4], 4
mov dword [ebp - 0x4b0], 0x495ee35d
mov dword [ebp - 0x3b4], 0xfffffff6
push 2
lea ecx, [ebp - 0x5b4]
call fcn.100170df
mov byte [ebp - 4], 5
mov dword [ebp - 0x40], 0
jmp 0x10026bd1
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x10026bed
push dword [ebp - 0x40]
lea ecx, [ebp - 0x518]
call fcn.10017169
mov dword [eax], 0x473ede5c
jmp 0x10026bca
mov dword [ebp - 0x40], 0
jmp 0x10026bfd
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x10026c19
push dword [ebp - 0x40]
lea ecx, [ebp - 0x5b4]
call fcn.10017169
mov dword [eax], 0x42f53403
jmp 0x10026bf6
cmp dword [ebp - 0x68], 0
je 0x10026c3b
mov dword [ebp - 0x240], 1
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
jmp 0x10026ef7
mov dword [ebp - 0x44], 0x292c5eb2
mov dword [ebp - 0xf8], 0
jmp 0x10026c5b
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jge 0x10026c77
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x444], 0x7800ff68
jmp 0x10026c4e
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6c0], eax
push 4
pop eax
shl eax, 0
imul eax, dword [ebp + eax - 0x444], 0xffffffff
test eax, eax
je 0x10026cae
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x444], 0
je 0x10026cae
mov dword [ebp - 0x3ac], 1
jmp 0x10026cb5
and dword [ebp - 0x3ac], 0
cmp dword [ebp - 0x3ac], 0xffff
jne 0x10026cd6
mov eax, 0x765e4b
test eax, eax
je 0x10026cd6
mov dword [ebp - 0x474], 1
jmp 0x10026cdd
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x68]
imul eax, dword [ebp - 0x68]
add eax, 5
cmp eax, dword [ebp - 0x4a8]
jge 0x10026cfb
mov dword [ebp - 0x248], 1
jmp 0x10026d02
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x248], eax
jge 0x10026d19
mov dword [ebp - 0x33c], 1
jmp 0x10026d20
and dword [ebp - 0x33c], 0
cmp dword [ebp - 0x33c], 0x4c3e
jne 0x10026d38
mov dword [ebp - 0x178], 1
jmp 0x10026d3f
and dword [ebp - 0x178], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x178]
mov dword [ebp + eax - 0x444], ecx
mov eax, dword [ebp - 0x178]
neg eax
cmp eax, dword [ebp - 0x68]
je 0x10026d6b
mov dword [ebp - 0x250], 1
jmp 0x10026d72
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x250]
jge 0x10026d89
mov dword [ebp - 0x404], 1
jmp 0x10026d90
and dword [ebp - 0x404], 0
push 0
lea ecx, [ebp - 0x518]
call fcn.10017169
mov ecx, dword [ebp - 0x404]
add ecx, dword [eax]
je 0x10026dbc
mov eax, 0x5ce5aba8
test eax, eax
je 0x10026dbc
mov dword [ebp - 0x47c], 1
jmp 0x10026dc3
and dword [ebp - 0x47c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4b0]
cmp dword [ebp + eax - 0x444], ecx
jle 0x10026de4
mov dword [ebp - 0x258], 1
jmp 0x10026deb
and dword [ebp - 0x258], 0
cmp dword [ebp - 0x258], 0x9cc
jne 0x10026e03
mov dword [ebp - 0x344], 1
jmp 0x10026e0a
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x344]
shl eax, 3
cmp eax, dword [ebp - 0x44]
jne 0x10026e28
mov dword [ebp - 0x260], 1
jmp 0x10026e2f
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x260]
add eax, 0xfff6
mov dword [ebp - 0x3b4], eax
mov esi, dword [ebp - 0x3b4]
push 0
lea ecx, [ebp - 0x518]
call fcn.10017169
cmp esi, dword [eax]
jl 0x10026e63
mov dword [ebp - 0x268], 1
jmp 0x10026e6a
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x268], eax
jge 0x10026e81
mov dword [ebp - 0x34c], 1
jmp 0x10026e88
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x34c]
jge 0x10026eae
push 0
lea ecx, [ebp - 0x518]
call fcn.10017169
cmp dword [eax], 0
jne 0x10026eae
and dword [ebp - 0x270], 0
jmp 0x10026eb8
mov dword [ebp - 0x270], 1
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x270]
sub eax, dword [ebp - 0x44]
neg eax
add eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x68]
jge 0x10026edb
mov dword [ebp - 0x3ec], 1
jmp 0x10026ee2
and dword [ebp - 0x3ec], 0
push 0
lea ecx, [ebp - 0x5b4]
call fcn.10017169
mov ecx, dword [ebp - 0x3ec]
mov dword [eax], ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x5b4]
call fcn.10017164
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.10017164
push 3
lea ecx, [ebp - 0x550]
call fcn.100170df
mov dword [ebp - 4], 6
mov dword [ebp - 0x6c8], 0xae9714a0
mov byte [ebp - 0x58], 0
movzx eax, byte [ebp - 0x58]
test eax, eax
je 0x10026f4e
push 0
push 0x1b6f
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov byte [ebp - 0x61], 0
movzx eax, byte [ebp - 0x61]
test eax, eax
je 0x10026f6f
push 0
push 0x11c4
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0xa8], 0
jmp 0x10026f88
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x10026fa4
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x528], 0
jmp 0x10026f7b
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x414], 0x77b6
mov dword [ebp - 0x2c], 0
jmp 0x10026fc5
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10026fd8
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x28], 0x4e2db58
jmp 0x10026fbe
mov dword [ebp - 0x2c], 0
jmp 0x10026fe8
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10026ffe
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x558], 0x38884515
jmp 0x10026fe1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x28], 3
jmp 0x10027023
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x28], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28], 0x13
jl 0x10027413
mov dword [ebp - 0x5a8], 0xfffffff7
mov dword [ebp - 0x5a4], 0xfffffff7
mov dword [ebp - 0x5a0], 0xfffffff7
mov dword [ebp - 0x59c], 0xfffffff7
lea ecx, [ebp - 0x17e]
call fcn.10008a53
push eax
lea eax, [ebp - 0x598]
push eax
lea eax, [ebp - 0x5a8]
push eax
lea ecx, [ebp - 0x720]
call fcn.10017178
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x42c]
call fcn.1001713e
mov byte [ebp - 4], 7
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x49c], 0x9105fa2e
mov dword [ebp - 0x498], 0x9105fa2e
mov dword [ebp - 0x494], 0x9105fa2e
mov dword [ebp - 0x490], 0x9105fa2e
push 3
lea ecx, [ebp - 0x42c]
call fcn.10017169
and dword [eax], 0
jmp 0x100270fa
push 3
lea ecx, [ebp - 0x42c]
call fcn.10017169
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x278]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x278]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x42c]
call fcn.10017169
cmp dword [eax], 0xfffffff6
jne 0x100272bd
mov dword [ebp - 0x168], 0xa6d
mov dword [ebp - 0x6d0], 0x6559653e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
mov dword [ebp - 0x6ec], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
mov dword [ebp - 0x48], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
add eax, 0xbdeb
cmp dword [ebp - 0x48], eax
jle 0x10027161
mov dword [ebp - 0x354], 1
jmp 0x10027168
and dword [ebp - 0x354], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp eax, dword [ebp - 0x354]
jle 0x10027186
mov dword [ebp - 0x280], 1
jmp 0x1002718d
and dword [ebp - 0x280], 0
push 4
pop eax
shl eax, 0
lea eax, [ebp + eax - 0x558]
mov dword [ebp - 0x3bc], eax
push 3
lea ecx, [ebp - 0x42c]
call fcn.10017169
mov ecx, dword [ebp - 0x3bc]
mov eax, dword [eax]
mov dword [ecx], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
imul eax, dword [ebp - 0x280]
mov ecx, dword [ebp - 0x3bc]
mov ecx, dword [ecx]
add ecx, eax
mov dword [ebp - 0x288], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x288]
mov dword [ebp + eax - 0x49c], ecx
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x288], eax
jle 0x10027204
mov dword [ebp - 0x488], 1
jmp 0x1002720b
and dword [ebp - 0x488], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
mov dword [ebp - 0x6f4], eax
mov esi, dword [ebp - 0x168]
push 3
lea ecx, [ebp - 0x42c]
call fcn.10017169
cmp esi, dword [eax]
jne 0x1002723e
mov dword [ebp - 0x35c], 1
jmp 0x10027245
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x35c], eax
jl 0x1002725c
mov dword [ebp - 0x290], 1
jmp 0x10027263
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x290], eax
jl 0x1002727b
cmp dword [ebp - 0x4c], 0
je 0x10027279
jmp 0x100272bd
jmp 0x100272b8
mov dword [ebp - 0x6cc], 0x5cf0adc1
mov eax, dword [ebp - 0x414]
dec eax
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x4c], 0
jmp 0x100272a2
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x100272b8
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x558], 0x3e731e7b
jmp 0x1002729b
jmp 0x100270d6
mov dword [ebp - 0x48], 0x15
jmp 0x100272cd
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
je 0x100273ff
mov dword [ebp - 0x138], 0xffffffff
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x678], eax
cmp dword [ebp - 0x138], 0
jne 0x100273db
cmp dword [ebp - 0x138], 0
jne 0x100273db
cmp dword [ebp - 0x138], 0x17d239f9
jle 0x1002731c
mov dword [ebp - 0x298], 1
jmp 0x10027323
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x298], eax
jle 0x1002733a
mov dword [ebp - 0x4b8], 1
jmp 0x10027341
and dword [ebp - 0x4b8], 0
cmp dword [ebp - 0x138], 6
jbe 0x10027356
mov dword [ebp - 0x364], 1
jmp 0x1002735d
and dword [ebp - 0x364], 0
cmp dword [ebp - 0x364], 0xfffffffe
jg 0x10027372
mov dword [ebp - 0x2a0], 1
jmp 0x10027379
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x2a0]
je 0x10027390
mov dword [ebp - 0x4c0], 1
jmp 0x10027397
and dword [ebp - 0x4c0], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x49c]
add eax, dword [ebp + ecx - 0x49c]
mov dword [ebp - 0x3c4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp + eax - 0x49c], ecx
cmp dword [ebp - 0x3c4], 0
jne 0x100273db
and dword [ebp - 0x2a8], 0
jmp 0x100273e5
mov dword [ebp - 0x2a8], 1
push 3
lea ecx, [ebp - 0x42c]
call fcn.10017169
mov ecx, dword [ebp - 0x2a8]
mov dword [eax], ecx
jmp 0x100272c6
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x42c]
call fcn.10017164
jmp 0x1002700e
lea eax, [ebp - 0xa8]
push eax
push 0x31b2
push 0
lea eax, [ebp - 0x550]
push eax
call fcn.1002c78e
add esp, 0x10
push 2
lea ecx, [ebp - 0xcc]
call fcn.100170df
mov byte [ebp - 4], 8
mov dword [ebp - 0x98], 4
mov dword [ebp - 0x100], 0xfffffff9
mov dword [ebp - 0x150], 3
mov dword [ebp - 0x3f4], 5
push 1
lea ecx, [ebp - 0x5d8]
call fcn.100170df
mov byte [ebp - 4], 9
mov dword [ebp - 0x2b8], 0xfffe
push 2
lea ecx, [ebp - 0x5c0]
call fcn.100170df
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x3cc], 3
mov dword [ebp - 0x14], 0
jmp 0x100274af
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x100274cb
push dword [ebp - 0x14]
lea ecx, [ebp - 0xcc]
call fcn.10017169
mov dword [eax], 0xffff
jmp 0x100274a8
mov dword [ebp - 0x14], 0
jmp 0x100274db
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x100274f7
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5d8]
call fcn.10017169
mov dword [eax], 1
jmp 0x100274d4
mov dword [ebp - 0x14], 0
jmp 0x10027507
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10027523
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5c0]
call fcn.10017169
mov dword [eax], 0xaf2c67a9
jmp 0x10027500
push 0
lea ecx, [ebp - 0xcc]
call fcn.10017169
cmp dword [ebp - 0x98], 0xffffffff
jne 0x10027545
mov dword [ebp - 0x4e4], 1
jmp 0x1002754c
and dword [ebp - 0x4e4], 0
push 0
lea ecx, [ebp - 0xcc]
call fcn.10017169
push 1
lea ecx, [ebp - 0xcc]
call fcn.10017169
mov esi, eax
push 1
lea ecx, [ebp - 0xcc]
call fcn.10017169
mov esi, dword [esi]
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0xcc]
call fcn.10017169
cmp esi, dword [eax]
jne 0x10027596
mov dword [ebp - 0x36c], 1
jmp 0x1002759d
and dword [ebp - 0x36c], 0
push 0
lea ecx, [ebp - 0xcc]
call fcn.10017169
mov ecx, dword [ebp - 0x36c]
add ecx, dword [eax]
sub ecx, dword [ebp - 0x98]
jne 0x100275c6
mov dword [ebp - 0x2b0], 1
jmp 0x100275cd
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x2b0], eax
jg 0x100275e7
mov dword [ebp - 0x4a4], 1
jmp 0x100275ee
and dword [ebp - 0x4a4], 0
push 1
lea ecx, [ebp - 0xcc]
call fcn.10017169
push 0
lea ecx, [ebp - 0xcc]
call fcn.10017169
cmp dword [eax], 0xffffffff
jg 0x10027628
mov eax, 0xc2af
test eax, eax
jne 0x10027628
cmp dword [ebp - 0x98], 0
jne 0x10027628
and dword [ebp - 0x530], 0
jmp 0x10027632
mov dword [ebp - 0x530], 1
push 1
lea ecx, [ebp - 0xcc]
call fcn.10017169
mov eax, dword [eax]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x604], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x610], eax
push 0
lea ecx, [ebp - 0xcc]
call fcn.10017169
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x6c4], eax
push 1
lea ecx, [ebp - 0xcc]
call fcn.10017169
mov eax, dword [eax]
mov dword [ebp - 0x3f4], eax
mov esi, dword [ebp - 0x3f4]
push 0
lea ecx, [ebp - 0x5d8]
call fcn.10017169
mov dword [eax], esi
cmp dword [ebp - 0x98], 0
je 0x100276b2
cmp dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
mov esi, dword [ebp - 0x150]
imul esi, dword [ebp - 0x2b8]
push 1
lea ecx, [ebp - 0xcc]
call fcn.10017169
add esi, dword [eax]
cmp esi, 0xffff
jbe 0x100276ef
mov dword [ebp - 0x374], 1
jmp 0x100276f6
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x374], eax
jle 0x10027710
mov dword [ebp - 0x2c0], 1
jmp 0x10027717
and dword [ebp - 0x2c0], 0
push 1
lea ecx, [ebp - 0xcc]
call fcn.10017169
mov esi, dword [eax]
imul esi, dword [ebp - 0x2c0]
push 1
lea ecx, [ebp - 0x5c0]
call fcn.10017169
mov dword [eax], esi
mov eax, dword [ebp - 0x3cc]
dec eax
mov dword [ebp - 0x3cc], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x5c0]
call fcn.10017164
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x5d8]
call fcn.10017164
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xcc]
call fcn.10017164
mov dword [ebp - 0x54], 0x42c70bb7
push 4
lea ecx, [ebp - 0x694]
call fcn.100170df
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x4ac], 0xd9c7279c
mov dword [ebp - 0x30], 0
jmp 0x100277a8
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x100277be
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x700], 1
jmp 0x100277a1
mov dword [ebp - 0x30], 0
jmp 0x100277ce
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x100277ea
push dword [ebp - 0x30]
lea ecx, [ebp - 0x694]
call fcn.10017169
mov dword [eax], 0xf5aee0cd
jmp 0x100277c7
mov dword [ebp - 0x54], 0
jmp 0x100277fa
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jg 0x1002784b
mov dword [ebp - 0x120], 0xff55e00f
mov dword [ebp - 0x120], 2
jmp 0x10027823
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jl 0x10027849
mov byte [ebp - 0x57], 0
movzx eax, byte [ebp - 0x57]
test eax, eax
je 0x10027847
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
jmp 0x10027816
jmp 0x100277f3
mov dword [ebp - 0x54], 2
jmp 0x1002785b
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x10027910
mov dword [ebp - 0x618], 0xfffffffa
mov dword [ebp - 0x2c8], 0xc8b9ba5e
mov dword [ebp - 0x108], 0
jmp 0x10027892
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jge 0x100278ae
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x744], 0x5a8b
jmp 0x10027885
mov dword [ebp - 0x2c8], 1
mov eax, dword [ebp - 0x2c8]
sub eax, 9
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x700]
jne 0x100278dc
mov dword [ebp - 0x37c], 1
jmp 0x100278e3
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x4ac], eax
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x1002790b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
jmp 0x10027854
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x694]
call fcn.10017164
cmp dword [ebp - 0x10], 0
jne 0x100279ac
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x10]
cmp eax, 7
jbe 0x1002794e
cmp dword [ebp - 0x34], 0
je 0x1002794e
mov dword [ebp - 0x2d0], 1
jmp 0x10027955
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x2d0]
jg 0x1002796c
mov dword [ebp - 0x4ec], 1
jmp 0x10027973
and dword [ebp - 0x4ec], 0
xor eax, eax
inc eax
jne 0x1002798d
mov eax, 0x6700
test eax, eax
jne 0x1002798d
mov dword [ebp - 0x40c], 1
jmp 0x10027994
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x34], 0
jne 0x100279ac
and dword [ebp - 0x2d8], 0
jmp 0x100279b6
mov dword [ebp - 0x2d8], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x528]
cmp dword [ebp - 0x2d8], eax
jne 0x10027f6a
mov dword [ebp - 0xa4], 0xda8e97ee
mov dword [ebp - 0x130], 0
jmp 0x100279f2
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
jge 0x10027a0e
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x688], 0xbaf43b7c
jmp 0x100279e5
mov dword [ebp - 0xa4], 0
jmp 0x10027a27
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jl 0x10027b20
mov dword [ebp - 0xe4], 1
mov dword [ebp - 0xd8], 0
jmp 0x10027a57
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 1
jge 0x10027a73
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x4b4], 0xc5534bf8
jmp 0x10027a4a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x4b4], 3
mov dword [ebp - 0xe4], 0
jmp 0x10027a9d
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jg 0x10027b1b
mov dword [ebp - 0xec], 1
mov dword [ebp - 0xec], 0
jmp 0x10027ac9
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x10027b08
mov byte [ebp - 0x55], 0
movzx eax, byte [ebp - 0x55]
test eax, eax
je 0x10027b06
push 0x2660
push 0xb9f
push 0x2bf
push 0x1c52
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
jmp 0x10027abc
cmp dword [ebp - 0xa4], 0
je 0x10027b16
jmp 0x10027a90
jmp 0x10027a90
jmp 0x10027a1a
mov dword [ebp - 0x78], 0
mov dword [ebp - 0xb4], 0xffffffff
mov dword [ebp - 0x70], 1
push 4
lea ecx, [ebp - 0x5f0]
call fcn.100170df
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xd0], 0
jmp 0x10027b62
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 4
jge 0x10027b81
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x5f0]
call fcn.10017169
or dword [eax], 0xffffffff
jmp 0x10027b55
mov dword [ebp - 0xb4], 0
jmp 0x10027b9a
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 8
jne 0x10027c82
mov dword [ebp - 0x90], 0xda5043c4
mov dword [ebp - 0x2e8], 0xfffffffa
cmp dword [ebp - 0x90], 0
jne 0x10027c67
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x620], eax
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x90], eax
jle 0x10027bee
mov dword [ebp - 0x384], 1
jmp 0x10027bf5
and dword [ebp - 0x384], 0
cmp dword [ebp - 0x384], 0x39e
jge 0x10027c0d
mov dword [ebp - 0x2e0], 1
jmp 0x10027c14
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x2e0], eax
je 0x10027c2e
mov dword [ebp - 0x3d4], 1
jmp 0x10027c35
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0x90]
add eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x2e8]
je 0x10027c67
mov eax, 0xfffc
test eax, eax
jne 0x10027c67
and dword [ebp - 0x38c], 0
jmp 0x10027c71
mov dword [ebp - 0x38c], 1
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x90], eax
jmp 0x10027b8d
mov dword [ebp - 0x70], 0
jmp 0x10027c92
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x10027cae
push dword [ebp - 0x70]
lea ecx, [ebp - 0x5f0]
call fcn.10017169
mov dword [eax], 0x13b28858
jmp 0x10027c8b
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x5f0]
call fcn.10017164
mov dword [ebp - 0x22c], 0xe868e013
mov dword [ebp - 0x6f0], 0xf112
mov dword [ebp - 0x628], 0x8901f2c2
mov dword [ebp - 0x698], 0x3fa75c19
mov dword [ebp - 0x630], 0xfddd3f46
mov dword [ebp - 0x6ac], 2
push 4
lea ecx, [ebp - 0x6a4]
call fcn.100170df
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x638], 0x4e665969
mov dword [ebp - 0x2f0], 3
mov dword [ebp - 0xf4], 0
jmp 0x10027d37
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 4
jge 0x10027d59
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x6a4]
call fcn.10017169
mov dword [eax], 0x1449c9fb
jmp 0x10027d2a
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6a4]
call fcn.10017164
mov eax, dword [ebp - 0x39c]
cmp dword [ebp - 0x78], eax
jg 0x10027d8c
mov dword [ebp - 0x3fc], 1
jmp 0x10027d93
and dword [ebp - 0x3fc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x528]
cmp dword [ebp - 0x3fc], eax
je 0x10027db3
mov dword [ebp - 0x2f8], 1
jmp 0x10027dba
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x2f8], eax
jne 0x10027dd1
mov dword [ebp - 0x394], 1
jmp 0x10027dd8
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x394], eax
je 0x10027df2
cmp dword [ebp - 0x78], 0
jne 0x10027df2
and dword [ebp - 0x300], 0
jmp 0x10027dfc
mov dword [ebp - 0x300], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x528]
cmp dword [ebp - 0x300], eax
jl 0x10027e1d
mov dword [ebp - 0x3dc], 1
jmp 0x10027e24
and dword [ebp - 0x3dc], 0
cmp dword [ebp - 0x3dc], 0x4380
jle 0x10027e3c
mov dword [ebp - 0x308], 1
jmp 0x10027e43
and dword [ebp - 0x308], 0
imul eax, dword [ebp - 0x308], 0xfff7
test eax, eax
jne 0x10027e55
cmp dword [ebp - 0x78], 0
cmp dword [ebp - 0x78], 0
jne 0x10027e6d
cmp dword [ebp - 0x39c], 0
jne 0x10027e6d
and dword [ebp - 0x200], 0
jmp 0x10027e77
mov dword [ebp - 0x200], 1
push 2
lea ecx, [ebp - 0x550]
call fcn.10017169
mov ecx, dword [ebp - 0x200]
cmp ecx, dword [eax]
jl 0x10027e9a
mov dword [ebp - 0x18c], 1
jmp 0x10027ea1
and dword [ebp - 0x18c], 0
cmp dword [ebp - 0x18c], 0x426f
jne 0x10027eb9
mov dword [ebp - 0x1fc], 1
jmp 0x10027ec0
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x1fc]
inc eax
cmp eax, dword [ebp - 0x78]
jge 0x10027ed8
mov dword [ebp - 0x214], 1
jmp 0x10027edf
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x214], eax
jle 0x10027ef6
mov dword [ebp - 0x21c], 1
jmp 0x10027efd
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x21c]
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x528]
cmp eax, dword [ebp - 0x78]
jne 0x10027f23
mov dword [ebp - 0x224], 1
jmp 0x10027f2a
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x22c], 0x9e820f9
cmp dword [ebp - 0x22c], 0x49a2f381
jge 0x10027f55
mov dword [ebp - 0x234], 1
jmp 0x10027f5c
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x34], eax
jmp 0x100283a0
mov dword [ebp - 0x10], 0
jmp 0x10027f7a
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x100283a0
mov dword [ebp - 0x594], 0xfffffffb
mov dword [ebp - 0x590], 0xfffffffb
mov dword [ebp - 0x58c], 0xfffffffb
mov dword [ebp - 0x588], 0xfffffffb
lea ecx, [ebp - 0x17d]
call fcn.10008a53
push eax
lea eax, [ebp - 0x584]
push eax
lea eax, [ebp - 0x594]
push eax
lea ecx, [ebp - 0x738]
call fcn.10017178
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x718]
call fcn.1001713e
mov dword [ebp - 0xfc], 0x8094a188
mov dword [ebp - 0xfc], 0
jmp 0x10028004
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jg 0x10028028
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x10028026
push 0x699
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x10027ff7
lea ecx, [ebp - 0x718]
call fcn.10017164
mov dword [ebp - 0x34], 0
jmp 0x10028043
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jg 0x1002839b
push 3
lea ecx, [ebp - 0x148]
call fcn.100170df
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x94], 1
mov dword [ebp - 0x104], 0
jmp 0x10028081
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jge 0x100280a3
push dword [ebp - 0x104]
lea ecx, [ebp - 0x148]
call fcn.10017169
mov dword [eax], 0x27cb3f4f
jmp 0x10028074
push 2
lea ecx, [ebp - 0x148]
call fcn.10017169
cmp dword [eax], 0
je 0x100282bd
mov dword [ebp - 0xb0], 0xdcba
mov dword [ebp - 0x4bc], 0
cmp dword [ebp - 0xb0], 0
jne 0x100280e8
mov eax, 0xb5725d36
test eax, eax
jne 0x100280e8
and dword [ebp - 0x23c], 0
jmp 0x100280f2
mov dword [ebp - 0x23c], 1
push 1
lea ecx, [ebp - 0x148]
call fcn.10017169
mov esi, eax
push 0
lea ecx, [ebp - 0x148]
call fcn.10017169
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x10028120
mov dword [ebp - 0x244], 1
jmp 0x10028127
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x244]
jne 0x1002815f
push 2
lea ecx, [ebp - 0x148]
call fcn.10017169
cmp dword [eax], 0
je 0x1002815f
mov dword [ebp - 0x24c], 1
jmp 0x10028166
and dword [ebp - 0x24c], 0
mov esi, dword [ebp - 0x24c]
sub esi, dword [ebp - 0xb0]
push 2
lea ecx, [ebp - 0x148]
call fcn.10017169
cmp esi, dword [eax]
jl 0x1002818f
mov dword [ebp - 0x254], 1
jmp 0x10028196
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x254], eax
jl 0x100281b0
mov dword [ebp - 0x25c], 1
jmp 0x100281b7
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x25c]
add eax, 0x68d3bf57
cmp eax, 0x9a85
jne 0x100281d5
mov dword [ebp - 0x264], 1
jmp 0x100281dc
and dword [ebp - 0x264], 0
mov esi, dword [ebp - 0xb0]
push 2
lea ecx, [ebp - 0x148]
call fcn.10017169
mov edi, dword [ebp - 0x264]
imul edi, dword [eax]
push 2
lea ecx, [ebp - 0x148]
call fcn.10017169
imul edi, dword [eax]
cmp esi, edi
jle 0x10028218
mov dword [ebp - 0x26c], 1
jmp 0x1002821f
and dword [ebp - 0x26c], 0
push 1
lea ecx, [ebp - 0x148]
call fcn.10017169
mov ecx, dword [ebp - 0x26c]
cmp ecx, dword [eax]
jne 0x10028242
mov dword [ebp - 0x274], 1
jmp 0x10028249
and dword [ebp - 0x274], 0
mov esi, dword [ebp - 0xb0]
imul esi, dword [ebp - 0x274]
push 1
lea ecx, [ebp - 0x148]
call fcn.10017169
cmp esi, dword [eax]
jne 0x10028273
mov dword [ebp - 0x51c], 1
jmp 0x1002827a
and dword [ebp - 0x51c], 0
push 2
lea ecx, [ebp - 0x148]
call fcn.10017169
push 0
lea ecx, [ebp - 0x148]
call fcn.10017169
cmp dword [eax], 0xfffb
jne 0x100282a8
mov dword [ebp - 0x27c], 1
jmp 0x100282af
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x4bc], eax
jmp 0x10028326
mov dword [ebp - 0x94], 0
jmp 0x100282d6
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0x1c
jge 0x10028326
mov byte [ebp - 0x59], 0
movzx eax, byte [ebp - 0x59]
test eax, eax
je 0x100282fc
push 0
push 0x20ba
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x10028324
push 0
push 0
push 0xb6d
push 0x211e
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
jmp 0x100282c9
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x148]
call fcn.10017164
mov dword [ebp - 0xd4], 0
jmp 0x1002834e
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 3
jge 0x1002836a
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x70c], 0x6409ef32
jmp 0x10028341
push dword [ebp - 0x10]
lea ecx, [ebp - 0x550]
call fcn.10017169
cmp dword [eax], 0
je 0x1002837f
jmp 0x1002839b
mov eax, dword [ebp - 0x10]
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax*4 - 0x528]
mov dword [ebp + ecx - 0x70c], eax
jmp 0x1002803c
jmp 0x10027f73
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x550]
call fcn.10017164
mov dword [ebp - 0x11c], 0xffffffff
push 4
lea ecx, [ebp - 0x31c]
call fcn.100170df
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x538], 0x79c90e69
mov dword [ebp - 0x114], 0
jmp 0x100283f0
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 4
jge 0x10028412
push dword [ebp - 0x114]
lea ecx, [ebp - 0x31c]
call fcn.10017169
mov dword [eax], 0x2f38d927
jmp 0x100283e3
mov dword [ebp - 0x11c], 0
jmp 0x1002842b
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xffffffe6
jne 0x100286b6
mov dword [ebp - 0x38], 0
jmp 0x10028448
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1002845e
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x9c], 1
jmp 0x10028441
mov dword [ebp - 0x38], 0
jmp 0x1002846e
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x10028484
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x188], 0xffffffff
jmp 0x10028467
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x9c], 0xfffffffd
jmp 0x100284b2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x9c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9c], 0xfffffffb
je 0x100286b1
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x1c], 1
jmp 0x100284dd
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x100286ac
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x188]
mov dword [ebp - 0x284], eax
push 3
lea ecx, [ebp - 0x31c]
call fcn.10017169
mov ecx, dword [ebp - 0x284]
mov dword [eax], ecx
cmp dword [ebp - 0x284], 0xfffffffd
jg 0x10028521
mov dword [ebp - 0x4f4], 1
jmp 0x10028528
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x1c]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x9c]
cmp dword [ebp + eax*4 - 0x188], ecx
jle 0x1002854d
mov dword [ebp - 0x4c4], 1
jmp 0x10028554
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x1c]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x9c]
cmp dword [ebp + eax*4 - 0x188], ecx
jge 0x10028579
mov dword [ebp - 0x28c], 1
jmp 0x10028580
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x188]
cmp eax, dword [ebp - 0x28c]
jl 0x1002859e
mov dword [ebp - 0x294], 1
jmp 0x100285a5
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x188]
cmp dword [ebp - 0x294], eax
jl 0x100285c3
mov dword [ebp - 0x29c], 1
jmp 0x100285ca
and dword [ebp - 0x29c], 0
cmp dword [ebp - 0x29c], 0xffffffff
ja 0x100285df
mov dword [ebp - 0x2a4], 1
jmp 0x100285e6
and dword [ebp - 0x2a4], 0
cmp dword [ebp - 0x2a4], 0xffffffff
jge 0x100285ff
cmp dword [ebp - 0x1c], 0
je 0x100285fa
jmp 0x100286ac
jmp 0x100286a7
mov dword [ebp - 0x50], 0xfffffffe
mov dword [ebp - 0x50], 0xffffffe7
jmp 0x10028616
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xffffffe7
jge 0x10028659
mov byte [ebp - 0x84], 0
movzx eax, byte [ebp - 0x84]
test eax, eax
je 0x10028645
push 0xd0a
push 0
push 0x2bd
push 0x1278
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x188], 0
je 0x10028657
jmp 0x1002860f
jmp 0x1002860f
mov dword [ebp - 0x50], 1
jmp 0x10028669
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x100286a7
mov dword [ebp - 0x124], 1
mov dword [ebp - 0x124], 0
jmp 0x10028692
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
jg 0x100286a5
cmp dword [ebp - 0x1c], 0
je 0x100286a3
jmp 0x100286a5
jmp 0x10028685
jmp 0x10028662
jmp 0x100284d6
jmp 0x10028497
jmp 0x1002841e
push 3
lea ecx, [ebp - 0x31c]
call fcn.10017169
cmp dword [eax], 0
jne 0x100286e3
push 3
lea ecx, [ebp - 0x31c]
call fcn.10017169
cmp dword [eax], 0
jne 0x100286e3
and dword [ebp - 0x2ac], 0
jmp 0x100286ed
mov dword [ebp - 0x2ac], 1
mov esi, dword [ebp - 0x538]
push 3
lea ecx, [ebp - 0x31c]
call fcn.10017169
cmp esi, dword [eax]
jg 0x10028710
mov dword [ebp - 0x2b4], 1
jmp 0x10028717
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x2ac]
cmp eax, dword [ebp - 0x2b4]
jl 0x10028731
mov dword [ebp - 0x2bc], 1
jmp 0x10028738
and dword [ebp - 0x2bc], 0
push 1
lea ecx, [ebp - 0x31c]
call fcn.10017169
mov eax, dword [eax]
cmp eax, dword [ebp - 0x2bc]
jne 0x1002875b
mov dword [ebp - 0x2c4], 1
jmp 0x10028762
and dword [ebp - 0x2c4], 0
push 3
lea ecx, [ebp - 0x31c]
call fcn.10017169
mov ecx, dword [ebp - 0x2c4]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x31c]
call fcn.10017164
mov eax, dword [ebp - 0x4cc]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0
jle 0x10028fee
mov dword [ebp - 0x18], 0x4b733c63
push 2
lea ecx, [ebp - 0x5cc]
call fcn.100170df
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x24], 0
jmp 0x100287cd
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x100287e3
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x484], 0x4c865b49
jmp 0x100287c6
mov dword [ebp - 0x24], 0
jmp 0x100287f3
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10028809
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x66c], 1
jmp 0x100287ec
push 0
push 0x1729
lea eax, [ebp - 0x5cc]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x7f9b
call fcn.1002c607
add esp, 0x14
cmp dword [ebp - 0x18], 0
je 0x1002889a
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
je 0x10028842
mov dword [ebp - 0x2cc], 1
jmp 0x10028849
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x2cc], eax
jg 0x10028863
cmp dword [ebp - 0x18], 0
jne 0x10028863
and dword [ebp - 0x4fc], 0
jmp 0x1002886d
mov dword [ebp - 0x4fc], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x640], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x18], 0
je 0x1002889a
mov dword [ebp - 0x2d4], 1
jmp 0x100288a1
and dword [ebp - 0x2d4], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x484], 1
cmp dword [ebp - 0x2d4], 1
jne 0x100288c7
mov dword [ebp - 0x2dc], 1
jmp 0x100288ce
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x2dc], eax
jg 0x100288e5
mov dword [ebp - 0x2e4], 1
jmp 0x100288ec
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x2e4], eax
je 0x10028903
mov dword [ebp - 0x2ec], 1
jmp 0x1002890a
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2ec]
je 0x10028931
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x484], 0
je 0x10028931
mov dword [ebp - 0x2f4], 1
jmp 0x10028938
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x2f4], eax
jge 0x1002894f
mov dword [ebp - 0x2fc], 1
jmp 0x10028956
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x2fc]
jne 0x1002896d
mov dword [ebp - 0x304], 1
jmp 0x10028974
and dword [ebp - 0x304], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x304]
mov dword [ebp + eax - 0x66c], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x484], 0xcecb4571
jbe 0x100289a6
mov dword [ebp - 0x30c], 1
jmp 0x100289ad
and dword [ebp - 0x30c], 0
cmp dword [ebp - 0x30c], 0xdd5d0881
ja 0x100289c5
mov dword [ebp - 0x320], 1
jmp 0x100289cc
and dword [ebp - 0x320], 0
push 0
lea ecx, [ebp - 0x5cc]
call fcn.10017169
mov ecx, dword [ebp - 0x320]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5cc]
call fcn.10017164
push 4
push 0x1000
push dword [ebp - 0x154]
mov eax, dword [ebp - 0x1f4]
mov ecx, dword [ebp - 0x4d4]
add ecx, dword [eax + 0xc]
push ecx
push 0x6a26
push 0x72fc
call fcn.10025253
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x15c]
mov dword [ecx], eax
mov dword [ebp - 0x56c], 0x324ec2e0
mov dword [ebp - 0x568], 0x324ec2e0
mov dword [ebp - 0x564], 0x324ec2e0
mov dword [ebp - 0x560], 0x324ec2e0
lea ecx, [ebp - 0x149]
call fcn.10008a53
push eax
lea eax, [ebp - 0x55c]
push eax
lea eax, [ebp - 0x56c]
push eax
lea ecx, [ebp - 0x728]
call fcn.10017178
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc0]
call fcn.1001713e
mov dword [ebp - 4], 0x11
mov dword [ebp - 0xe0], 1
mov dword [ebp - 0x1a4], 0xfffffffb
mov dword [ebp - 0x1dc], 9
mov dword [ebp - 0x1d4], 0x6e71ebdc
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x12c], 0
jmp 0x10028ad7
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 2
jge 0x10028af3
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x170], 0x8e20b458
jmp 0x10028aca
push 0
lea ecx, [ebp - 0xc0]
call fcn.10017169
mov dword [eax], 0xfffffffb
jmp 0x10028b2c
push 0
lea ecx, [ebp - 0xc0]
call fcn.10017169
cmp dword [eax], 0xe
jl 0x10028d63
mov dword [ebp - 0x80], 0xfffc
mov dword [ebp - 0x13c], 0xffffffff
mov dword [ebp - 0x134], 0
jmp 0x10028b6c
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jge 0x10028b88
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x4dc], 0xfffffffa
jmp 0x10028b5f
cmp dword [ebp - 0x80], 0
jne 0x10028cfb
push 7
pop eax
test eax, eax
je 0x10028cd7
push 3
lea ecx, [ebp - 0xc0]
call fcn.10017169
push 3
lea ecx, [ebp - 0xc0]
call fcn.10017169
mov ecx, dword [ebp - 0x80]
imul ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x10028bce
mov dword [ebp - 0x330], 1
jmp 0x10028bd5
and dword [ebp - 0x330], 0
push 0
lea ecx, [ebp - 0xc0]
call fcn.10017169
mov eax, dword [eax]
cmp eax, dword [ebp - 0x330]
jne 0x10028bf8
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x350], eax
jle 0x10028cfb
mov eax, 0xa258
test eax, eax
jne 0x10028cfb
mov dword [ebp - 0x358], 1
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x358], eax
jne 0x10028d1f
mov dword [ebp - 0x360], 1
jmp 0x10028d26
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x360], eax
je 0x10028d40
mov dword [ebp - 0x368], 1
jmp 0x10028d47
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
je 0x10028d5e
push 2
lea ecx, [ebp - 0xc0]
call fcn.10017169
mov dword [ebp - 0xe0], 0xffff
mov esi, dword [ebp - 0xe0]
push 3
lea ecx, [ebp - 0xc0]
call fcn.10017169
cmp dword [eax], esi
jl 0x10028d9d
mov dword [ebp - 0x190], 1
jmp 0x10028da4
and dword [ebp - 0x190], 0
push 0
lea ecx, [ebp - 0xc0]
call fcn.10017169
cmp dword [eax], 0xe188a746
jb 0x10028dc5
mov dword [ebp - 0x370], 1
jmp 0x10028dcc
and dword [ebp - 0x370], 0
push 0
lea ecx, [ebp - 0xc0]
call fcn.10017169
mov ecx, dword [ebp - 0x370]
cmp ecx, dword [eax]
jg 0x10028def
mov dword [ebp - 0x378], 1
jmp 0x10028df6
and dword [ebp - 0x378], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x170]
cmp dword [ebp - 0x378], eax
jle 0x10028e17
mov dword [ebp - 0x380], 1
jmp 0x10028e1e
and dword [ebp - 0x380], 0
push 3
lea ecx, [ebp - 0xc0]
call fcn.10017169
mov ecx, dword [ebp - 0x380]
cmp ecx, dword [eax]
jg 0x10028e41
mov dword [ebp - 0x194], 1
jmp 0x10028e48
and dword [ebp - 0x194], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x190]
sub ecx, dword [ebp + eax - 0x170]
imul ecx, dword [ebp - 0x194]
mov dword [ebp - 0x19c], ecx
push 0
lea ecx, [ebp - 0xc0]
call fcn.10017169
mov ecx, dword [ebp - 0x19c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x170]
cmp dword [ebp - 0x1a4], eax
jle 0x10028eaa
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret