Function at 0x100207c9
Capabilities:
Contain obfuscated stackstrings
Create pipe
Get common file path
Get disk information
Get graphical window text
Identify system language via api
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006b4e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1754
call fcn.10066e20
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x70c], 0
push 3
lea ecx, [ebp - 0x10f0]
call fcn.100131db
and dword [ebp - 4], 0
mov dword [ebp - 0x2a8], 0
jmp 0x10020830
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 3
jge 0x10020852
push dword [ebp - 0x2a8]
lea ecx, [ebp - 0x10f0]
call fcn.10013282
mov dword [eax], 0x8029989d
jmp 0x10020823
mov dword [ebp - 0x138], 0
jmp 0x1002086b
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xffffffff
jl 0x100209bd
mov dword [ebp - 0x538], 0xfffffff9
push 4
lea ecx, [ebp - 0x1054]
call fcn.100131db
mov byte [ebp - 4], 1
mov dword [ebp - 0xc94], 0xffffffff
mov dword [ebp - 0x370], 0
jmp 0x100208b6
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 4
jge 0x100208d5
push dword [ebp - 0x370]
lea ecx, [ebp - 0x1054]
call fcn.10013282
or dword [eax], 0xffffffff
jmp 0x100208a9
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x1210], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x70c], eax
mov esi, dword [ebp - 0x70c]
push 2
lea ecx, [ebp - 0x10f0]
call fcn.10013282
mov dword [eax], esi
cmp dword [ebp - 0x538], 0
je 0x10020920
cmp dword [ebp - 0x138], 0
je 0x10020920
mov dword [ebp - 0x45c], 1
jmp 0x10020927
and dword [ebp - 0x45c], 0
push 0
lea ecx, [ebp - 0x1054]
call fcn.10013282
mov ecx, dword [ebp - 0x45c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x538]
cmp dword [ebp - 0x45c], eax
jle 0x10020956
mov dword [ebp - 0xafc], 1
jmp 0x1002095d
and dword [ebp - 0xafc], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0xafc], eax
jge 0x10020977
mov dword [ebp - 0xb04], 1
jmp 0x1002097e
and dword [ebp - 0xb04], 0
mov eax, dword [ebp - 0xb04]
mov dword [ebp - 0xc94], eax
mov byte [ebp - 0x186], 0
movzx eax, byte [ebp - 0x186]
test eax, eax
je 0x100209a9
push 0x1249
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1054]
call fcn.1001325d
jmp 0x1002085e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10f0]
call fcn.1001325d
cmp dword [ebp + 0x10], 0
jbe 0x10020c62
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10020c62
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x4e4], 0x8067e307
mov dword [ebp - 0x148], 0xb597857
mov dword [ebp - 0xb24], 0x42c512dc
mov dword [ebp - 0x2b0], 4
mov dword [ebp - 0xb50], 0xffffffff
mov dword [ebp - 0x298], 0
jmp 0x10020a37
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 4
jge 0x10020a53
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0xf54], 0xe9ab5c29
jmp 0x10020a2a
mov byte [ebp - 0x17b], 0
movzx eax, byte [ebp - 0x17b]
test eax, eax
je 0x10020a6b
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x1468], eax
mov eax, dword [ebp - 0x140]
cmp eax, dword [ebp - 0x140]
je 0x10020a91
mov dword [ebp - 0xb0c], 1
jmp 0x10020a98
and dword [ebp - 0xb0c], 0
mov eax, dword [ebp - 0x140]
cmp eax, dword [ebp - 0xb0c]
jle 0x10020ab2
mov dword [ebp - 0xb14], 1
jmp 0x10020ab9
and dword [ebp - 0xb14], 0
mov eax, dword [ebp - 0xb14]
add eax, 0x46dd7f9c
add eax, dword [ebp - 0x140]
mov dword [ebp - 0xb1c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb1c]
mov dword [ebp + eax - 0xf54], ecx
cmp dword [ebp - 0xb1c], 0
jne 0x10020b05
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xf54], 0
jne 0x10020b05
and dword [ebp - 0xc90], 0
jmp 0x10020b0f
mov dword [ebp - 0xc90], 1
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x1308], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf54]
sub eax, dword [ebp - 0x140]
mov dword [ebp - 0xb24], eax
je 0x10020b4a
cmp dword [ebp - 0x2b0], 0
je 0x10020b4a
mov dword [ebp - 0xb2c], 1
jmp 0x10020b51
and dword [ebp - 0xb2c], 0
cmp dword [ebp - 0xb2c], 0xce1a812c
jae 0x10020b69
mov dword [ebp - 0xb40], 1
jmp 0x10020b70
and dword [ebp - 0xb40], 0
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0xb40], eax
jge 0x10020b8a
mov dword [ebp - 0xb48], 1
jmp 0x10020b91
and dword [ebp - 0xb48], 0
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x4e4], eax
mov eax, dword [ebp - 0xb48]
mov dword [ebp - 0xb50], eax
mov eax, dword [ebp - 0x4e4]
cmp eax, dword [ebp - 0xb50]
jg 0x10020bc3
mov dword [ebp - 0xb58], 1
jmp 0x10020bca
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0x2b0]
imul eax, dword [ebp - 0xb58]
cmp eax, dword [ebp - 0x148]
jle 0x10020beb
mov dword [ebp - 0xb60], 1
jmp 0x10020bf2
and dword [ebp - 0xb60], 0
cmp dword [ebp - 0xb60], 2
jb 0x10020c04
cmp dword [ebp - 0x2b0], 0
je 0x10020c3b
mov dword [ebp - 0x148], 0
jmp 0x10020c1d
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 4
jge 0x10020c39
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0xf54], 5
jmp 0x10020c10
jmp 0x10020c4e
mov eax, dword [ebp - 0x4e4]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xf54], eax
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1001d7e8
pop ecx
pop ecx
jmp 0x1002aa9b
mov dword [ebp - 0x18c], 0x1e559696
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0xb8], 0
jmp 0x10020c8f
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jge 0x10020cab
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0xca0], 0
jmp 0x10020c82
mov dword [ebp - 0xb8], 0
jmp 0x10020cc4
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jge 0x10020ce0
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0xf14], 0x77a14a9c
jmp 0x10020cb7
mov dword [ebp - 0x18c], 0
jmp 0x10020cf9
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
jl 0x10020dc9
mov dword [ebp - 0x1568], 0xffffffff
mov dword [ebp - 0x1310], 0
push 1
lea ecx, [ebp - 0x1084]
call fcn.100131db
mov dword [ebp - 4], 2
mov dword [ebp - 0xc98], 0
mov dword [ebp - 0x378], 0
jmp 0x10020d51
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 1
jge 0x10020d73
push dword [ebp - 0x378]
lea ecx, [ebp - 0x1084]
call fcn.10013282
mov dword [eax], 0xdf9c7750
jmp 0x10020d44
xor eax, eax
inc eax
je 0x10020d8d
cmp dword [ebp - 0x1cc], 0
je 0x10020d8d
mov dword [ebp - 0x464], 1
jmp 0x10020d94
and dword [ebp - 0x464], 0
push 0
lea ecx, [ebp - 0x1084]
call fcn.10013282
mov ecx, dword [ebp - 0x464]
mov dword [eax], ecx
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0xc98], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1084]
call fcn.1001325d
jmp 0x10020cec
mov dword [ebp - 0x1cc], 0x1a
jmp 0x10020de2
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0x11
je 0x10020f5f
mov dword [ebp - 0x150], 0xf355c0c8
mov dword [ebp - 0xb68], 0x5daa08bb
mov dword [ebp - 0xcb0], 0xf285f402
mov byte [ebp - 0x159], 0
movzx eax, byte [ebp - 0x159]
test eax, eax
je 0x10020e27
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xb68], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xca0]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0xb68]
cmp eax, dword [ebp - 0x18c]
jg 0x10020e60
mov dword [ebp - 0xb78], 1
jmp 0x10020e67
and dword [ebp - 0xb78], 0
mov eax, dword [ebp - 0x150]
add eax, dword [ebp - 0x1cc]
mov dword [ebp - 0xca8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xca8]
mov dword [ebp + eax - 0xf14], ecx
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xf14], 0x6d9e96b
cmp dword [ebp - 0x150], 0x6d9e96b
jle 0x10020eb5
mov dword [ebp - 0xb70], 1
jmp 0x10020ebc
and dword [ebp - 0xb70], 0
mov eax, dword [ebp - 0x150]
add eax, dword [ebp - 0xb70]
cmp dword [ebp - 0xb78], eax
jl 0x10020edc
mov dword [ebp - 0xb80], 1
jmp 0x10020ee3
and dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0xb80]
sub eax, dword [ebp - 0x150]
mov dword [ebp - 0xcb0], eax
cmp dword [ebp - 0x150], 0xffffffff
jg 0x10020f0a
mov dword [ebp - 0xb88], 1
jmp 0x10020f11
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0xb88], eax
jge 0x10020f3b
mov byte [ebp - 0x126], 0
movzx eax, byte [ebp - 0x126]
test eax, eax
je 0x10020f39
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10020f5a
mov byte [ebp - 0x127], 0
movzx eax, byte [ebp - 0x127]
test eax, eax
je 0x10020f5a
push 0x11d1
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x10020dd5
mov dword [ebp - 0x2b8], 0xe0a8eac8
mov byte [ebp - 0x162], 0
movzx eax, byte [ebp - 0x162]
test eax, eax
je 0x10020f88
push 0
push 0xe8c
call dword [sym.imp.USER32.dll_ValidateRgn]
mov dword [ebp - 0x2b8], 0x13
jmp 0x10020fa1
mov eax, dword [ebp - 0x2b8]
dec eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0xfffffff1
jle 0x10020ff6
mov dword [ebp - 0x37c], 0
mov dword [ebp - 0x37c], 0
jmp 0x10020fcd
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0xd
jg 0x10020ff4
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x10020ff2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
jmp 0x10020fc0
jmp 0x10020f94
cmp dword [ebp + 0x10], 0
jne 0x100261b4
mov dword [ebp - 0x2c0], 0x1f7e2799
mov dword [ebp - 0xcb8], 0x62c9cc14
mov dword [ebp - 0x1478], 0
mov dword [ebp - 0x2c0], 0
jmp 0x10021037
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0x12
jl 0x10021098
mov dword [ebp - 0x404], 0xfffffffd
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x10021068
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov dword [ebp - 0x404], 8
jmp 0x10021081
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0x15
jl 0x10021096
mov dword [ebp - 0xcb8], 0xcefa9d19
jmp 0x10021074
jmp 0x1002102a
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.10016c29
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x230], 0xc68ec0ae
mov dword [ebp - 0x230], 0
jmp 0x100210cc
mov eax, dword [ebp - 0x230]
dec eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0xfffffff9
je 0x100210e2
cmp dword [ebp - 0x230], 0
je 0x100210e0
jmp 0x100210e2
jmp 0x100210bf
mov byte [ebp - 0x12f], 0
movzx eax, byte [ebp - 0x12f]
test eax, eax
je 0x100210fe
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x158], 0x8d58
mov dword [ebp - 0x3dc], 0xfffffffc
push 1
lea ecx, [ebp - 0x288]
call fcn.100131db
mov dword [ebp - 4], 3
mov dword [ebp - 0x384], 0xb5486b6f
mov dword [ebp - 0x2d0], 0xa058a13c
mov dword [ebp - 0x8e8], 1
mov dword [ebp - 0x2c8], 0
jmp 0x10021164
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 1
jge 0x10021183
push dword [ebp - 0x2c8]
lea ecx, [ebp - 0x288]
call fcn.10013282
and dword [eax], 0
jmp 0x10021157
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x158]
je 0x1002119a
mov dword [ebp - 0xbc0], 1
jmp 0x100211a1
and dword [ebp - 0xbc0], 0
push 0
lea ecx, [ebp - 0x288]
call fcn.10013282
mov esi, eax
push 0
lea ecx, [ebp - 0x288]
call fcn.10013282
mov eax, dword [eax]
cmp eax, dword [esi]
je 0x100211cf
mov dword [ebp - 0xbb4], 1
jmp 0x100211d6
and dword [ebp - 0xbb4], 0
mov eax, dword [ebp - 0xbb4]
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x3dc]
cmp eax, dword [ebp - 0x158]
jle 0x100211fc
mov dword [ebp - 0xb8c], 1
jmp 0x10021203
and dword [ebp - 0xb8c], 0
push 0
lea ecx, [ebp - 0x288]
call fcn.10013282
mov ecx, dword [ebp - 0xb8c]
cmp ecx, dword [eax]
jg 0x10021226
mov dword [ebp - 0xaf4], 1
jmp 0x1002122d
and dword [ebp - 0xaf4], 0
push 0
lea ecx, [ebp - 0x288]
call fcn.10013282
mov ecx, dword [ebp - 0xaf4]
cmp ecx, dword [eax]
jge 0x10021250
mov dword [ebp - 0x5b0], 1
jmp 0x10021257
and dword [ebp - 0x5b0], 0
push 0
lea ecx, [ebp - 0x288]
call fcn.10013282
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5b0]
jg 0x1002127a
mov dword [ebp - 0x8d0], 1
jmp 0x10021281
and dword [ebp - 0x8d0], 0
push 0
lea ecx, [ebp - 0x288]
call fcn.10013282
mov ecx, dword [ebp - 0x8d0]
cmp ecx, dword [eax]
je 0x100212a4
mov dword [ebp - 0x5b8], 1
jmp 0x100212ab
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x5b8], eax
jge 0x100212c2
mov dword [ebp - 0xa60], 1
jmp 0x100212c9
and dword [ebp - 0xa60], 0
cmp dword [ebp - 0xa60], 0xf0e77da1
ja 0x100212e1
mov dword [ebp - 0x5c0], 1
jmp 0x100212e8
and dword [ebp - 0x5c0], 0
cmp dword [ebp - 0x5c0], 0xa67606e8
ja 0x10021300
mov dword [ebp - 0x8d8], 1
jmp 0x10021307
and dword [ebp - 0x8d8], 0
push 0
lea ecx, [ebp - 0x288]
call fcn.10013282
mov ecx, dword [ebp - 0x8d8]
cmp ecx, dword [eax]
jne 0x10021325
cmp dword [ebp - 0x158], 0
cmp dword [ebp - 0x54], 0
jne 0x10021346
push 0
lea ecx, [ebp - 0x288]
call fcn.10013282
cmp dword [eax], 0
jne 0x10021346
and dword [ebp - 0x5c8], 0
jmp 0x10021350
mov dword [ebp - 0x5c8], 1
push 0
lea ecx, [ebp - 0x288]
call fcn.10013282
mov ecx, dword [ebp - 0x5c8]
mov dword [eax], ecx
cmp dword [ebp - 0x54], 0
jne 0x1002137a
cmp dword [ebp - 0x54], 0
jne 0x1002137a
and dword [ebp - 0xb28], 0
jmp 0x10021384
mov dword [ebp - 0xb28], 1
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0xb28], eax
jg 0x1002139e
mov dword [ebp - 0x5d0], 1
jmp 0x100213a5
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x5d0]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1318], eax
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x152c], eax
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x1320], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x1488], eax
push 0
lea ecx, [ebp - 0x288]
call fcn.10013282
cmp dword [eax], 0
jne 0x10021402
cmp dword [ebp - 0x158], 0
jne 0x10021402
and dword [ebp - 0xcc0], 0
jmp 0x1002140c
mov dword [ebp - 0xcc0], 1
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x1328], eax
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x384]
cmp eax, dword [ebp - 0x8e8]
jle 0x1002145a
cmp dword [ebp - 0x384], 0
je 0x1002145a
push 0
lea ecx, [ebp - 0x288]
call fcn.10013282
cmp dword [eax], 0
je 0x1002145a
mov dword [ebp - 0x8e0], 1
jmp 0x10021461
and dword [ebp - 0x8e0], 0
cmp dword [ebp - 0x8e0], 0x160c
je 0x10021479
mov dword [ebp - 0x5d8], 1
jmp 0x10021480
and dword [ebp - 0x5d8], 0
cmp dword [ebp - 0x5d8], 0x704bae91
jg 0x10021498
mov dword [ebp - 0xa68], 1
jmp 0x1002149f
and dword [ebp - 0xa68], 0
cmp dword [ebp - 0xa68], 0x7b2c
jl 0x100214b7
mov dword [ebp - 0x5e0], 1
jmp 0x100214be
and dword [ebp - 0x5e0], 0
cmp dword [ebp - 0x5e0], 0xfff9
jbe 0x100214da
xor eax, eax
je 0x100214da
mov dword [ebp - 0x5e8], 1
jmp 0x100214e1
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x8e8]
cmp dword [ebp - 0x5e8], eax
jne 0x100214fb
mov dword [ebp - 0x5f0], 1
jmp 0x10021502
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0xbc0]
cmp eax, dword [ebp - 0x5f0]
jle 0x1002163f
mov dword [ebp - 0x2d8], 0x9bdd1892
mov dword [ebp - 0x600], 0x189efa4e
mov dword [ebp - 0xb30], 0xb46dff61
mov dword [ebp - 0xcc8], 0x6e3f992c
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0xf04b2b3a
jbe 0x10021560
mov dword [ebp - 0x8f0], 1
jmp 0x10021567
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x3dc]
cmp dword [ebp - 0x8f0], eax
jl 0x10021581
mov dword [ebp - 0x5f8], 1
jmp 0x10021588
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x2d8]
cmp dword [ebp - 0x5f8], eax
jne 0x100215a2
mov dword [ebp - 0xa70], 1
jmp 0x100215a9
and dword [ebp - 0xa70], 0
mov eax, dword [ebp - 0xa70]
mov dword [ebp - 0x600], eax
cmp dword [ebp - 0x600], 0
je 0x100215ce
xor eax, eax
je 0x100215ce
mov dword [ebp - 0x8f8], 1
jmp 0x100215d5
and dword [ebp - 0x8f8], 0
cmp dword [ebp - 0x8f8], 0x7913da51
jg 0x100215ed
mov dword [ebp - 0x608], 1
jmp 0x100215f4
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x2d8]
cmp eax, dword [ebp - 0x608]
je 0x1002160b
mov eax, 0xffff
test eax, eax
jne 0x10021618
push 0
lea ecx, [ebp - 0x288]
call fcn.10013282
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0xb30], eax
mov eax, dword [ebp - 0xb30]
mov dword [ebp - 0x114c], eax
imul eax, dword [ebp - 0x54], 0x4ac1
mov dword [ebp - 0xcc8], eax
jmp 0x10021683
mov dword [ebp - 0x54], 0
jmp 0x1002164f
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x10021683
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x1002166d
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x288]
call fcn.10013282
mov dword [eax], 0x464c6607
jmp 0x10021648
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x288]
call fcn.1001325d
mov dword [ebp - 0x1c4], 0xbac64a68
mov dword [ebp - 0xd20], 0x708bee6d
mov dword [ebp - 0x1c4], 0x1d
jmp 0x100216bf
mov eax, dword [ebp - 0x1c4]
dec eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0xfffffffb
jl 0x100218d2
mov dword [ebp - 0x1b0], 1
mov dword [ebp - 0x38c], 0
jmp 0x100216ef
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 3
jge 0x1002170b
mov eax, dword [ebp - 0x38c]
mov dword [ebp + eax*4 - 0x15bc], 0xfaab39e
jmp 0x100216e2
mov dword [ebp - 0x1b0], 0
jmp 0x10021724
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0x13
jg 0x100218cd
mov dword [ebp - 0x570], 0xe58b
mov dword [ebp - 0xec], 6
cmp dword [ebp - 0x570], 0
jne 0x1002175a
mov dword [ebp - 0x610], 1
jmp 0x10021761
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x1154], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x115c], eax
cmp dword [ebp - 0x570], 0xffffffff
ja 0x1002179a
mov dword [ebp - 0x900], 1
jmp 0x100217a1
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x1b0]
imul eax, dword [ebp - 0x900]
test eax, eax
je 0x100217ec
mov dword [ebp - 0xec], 0
jmp 0x100217cb
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jge 0x100217e7
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x15bc], 0xffffffff
jmp 0x100217be
jmp 0x100218c8
mov dword [ebp - 0x46c], 0x25ec5604
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0x570]
je 0x10021810
mov dword [ebp - 0x908], 1
jmp 0x10021817
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0x46c]
jge 0x10021831
mov dword [ebp - 0x618], 1
jmp 0x10021838
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0x46c]
jg 0x10021852
mov dword [ebp - 0xa78], 1
jmp 0x10021859
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0x618]
cmp eax, dword [ebp - 0xa78]
jle 0x10021873
mov dword [ebp - 0x620], 1
jmp 0x1002187a
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x46c]
cmp dword [ebp - 0x620], eax
jge 0x10021894
mov dword [ebp - 0x628], 1
jmp 0x1002189b
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x908]
cmp eax, dword [ebp - 0x628]
jne 0x100218b5
mov dword [ebp - 0xb9c], 1
jmp 0x100218bc
and dword [ebp - 0xb9c], 0
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0xd20], eax
jmp 0x10021717
jmp 0x100216b2
mov byte [ebp - 0x133], 0
movzx eax, byte [ebp - 0x133]
test eax, eax
je 0x100218f1
push 0
push 0x3f2
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [0x10613a1c], 0
jne 0x10025ac6
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x22c], 7
jmp 0x10021921
mov eax, dword [ebp - 0x22c]
dec eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0xfffffffd
je 0x1002195b
cmp dword [ebp - 0x22c], 0
je 0x10021935
jmp 0x1002195b
mov byte [ebp - 0x185], 0
movzx eax, byte [ebp - 0x185]
test eax, eax
je 0x10021959
push 0
push 0x789
push 0x1cc2
call dword [sym.imp.GDI32.dll_CreatePen]
jmp 0x10021914
mov dword [ebp - 0xd28], 0x1c83
lea eax, [ebp - 0xd28]
push eax
call fcn.1001d79e
pop ecx
mov dword [ebp - 0x868], eax
mov dword [ebp - 0x1164], 0
mov dword [ebp - 0x116c], 0x3f4f46db
mov dword [ebp - 0x1174], 0x1f665683
mov dword [ebp - 0x1c0], 0xffffffff
mov dword [ebp - 0x117c], 0xffffffff
mov dword [ebp - 0x1184], 0x40194ddb
mov dword [ebp - 0x198], 0x9f30cc2f
mov dword [ebp - 0x2e0], 0
jmp 0x100219d7
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 3
jge 0x100219f3
mov eax, dword [ebp - 0x2e0]
mov dword [ebp + eax*4 - 0x13a4], 4
jmp 0x100219ca
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x1c0], 2
jmp 0x10021a19
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jl 0x10021aa7
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp + eax*4 - 0x13a4], 0
je 0x10021a38
jmp 0x10021aa7
mov dword [ebp - 0x198], 0
jmp 0x10021a51
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 2
jg 0x10021aa2
mov dword [ebp - 0xd30], 0xfffffffe
mov eax, dword [ebp - 0xd30]
mov ecx, dword [ebp - 0x1c0]
mov dword [ebp + ecx*4 - 0x13a4], eax
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x10021aa0
push 0
push 0x1a7d
push 0xc5f
push 0x156b
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
jmp 0x10021a44
jmp 0x10021a0c
mov dword [ebp - 0x2e8], 0x70ad6f2e
mov dword [ebp - 0x101c], 0xffab8c3a
mov dword [ebp - 0x1018], 0xffab8c3a
mov dword [ebp - 0x1014], 0xffab8c3a
mov dword [ebp - 0x1010], 0xffab8c3a
lea ecx, [ebp - 0x4fd]
call fcn.100132e4
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x101c]
push eax
lea ecx, [ebp - 0x1600]
call fcn.100132e7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xbe4]
call fcn.10013237
mov dword [ebp - 4], 4
mov dword [ebp - 0x118c], 0xe60d743c
mov dword [ebp - 0xf68], 0x43334adc
mov dword [ebp - 0xf64], 0x43334adc
mov dword [ebp - 0xf60], 0x43334adc
mov dword [ebp - 0xf5c], 0x43334adc
lea ecx, [ebp - 0x52d]
call fcn.100132e4
push eax
lea eax, [ebp - 0xf58]
push eax
lea eax, [ebp - 0xf68]
push eax
lea ecx, [ebp - 0x1630]
call fcn.100132e7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x15f8]
call fcn.10013237
mov byte [ebp - 4], 5
mov dword [ebp - 0x41c], 0
jmp 0x10021b99
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 2
jge 0x10021bb5
mov eax, dword [ebp - 0x41c]
mov dword [ebp + eax*4 - 0xf24], 0x8fab8d23
jmp 0x10021b8c
mov dword [ebp - 0x2e8], 0
jmp 0x10021bce
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0x1d
jne 0x10021ead
mov dword [ebp - 0x1a0], 1
mov dword [ebp - 0x1a0], 0
jmp 0x10021bfe
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jg 0x10021ea8
mov dword [ebp - 0x98], 0
mov dword [ebp - 0xd38], 0xee1d4595
mov dword [ebp - 0x98], 3
jmp 0x10021c38
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jl 0x10021c5b
push dword [ebp - 0x98]
lea ecx, [ebp - 0xbe4]
call fcn.10013282
cmp dword [eax], 0
je 0x10021c59
jmp 0x10021c5b
jmp 0x10021c2b
mov dword [ebp - 0x98], 0
jmp 0x10021c74
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jg 0x10021ea3
push 3
lea ecx, [ebp - 0xb98]
call fcn.100131db
mov byte [ebp - 4], 6
mov dword [ebp - 0x640], 0xffffffff
mov dword [ebp - 0x394], 0
jmp 0x10021cb5
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 3
jge 0x10021cd7
push dword [ebp - 0x394]
lea ecx, [ebp - 0xb98]
call fcn.10013282
mov dword [eax], 0xd697e780
jmp 0x10021ca8
mov byte [ebp - 0x17a], 0
movzx eax, byte [ebp - 0x17a]
test eax, eax
je 0x10021cf5
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 1
lea ecx, [ebp - 0xb98]
call fcn.10013282
and dword [eax], 0
jmp 0x10021d2b
push 1
lea ecx, [ebp - 0xb98]
call fcn.10013282
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0x630]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x630]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xb98]
call fcn.10013282
cmp dword [eax], 3
jg 0x10021e8f
mov dword [ebp - 0x638], 0x8ab9c279
push 1
lea ecx, [ebp - 0xb98]
call fcn.10013282
push dword [eax]
lea ecx, [ebp - 0xbe4]
call fcn.10013282
cmp dword [eax], 0
jne 0x10021df2
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0xbe4]
call fcn.10013282
push 2
lea ecx, [ebp - 0xbe4]
call fcn.10013282
mov eax, dword [eax]
sub eax, 0x58692bfe
je 0x10021da6
or eax, 0xffffffff
je 0x10021da6
mov dword [ebp - 0x910], 1
jmp 0x10021dad
and dword [ebp - 0x910], 0
mov dword [ebp - 0x638], 0x9642
push 1
lea ecx, [ebp - 0xb98]
call fcn.10013282
push dword [eax]
lea ecx, [ebp - 0xbe4]
call fcn.10013282
mov ecx, dword [ebp - 0x910]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x638]
imul eax, ecx
cmp eax, 0xea96
jge 0x10021df2
and dword [ebp - 0xa80], 0
jmp 0x10021dfc
mov dword [ebp - 0xa80], 1
mov eax, dword [ebp - 0xa80]
mov dword [ebp - 0x640], eax
mov esi, dword [ebp - 0x640]
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0xbe4]
call fcn.10013282
cmp esi, dword [eax]
jge 0x10021e2f
mov dword [ebp - 0x918], 1
jmp 0x10021e36
and dword [ebp - 0x918], 0
push 1
lea ecx, [ebp - 0xb98]
call fcn.10013282
mov ecx, dword [ebp - 0x918]
cmp ecx, dword [eax]
jg 0x10021e59
mov dword [ebp - 0x648], 1
jmp 0x10021e60
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0xd38], eax
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x10021e8a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10021d07
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb98]
call fcn.1001325d
jmp 0x10021c67
jmp 0x10021bf1
jmp 0x10021bc1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf24]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xf24], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x15f8]
call fcn.1001325d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbe4]
call fcn.1001325d
mov dword [ebp - 0x3e4], 0
mov dword [ebp - 0x1194], 0x7e6aa165
push 1
lea ecx, [ebp - 0x13e4]
call fcn.100131db
mov dword [ebp - 4], 7
mov dword [ebp - 0x2f0], 0
jmp 0x10021f27
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 1
jge 0x10021f49
push dword [ebp - 0x2f0]
lea ecx, [ebp - 0x13e4]
call fcn.10013282
mov dword [eax], 3
jmp 0x10021f1a
mov dword [ebp - 0x3e4], 0xffffffe6
jmp 0x10021f62
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0xfffffffe
je 0x100222f9
mov dword [ebp - 0x39c], 1
mov dword [ebp - 0x119c], 6
push 2
lea ecx, [ebp - 0x13d4]
call fcn.100131db
mov byte [ebp - 4], 8
mov dword [ebp - 0x1514], 0xeb61943e
mov dword [ebp - 0x1510], 0xeb61943e
mov dword [ebp - 0x150c], 0xeb61943e
mov dword [ebp - 0x1508], 0xeb61943e
mov dword [ebp - 0x2f8], 0
jmp 0x10021fd5
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 2
jge 0x10021ff7
push dword [ebp - 0x2f8]
lea ecx, [ebp - 0x13d4]
call fcn.10013282
mov dword [eax], 6
jmp 0x10021fc8
mov dword [ebp - 0x39c], 0
jmp 0x10022010
mov eax, dword [ebp - 0x39c]
dec eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0xfffffff0
jge 0x100222e5
mov dword [ebp - 0x11c4], 0x4fda7ef5
mov dword [ebp - 0x11cc], 0
push 2
lea ecx, [ebp - 0x13c4]
call fcn.100131db
mov byte [ebp - 4], 9
mov dword [ebp - 0xfa4], 0x9448
mov dword [ebp - 0xfa0], 0x9448
mov dword [ebp - 0xf9c], 0x9448
mov dword [ebp - 0xf98], 0x9448
lea ecx, [ebp - 0x4d5]
call fcn.100132e4
push eax
lea eax, [ebp - 0xf94]
push eax
lea eax, [ebp - 0xfa4]
push eax
lea ecx, [ebp - 0x1678]
call fcn.100132e7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x15ec]
call fcn.10013237
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x650], 0x34bd47cd
mov dword [ebp - 0xd8], 0
jmp 0x100220c6
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jge 0x100220e2
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0xb38], 0x80c170c
jmp 0x100220b9
mov dword [ebp - 0xd8], 0
jmp 0x100220fb
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jge 0x1002211d
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x13c4]
call fcn.10013282
mov dword [eax], 1
jmp 0x100220ee
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xb38], 0
jmp 0x1002214b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb38]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xb38], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb38], 2
jl 0x100222c2
push 1
lea ecx, [ebp - 0x10d8]
call fcn.100131db
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x11d4], 0
mov dword [ebp - 0x11dc], 0x52509e71
mov dword [ebp - 0x11e4], 0x5b3847d2
mov dword [ebp - 0x11ec], 1
mov dword [ebp - 0x11f4], 0xffffffff
mov dword [ebp - 0x11fc], 0xa5d732ad
mov dword [ebp - 0x1204], 0xffffffff
mov dword [ebp - 0x120c], 0xc0ec0dce
mov dword [ebp - 0x1214], 0xd58e7ea1
push 2
lea ecx, [ebp - 0x13b4]
call fcn.100131db
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xa0], 0
jmp 0x100221f4
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x10022216
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x10d8]
call fcn.10013282
mov dword [eax], 1
jmp 0x100221e7
mov dword [ebp - 0xa0], 0
jmp 0x1002222f
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x10022251
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x13b4]
call fcn.10013282
mov dword [eax], 3
jmp 0x10022222
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x10022276
push 4
pop eax
shl eax, 0
push 0xfffffffffffffffd
pop ecx
sub ecx, dword [ebp + eax - 0xb38]
je 0x10022276
mov dword [ebp - 0xb3c], 1
jmp 0x1002227d
and dword [ebp - 0xb3c], 0
push 0
lea ecx, [ebp - 0x10d8]
call fcn.10013282
mov ecx, dword [ebp - 0xb3c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x650]
dec eax
mov dword [ebp - 0x650], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x13b4]
call fcn.1001325d
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x10d8]
call fcn.1001325d
jmp 0x10022130
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x15ec]
call fcn.1001325d
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x13c4]
call fcn.1001325d
jmp 0x10022003
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x13d4]
call fcn.1001325d
jmp 0x10021f55
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13e4]
call fcn.1001325d
mov byte [ebp - 0x254], 0xb
mov byte [ebp - 0x253], 0x44
mov byte [ebp - 0x252], 9
mov byte [ebp - 0x251], 0x16
mov byte [ebp - 0x250], 7
mov byte [ebp - 0x24f], 7
mov byte [ebp - 0x24e], 5
mov byte [ebp - 0x24d], 0x1b
mov byte [ebp - 0x24c], 0
mov byte [ebp - 0x24b], 0x35
mov byte [ebp - 0x24a], 2
mov byte [ebp - 0x249], 0x33
mov byte [ebp - 0x248], 6
mov byte [ebp - 0x247], 7
mov byte [ebp - 0x246], 0xa
mov byte [ebp - 0x245], 0x36
mov byte [ebp - 0x244], 8
mov byte [ebp - 0x243], 0x2a
mov byte [ebp - 0x242], 3
mov byte [ebp - 0x241], 0x39
mov byte [ebp - 0x240], 4
mov byte [ebp - 0x23f], 0x33
mov byte [ebp - 0x23e], 0xc
mov byte [ebp - 0x23d], 0x32
mov byte [ebp - 0x23c], 2
mov byte [ebp - 0x23b], 0xec
mov byte [ebp - 0x23a], 0x5c
mov byte [ebp - 0x239], 1
mov byte [ebp - 0x238], 0x32
push 2
lea ecx, [ebp - 0x588]
call fcn.100131db
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x4ec], 0
push 2
lea ecx, [ebp - 0xc2c]
call fcn.100131db
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x940], 0x98cbdb62
mov dword [ebp - 0xa90], 0x2633933b
mov dword [ebp - 0x44], 0
jmp 0x10022426
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x1002243c
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x474], 9
jmp 0x1002241f
mov dword [ebp - 0x44], 0
jmp 0x1002244c
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x10022465
push dword [ebp - 0x44]
lea ecx, [ebp - 0x588]
call fcn.10013282
or dword [eax], 0xffffffff
jmp 0x10022445
mov dword [ebp - 0x44], 0
jmp 0x10022475
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x10022491
push dword [ebp - 0x44]
lea ecx, [ebp - 0xc2c]
call fcn.10013282
mov dword [eax], 0xfdda
jmp 0x1002246e
push 1
lea ecx, [ebp - 0x588]
call fcn.10013282
and dword [eax], 0
jmp 0x100224c7
push 1
lea ecx, [ebp - 0x588]
call fcn.10013282
mov dword [ebp - 0x920], eax
mov eax, dword [ebp - 0x920]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x920]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x588]
call fcn.10013282
cmp dword [eax], 0
jl 0x100224f6
push 1
lea ecx, [ebp - 0x588]
call fcn.10013282
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x474], 0
je 0x100224f4
jmp 0x100224f6
jmp 0x100224a3
cmp dword [ebp - 0x4ec], 0
je 0x1002252a
mov byte [ebp - 0x17c], 0
movzx eax, byte [ebp - 0x17c]
test eax, eax
je 0x10022525
push 0
push 0x1d7
push 0
push 0x1391
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
jmp 0x10022812
mov dword [ebp - 0x928], 8
mov dword [ebp - 0x300], 0xfffffffa
mov dword [ebp - 0x234], 0
push 1
lea ecx, [ebp - 0x588]
call fcn.10013282
cmp dword [eax], 0
je 0x10022576
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x474], 0
je 0x10022576
mov dword [ebp - 0x658], 1
jmp 0x1002257d
and dword [ebp - 0x658], 0
cmp dword [ebp - 0x658], 0
je 0x10022592
mov dword [ebp - 0xa88], 1
jmp 0x10022599
and dword [ebp - 0xa88], 0
push 0
lea ecx, [ebp - 0xc2c]
call fcn.10013282
mov esi, dword [ebp - 0xa88]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0xc2c]
call fcn.10013282
cmp esi, dword [eax]
jge 0x100225db
push 0
lea ecx, [ebp - 0x588]
call fcn.10013282
cmp dword [eax], 0
jne 0x100225db
and dword [ebp - 0x660], 0
jmp 0x100225e5
mov dword [ebp - 0x660], 1
mov eax, 0x3813
sub eax, dword [ebp - 0x660]
cmp eax, dword [ebp - 0x300]
jl 0x10022604
mov dword [ebp - 0x668], 1
jmp 0x1002260b
and dword [ebp - 0x668], 0
push 0
lea ecx, [ebp - 0xc2c]
call fcn.10013282
mov eax, dword [eax]
mov dword [ebp - 0x928], eax
mov eax, dword [ebp - 0x928]
cmp eax, dword [ebp - 0x668]
je 0x1002263a
mov dword [ebp - 0xbc8], 1
jmp 0x10022641
and dword [ebp - 0xbc8], 0
mov eax, dword [ebp - 0xbc8]
sub eax, dword [ebp - 0x4ec]
cmp eax, dword [ebp - 0x940]
jg 0x10022661
mov dword [ebp - 0x670], 1
jmp 0x10022668
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
cmp eax, dword [ebp - 0x234]
jg 0x1002268e
mov dword [ebp - 0x930], 1
jmp 0x10022695
and dword [ebp - 0x930], 0
cmp dword [ebp - 0x930], 0xf3f6085e
jae 0x100226ad
mov dword [ebp - 0x678], 1
jmp 0x100226b4
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0xa90], eax
cmp dword [ebp - 0xa90], 0
je 0x100226da
xor eax, eax
inc eax
je 0x100226da
mov dword [ebp - 0xd40], 1
jmp 0x100226e1
and dword [ebp - 0xd40], 0
mov eax, dword [ebp - 0x300]
imul eax, dword [ebp - 0x234]
cmp eax, dword [ebp - 0x4ec]
je 0x10022702
mov dword [ebp - 0x680], 1
jmp 0x10022709
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x234]
cmp dword [ebp - 0x680], eax
jge 0x10022729
cmp dword [ebp - 0x234], 0
jne 0x10022729
and dword [ebp - 0x938], 0
jmp 0x10022733
mov dword [ebp - 0x938], 1
push 0
lea ecx, [ebp - 0x588]
call fcn.10013282
mov ecx, dword [ebp - 0x938]
cmp ecx, dword [eax]
jg 0x10022756
mov dword [ebp - 0x688], 1
jmp 0x1002275d
and dword [ebp - 0x688], 0
cmp dword [ebp - 0x688], 0x97e6
jl 0x10022775
mov dword [ebp - 0xb44], 1
jmp 0x1002277c
and dword [ebp - 0xb44], 0
push 1
lea ecx, [ebp - 0x588]
call fcn.10013282
mov ecx, dword [ebp - 0xb44]
cmp ecx, dword [eax]
jl 0x1002279f
mov dword [ebp - 0x690], 1
jmp 0x100227a6
and dword [ebp - 0x690], 0
cmp dword [ebp - 0x690], 0xfffd
jbe 0x100227ce
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x474], 0
je 0x100227ce
mov dword [ebp - 0x698], 1
jmp 0x100227d5
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x940]
cmp dword [ebp - 0x698], eax
jne 0x100227ef
mov dword [ebp - 0xa98], 1
jmp 0x100227f6
and dword [ebp - 0xa98], 0
push 0
lea ecx, [ebp - 0xc2c]
call fcn.10013282
mov ecx, dword [ebp - 0xa98]
imul ecx, dword [eax]
mov dword [ebp - 0x234], ecx
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xc2c]
call fcn.1001325d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x588]
call fcn.1001325d
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x254]
and eax, 0x3c
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x254]
or ecx, 0x3c
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x254]
mov byte [ebp + eax - 0xc54], cl
push 2
lea ecx, [ebp - 0x13f4]
call fcn.100131db
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x308], 0xdf1febae
mov dword [ebp - 0x121c], 0xffffffff
mov dword [ebp - 0x40c], 0
jmp 0x100228aa
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 2
jge 0x100228cc
push dword [ebp - 0x40c]
lea ecx, [ebp - 0x13f4]
call fcn.10013282
mov dword [eax], 0xfff7
jmp 0x1002289d
mov dword [ebp - 0x308], 0
jmp 0x100228e5
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jg 0x10022938
mov dword [ebp - 0x3a4], 0xcce1e2c0
mov dword [ebp - 0x3a4], 0
jmp 0x10022911
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 1
jg 0x10022936
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x10022934
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
jmp 0x10022904
jmp 0x100228d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13f4]
call fcn.1001325d
mov dword [ebp - 0x2c], 2
and dword [ebp - 0x214], 0
jmp 0x1002295f
mov eax, dword [ebp - 0x2c]
inc eax
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1d
jae 0x10023747
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x254]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x2c], eax
jne 0x100234fe
push 4
lea ecx, [ebp - 0x548]
call fcn.100131db
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x64], 0xfffffffb
mov dword [ebp - 0x1d8], 0xffffffff
mov dword [ebp - 0x100], 0
push 1
lea ecx, [ebp - 0xc38]
call fcn.100131db
mov byte [ebp - 4], 0x11
mov dword [ebp - 0xd50], 0x23579942
mov dword [ebp - 0xd58], 0xa000c971
mov dword [ebp - 0xc0], 0
jmp 0x100229f1
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 4
jge 0x10022a13
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x548]
call fcn.10013282
mov dword [eax], 0xa049fe38
jmp 0x100229e4
mov dword [ebp - 0xc0], 0
jmp 0x10022a2c
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jge 0x10022a4e
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xc38]
call fcn.10013282
mov dword [eax], 0x51162d50
jmp 0x10022a1f
mov dword [ebp - 0x64], 0
jmp 0x10022a5e
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jg 0x10022f39
mov dword [ebp - 0x160], 0xfffb
mov dword [ebp - 0x47c], 0x3ec3e1b8
mov dword [ebp - 0x1224], 0xf4aedf2f
mov dword [ebp - 0x122c], 0xffffffff
mov dword [ebp - 0x1234], 1
mov dword [ebp - 0x123c], 0xffffffff
mov dword [ebp - 0x1244], 0x28d0d4a4
mov dword [ebp - 0x1528], 0xe333b8fb
mov dword [ebp - 0x1524], 0xe333b8fb
mov dword [ebp - 0x1520], 0xe333b8fb
mov dword [ebp - 0x151c], 0xe333b8fb
mov dword [ebp - 0x310], 0
jmp 0x10022aef
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 2
jge 0x10022b0b
mov eax, dword [ebp - 0x310]
mov dword [ebp + eax*4 - 0xf1c], 0xffffffff
jmp 0x10022ae2
push dword [ebp - 0x64]
lea ecx, [ebp - 0x548]
call fcn.10013282
cmp dword [eax], 0
jne 0x10022b51
cmp dword [ebp - 0x160], 0
jne 0x10022b33
mov dword [ebp - 0x6a0], 1
jmp 0x10022b3a
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x6a0], eax
jge 0x10022b51
and dword [ebp - 0x948], 0
jmp 0x10022b5b
mov dword [ebp - 0x948], 1
mov eax, dword [ebp - 0x948]
mov dword [ebp - 0x1d8], eax
push 0
lea ecx, [ebp - 0x548]
call fcn.10013282
mov esi, eax
push 3
lea ecx, [ebp - 0x548]
call fcn.10013282
mov eax, dword [eax]
cmp eax, dword [esi]
jle 0x10022b95
mov dword [ebp - 0x950], 1
jmp 0x10022b9c
and dword [ebp - 0x950], 0
push dword [ebp - 0x64]
lea ecx, [ebp - 0x548]
call fcn.10013282
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x124c], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x1254], eax
push 0
lea ecx, [ebp - 0xc38]
call fcn.10013282
mov esi, eax
push dword [ebp - 0x64]
lea ecx, [ebp - 0x548]
call fcn.10013282
mov eax, dword [eax]
cmp eax, dword [esi]
jg 0x10022bf1
mov dword [ebp - 0x6a8], 1
jmp 0x10022bf8
and dword [ebp - 0x6a8], 0
cmp dword [ebp - 0x6a8], 0xfffffffe
jne 0x10022c0d
mov dword [ebp - 0x534], 1
jmp 0x10022c14
and dword [ebp - 0x534], 0
push 0
lea ecx, [ebp - 0xc38]
call fcn.10013282
mov ecx, dword [ebp - 0x534]
mov dword [eax], ecx
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x534], eax
jg 0x10022c43
mov dword [ebp - 0xbac], 1
jmp 0x10022c4a
and dword [ebp - 0xbac], 0
push dword [ebp - 0x64]
lea ecx, [ebp - 0x548]
call fcn.10013282
mov eax, dword [eax]
cmp eax, dword [ebp - 0xbac]
jle 0x10022c7e
push dword [ebp - 0x64]
lea ecx, [ebp - 0x548]
call fcn.10013282
cmp dword [eax], 0
jne 0x10022c7e
and dword [ebp - 0x6b0], 0
jmp 0x10022c88
mov dword [ebp - 0x6b0], 1
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x47c]
cmp eax, dword [ebp - 0x100]
jl 0x10022cae
mov dword [ebp - 0x6b8], 1
jmp 0x10022cb5
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x950]
cmp eax, dword [ebp - 0x6b8]
jne 0x10022ccf
mov dword [ebp - 0xaa0], 1
jmp 0x10022cd6
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0xaa0], eax
jle 0x10022cf6
cmp dword [ebp - 0x100], 0
je 0x10022cf6
mov dword [ebp - 0xd48], 1
jmp 0x10022cfd
and dword [ebp - 0xd48], 0
mov eax, dword [ebp - 0xd50]
mov dword [ebp - 0x125c], eax
mov eax, 0xffff
cmp eax, 0x7911
jb 0x10022d21
mov dword [ebp - 0x6c0], 1
jmp 0x10022d28
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x1d8]
sub eax, dword [ebp - 0x6c0]
jne 0x10022d3d
cmp dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x1d8]
je 0x10022d57
mov dword [ebp - 0x958], 1
jmp 0x10022d5e
and dword [ebp - 0x958], 0
push dword [ebp - 0x64]
lea ecx, [ebp - 0x548]
call fcn.10013282
mov ecx, dword [ebp - 0x958]
cmp ecx, dword [eax]
jge 0x10022d82
mov dword [ebp - 0x6c8], 1
jmp 0x10022d89
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x6c8], eax
jg 0x10022da3
mov dword [ebp - 0xb4c], 1
jmp 0x10022daa
and dword [ebp - 0xb4c], 0
push 0
lea ecx, [ebp - 0x548]
call fcn.10013282
mov ecx, dword [ebp - 0xb4c]
cmp ecx, dword [eax]
jg 0x10022dcd
mov dword [ebp - 0x6d0], 1
jmp 0x10022dd4
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x160]
imul eax, dword [ebp - 0x6d0]
cmp eax, 0x3cfebdab
jle 0x10022ee7
push 1
lea ecx, [ebp - 0x1414]
call fcn.100131db
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x1264], 1
mov dword [ebp - 0x126c], 3
push 4
lea ecx, [ebp - 0x1404]
call fcn.100131db
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x1274], 0x9e13a3a1
mov dword [ebp - 0x127c], 0x6a6c3430
mov dword [ebp - 0xa8], 0
jmp 0x10022e4f
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
jge 0x10022e71
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x1414]
call fcn.10013282
mov dword [eax], 0xa6f32215
jmp 0x10022e42
mov dword [ebp - 0xa8], 0
jmp 0x10022e8a
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 4
jge 0x10022eac
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x1404]
call fcn.10013282
mov dword [eax], 0xfffffff8
jmp 0x10022e7d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf1c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xf1c], eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1404]
call fcn.1001325d
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1414]
call fcn.1001325d
jmp 0x10022f34
mov dword [ebp - 0x100], 0
jmp 0x10022f00
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jg 0x10022f34
push 0
lea ecx, [ebp - 0xc38]
call fcn.10013282
cmp dword [eax], 0
je 0x10022f1d
jmp 0x10022f34
mov esi, dword [ebp - 0xd58]
push 0
lea ecx, [ebp - 0xc38]
call fcn.10013282
mov dword [eax], esi
jmp 0x10022ef3
jmp 0x10022a57
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x1d8], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xc38]
call fcn.1001325d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x548]
call fcn.1001325d
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x254]
inc eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0xff4], 0x537c
mov dword [ebp - 0xff0], 0x537c
mov dword [ebp - 0xfec], 0x537c
mov dword [ebp - 0xfe8], 0x537c
lea ecx, [ebp - 0x4dd]
call fcn.100132e4
push eax
lea eax, [ebp - 0xfe4]
push eax
lea eax, [ebp - 0xff4]
push eax
lea ecx, [ebp - 0x1640]
call fcn.100132e7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xdd0]
call fcn.10013237
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x484], 0xfffffffe
mov dword [ebp - 0x3ec], 0
jmp 0x10023003
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 1
jge 0x1002301f
mov eax, dword [ebp - 0x3ec]
mov dword [ebp + eax*4 - 0x56c], 1
jmp 0x10022ff6
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1284], eax
cmp dword [ebp - 0x1c], 9
jb 0x1002303a
mov dword [ebp - 0x960], 1
jmp 0x10023041
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x960], eax
je 0x10023058
mov dword [ebp - 0x6d8], 1
jmp 0x1002305f
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x6d8], eax
je 0x10023076
mov dword [ebp - 0xaa8], 1
jmp 0x1002307d
and dword [ebp - 0xaa8], 0
cmp dword [ebp - 0xaa8], 0xfffffffb
jge 0x10023092
mov dword [ebp - 0xd60], 1
jmp 0x10023099
and dword [ebp - 0xd60], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x128c], eax
cmp dword [ebp - 0x1c], 0
jne 0x100230ba
mov eax, 0x67457993
test eax, eax
jne 0x100230ba
and dword [ebp - 0x6e0], 0
jmp 0x100230c4
mov dword [ebp - 0x6e0], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x6e0], eax
je 0x100230db
mov dword [ebp - 0x968], 1
jmp 0x100230e2
and dword [ebp - 0x968], 0
cmp dword [ebp - 0x968], 0x5761
jg 0x10023103
mov eax, 0x360d
test eax, eax
je 0x10023103
mov dword [ebp - 0x6e8], 1
jmp 0x1002310a
and dword [ebp - 0x6e8], 0
cmp dword [ebp - 0x6e8], 0xffff
jb 0x10023122
mov dword [ebp - 0xbd0], 1
jmp 0x10023129
and dword [ebp - 0xbd0], 0
cmp dword [ebp - 0xbd0], 0x11e2
jge 0x10023141
mov dword [ebp - 0xd68], 1
jmp 0x10023148
and dword [ebp - 0xd68], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1294], eax
mov eax, 0x1fc3eee
sub eax, dword [ebp - 0x1c]
je 0x10023167
mov dword [ebp - 0xd70], 1
jmp 0x1002316e
and dword [ebp - 0xd70], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x129c], eax
cmp dword [ebp - 0x1c], 0
je 0x1002324a
mov dword [ebp - 0x6f0], 0
mov dword [ebp - 0x1c], 3
jmp 0x1002319b
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x10023236
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0xd0], 0
jmp 0x100231c8
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 3
jg 0x100231f5
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xdd0]
call fcn.10013282
cmp dword [eax], 0
je 0x100231e6
jmp 0x100231f5
mov eax, dword [ebp - 0x6f0]
inc eax
mov dword [ebp - 0x6f0], eax
jmp 0x100231bb
mov dword [ebp - 0xd0], 3
jmp 0x1002320e
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jl 0x10023231
push dword [ebp - 0xd0]
lea ecx, [ebp - 0xdd0]
call fcn.10013282
cmp dword [eax], 0
je 0x1002322f
jmp 0x10023231
jmp 0x10023201
jmp 0x10023194
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x484], eax
jmp 0x100234bd
push 1
lea ecx, [ebp - 0x1108]
call fcn.100131db
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x48c], 0xfffffff8
mov dword [ebp - 0x218], 0x95921ba5
mov dword [ebp - 0x1e0], 0x4e48c0c8
mov dword [ebp - 0x320], 0x16590181
mov dword [ebp - 0x3ac], 0x42ee1e3c
mov dword [ebp - 0x318], 0
jmp 0x100232a6
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 1
jge 0x100232c8
push dword [ebp - 0x318]
lea ecx, [ebp - 0x1108]
call fcn.10013282
mov dword [eax], 1
jmp 0x10023299
cmp dword [ebp - 0x1e0], 0
jne 0x100232d8
cmp dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x1e0]
add eax, 0x32dc1b2d
cmp dword [ebp - 0x218], eax
jge 0x100232f7
mov dword [ebp - 0xd78], 1
jmp 0x100232fe
and dword [ebp - 0xd78], 0
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x12a4], eax
mov eax, dword [ebp - 0x1e0]
add eax, 8
cmp eax, dword [ebp - 0x1c]
jne 0x10023324
mov dword [ebp - 0x970], 1
jmp 0x1002332b
and dword [ebp - 0x970], 0
push 0
lea ecx, [ebp - 0x1108]
call fcn.10013282
mov dword [ebp - 0x4f4], eax
mov eax, dword [ebp - 0x4f4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4f4]
mov dword [ecx], eax
mov eax, dword [ebp - 0x4f4]
mov eax, dword [eax]
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x218]
sub eax, dword [ebp - 0x970]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x48c]
sub eax, dword [ebp - 0x218]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x3ac], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3ac]
cmp ecx, dword [ebp + eax - 0x56c]
je 0x100233c0
mov dword [ebp - 0x6f8], 1
jmp 0x100233c7
and dword [ebp - 0x6f8], 0
cmp dword [ebp - 0x6f8], 0x8f302d78
jne 0x100233df
mov dword [ebp - 0xab0], 1
jmp 0x100233e6
and dword [ebp - 0xab0], 0
push 0
lea ecx, [ebp - 0xdd0]
call fcn.10013282
mov ecx, dword [ebp - 0xab0]
cmp ecx, dword [eax]
jle 0x10023412
cmp dword [ebp - 0x3ac], 0
je 0x10023412
mov dword [ebp - 0x700], 1
jmp 0x10023419
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x700]
inc eax
jne 0x10023434
cmp dword [ebp - 0x3ac], 0
jne 0x10023434
and dword [ebp - 0x978], 0
jmp 0x1002343e
mov dword [ebp - 0x978], 1
push 3
lea ecx, [ebp - 0xdd0]
call fcn.10013282
mov eax, 0xe5c5
test eax, eax
je 0x10023469
mov eax, 0xcf48
test eax, eax
je 0x10023469
mov dword [ebp - 0x708], 1
jmp 0x10023470
and dword [ebp - 0x708], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x708]
mov dword [ebp + eax - 0x56c], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x56c]
mov dword [ebp - 0x12ac], eax
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x48c], eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x1108]
call fcn.1001325d
mov byte [ebp - 0x17e], 0
movzx eax, byte [ebp - 0x17e]
test eax, eax
je 0x100234d5
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdd0]
call fcn.1001325d
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x254]
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x2c], eax
jmp 0x10022957
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x214]
movzx eax, byte [ebp + eax - 0x256]
movsx eax, byte [ebp + eax - 0xc54]
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x253]
and ecx, eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x214]
movzx eax, byte [ebp + eax - 0x256]
movsx eax, byte [ebp + eax - 0xc54]
mov edx, dword [ebp - 0x2c]
movzx edx, byte [ebp + edx - 0x253]
and edx, eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x214]
movzx eax, byte [ebp + eax - 0x256]
movsx eax, byte [ebp + eax - 0xc54]
mov esi, dword [ebp - 0x2c]
movzx ebx, byte [ebp + esi - 0x253]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x254]
mov byte [ebp + eax - 0xc54], bl
mov dword [ebp - 0x42c], 0xfffffffa
mov dword [ebp - 0xb54], 0x1e19e95d
push 2
lea ecx, [ebp - 0x1048]
call fcn.100131db
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x3c], 0
jmp 0x100235be
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x100235d4
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1424], 0xb5c6eff3
jmp 0x100235b7
mov dword [ebp - 0x3c], 0
jmp 0x100235e4
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x10023600
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1048]
call fcn.10013282
mov dword [eax], 0xdf628589
jmp 0x100235dd
mov dword [ebp - 0x3c], 0
jmp 0x10023610
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x10023626
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x11a8], 0x8787d636
jmp 0x10023609
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1424], 0
mov dword [ebp - 0x42c], 0
push 3
pop eax
test eax, eax
je 0x10023671
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1424]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x42c]
neg eax
je 0x10023671
mov dword [ebp - 0xd80], 1
jmp 0x10023678
and dword [ebp - 0xd80], 0
mov eax, dword [ebp - 0xb54]
mov dword [ebp - 0xd88], eax
push 1
lea ecx, [ebp - 0x1048]
call fcn.10013282
mov ecx, dword [ebp - 0xd88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x42c]
sub eax, dword [ebp - 0xb54]
cmp eax, 0x21cd4309
jle 0x100236b8
mov dword [ebp - 0x710], 1
jmp 0x100236bf
and dword [ebp - 0x710], 0
cmp dword [ebp - 0x710], 0
jl 0x100236d4
mov dword [ebp - 0x980], 1
jmp 0x100236db
and dword [ebp - 0x980], 0
cmp dword [ebp - 0x980], 0x9c27
je 0x100236f3
mov dword [ebp - 0x718], 1
jmp 0x100236fa
and dword [ebp - 0x718], 0
cmp dword [ebp - 0x718], 0xf2ee76f5
jb 0x10023712
mov dword [ebp - 0xab8], 1
jmp 0x10023719
and dword [ebp - 0xab8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xab8]
mov dword [ebp + eax - 0x11a8], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1048]
call fcn.1001325d
and dword [ebp - 0x214], 0
jmp 0x10022957
mov dword [ebp - 0x12b4], 0
mov dword [ebp - 0x12bc], 0x3f4f46db
mov dword [ebp - 0x12c4], 0x1f665683
mov dword [ebp - 0x1a8], 0xffffffff
mov dword [ebp - 0x12cc], 0xffffffff
mov dword [ebp - 0x12d4], 0x40194ddb
mov dword [ebp - 0x1b8], 0x9f30cc2f
mov dword [ebp - 0x328], 0
jmp 0x100237a6
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 3
jge 0x100237c2
mov eax, dword [ebp - 0x328]
mov dword [ebp + eax*4 - 0x1434], 4
jmp 0x10023799
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1a8], 2
jmp 0x100237e8
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
jl 0x10023876
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp + eax*4 - 0x1434], 0
je 0x10023807
jmp 0x10023876
mov dword [ebp - 0x1b8], 0
jmp 0x10023820
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 2
jg 0x10023871
mov dword [ebp - 0xd90], 0xfffffffe
mov eax, dword [ebp - 0xd90]
mov ecx, dword [ebp - 0x1a8]
mov dword [ebp + ecx*4 - 0x1434], eax
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1002386f
push 0
push 0x1a7d
push 0xc5f
push 0x156b
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
jmp 0x10023813
jmp 0x100237db
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xc54], 0
lea eax, [ebp - 0xc54]
push eax
lea ecx, [ebp - 0x1728]
call fcn.1002b9bc
mov dword [ebp - 0xd98], eax
mov eax, dword [ebp - 0xd98]
mov dword [ebp - 0xda0], eax
mov dword [ebp - 4], 0x17
mov edx, dword [ebp - 0x868]
mov ecx, dword [ebp - 0xda0]
call fcn.10016c29
mov dword [0x10613a1c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1728]
call fcn.1001313b
mov dword [ebp - 0x12dc], 1
mov byte [ebp - 0x180], 0
movzx eax, byte [ebp - 0x180]
test eax, eax
je 0x10023905
push 0x2206
push 0x26e4
push 0x26d
call dword [sym.imp.GDI32.dll_GetPixel]
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x10023923
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
and dword [ebp - 0x3b4], 0
jmp 0x10023939
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0xe
jae 0x10023952
mov eax, dword [ebp - 0x3b4]
mov byte [ebp + eax - 0xc54], 0
jmp 0x1002392c
push 4
lea ecx, [ebp - 0xeac]
call fcn.100131db
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x1e8], 0xffffffff
mov dword [ebp - 0x1124], 0x8e17c109
mov dword [ebp - 0x1120], 0x8e17c109
mov dword [ebp - 0x111c], 0x8e17c109
mov dword [ebp - 0x1118], 0x8e17c109
mov dword [ebp - 0xdb0], 1
mov dword [ebp - 0x12e4], 0
mov dword [ebp - 0x330], 0
jmp 0x100239c5
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 4
jge 0x100239e7
push dword [ebp - 0x330]
lea ecx, [ebp - 0xeac]
call fcn.10013282
mov dword [eax], 0xbbca
jmp 0x100239b8
mov dword [ebp - 0x1e8], 0
jmp 0x10023a00
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 3
jg 0x10023af1
mov dword [ebp - 0x1c8], 0xe1265ab3
mov dword [ebp - 0x1c8], 3
jmp 0x10023a30
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
jl 0x10023aec
mov dword [ebp - 0xda8], 0
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0xeac]
call fcn.10013282
mov eax, dword [eax]
mov dword [ebp - 0xda8], eax
push 1
lea ecx, [ebp - 0xeac]
call fcn.10013282
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1124], 0xfffffffa
push 0xfffffffffffffffa
pop eax
cmp eax, 4
jbe 0x10023a92
mov dword [ebp - 0x720], 1
jmp 0x10023a99
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x1c8]
cmp eax, dword [ebp - 0x720]
jl 0x10023ab3
mov dword [ebp - 0x988], 1
jmp 0x10023aba
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x988], eax
jg 0x10023ad4
mov dword [ebp - 0x728], 1
jmp 0x10023adb
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x728]
mov dword [ebp - 0xdb0], eax
jmp 0x10023a23
jmp 0x100239f3
mov byte [ebp - 0x182], 0
movzx eax, byte [ebp - 0x182]
test eax, eax
je 0x10023b14
push 0
push 0x2502
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeac]
call fcn.1001325d
mov dword [ebp - 0x48], 0x5c68ec0a
mov dword [ebp - 0x4fc], 0xffffffff
mov dword [ebp - 0x3bc], 0
mov dword [ebp - 0x340], 7
mov dword [ebp - 0x4ac], 0
mov dword [ebp - 0x770], 0xfffffff9
mov dword [ebp - 0xc88], 0xc509ca4f
mov dword [ebp - 0x9a8], 0x63372585
push 4
lea ecx, [ebp - 0xc44]
call fcn.100131db
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x53c], 0xffffffff
push 1
lea ecx, [ebp - 0xbf0]
call fcn.100131db
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0xe14], 0xd5fca44b
mov dword [ebp - 0xb0], 0
jmp 0x10023bc2
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 4
jge 0x10023be4
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xc44]
call fcn.10013282
mov dword [eax], 0x4fa3fda3
jmp 0x10023bb5
mov dword [ebp - 0xb0], 0
jmp 0x10023bfd
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x10023c1f
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xbf0]
call fcn.10013282
mov dword [eax], 0x2c67a955
jmp 0x10023bf0
mov dword [ebp - 0x48], 0x1b
jmp 0x10023c2f
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x19
jg 0x10023df5
mov dword [ebp - 0x338], 0xffffffff
mov dword [ebp - 0xbd8], 0
mov dword [ebp - 0x730], 1
mov dword [ebp - 0x12ec], 0x6eea5306
mov dword [ebp - 0x3f4], 0
jmp 0x10023c7a
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 1
jge 0x10023c96
mov eax, dword [ebp - 0x3f4]
mov dword [ebp + eax*4 - 0x494], 0xffffffff
jmp 0x10023c6d
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x730], eax
mov eax, dword [ebp - 0x338]
add eax, dword [ebp - 0xbd8]
cmp eax, dword [ebp - 0x730]
jle 0x10023ccb
mov dword [ebp - 0xdb8], 1
jmp 0x10023cd2
and dword [ebp - 0xdb8], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x12f4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x494]
cmp eax, dword [ebp - 0x338]
jg 0x10023cff
mov dword [ebp - 0x990], 1
jmp 0x10023d06
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x990], eax
jg 0x10023d1d
mov dword [ebp - 0x738], 1
jmp 0x10023d24
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x738]
cmp eax, dword [ebp - 0x48]
je 0x10023d3e
mov dword [ebp - 0xac0], 1
jmp 0x10023d45
and dword [ebp - 0xac0], 0
mov eax, dword [ebp - 0x4fc]
dec eax
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x4fc]
cmp eax, dword [ebp - 0xac0]
jg 0x10023d6c
mov dword [ebp - 0x740], 1
jmp 0x10023d73
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x740], eax
jl 0x10023d97
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x494], 0
jne 0x10023d97
and dword [ebp - 0x998], 0
jmp 0x10023da1
mov dword [ebp - 0x998], 1
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x998], eax
jne 0x10023db8
mov dword [ebp - 0x748], 1
jmp 0x10023dbf
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x748], eax
jl 0x10023dd6
mov dword [ebp - 0xdc0], 1
jmp 0x10023ddd
and dword [ebp - 0xdc0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x494]
mov dword [ebp - 0x3bc], eax
jmp 0x10023c28
mov eax, dword [ebp - 0x53c]
dec eax
mov dword [ebp - 0x53c], eax
push 0
lea ecx, [ebp - 0xbf0]
call fcn.10013282
cmp dword [eax], 0xffffffff
je 0x10023e20
mov dword [ebp - 0xe84], 1
jmp 0x10023e27
and dword [ebp - 0xe84], 0
imul eax, dword [ebp - 0x770], 0xae7
test eax, eax
jl 0x10023e41
mov dword [ebp - 0xb5c], 1
jmp 0x10023e48
and dword [ebp - 0xb5c], 0
mov eax, dword [ebp - 0xe14]
cmp dword [ebp - 0xb5c], eax
je 0x10023e62
mov dword [ebp - 0x750], 1
jmp 0x10023e69
and dword [ebp - 0x750], 0
mov esi, dword [ebp - 0x3bc]
push 0
lea ecx, [ebp - 0xbf0]
call fcn.10013282
mov eax, dword [eax]
add eax, dword [ebp - 0x750]
imul eax, eax, 0x2a1d
cmp eax, esi
jge 0x10023e9a
mov dword [ebp - 0x9a0], 1
jmp 0x10023ea1
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x9a0]
add eax, 8
mov dword [ebp - 0x3bc], eax
mov esi, dword [ebp - 0x3bc]
push 0
lea ecx, [ebp - 0xbf0]
call fcn.10013282
add esi, dword [eax]
cmp esi, 0xfffffffa
jle 0x10023ed6
mov dword [ebp - 0x758], 1
jmp 0x10023edd
and dword [ebp - 0x758], 0
push 3
lea ecx, [ebp - 0xc44]
call fcn.10013282
mov eax, dword [eax]
cmp eax, dword [ebp - 0x758]
jge 0x10023f00
mov dword [ebp - 0xd18], 1
jmp 0x10023f07
and dword [ebp - 0xd18], 0
cmp dword [ebp - 0x9a8], 0
je 0x10023f25
cmp dword [ebp - 0x53c], 0
je 0x10023f25
mov dword [ebp - 0xac8], 1
jmp 0x10023f2c
and dword [ebp - 0xac8], 0
cmp dword [ebp - 0xac8], 0x17898a80
jne 0x10023f44
mov dword [ebp - 0x760], 1
jmp 0x10023f4b
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x340]
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0x12fc], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1304], eax
push 0
lea ecx, [ebp - 0xbf0]
call fcn.10013282
cmp dword [eax], 3
jbe 0x10023f84
mov dword [ebp - 0x768], 1
jmp 0x10023f8b
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0xc88]
cmp dword [ebp - 0x768], eax
jl 0x10023fa5
mov dword [ebp - 0x49c], 1
jmp 0x10023fac
and dword [ebp - 0x49c], 0
push 3
lea ecx, [ebp - 0xc44]
call fcn.10013282
mov ecx, dword [ebp - 0x49c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x340]
cmp dword [ebp - 0x49c], eax
jle 0x10023fdb
mov dword [ebp - 0xc64], 1
jmp 0x10023fe2
and dword [ebp - 0xc64], 0
push 0
lea ecx, [ebp - 0xbf0]
call fcn.10013282
cmp dword [ebp - 0x4ac], 0
ja 0x10024004
mov dword [ebp - 0xbd4], 1
jmp 0x1002400b
and dword [ebp - 0xbd4], 0
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0
jne 0x10024024
mov eax, dword [0x10613a1c]
cmp eax, dword [ebp - 0x418]
je 0x10025ae4
mov eax, dword [0x10ac91f4]
cmp eax, dword [ebp - 0x418]
jne 0x100261b4
mov dword [ebp - 0x24], 1
push 1
lea ecx, [ebp - 0xe10]
call fcn.100131db
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x8c], 0
jmp 0x10025b18
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x10025b34
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x558], 0
jmp 0x10025b0b
mov dword [ebp - 0x8c], 0
jmp 0x10025b4d
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x10025b6c
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xe10]
call fcn.10013282
and dword [eax], 0
jmp 0x10025b40
mov dword [ebp - 0x24], 0
jmp 0x10025b7c
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jg 0x10025c43
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x558]
mov dword [ebp - 0x1160], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x558]
mov dword [ebp - 0x1498], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp + ecx*4 - 0x558]
cmp edx, dword [ebp + eax - 0x558]
jne 0x10025bce
mov dword [ebp - 0x878], 1
jmp 0x10025bd5
and dword [ebp - 0x878], 0
cmp dword [ebp - 0x878], 0xffffffff
jae 0x10025bed
cmp dword [ebp - 0x24], 0
jne 0x10025bed
and dword [ebp - 0xcbc], 0
jmp 0x10025bf7
mov dword [ebp - 0xcbc], 1
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x558]
mov dword [ebp - 0x1168], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x558]
mov dword [ebp - 0x1338], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x558]
mov dword [ebp - 0x1170], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x558]
mov ecx, dword [ebp - 0x24]
mov dword [ebp + ecx*4 - 0x558], eax
jmp 0x10025b75
mov dword [ebp - 0x24], 0xfffffff7
jmp 0x10025c53
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1c
jl 0x1002618d
push 2
lea ecx, [ebp - 0xba8]
call fcn.100131db
mov byte [ebp - 4], 0x2c
push 1
lea ecx, [ebp - 0xe00]
call fcn.100131db
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0xcc4], 0xfffffff6
mov dword [ebp - 0xe74], 0xd849ede1
mov dword [ebp - 0x8c0], 0xc81c
mov dword [ebp - 0x94], 0
jmp 0x10025cb6
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x10025cd8
push dword [ebp - 0x94]
lea ecx, [ebp - 0xba8]
call fcn.10013282
mov dword [eax], 0x1fdbd017
jmp 0x10025ca9
mov dword [ebp - 0x94], 0
jmp 0x10025cf1
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x10025d13
push dword [ebp - 0x94]
lea ecx, [ebp - 0xe00]
call fcn.10013282
mov dword [eax], 0x279c90e6
jmp 0x10025ce4
push 0
lea ecx, [ebp - 0xba8]
call fcn.10013282
and dword [eax], 0
jmp 0x10025d49
push 0
lea ecx, [ebp - 0xba8]
call fcn.10013282
mov dword [ebp - 0xb10], eax
mov eax, dword [ebp - 0xb10]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xb10]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xba8]
call fcn.10013282
cmp dword [eax], 0x1a
jl 0x1002616a
mov dword [ebp - 0x200], 0x9785734c
mov dword [ebp - 0x2f4], 1
mov dword [ebp - 0x14bc], 0x5a0455d8
mov dword [ebp - 0x1178], 0x62a9717e
push 0
lea ecx, [ebp - 0xe10]
call fcn.10013282
mov esi, dword [eax]
sub esi, 0xf5ae
push 0
lea ecx, [ebp - 0xba8]
call fcn.10013282
cmp dword [eax], esi
jge 0x10025db9
mov dword [ebp - 0x880], 1
jmp 0x10025dc0
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x2f4]
add eax, dword [ebp - 0x880]
push 4
pop ecx
shl ecx, 1
cmp dword [ebp + ecx - 0x558], eax
jg 0x10025fd7
push 2
lea ecx, [ebp - 0xdf0]
call fcn.100131db
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0xe44], 0xfffffffc
mov dword [ebp - 0xda4], 0xffffffff
mov dword [ebp - 0x2e4], 0
jmp 0x10025e28
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 2
jge 0x10025e4a
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0xdf0]
call fcn.10013282
mov dword [eax], 0xfffffffd
jmp 0x10025e1b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x558]
mov dword [ebp - 0xa38], eax
push 0
lea ecx, [ebp - 0xe00]
call fcn.10013282
mov ecx, dword [ebp - 0xa38]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0xdf0]
call fcn.10013282
mov ecx, dword [ebp - 0xa38]
cmp ecx, dword [eax]
je 0x10025e95
mov dword [ebp - 0x888], 1
jmp 0x10025e9c
and dword [ebp - 0x888], 0
push 0
lea ecx, [ebp - 0xba8]
call fcn.10013282
mov eax, dword [eax]
imul eax, dword [ebp - 0x888]
test eax, eax
jne 0x10025f62
cmp dword [ebp - 0x200], 0
je 0x10025f2d
push 0
lea ecx, [ebp - 0xe10]
call fcn.10013282
cmp dword [eax], 0x5d8d3410
je 0x10025ee4
mov dword [ebp - 0xb84], 1
jmp 0x10025eeb
and dword [ebp - 0xb84], 0
cmp dword [ebp - 0xb84], 7
jne 0x10025f00
mov dword [ebp - 0x890], 1
jmp 0x10025f07
and dword [ebp - 0x890], 0
push 1
lea ecx, [ebp - 0xdf0]
call fcn.10013282
mov ecx, dword [ebp - 0x890]
imul ecx, dword [eax]
test ecx, ecx
je 0x10025f2d
mov dword [ebp - 0xa40], 1
jmp 0x10025f34
and dword [ebp - 0xa40], 0
push 0
lea ecx, [ebp - 0xe00]
call fcn.10013282
mov ecx, dword [ebp - 0xa40]
add ecx, dword [eax]
jne 0x10025f54
cmp dword [ebp - 0xe44], 0
je 0x10025f59
xor eax, eax
inc eax
jne 0x10025f62
and dword [ebp - 0x898], 0
jmp 0x10025f6c
mov dword [ebp - 0x898], 1
mov eax, dword [ebp - 0xcc4]
cmp dword [ebp - 0x898], eax
jl 0x10025f86
mov dword [ebp - 0xb18], 1
jmp 0x10025f8d
and dword [ebp - 0xb18], 0
mov eax, dword [ebp - 0xda4]
cmp dword [ebp - 0xb18], eax
jne 0x10025fa7
mov dword [ebp - 0x8a0], 1
jmp 0x10025fae
and dword [ebp - 0x8a0], 0
push 0
lea ecx, [ebp - 0xdf0]
call fcn.10013282
mov ecx, dword [ebp - 0x8a0]
mov dword [eax], ecx
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0xdf0]
call fcn.1001325d
jmp 0x10026165
mov dword [ebp - 0x8b0], 0x89c8
mov dword [ebp - 0x1340], 5
mov dword [ebp - 0x2ec], 0
jmp 0x10026004
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 3
jge 0x10026020
mov eax, dword [ebp - 0x2ec]
mov dword [ebp + eax*4 - 0x16c8], 0x4a9b8364
jmp 0x10025ff7
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x1180], eax
push 0
lea ecx, [ebp - 0xe10]
call fcn.10013282
mov dword [eax], 0x4f5774d2
mov dword [ebp - 0x2f4], 0x918cb0b9
cmp dword [ebp - 0x2f4], 0x4f5774d2
jl 0x10026061
mov dword [ebp - 0xa48], 1
jmp 0x10026068
and dword [ebp - 0xa48], 0
push 0
lea ecx, [ebp - 0xba8]
call fcn.10013282
mov eax, dword [eax]
cmp eax, dword [ebp - 0xa48]
jle 0x1002608b
mov dword [ebp - 0x8b8], 1
jmp 0x10026092
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x200]
cmp eax, dword [ebp - 0x200]
jl 0x100260ac
mov dword [ebp - 0x8a8], 1
jmp 0x100260b3
and dword [ebp - 0x8a8], 0
cmp dword [ebp - 0x8a8], 0
jle 0x100260c8
mov dword [ebp - 0xbb8], 1
jmp 0x100260cf
and dword [ebp - 0xbb8], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0xbb8], eax
je 0x100260e9
mov dword [ebp - 0xa50], 1
jmp 0x100260f0
and dword [ebp - 0xa50], 0
mov eax, dword [ebp - 0x8b0]
add eax, dword [ebp - 0xa50]
cmp dword [ebp - 0x8b8], eax
je 0x10026110
mov dword [ebp - 0xccc], 1
jmp 0x10026117
and dword [ebp - 0xccc], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14a8], eax
push 0
lea ecx, [ebp - 0xe00]
call fcn.10013282
mov dword [eax], 1
cmp dword [ebp - 0x24], 1
je 0x10026145
mov dword [ebp - 0xb20], 1
jmp 0x1002614c
and dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0xb20]
mov dword [ebp - 0xe74], eax
mov eax, dword [ebp - 0x8c0]
dec eax
mov dword [ebp - 0x8c0], eax
jmp 0x10025d25
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0xe00]
call fcn.1001325d
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xba8]
call fcn.1001325d
jmp 0x10025c4c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe10]
call fcn.1001325d
mov ecx, dword [ebp + 0xc]
call fcn.10012ea5
push eax
push dword [ebp + 8]
call fcn.1001d7e8
pop ecx
pop ecx
jmp 0x1002aa9b
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xf90], 0x537c
mov dword [ebp - 0xf8c], 0x537c
mov dword [ebp - 0xf88], 0x537c
mov dword [ebp - 0xf84], 0x537c
lea ecx, [ebp - 0x4f5]
call fcn.100132e4
push eax
lea eax, [ebp - 0xf80]
push eax
lea eax, [ebp - 0xf90]
push eax
lea ecx, [ebp - 0x1610]
call fcn.100132e7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe20]
call fcn.10013237
mov dword [ebp - 4], 0x2f
mov dword [ebp - 0x4d4], 0xfffffffe
mov dword [ebp - 0x2fc], 0
jmp 0x10026242
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 1
jge 0x1002625e
mov eax, dword [ebp - 0x2fc]
mov dword [ebp + eax*4 - 0x55c], 1
jmp 0x10026235
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1188], eax
cmp dword [ebp - 0x14], 9
jb 0x10026279
mov dword [ebp - 0xa58], 1
jmp 0x10026280
and dword [ebp - 0xa58], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xa58], eax
je 0x10026297
mov dword [ebp - 0x8c8], 1
jmp 0x1002629e
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x8c8], eax
je 0x100262b5
mov dword [ebp - 0x5a8], 1
jmp 0x100262bc
and dword [ebp - 0x5a8], 0
cmp dword [ebp - 0x5a8], 0xfffffffb
jge 0x100262d1
mov dword [ebp - 0xcd8], 1
jmp 0x100262d8
and dword [ebp - 0xcd8], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1348], eax
cmp dword [ebp - 0x14], 0
jne 0x100262f9
mov eax, 0x67457993
test eax, eax
jne 0x100262f9
and dword [ebp - 0x5ac], 0
jmp 0x10026303
mov dword [ebp - 0x5ac], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x5ac], eax
je 0x1002631a
mov dword [ebp - 0x5b4], 1
jmp 0x10026321
and dword [ebp - 0x5b4], 0
cmp dword [ebp - 0x5b4], 0x5761
jg 0x10026342
mov eax, 0x360d
test eax, eax
je 0x10026342
mov dword [ebp - 0x5bc], 1
jmp 0x10026349
and dword [ebp - 0x5bc], 0
cmp dword [ebp - 0x5bc], 0xffff
jb 0x10026361
mov dword [ebp - 0x5c4], 1
jmp 0x10026368
and dword [ebp - 0x5c4], 0
cmp dword [ebp - 0x5c4], 0x11e2
jge 0x10026380
mov dword [ebp - 0xdac], 1
jmp 0x10026387
and dword [ebp - 0xdac], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1190], eax
mov eax, 0x1fc3eee
sub eax, dword [ebp - 0x14]
je 0x100263a6
mov dword [ebp - 0xce4], 1
jmp 0x100263ad
and dword [ebp - 0xce4], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14c0], eax
cmp dword [ebp - 0x14], 0
je 0x10026489
mov dword [ebp - 0x5cc], 0
mov dword [ebp - 0x14], 3
jmp 0x100263da
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x10026475
mov dword [ebp - 0x9c], 1
mov dword [ebp - 0x9c], 0
jmp 0x10026407
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jg 0x10026434
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe20]
call fcn.10013282
cmp dword [eax], 0
je 0x10026425
jmp 0x10026434
mov eax, dword [ebp - 0x5cc]
inc eax
mov dword [ebp - 0x5cc], eax
jmp 0x100263fa
mov dword [ebp - 0x9c], 3
jmp 0x1002644d
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x10026470
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xe20]
call fcn.10013282
cmp dword [eax], 0
je 0x1002646e
jmp 0x10026470
jmp 0x10026440
jmp 0x100263d3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4d4], eax
jmp 0x100266fc
push 1
lea ecx, [ebp - 0x109c]
call fcn.100131db
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x4dc], 0xfffffff8
mov dword [ebp - 0x20c], 0x95921ba5
mov dword [ebp - 0x208], 0x4e48c0c8
mov dword [ebp - 0x314], 0x16590181
mov dword [ebp - 0x30c], 0x42ee1e3c
mov dword [ebp - 0x304], 0
jmp 0x100264e5
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 1
jge 0x10026507
push dword [ebp - 0x304]
lea ecx, [ebp - 0x109c]
call fcn.10013282
mov dword [eax], 1
jmp 0x100264d8
cmp dword [ebp - 0x208], 0
jne 0x10026517
cmp dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x208]
add eax, 0x32dc1b2d
cmp dword [ebp - 0x20c], eax
jge 0x10026536
mov dword [ebp - 0xe54], 1
jmp 0x1002653d
and dword [ebp - 0xe54], 0
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x1198], eax
mov eax, dword [ebp - 0x208]
add eax, 8
cmp eax, dword [ebp - 0x14]
jne 0x10026563
mov dword [ebp - 0x5d4], 1
jmp 0x1002656a
and dword [ebp - 0x5d4], 0
push 0
lea ecx, [ebp - 0x109c]
call fcn.10013282
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x524]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x524]
mov dword [ecx], eax
mov eax, dword [ebp - 0x524]
mov eax, dword [eax]
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp - 0x20c]
sub eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x4dc]
sub eax, dword [ebp - 0x20c]
mov dword [ebp - 0x4d4], eax
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x30c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x30c]
cmp ecx, dword [ebp + eax - 0x55c]
je 0x100265ff
mov dword [ebp - 0x5dc], 1
jmp 0x10026606
and dword [ebp - 0x5dc], 0
cmp dword [ebp - 0x5dc], 0x8f302d78
jne 0x1002661e
mov dword [ebp - 0x5e4], 1
jmp 0x10026625
and dword [ebp - 0x5e4], 0
push 0
lea ecx, [ebp - 0xe20]
call fcn.10013282
mov ecx, dword [ebp - 0x5e4]
cmp ecx, dword [eax]
jle 0x10026651
cmp dword [ebp - 0x30c], 0
je 0x10026651
mov dword [ebp - 0x5ec], 1
jmp 0x10026658
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
inc eax
jne 0x10026673
cmp dword [ebp - 0x30c], 0
jne 0x10026673
and dword [ebp - 0x5f4], 0
jmp 0x1002667d
mov dword [ebp - 0x5f4], 1
push 3
lea ecx, [ebp - 0xe20]
call fcn.10013282
mov eax, 0xe5c5
test eax, eax
je 0x100266a8
mov eax, 0xcf48
test eax, eax
je 0x100266a8
mov dword [ebp - 0x5fc], 1
jmp 0x100266af
and dword [ebp - 0x5fc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5fc]
mov dword [ebp + eax - 0x55c], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x55c]
mov dword [ebp - 0x1350], eax
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x4dc], eax
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x109c]
call fcn.1001325d
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x10026714
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe20]
call fcn.1001325d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x31c], eax
push 2
lea ecx, [ebp - 0x450]
call fcn.100131db
mov dword [ebp - 4], 0x31
mov dword [ebp - 0x52c], 0xffffffff
mov dword [ebp - 0x654], 0xf758fc56
push 1
lea ecx, [ebp - 0x10b4]
call fcn.100131db
mov byte [ebp - 4], 0x32
mov dword [ebp - 0xcf0], 0x494dfd99
mov dword [ebp - 0x11a0], 0x7c914a3a
mov dword [ebp - 0xa4], 0
jmp 0x10026792
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x100267b1
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x450]
call fcn.10013282
and dword [eax], 0
jmp 0x10026785
mov dword [ebp - 0xa4], 0
jmp 0x100267ca
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jge 0x100267ec
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x10b4]
call fcn.10013282
mov dword [eax], 7
jmp 0x100267bd
push 0
lea ecx, [ebp - 0x450]
call fcn.10013282
mov esi, eax
push 1
lea ecx, [ebp - 0x450]
call fcn.10013282
mov eax, dword [eax]
imul eax, dword [esi]
cmp eax, 0xaaf0
jge 0x10026820
mov dword [ebp - 0x604], 1
jmp 0x10026827
and dword [ebp - 0x604], 0
push 0
lea ecx, [ebp - 0x450]
call fcn.10013282
mov eax, dword [eax]
cmp eax, dword [ebp - 0x604]
jl 0x1002684a
mov dword [ebp - 0x60c], 1
jmp 0x10026851
and dword [ebp - 0x60c], 0
cmp dword [ebp - 0x60c], 0xffff
je 0x10026869
mov dword [ebp - 0x614], 1
jmp 0x10026870
and dword [ebp - 0x614], 0
push 0
lea ecx, [ebp - 0x450]
call fcn.10013282
mov ecx, dword [ebp - 0x614]
cmp ecx, dword [eax]
jl 0x10026893
mov dword [ebp - 0x61c], 1
jmp 0x1002689a
and dword [ebp - 0x61c], 0
cmp dword [ebp - 0x61c], 0x2717f403
jle 0x100268b2
mov dword [ebp - 0x624], 1
jmp 0x100268b9
and dword [ebp - 0x624], 0
push 0
lea ecx, [ebp - 0x450]
call fcn.10013282
mov eax, dword [eax]
cmp eax, dword [ebp - 0x624]
je 0x100268d7
cmp dword [ebp - 0x52c], 0
cmp dword [ebp - 0x52c], 0
je 0x100268e7
cmp dword [ebp - 0x52c], 0
push 0
lea ecx, [ebp - 0x450]
call fcn.10013282
push 0
lea ecx, [ebp - 0x450]
call fcn.10013282
cmp dword [eax], 0x7120dd93
jg 0x10026927
push 1
lea ecx, [ebp - 0x450]
call fcn.10013282
cmp dword [eax], 0
je 0x10026927
mov dword [ebp - 0x62c], 1
jmp 0x1002692e
and dword [ebp - 0x62c], 0
push 0
lea ecx, [ebp - 0x450]
call fcn.10013282
mov ecx, dword [ebp - 0x62c]
add ecx, dword [eax]
jne 0x10026960
push 0
lea ecx, [ebp - 0x450]
call fcn.10013282
cmp dword [eax], 0
jne 0x10026960
and dword [ebp - 0x634], 0
jmp 0x1002696a
mov dword [ebp - 0x634], 1
cmp dword [ebp - 0x634], 0
jne 0x1002697f
mov dword [ebp - 0x63c], 1
jmp 0x10026986
and dword [ebp - 0x63c], 0
cmp dword [ebp - 0x63c], 0xc5051dd2
ja 0x1002699e
mov dword [ebp - 0x644], 1
jmp 0x100269a5
and dword [ebp - 0x644], 0
cmp dword [ebp - 0x644], 0x38ca8c98
jne 0x100269bd
mov dword [ebp - 0x64c], 1
jmp 0x100269c4
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x654], eax
mov eax, dword [ebp - 0x654]
mov dword [ebp - 0x65c], eax
push 0
lea ecx, [ebp - 0x10b4]
call fcn.10013282
mov ecx, dword [ebp - 0x65c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 0xcf0], eax
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x10b4]
call fcn.1001325d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call fcn.1001325d
cmp dword [ebp - 0x31c], 0
je 0x1002aa4c
mov eax, dword [ebp - 0x31c]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1002aa4c
push 2
lea ecx, [ebp - 0xe30]
call fcn.100131db
mov dword [ebp - 4], 0x33
mov dword [ebp - 0x14b8], 0x75c19c5a
mov dword [ebp - 0x11ac], 0xffffffff
mov dword [ebp - 0xfb8], 0x13ce
mov dword [ebp - 0xfb4], 0x13ce
mov dword [ebp - 0xfb0], 0x13ce
mov dword [ebp - 0xfac], 0x13ce
lea ecx, [ebp - 0x51d]
call fcn.100132e4
push eax
lea eax, [ebp - 0xfa8]
push eax
lea eax, [ebp - 0xfb8]
push eax
lea ecx, [ebp - 0x1618]
call fcn.100132e7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x15c8]
call fcn.10013237
mov byte [ebp - 4], 0x34
mov dword [ebp - 0x1358], 9
push 1
lea ecx, [ebp - 0x10e4]
call fcn.100131db
mov byte [ebp - 4], 0x35
mov dword [ebp - 0x38], 0
jmp 0x10026af0
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x10026b09
push dword [ebp - 0x38]
lea ecx, [ebp - 0xe30]
call fcn.10013282
or dword [eax], 0xffffffff
jmp 0x10026ae9
mov dword [ebp - 0x38], 0
jmp 0x10026b19
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x10026b2f
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1628], 0x5912491e
jmp 0x10026b12
mov dword [ebp - 0x38], 0
jmp 0x10026b3f
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x10026b5b
push dword [ebp - 0x38]
lea ecx, [ebp - 0x10e4]
call fcn.10013282
mov dword [eax], 5
jmp 0x10026b38
push 0
lea ecx, [ebp - 0xe30]
call fcn.10013282
mov dword [eax], 0xfffffff2
jmp 0x10026b94
push 0
lea ecx, [ebp - 0xe30]
call fcn.10013282
mov dword [ebp - 0x664], eax
mov eax, dword [ebp - 0x664]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x664]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xe30]
call fcn.10013282
cmp dword [eax], 0x13
jne 0x10026d45
mov dword [ebp - 0x11b8], 0
mov dword [ebp - 0x14c8], 0xc25fcc58
mov dword [ebp - 0x11c0], 0x91df82d8
mov dword [ebp - 0x1360], 0xbc3ec3d4
mov dword [ebp - 0x11c8], 1
mov dword [ebp - 0x14d0], 0x73672d71
mov dword [ebp - 0x11d0], 0xfa32fd2d
mov dword [ebp - 0x1368], 0x22db785b
mov dword [ebp - 0x11d8], 4
mov dword [ebp - 0x14c4], 0xd238e486
mov dword [ebp - 0x11e0], 3
mov dword [ebp - 0x1370], 0xef068cd5
mov dword [ebp - 0x11e8], 0xa0b34938
mov dword [ebp - 0x1570], 0xc3e8ce6f
mov dword [ebp - 0x11f0], 0xffffffff
mov dword [ebp - 0x1378], 0x6c0b333e
mov dword [ebp - 0x11f8], 0x593f6a08
mov dword [ebp - 0x14cc], 0xffffffff
mov dword [ebp - 0x1200], 2
push 1
lea ecx, [ebp - 0x10cc]
call fcn.100131db
mov byte [ebp - 4], 0x36
mov dword [ebp - 0xac], 0
jmp 0x10026c92
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 2
jge 0x10026cae
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x1638], 0x74d4b4b2
jmp 0x10026c85
mov dword [ebp - 0xac], 0
jmp 0x10026cc7
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x10026ce9
push dword [ebp - 0xac]
lea ecx, [ebp - 0x10cc]
call fcn.10013282
mov dword [eax], 0x9ce57088
jmp 0x10026cba
push 0
lea ecx, [ebp - 0x10cc]
call fcn.10013282
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x66c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x66c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x10e4]
call fcn.10013282
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x674]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x674]
mov dword [ecx], eax
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x10cc]
call fcn.1001325d
jmp 0x10026b70
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x10e4]
call fcn.1001325d
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x15c8]
call fcn.1001325d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe30]
call fcn.1001325d
mov eax, dword [ebp - 0x31c]
mov ecx, dword [ebp - 0x31c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1fc], ecx
mov eax, dword [ebp - 0x1fc]
cmp dword [eax], 0x4550
jne 0x1002aa4c
mov eax, dword [ebp - 0x1fc]
cmp dword [eax + 0x74], 0
jbe 0x1002aa4c
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1fc]
cmp dword [ecx + eax + 0x78], 0
je 0x1002aa4c
mov dword [ebp - 0x324], 0xffff
push 3
lea ecx, [ebp - 0xc08]
call fcn.100131db
mov dword [ebp - 4], 0x37
push 1
lea ecx, [ebp - 0x10fc]
call fcn.100131db
mov byte [ebp - 4], 0x38
mov dword [ebp - 0x67c], 0xfffffffb
mov dword [ebp - 0xdb4], 0xb0a6d081
mov dword [ebp - 0x1380], 0x7b1b0cad
mov dword [ebp - 0xb4], 0
jmp 0x10026e26
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x10026e48
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xc08]
call fcn.10013282
mov dword [eax], 3
jmp 0x10026e19
mov dword [ebp - 0xb4], 0
jmp 0x10026e61
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x10026e80
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x10fc]
call fcn.10013282
or dword [eax], 0xffffffff
jmp 0x10026e54
mov esi, dword [ebp - 0x324]
push 0
lea ecx, [ebp - 0xc08]
call fcn.10013282
mov dword [eax], esi
mov dword [ebp - 0x67c], 1
cmp dword [ebp - 0x67c], 0
jne 0x10026eba
cmp dword [ebp - 0x324], 0
jne 0x10026eba
and dword [ebp - 0x68c], 0
jmp 0x10026ec4
mov dword [ebp - 0x68c], 1
push 0
lea ecx, [ebp - 0xc08]
call fcn.10013282
mov dword [ebp - 0x684], eax
push 1
lea ecx, [ebp - 0xc08]
call fcn.10013282
mov ecx, dword [ebp - 0x684]
mov eax, dword [eax]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x10fc]
call fcn.10013282
mov ecx, dword [ebp - 0x684]
mov ecx, dword [ecx]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x68c]
jge 0x10026f28
push 0
lea ecx, [ebp - 0xc08]
call fcn.10013282
cmp dword [eax], 0
je 0x10026f28
and dword [ebp - 0x694], 0
jmp 0x10026f32
mov dword [ebp - 0x694], 1
cmp dword [ebp - 0x694], 0xa2ef703c
jb 0x10026f4a
mov dword [ebp - 0x69c], 1
jmp 0x10026f51
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x69c]
sub eax, dword [ebp - 0x324]
imul eax, dword [ebp - 0x324]
mov dword [ebp - 0xdb4], eax
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x10fc]
call fcn.1001325d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc08]
call fcn.1001325d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x1208], 1
mov dword [ebp - 0x1548], 0xfffffffc
mov dword [ebp - 0x1148], 0x251d69f4
mov dword [ebp - 0x1388], 0xffffffff
mov dword [ebp - 0x1218], 0
mov dword [ebp - 0x14d4], 0xcb03629a
mov dword [ebp - 0x1220], 0xdfe4b283
mov dword [ebp - 0x1390], 0xee327439
mov dword [ebp - 0xe7c], 0x50db8561
mov dword [ebp - 0x1228], 0x1c03809d
mov dword [ebp - 0xcfc], 0x328a062b
mov dword [ebp - 0x1588], 5
mov dword [ebp - 0x6a4], 0xbc2
mov dword [ebp - 0x32c], 0
jmp 0x1002702c
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 3
jge 0x10027048
mov eax, dword [ebp - 0x32c]
mov dword [ebp + eax*4 - 0x16a4], 0x2aa61fc2
jmp 0x1002701f
mov eax, dword [ebp - 0x6a4]
dec eax
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0xcfc], 0xd437f1bd
je 0x1002706d
mov dword [ebp - 0x6ac], 1
jmp 0x10027074
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x6ac]
neg eax
mov dword [ebp - 0xe7c], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1fc]
mov edx, dword [ebp - 0x1bc]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xf0], edx
mov dword [ebp - 0x1134], 0xa5d6c05b
mov dword [ebp - 0x1130], 0xa5d6c05b
mov dword [ebp - 0x112c], 0xa5d6c05b
mov dword [ebp - 0x1128], 0xa5d6c05b
mov dword [ebp - 0x210], 0x53d8da8e
mov dword [ebp - 0x1230], 0xc6fe
mov dword [ebp - 0x1144], 0xfffffff7
mov dword [ebp - 0x1140], 0xfffffff7
mov dword [ebp - 0x113c], 0xfffffff7
mov dword [ebp - 0x1138], 0xfffffff7
mov dword [ebp - 0x210], 0
jmp 0x1002711b
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 4
jge 0x10027137
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x1134], 0xeede0b40
jmp 0x1002710e
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x1144], 1
mov eax, 0xffff
mov word [ebp - 0x90], ax
or dword [ebp - 0x1b4], 0xffffffff
mov dword [ebp - 0x190], 4
mov dword [ebp - 0x1398], 0xfffffff8
mov dword [ebp - 0x1238], 0x373b2c57
mov dword [ebp - 0x14dc], 0x62a96950
mov dword [ebp - 0x1240], 0x7c694a61
mov dword [ebp - 0x13a8], 0
mov dword [ebp - 0x1248], 0x495231fb
mov dword [ebp - 0x1550], 1
mov dword [ebp - 0x1250], 0x8e2294b
mov dword [ebp - 0x13b8], 3
mov dword [ebp - 0xd08], 0xf066b7a7
mov dword [ebp - 0x1258], 0xfffffff7
push 1
lea ecx, [ebp - 0x1114]
call fcn.100131db
mov dword [ebp - 4], 0x39
mov dword [ebp - 0x30], 0
jmp 0x100271f7
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x1002720d
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1744], 0x5711
jmp 0x100271f0
mov dword [ebp - 0x30], 0
jmp 0x1002721d
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x10027233
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1764], 0x7507af9c
jmp 0x10027216
mov dword [ebp - 0x30], 0
jmp 0x10027243
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1002725f
push dword [ebp - 0x30]
lea ecx, [ebp - 0x1114]
call fcn.10013282
mov dword [eax], 1
jmp 0x1002723c
mov dword [ebp - 0x190], 0
jmp 0x10027278
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 3
jg 0x1002740f
mov dword [ebp - 0x14e4], 0x221e9c96
mov dword [ebp - 0xdbc], 5
mov dword [ebp - 0x1260], 0xffffffff
mov dword [ebp - 0x13c8], 0xfffffff8
mov dword [ebp - 0x1268], 0
mov dword [ebp - 0x1578], 0xf9beab1d
mov dword [ebp - 0x1270], 3
mov dword [ebp - 0x13d8], 0x9d2e819d
mov dword [ebp - 0x460], 0xb6890635
mov dword [ebp - 0x1278], 1
mov dword [ebp - 0x14ec], 0xffffffff
push 2
pop eax
test eax, eax
je 0x1002730f
cmp dword [ebp - 0xd08], 0
je 0x1002730f
mov dword [ebp - 0x6b4], 1
jmp 0x10027316
and dword [ebp - 0x6b4], 0
cmp dword [ebp - 0x460], 0
jne 0x10027331
cmp dword [ebp - 0x190], 0
jne 0x10027331
and dword [ebp - 0x6bc], 0
jmp 0x1002733b
mov dword [ebp - 0x6bc], 1
push 0
lea ecx, [ebp - 0x1114]
call fcn.10013282
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x458]
mov eax, dword [eax]
sub eax, dword [ebp - 0x6b4]
add eax, dword [ebp - 0x6bc]
mov ecx, dword [ebp - 0x458]
mov ecx, dword [ecx]
inc ecx
mov edx, dword [ebp - 0x458]
mov dword [edx], ecx
test eax, eax
jne 0x10027389
mov eax, 0xff9e
test eax, eax
jne 0x10027389
and dword [ebp - 0x6c4], 0
jmp 0x10027393
mov dword [ebp - 0x6c4], 1
mov eax, dword [ebp - 0x190]
cmp eax, dword [ebp - 0x6c4]
jne 0x100273ad
mov dword [ebp - 0x6cc], 1
jmp 0x100273b4
and dword [ebp - 0x6cc], 0
cmp dword [ebp - 0x6cc], 0x363f
jge 0x100273cc
mov dword [ebp - 0x6d4], 1
jmp 0x100273d3
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0x9a67b9c5
jae 0x100273f7
mov dword [ebp - 0x6dc], 1
jmp 0x100273fe
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x6dc]
mov dword [ebp - 0xdbc], eax
jmp 0x1002726b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1114]
call fcn.1001325d
cmp dword [ebp + 0x10], 0
jbe 0x10027cab
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x104], 0x76b87d0f
mov dword [ebp - 0x178], 0xe3051ebf
push 1
lea ecx, [ebp - 0xee8]
call fcn.100131db
mov dword [ebp - 4], 0x3a
mov dword [ebp - 0x1280], 7
push 3
lea ecx, [ebp - 0x10a8]
call fcn.100131db
mov byte [ebp - 4], 0x3b
mov dword [ebp - 0xbc], 0
jmp 0x1002748b
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x100274ad
push dword [ebp - 0xbc]
lea ecx, [ebp - 0xee8]
call fcn.10013282
mov dword [eax], 0xc299e885
jmp 0x1002747e
mov dword [ebp - 0xbc], 0
jmp 0x100274c6
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x100274e8
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x10a8]
call fcn.10013282
mov dword [eax], 3
jmp 0x100274b9
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x10027506
mov dword [ebp - 0x6ec], 1
jmp 0x1002750d
and dword [ebp - 0x6ec], 0
mov dword [ebp - 0x178], 0x76ee
mov eax, dword [ebp - 0x178]
add eax, 6
cmp eax, dword [ebp - 0x74]
jl 0x10027531
mov dword [ebp - 0x6e4], 1
jmp 0x10027538
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x6e4]
jne 0x1002754f
mov dword [ebp - 0xd14], 1
jmp 0x10027556
and dword [ebp - 0xd14], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x13e8], eax
mov eax, dword [ebp - 0x6ec]
sub eax, dword [ebp - 0x178]
imul eax, dword [ebp - 0x74]
cmp dword [ebp - 0x74], eax
jne 0x10027580
mov dword [ebp - 0x6f4], 1
jmp 0x10027587
and dword [ebp - 0x6f4], 0
push 0
lea ecx, [ebp - 0xee8]
call fcn.10013282
mov ecx, dword [ebp - 0x6f4]
add ecx, dword [eax]
je 0x100275bd
mov byte [ebp - 0x12c], 0
movzx eax, byte [ebp - 0x12c]
test eax, eax
je 0x100275b8
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x10027728
mov dword [ebp - 0xe64], 0x85fa
mov dword [ebp - 0x178], 0x1a
jmp 0x100275e0
mov eax, dword [ebp - 0x178]
dec eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x17
jl 0x10027728
mov dword [ebp - 0x74], 0
jmp 0x100275fd
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 8
jl 0x10027718
mov dword [ebp - 0x104], 0
jmp 0x10027620
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jl 0x10027713
mov dword [ebp - 0xe0], 5
mov dword [ebp - 0xe0], 0
jmp 0x10027650
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jl 0x10027685
mov byte [ebp - 0x163], 0
movzx eax, byte [ebp - 0x163]
test eax, eax
je 0x10027683
push 0x1bd5
push 0
push 0x103b
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
jmp 0x10027643
mov dword [ebp - 0xe0], 0
jmp 0x1002769e
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jl 0x1002770e
mov dword [ebp - 0x334], 0xfbf26171
mov dword [ebp - 0x334], 0
jmp 0x100276ca
mov eax, dword [ebp - 0x334]
dec eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0
jl 0x100276f4
mov byte [ebp - 0x12e], 0
movzx eax, byte [ebp - 0x12e]
test eax, eax
je 0x100276f2
push 0x440
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x100276bd
push dword [ebp - 0x104]
lea ecx, [ebp - 0xee8]
call fcn.10013282
cmp dword [eax], 0
je 0x1002770c
jmp 0x1002770e
jmp 0x10027691
jmp 0x10027613
jmp 0x100275f6
cmp dword [ebp - 0xe64], 0
je 0x10027723
jmp 0x10027728
jmp 0x100275d3
push 2
lea ecx, [ebp - 0x10a8]
call fcn.10013282
mov dword [ebp - 0x6fc], eax
mov eax, dword [ebp - 0x6fc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x6fc]
mov dword [ecx], eax
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x10a8]
call fcn.1001325d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xee8]
call fcn.1001325d
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x10027ca6
mov dword [ebp - 0x58], 0xac8b13ec
or dword [ebp - 0xfe0], 0xffffffff
or dword [ebp - 0xfdc], 0xffffffff
or dword [ebp - 0xfd8], 0xffffffff
or dword [ebp - 0xfd4], 0xffffffff
lea ecx, [ebp - 0x525]
call fcn.100132e4
push eax
lea eax, [ebp - 0xfd0]
push eax
lea eax, [ebp - 0xfe0]
push eax
lea ecx, [ebp - 0x1680]
call fcn.100132e7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe40]
call fcn.10013237
mov dword [ebp - 4], 0x3c
mov dword [ebp - 0xe4], 0xfffe
mov dword [ebp - 0x468], 1
mov dword [ebp - 0x478], 0xffffffff
mov dword [ebp - 0x72c], 0xbc97de2e
mov dword [ebp - 0x75c], 0xffffffff
mov dword [ebp - 0x764], 2
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
jne 0x100278b7
push 1
lea ecx, [ebp - 0xe40]
call fcn.10013282
cmp dword [eax], 0
jne 0x100278b7
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x1288], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x1558], eax
cmp dword [ebp - 0x468], 0
jne 0x1002786c
cmp dword [ebp - 0x58], 0
jne 0x1002786c
and dword [ebp - 0x704], 0
jmp 0x10027876
mov dword [ebp - 0x704], 1
mov eax, dword [ebp - 0x704]
sub eax, dword [ebp - 0x468]
je 0x10027899
cmp dword [ebp - 0xe4], 0
je 0x10027899
mov dword [ebp - 0x5a4], 1
jmp 0x100278a0
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x5a4], eax
jg 0x100278b7
and dword [ebp - 0x714], 0
jmp 0x100278c1
mov dword [ebp - 0x714], 1
mov eax, dword [ebp - 0x468]
cmp dword [ebp - 0x714], eax
je 0x100278db
mov dword [ebp - 0x71c], 1
jmp 0x100278e2
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x71c]
jne 0x10027a9d
push 4
lea ecx, [ebp - 0x43c]
call fcn.100131db
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0x724], 0xc17a3f0a
mov dword [ebp - 0x33c], 0
jmp 0x10027925
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 4
jge 0x10027947
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x43c]
call fcn.10013282
mov dword [eax], 0x588c5561
jmp 0x10027918
push 2
lea ecx, [ebp - 0x43c]
call fcn.10013282
push 2
lea ecx, [ebp - 0x43c]
call fcn.10013282
mov esi, eax
push 0
lea ecx, [ebp - 0x43c]
call fcn.10013282
mov eax, dword [eax]
mov dword [esi], eax
mov dword [ebp - 0x58], 0
jmp 0x10027984
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jg 0x10027a89
push dword [ebp - 0x58]
lea ecx, [ebp - 0x43c]
call fcn.10013282
cmp dword [eax], 0
jne 0x10027a7a
push 1
lea ecx, [ebp - 0xe40]
call fcn.10013282
and dword [eax], 0
push 1
lea ecx, [ebp - 0x43c]
call fcn.10013282
mov eax, dword [eax]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0
je 0x10027a12
push dword [ebp - 0x58]
lea ecx, [ebp - 0x43c]
call fcn.10013282
mov esi, eax
push dword [ebp - 0x58]
lea ecx, [ebp - 0x43c]
call fcn.10013282
mov edi, dword [eax]
sub edi, dword [esi]
push 2
lea ecx, [ebp - 0x43c]
call fcn.10013282
cmp edi, dword [eax]
jne 0x10027a12
mov dword [ebp - 0xd1c], 1
jmp 0x10027a19
and dword [ebp - 0xd1c], 0
push 0
lea ecx, [ebp - 0x43c]
call fcn.10013282
push 2
lea ecx, [ebp - 0x43c]
call fcn.10013282
mov eax, 0x16928694
test eax, eax
jne 0x10027a4e
cmp dword [ebp - 0xe4], 0
jne 0x10027a4e
and dword [ebp - 0x470], 0
jmp 0x10027a58
mov dword [ebp - 0x470], 1
push dword [ebp - 0x58]
lea ecx, [ebp - 0x43c]
call fcn.10013282
mov ecx, dword [ebp - 0x470]
mov dword [eax], ecx
mov eax, dword [ebp - 0x470]
sub eax, dword [ebp - 0x724]
mov dword [ebp - 0x724], 0xd505bc98
jmp 0x1002797d
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x43c]
call fcn.1001325d
jmp 0x10027c8c
mov dword [ebp - 0xe8], 0x94681c37
mov dword [ebp - 0x344], 0
jmp 0x10027ac0
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 2
jge 0x10027adc
mov eax, dword [ebp - 0x344]
mov dword [ebp + eax*4 - 0x11b4], 0x4ffad677
jmp 0x10027ab3
push 1
lea ecx, [ebp - 0xe40]
call fcn.10013282
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x1290], eax
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x72c], 1
jne 0x10027b1c
cmp dword [ebp - 0xe8], 0
jne 0x10027b1c
and dword [ebp - 0x734], 0
jmp 0x10027b26
mov dword [ebp - 0x734], 1
cmp dword [ebp - 0x734], 4
jae 0x10027b3b
mov dword [ebp - 0x73c], 1
jmp 0x10027b42
and dword [ebp - 0x73c], 0
cmp dword [ebp - 0x73c], 8
jne 0x10027b57
mov dword [ebp - 0x744], 1
jmp 0x10027b5e
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x744], eax
jne 0x10027b7b
cmp dword [ebp - 0xe8], 0
jne 0x10027b7b
and dword [ebp - 0x74c], 0
jmp 0x10027b85
mov dword [ebp - 0x74c], 1
mov eax, dword [ebp - 0xe8]
imul eax, dword [ebp - 0x74c]
inc eax
mov dword [ebp - 0x754], eax
push 1
lea ecx, [ebp - 0xe40]
call fcn.10013282
mov ecx, dword [ebp - 0x754]
mov dword [eax], ecx
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x75c], eax
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0x764], eax
mov eax, dword [ebp - 0x764]
cmp eax, dword [ebp - 0xe8]
jl 0x10027be0
mov dword [ebp - 0x76c], 1
jmp 0x10027be7
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x76c], eax
jle 0x10027c01
mov dword [ebp - 0x774], 1
jmp 0x10027c08
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x774], eax
jg 0x10027c22
mov dword [ebp - 0x77c], 1
jmp 0x10027c29
and dword [ebp - 0x77c], 0
cmp dword [ebp - 0x77c], 1
jle 0x10027c47
cmp dword [ebp - 0xe8], 0
je 0x10027c47
mov dword [ebp - 0x784], 1
jmp 0x10027c4e
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x784]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x11b4], eax
mov byte [ebp - 0x183], 0
movzx eax, byte [ebp - 0x183]
test eax, eax
je 0x10027c8c
push 0
push 0
push 0x1af1
push 0x988
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe40]
call fcn.1001325d
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x90], ax
jmp 0x1002a569
mov dword [ebp - 0x480], 0xfffffffd
mov dword [ebp - 0xd24], 0x25d3
push 1
lea ecx, [ebp - 0x103c]
call fcn.100131db
mov dword [ebp - 4], 0x3e
mov dword [ebp - 0xc4], 0
jmp 0x10027cec
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x10027d08
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0xe50], 1
jmp 0x10027cdf
mov dword [ebp - 0xc4], 0
jmp 0x10027d21
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jge 0x10027d43
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x103c]
call fcn.10013282
mov dword [eax], 1
jmp 0x10027d14
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x13f8], eax
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0xdc4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xdc4]
mov dword [ebp + eax - 0xe50], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe50]
mov dword [ebp - 0x1298], eax
cmp dword [ebp - 0x480], 0
jne 0x10027d9c
mov eax, 0xeb2391cb
test eax, eax
jne 0x10027d9c
and dword [ebp - 0x78c], 0
jmp 0x10027da6
mov dword [ebp - 0x78c], 1
cmp dword [ebp - 0x78c], 8
jbe 0x10027dbb
mov dword [ebp - 0x794], 1
jmp 0x10027dc2
and dword [ebp - 0x794], 0
cmp dword [ebp - 0x794], 0
je 0x10027dd7
mov dword [ebp - 0x79c], 1
jmp 0x10027dde
and dword [ebp - 0x79c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xe50]
cmp dword [ebp - 0x79c], eax
jg 0x10027e0e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xe50], 0
je 0x10027e0e
mov dword [ebp - 0x7a4], 1
jmp 0x10027e15
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x7a4]
sub eax, dword [ebp - 0xd24]
je 0x10027e3f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe50], 0
je 0x10027e3f
mov dword [ebp - 0x7ac], 1
jmp 0x10027e46
and dword [ebp - 0x7ac], 0
cmp dword [ebp - 0x7ac], 0x821342f3
jae 0x10027e5e
mov dword [ebp - 0x7b4], 1
jmp 0x10027e65
and dword [ebp - 0x7b4], 0
mov esi, dword [ebp - 0x7b4]
sub esi, 0x5af9
push 0
lea ecx, [ebp - 0x103c]
call fcn.10013282
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x103c]
call fcn.1001325d
mov dword [ebp - 0x35c], 0
mov dword [ebp - 0x34c], 9
push 3
lea ecx, [ebp - 0xe60]
call fcn.100131db
mov dword [ebp - 4], 0x3f
mov dword [ebp - 0x498], 0xd38ca8c9
mov dword [ebp - 0x194], 0xc5674fa7
push 2
lea ecx, [ebp - 0xf00]
call fcn.100131db
mov byte [ebp - 4], 0x40
mov dword [ebp - 0x20], 0
jmp 0x10027eec
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10027f02
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xfc], 0xfffffffe
jmp 0x10027ee5
mov dword [ebp - 0x20], 0
jmp 0x10027f12
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10027f28
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xed0], 7
jmp 0x10027f0b
mov dword [ebp - 0x20], 0
jmp 0x10027f38
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10027f51
push dword [ebp - 0x20]
lea ecx, [ebp - 0xe60]
call fcn.10013282
or dword [eax], 0xffffffff
jmp 0x10027f31
mov dword [ebp - 0x20], 0
jmp 0x10027f61
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10027f7d
push dword [ebp - 0x20]
lea ecx, [ebp - 0xf00]
call fcn.10013282
mov dword [eax], 1
jmp 0x10027f5a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xfc], 0
jne 0x10028087
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xfc]
mov dword [ebp - 0x14f4], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xfc]
cmp ecx, dword [ebp + eax - 0xfc]
jge 0x10027fdc
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xfc], 0
je 0x10027fdc
mov dword [ebp - 0x7bc], 1
jmp 0x10027fe3
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x7bc]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x12a0], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xfc]
sub ecx, dword [ebp + eax - 0xfc]
je 0x1002802c
cmp dword [ebp - 0x35c], 0
je 0x1002802c
mov dword [ebp - 0x7c4], 1
jmp 0x10028033
and dword [ebp - 0x7c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xfc]
cmp dword [ebp - 0x7c4], eax
jl 0x10028054
mov dword [ebp - 0xe88], 1
jmp 0x1002805b
and dword [ebp - 0xe88], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xfc]
mov dword [ebp - 0x1408], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xfc], 0
jne 0x10028087
and dword [ebp - 0x7cc], 0
jmp 0x10028091
mov dword [ebp - 0x7cc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xfc]
cmp dword [ebp - 0x7cc], eax
jne 0x100280b2
mov dword [ebp - 0x488], 1
jmp 0x100280b9
and dword [ebp - 0x488], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x488]
mov dword [ebp + eax - 0xed0], ecx
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x7d4], eax
push 0
lea ecx, [ebp - 0xe60]
call fcn.10013282
mov ecx, dword [ebp - 0x7d4]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xfc]
cmp dword [ebp - 0x7d4], eax
je 0x10028128
push 2
lea ecx, [ebp - 0xe60]
call fcn.10013282
cmp dword [eax], 0
jne 0x10028128
and dword [ebp - 0x7dc], 0
jmp 0x10028132
mov dword [ebp - 0x7dc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xfc]
cmp dword [ebp - 0x7dc], eax
jl 0x10028153
mov dword [ebp - 0x7e4], 1
jmp 0x1002815a
and dword [ebp - 0x7e4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x498]
add ecx, dword [ebp - 0x7e4]
cmp ecx, dword [ebp + eax - 0xfc]
jg 0x10028181
mov dword [ebp - 0x7ec], 1
jmp 0x10028188
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x7ec]
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
je 0x100282cb
push 1
lea ecx, [ebp - 0xf00]
call fcn.10013282
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x490]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x490]
mov ecx, dword [ecx]
inc ecx
mov edx, dword [ebp - 0x490]
mov dword [edx], ecx
test eax, eax
je 0x100282cb
push 1
lea ecx, [ebp - 0xf00]
call fcn.10013282
mov eax, dword [eax]
mov dword [ebp - 0x34c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xed0]
cmp eax, dword [ebp - 0x34c]
jne 0x1002820a
mov dword [ebp - 0x354], 1
jmp 0x10028211
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x498]
add eax, 8
cmp eax, dword [ebp - 0x194]
je 0x1002822e
mov dword [ebp - 0x7f4], 1
jmp 0x10028235
and dword [ebp - 0x7f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xfc]
cmp dword [ebp - 0x7f4], eax
jle 0x10028256
mov dword [ebp - 0x7fc], 1
jmp 0x1002825d
and dword [ebp - 0x7fc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x354]
mov dword [ebp + eax - 0xed0], ecx
push 1
lea ecx, [ebp - 0xe60]
call fcn.10013282
mov ecx, dword [ebp - 0x354]
mov dword [eax], ecx
mov eax, dword [ebp - 0x354]
imul eax, dword [ebp - 0x7fc]
cmp eax, 0xf05c8a2d
jb 0x100282a4
mov dword [ebp - 0xd2c], 1
jmp 0x100282ab
and dword [ebp - 0xd2c], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xed0], 0
jne 0x100282bf
or eax, 0xffffffff
je 0x100282cb
mov dword [ebp - 0xdd4], 1
jmp 0x100282d2
and dword [ebp - 0xdd4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xfc]
mov dword [ebp - 0x12a8], eax
mov eax, dword [ebp - 0x498]
cmp eax, dword [ebp - 0x194]
jg 0x100282ff
mov dword [ebp - 0x804], 1
jmp 0x10028306
and dword [ebp - 0x804], 0
cmp dword [ebp - 0x804], 0x2b46
jg 0x1002831e
mov dword [ebp - 0x80c], 1
jmp 0x10028325
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x80c], eax
jl 0x1002833f
mov dword [ebp - 0x814], 1
jmp 0x10028346
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x814], eax
jle 0x10028360
mov dword [ebp - 0x81c], 1
jmp 0x10028367
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0x81c]
sub eax, 0xffff
mov dword [ebp - 0x35c], eax
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0xf00]
call fcn.1001325d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe60]
call fcn.1001325d
mov eax, dword [0x10ac9190]
and eax, 1
jne 0x100283cd
mov eax, dword [0x10ac9190]
or eax, 1
mov dword [0x10ac9190], eax
mov dword [ebp - 4], 0x41
mov ecx, 0x10ac9194
call fcn.100132fb
push 0x1006c095
call fcn.10053799
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x60], 0x66fe7d8a
mov dword [ebp - 0x364], 0
jmp 0x100283ed
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 3
jge 0x10028409
mov eax, dword [ebp - 0x364]
mov dword [ebp + eax*4 - 0x1734], 0x945cb81e
jmp 0x100283e0
cmp dword [ebp - 0x60], 0
je 0x10028421
cmp dword [ebp - 0x60], 0
je 0x10028421
mov dword [ebp - 0x83c], 1
jmp 0x10028428
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x60]
jle 0x1002843c
mov dword [ebp - 0x824], 1
jmp 0x10028443
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x824], eax
jg 0x1002845d
cmp dword [ebp - 0x60], 0
jne 0x1002845d
and dword [ebp - 0x82c], 0
jmp 0x10028467
mov dword [ebp - 0x82c], 1
mov eax, dword [ebp - 0x82c]
neg eax
cmp eax, dword [ebp - 0x60]
jge 0x10028480
mov dword [ebp - 0x834], 1
jmp 0x10028487
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x834]
jge 0x1002849e
mov dword [ebp - 0x844], 1
jmp 0x100284a5
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x83c]
cmp eax, dword [ebp - 0x844]
jle 0x100284bf
mov dword [ebp - 0xd34], 1
jmp 0x100284c6
and dword [ebp - 0xd34], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1598], eax
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x60]
jl 0x100284e3
cmp dword [ebp + 0x10], 0
jne 0x1002a598
cmp dword [ebp - 0x1b4], 0xffffffff
je 0x1002a598
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x1bc]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x1b4]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x90], ax
mov dword [ebp - 0x428], 0xfe7d8a87
mov dword [ebp - 0xae4], 0x3d4e677b
mov dword [ebp - 0x420], 0
jmp 0x1002a5c5
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 4
jge 0x1002a5e1
mov eax, dword [ebp - 0x420]
mov dword [ebp + eax*4 - 0x1754], 0xfffffffb
jmp 0x1002a5b8
mov dword [ebp - 0x428], 3
jmp 0x1002a5fa
mov eax, dword [ebp - 0x428]
dec eax
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jl 0x1002a65f
mov dword [ebp - 0x430], 0
jmp 0x1002a61c
mov eax, dword [ebp - 0x430]
inc eax
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 2
jge 0x1002a638
mov eax, dword [ebp - 0x430]
mov dword [ebp + eax*4 - 0x1668], 0xfffffffc
jmp 0x1002a60f
mov eax, dword [ebp - 0xae4]
inc eax
mov dword [ebp - 0xae4], eax
mov byte [ebp - 0x179], 0
movzx eax, byte [ebp - 0x179]
test eax, eax
je 0x1002a65d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x1002a5ed
movzx eax, word [ebp - 0x90]
cmp eax, 0xffff
je 0x1002aa4c
movzx eax, word [ebp - 0x90]
mov ecx, dword [ebp - 0xf0]
mov edx, dword [ebp - 0x1bc]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0xc78], eax
mov eax, dword [ebp - 0xc78]
mov ecx, dword [ebp - 0x1bc]
add ecx, dword [eax]
mov dword [ebp - 0xf4], ecx
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0xf0]
jbe 0x1002aa44
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1fc]
mov edx, dword [ebp - 0xf0]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0xf4], edx
jae 0x1002aa44
mov eax, dword [0x10ac9190]
and eax, 2
jne 0x1002a70a
mov eax, dword [0x10ac9190]
or eax, 2
mov dword [0x10ac9190], eax
mov dword [ebp - 4], 0x55
push 0x1757
call fcn.1000bcb8
pop ecx
mov byte [0x10ac918c], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x80], 1
mov byte [ebp - 0x7f], 0x3f
mov byte [ebp - 0x7e], 0
mov byte [ebp - 0x7d], 8
mov byte [ebp - 0x7c], 1
mov byte [ebp - 0x7b], 0x78
mov byte [ebp - 0x7a], 2
mov byte [ebp - 0x79], 8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x80]
and eax, 0x53
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x80]
or ecx, 0x53
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x80]
mov byte [ebp + eax - 0x11c], cl
mov dword [ebp - 0x28], 2
and dword [ebp - 0x204], 0
jmp 0x1002a772
mov eax, dword [ebp - 0x28]
inc eax
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 8
jae 0x1002a83b
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x80]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x28], eax
jne 0x1002a7b3
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x80]
inc eax
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x80]
mov ecx, dword [ebp - 0x28]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x28], eax
jmp 0x1002a76a
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x204]
movzx eax, byte [ebp + eax - 0x82]
movsx eax, byte [ebp + eax - 0x11c]
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0x7f]
and ecx, eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x204]
movzx eax, byte [ebp + eax - 0x82]
movsx eax, byte [ebp + eax - 0x11c]
mov edx, dword [ebp - 0x28]
movzx edx, byte [ebp + edx - 0x7f]
and edx, eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x204]
movzx eax, byte [ebp + eax - 0x82]
movsx eax, byte [ebp + eax - 0x11c]
mov esi, dword [ebp - 0x28]
movzx ebx, byte [ebp + esi - 0x7f]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x80]
mov byte [ebp + eax - 0x11c], bl
and dword [ebp - 0x204], 0
jmp 0x1002a76a
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x11c], 0
mov eax, dword [0x10ac9190]
and eax, 4
jne 0x1002a887
mov eax, dword [0x10ac9190]
or eax, 4
mov dword [0x10ac9190], eax
mov dword [ebp - 4], 0x56
lea eax, [ebp - 0x11c]
push eax
mov ecx, 0x10ac9150
call fcn.1002b9bc
push 0x1006c086
call fcn.10053799
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x3d4], 0
jmp 0x1002a89d
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 4
jae 0x1002a8b6
mov eax, dword [ebp - 0x3d4]
mov byte [ebp + eax - 0x11c], 0
jmp 0x1002a890
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x124], eax
movsx eax, byte [0x10ac918c]
mov ecx, dword [ebp - 0x124]
movsx ecx, byte [ecx]
cmp ecx, eax
je 0x1002a8e5
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
jmp 0x1002a8c2
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
push dword [ebp - 0x124]
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x15b0]
call fcn.1002dd61
mov dword [ebp - 4], 0x57
push 0x10ac9150
lea ecx, [ebp - 0x15b0]
call fcn.1002b9df
lea eax, [ebp - 0x12f8]
push eax
lea ecx, [ebp - 0x15b0]
call fcn.10013ca5
push dword [eax]
lea eax, [ebp - 0x1518]
push eax
lea ecx, [ebp - 0x15b0]
call fcn.10013c91
push dword [eax]
lea ecx, [ebp - 0x1698]
call fcn.1002dd8a
mov byte [ebp - 4], 0x58
lea eax, [ebp - 0x1698]
push eax
call fcn.10016d38
pop ecx
mov dword [ebp - 0x4d0], eax
cmp dword [ebp - 0x4d0], 0
je 0x1002a9f0
push dword [ebp - 0x124]
lea ecx, [ebp - 0x15e0]
call fcn.1002b9bc
mov byte [ebp - 4], 0x59
lea edx, [ebp - 0xc80]
lea ecx, [ebp - 0x15e0]
call fcn.10016cd5
movzx eax, al
test eax, eax
je 0x1002a9c0
push 0
push dword [ebp - 0xc80]
push 0
push dword [ebp - 0x4d0]
call fcn.100207c9
add esp, 0x10
mov dword [ebp - 0xf4], eax
jmp 0x1002a9df
push 1
push 0
lea eax, [ebp - 0x15e0]
push eax
push dword [ebp - 0x4d0]
call fcn.100207c9
add esp, 0x10
mov dword [ebp - 0xf4], eax
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x15e0]
call fcn.1001313b
jmp 0x1002aa26
cmp dword [ebp + 0x10], 0
jne 0x1002aa06
mov ecx, dword [ebp + 0xc]
call fcn.10012ea5
mov dword [ebp - 0xaec], eax
jmp 0x1002aa10
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0xaec], eax
push dword [ebp - 0xaec]
push dword [ebp + 8]
call fcn.1001d7e8
pop ecx
pop ecx
mov dword [ebp - 0xf4], eax
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x1698]
call fcn.10013072
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15b0]
call fcn.1001313b
mov eax, dword [ebp - 0xf4]
jmp 0x1002aa9b
mov dword [ebp - 0x1300], 0x342eb90d
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x1002aa76
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov byte [ebp - 0x181], 0
movzx eax, byte [ebp - 0x181]
test eax, eax
je 0x1002aa99
push 0
push 0
push 0
push 0x4de
call dword [sym.imp.GDI32.dll_PolyPolyline]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret