Function at 0x10009035
Capabilities:
Clear file content
Connect pipe
Create pipe
Create process on windows
Get common file path
Get geographical location
Get thread local storage value
Parse pe header
Query environment variable
Set environment variable
Write and execute a file

Disassembly:
mov eax, 0x10072e27
call fcn.10072060
mov eax, 0x170c
call fcn.1006fc80
push ebx
push esi
xor esi, esi
mov byte [ebp - 0x79], dl
push edi
inc esi
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x2c], esi
xor eax, eax
mov dword [ebp - 0x40], 0xffffffff
push 3
mov dword [ebp - 0x10], eax
pop edi
cmp dword [ebp - 0x10], edi
jge 0x10009084
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe20], 0xa8eac8b1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000906c
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100090a0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x368], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000908c
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x100090c8
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0xe20]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xe20], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jle 0x100090a9
xor eax, eax
inc dword [ebp - 0x368]
mov dword [ebp - 0x38], 0xbe8e56f9
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x100090f5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1d0], 0x6bdde0bc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100090dd
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10009108
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor eax, eax
mov dword [ebp - 0x38], eax
mov ebx, 0xff5ecce3
push 5
pop ecx
cmp dword [ebp - 0x38], eax
jl 0x100091e7
mov edi, 0xea28c7ff
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x50], 0x6b8642e5
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jg 0x100091db
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x100091c5
mov dword [ebp - 0x50], 0xffffffff
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x1d0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp edi, eax
mov eax, dword [ebp - 0x1d0]
sbb ecx, ecx
xor edx, edx
neg ecx
add ecx, eax
mov eax, dword [ebp - 0x50]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sete dl
cmp edx, ebx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x50]
je 0x1000918f
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setl dl
sub edx, 2
neg edx
mov eax, dword [ebp + eax*4 - 0x1d0]
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
xor eax, eax
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x50], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10009146
mov dword [ebp - 0x50], 0xa19ae86a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x10009137
push 5
pop ecx
dec dword [ebp - 0x38]
jns 0x10009121
push 3
pop edi
mov dword [ebp - 0x20], eax
xor edx, edx
mov dword [ebp - 0x10], 0xa927213e
mov dword [ebp - 0x4c], 0xec6f0d4a
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setl bl
xor ecx, ecx
add ebx, 2
cmp ebx, eax
setg cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x10009267
mov dword [ebp - 0x10], 8
jmp 0x1000925c
mov dword [ebp - 0x28], 0x57e3b6f9
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffea
jl 0x10009259
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffea
jge 0x10009248
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x15
je 0x10009238
jmp 0x1000933a
mov dword [ebp - 0x50], 0x7d96711d
xor edx, edx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x50], 0xfffffffa
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
imul ecx, dword [ebp - 0x10]
add ecx, 0x6f62939
mov dword [ebp - 0x10], ecx
je 0x100092b7
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100092b9
mov ecx, esi
jmp 0x100092bb
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x1c]
imul eax, ecx
test eax, eax
je 0x100092d0
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x100092d2
mov eax, esi
jmp 0x100092d2
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x100092e0
mov edx, esi
mov dword [ebp - 0x50], eax
xor ecx, ecx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x4c]
sub edx, eax
mov eax, dword [ebp - 0x34]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xc7f
mov ecx, dword [ebp - 0x20]
setl al
sub ecx, eax
neg ecx
sbb ecx, ecx
add ecx, 0x79df
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1000933c
call dword [sym.imp.GDI32.dll_GdiFlush]
xor eax, eax
mov dword [ebp - 0x24], eax
or esi, 0xffffffff
mov dword [ebp - 0x28], esi
xor ebx, ebx
mov dword [ebp - 0x40], 0xf3d37a5b
inc ebx
mov dword [ebp - 0x40], 0x8e9646b8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 6
jne 0x1000945f
push 2
lea ecx, [ebp - 0xff4]
call fcn.10024d89
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], 0x446df37d
mov dword [ebp - 0x40], 0x872d9ee1
mov dword [ebp - 0x14], 0x9cdc345f
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x100093b2
push dword [ebp - 0x10]
lea ecx, [ebp - 0xff4]
call fcn.10024e10
and dword [eax], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10009396
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100093d2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xeec], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100093ba
xor eax, eax
mov dword [ebp - 0x38], eax
jmp 0x100093ea
mov dword [ebp - 0x40], 0xc9ed9ba0
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x2c]
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
jle 0x100093d7
mov dword [ebp - 0x2c], eax
jmp 0x1000943c
cmp dword [ebp - 0x38], eax
je 0x10009423
push 7
mov dword [ebp - 0x14], 0xb
pop ecx
jmp 0x1000941c
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10009419
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 7
xor eax, eax
pop ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jg 0x10009405
jmp 0x10009436
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10009433
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x2c]
push 0
pop eax
cmp dword [ebp - 0x2c], 0x2c
je 0x100093f4
lea ecx, [ebp - 0xff4]
mov dword [ebp - 4], esi
call fcn.10024e0b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 6
je 0x10009363
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10009474
push 0x6d0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0xe38]
mov dword [ebp - 0x24], 0xf6af1124
mov dword [ebp - 0x40], esi
push 2
call fcn.10024d89
xor eax, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x100094bb
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe38]
call fcn.10024e10
mov dword [eax], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000949c
xor eax, eax
push 0xfffffffffffffffb
mov dword [ebp - 0x24], 6
pop ecx
jmp 0x10009683
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x100094f0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5ac], 0x91e29ea4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100094d8
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10009510
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5dc], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x100094f8
xor eax, eax
dec dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x10009680
mov dword [ebp - 0x38], 0xfca86293
mov dword [ebp - 0x40], 0xfffffffa
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1000954f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1058], 0x9a22db78
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10009536
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000965f
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x928]
mov dword [ebp - 0x50], 0xffff
mov dword [ebp - 0x2c], 6
push 2
call fcn.10024d89
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x100095a0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x928]
call fcn.10024e10
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10009585
xor eax, eax
cmp dword [ebp - 0x1050], eax
jne 0x100095b2
mov ecx, eax
cmp dword [ebp - 0x5ac], eax
je 0x100095b4
mov ecx, ebx
xor eax, eax
cmp ecx, 0x53fc
setle al
cmp eax, 0x4593f6a0
je 0x100095cd
xor eax, eax
cmp dword [ebp - 0x10], eax
je 0x100095cf
mov eax, ebx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x104c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x104c], 0x26d8f9c3
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], eax
jmp 0x10009647
mov dword [ebp - 0x10], eax
jmp 0x1000963f
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], edi
jg 0x1000963c
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10009623
push eax
push 0x23f9
push eax
call dword [sym.imp.GDI32.dll_GetRegionData]
xor eax, eax
push eax
lea ecx, [ebp - 0x928]
call fcn.10024e10
push 0
inc dword [eax]
inc dword [ebp - 0x2c]
pop eax
cmp dword [ebp - 0x2c], edi
jle 0x1000960b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x10009603
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edi
jle 0x100095fe
lea ecx, [ebp - 0x928]
mov byte [ebp - 4], bl
call fcn.10024e0b
push 0xfffffffffffffffb
pop ecx
jmp 0x1000966f
mov dword [ebp - 0x28], 0x5708880d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x5dc], eax
inc dword [ebp - 0x44]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1000951f
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffef
jl 0x100094ca
lea ecx, [ebp - 0xe38]
mov dword [ebp - 4], esi
call fcn.10024e0b
mov dword [ebp - 0x40], esi
lea ecx, [ebp - 0x760]
mov dword [ebp - 0x38], 0x4ccb63e8
mov dword [ebp - 0x50], 0xe28fdeb7
push ebx
call fcn.10024d89
mov dword [ebp - 4], edi
xor eax, eax
mov dword [ebp - 0x50], 0xa329ef4a
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100096ed
push dword [ebp - 0x14]
lea ecx, [ebp - 0x760]
call fcn.10024e10
mov dword [eax], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100096d3
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10009708
push eax
push 0x1a88
push 0xaa3
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x760]
xor eax, eax
mov dword [ebp - 0x50], 0x94f9
push eax
call fcn.10024e10
mov edx, dword [ebp - 0x50]
mov esi, eax
mov ecx, dword [ebp - 0x38]
xor eax, eax
cmp edx, ecx
lea ecx, [ebp - 0x760]
setl al
add eax, dword [ebp - 0x38]
mov dword [esi], eax
xor eax, eax
push eax
call fcn.10024e10
mov eax, dword [ebp - 0x38]
mov ecx, ebx
mov eax, dword [ebp - 0x38]
sub ecx, eax
add ecx, dword [ebp - 0x38]
mov dword [ebp - 0x50], ecx
lea ecx, [ebp - 0x760]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x28], eax
or dword [ebp - 4], 0xffffffff
call fcn.10024e0b
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000978c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd58], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10009774
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jl 0x100097ba
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100097b5
push 0x12c0
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x1000979a
mov dword [ebp - 0x1c], eax
jmp 0x100097d3
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100097d0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x100097bf
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x38], 9
cmp dword [ebp - 0x38], ebx
mov ebx, dword [sym.imp.USER32.dll_GetDC]
jne 0x10009834
xor esi, esi
inc esi
mov dword [ebp - 0x28], 0xc69a
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10009821
push 0x8e4
push eax
push 0x1879
push 0x1179
push eax
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x38]
push 0
pop eax
cmp dword [ebp - 0x38], esi
je 0x100097f4
jmp 0x10009837
xor esi, esi
inc esi
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x10009849
push eax
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x1000986c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf64], 0xa8eac8b1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10009854
xor eax, eax
push 0xfffffffffffffff7
mov dword [ebp - 0x38], 0x9b55bb2c
mov dword [ebp - 0x38], 0x13
pop ecx
jmp 0x100098a6
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0xffffffed
jle 0x100098a3
mov dword [ebp - 0x50], 0xf7a73d2d
inc dword [ebp - 0x50]
mov eax, dword [ebp - 0x38]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffed
jg 0x1000988b
xor eax, eax
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffe9
jne 0x1000987f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x100098c8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x308], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100098b4
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jge 0x100098ee
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x904], 0x7fd5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100098d6
xor eax, eax
push 2
pop edx
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], eax
jl 0x100099a8
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x904], 0
je 0x10009927
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1000999a
push esi
push eax
push 0x4d
call edi
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
jmp 0x1000999a
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x904]
mov eax, dword [ebp - 0x2c]
sub ecx, dword [ebp + eax*4 - 0x904]
je 0x10009973
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x10009953
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1000999a
push eax
call edi
push eax
call ebx
push eax
xor eax, eax
push eax
push 0x19b8
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
jmp 0x1000999a
mov dword [ebp - 0x14], 0xcf09cc25
xor eax, eax
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], eax
jl 0x100099a6
mov dword [ebp - 0x50], 0x544d1878
mov eax, dword [ebp - 0x50]
dec dword [ebp - 0x14]
jns 0x10009984
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x100099a6
dec dword [ebp - 0x2c]
push 2
pop edx
jns 0x100098fd
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], edx
jg 0x10009c8f
jmp 0x100099b8
xor eax, eax
mov dword [ebp - 0x40], 0x70ad
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100099e1
push eax
push 0x25db
push 0x2d7
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x100099f8
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
xor eax, eax
mov dword [ebp - 0x20], 0xb110c93b
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x58], 0x49562184
push 3
mov dword [ebp - 0x14], eax
pop edx
cmp dword [ebp - 0x14], edx
jge 0x10009a30
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbbc], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10009a18
xor eax, eax
mov dword [ebp - 0x20], 8
cmp dword [ebp - 0x20], 0xb
jle 0x10009c6e
jmp 0x10009a45
xor eax, eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x4c8]
push esi
call fcn.10024d89
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x50], 0x90ae73
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10009a91
push dword [ebp - 0x14]
lea ecx, [ebp - 0x4c8]
call fcn.10024e10
mov dword [eax], 0xcf13e13a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10009a73
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10009c48
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x10009ab9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x84], 0x9609c3fb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10009aa1
xor eax, eax
push 3
mov dword [ebp - 0x10], eax
pop ecx
cmp dword [ebp - 0x10], ecx
jge 0x10009adc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7a8], 0xb56095db
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10009ac4
xor eax, eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xfffffffa
jle 0x10009c2e
mov dword [ebp - 0x1c], 0xadf1adb2
lea ecx, [ebp - 0x4c8]
mov dword [ebp - 0x50], 0xfffffffc
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x2c]
xor eax, eax
push eax
call fcn.10024e10
mov dword [eax], esi
test esi, esi
jne 0x10009b55
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x4c8]
mov eax, dword [ebp - 0x20]
xor eax, eax
push eax
call fcn.10024e10
mov ecx, dword [ebp - 0x84]
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp dword [eax], ecx
setge dl
mov dword [ebp - 0xbb4], edx
mov eax, dword [ebp - 0x20]
imul eax, edx
test eax, eax
jne 0x10009b55
mov ecx, eax
inc esi
jmp 0x10009b5a
xor esi, esi
inc esi
mov ecx, esi
xor eax, eax
cmp ecx, 0x4886
setge al
xor edx, edx
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
cmp ecx, eax
mov eax, dword [ebp - 0x84]
setle dl
sub edx, eax
mov eax, dword [ebp - 0x2c]
imul eax, edx
mov dword [ebp - 0x7a4], eax
xor eax, eax
cmp dword [ebp - 0x84], eax
je 0x10009bea
mov eax, dword [ebp - 0x1c]
neg eax
push 3
sbb eax, eax
neg eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
pop ecx
add eax, ecx
jne 0x10009bb5
mov eax, dword [ebp - 0xbb4]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x4c8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
push eax
call fcn.10024e10
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x28]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x58]
jge 0x10009be8
mov ecx, esi
jmp 0x10009bec
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x84]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x7a4]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x7a4]
setl cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xbbc], eax
dec dword [ebp - 0x84]
cmp dword [ebp - 0x84], 0xfffffffa
jg 0x10009aef
xor eax, eax
push eax
lea ecx, [ebp - 0x4c8]
call fcn.10024e10
mov ecx, dword [ebp - 0x7a4]
push 0
mov dword [eax], ecx
inc dword [ebp - 0x2c]
pop eax
cmp dword [ebp - 0x2c], 0xe
je 0x10009a99
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c8]
call fcn.10024e0b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xb
jg 0x10009a43
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + eax*4 - 0xf64]
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xf64], ecx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 2
jle 0x100099b6
xor ebx, ebx
mov dword [ebp - 0x1c], 0xa9d19ac1
inc ebx
mov dword [ebp - 0x38], 0x83bc1b0f
mov dword [ebp - 0x14], 0xd0127420
lea ecx, [ebp - 0x5d8]
push ebx
call fcn.10024d89
push 5
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x91c]
xor eax, eax
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x10], eax
push ebx
call fcn.10024d89
xor eax, eax
mov byte [ebp - 4], 6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10009cfd
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5d8]
call fcn.10024e10
mov dword [eax], 0x17c92570
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10009cdf
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10009d15
push dword [ebp - 0x10]
lea ecx, [ebp - 0x91c]
call fcn.10024e10
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10009d02
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
cmp eax, ebx
setle cl
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x5d8]
mov eax, dword [ebp - 0x14]
xor eax, eax
push eax
call fcn.10024e10
mov edx, dword [ebp - 0x14]
mov esi, eax
mov ecx, dword [ebp - 0x1c]
xor eax, eax
cmp edx, ecx
mov ecx, dword [ebp - 0x38]
setl al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x5d8]
setle dl
xor eax, eax
push eax
mov dword [esi], edx
call fcn.10024e10
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x91c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x10], eax
push eax
call fcn.10024e10
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp ecx, ebx
setg dl
sub edx, 0x85
neg edx
sbb edx, edx
inc edx
mov dword [eax], edx
mov dword [ebp - 0x10], 0x1b
jmp 0x10009e6b
mov dword [ebp - 0x34], 0x7e8f8848
mov dword [ebp - 0x14], 0x7dbc1552
mov dword [ebp - 0x44], 0xd45ab60a
mov dword [ebp - 0x48], 0xa6c9c6c2
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10009e53
mov eax, dword [ebp - 0x50]
mov ecx, 0x7f794fc7
sub ecx, eax
xor eax, eax
add ecx, dword [ebp - 0x14]
cmp ecx, 0x7e7f6f8
setne al
xor ebx, ebx
neg eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
lea ecx, [ebp - 0x5d8]
setne bl
xor eax, eax
push eax
call fcn.10024e10
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x34]
cmp ebx, eax
setne cl
add ecx, 4
cmp ecx, 0xbb2d3f57
sbb eax, eax
xor ebx, ebx
inc eax
imul eax, eax, 7
cmp eax, 0x79a9257d
jge 0x10009e52
xor eax, eax
inc ebx
jmp 0x10009e55
inc ebx
mov eax, ebx
mov edx, dword [ebp - 0x10]
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x48]
cmp edx, eax
setg cl
mov dword [ebp - 0x48], ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff1
jne 0x10009db9
lea ecx, [ebp - 0x91c]
call fcn.10024e0b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5d8]
call fcn.10024e0b
inc dword [ebp - 0x308]
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x40], 0xffffffff
push 3
mov dword [ebp - 0x10], eax
pop edx
cmp dword [ebp - 0x10], edx
jge 0x10009ec4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe50], 0xa8eac8b1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10009eac
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10009ee0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x358], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10009ecc
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x10009f08
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0xe50]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xe50], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jle 0x10009ee9
xor eax, eax
inc dword [ebp - 0x358]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edx
jge 0x10009f38
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1048], 0xa8eac8b1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10009f20
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x10009f54
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x35c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10009f40
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x10009f70
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x1048]
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1048], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jle 0x10009f59
inc dword [ebp - 0x35c]
lea ecx, [ebp - 0xae4]
mov esi, 0xb0647dc4
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x34], 0x44555950
mov dword [ebp - 0x40], 0x6085
push 2
call fcn.10024d89
push 7
pop eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x4c], 0xf58aae07
mov dword [ebp - 0x28], 0x9634d71b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x10009fd7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1604], 0x4d9edbda
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10009fbe
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10009fff
push dword [ebp - 0x10]
lea ecx, [ebp - 0xae4]
call fcn.10024e10
mov dword [eax], 0x71a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10009fe0
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1000a03c
mov eax, dword [ebp - 0x34]
xor ecx, ecx
add eax, 2
cmp eax, 0xd23c
setl cl
lea eax, [ecx + 0x6497]
xor ecx, ecx
mov dword [ebp - 0x1600], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, 6
setne cl
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jg 0x1000a03c
xor eax, eax
mov edx, eax
jmp 0x1000a03e
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
push 3
setl cl
pop edx
cmp edx, eax
push ebx
sbb eax, eax
inc eax
sub eax, ecx
lea ecx, [ebp - 0xae4]
mov dword [ebp - 0x28], eax
call fcn.10024e10
lea ecx, [ebp - 0xae4]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
or dword [ebp - 4], 0xffffffff
call fcn.10024e0b
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x934]
mov dword [ebp - 0x34], 0x44555950
mov dword [ebp - 0x40], 0x6085
push 2
call fcn.10024d89
mov dword [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x4c], 0xf58aae07
mov dword [ebp - 0x28], 0x9634d71b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000a0cf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x161c], 0x4d9edbda
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000a0b6
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1000a0f7
push dword [ebp - 0x10]
lea ecx, [ebp - 0x934]
call fcn.10024e10
mov dword [eax], 0x71a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1000a0d8
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1000a134
mov eax, dword [ebp - 0x34]
xor ecx, ecx
add eax, 2
cmp eax, 0xd23c
setl cl
lea eax, [ecx + 0x6497]
xor ecx, ecx
mov dword [ebp - 0x1618], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, 6
setne cl
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jg 0x1000a134
xor eax, eax
mov edx, eax
jmp 0x1000a136
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
push 3
setl cl
pop edx
cmp edx, eax
push ebx
sbb eax, eax
inc eax
sub eax, ecx
lea ecx, [ebp - 0x934]
mov dword [ebp - 0x28], eax
call fcn.10024e10
lea ecx, [ebp - 0x934]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
or dword [ebp - 4], 0xffffffff
call fcn.10024e0b
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor eax, eax
mov dword [ebp - 0x4c], 0x365653d4
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1000a190
push 0x1bf9
push eax
push eax
call ebx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov esi, dword [sym.imp.USER32.dll_GetCapture]
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1000a1af
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1000a1c8
call esi
jmp 0x1000a1c8
mov dword [ebp - 0x50], 0x1654
mov dword [ebp - 0x28], 0x969ac54c
cmp dword [ebp - 0x50], eax
je 0x1000a1c5
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0xb0647dc4
lea ecx, [ebp - 0xc34]
mov dword [ebp - 0x34], 0x44555950
mov dword [ebp - 0x40], 0x6085
push 2
call fcn.10024d89
mov dword [ebp - 4], 9
xor eax, eax
mov dword [ebp - 0x4c], 0xf58aae07
mov dword [ebp - 0x28], 0x9634d71b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000a223
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1634], 0x4d9edbda
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000a20a
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1000a24b
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc34]
call fcn.10024e10
mov dword [eax], 0x71a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1000a22c
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1000a288
mov eax, dword [ebp - 0x34]
xor ecx, ecx
add eax, 2
cmp eax, 0xd23c
setl cl
lea eax, [ecx + 0x6497]
xor ecx, ecx
mov dword [ebp - 0x1630], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, 6
setne cl
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jg 0x1000a288
xor eax, eax
mov edx, eax
jmp 0x1000a28d
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
push 3
setl cl
pop edx
cmp edx, eax
sbb eax, eax
inc eax
sub eax, ecx
lea ecx, [ebp - 0xc34]
mov dword [ebp - 0x28], eax
xor eax, eax
inc eax
push eax
call fcn.10024e10
lea ecx, [ebp - 0xc34]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
or dword [ebp - 4], 0xffffffff
call fcn.10024e0b
xor eax, eax
mov dword [ebp - 0x4c], 0x365653d4
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1000a2e4
push 0x1bf9
push eax
push eax
call ebx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1000a2fd
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1000a318
call esi
jmp 0x1000a316
mov dword [ebp - 0x50], 0x1654
mov dword [ebp - 0x28], 0x969ac54c
cmp dword [ebp - 0x50], eax
je 0x1000a313
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x4c], 0x365653d4
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1000a331
push 0x1bf9
push eax
push eax
call ebx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
xor eax, eax
cmp dword [ebp - 0x4c], eax
je 0x1000a34a
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1000a365
call esi
jmp 0x1000a363
mov dword [ebp - 0x50], 0x1654
mov dword [ebp - 0x28], 0x969ac54c
cmp dword [ebp - 0x50], eax
je 0x1000a360
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x40], 0xfffffff6
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1000a383
push 0x6d0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1000a395
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 0x126c]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x127c]
push eax
lea ecx, [ebp - 0x163c]
movdqu xmmword [ebp - 0x127c], xmm0
call fcn.10024e1f
lea ecx, [ebp - 0x1c6]
mov esi, eax
call fcn.10009032
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1390]
push dword [esi]
call fcn.10024de5
xor eax, eax
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x24], eax
push 3
mov dword [ebp - 0x24], eax
pop ebx
cmp dword [ebp - 0x24], ebx
jg 0x1000a44e
xor esi, esi
inc esi
push ebx
lea ecx, [ebp - 0x94c]
call fcn.10024d89
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000a425
push dword [ebp - 0x14]
lea ecx, [ebp - 0x94c]
call fcn.10024e10
mov dword [eax], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000a40b
xor eax, eax
push eax
lea ecx, [ebp - 0x94c]
call fcn.10024e10
lea ecx, [ebp - 0x94c]
mov byte [ebp - 4], 0xa
mov dword [eax], 0x4a2a4f40
call fcn.10024e0b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1000a3f1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1390]
call fcn.10024e0b
mov dword [ebp - 0x48], 0xb0647dc4
xor ebx, ebx
mov dword [ebp - 0x1c], 6
inc ebx
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], 0x14
jge 0x1000a55e
mov dword [ebp - 0x14], 0xfda0e60f
lea ecx, [ebp - 0xe68]
push ebx
call fcn.10024d89
mov dword [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000a4c5
push dword [ebp - 0x14]
lea ecx, [ebp - 0xe68]
call fcn.10024e10
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000a4aa
xor eax, eax
mov dword [ebp - 0x14], 0xffffffef
jmp 0x1000a541
mov dword [ebp - 0x38], 0x10e164ca
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], eax
jg 0x1000a53e
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1000a4f2
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
xor eax, eax
cmp dword [ebp - 0x50], eax
je 0x1000a50e
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x40], ebx
dec dword [ebp - 0x44]
jmp 0x1000a533
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1000a533
push eax
push 0x1be7
push 0x12e0
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
xor eax, eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
push 0
pop eax
jle 0x1000a4e0
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe7
jle 0x1000a4ce
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe68]
call fcn.10024e0b
inc dword [ebp - 0x1c]
jmp 0x1000a475
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1000a576
mov dword [ebp - 0x28], 0xc9ca
mov dword [ebp - 0x28], 0xe7975358
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x14
jg 0x1000a565
mov dword [ebp - 0x34], 0x44555950
mov dword [ebp - 0x4c], 0xffff
mov dword [ebp - 0x1c], 0xfffffff6
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x4c]
sub ecx, eax
jne 0x1000a5b0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], 0xfffffffa
jmp 0x1000a648
movdqa xmm0, xmmword [0x10007e90]
lea eax, [ebp - 0x10cc]
push eax
lea eax, [ebp - 0x10dc]
push eax
lea ecx, [ebp - 0x14ec]
movdqu xmmword [ebp - 0x10dc], xmm0
call fcn.10024e1f
lea ecx, [ebp - 0x1f8]
mov esi, eax
call fcn.10009032
push eax
push dword [esi + 4]
lea ecx, [ebp - 0xafc]
push dword [esi]
call fcn.10024de5
xor eax, eax
mov dword [ebp - 4], 0xd
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], al
je 0x1000a622
push 0x1172
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 3
pop eax
push eax
lea ecx, [ebp - 0xafc]
call fcn.10024e10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xafc]
cmp dword [eax], 0
jne 0x1000a656
call fcn.10024e0b
inc dword [ebp - 0x1c]
push 7
pop esi
cmp dword [ebp - 0x1c], esi
jne 0x1000a5bf
jmp 0x1000a65e
call fcn.10024e0b
push 7
pop esi
mov dword [ebp - 0x14], 0x2fe22364
xor eax, eax
mov dword [ebp - 0x40], 0x417be18
mov dword [ebp - 0x40], 0x5e81a7ec
push 2
mov dword [ebp - 0x50], 0xc5d177cc
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000a69e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xfbc], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000a68a
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ecx
jge 0x1000a6be
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1504], 0xddcd1665
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000a6a6
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jge 0x1000a6de
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd68], 0xa5f34bda
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x1000a6c6
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1000a79a
lea ecx, [ebp - 0xe80]
call fcn.10024d89
mov dword [ebp - 4], 0xe
lea ecx, [ebp - 0xf7c]
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x40], 0x7cd95da2
push 4
call fcn.10024d89
xor eax, eax
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000a740
push dword [ebp - 0x10]
lea ecx, [ebp - 0xe80]
call fcn.10024e10
mov dword [eax], 0x73d2d672
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000a722
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000a764
push dword [ebp - 0x10]
lea ecx, [ebp - 0xf7c]
call fcn.10024e10
mov dword [eax], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000a749
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1000a778
push eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
inc dword [ebp - 0x50]
lea ecx, [ebp - 0xf7c]
call fcn.10024e0b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe80]
call fcn.10024e0b
inc dword [ebp - 0x14]
xor eax, eax
push ebx
cmp dword [ebp - 0x14], eax
jle 0x1000a6e6
mov dword [ebp - 0x40], 0x6085
lea ecx, [ebp - 0x150]
call fcn.10024d89
push 4
lea ecx, [ebp - 0x964]
mov dword [ebp - 4], 0x10
call fcn.10024d89
xor eax, eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000a7f6
push dword [ebp - 0x10]
lea ecx, [ebp - 0x150]
call fcn.10024e10
mov dword [eax], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000a7d8
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1000a81e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x964]
call fcn.10024e10
mov dword [eax], 0x80643b8a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000a7ff
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1000a83a
push 0x1498
push 0x1552
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor eax, eax
push eax
lea ecx, [ebp - 0x150]
call fcn.10024e10
xor eax, eax
lea ecx, [ebp - 0x150]
push eax
call fcn.10024e10
xor eax, eax
lea ecx, [ebp - 0x150]
push eax
call fcn.10024e10
xor eax, eax
lea ecx, [ebp - 0x150]
push eax
call fcn.10024e10
xor eax, eax
lea ecx, [ebp - 0x150]
push eax
call fcn.10024e10
xor eax, eax
lea ecx, [ebp - 0x150]
push eax
call fcn.10024e10
mov esi, eax
lea ecx, [ebp - 0x150]
xor eax, eax
push eax
call fcn.10024e10
lea ecx, [ebp - 0x150]
mov edi, dword [eax]
xor eax, eax
imul edi, dword [esi]
push eax
sub edi, 0x1fdb
call fcn.10024e10
mov eax, dword [eax]
imul eax, edi
test eax, eax
jne 0x1000a8d8
push eax
lea ecx, [ebp - 0x150]
call fcn.10024e10
cmp dword [eax], 0
jne 0x1000a8d8
xor eax, eax
xor edi, edi
mov esi, eax
inc edi
jmp 0x1000a8df
xor edi, edi
inc edi
xor eax, eax
mov esi, edi
push eax
lea ecx, [ebp - 0x150]
call fcn.10024e10
lea ecx, [ebp - 0x150]
sub esi, dword [eax]
xor eax, eax
push eax
call fcn.10024e10
xor ecx, ecx
push 3
cmp esi, dword [eax]
pop esi
setne cl
xor ebx, ebx
cmp ecx, 0xc608
lea ecx, [ebp - 0x964]
push esi
setle bl
call fcn.10024e10
lea ecx, [ebp - 0x964]
mov dword [eax], ebx
call fcn.10024e0b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.10024e0b
push 2
lea ecx, [ebp - 0x97c]
call fcn.10024d89
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0x100c]
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x40], 0x1897a4a
push esi
call fcn.10024d89
xor eax, eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000a992
push dword [ebp - 0x10]
lea ecx, [ebp - 0x100c]
call fcn.10024e10
mov dword [eax], 0x2fd4914d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000a974
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1000a9a8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x890], 0xffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1000a997
dec dword [ebp - 0x88c]
lea ecx, [ebp - 0x100c]
mov byte [ebp - 4], 0x12
call fcn.10024e0b
mov dword [ebp - 0x3c], 0xf58aae07
lea ecx, [ebp - 0x444]
push esi
call fcn.10024d89
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xe94]
mov dword [ebp - 0x50], 0x4b733c63
mov dword [ebp - 0x28], 8
push edi
call fcn.10024d89
xor eax, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], esi
jge 0x1000aa20
push dword [ebp - 0x10]
lea ecx, [ebp - 0x444]
call fcn.10024e10
mov dword [eax], 0x399841b3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000aa02
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jge 0x1000aa46
push dword [ebp - 0x10]
lea ecx, [ebp - 0xe94]
call fcn.10024e10
mov dword [eax], 0xeaa29c14
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000aa28
xor eax, eax
push eax
lea ecx, [ebp - 0x444]
call fcn.10024e10
push 0x18
pop ebx
mov dword [eax], ebx
jmp 0x1000aa76
mov dword [ebp - 0x50], 0x6748f69f
lea ecx, [ebp - 0x444]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x28], eax
xor eax, eax
push eax
call fcn.10024e10
dec dword [eax]
xor eax, eax
lea ecx, [ebp - 0x444]
push eax
call fcn.10024e10
cmp dword [eax], ebx
jge 0x1000aa59
lea ecx, [ebp - 0xe94]
call fcn.10024e0b
lea ecx, [ebp - 0x444]
mov byte [ebp - 4], 0x12
call fcn.10024e0b
movdqa xmm0, xmmword [0x10007e70]
lea eax, [ebp - 0x11ec]
push eax
lea eax, [ebp - 0x11fc]
mov dword [ebp - 0x28], 0x9634d71b
push eax
lea ecx, [ebp - 0x1514]
movdqu xmmword [ebp - 0x11fc], xmm0
call fcn.10024e1f
lea ecx, [ebp - 0x1c8]
mov esi, eax
call fcn.10009032
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1498]
push dword [esi]
call fcn.10024de5
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x7c0]
mov dword [ebp - 0x24], 0x37c1d6b3
mov dword [ebp - 0x28], 0xa30a4ccf
push 2
call fcn.10024d89
xor eax, eax
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x10], eax
push 3
pop esi
cmp dword [ebp - 0x10], edi
jge 0x1000ab34
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa0], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000ab20
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1000ab5c
push dword [ebp - 0x10]
lea ecx, [ebp - 0x7c0]
call fcn.10024e10
mov dword [eax], 0xab39e224
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1000ab3d
xor eax, eax
mov byte [ebp - 0x2d], al
cmp byte [ebp - 0x2d], 0
je 0x1000ab6e
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor eax, eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], esi
jg 0x1000ad83
jmp 0x1000ab84
xor eax, eax
push 8
pop ecx
mov dword [ebp - 0x39c], ecx
mov dword [ebp - 0x398], ecx
mov dword [ebp - 0x394], ecx
mov dword [ebp - 0x390], ecx
mov dword [ebp - 0x58], 0xa7f359a1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x1000abc6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb0], 0xe6da504
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000abae
xor eax, eax
mov dword [ebp - 0xb0], esi
cmp dword [ebp - 0xb0], eax
jl 0x1000ace9
jmp 0x1000abdc
xor eax, eax
mov dword [ebp - 0x50], edi
lea ecx, [ebp - 0xbd4]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x44], 0xd44c039e
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x38], 0xba13b288
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0x87fce6bb
mov dword [ebp - 0x40], 0x8112def9
mov dword [ebp - 0x40], 0x133f29c8
push 2
call fcn.10024d89
mov byte [ebp - 4], bl
xor eax, eax
mov dword [ebp - 0x4c], 0x59c3f908
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1000ac50
push 5
pop ebx
push dword [ebp - 0x14]
lea ecx, [ebp - 0xbd4]
call fcn.10024e10
mov dword [eax], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000ac34
inc dword [ebp - 0x50]
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x24], 0xffff
test eax, eax
je 0x1000ac6c
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1000ac6e
mov eax, edi
jmp 0x1000ac6e
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1000ac84
push eax
lea ecx, [ebp - 0x7c0]
call fcn.10024e10
push edi
lea ecx, [ebp - 0xbd4]
call fcn.10024e10
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x394]
mov eax, dword [ebp - 0x394]
mov eax, dword [ebp - 0x394]
mov eax, dword [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
je 0x1000acbb
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x4c]
dec dword [ebp - 0x4c]
cmp eax, edi
jne 0x1000acc9
mov eax, edi
jmp 0x1000accb
xor eax, eax
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0xbd4]
mov byte [ebp - 4], 0x17
call fcn.10024e0b
dec dword [ebp - 0xb0]
jns 0x1000abda
mov eax, dword [ebp - 0x394]
sub eax, dword [ebp - 0xa0]
neg eax
sbb eax, eax
add eax, 0x3ffcd554
neg eax
sbb eax, eax
neg eax
neg eax
cmp eax, dword [ebp - 0x394]
jne 0x1000ad19
xor eax, eax
cmp dword [ebp - 0x58], eax
je 0x1000ad1b
mov esi, edi
jmp 0x1000ad1d
xor eax, eax
mov esi, eax
push edi
lea ecx, [ebp - 0x7c0]
call fcn.10024e10
xor ecx, ecx
mov edx, 0xdd14a140
cmp esi, edx
mov dword [eax], edx
setg cl
mov eax, dword [ebp - 0x398]
add eax, ecx
mov ecx, dword [ebp - 0x24]
add ecx, eax
mov dword [ebp - 0x28], ecx
je 0x1000ad4f
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x394]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xa0]
dec eax
neg eax
push 3
sbb eax, eax
neg eax
mov dword [ebp - 0xb0], eax
inc dword [ebp - 0xa0]
pop esi
cmp dword [ebp - 0xa0], esi
jle 0x1000ab82
lea ecx, [ebp - 0x7c0]
call fcn.10024e0b
lea ecx, [ebp - 0x1498]
mov byte [ebp - 4], 0x12
call fcn.10024e0b
push 3
pop ebx
mov dword [ebp - 0x20], 0x5c80
lea ecx, [ebp - 0x7d8]
mov dword [ebp - 0x50], 0x7eb8e136
push ebx
call fcn.10024d89
mov byte [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x4c], 0xffff
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jge 0x1000adf0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x7d8]
call fcn.10024e10
mov dword [eax], 0x20c4365d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000add2
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1000ae06
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13a8], 0x865e1bfe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000adf5
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x20], 0x1b0ae28d
je 0x1000ae1e
cmp dword [ebp - 0x20], eax
je 0x1000ae25
mov esi, edi
cmp dword [ebp - 0x20], eax
jne 0x1000ae27
mov esi, eax
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x7d8]
xor eax, eax
push eax
call fcn.10024e10
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp esi, ecx
setne dl
xor ecx, ecx
sub edx, dword [ebp - 0x50]
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
neg edx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x7d8]
push eax
call fcn.10024e10
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp dword [eax], ecx
setne dl
xor eax, eax
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], eax
jne 0x1000ae88
mov edx, eax
cmp dword [ebp - 0x4c], eax
je 0x1000ae8a
mov edx, edi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x13a0], ecx
lea ecx, [ebp - 0x7d8]
mov byte [ebp - 4], 0x12
call fcn.10024e0b
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1000aec1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x164c], 0x4d9edbda
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000aeb0
mov esi, 0xffff
lea ecx, [ebp - 0x2ec]
mov dword [ebp - 0x1c], esi
push 2
call fcn.10024d89
mov byte [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x2c], 0x9729cf30
mov dword [ebp - 0x20], 0x4e80031a
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], 0x9f196e6c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1000af22
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2ec]
call fcn.10024e10
or dword [eax], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1000af06
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1000af38
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x16b8], 0x3c17a3f0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x1000af27
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2ec]
push edi
call fcn.10024e10
cmp dword [ebp - 0x1c], esi
push edi
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x2ec]
call fcn.10024e10
lea ecx, [ebp - 0x2ec]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
xor eax, eax
push eax
call fcn.10024e10
mov ecx, dword [ebp - 0x20]
xor ebx, ebx
mov edx, dword [ebp - 0x1c]
sub edx, ecx
mov ecx, dword [ebp - 0x4c]
cmp edx, ecx
setne bl
dec ebx
add ebx, dword [eax]
mov eax, dword [ebp - 0x4c]
neg ebx
sbb ebx, ebx
neg ebx
imul eax, ebx
cmp eax, edi
je 0x1000af9c
mov eax, dword [ebp - 0x38]
push edi
lea ecx, [ebp - 0x2ec]
call fcn.10024e10
push edi
lea ecx, [ebp - 0x2ec]
mov esi, eax
call fcn.10024e10
mov ecx, dword [esi]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x4c]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x2ec]
push eax
call fcn.10024e10
mov ecx, dword [ebp - 0x10]
cmp dword [eax], ecx
jge 0x1000afec
xor eax, eax
cmp dword [ebp - 0x2c], eax
je 0x1000afee
mov edx, edi
jmp 0x1000aff0
xor eax, eax
mov edx, eax
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, edx
mov eax, 0xd9a54e58
push 0xfffffffffffffffd
setg cl
cmp eax, ecx
mov ecx, 0xd7c3b7c3
sbb eax, eax
neg eax
cmp ecx, eax
pop ecx
sbb eax, eax
neg eax
cmp eax, 0xd940
jge 0x1000b056
mov dword [ebp - 0x28], 0x14186e14
xor eax, eax
mov dword [ebp - 0x58], 0xba1dd793
mov dword [ebp - 0x2c], eax
jmp 0x1000b045
xor eax, eax
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x1c], eax
jmp 0x1000b0f0