Function at 0x10020060
Capabilities:
Accept command line arguments
Get geographical location
Get graphical window text
Get memory capacity
Parse pe header
Query environment variable
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061325
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1654
call fcn.1005cfd0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1fc], 0xfffffffd
push 3
lea ecx, [ebp - 0xe3c]
call fcn.10013a9c
and dword [ebp - 4], 0
mov dword [ebp - 0xc10], 0xecaa7054
mov dword [ebp - 0x284], 0
jmp 0x100200c7
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 3
jge 0x100200e9
push dword [ebp - 0x284]
lea ecx, [ebp - 0xe3c]
call fcn.10013b14
mov dword [eax], 0x3a47
jmp 0x100200ba
mov dword [ebp - 0x1fc], 0xc
jmp 0x10020102
mov eax, dword [ebp - 0x1fc]
dec eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0xfffffffd
je 0x10020554
mov dword [ebp - 0x1a4], 0
mov byte [ebp - 0x19f], 0
movzx eax, byte [ebp - 0x19f]
test eax, eax
je 0x1002013c
push 0x1e59
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x1a4], 0
jmp 0x10020155
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 2
jg 0x1002054f
mov dword [ebp - 0x28c], 0x568d526d
push 3
lea ecx, [ebp - 0xf60]
call fcn.10013a9c
mov byte [ebp - 4], 1
mov dword [ebp - 0xca4], 0xde30eca6
mov dword [ebp - 0x3a4], 0
jmp 0x100201a0
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 3
jge 0x100201c2
push dword [ebp - 0x3a4]
lea ecx, [ebp - 0xf60]
call fcn.10013b14
mov dword [eax], 0x3244d513
jmp 0x10020193
mov dword [ebp - 0x28c], 0
jmp 0x100201db
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 2
jg 0x10020531
push 4
lea ecx, [ebp - 0x4b8]
call fcn.10013a9c
mov byte [ebp - 4], 2
mov dword [ebp - 0x1f0], 9
mov dword [ebp - 0x214], 0xabac89d7
mov dword [ebp - 0x34c], 0
jmp 0x10020226
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 4
jge 0x10020248
push dword [ebp - 0x34c]
lea ecx, [ebp - 0x4b8]
call fcn.10013b14
mov dword [eax], 0xd66a0756
jmp 0x10020219
push 0
lea ecx, [ebp - 0xf60]
call fcn.10013b14
mov dword [eax], 1
push 3
lea ecx, [ebp - 0x4b8]
call fcn.10013b14
mov dword [eax], 2
jmp 0x10020294
push 3
lea ecx, [ebp - 0x4b8]
call fcn.10013b14
mov dword [ebp - 0x6a4], eax
mov eax, dword [ebp - 0x6a4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x6a4]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x4b8]
call fcn.10013b14
cmp dword [eax], 0
jl 0x1002051d
push 1
lea ecx, [ebp - 0x1140]
call fcn.10013a9c
mov byte [ebp - 4], 3
mov dword [ebp - 0x294], 0
jmp 0x100202d4
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 1
jge 0x100202f3
push dword [ebp - 0x294]
lea ecx, [ebp - 0x1140]
call fcn.10013b14
or dword [eax], 0xffffffff
jmp 0x100202c7
push 3
lea ecx, [ebp - 0x4b8]
call fcn.10013b14
push dword [eax]
lea ecx, [ebp - 0xe3c]
call fcn.10013b14
cmp dword [eax], 0
jne 0x1002031e
mov dword [ebp - 0xb44], 1
jmp 0x10020325
and dword [ebp - 0xb44], 0
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x1484], eax
push 3
lea ecx, [ebp - 0x4b8]
call fcn.10013b14
cmp dword [eax], 0xd3e9
jle 0x1002035b
cmp dword [ebp - 0x214], 0
je 0x1002035b
mov dword [ebp - 0xb3c], 1
jmp 0x10020362
and dword [ebp - 0xb3c], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0xb3c], eax
jne 0x1002037c
mov dword [ebp - 0xdc4], 1
jmp 0x10020383
and dword [ebp - 0xdc4], 0
push 3
lea ecx, [ebp - 0x4b8]
call fcn.10013b14
push dword [eax]
lea ecx, [ebp - 0xe3c]
call fcn.10013b14
mov ecx, dword [ebp - 0xb44]
add ecx, dword [eax]
cmp ecx, 0x29a2a67f
jge 0x100203b9
mov dword [ebp - 0xc94], 1
jmp 0x100203c0
and dword [ebp - 0xc94], 0
mov esi, dword [ebp - 0x1a4]
push 3
lea ecx, [ebp - 0x4b8]
call fcn.10013b14
cmp dword [eax], esi
jg 0x100203e3
mov dword [ebp - 0xc9c], 1
jmp 0x100203ea
and dword [ebp - 0xc9c], 0
push 3
lea ecx, [ebp - 0x4b8]
call fcn.10013b14
push dword [eax]
lea ecx, [ebp - 0xe3c]
call fcn.10013b14
mov esi, dword [ebp - 0x1a4]
push 0
lea ecx, [ebp - 0xf60]
call fcn.10013b14
cmp esi, dword [eax]
je 0x10020427
mov dword [ebp - 0xb58], 1
jmp 0x1002042e
and dword [ebp - 0xb58], 0
push 0
lea ecx, [ebp - 0x1140]
call fcn.10013b14
mov ecx, dword [ebp - 0xb58]
cmp ecx, dword [eax]
jl 0x10020451
mov dword [ebp - 0xb60], 1
jmp 0x10020458
and dword [ebp - 0xb60], 0
cmp dword [ebp - 0xb60], 0x2138b36c
je 0x10020470
mov dword [ebp - 0xb68], 1
jmp 0x10020477
and dword [ebp - 0xb68], 0
cmp dword [ebp - 0xb68], 2
jne 0x1002048c
mov dword [ebp - 0xb70], 1
jmp 0x10020493
and dword [ebp - 0xb70], 0
mov eax, dword [ebp - 0xb70]
mov dword [ebp - 0xca4], eax
mov dword [ebp - 0x214], 0
jmp 0x100204b8
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0x37
je 0x10020509
mov dword [ebp - 0x1f0], 6
jmp 0x100204da
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0x27
jne 0x10020507
mov byte [ebp - 0x18e], 0
movzx eax, byte [ebp - 0x18e]
test eax, eax
je 0x10020505
push 0x634
push 0xff0
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x100204cd
jmp 0x100204ab
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1140]
call fcn.10013af8
jmp 0x10020270
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4b8]
call fcn.10013af8
jmp 0x100201ce
mov dword [ebp - 0xc10], 0x93046aa1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf60]
call fcn.10013af8
jmp 0x10020148
jmp 0x100200f5
mov byte [ebp - 0x18f], 0
movzx eax, byte [ebp - 0x18f]
test eax, eax
je 0x1002057e
push 0x1b6c
push 0
push 0x1993
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe3c]
call fcn.10013af8
cmp dword [ebp + 0x10], 0
jbe 0x1002083c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002083c
mov dword [ebp - 0x58], 7
mov dword [ebp - 0xaf0], 0x1d25bb08
mov dword [ebp - 0x58], 0
jmp 0x100205c4
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xfffffff4
jne 0x10020828
mov dword [ebp - 0xfc], 0xeede0b40
mov dword [ebp - 0x4e8], 0xc6fe23a2
mov dword [ebp - 0xb80], 0xfffffffa
push 2
lea ecx, [ebp - 0x10bc]
call fcn.10013a9c
mov dword [ebp - 4], 4
mov dword [ebp - 0x3d4], 0
jmp 0x10020619
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 2
jge 0x1002063b
push dword [ebp - 0x3d4]
lea ecx, [ebp - 0x10bc]
call fcn.10013b14
mov dword [eax], 0xc5051dd2
jmp 0x1002060c
mov dword [ebp - 0xfc], 0
jmp 0x10020654
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 6
je 0x10020814
mov dword [ebp - 0xdd4], 0xb963
cmp dword [ebp - 0xfc], 0
jne 0x10020683
cmp dword [ebp - 0x58], 0
jne 0x10020683
and dword [ebp - 0x4f8], 0
jmp 0x1002068d
mov dword [ebp - 0x4f8], 1
cmp dword [ebp - 0x58], 0
je 0x100206a5
cmp dword [ebp - 0x58], 0
je 0x100206a5
mov dword [ebp - 0xb78], 1
jmp 0x100206ac
and dword [ebp - 0xb78], 0
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0xb80], eax
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0xb80]
jle 0x100206d2
mov dword [ebp - 0xb88], 1
jmp 0x100206d9
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0xb88]
sub eax, dword [ebp - 0x58]
cmp eax, 0x2be1
jne 0x100206f5
mov dword [ebp - 0xb90], 1
jmp 0x100206fc
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0xb90], eax
jge 0x10020713
mov dword [ebp - 0xbc8], 1
jmp 0x1002071a
and dword [ebp - 0xbc8], 0
cmp dword [ebp - 0xbc8], 0x3b1d
jl 0x10020732
mov dword [ebp - 0xdcc], 1
jmp 0x10020739
and dword [ebp - 0xdcc], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x140c], eax
mov eax, dword [ebp - 0xdd4]
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x4e8]
cmp eax, dword [ebp - 0x58]
jne 0x10020768
mov dword [ebp - 0xb34], 1
jmp 0x1002076f
and dword [ebp - 0xb34], 0
mov eax, dword [ebp - 0xb34]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0xaf0]
cmp eax, dword [ebp - 0x58]
jne 0x10020792
mov dword [ebp - 0x4f0], 1
jmp 0x10020799
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x4f0], eax
jg 0x100207b3
mov dword [ebp - 0x860], 1
jmp 0x100207ba
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x860], eax
jne 0x100207d1
mov dword [ebp - 0xa18], 1
jmp 0x100207d8
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0x4f8]
cmp eax, dword [ebp - 0xa18]
jne 0x100207f2
mov dword [ebp - 0x500], 1
jmp 0x100207f9
and dword [ebp - 0x500], 0
imul esi, dword [ebp - 0x500], 0xfffffffc
push 0
lea ecx, [ebp - 0x10bc]
call fcn.10013b14
mov dword [eax], esi
jmp 0x10020647
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10bc]
call fcn.10013af8
jmp 0x100205bd
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1001ca64
pop ecx
pop ecx
jmp 0x10029fb5
mov dword [ebp - 0x1000], 1
mov dword [ebp - 0xffc], 1
mov dword [ebp - 0xff8], 1
mov dword [ebp - 0xff4], 1
lea ecx, [ebp - 0x49e]
call fcn.100145b6
push eax
lea eax, [ebp - 0xff0]
push eax
lea eax, [ebp - 0x1000]
push eax
lea ecx, [ebp - 0x1580]
call fcn.1002c975
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4dc]
call fcn.1002c94f
mov dword [ebp - 4], 5
mov dword [ebp - 0x68], 0xa18885c6
mov dword [ebp - 0x68], 3
jmp 0x100208b7
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x10020b4a
mov dword [ebp - 0x510], 3
mov dword [ebp - 0xdec], 0xbd55fd0a
mov dword [ebp - 0xdf4], 0xbaf9eb11
mov dword [ebp - 0x868], 0x932
mov dword [ebp - 0xddc], 0x10007d60
cmp dword [ebp - 0x868], 0xc2f
jle 0x100209c5
push 0xd7d
call dword [sym.imp.USER32.dll_GetParent]
and dword [ebp - 0x29c], 0
jmp 0x10020924
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0x1298
jge 0x100209ba
and dword [ebp - 0x354], 0
jmp 0x1002094a
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0x1b09
jge 0x100209b5
and dword [ebp - 0x2a4], 0
jmp 0x1002096c
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0x4e4c
jge 0x100209b3
mov eax, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x354]
shl eax, cl
mov ecx, dword [ebp - 0x2a4]
sar eax, cl
cdq
mov dword [ebp - 0xcb0], eax
mov dword [ebp - 0xcac], edx
push dword [ebp - 0xcac]
push dword [ebp - 0xcb0]
mov ecx, 0x10607b78
call fcn.10013775
jmp 0x1002095f
jmp 0x1002093d
jmp 0x10020917
push 0x1d58
call dword [sym.imp.USER32.dll_DestroyWindow]
mov byte [ebp - 4], 6
cmp dword [ebp - 0x868], 0x6c2
jge 0x100209e5
mov edx, dword [ebp - 0xddc]
mov ecx, 0x10607b78
call fcn.10016475
jmp 0x10020a01
mov dword [ebp - 4], 5
jmp 0x10020a11
push dword [ebp - 0x68]
lea ecx, [ebp - 0x4dc]
call fcn.10013b14
push 2
lea ecx, [ebp - 0x4dc]
call fcn.10013b14
cmp dword [eax], 0
jne 0x10020a4d
push dword [ebp - 0x68]
lea ecx, [ebp - 0x4dc]
call fcn.10013b14
cmp dword [eax], 0
jne 0x10020a4d
and dword [ebp - 0xb64], 0
jmp 0x10020a57
mov dword [ebp - 0xb64], 1
push dword [ebp - 0x68]
lea ecx, [ebp - 0x4dc]
call fcn.10013b14
push dword [ebp - 0x68]
lea ecx, [ebp - 0x4dc]
call fcn.10013b14
xor eax, eax
inc eax
neg eax
cmp eax, 0xffffffff
ja 0x10020a89
mov dword [ebp - 0x508], 1
jmp 0x10020a90
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x508]
add eax, 0x1ec92367
jne 0x10020aaf
mov eax, 0xc4365de
test eax, eax
jne 0x10020aaf
and dword [ebp - 0x870], 0
jmp 0x10020ab9
mov dword [ebp - 0x870], 1
mov eax, dword [ebp - 0xb64]
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x510]
cmp eax, dword [ebp - 0x870]
je 0x10020adf
mov dword [ebp - 0xde4], 1
jmp 0x10020ae6
and dword [ebp - 0xde4], 0
push 3
lea ecx, [ebp - 0x4dc]
call fcn.10013b14
mov eax, dword [eax]
add eax, 0xc023
mov dword [ebp - 0x518], eax
push dword [ebp - 0x68]
lea ecx, [ebp - 0x4dc]
call fcn.10013b14
mov ecx, dword [ebp - 0x518]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdec]
cmp dword [ebp - 0x518], eax
jl 0x10020b32
push dword [ebp - 0x68]
lea ecx, [ebp - 0x4dc]
call fcn.10013b14
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x12e4], eax
mov dword [ebp - 0xdf4], 0x20b275cf
jmp 0x100208b0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4dc]
call fcn.10013af8
cmp dword [ebp + 0x10], 0
jne 0x100256a2
mov dword [ebp - 0xa0], 1
push 2
lea ecx, [ebp - 0xba0]
call fcn.10013a9c
mov dword [ebp - 4], 8
mov dword [ebp - 0x1478], 0xbb6e743
mov dword [ebp - 0x3ac], 0
jmp 0x10020ba4
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 2
jge 0x10020bc6
push dword [ebp - 0x3ac]
lea ecx, [ebp - 0xba0]
call fcn.10013b14
mov dword [eax], 0xecba2afe
jmp 0x10020b97
mov dword [ebp - 0xa0], 0xfffffff7
jmp 0x10020bdf
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 9
je 0x10021147
mov dword [ebp - 0x1c], 0x8adae8c9
push 1
lea ecx, [ebp - 0x1098]
call fcn.10013a9c
mov byte [ebp - 4], 9
mov dword [ebp - 0xe04], 0x7d7132c2
mov dword [ebp - 0xe0c], 5
mov dword [ebp - 0xe14], 0x5aa1
mov dword [ebp - 0x2ac], 0
jmp 0x10020c3b
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 1
jge 0x10020c5d
push dword [ebp - 0x2ac]
lea ecx, [ebp - 0x1098]
call fcn.10013b14
mov dword [eax], 0xfffffffd
jmp 0x10020c2e
mov dword [ebp - 0x1c], 0
jmp 0x10020c6d
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jg 0x10020c8a
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xba0]
call fcn.10013b14
cmp dword [eax], 0
je 0x10020c88
jmp 0x10020c8a
jmp 0x10020c66
mov dword [ebp - 0x1c], 1
jmp 0x10020c9a
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x10021133
mov dword [ebp - 0x1ec], 0xd4fce886
push 3
lea ecx, [ebp - 0xe4c]
call fcn.10013a9c
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x35c], 0
jmp 0x10020cd8
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 3
jge 0x10020cfa
push dword [ebp - 0x35c]
lea ecx, [ebp - 0xe4c]
call fcn.10013b14
mov dword [eax], 8
jmp 0x10020ccb
push 0
lea ecx, [ebp - 0xba0]
call fcn.10013b14
cmp dword [eax], 0x51cd25bb
jg 0x10020d1b
mov dword [ebp - 0xa20], 1
jmp 0x10020d22
and dword [ebp - 0xa20], 0
cmp dword [ebp - 0xa20], 0
jae 0x10020d37
mov dword [ebp - 0x520], 1
jmp 0x10020d3e
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x520]
jne 0x10020d55
mov dword [ebp - 0x878], 1
jmp 0x10020d5c
and dword [ebp - 0x878], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xba0]
call fcn.10013b14
mov ecx, dword [ebp - 0x878]
cmp ecx, dword [eax]
jge 0x10020d80
mov dword [ebp - 0x464], 1
jmp 0x10020d87
and dword [ebp - 0x464], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xba0]
call fcn.10013b14
mov ecx, dword [ebp - 0x464]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x464], eax
jg 0x10020db4
mov dword [ebp - 0x528], 1
jmp 0x10020dbb
and dword [ebp - 0x528], 0
cmp dword [ebp - 0x528], 0x5f1871d0
jle 0x10020ddc
mov eax, 0x722
test eax, eax
je 0x10020ddc
mov dword [ebp - 0xaf8], 1
jmp 0x10020de3
and dword [ebp - 0xaf8], 0
cmp dword [ebp - 0xaf8], 0xfffffffa
jl 0x10020df8
mov dword [ebp - 0x530], 1
jmp 0x10020dff
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x530], eax
jle 0x10020e19
mov dword [ebp - 0x880], 1
jmp 0x10020e20
and dword [ebp - 0x880], 0
cmp dword [ebp - 0x880], 0xf8278b72
ja 0x10020e3b
cmp dword [ebp - 0x1c], 0
jne 0x10020e3b
and dword [ebp - 0x538], 0
jmp 0x10020e45
mov dword [ebp - 0x538], 1
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x538], eax
jle 0x10020e5f
mov dword [ebp - 0xdfc], 1
jmp 0x10020e66
and dword [ebp - 0xdfc], 0
cmp dword [ebp - 0x1c], 7
je 0x10020e78
mov dword [ebp - 0xa28], 1
jmp 0x10020e7f
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0xa28]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x1ec]
cmp eax, dword [ebp - 0xa0]
jge 0x10020ea5
mov dword [ebp - 0x540], 1
jmp 0x10020eac
and dword [ebp - 0x540], 0
cmp dword [ebp - 0x540], 1
jge 0x10020ec1
mov dword [ebp - 0x888], 1
jmp 0x10020ec8
and dword [ebp - 0x888], 0
push 0
lea ecx, [ebp - 0xe4c]
call fcn.10013b14
mov ecx, dword [ebp - 0x888]
cmp ecx, dword [eax]
jle 0x10020eeb
mov dword [ebp - 0x548], 1
jmp 0x10020ef2
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x548]
jne 0x10020f0c
mov dword [ebp - 0xba4], 1
jmp 0x10020f13
and dword [ebp - 0xba4], 0
push 1
lea ecx, [ebp - 0xe4c]
call fcn.10013b14
mov ecx, dword [ebp - 0xba4]
imul ecx, dword [eax]
test ecx, ecx
jne 0x10020f3f
cmp dword [ebp - 0xa0], 0
jne 0x10020f3f
and dword [ebp - 0x550], 0
jmp 0x10020f49
mov dword [ebp - 0x550], 1
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x550]
imul eax, eax, 0xffffffff
mov dword [ebp - 0x890], eax
push 0
lea ecx, [ebp - 0x1098]
call fcn.10013b14
mov ecx, dword [ebp - 0x890]
mov dword [eax], ecx
cmp dword [ebp - 0x890], 0x605d
jle 0x10020f8e
cmp dword [ebp - 0x1c], 0
je 0x10020f8e
mov dword [ebp - 0x558], 1
jmp 0x10020f95
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0xe04]
cmp dword [ebp - 0x558], eax
jge 0x10020fc8
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xba0]
call fcn.10013b14
cmp dword [eax], 0
jne 0x10020fc8
cmp dword [ebp - 0xe0c], 0
jne 0x10020fc8
and dword [ebp - 0xa30], 0
jmp 0x10020fd2
mov dword [ebp - 0xa30], 1
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xa30], eax
jne 0x10020fec
mov dword [ebp - 0x560], 1
jmp 0x10020ff3
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0xe14], eax
push 0
lea ecx, [ebp - 0xe4c]
call fcn.10013b14
cmp dword [eax], 0
jne 0x10021028
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xba0]
call fcn.10013b14
cmp dword [eax], 0
je 0x100210fc
mov dword [ebp - 0x2b4], 0
jmp 0x10021041
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 1
jge 0x1002105d
mov eax, dword [ebp - 0x2b4]
mov dword [ebp + eax*4 - 0x898], 0xffff
jmp 0x10021034
mov dword [ebp - 0x1ec], 0
jmp 0x10021076
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0xd
jg 0x100210fa
push 1
lea ecx, [ebp - 0x1348]
call fcn.10013a9c
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x3ec], 0
jmp 0x100210a9
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 1
jge 0x100210cb
push dword [ebp - 0x3ec]
lea ecx, [ebp - 0x1348]
call fcn.10013b14
mov dword [eax], 0xfffffff9
jmp 0x1002109c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x898]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x898], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1348]
call fcn.10013af8
jmp 0x10021069
jmp 0x1002111f
mov byte [ebp - 0x15d], 0
movzx eax, byte [ebp - 0x15d]
test eax, eax
je 0x1002111f
push 0xc60
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xe4c]
call fcn.10013af8
jmp 0x10020c93
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1098]
call fcn.10013af8
jmp 0x10020bd2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xba0]
call fcn.10013af8
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.10017455
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x98], 0xfffffffd
mov dword [ebp - 0x12ec], 0xfffffffc
mov dword [ebp - 0x1414], 0x589afca8
mov dword [ebp - 0x12f4], 0xfffffff6
mov dword [ebp - 0x147c], 1
mov dword [ebp - 0x588], 0xffffffff
mov dword [ebp - 0xe8], 0
jmp 0x100211bc
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 3
jge 0x100211d8
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x488], 1
jmp 0x100211af
mov dword [ebp - 0xe8], 0
jmp 0x100211f1
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 1
jge 0x1002120d
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x12fc], 0xb42b8ff
jmp 0x100211e4
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x488], 0
jmp 0x1002123b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x488]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x488], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x488], 0xfffffff4
jge 0x10021571
mov dword [ebp - 0x12c], 0xfffd
mov dword [ebp - 0xe2c], 0
mov dword [ebp - 0x141c], 0xffffffff
mov dword [ebp - 0x1304], 8
mov dword [ebp - 0x1480], 1
mov dword [ebp - 0x130c], 0xffffffff
mov dword [ebp - 0x1424], 0
mov dword [ebp - 0x1314], 0xd9caaf7c
mov dword [ebp - 0x119c], 4
mov dword [ebp - 0x11a4], 0xdffa870c
mov dword [ebp - 0x11ac], 0xfffffffa
mov dword [ebp - 0x11c8], 0x49124c6e
cmp dword [ebp - 0x12c], 0
je 0x10021435
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x488], 0
jne 0x100212f4
push 5
pop eax
test eax, eax
jne 0x100212f4
and dword [ebp - 0xe1c], 0
jmp 0x100212fe
mov dword [ebp - 0xe1c], 1
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x11d0], eax
mov eax, 0x6874be76
cmp eax, 0xfffffff8
jne 0x10021330
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x488], 0
je 0x10021330
mov dword [ebp - 0x568], 1
jmp 0x10021337
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x568], eax
jg 0x10021351
mov dword [ebp - 0xb00], 1
jmp 0x10021358
and dword [ebp - 0xb00], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0xb00], eax
jge 0x10021372
mov dword [ebp - 0xe24], 1
jmp 0x10021379
and dword [ebp - 0xe24], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x488]
mov dword [ebp - 0x11d8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x488], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xe2c]
cmp ecx, dword [ebp + eax - 0x488]
jge 0x100213c6
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x488], 0
jne 0x100213c6
and dword [ebp - 0x570], 0
jmp 0x100213d0
mov dword [ebp - 0x570], 1
cmp dword [ebp - 0x570], 1
je 0x100213e5
mov dword [ebp - 0x8a0], 1
jmp 0x100213ec
and dword [ebp - 0x8a0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x488]
cmp dword [ebp - 0x8a0], eax
je 0x1002140d
mov dword [ebp - 0x578], 1
jmp 0x10021414
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x578]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x10021435
mov dword [ebp - 0xa38], 1
jmp 0x1002143c
and dword [ebp - 0xa38], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0xa38], eax
jl 0x10021456
mov dword [ebp - 0x580], 1
jmp 0x1002145d
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x580], eax
jne 0x10021477
mov dword [ebp - 0x8a8], 1
jmp 0x1002147e
and dword [ebp - 0x8a8], 0
cmp dword [ebp - 0x8a8], 0
jne 0x10021493
mov dword [ebp - 0xf10], 1
jmp 0x1002149a
and dword [ebp - 0xf10], 0
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x11e0], eax
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x100214f5
mov dword [ebp - 0x41c], 0xffff
mov dword [ebp - 0x98], 0
jmp 0x100214d0
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 4
jge 0x100214e8
mov eax, dword [ebp - 0x41c]
dec eax
mov dword [ebp - 0x41c], eax
jmp 0x100214c3
cmp dword [ebp - 0x41c], 0
je 0x100214f3
jmp 0x10021571
jmp 0x1002155f
mov dword [ebp - 0x98], 0
jmp 0x1002150e
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x1a
jne 0x1002155f
mov dword [ebp - 0x2bc], 0
jmp 0x10021530
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 3
jge 0x1002154c
mov eax, dword [ebp - 0x2bc]
mov dword [ebp + eax*4 - 0x1500], 0
jmp 0x10021523
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1500], 0
je 0x1002155d
jmp 0x1002155f
jmp 0x10021501
mov eax, dword [ebp - 0x588]
dec eax
mov dword [ebp - 0x588], eax
jmp 0x10021220
cmp dword [0x106098ac], 0
jne 0x10025008
push 4
lea ecx, [ebp - 0x4c4]
call fcn.10013a9c
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x78], 0x22ba3946
mov dword [ebp - 0x590], 3
mov dword [ebp - 0x5b8], 8
mov dword [ebp - 0xc18], 0x5ab136
mov dword [ebp - 0x5c0], 1
mov dword [ebp - 0x364], 0
jmp 0x100215da
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 4
jge 0x100215fc
push dword [ebp - 0x364]
lea ecx, [ebp - 0x4c4]
call fcn.10013b14
mov dword [eax], 0xfffffffa
jmp 0x100215cd
mov dword [ebp - 0x78], 0
jmp 0x1002160c
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jg 0x100218f0
mov dword [ebp - 0xc0], 0x33efc07e
mov dword [ebp - 0xc0], 3
jmp 0x10021639
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jl 0x100218d1
mov dword [ebp - 0xc8c], 0xaafa0b2b
mov eax, 0x49fc
test eax, eax
je 0x100217cd
push dword [ebp - 0x78]
lea ecx, [ebp - 0x4c4]
call fcn.10013b14
push dword [ebp - 0x78]
lea ecx, [ebp - 0x4c4]
call fcn.10013b14
cmp dword [eax], 0xffffffff
jne 0x1002169d
push dword [ebp - 0x78]
lea ecx, [ebp - 0x4c4]
call fcn.10013b14
cmp dword [eax], 0
je 0x1002169d
mov dword [ebp - 0xb6c], 1
jmp 0x100216a4
and dword [ebp - 0xb6c], 0
mov eax, dword [ebp - 0xb6c]
mov dword [ebp - 0x590], eax
mov esi, dword [ebp - 0xc0]
mov edi, dword [ebp - 0x590]
push dword [ebp - 0x78]
lea ecx, [ebp - 0x4c4]
call fcn.10013b14
add edi, dword [eax]
cmp edi, esi
jg 0x100216dc
mov dword [ebp - 0x8b0], 1
jmp 0x100216e3
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0xc0]
imul eax, dword [ebp - 0x8b0]
cmp eax, 0xfffffffb
jne 0x10021701
mov dword [ebp - 0x598], 1
jmp 0x10021708
and dword [ebp - 0x598], 0
push dword [ebp - 0x78]
lea ecx, [ebp - 0x4c4]
call fcn.10013b14
mov ecx, dword [ebp - 0x598]
imul ecx, dword [eax]
test ecx, ecx
jne 0x1002173f
push dword [ebp - 0x78]
lea ecx, [ebp - 0x4c4]
call fcn.10013b14
cmp dword [eax], 0
jne 0x1002173f
and dword [ebp - 0xa40], 0
jmp 0x10021749
mov dword [ebp - 0xa40], 1
mov eax, dword [ebp - 0x5b8]
cmp dword [ebp - 0xa40], eax
jge 0x10021763
mov dword [ebp - 0xe08], 1
jmp 0x1002176a
and dword [ebp - 0xe08], 0
mov eax, 0xb8e00457
cmp eax, 0x71e9942
je 0x10021782
mov dword [ebp - 0x5a0], 1
jmp 0x10021789
and dword [ebp - 0x5a0], 0
push 3
lea ecx, [ebp - 0x4c4]
call fcn.10013b14
mov ecx, dword [ebp - 0x5a0]
cmp ecx, dword [eax]
jg 0x100217ac
mov dword [ebp - 0x8b8], 1
jmp 0x100217b3
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0xc0]
add eax, dword [ebp - 0x8b8]
je 0x100217cd
mov dword [ebp - 0x5a8], 1
jmp 0x100217d4
and dword [ebp - 0x5a8], 0
cmp dword [ebp - 0x5a8], 0xf846
jle 0x100217ec
mov dword [ebp - 0xb08], 1
jmp 0x100217f3
and dword [ebp - 0xb08], 0
mov eax, dword [ebp - 0xc18]
cmp dword [ebp - 0xb08], eax
jge 0x1002181f
cmp dword [ebp - 0xc0], 0
je 0x1002181f
mov eax, 0x325c
test eax, eax
je 0x1002181f
mov dword [ebp - 0x5b0], 1
jmp 0x10021826
and dword [ebp - 0x5b0], 0
cmp dword [ebp - 0x5b0], 0x62c80f3b
je 0x10021847
cmp dword [ebp - 0xc0], 0
je 0x10021847
mov dword [ebp - 0x8c0], 1
jmp 0x1002184e
and dword [ebp - 0x8c0], 0
imul eax, dword [ebp - 0x8c0], 0x2337
cmp eax, dword [ebp - 0x5b8]
jge 0x1002186c
mov dword [ebp - 0xa48], 1
jmp 0x10021873
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0xa48]
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x5c0], 0
je 0x100218a1
xor eax, eax
je 0x100218a1
mov eax, 0x1580eb60
test eax, eax
je 0x100218a1
mov dword [ebp - 0x8c8], 1
jmp 0x100218a8
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x8c8]
mov dword [ebp - 0xc8c], eax
push dword [ebp - 0x78]
lea ecx, [ebp - 0x4c4]
call fcn.10013b14
cmp dword [eax], 0
je 0x100218cc
jmp 0x1002162c
jmp 0x1002162c
mov byte [ebp - 0x191], 0
movzx eax, byte [ebp - 0x191]
test eax, eax
je 0x100218eb
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x10021605
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c4]
call fcn.10013af8
mov dword [ebp - 0xdd8], 0x3d37
lea eax, [ebp - 0xdd8]
push eax
call fcn.1001ca2e
pop ecx
mov dword [ebp - 0x808], eax
mov dword [ebp - 0x11e8], 4
mov byte [ebp - 0x165], 0
movzx eax, byte [ebp - 0x165]
test eax, eax
je 0x10021944
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov byte [ebp - 0x193], 0
movzx eax, byte [ebp - 0x193]
test eax, eax
je 0x1002196d
push 0xbf2
push 0
push 0x862
push 0x13e4
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov dword [ebp - 0x30], 0xff23b1a9
mov dword [ebp - 0x8e0], 4
mov dword [ebp - 0x8d0], 0xab4d
mov dword [ebp - 0x70], 0xffffffff
mov dword [ebp - 0xb74], 0xfffffff8
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jle 0x100219ad
mov dword [ebp - 0x5f0], 1
jmp 0x100219b4
and dword [ebp - 0x5f0], 0
cmp dword [ebp - 0x30], 0
je 0x100219c6
mov dword [ebp - 0x5c8], 1
jmp 0x100219cd
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x5c8], eax
jl 0x100219e4
mov dword [ebp - 0xbbc], 1
jmp 0x100219eb
and dword [ebp - 0xbbc], 0
mov eax, dword [ebp - 0xbbc]
sub eax, dword [ebp - 0x30]
cmp eax, 0xffffffff
jl 0x10021a05
mov dword [ebp - 0x5d0], 1
jmp 0x10021a0c
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x5d0]
mov dword [ebp - 0x8d0], eax
mov eax, dword [ebp - 0x8d0]
cmp eax, dword [ebp - 0x30]
jge 0x10021a2f
mov dword [ebp - 0x5d8], 1
jmp 0x10021a36
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x5d8]
neg eax
neg eax
cmp eax, 0x5835
jg 0x10021a53
mov dword [ebp - 0xa50], 1
jmp 0x10021a5a
and dword [ebp - 0xa50], 0
mov eax, dword [ebp - 0xa50]
sub eax, dword [ebp - 0x30]
cmp eax, 1
jl 0x10021a74
mov dword [ebp - 0x5e0], 1
jmp 0x10021a7b
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x5e0]
sub eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x10021a95
mov dword [ebp - 0x8d8], 1
jmp 0x10021a9c
and dword [ebp - 0x8d8], 0
cmp dword [ebp - 0x8d8], 0
jle 0x10021aa9
cmp dword [ebp - 0x70], 0
push 9
pop eax
cmp eax, 0xb13
jbe 0x10021abf
mov dword [ebp - 0x5e8], 1
jmp 0x10021ac6
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x5e8]
sub eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x10021ae0
mov dword [ebp - 0xb10], 1
jmp 0x10021ae7
and dword [ebp - 0xb10], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xb10], eax
jg 0x10021afe
mov dword [ebp - 0x5f8], 1
jmp 0x10021b05
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x8e0], eax
mov eax, dword [ebp - 0x8e0]
cmp eax, dword [ebp - 0x5f8]
jle 0x10021b2b
mov dword [ebp - 0xa58], 1
jmp 0x10021b32
and dword [ebp - 0xa58], 0
cmp dword [ebp - 0xa58], 1
jne 0x10021b47
mov dword [ebp - 0x600], 1
jmp 0x10021b4e
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x70]
imul eax, dword [ebp - 0x600]
imul eax, eax, 0x7056
cmp eax, dword [ebp - 0x70]
je 0x10021b75
cmp dword [ebp - 0x70], 0
je 0x10021b75
mov dword [ebp - 0x8e8], 1
jmp 0x10021b7c
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x8e8]
add eax, 0x7348
cmp dword [ebp - 0x30], eax
je 0x10021b9b
cmp dword [ebp - 0x70], 0
jne 0x10021b9b
and dword [ebp - 0x608], 0
jmp 0x10021ba5
mov dword [ebp - 0x608], 1
mov eax, dword [ebp - 0x70]
add eax, dword [ebp - 0x608]
cmp eax, dword [ebp - 0x70]
jl 0x10021bbf
mov dword [ebp - 0xc20], 1
jmp 0x10021bc6
and dword [ebp - 0xc20], 0
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0x11f0], eax
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x70], 0
jmp 0x10021beb
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x10021c3a
mov dword [ebp - 0x2c4], 0
jmp 0x10021c0a
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 1
jge 0x10021c26
mov eax, dword [ebp - 0x2c4]
mov dword [ebp + eax*4 - 0xef0], 0
jmp 0x10021bfd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xef0], 0
je 0x10021c38
jmp 0x10021c3a
jmp 0x10021be4
and dword [ebp - 0x1050], 0
and dword [ebp - 0x104c], 0
and dword [ebp - 0x1048], 0
and dword [ebp - 0x1044], 0
lea ecx, [ebp - 0x475]
call fcn.100145b6
push eax
lea eax, [ebp - 0x1040]
push eax
lea eax, [ebp - 0x1050]
push eax
lea ecx, [ebp - 0x1558]
call fcn.1002c975
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xbe4]
call fcn.1002c94f
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x8c], 0x9fa85f88
mov dword [ebp - 0x3c], 0x324015fb
push 0
lea ecx, [ebp - 0xbe4]
call fcn.10013b14
and dword [eax], 0
jmp 0x10021cd9
push 0
lea ecx, [ebp - 0xbe4]
call fcn.10013b14
mov dword [ebp - 0x610], eax
mov eax, dword [ebp - 0x610]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x610]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xbe4]
call fcn.10013b14
cmp dword [eax], 0xfffffffe
jne 0x1002208e
mov dword [ebp - 0x8f8], 0xfffffff9
mov dword [ebp - 0x630], 0xffffffff
mov dword [ebp - 0x11f8], 0xc3cc8c9f
mov dword [ebp - 0xbb4], 0x960698b4
mov dword [ebp - 0x3b4], 0
jmp 0x10021d30
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 3
jge 0x10021d4c
mov eax, dword [ebp - 0x3b4]
mov dword [ebp + eax*4 - 0xbd8], 0xcce35a12
jmp 0x10021d23
push 0
lea ecx, [ebp - 0xbe4]
call fcn.10013b14
cmp dword [eax], 0
je 0x10022034
mov dword [ebp - 0x94], 0x34172034
cmp dword [ebp - 0x8f8], 0xffffffff
jle 0x10021ea5
push 2
lea ecx, [ebp - 0xbe4]
call fcn.10013b14
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
je 0x10021da0
cmp dword [ebp - 0x94], 0
jne 0x10021dbb
push 1
lea ecx, [ebp - 0xbe4]
call fcn.10013b14
cmp dword [eax], 0
jne 0x10021dbb
and dword [ebp - 0x8f0], 0
jmp 0x10021dc5
mov dword [ebp - 0x8f0], 1
mov eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x8f0]
cmp eax, 0xfffffff8
jg 0x10021de2
mov dword [ebp - 0x618], 1
jmp 0x10021de9
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x618], eax
jle 0x10021e03
mov dword [ebp - 0xa60], 1
jmp 0x10021e0a
and dword [ebp - 0xa60], 0
cmp dword [ebp - 0xa60], 0xffffffff
jg 0x10021e1f
mov dword [ebp - 0x620], 1
jmp 0x10021e26
and dword [ebp - 0x620], 0
imul eax, dword [ebp - 0x620], 0x26c7
imul eax, dword [ebp - 0x94]
imul eax, dword [ebp - 0x8f8]
test eax, eax
jne 0x10021e54
cmp dword [ebp - 0x94], 0
jne 0x10021e54
and dword [ebp - 0x628], 0
jmp 0x10021e5e
mov dword [ebp - 0x628], 1
cmp dword [ebp - 0x628], 0xffffffff
je 0x10021e73
mov dword [ebp - 0xb18], 1
jmp 0x10021e7a
and dword [ebp - 0xb18], 0
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
dec eax
je 0x10021ea5
xor eax, eax
je 0x10021ea5
mov dword [ebp - 0x900], 1
jmp 0x10021eac
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x8c], 0
jmp 0x10021ed1
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jg 0x10022032
mov dword [ebp - 0x3c], 2
jmp 0x10021eee
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x10021f08
mov eax, dword [ebp - 0x8c]
cmp dword [ebp + eax*4 - 0xbd8], 0
je 0x10021f06
jmp 0x10021f08
jmp 0x10021ee7
cmp dword [ebp - 0x94], 0
jne 0x10021fa1
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp + eax*4 - 0xbd8]
mov dword [ebp - 0x1200], eax
mov eax, dword [ebp - 0x8c]
imul eax, dword [ebp + eax*4 - 0xbd8], 0xfce9
push 4
pop ecx
imul ecx, ecx, 0
cmp dword [ebp + ecx - 0xbd8], eax
jge 0x10021f54
mov dword [ebp - 0x638], 1
jmp 0x10021f5b
and dword [ebp - 0x638], 0
cmp dword [ebp - 0x638], 0x8a13c444
je 0x10021f7c
cmp dword [ebp - 0x94], 0
je 0x10021f7c
mov dword [ebp - 0xc28], 1
jmp 0x10021f83
and dword [ebp - 0xc28], 0
xor eax, eax
inc eax
jne 0x10021fa1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbd8], 0
jne 0x10021fa1
and dword [ebp - 0xa68], 0
jmp 0x10021fab
mov dword [ebp - 0xa68], 1
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp + eax*4 - 0xbd8]
cmp eax, dword [ebp - 0xa68]
jl 0x10021fcc
mov dword [ebp - 0x640], 1
jmp 0x10021fd3
and dword [ebp - 0x640], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbd8]
cmp dword [ebp - 0x640], eax
jne 0x10021ff3
mov dword [ebp - 0x908], 1
jmp 0x10021ffa
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x908], eax
je 0x10022014
mov dword [ebp - 0x648], 1
jmp 0x1002201b
and dword [ebp - 0x648], 0
imul eax, dword [ebp - 0x648], 0xffffffff
sub eax, 0xbbb5
mov dword [ebp - 0x94], eax
jmp 0x10021ec4
jmp 0x10022059
mov dword [ebp - 0x3c], 2
jmp 0x10022044
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x10022059
mov eax, dword [ebp - 0xbb4]
dec eax
mov dword [ebp - 0xbb4], eax
jmp 0x1002203d
mov dword [ebp - 0x3c], 0
jmp 0x10022069
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x10022089
mov byte [ebp - 0x16d], 0
movzx eax, byte [ebp - 0x16d]
test eax, eax
je 0x10022087
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
jmp 0x10022062
jmp 0x10021cb5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbe4]
call fcn.10013af8
mov byte [ebp - 0x26c], 5
mov byte [ebp - 0x26b], 0x93
mov byte [ebp - 0x26a], 3
mov byte [ebp - 0x269], 0x24
mov byte [ebp - 0x268], 0
mov byte [ebp - 0x267], 0x11
mov byte [ebp - 0x266], 7
mov byte [ebp - 0x265], 0x2e
mov byte [ebp - 0x264], 4
mov byte [ebp - 0x263], 0xc
mov byte [ebp - 0x262], 1
mov byte [ebp - 0x261], 0
mov byte [ebp - 0x260], 1
mov byte [ebp - 0x25f], 0x17
mov byte [ebp - 0x25e], 0xc
mov byte [ebp - 0x25d], 0x32
mov byte [ebp - 0x25c], 0xb
mov byte [ebp - 0x25b], 0x2f
mov byte [ebp - 0x25a], 8
mov byte [ebp - 0x259], 0x17
mov byte [ebp - 0x258], 9
mov byte [ebp - 0x257], 1
mov byte [ebp - 0x256], 0xa
mov byte [ebp - 0x255], 0x2b
mov byte [ebp - 0x254], 2
mov byte [ebp - 0x253], 0x31
mov byte [ebp - 0x252], 6
mov byte [ebp - 0x251], 7
mov dword [ebp - 0x1208], 0x61f9c28a
mov dword [ebp - 0x1210], 0x9be1d925
mov dword [ebp - 0x1218], 1
mov dword [ebp - 0x1220], 0x4e6d4f28
mov dword [ebp - 0x1228], 0
mov dword [ebp - 0x1230], 0
mov dword [ebp - 0x1238], 4
mov dword [ebp - 0x1240], 0xfe30f587
mov dword [ebp - 0x1248], 0x412df3d3
push 1
lea ecx, [ebp - 0x1358]
call fcn.10013a9c
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xa8], 0
jmp 0x100221e8
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
jge 0x1002220a
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x1358]
call fcn.10013b14
mov dword [eax], 0x8cf4c59c
jmp 0x100221db
mov dword [ebp - 0xa8], 0
jmp 0x10022223
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
jge 0x1002223f
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x650], 0x66e9
jmp 0x10022216
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x650]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x650], eax
mov byte [ebp - 0x195], 0
movzx eax, byte [ebp - 0x195]
test eax, eax
je 0x10022278
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1358]
call fcn.10013af8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x26c]
and eax, 0xe1
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x26c]
or ecx, 0xe1
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x26c]
mov byte [ebp + eax - 0xf08], cl
mov dword [ebp - 0x4c], 2
and dword [ebp - 0x3bc], 0
jmp 0x100222dd
mov eax, dword [ebp - 0x4c]
inc eax
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x1c
jae 0x10023109
mov dword [ebp - 0x14], 0xb7c7ce53
mov dword [ebp - 0x134], 1
mov dword [ebp - 0xc38], 8
mov dword [ebp - 0x2cc], 0
jmp 0x1002231b
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 3
jge 0x10022337
mov eax, dword [ebp - 0x2cc]
mov dword [ebp + eax*4 - 0x1e4], 0xffffffff
jmp 0x1002230e
mov dword [ebp - 0x14], 2
jmp 0x10022347
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x10022677
mov dword [ebp - 0x36c], 0
jmp 0x1002236a
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 1
jge 0x10022386
mov eax, dword [ebp - 0x36c]
mov dword [ebp + eax*4 - 0xde0], 0x643747c9
jmp 0x1002235d
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1e4]
mov dword [ebp - 0x1250], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x1e4], 0x17f4
jl 0x100223b2
mov dword [ebp - 0x910], 1
jmp 0x100223b9
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x910], eax
jge 0x100223d0
mov dword [ebp - 0x658], 1
jmp 0x100223d7
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1e4]
cmp dword [ebp - 0x658], eax
jne 0x100223f5
mov dword [ebp - 0xa70], 1
jmp 0x100223fc
and dword [ebp - 0xa70], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xa70]
add ecx, 0x653b
cmp ecx, dword [ebp + eax*4 - 0x1e4]
jle 0x10022420
mov dword [ebp - 0x660], 1
jmp 0x10022427
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x660]
sub eax, dword [ebp - 0x14]
jne 0x1002244d
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1e4], 0
je 0x1002244d
mov dword [ebp - 0x918], 1
jmp 0x10022454
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x134], eax
xor eax, eax
inc eax
neg eax
jne 0x10022472
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x1e4], 0
xor eax, eax
cmp eax, 0x6193fe69
je 0x10022487
mov dword [ebp - 0x668], 1
jmp 0x1002248e
and dword [ebp - 0x668], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e4]
imul eax, dword [ebp - 0x668]
mov ecx, dword [ebp - 0x14]
cmp dword [ebp + ecx*4 - 0x1e4], eax
jl 0x100224ba
mov dword [ebp - 0xb20], 1
jmp 0x100224c1
and dword [ebp - 0xb20], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0xb20]
cmp ecx, dword [ebp + eax - 0x1e4]
je 0x100224e4
mov dword [ebp - 0x670], 1
jmp 0x100224eb
and dword [ebp - 0x670], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e4]
cmp dword [ebp - 0x670], eax
jg 0x1002250b
mov dword [ebp - 0x920], 1
jmp 0x10022512
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1e4]
cmp dword [ebp - 0x920], eax
jne 0x10022530
mov dword [ebp - 0x678], 1
jmp 0x10022537
and dword [ebp - 0x678], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x678]
sub edx, dword [ebp + ecx - 0x1e4]
cmp edx, dword [ebp + eax - 0x1e4]
jle 0x10022565
mov dword [ebp - 0xa78], 1
jmp 0x1002256c
and dword [ebp - 0xa78], 0
cmp dword [ebp - 0xa78], 0
jg 0x10022581
mov dword [ebp - 0x680], 1
jmp 0x10022588
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1e4]
cmp dword [ebp - 0x680], eax
jl 0x100225a6
mov dword [ebp - 0x928], 1
jmp 0x100225ad
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1e4]
cmp dword [ebp - 0x928], eax
je 0x100225cb
mov dword [ebp - 0x688], 1
jmp 0x100225d2
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x1e4]
cmp dword [ebp - 0x688], eax
je 0x100225f0
mov dword [ebp - 0xb7c], 1
jmp 0x100225f7
and dword [ebp - 0xb7c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb7c]
mov dword [ebp + eax - 0xde0], ecx
mov dword [ebp - 0x134], 2
jmp 0x10022623
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jl 0x10022672
mov byte [ebp - 0x175], 0
movzx eax, byte [ebp - 0x175]
test eax, eax
je 0x1002264a
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_CopySid]
mov byte [ebp - 0x197], 0
movzx eax, byte [ebp - 0x197]
test eax, eax
je 0x10022670
push 0
push 0x1ba1
push 6
push 0xb22
call dword [sym.imp.USER32.dll_SetScrollPos]
jmp 0x10022616
jmp 0x10022340
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1e4], 0
je 0x100227d1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1258], eax
mov eax, 0x64db
sub eax, dword [ebp - 0x14]
cmp eax, 0x5c8a2db
je 0x100226af
mov dword [ebp - 0x690], 1
jmp 0x100226b6
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x690], eax
jne 0x100226d0
mov dword [ebp - 0x930], 1
jmp 0x100226d7
and dword [ebp - 0x930], 0
cmp dword [ebp - 0x930], 2
jle 0x100226ec
mov dword [ebp - 0x698], 1
jmp 0x100226f3
and dword [ebp - 0x698], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e4]
cmp dword [ebp - 0x698], eax
jg 0x10022714
mov dword [ebp - 0xc30], 1
jmp 0x1002271b
and dword [ebp - 0xc30], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x134]
cmp ecx, dword [ebp + eax - 0x1e4]
jl 0x1002273c
mov dword [ebp - 0xa80], 1
jmp 0x10022743
and dword [ebp - 0xa80], 0
cmp dword [ebp - 0xa80], 0xf6f6
jge 0x1002275b
mov dword [ebp - 0xe90], 1
jmp 0x10022762
and dword [ebp - 0xe90], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1260], eax
mov eax, 0x7974d377
cmp eax, 0x8266c095
jb 0x10022783
mov dword [ebp - 0x6a0], 1
jmp 0x1002278a
and dword [ebp - 0x6a0], 0
cmp dword [ebp - 0x6a0], 0
je 0x1002279f
mov dword [ebp - 0x938], 1
jmp 0x100227a6
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x938], eax
jge 0x100227bd
mov dword [ebp - 0x6a8], 1
jmp 0x100227c4
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x6a8]
shl eax, 3
test eax, eax
jne 0x100227e9
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1e4], 0
jne 0x100227e9
and dword [ebp - 0xb28], 0
jmp 0x100227f3
mov dword [ebp - 0xb28], 1
mov eax, dword [ebp - 0xb28]
mov dword [ebp - 0xc38], eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x26c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x4c], eax
jne 0x10022ad7
mov eax, dword [ebp - 0x4c]
movzx eax, byte [ebp + eax - 0x26c]
inc eax
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 0x204], 0xfffffffc
mov dword [ebp - 0x6b8], 0xffffffff
mov dword [ebp - 0xde8], 0xffffffff
mov dword [ebp - 0xc40], 0xfdbd
mov dword [ebp - 0x49c], 0xfffffffc
mov dword [ebp - 0x13c], 0xffffffff
mov dword [ebp - 0xdf0], 1
mov dword [ebp - 0xc50], 7
push 2
lea ecx, [ebp - 0x10d4]
call fcn.10013a9c
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x2d4], 0
jmp 0x100228a9
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 2
jge 0x100228c8
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0x10d4]
call fcn.10013b14
and dword [eax], 0
jmp 0x1002289c
mov eax, dword [ebp - 0x204]
cmp eax, dword [ebp - 0x6b8]
jl 0x100228e2
mov dword [ebp - 0x6b0], 1
jmp 0x100228e9
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0xde8]
cmp dword [ebp - 0x6b0], eax
jl 0x10022903
mov dword [ebp - 0x6c8], 1
jmp 0x1002290a
and dword [ebp - 0x6c8], 0
cmp dword [ebp - 0xc40], 0x38d9
je 0x10022922
mov dword [ebp - 0x940], 1
jmp 0x10022929
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x940], eax
jne 0x10022943
mov dword [ebp - 0xa88], 1
jmp 0x1002294a
and dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0x6b8]
cmp dword [ebp - 0xa88], eax
jl 0x10022964
mov dword [ebp - 0xec8], 1
jmp 0x1002296b
and dword [ebp - 0xec8], 0
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x1268], eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0x51cf
jne 0x1002299b
mov dword [ebp - 0x6c0], 1
jmp 0x100229a2
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x13c]
add eax, dword [ebp - 0x6c0]
cmp eax, dword [ebp - 0x204]
jle 0x100229c2
mov dword [ebp - 0x948], 1
jmp 0x100229c9
and dword [ebp - 0x948], 0
cmp dword [ebp - 0x948], 1
jg 0x100229de
mov dword [ebp - 0xc48], 1
jmp 0x100229e5
and dword [ebp - 0xc48], 0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x1270], eax
mov eax, dword [ebp - 0xdf0]
cmp dword [ebp - 0x6c8], eax
jg 0x10022a0b
mov dword [ebp - 0xbc4], 1
jmp 0x10022a12
and dword [ebp - 0xbc4], 0
mov eax, dword [ebp - 0xbc4]
mov dword [ebp - 0xc50], eax
mov dword [ebp - 0x13c], 0
jmp 0x10022a37
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 1
jg 0x10022aae
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x10d4]
call fcn.10013b14
cmp dword [eax], 0xffff
jne 0x10022a65
mov dword [ebp - 0x6d0], 1
jmp 0x10022a6c
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x49c], eax
mov byte [ebp - 0x17d], 0
movzx eax, byte [ebp - 0x17d]
test eax, eax
je 0x10022aa9
push 0x156a
push 0x10cc
push 0x20fb
push 0x1362
push 0x236c
call dword [sym.imp.GDI32.dll_IntersectClipRect]
jmp 0x10022a2a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10d4]
call fcn.10013af8
mov eax, dword [ebp - 0x4c]
movzx eax, byte [ebp + eax - 0x26c]
mov ecx, dword [ebp - 0x4c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x4c], eax
jmp 0x100222d5
mov dword [ebp - 0x48], 0xfffffff6
mov dword [ebp - 0x20c], 9
mov dword [ebp - 0x3dc], 0
jmp 0x10022b01
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 2
jge 0x10022b1d
mov eax, dword [ebp - 0x3dc]
mov dword [ebp + eax*4 - 0xcc8], 0xd29640
jmp 0x10022af4
mov dword [ebp - 0x48], 0
jmp 0x10022b2d
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jl 0x10022b7a
mov dword [ebp - 0xea0], 0x638ecf54
cmp dword [ebp - 0xea0], 0
je 0x10022b48
jmp 0x10022b7a
mov byte [ebp - 0x199], 0
movzx eax, byte [ebp - 0x199]
test eax, eax
je 0x10022b78
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x10022b26
mov dword [ebp - 0x48], 0
jmp 0x10022b8a
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xffffffec
jg 0x1002309d
mov dword [ebp - 0x1c8], 0x331c
mov dword [ebp - 0x88], 0xc84b7b83
cmp dword [ebp - 0x48], 0
je 0x10022c5a
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1278], eax
cmp dword [ebp - 0x1c8], 0x7c7a
jg 0x10022bd3
mov dword [ebp - 0xc58], 1
jmp 0x10022bda
and dword [ebp - 0xc58], 0
mov eax, 0x68f928d9
test eax, eax
je 0x10022bf8
mov eax, 0x61fc42ff
test eax, eax
je 0x10022bf8
mov dword [ebp - 0x950], 1
jmp 0x10022bff
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x950], eax
jge 0x10022c16
mov dword [ebp - 0x6d8], 1
jmp 0x10022c1d
and dword [ebp - 0x6d8], 0
cmp dword [ebp - 0x6d8], 0
je 0x10022c39
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x10022c39
mov dword [ebp - 0xa90], 1
jmp 0x10022c40
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0xa90], eax
jne 0x10022c5a
mov dword [ebp - 0xdf8], 1
jmp 0x10022c61
and dword [ebp - 0xdf8], 0
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x1280], eax
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x20c]
je 0x10022c84
mov dword [ebp - 0x6e0], 1
jmp 0x10022c8b
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x6e0], eax
jg 0x10022ca5
mov dword [ebp - 0x958], 1
jmp 0x10022cac
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x48]
je 0x10022ccf
mov dword [ebp - 0x6e8], 1
jmp 0x10022cd6
and dword [ebp - 0x6e8], 0
cmp dword [ebp - 0x6e8], 0xffffffff
jg 0x10022ceb
mov dword [ebp - 0xb30], 1
jmp 0x10022cf2
and dword [ebp - 0xb30], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0xb30]
jne 0x10022d09
mov dword [ebp - 0x6f0], 1
jmp 0x10022d10
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x20c]
add eax, dword [ebp - 0x6f0]
je 0x10023070
mov dword [ebp - 0x144], 0xb1bb30b1
mov dword [ebp - 0xeb0], 0x4d86
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x1288], eax
imul eax, dword [ebp - 0x20c], 0xfffb
cmp eax, 0x4b79
jle 0x10022d65
cmp dword [ebp - 0x20c], 0
jne 0x10022d65
and dword [ebp - 0x960], 0
jmp 0x10022d6f
mov dword [ebp - 0x960], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xcc8]
cmp dword [ebp - 0x960], eax
jle 0x10022d90
mov dword [ebp - 0x6f8], 1
jmp 0x10022d97
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x144]
sub eax, dword [ebp - 0x6f8]
imul eax, eax, 0x90f6
cmp eax, 0xfffffffb
jne 0x10022dba
mov dword [ebp - 0xc60], 1
jmp 0x10022dc1
and dword [ebp - 0xc60], 0
mov dword [ebp - 0x88], 2
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x1290], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x1298], eax
mov dword [ebp - 0x144], 0
mov dword [ebp - 0xb84], 0x1f74
mov dword [ebp - 0xc78], 0x10007dec
cmp dword [ebp - 0xb84], 0x21d6
jle 0x10022efb
push 0xd7d
call dword [sym.imp.USER32.dll_GetParent]
and dword [ebp - 0x2dc], 0
jmp 0x10022e32
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0x1e77
jge 0x10022ef3
and dword [ebp - 0x374], 0
jmp 0x10022e58
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0x43c4
jge 0x10022eee
and dword [ebp - 0x2e4], 0
jmp 0x10022e7e
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0x616f
jge 0x10022ee9
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [ebp - 0x374]
sar eax, cl
xor eax, dword [ebp - 0x2e4]
cdq
mov dword [ebp - 0xcbc], eax
mov dword [ebp - 0xcb8], edx
push dword [ebp - 0xcb8]
push dword [ebp - 0xcbc]
lea ecx, [ebp - 0x15e0]
call fcn.1000a92e
pop ecx
pop ecx
mov dword [ebp - 0xec4], eax
mov ecx, dword [ebp - 0xec4]
call fcn.10013755
push eax
call fcn.10049db3
pop ecx
lea ecx, [ebp - 0x15e0]
call fcn.1001374b
jmp 0x10022e71
jmp 0x10022e4b
jmp 0x10022e25
push 0
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
imul eax, dword [ebp - 0x144], 0xa6f
test eax, eax
je 0x10022f1e
cmp dword [ebp - 0x20c], 0
je 0x10022f1e
mov dword [ebp - 0xc68], 1
jmp 0x10022f25
and dword [ebp - 0xc68], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x12a0], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x12a8], eax
mov eax, dword [ebp - 0x88]
dec eax
cmp eax, 1
jb 0x10022f55
mov dword [ebp - 0xa98], 1
jmp 0x10022f5c
and dword [ebp - 0xa98], 0
cmp dword [ebp - 0xa98], 1
jb 0x10022f71
mov dword [ebp - 0xe00], 1
jmp 0x10022f78
and dword [ebp - 0xe00], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xcc8]
mov dword [ebp - 0x12b0], eax
mov eax, dword [ebp - 0x1c8]
cmp eax, dword [ebp - 0x88]
jl 0x10022fa5
mov dword [ebp - 0x700], 1
jmp 0x10022fac
and dword [ebp - 0x700], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x88]
imul ecx, dword [ebp - 0x700]
cmp ecx, dword [ebp + eax - 0xcc8]
jl 0x10022fd4
mov dword [ebp - 0x968], 1
jmp 0x10022fdb
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x968], eax
jne 0x10022ff5
mov dword [ebp - 0x708], 1
jmp 0x10022ffc
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x708], eax
jle 0x10023016
mov dword [ebp - 0xc70], 1
jmp 0x1002301d
and dword [ebp - 0xc70], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xeb0], eax
mov dword [ebp - 4], 0x10
cmp dword [ebp - 0xb84], 0x1d0e
jge 0x10023048
push dword [ebp - 0xc78]
call fcn.10049db3
pop ecx
jmp 0x10023064
or dword [ebp - 4], 0xffffffff
jmp 0x1002306e
jmp 0x10023098
cmp dword [ebp - 0x88], 0
je 0x1002307b
jmp 0x1002309d
mov byte [ebp - 0x185], 0
movzx eax, byte [ebp - 0x185]
test eax, eax
je 0x10023098
push 0xcdb
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
jmp 0x10022b83
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x3bc]
movzx eax, byte [ebp + eax - 0x26e]
movsx eax, byte [ebp + eax - 0xf08]
mov ecx, dword [ebp - 0x4c]
movzx ecx, byte [ebp + ecx - 0x26b]
and ecx, eax
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x3bc]
movzx eax, byte [ebp + eax - 0x26e]
movsx eax, byte [ebp + eax - 0xf08]
mov edx, dword [ebp - 0x4c]
movzx edx, byte [ebp + edx - 0x26b]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x4c]
movzx eax, byte [ebp + eax - 0x26c]
mov byte [ebp + eax - 0xf08], dl
and dword [ebp - 0x3bc], 0
jmp 0x100222d5
mov dword [ebp - 0x424], 0x2a0c0e07
mov dword [ebp - 0x728], 0x4067bc62
mov dword [ebp - 0x46c], 1
mov dword [ebp - 0x738], 0x949f0dc4
mov dword [ebp - 0x2ec], 0
jmp 0x1002314a
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 1
jge 0x10023163
mov eax, dword [ebp - 0x2ec]
mov dword [ebp + eax*4 - 0x24], 0x5425
jmp 0x1002313d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 0
je 0x10023320
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 0
je 0x10023301
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
mov dword [ebp - 0x12b8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
mov dword [ebp - 0x12c0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 0x4e94
jle 0x100231c1
mov dword [ebp - 0x710], 1
jmp 0x100231c8
and dword [ebp - 0x710], 0
cmp dword [ebp - 0x710], 9
jne 0x100231dd
mov dword [ebp - 0x970], 1
jmp 0x100231e4
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x970]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x12c8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
mov dword [ebp - 0x12d0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 0x1b07
jg 0x10023235
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 0
je 0x10023235
mov dword [ebp - 0x718], 1
jmp 0x1002323c
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x718]
sub eax, 0x7eb2
cmp eax, 0xd64de8cc
jb 0x1002325a
mov dword [ebp - 0xaa0], 1
jmp 0x10023261
and dword [ebp - 0xaa0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
cmp dword [ebp - 0xaa0], eax
jle 0x1002327f
mov dword [ebp - 0x720], 1
jmp 0x10023286
and dword [ebp - 0x720], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
cmp dword [ebp - 0x720], eax
jne 0x100232a3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 1
jne 0x100232d6
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x100232d6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 0
jne 0x100232d6
cmp dword [ebp - 0x424], 0
jne 0x100232d6
and dword [ebp - 0x978], 0
jmp 0x100232e0
mov dword [ebp - 0x978], 1
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0x728], eax
cmp dword [ebp - 0x728], 0
je 0x10023301
mov dword [ebp - 0xb38], 1
jmp 0x10023308
and dword [ebp - 0xb38], 0
cmp dword [ebp - 0xb38], 0x40a7
je 0x10023320
mov dword [ebp - 0x730], 1
jmp 0x10023327
and dword [ebp - 0x730], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x24]
imul ecx, dword [ebp - 0x730]
sub ecx, dword [ebp + eax - 0x24]
mov dword [ebp - 0x46c], ecx
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x46c]
sub edx, dword [ebp + ecx - 0x24]
imul edx, dword [ebp + eax - 0x24]
test edx, edx
jge 0x10023373
mov dword [ebp - 0x980], 1
jmp 0x1002337a
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0x738], eax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x738], eax
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0xf08], 0
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x104], 1
push 2
lea ecx, [ebp - 0x1368]
call fcn.10013a9c
mov dword [ebp - 4], 0x12
mov dword [ebp - 0xc80], 0xb91e60e7
mov dword [ebp - 0x37c], 0
jmp 0x100233eb
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 2
jge 0x1002340d
push dword [ebp - 0x37c]
lea ecx, [ebp - 0x1368]
call fcn.10013b14
mov dword [eax], 0x81f3403c
jmp 0x100233de
mov eax, 0xa2c7
test eax, eax
je 0x1002344c
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x12d8], eax
mov eax, dword [ebp - 0x104]
add eax, 0xd187
mov ecx, dword [ebp - 0x104]
sub ecx, eax
dec ecx
mov eax, dword [ebp - 0x14c]
add eax, ecx
je 0x1002344c
mov dword [ebp - 0xaa8], 1
jmp 0x10023453
and dword [ebp - 0xaa8], 0
cmp dword [ebp - 0xaa8], 0x425f
jg 0x1002346b
mov dword [ebp - 0x740], 1
jmp 0x10023472
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x740], eax
jg 0x1002348c
mov dword [ebp - 0x988], 1
jmp 0x10023493
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x988], eax
jl 0x100234ad
mov dword [ebp - 0x748], 1
jmp 0x100234b4
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x748], eax
jg 0x10023580
mov dword [ebp - 0x104], 0xffffffe7
jmp 0x100234df
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xc
je 0x1002357e
mov dword [ebp - 0x2f4], 0xfffffffa
mov dword [ebp - 0x14c], 0
jmp 0x1002350f
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0x18
jne 0x10023531
mov dword [ebp - 0xbcc], 1
mov eax, dword [ebp - 0xbcc]
inc eax
mov dword [ebp - 0xbcc], eax
jmp 0x10023502
mov dword [ebp - 0x2f4], 0
jmp 0x1002354a
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 1
jg 0x10023579
mov byte [ebp - 0x19b], 0
movzx eax, byte [ebp - 0x19b]
test eax, eax
je 0x10023577
push 0xe6
push 0xacf
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x1002353d
jmp 0x100234d2
jmp 0x100235be
mov dword [ebp - 0xd30], 0
mov byte [ebp - 0x11a], 0
movzx eax, byte [ebp - 0x11a]
test eax, eax
je 0x100235b2
push 0
push 0
push 0x39b
push 0x166c
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
mov eax, dword [ebp - 0xd30]
mov dword [ebp - 0xc80], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1368]
call fcn.10013af8
lea eax, [ebp - 0xf08]
push eax
lea ecx, [ebp - 0x1658]
call fcn.1002c90d
mov dword [ebp - 0xd34], eax
mov eax, dword [ebp - 0xd34]
mov dword [ebp - 0xc88], eax
mov dword [ebp - 4], 0x13
mov edx, dword [ebp - 0x808]
mov ecx, dword [ebp - 0xc88]
call fcn.10017455
mov dword [0x106098ac], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1658]
call fcn.100139fc
and dword [ebp - 0x3fc], 0
jmp 0x10023633
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 0xe
jae 0x1002364c
mov eax, dword [ebp - 0x3fc]
mov byte [ebp + eax - 0xf08], 0
jmp 0x10023626
mov dword [ebp - 0x12e0], 0x5c96dd1e
mov dword [ebp - 0x12e8], 0xf4a8b108
mov dword [ebp - 0x21c], 0x9ef72d4e
mov dword [ebp - 0x12f0], 0
mov dword [ebp - 0x12f8], 0x2bbef7d6
mov dword [ebp - 0x1300], 1
mov dword [ebp - 0x1308], 2
mov dword [ebp - 0x1310], 0xfffffff8
mov dword [ebp - 0x1318], 0x2a831d26
mov dword [ebp - 0x1320], 0xc285ce96
mov dword [ebp - 0x1328], 0x3c407858
mov dword [ebp - 0x1330], 0x54dbbe5
mov dword [ebp - 0x1184], 2
mov dword [ebp - 0x1180], 2
mov dword [ebp - 0x117c], 2
mov dword [ebp - 0x1178], 2
push 2
lea ecx, [ebp - 0x1378]
call fcn.10013a9c
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x1338], 0xb2c4eb0a
mov dword [ebp - 0x1410], 0xd493
mov dword [ebp - 0x750], 0xb2a93f04
mov dword [ebp - 0xdc], 0
jmp 0x10023737
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 2
jge 0x10023759
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x1378]
call fcn.10013b14
mov dword [eax], 0xfffffff7
jmp 0x1002372a
mov dword [ebp - 0xdc], 0
jmp 0x10023772
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 3
jge 0x1002378e
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0x1604], 0x33c7
jmp 0x10023765
mov eax, dword [ebp - 0x750]
inc eax
mov dword [ebp - 0x750], eax
mov dword [ebp - 0x21c], 0
jmp 0x100237b4
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 4
jge 0x100237d0
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0x1184], 0
jmp 0x100237a7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1378]
call fcn.10013af8
mov dword [ebp - 0x154], 0xffffffff
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x1418], eax
cmp dword [ebp - 0x154], 0
je 0x10023847
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x1420], eax
cmp dword [ebp - 0x154], 0xed1
jg 0x10023822
mov dword [ebp - 0x990], 1
jmp 0x10023829
and dword [ebp - 0x990], 0
cmp dword [ebp - 0x990], 1
jne 0x10023847
cmp dword [ebp - 0x154], 0
je 0x10023847
mov dword [ebp - 0x758], 1
jmp 0x1002384e
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x758], eax
jne 0x10023868
mov dword [ebp - 0xab0], 1
jmp 0x1002386f
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0xab0]
lea eax, [ecx + eax + 3]
test eax, eax
je 0x100238a2
mov byte [ebp - 0x11c], 0
movzx eax, byte [ebp - 0x11c]
test eax, eax
je 0x100238a0
push 0xe66
call dword [sym.imp.GDI32.dll_EndDoc]
jmp 0x100238c2
mov byte [ebp - 0x11e], 0
movzx eax, byte [ebp - 0x11e]
test eax, eax
je 0x100238c2
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov byte [ebp - 0x250], 5
mov byte [ebp - 0x24f], 0xa8
mov byte [ebp - 0x24e], 0xb
mov byte [ebp - 0x24d], 0x16
mov byte [ebp - 0x24c], 3
mov byte [ebp - 0x24b], 0x12
mov byte [ebp - 0x24a], 6
mov byte [ebp - 0x249], 0x31
mov byte [ebp - 0x248], 8
mov byte [ebp - 0x247], 0x3f
mov byte [ebp - 0x246], 0xc
mov byte [ebp - 0x245], 0x1c
mov byte [ebp - 0x244], 4
mov byte [ebp - 0x243], 0x91
mov byte [ebp - 0x242], 0x4f
mov byte [ebp - 0x241], 0x72
mov byte [ebp - 0x240], 0x4c
mov byte [ebp - 0x23f], 1
mov byte [ebp - 0x23e], 1
mov byte [ebp - 0x23d], 0xd
mov byte [ebp - 0x23c], 0x25
mov byte [ebp - 0x23b], 4
mov byte [ebp - 0x23a], 0x23
mov byte [ebp - 0x239], 2
mov byte [ebp - 0x238], 0x11
mov byte [ebp - 0x237], 9
mov byte [ebp - 0x236], 6
mov byte [ebp - 0x235], 0xa
mov byte [ebp - 0x234], 6
mov byte [ebp - 0x233], 7
mov byte [ebp - 0x232], 0x17
mov byte [ebp - 0x231], 0
mov byte [ebp - 0x230], 0x31
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x250]
and eax, 0xcd
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x250]
or ecx, 0xcd
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x250]
mov byte [ebp + eax - 0xc0c], cl
mov dword [ebp - 0xf44], 4
mov dword [ebp - 0xf40], 4
mov dword [ebp - 0xf3c], 4
mov dword [ebp - 0xf38], 4
mov dword [ebp - 0x760], 1
mov dword [ebp - 0x1428], 0x1464f16e
mov dword [ebp - 0xc90], 0xffffffff
mov dword [ebp - 0x1430], 0xfffffff6
mov dword [ebp - 0x1438], 0x53a34c86
push 3
lea ecx, [ebp - 0x1158]
call fcn.10013a9c
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x42c], 0x5a519d81
mov dword [ebp - 0x2fc], 0
jmp 0x10023a78
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 3
jge 0x10023a9a
push dword [ebp - 0x2fc]
lea ecx, [ebp - 0x1158]
call fcn.10013b14
mov dword [eax], 0xed065768
jmp 0x10023a6b
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xf44], 4
jle 0x10023ab5
mov dword [ebp - 0x768], 1
jmp 0x10023abc
and dword [ebp - 0x768], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf44]
mov dword [ebp - 0x1440], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xf44]
mov dword [ebp - 0x760], eax
cmp dword [ebp - 0x760], 0
jne 0x10023afc
mov eax, 0x9d7
test eax, eax
jne 0x10023afc
and dword [ebp - 0x998], 0
jmp 0x10023b06
mov dword [ebp - 0x998], 1
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x42c]
cmp eax, dword [ebp - 0x998]
jne 0x10023b2d
mov dword [ebp - 0xd3c], 1
jmp 0x10023b34
and dword [ebp - 0xd3c], 0
mov esi, dword [ebp - 0x768]
sub esi, dword [ebp - 0xc90]
push 2
lea ecx, [ebp - 0x1158]
call fcn.10013b14
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1158]
call fcn.10013af8
mov dword [ebp - 0x2c], 2
and dword [ebp - 0x1f4], 0
jmp 0x10023b76
mov eax, dword [ebp - 0x2c]
inc eax
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x21
jae 0x100247f2
mov dword [ebp - 0xf54], 0x69f4981
mov dword [ebp - 0xf50], 0x69f4981
mov dword [ebp - 0xf4c], 0x69f4981
mov dword [ebp - 0xf48], 0x69f4981
mov dword [ebp - 0x3c4], 0x34b0b4ef
mov dword [ebp - 0xc98], 0xb37d0226
mov dword [ebp - 0x780], 0x5835
mov dword [ebp - 0x384], 0
jmp 0x10023bdf
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 2
jge 0x10023bfb
mov eax, dword [ebp - 0x384]
mov dword [ebp + eax*4 - 0xb50], 0x2eb9
jmp 0x10023bd2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb50], 0
je 0x10023d38
mov dword [ebp - 0x304], 0
jmp 0x10023c28
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 1
jge 0x10023c44
mov eax, dword [ebp - 0x304]
mov dword [ebp + eax*4 - 0xd44], 1
jmp 0x10023c1b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb50], 0
jne 0x10023c60
mov dword [ebp - 0x770], 1
jmp 0x10023c67
and dword [ebp - 0x770], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb50]
mov dword [ebp - 0x1448], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd44], 0
jge 0x10023c96
mov dword [ebp - 0xb40], 1
jmp 0x10023c9d
and dword [ebp - 0xb40], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb50]
cmp eax, dword [ebp - 0xb40]
jge 0x10023cbe
mov dword [ebp - 0x9a0], 1
jmp 0x10023cc5
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x770]
cmp eax, dword [ebp - 0x9a0]
je 0x10023cdf
mov dword [ebp - 0x4a4], 1
jmp 0x10023ce6
and dword [ebp - 0x4a4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4a4]
mov dword [ebp + eax - 0xf54], ecx
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x3c4], eax
mov byte [ebp - 0x120], 0
movzx eax, byte [ebp - 0x120]
test eax, eax
je 0x10023d33
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
jmp 0x10023ede
mov dword [ebp - 0x15c], 1
mov dword [ebp - 0xd54], 0x895c4b79
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0x1450], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x1458], eax
mov eax, dword [ebp - 0x15c]
cmp eax, dword [ebp - 0x780]
jge 0x10023d7e
mov dword [ebp - 0x778], 1
jmp 0x10023d85
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x3c4]
cmp dword [ebp - 0x778], eax
jle 0x10023da5
cmp dword [ebp - 0x3c4], 0
jne 0x10023da5
and dword [ebp - 0xab8], 0
jmp 0x10023daf
mov dword [ebp - 0xab8], 1
mov eax, dword [ebp - 0xab8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
cmp dword [ebp + ecx - 0xb50], eax
jl 0x10023dd1
mov dword [ebp - 0xd4c], 1
jmp 0x10023dd8
and dword [ebp - 0xd4c], 0
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x1460], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x1488], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x1490], eax
cmp dword [ebp - 0x780], 0xffffffff
jle 0x10023e11
mov dword [ebp - 0x9a8], 1
jmp 0x10023e18
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x9a8], eax
jl 0x10023e32
mov dword [ebp - 0x788], 1
jmp 0x10023e39
and dword [ebp - 0x788], 0
cmp dword [ebp - 0x788], 0xffffffff
jl 0x10023e4e
mov dword [ebp - 0xb8c], 1
jmp 0x10023e55
and dword [ebp - 0xb8c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf54]
cmp dword [ebp - 0xb8c], eax
jl 0x10023e76
mov dword [ebp - 0xca0], 1
jmp 0x10023e7d
and dword [ebp - 0xca0], 0
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x1498], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf54]
cmp eax, dword [ebp - 0x15c]
jle 0x10023eaa
mov dword [ebp - 0x790], 1
jmp 0x10023eb1
and dword [ebp - 0x790], 0
cmp dword [ebp - 0x790], 0x81f6
jne 0x10023ec9
mov dword [ebp - 0x9b0], 1
jmp 0x10023ed0
and dword [ebp - 0x9b0], 0
xor eax, eax
sub eax, dword [ebp - 0x9b0]
mov dword [ebp - 0xd54], eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x250]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x2c], eax
jne 0x10024127
mov dword [ebp - 0x1b0], 0x48bbca63
mov byte [ebp - 0x12d], 0
mov dword [ebp - 0x798], 0x6592
mov dword [ebp - 0xd5c], 0x10007e68
cmp dword [ebp - 0x798], 0x6739
jle 0x10024007
and dword [ebp - 0x30c], 0
jmp 0x10023f44
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0x19b6
jge 0x10024007
and dword [ebp - 0x38c], 0
jmp 0x10023f6a
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0x7385
jge 0x10024002
and dword [ebp - 0x314], 0
jmp 0x10023f90
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0x1f3f
jge 0x10023ffd
mov eax, dword [ebp - 0x30c]
cdq
idiv dword [ebp - 0x38c]
imul edx, dword [ebp - 0x314]
mov eax, edx
cdq
mov dword [ebp - 0xcd4], eax
mov dword [ebp - 0xcd0], edx
push dword [ebp - 0xcd0]
push dword [ebp - 0xcd4]
lea ecx, [ebp - 0x1634]
call fcn.1000a92e
pop ecx
pop ecx
mov dword [ebp - 0xca8], eax
mov ecx, dword [ebp - 0xca8]
call fcn.10013755
push eax
call fcn.10049db3
pop ecx
lea ecx, [ebp - 0x1634]
call fcn.1001374b
jmp 0x10023f83
jmp 0x10023f5d
jmp 0x10023f37
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x1002401d
push 0xb96
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [ebp - 4], 0x16
cmp dword [ebp - 0x798], 0x6240
jge 0x1002403c
push dword [ebp - 0xd5c]
call fcn.10049db3
pop ecx
jmp 0x10024058
or dword [ebp - 4], 0xffffffff
jmp 0x10024062
mov dword [ebp - 0x1b0], 0xfffffff6
jmp 0x1002407b
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 3
jne 0x100240fb
mov dword [ebp - 0x3e4], 0
cmp dword [ebp - 0x1b0], 0
je 0x10024099
jmp 0x100240fb
mov dword [ebp - 0x3e4], 0xfffffffc
jmp 0x100240b2
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0xffffffff
jne 0x100240f6
mov dword [ebp - 0x31c], 0xfaaaeb9a
mov dword [ebp - 0x31c], 0
jmp 0x100240de
mov eax, dword [ebp - 0x31c]
dec eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0xffffffe9
je 0x100240f4
cmp dword [ebp - 0x1b0], 0
je 0x100240f2
jmp 0x100240f4
jmp 0x100240d1
jmp 0x100240a5
jmp 0x1002406e
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x250]
inc eax
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x250]
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x2c], eax
jmp 0x10023b6e
mov dword [ebp - 0xb48], 0
mov dword [ebp - 0xcb4], 0xfffffff7
mov dword [ebp - 0x14a0], 0xffffffff
push 2
lea ecx, [ebp - 0x1110]
call fcn.10013a9c
mov dword [ebp - 4], 0x18
mov dword [ebp - 0xd6c], 0x8555145c
mov dword [ebp - 0x7a8], 0xfffffffb
mov dword [ebp - 0x14a8], 0x6e9f0866
mov dword [ebp - 0xccc], 0xf4d4e2
mov dword [ebp - 0x434], 0xe4f2
mov dword [ebp - 0xc8], 0
jmp 0x100241a4
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jge 0x100241c6
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x1110]
call fcn.10013b14
mov dword [eax], 1
jmp 0x10024197
mov dword [ebp - 0xc8], 0
jmp 0x100241df
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x100241fb
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x1664], 0xea0a9f4f
jmp 0x100241d2
mov byte [ebp - 0x122], 0
movzx eax, byte [ebp - 0x122]
test eax, eax
je 0x10024218
push 0x19c
call dword [sym.imp.GDI32.dll_UpdateColors]
cmp dword [ebp - 0xb48], 0
jne 0x100242fb
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0xd64], eax
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0xcc0], eax
mov eax, dword [ebp - 0x434]
inc eax
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0xd64]
cmp eax, dword [ebp - 0xcc0]
jl 0x10024264
mov dword [ebp - 0xac0], 1
jmp 0x1002426b
and dword [ebp - 0xac0], 0
cmp dword [ebp - 0xac0], 1
jne 0x10024280
mov dword [ebp - 0x7a0], 1
jmp 0x10024287
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0xd6c]
cmp dword [ebp - 0x7a0], eax
jg 0x100242a1
mov dword [ebp - 0x9b8], 1
jmp 0x100242a8
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x9b8]
mov dword [ebp - 0x7a8], eax
mov esi, dword [ebp - 0x7a8]
add esi, 0x33631af
push 0
lea ecx, [ebp - 0x1110]
call fcn.10013b14
cmp esi, dword [eax]
jle 0x100242dd
mov dword [ebp - 0x7b0], 1
jmp 0x100242e4
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0xb48]
cmp eax, dword [ebp - 0x7b0]
jg 0x100242fb
and dword [ebp - 0x9c0], 0
jmp 0x10024305
mov dword [ebp - 0x9c0], 1
mov eax, dword [ebp - 0x9c0]
mov dword [ebp - 0xccc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1110]
call fcn.10013af8
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x1f4]
movzx eax, byte [ebp + eax - 0x252]
movsx eax, byte [ebp + eax - 0xc0c]
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x24f]
and ecx, eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x1f4]
movzx eax, byte [ebp + eax - 0x252]
movsx eax, byte [ebp + eax - 0xc0c]
mov edx, dword [ebp - 0x2c]
movzx edx, byte [ebp + edx - 0x24f]
and edx, eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x1f4]
movzx eax, byte [ebp + eax - 0x252]
movsx eax, byte [ebp + eax - 0xc0c]
mov esi, dword [ebp - 0x2c]
movzx ebx, byte [ebp + esi - 0x24f]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x250]
mov byte [ebp + eax - 0xc0c], bl
mov dword [ebp - 0xac8], 0x992
mov dword [ebp - 0xd74], 0x10007ed4
cmp dword [ebp - 0xac8], 0xb21
jle 0x100244aa
and dword [ebp - 0x3cc], 0
jmp 0x100243e2
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0x4a7e
jge 0x100244aa
and dword [ebp - 0x32c], 0
jmp 0x10024408
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0x736c
jge 0x100244a5
and dword [ebp - 0x394], 0
jmp 0x1002442e
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 0x5122
jge 0x100244a0
and dword [ebp - 0x324], 0
jmp 0x10024450
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0x5d73
jge 0x1002449e
mov eax, dword [ebp - 0x394]
cdq
idiv dword [ebp - 0x324]
mov eax, dword [ebp - 0x3cc]
add eax, dword [ebp - 0x32c]
mov ecx, edx
shl eax, cl
cdq
mov dword [ebp - 0xce0], eax
mov dword [ebp - 0xcdc], edx
push dword [ebp - 0xcdc]
push dword [ebp - 0xce0]
mov ecx, 0x10607b78
call fcn.10013775
jmp 0x10024443
jmp 0x10024421
jmp 0x100243fb
jmp 0x100243d5
mov dword [ebp - 0xac], 0x8ade19d2
push 2
lea ecx, [ebp - 0x1128]
call fcn.10013a9c
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x14b0], 0
mov dword [ebp - 0xe4], 0
jmp 0x100244eb
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jge 0x10024507
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0x14b8], 8
jmp 0x100244de
mov dword [ebp - 0xe4], 0
jmp 0x10024520
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 2
jge 0x1002453f
push dword [ebp - 0xe4]
lea ecx, [ebp - 0x1128]
call fcn.10013b14
and dword [eax], 0
jmp 0x10024513
mov dword [ebp - 0xac], 0
jmp 0x10024558
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x100246d7
push 4
lea ecx, [ebp - 0xe5c]
call fcn.10013a9c
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0xfd8], 0x1c97412d
mov dword [ebp - 0xfd4], 0x1c97412d
mov dword [ebp - 0xfd0], 0x1c97412d
mov dword [ebp - 0xfcc], 0x1c97412d
lea ecx, [ebp - 0x401]
call fcn.100145b6
push eax
lea eax, [ebp - 0xfc8]
push eax
lea eax, [ebp - 0xfd8]
push eax
lea ecx, [ebp - 0x15c8]
call fcn.1002c975
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1388]
call fcn.1002c94f
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x39c], 0
jmp 0x100245f0
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 4
jge 0x1002460f
push dword [ebp - 0x39c]
lea ecx, [ebp - 0xe5c]
call fcn.10013b14
or dword [eax], 0xffffffff
jmp 0x100245e3
push 2
lea ecx, [ebp - 0xe5c]
call fcn.10013b14
and dword [eax], 0
jmp 0x10024645
push 2
lea ecx, [ebp - 0xe5c]
call fcn.10013b14
mov dword [ebp - 0x7b8], eax
mov eax, dword [ebp - 0x7b8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x7b8]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xe5c]
call fcn.10013b14
cmp dword [eax], 0
jl 0x100246b4
mov dword [ebp - 0x334], 3
mov dword [ebp - 0x334], 0
jmp 0x1002467a
mov eax, dword [ebp - 0x334]
dec eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0
jl 0x100246af
push 0
lea ecx, [ebp - 0x1388]
call fcn.10013b14
or dword [eax], 0xffffffff
mov byte [ebp - 0x124], 0
movzx eax, byte [ebp - 0x124]
test eax, eax
je 0x100246ad
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1002466d
jmp 0x10024621
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x1388]
call fcn.10013af8
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xe5c]
call fcn.10013af8
jmp 0x1002454b
mov dword [ebp - 0xac], 0
jmp 0x100246f0
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jg 0x1002478e
or dword [ebp - 0x1078], 0xffffffff
or dword [ebp - 0x1074], 0xffffffff
or dword [ebp - 0x1070], 0xffffffff
or dword [ebp - 0x106c], 0xffffffff
lea ecx, [ebp - 0x455]
call fcn.100145b6
push eax
lea eax, [ebp - 0x1068]
push eax
lea eax, [ebp - 0x1078]
push eax
lea ecx, [ebp - 0x15b0]
call fcn.1002c975
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1398]
call fcn.1002c94f
mov byte [ebp - 4], 0x1c
push 1
lea ecx, [ebp - 0x1128]
call fcn.10013b14
mov dword [eax], 0x9310c13f
mov esi, dword [ebp - 0xac]
push 3
lea ecx, [ebp - 0x1398]
call fcn.10013b14
mov dword [eax], esi
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1398]
call fcn.10013af8
jmp 0x100246e3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1128]
call fcn.10013af8
mov dword [ebp - 4], 0x1d
cmp dword [ebp - 0xac8], 0x61e
jge 0x100247c0
mov edx, dword [ebp - 0xd74]
mov ecx, 0x10607b78
call fcn.10016475
jmp 0x100247dc
or dword [ebp - 4], 0xffffffff
jmp 0x100247e6
and dword [ebp - 0x1f4], 0
jmp 0x10023b6e
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0xc0c], 0
mov dword [ebp - 0x20], 0x97a4a12b
mov dword [ebp - 0x28], 0xffffffff
push 4
lea ecx, [ebp - 0x498]
call fcn.10013a9c
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x44], 0
jmp 0x10024832
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x10024848
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xe6c], 0xfffffff8
jmp 0x1002482b
mov dword [ebp - 0x44], 0
jmp 0x10024858
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x10024871
push dword [ebp - 0x44]
lea ecx, [ebp - 0x498]
call fcn.10013b14
or dword [eax], 0xffffffff
jmp 0x10024851
mov dword [ebp - 0x44], 0
jmp 0x10024881
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x10024897
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x1548], 0xfffffffe
jmp 0x1002487a
cmp dword [ebp - 0x20], 1
jl 0x100248a9
mov dword [ebp - 0x9c8], 1
jmp 0x100248b0
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x7c0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7c0]
mov dword [ebp + eax - 0xe6c], ecx
mov eax, dword [ebp - 0x7c0]
cmp eax, dword [ebp - 0x9c8]
jle 0x100248e9
mov dword [ebp - 0x7c8], 1
jmp 0x100248f0
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x7c8]
jge 0x10024907
mov dword [ebp - 0xbc0], 1
jmp 0x1002490e
and dword [ebp - 0xbc0], 0
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0x1f050678
cmp dword [ebp - 0x28], 0
jne 0x1002494b
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp + eax - 0xe6c]
test ecx, ecx
je 0x10024942
mov eax, 0xf591
test eax, eax
jne 0x1002494b
and dword [ebp - 0x7d0], 0
jmp 0x10024955
mov dword [ebp - 0x7d0], 1
push 2
lea ecx, [ebp - 0x498]
call fcn.10013b14
mov ecx, dword [ebp - 0x7d0]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xe6c]
push 2
lea ecx, [ebp - 0x498]
call fcn.10013b14
sub esi, dword [eax]
jne 0x10024c0b
mov dword [ebp - 0xcd8], 0x85869896
mov dword [ebp - 0x28], 2
jmp 0x100249a6
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x10024bdd
mov dword [ebp - 0x3f4], 0
jmp 0x100249c9
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 3
jge 0x100249e5
mov eax, dword [ebp - 0x3f4]
mov dword [ebp + eax*4 - 0x1518], 2
jmp 0x100249bc
mov dword [ebp - 0x20], 0
jmp 0x100249f5
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x10024bc4
mov esi, dword [ebp - 0x20]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x498]
call fcn.10013b14
imul esi, dword [eax]
test esi, esi
jne 0x10024a23
mov dword [ebp - 0x7d8], 1
jmp 0x10024a2a
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xe6c]
mov dword [ebp - 0x9d0], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x9d0]
mov dword [ebp + eax*4 - 0xe6c], ecx
mov eax, dword [ebp - 0x9d0]
cmp eax, dword [ebp - 0x7d8]
jg 0x10024a64
mov dword [ebp - 0xad0], 1
jmp 0x10024a6b
and dword [ebp - 0xad0], 0
cmp dword [ebp - 0xad0], 0xfffffff6
jne 0x10024a80
mov dword [ebp - 0x7e0], 1
jmp 0x10024a87
and dword [ebp - 0x7e0], 0
cmp dword [ebp - 0x7e0], 0x1422
jge 0x10024a9f
mov dword [ebp - 0x9d8], 1
jmp 0x10024aa6
and dword [ebp - 0x9d8], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x9d8], eax
je 0x10024abd
mov dword [ebp - 0x7e8], 1
jmp 0x10024ac4
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0xcd8]
cmp dword [ebp - 0x7e8], eax
je 0x10024ade
mov dword [ebp - 0xb54], 1
jmp 0x10024ae5
and dword [ebp - 0xb54], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x498]
call fcn.10013b14
mov ecx, dword [ebp - 0xb54]
cmp ecx, dword [eax]
jl 0x10024b09
mov dword [ebp - 0x7f0], 1
jmp 0x10024b10
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0x7f0]
sub eax, 7
je 0x10024b2d
cmp dword [ebp - 0x28], 0
je 0x10024b2d
mov dword [ebp - 0x9e0], 1
jmp 0x10024b34
and dword [ebp - 0x9e0], 0
push 2
lea ecx, [ebp - 0x498]
call fcn.10013b14
mov ecx, dword [ebp - 0x9e0]
add ecx, dword [eax]
mov dword [ebp - 0x7f8], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x7f8]
mov dword [ebp + eax - 0x1548], ecx
mov esi, dword [ebp - 0x7f8]
sub esi, 0x5f7f
push dword [ebp - 0x20]
lea ecx, [ebp - 0x498]
call fcn.10013b14
cmp dword [eax], esi
jge 0x10024b8c
mov dword [ebp - 0xad8], 1
jmp 0x10024b93
and dword [ebp - 0xad8], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1518], 0x12b9
mov esi, 0x12b9
sub esi, dword [ebp - 0xad8]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x498]
call fcn.10013b14
mov dword [eax], esi
jmp 0x100249ee
push dword [ebp - 0x28]
lea ecx, [ebp - 0x498]
call fcn.10013b14
mov dword [eax], 5
jmp 0x1002499f
mov dword [ebp - 0x20], 0
jmp 0x10024bed
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x10024c06
push dword [ebp - 0x20]
lea ecx, [ebp - 0x498]
call fcn.10013b14
and dword [eax], 0
jmp 0x10024be6
jmp 0x10024de7
mov dword [ebp - 0x14c4], 0xc4b0
mov dword [ebp - 0x14cc], 4
mov dword [ebp - 0x14c0], 1
mov byte [ebp - 0x19e], 0
movzx eax, byte [ebp - 0x19e]
test eax, eax
je 0x10024c46
push 0x1036
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0x28], 0xfffffffc
jmp 0x10024c56
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffe2
jle 0x10024de7
mov dword [ebp - 0x13f4], 0xffffffff
mov dword [ebp - 0x11a0], 1
mov dword [ebp - 0x11c0], 0xfffffffa
push 2
lea ecx, [ebp - 0x114c]
call fcn.10013a9c
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x27c], 0
jmp 0x10024ca8
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 2
jge 0x10024cca
push dword [ebp - 0x27c]
lea ecx, [ebp - 0x114c]
call fcn.10013b14
mov dword [eax], 0xd45eb447
jmp 0x10024c9b
mov dword [ebp - 0x9e8], 0x4fd1
mov dword [ebp - 0xd7c], 0x10007f34
cmp dword [ebp - 0x9e8], 0x522f
jle 0x10024d63
and dword [ebp - 0x280], 0
jmp 0x10024d00
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0x527f
jge 0x10024d63
and dword [ebp - 0x288], 0
jmp 0x10024d22
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0x3e0
jge 0x10024d61
mov eax, dword [ebp - 0x280]
mov ecx, dword [ebp - 0x288]
shl eax, cl
cdq
mov dword [ebp - 0xcec], eax
mov dword [ebp - 0xce8], edx
push dword [ebp - 0xce8]
push dword [ebp - 0xcec]
mov ecx, 0x10607b78
call fcn.10013775
jmp 0x10024d15
jmp 0x10024cf3
push 0
lea ecx, [ebp - 0x114c]
call fcn.10013b14
mov dword [ebp - 0x800], eax
mov eax, dword [ebp - 0x800]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x800]
mov dword [ecx], eax
mov byte [ebp - 4], 0x21
cmp dword [ebp - 0x9e8], 0x4d8f
jge 0x10024da7
mov edx, dword [ebp - 0xd7c]
mov ecx, 0x10607b78
call fcn.10016475
jmp 0x10024dc3
mov dword [ebp - 4], 0x20
jmp 0x10024dd3
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x114c]
call fcn.10013af8
jmp 0x10024c4f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x498]
call fcn.10013af8
lea eax, [ebp - 0xc0c]
push eax
lea ecx, [ebp - 0x15f8]
call fcn.1002c90d
mov dword [ebp - 0xce4], eax
mov eax, dword [ebp - 0xce4]
mov dword [ebp - 0xd84], eax
mov dword [ebp - 4], 0x23
mov edx, dword [ebp - 0x808]
mov ecx, dword [ebp - 0xd84]
call fcn.10017455
mov dword [0x10609a28], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15f8]
call fcn.100139fc
mov dword [ebp - 0x1198], 0x5c96dd1e
mov dword [ebp - 0x11a8], 0xf4a8b108
mov dword [ebp - 0x1f8], 0x9ef72d4e
mov dword [ebp - 0x131c], 0
mov dword [ebp - 0x11b0], 0x2bbef7d6
mov dword [ebp - 0x142c], 1
mov dword [ebp - 0x11bc], 2
mov dword [ebp - 0x1324], 0xfffffff8
mov dword [ebp - 0x11c4], 0x2a831d26
mov dword [ebp - 0x14ac], 0xc285ce96
mov dword [ebp - 0x11cc], 0x3c407858
mov dword [ebp - 0x132c], 0x54dbbe5
mov dword [ebp - 0x1174], 2
mov dword [ebp - 0x1170], 2
mov dword [ebp - 0x116c], 2
mov dword [ebp - 0x1168], 2
push 2
lea ecx, [ebp - 0x13a8]
call fcn.10013a9c
mov dword [ebp - 4], 0x24
mov dword [ebp - 0x11d4], 0xb2c4eb0a
mov dword [ebp - 0x1434], 0xd493
mov dword [ebp - 0xb94], 0xb2a93f04
mov dword [ebp - 0xd0], 0
jmp 0x10024f31
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x10024f53
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x13a8]
call fcn.10013b14
mov dword [eax], 0xfffffff7
jmp 0x10024f24
mov dword [ebp - 0xd0], 0
jmp 0x10024f6c
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 3
jge 0x10024f88
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x1640], 0x33c7
jmp 0x10024f5f
mov eax, dword [ebp - 0xb94]
inc eax
mov dword [ebp - 0xb94], eax
mov dword [ebp - 0x1f8], 0
jmp 0x10024fae
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 4
jge 0x10024fca
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0x1174], 0
jmp 0x10024fa1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13a8]
call fcn.10013af8
and dword [ebp - 0x290], 0
jmp 0x10024fef
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0xf
jae 0x10025008
mov eax, dword [ebp - 0x290]
mov byte [ebp + eax - 0xc0c], 0
jmp 0x10024fe2
mov dword [ebp - 0xfec], 1
mov dword [ebp - 0xfe8], 1
mov dword [ebp - 0xfe4], 1
mov dword [ebp - 0xfe0], 1
lea ecx, [ebp - 0x45d]
call fcn.100145b6
push eax
lea eax, [ebp - 0xfdc]
push eax
lea eax, [ebp - 0xfec]
push eax
lea ecx, [ebp - 0x1560]
call fcn.1002c975
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4d0]
call fcn.1002c94f
mov dword [ebp - 4], 0x25
mov dword [ebp - 0x60], 0xa18885c6
mov dword [ebp - 0x60], 3
jmp 0x10025083
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x100251e4
mov dword [ebp - 0x818], 3
mov dword [ebp - 0xd8c], 0xbd55fd0a
mov dword [ebp - 0xcfc], 0xbaf9eb11
push dword [ebp - 0x60]
lea ecx, [ebp - 0x4d0]
call fcn.10013b14
push 2
lea ecx, [ebp - 0x4d0]
call fcn.10013b14
cmp dword [eax], 0
jne 0x100250e7
push dword [ebp - 0x60]
lea ecx, [ebp - 0x4d0]
call fcn.10013b14
cmp dword [eax], 0
jne 0x100250e7
and dword [ebp - 0x9f0], 0
jmp 0x100250f1
mov dword [ebp - 0x9f0], 1
push dword [ebp - 0x60]
lea ecx, [ebp - 0x4d0]
call fcn.10013b14
push dword [ebp - 0x60]
lea ecx, [ebp - 0x4d0]
call fcn.10013b14
xor eax, eax
inc eax
neg eax
cmp eax, 0xffffffff
ja 0x10025123
mov dword [ebp - 0x810], 1
jmp 0x1002512a
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x810]
add eax, 0x1ec92367
jne 0x10025149
mov eax, 0xc4365de
test eax, eax
jne 0x10025149
and dword [ebp - 0xae0], 0
jmp 0x10025153
mov dword [ebp - 0xae0], 1
mov eax, dword [ebp - 0x9f0]
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x818]
cmp eax, dword [ebp - 0xae0]
je 0x10025179
mov dword [ebp - 0xcf0], 1
jmp 0x10025180
and dword [ebp - 0xcf0], 0
push 3
lea ecx, [ebp - 0x4d0]
call fcn.10013b14
mov eax, dword [eax]
add eax, 0xc023
mov dword [ebp - 0x820], eax
push dword [ebp - 0x60]
lea ecx, [ebp - 0x4d0]
call fcn.10013b14
mov ecx, dword [ebp - 0x820]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd8c]
cmp dword [ebp - 0x820], eax
jl 0x100251cc
push dword [ebp - 0x60]
lea ecx, [ebp - 0x4d0]
call fcn.10013b14
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x11dc], eax
mov dword [ebp - 0xcfc], 0x20b275cf
jmp 0x1002507c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d0]
call fcn.10013af8
mov eax, dword [0x106098ac]
cmp eax, dword [ebp - 0x3c8]
je 0x10025211
mov eax, dword [0x10609a28]
cmp eax, dword [ebp - 0x3c8]
jne 0x100256a2
mov dword [ebp - 0x34], 0xb642c70b
mov dword [ebp - 0x1334], 0xffffffff
mov dword [ebp - 0x11e4], 0x97d93cbf
mov dword [ebp - 0x298], 0
jmp 0x10025245
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 1
jge 0x10025261
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0x2b0], 0xfffffff7
jmp 0x10025238
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x15
jmp 0x10025277
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x15
jge 0x1002568a
mov dword [ebp - 0x64], 0x1e6e2bf
mov dword [ebp - 0x164], 0x14151c8b
mov dword [ebp - 0x43c], 1
mov dword [ebp - 0xda4], 0xd660f181
mov dword [ebp - 0x2a0], 0
jmp 0x100252bf
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 4
jge 0x100252db
mov eax, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0x1474], 1
jmp 0x100252b2
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x64]
jne 0x100252ef
mov dword [ebp - 0xd94], 1
jmp 0x100252f6
and dword [ebp - 0xd94], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x148c], eax
cmp dword [ebp - 0x64], 0
jne 0x10025314
cmp dword [ebp - 0x34], 0
jne 0x10025314
and dword [ebp - 0x9f8], 0
jmp 0x1002531e
mov dword [ebp - 0x9f8], 1
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x9f8], eax
je 0x10025335
mov dword [ebp - 0x828], 1
jmp 0x1002533c
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x828], eax
je 0x10025359
cmp dword [ebp - 0x34], 0
je 0x10025359
mov dword [ebp - 0xb5c], 1
jmp 0x10025360
and dword [ebp - 0xb5c], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0xb5c], eax
jl 0x10025377
mov dword [ebp - 0x830], 1
jmp 0x1002537e
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x830]
lea eax, [ecx + eax - 5]
cmp eax, dword [ebp - 0x64]
jl 0x1002539c
mov dword [ebp - 0xa00], 1
jmp 0x100253a3
and dword [ebp - 0xa00], 0
cmp dword [ebp - 0xa00], 0xfffffff8
je 0x100253bb
cmp dword [ebp - 0x34], 0
jne 0x100253bb
and dword [ebp - 0x474], 0
jmp 0x100253c5
mov dword [ebp - 0x474], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x474]
mov dword [ebp + eax - 0x2b0], ecx
mov eax, dword [ebp - 0x474]
add eax, 0xc6d0
cmp eax, dword [ebp - 0x64]
jle 0x100253f4
mov dword [ebp - 0x838], 1
jmp 0x100253fb
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x838]
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0xb2f67ab
jg 0x1002541f
mov dword [ebp - 0xae8], 1
jmp 0x10025426
and dword [ebp - 0xae8], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0xae8]
cmp eax, dword [ebp - 0x64]
jge 0x10025441
mov dword [ebp - 0x840], 1
jmp 0x10025448
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x840]
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x164], 0x1a
jmp 0x10025470
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0xe
jne 0x10025685
mov dword [ebp - 0xd14], 0xfffffffa
mov dword [ebp - 0x2a8], 0
jmp 0x100254a0
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 2
jge 0x100254bc
mov eax, dword [ebp - 0x2a8]
mov dword [ebp + eax*4 - 0xcf8], 0x94bf
jmp 0x10025493
mov eax, dword [ebp - 0x43c]
cmp eax, dword [ebp - 0x43c]
jne 0x100254d6
mov dword [ebp - 0xa08], 1
jmp 0x100254dd
and dword [ebp - 0xa08], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2b0]
cmp dword [ebp - 0xa08], eax
jge 0x100254fe
mov dword [ebp - 0xd08], 1
jmp 0x10025505
and dword [ebp - 0xd08], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xcf8]
inc eax
mov dword [ebp - 0xd9c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xd9c]
mov dword [ebp + eax - 0xcf8], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2b0], 0x7779
je 0x1002554b
mov dword [ebp - 0x848], 1
jmp 0x10025552
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x848]
neg eax
cmp eax, dword [ebp - 0x34]
jle 0x1002556b
mov dword [ebp - 0xbb8], 1
jmp 0x10025572
and dword [ebp - 0xbb8], 0
mov eax, dword [ebp - 0xd14]
add eax, dword [ebp - 0xbb8]
cmp eax, 0xef5ead4a
ja 0x10025591
mov dword [ebp - 0x850], 1
jmp 0x10025598
and dword [ebp - 0x850], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xcf8]
imul ecx, dword [ebp - 0x850]
imul ecx, dword [ebp + eax - 0x1474]
test ecx, ecx
jne 0x100255cc
cmp dword [ebp - 0x34], 0
jne 0x100255cc
and dword [ebp - 0xa10], 0
jmp 0x100255d6
mov dword [ebp - 0xa10], 1
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0xa10], eax
jge 0x100255ed
mov dword [ebp - 0x858], 1
jmp 0x100255f4
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x164]
cmp eax, dword [ebp - 0x858]
je 0x1002560e
mov dword [ebp - 0x4e4], 1
jmp 0x10025615
and dword [ebp - 0x4e4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1474]
cmp dword [ebp - 0x4e4], eax
jle 0x10025635
mov dword [ebp - 0x4ec], 1
jmp 0x1002563c
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0xda4]
cmp dword [ebp - 0x4ec], eax
jge 0x10025656
mov dword [ebp - 0x4f4], 1
jmp 0x1002565d
and dword [ebp - 0x4f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2b0]
mov ecx, dword [ebp - 0x4f4]
lea eax, [ecx + eax + 9]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1474], eax
jmp 0x10025463
jmp 0x10025270
mov ecx, dword [ebp + 0xc]
call fcn.10013755
push eax
push dword [ebp + 8]
call fcn.1001ca64
pop ecx
pop ecx
jmp 0x10029fb5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0
je 0x10029d08
mov eax, dword [ebp - 0x2c0]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10029d08
mov dword [ebp - 0x2b8], 0xffffffff
mov dword [ebp - 0x11ec], 6
mov dword [ebp - 0x2b8], 0xfffffffd
jmp 0x100256f9
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 7
jg 0x10025736
mov byte [ebp - 0x11b], 0
movzx eax, byte [ebp - 0x11b]
test eax, eax
je 0x1002571c
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov byte [ebp - 0x18d], 0
movzx eax, byte [ebp - 0x18d]
test eax, eax
je 0x10025734
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x100256ec
mov eax, dword [ebp - 0x2c0]
mov ecx, dword [ebp - 0x2c0]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x22c], ecx
mov eax, dword [ebp - 0x22c]
cmp dword [eax], 0x4550
jne 0x10029d08
mov eax, dword [ebp - 0x22c]
cmp dword [eax + 0x74], 0
jbe 0x10029d08
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x22c]
cmp dword [ecx + eax + 0x78], 0
je 0x10029d08
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x200], 1
mov dword [ebp - 0x524], 0xfffffff7
mov dword [ebp - 0x2c8], 0
jmp 0x100257ba
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 4
jge 0x100257d6
mov eax, dword [ebp - 0x2c8]
mov dword [ebp + eax*4 - 0x14f4], 0xd29729c
jmp 0x100257ad
mov dword [ebp - 0x200], 0xa8eac8b
mov dword [ebp - 0x200], 0xfffffff9
jmp 0x100257f9
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0x28
jge 0x10025aed
mov dword [ebp - 0x4ac], 0xdfd94759
mov dword [ebp - 0x4fc], 0x1224
mov dword [ebp - 0xd20], 0x10007f80
cmp dword [ebp - 0x4fc], 0x14ff
jle 0x10025913
and dword [ebp - 0x2d0], 0
jmp 0x1002584a
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0x7bda
jge 0x10025913
and dword [ebp - 0x270], 0
jmp 0x10025870
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0x748f
jge 0x1002590e
and dword [ebp - 0x2d8], 0
jmp 0x10025896
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0x2f45
jge 0x10025909
and dword [ebp - 0x2e0], 0
jmp 0x100258b8
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0x7ad3
jge 0x10025907
mov eax, dword [ebp - 0x2d0]
mov ecx, dword [ebp - 0x270]
shl eax, cl
mov ecx, dword [ebp - 0x2d8]
sar eax, cl
mov ecx, dword [ebp - 0x2e0]
shl eax, cl
cdq
mov dword [ebp - 0xd04], eax
mov dword [ebp - 0xd00], edx
push dword [ebp - 0xd00]
push dword [ebp - 0xd04]
mov ecx, 0x10607b78
call fcn.10013775
jmp 0x100258ab
jmp 0x10025889
jmp 0x10025863
jmp 0x1002583d
mov dword [ebp - 0x52c], 1
mov dword [ebp - 4], 0x26
cmp dword [ebp - 0x4fc], 0x1080
jge 0x10025940
mov edx, dword [ebp - 0xd20]
mov ecx, 0x10607b78
call fcn.10016475
jmp 0x1002595c
or dword [ebp - 4], 0xffffffff
jmp 0x10025966
mov dword [ebp - 0x2e8], 0
jmp 0x1002597f
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 1
jge 0x1002599b
mov eax, dword [ebp - 0x2e8]
mov dword [ebp + eax*4 - 0x2f8], 0x76942a1e
jmp 0x10025972
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2f8], 0
je 0x100259cb
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x14f4], 0x4210e164
mov dword [ebp - 0x4ac], 0x4210e164
jmp 0x10025ad3
mov dword [ebp - 0x2f0], 0xfffffff8
mov dword [ebp - 0x534], 0xfffffff6
cmp dword [ebp - 0x2f0], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14f4], 0
je 0x10025a06
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2f8], 0
jne 0x10025a18
mov eax, 0x1f1e283d
test eax, eax
jne 0x10025a18
and dword [ebp - 0x504], 0
jmp 0x10025a22
mov dword [ebp - 0x504], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2f8]
cmp dword [ebp - 0x504], eax
jge 0x10025a43
mov dword [ebp - 0x50c], 1
jmp 0x10025a4a
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x2f0]
cmp eax, dword [ebp - 0x50c]
jge 0x10025a6a
cmp dword [ebp - 0x2f0], 0
jne 0x10025a6a
and dword [ebp - 0x514], 0
jmp 0x10025a74
mov dword [ebp - 0x514], 1
mov eax, dword [ebp - 0x2f0]
cmp dword [ebp - 0x514], eax
jg 0x10025a8e
mov dword [ebp - 0x51c], 1
jmp 0x10025a95
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x52c], eax
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 0
je 0x10025ad3
jmp 0x100257ec
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2f8], 0
je 0x10025ae8
jmp 0x100257ec
jmp 0x100257ec
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x22c]
mov edx, dword [ebp - 0x1cc]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x114], 9
mov dword [ebp - 0x300], 0
jmp 0x10025b2c
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 2
jge 0x10025b48
mov eax, dword [ebp - 0x300]
mov dword [ebp + eax*4 - 0xfa4], 0x3df603fa
jmp 0x10025b1f
mov dword [ebp - 0x114], 0
jmp 0x10025b61
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x18
je 0x10025dba
push 2
lea ecx, [ebp - 0xbf0]
call fcn.10013a9c
mov dword [ebp - 4], 0x28
mov dword [ebp - 0xdac], 0x6fc2e607
mov dword [ebp - 0xd2c], 0xa08376fb
mov dword [ebp - 0x308], 0
jmp 0x10025baf
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 2
jge 0x10025bd1
push dword [ebp - 0x308]
lea ecx, [ebp - 0xbf0]
call fcn.10013b14
mov dword [eax], 0xfffffffe
jmp 0x10025ba2
push 1
lea ecx, [ebp - 0xbf0]
call fcn.10013b14
and dword [eax], 0
jmp 0x10025c07
push 1
lea ecx, [ebp - 0xbf0]
call fcn.10013b14
mov dword [ebp - 0x53c], eax
mov eax, dword [ebp - 0x53c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x53c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xbf0]
call fcn.10013b14
cmp dword [eax], 1
jg 0x10025da6
mov dword [ebp - 0x444], 0xaeba4d3e
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x114]
jle 0x10025c41
mov dword [ebp - 0x564], 1
jmp 0x10025c48
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x444], 0xd8ef068c
ja 0x10025c60
mov dword [ebp - 0x544], 1
jmp 0x10025c67
and dword [ebp - 0x544], 0
cmp dword [ebp - 0x544], 0
jb 0x10025c7c
mov dword [ebp - 0x54c], 1
jmp 0x10025c83
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x54c], eax
jle 0x10025c9d
mov dword [ebp - 0x554], 1
jmp 0x10025ca4
and dword [ebp - 0x554], 0
imul eax, dword [ebp - 0x554], 0x47cd
cmp eax, dword [ebp - 0xdac]
jg 0x10025cc2
mov dword [ebp - 0x55c], 1
jmp 0x10025cc9
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x55c]
sub eax, 0x5aac03d1
cmp eax, 1
jb 0x10025ce5
mov dword [ebp - 0x56c], 1
jmp 0x10025cec
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x564]
add eax, dword [ebp - 0x56c]
cmp eax, dword [ebp - 0x444]
jle 0x10025d0c
mov dword [ebp - 0x574], 1
jmp 0x10025d13
and dword [ebp - 0x574], 0
push 1
lea ecx, [ebp - 0xbf0]
call fcn.10013b14
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xfa4]
mov dword [ebp - 0x57c], eax
push 1
lea ecx, [ebp - 0xbf0]
call fcn.10013b14
mov eax, dword [eax]
mov ecx, dword [ebp - 0x57c]
mov dword [ebp + eax*4 - 0xfa4], ecx
mov eax, dword [ebp - 0x574]
inc eax
cmp dword [ebp - 0x57c], eax
jg 0x10025d66
mov dword [ebp - 0x584], 1
jmp 0x10025d6d
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x584], eax
jl 0x10025d87
mov dword [ebp - 0x58c], 1
jmp 0x10025d8e
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x444]
imul eax, dword [ebp - 0x58c]
mov dword [ebp - 0xd2c], eax
jmp 0x10025be3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbf0]
call fcn.10013af8
jmp 0x10025b54
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x10025de0
push 0
push 0x677
push 0
push 0x176e
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, 0xffff
mov word [ebp - 0xb8], ax
or dword [ebp - 0x1bc], 0xffffffff
mov dword [ebp - 0x9c], 0x2c03342e
mov dword [ebp - 0x38], 0xf953
mov dword [ebp - 0x1d8], 0xcf49cf94
mov dword [ebp - 0x274], 0
jmp 0x10025e27
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 3
jge 0x10025e43
mov eax, dword [ebp - 0x274]
mov dword [ebp + eax*4 - 0x1164], 0x5f0a
jmp 0x10025e1a
mov dword [ebp - 0x9c], 0xfffffffb
jmp 0x10025e5c
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xfffffff6
je 0x100262f5
mov dword [ebp - 0x50], 0x54c3c69a
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x47c], 0xffffffff
mov dword [ebp - 0x50], 0
jmp 0x10025e94
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xb
jle 0x100262af
mov dword [ebp - 0x59c], 0x42ff18c9
mov dword [ebp - 0xd38], 0xfffffffa
push 3
lea ecx, [ebp - 0xf84]
call fcn.10013a9c
mov dword [ebp - 4], 0x29
mov dword [ebp - 0xd40], 0
mov dword [ebp - 0xe10], 0xffffffff
mov dword [ebp - 0xec], 0
jmp 0x10025ef3
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jge 0x10025f0f
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0xe7c], 0
jmp 0x10025ee6
mov dword [ebp - 0xec], 0
jmp 0x10025f28
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jge 0x10025f4a
push dword [ebp - 0xec]
lea ecx, [ebp - 0xf84]
call fcn.10013b14
mov dword [eax], 0xfffffffe
jmp 0x10025f1b
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x133c], eax
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x50]
jle 0x10025f6a
mov dword [ebp - 0x594], 1
jmp 0x10025f71
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x594]
dec eax
mov dword [ebp - 0x59c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x59c]
sub ecx, dword [ebp + eax - 0xe7c]
cmp ecx, 0xa7b7e80d
jae 0x10025fa5
mov dword [ebp - 0x5a4], 1
jmp 0x10025fac
and dword [ebp - 0x5a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe7c]
cmp dword [ebp - 0x5a4], eax
jg 0x10025fcd
mov dword [ebp - 0x5ac], 1
jmp 0x10025fd4
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x5ac]
add eax, 0xf118
jne 0x10025fee
xor eax, eax
jne 0x10025fee
and dword [ebp - 0x5b4], 0
jmp 0x10025ff8
mov dword [ebp - 0x5b4], 1
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x5b4], eax
jg 0x1002600f
mov dword [ebp - 0xdb4], 1
jmp 0x10026016
and dword [ebp - 0xdb4], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x11f4], eax
cmp dword [ebp - 0x9c], 0
je 0x1002602f
cmp dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 1
jne 0x1002604d
mov dword [ebp - 0x5bc], 1
jmp 0x10026054
and dword [ebp - 0x5bc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5bc]
sub ecx, dword [ebp + eax - 0xe7c]
cmp ecx, dword [ebp - 0x38]
je 0x10026078
mov dword [ebp - 0x5c4], 1
jmp 0x1002607f
and dword [ebp - 0x5c4], 0
cmp dword [ebp - 0x5c4], 0x8d0336d0
jb 0x10026097
mov dword [ebp - 0x5cc], 1
jmp 0x1002609e
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x5cc], eax
jg 0x100260b8
mov dword [ebp - 0x5d4], 1
jmp 0x100260bf
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x5d4], eax
jle 0x100260e5
mov dword [ebp - 0xdbc], 0x4353ea3a
mov eax, dword [ebp - 0xdbc]
mov dword [ebp - 0xd38], eax
jmp 0x1002629b
mov dword [ebp - 0xd48], 0xfffc
mov byte [ebp - 0x11f], 0
movzx eax, byte [ebp - 0x11f]
test eax, eax
je 0x10026113
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x208], 0
je 0x1002616f
cmp dword [ebp - 0x208], 1
jne 0x10026131
mov dword [ebp - 0x5dc], 1
jmp 0x10026138
and dword [ebp - 0x5dc], 0
cmp dword [ebp - 0x5dc], 0x2cd0
jle 0x10026150
mov dword [ebp - 0x5e4], 1
jmp 0x10026157
and dword [ebp - 0x5e4], 0
cmp dword [ebp - 0x5e4], 0x3dcdcbd5
jne 0x1002616f
mov dword [ebp - 0x5ec], 1
jmp 0x10026176
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
sub eax, dword [ebp - 0x208]
mov dword [ebp - 0x5f4], eax
push 0
lea ecx, [ebp - 0xf84]
call fcn.10013b14
mov ecx, dword [ebp - 0x5f4]
mov dword [eax], ecx
cmp dword [ebp - 0x5f4], 0xa828c040
jb 0x100261cb
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1164], 0
jne 0x100261cb
cmp dword [ebp - 0x9c], 0
jne 0x100261cb
and dword [ebp - 0xee4], 0
jmp 0x100261d5
mov dword [ebp - 0xee4], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1164]
mov dword [ebp - 0x143c], eax
mov eax, dword [ebp - 0xd40]
mov dword [ebp - 0x11fc], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x47c]
sub eax, dword [ebp - 0xe10]
cmp eax, dword [ebp - 0x50]
jle 0x1002621a
mov dword [ebp - 0x5fc], 1
jmp 0x10026221
and dword [ebp - 0x5fc], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xe7c]
add ecx, dword [ebp - 0x5fc]
imul ecx, dword [ebp + eax - 0xe7c]
cmp ecx, dword [ebp - 0x9c]
jl 0x10026254
mov dword [ebp - 0x604], 1
jmp 0x1002625b
and dword [ebp - 0x604], 0
cmp dword [ebp - 0x604], 0xd370
jge 0x10026273
mov dword [ebp - 0x60c], 1
jmp 0x1002627a
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x1d8], eax
push 1
lea ecx, [ebp - 0xf84]
call fcn.10013b14
mov eax, dword [eax]
mov dword [ebp - 0xd48], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf84]
call fcn.10013af8
jmp 0x10025e8d
mov dword [ebp - 0x50], 0
jmp 0x100262bf
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xfffffff9
je 0x100262f0
mov dword [ebp - 0x38], 0x1c
jmp 0x100262d5
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xfffffff2
jge 0x100262e6
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x47c], eax
jmp 0x100262ce
cmp dword [ebp - 0x38], 0
je 0x100262ee
jmp 0x100262b8
jmp 0x100262b8
jmp 0x10025e4f
mov dword [ebp - 0x38], 2
jmp 0x10026305
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x10026342
mov dword [ebp - 0x1d8], 0
jmp 0x10026324
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 3
jge 0x10026340
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x1164], 0xfffa
jmp 0x10026317
jmp 0x100262fe
cmp dword [ebp + 0x10], 0
jbe 0x1002678d
mov dword [ebp - 0xd8], 2
mov dword [ebp - 0xf24], 7
mov dword [ebp - 0xf20], 7
mov dword [ebp - 0xf1c], 7
mov dword [ebp - 0xf18], 7
mov dword [ebp - 0x61c], 0x72b90f99
mov dword [ebp - 0xd8], 0xffffffee
jmp 0x100263a1
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xffffffe4
jne 0x100263b7
cmp dword [ebp - 0xd8], 0
je 0x100263b5
jmp 0x100263b7
jmp 0x10026394
mov dword [ebp - 0x62c], 0x12be
mov dword [ebp - 0xd50], 0x10007ff8
cmp dword [ebp - 0x62c], 0x1345
jle 0x100264cd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
and dword [ebp - 0x318], 0
jmp 0x100263fb
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0x51fb
jge 0x100264bd
and dword [ebp - 0x278], 0
jmp 0x10026421
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0x7b51
jge 0x100264b8
and dword [ebp - 0x310], 0
jmp 0x10026447
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0x5b7b
jge 0x100264b3
mov ecx, dword [ebp - 0x278]
imul ecx, dword [ebp - 0x310]
mov eax, dword [ebp - 0x318]
shl eax, cl
cdq
mov dword [ebp - 0xd10], eax
mov dword [ebp - 0xd0c], edx
push dword [ebp - 0xd0c]
push dword [ebp - 0xd10]
lea ecx, [ebp - 0x161c]
call fcn.1000a92e
pop ecx
pop ecx
mov dword [ebp - 0xec0], eax
mov ecx, dword [ebp - 0xec0]
call fcn.10013755
push eax
call fcn.10049db3
pop ecx
lea ecx, [ebp - 0x161c]
call fcn.1001374b
jmp 0x1002643a
jmp 0x10026414
jmp 0x100263ee
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x134c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf24]
mov dword [ebp - 0x1204], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xf24]
add eax, 0x34111d01
je 0x10026523
push 5
pop eax
test eax, eax
je 0x10026523
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf24], 0
je 0x10026523
mov dword [ebp - 0x614], 1
jmp 0x1002652a
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x61c], eax
mov eax, dword [ebp - 0xd8]
push 4
pop ecx
shl ecx, 1
mov edx, dword [ebp - 0x61c]
sub edx, dword [ebp + ecx - 0xf24]
lea eax, [edx + eax + 0x2cc9105f]
cmp dword [ebp - 0xd8], eax
jle 0x10026569
mov dword [ebp - 0x624], 1
jmp 0x10026570
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x624]
add eax, 6
mov dword [ebp - 0xd8], eax
mov dword [ebp - 4], 0x2a
cmp dword [ebp - 0x62c], 0xf6a
jge 0x1002659e
push dword [ebp - 0xd50]
call fcn.10049db3
pop ecx
jmp 0x100265ba
or dword [ebp - 4], 0xffffffff
jmp 0x100265c4
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x10026788
mov dword [ebp - 0x16c], 0xfffb
push 3
lea ecx, [ebp - 0x10ec]
call fcn.10013a9c
mov dword [ebp - 4], 0x2c
mov dword [ebp - 0xeec], 0xe60e7790
mov dword [ebp - 0xf0], 0
jmp 0x10026617
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 4
jge 0x10026633
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x1194], 0xfffffffe
jmp 0x1002660a
mov dword [ebp - 0xf0], 0
jmp 0x1002664c
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 3
jge 0x1002666e
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x10ec]
call fcn.10013b14
mov dword [eax], 0x403ca955
jmp 0x1002663f
xor eax, eax
jne 0x1002671e
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x14bc], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x120c], eax
mov eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0x16c]
jne 0x100266a8
mov dword [ebp - 0x44c], 1
jmp 0x100266af
and dword [ebp - 0x44c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x44c]
mov dword [ebp + eax - 0x1194], ecx
cmp dword [ebp - 0x44c], 0
je 0x100266d9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1194], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x16c]
cmp ecx, dword [ebp + eax - 0x1194]
jl 0x100266f9
mov dword [ebp - 0xe18], 1
jmp 0x10026700
and dword [ebp - 0xe18], 0
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x135c], eax
push 0
lea ecx, [ebp - 0x10ec]
call fcn.10013b14
cmp dword [eax], 0
je 0x1002672e
xor eax, eax
je 0x1002672e
mov dword [ebp - 0xd58], 1
jmp 0x10026735
and dword [ebp - 0xd58], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1194]
cmp eax, dword [ebp - 0x16c]
jge 0x10026756
mov dword [ebp - 0x634], 1
jmp 0x1002675d
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x634]
sub eax, 0xb8ce
mov dword [ebp - 0xeec], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10ec]
call fcn.10013af8
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0xb8], ax
jmp 0x100293a0
mov dword [ebp - 0x1214], 0x9ac78948
mov dword [ebp - 0x1444], 0xa12b57e8
mov dword [ebp - 0x121c], 1
mov dword [ebp - 0x136c], 0x7cefa9d1
mov dword [ebp - 0x1224], 7
mov dword [ebp - 0x63c], 0
mov dword [ebp - 0x320], 0
jmp 0x100267e2
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 1
jge 0x100267fe
mov eax, dword [ebp - 0x320]
mov dword [ebp + eax*4 - 0x1494], 0x8c08872f
jmp 0x100267d5
mov eax, dword [ebp - 0x63c]
dec eax
mov dword [ebp - 0x63c], eax
mov eax, dword [0x10609a30]
and eax, 1
jne 0x10026842
mov eax, dword [0x10609a30]
or eax, 1
mov dword [0x10609a30], eax
mov dword [ebp - 4], 0x2d
mov ecx, 0x10609a08
call fcn.10013d81
push 0x10061b98
call fcn.10049d89
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x65c], 0
mov dword [ebp - 0xe20], 1
mov dword [ebp - 0x330], 0xfffffffb
mov dword [ebp - 0xd78], 0x50b5f0b1
mov dword [ebp - 0xef4], 5
mov dword [ebp - 0xd70], 2
mov dword [ebp - 0xe28], 1
mov dword [ebp - 0x328], 0
mov dword [ebp - 0x4a8], 0xc6eed1e1
mov dword [ebp - 0xe0], 0
jmp 0x100268b5
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jge 0x100268d1
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0xd60], 0xefa5f9c7
jmp 0x100268a8
mov dword [ebp - 0xe0], 0
jmp 0x100268ea
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 2
jge 0x10026906
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0xd1c], 0xffffffff
jmp 0x100268dd
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 0x122c], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x137c], eax
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x1002692f
imul eax, dword [ebp - 0x328], 0x74b6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd60], 0
jne 0x10026951
cmp dword [ebp - 0xe20], 0
jne 0x10026951
and dword [ebp - 0xd68], 0
jmp 0x1002695b
mov dword [ebp - 0xd68], 1
mov eax, dword [ebp - 0x330]
inc eax
imul eax, dword [ebp - 0xef4]
cmp eax, dword [ebp - 0x330]
jle 0x1002697d
mov dword [ebp - 0x644], 1
jmp 0x10026984
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x4a8]
dec eax
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x4a8]
imul eax, dword [ebp - 0x644]
cmp eax, 0xa88a
jg 0x100269b1
mov dword [ebp - 0x64c], 1
jmp 0x100269b8
and dword [ebp - 0x64c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd1c]
cmp dword [ebp - 0x64c], eax
jle 0x100269df
cmp dword [ebp - 0xd70], 0
jne 0x100269df
and dword [ebp - 0x654], 0
jmp 0x100269e9
mov dword [ebp - 0x654], 1
mov eax, dword [ebp - 0x654]
mov dword [ebp - 0x328], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x65c]
add ecx, dword [ebp - 0x328]
add ecx, dword [ebp - 0xe28]
add ecx, dword [ebp + eax - 0xd1c]
mov dword [ebp - 0x330], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x330]
imul ecx, dword [ebp + eax - 0xd1c]
mov dword [ebp - 0xd78], ecx
movzx eax, byte [0x106098a0]
test eax, eax
je 0x10027381
mov ecx, 0x10609a08
call fcn.1002c9c7
movzx eax, al
test eax, eax
jne 0x10027381
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x74c]
push eax
mov ecx, 0x10609a08
call fcn.10013be8
mov dword [ebp - 0x5c], 0xfffffff7
mov dword [ebp - 0x174], 0x564c7b7f
push 1
lea ecx, [ebp - 0x344]
call fcn.10013a9c
mov dword [ebp - 4], 0x2e
mov dword [ebp - 0x6c], 0xe9a5
mov dword [ebp - 0x1014], 0x6d2926a0
mov dword [ebp - 0x1010], 0x6d2926a0
mov dword [ebp - 0x100c], 0x6d2926a0
mov dword [ebp - 0x1008], 0x6d2926a0
lea ecx, [ebp - 0x46d]
call fcn.100145b6
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x15c0]
call fcn.1002c975
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x10b0]
call fcn.1002c94f
mov byte [ebp - 4], 0x2f
mov dword [ebp - 0x724], 1
mov dword [ebp - 0x73c], 0
mov dword [ebp - 0x338], 0
jmp 0x10026b2a
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 1
jge 0x10026b4c
push dword [ebp - 0x338]
lea ecx, [ebp - 0x344]
call fcn.10013b14
mov dword [eax], 0xb534de6f
jmp 0x10026b1d
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x6c]
dec ecx
mov dword [ebp - 0x6c], ecx
test eax, eax
je 0x10026b6f
cmp dword [ebp - 0x5c], 0x70cc
jge 0x10026b6f
mov dword [ebp - 0x664], 1
jmp 0x10026b76
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
jge 0x10026b97
mov dword [ebp - 0x66c], 1
jmp 0x10026b9e
and dword [ebp - 0x66c], 0
push 0
lea ecx, [ebp - 0x344]
call fcn.10013b14
mov esi, dword [ebp - 0x66c]
imul esi, dword [eax]
sub esi, 0x1a17e582
push 0
lea ecx, [ebp - 0x344]
call fcn.10013b14
imul esi, dword [eax]
neg esi
mov eax, dword [ebp - 0x5c]
add eax, esi
cmp dword [ebp - 0x5c], eax
je 0x10026be4
xor eax, eax
inc eax
jne 0x10026be4
and dword [ebp - 0x674], 0
jmp 0x10026bee
mov dword [ebp - 0x674], 1
push 0
lea ecx, [ebp - 0x344]
call fcn.10013b14
mov ecx, dword [ebp - 0x674]
add ecx, dword [eax]
cmp dword [ebp - 0x5c], ecx
jge 0x10026c14
mov dword [ebp - 0x67c], 1
jmp 0x10026c1b
and dword [ebp - 0x67c], 0
push 0
lea ecx, [ebp - 0x344]
call fcn.10013b14
mov esi, dword [ebp - 0x67c]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x344]
call fcn.10013b14
cmp esi, dword [eax]
jle 0x1002710d
mov dword [ebp - 0x454], 3
mov dword [ebp - 0x1234], 0x195c588c
mov dword [ebp - 0x144c], 0xffffffff
mov dword [ebp - 0xd90], 0
mov dword [ebp - 0x123c], 0x467468e5
mov dword [ebp - 0x6dc], 0x46c64e71
mov dword [ebp - 0x138c], 0x52b8909f
mov dword [ebp - 0x1244], 0xfadbacd6
mov dword [ebp - 0x14b4], 0x32dc71
mov dword [ebp - 0x124c], 0xffffffff
mov dword [ebp - 0x139c], 1
mov dword [ebp - 0x1254], 0xf82ea917
push 1
lea ecx, [ebp - 0x13b8]
call fcn.10013a9c
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x69c], 1
mov dword [ebp - 0xd88], 0xaa6f69a7
push 3
lea ecx, [ebp - 0x10a4]
call fcn.10013a9c
mov byte [ebp - 4], 0x31
mov dword [ebp - 0xb0], 0
jmp 0x10026d0d
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x10026d2f
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x13b8]
call fcn.10013b14
mov dword [eax], 8
jmp 0x10026d00
mov dword [ebp - 0xb0], 0
jmp 0x10026d48
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x10026d6a
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x10a4]
call fcn.10013b14
mov dword [eax], 0xffff
jmp 0x10026d3b
push 0
lea ecx, [ebp - 0x344]
call fcn.10013b14
mov dword [eax], 0xccf9
cmp dword [ebp - 0x6dc], 0xccf9
jle 0x10026d95
mov dword [ebp - 0x68c], 1
jmp 0x10026d9c
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x454]
cmp eax, dword [ebp - 0x174]
jl 0x10026db6
mov dword [ebp - 0x684], 1
jmp 0x10026dbd
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x684]
add eax, 0xe47c
sub eax, dword [ebp - 0x6c]
add eax, 0x7f8e3ccd
sub eax, dword [ebp - 0x6c]
cmp eax, 0xfc4b74e4
jae 0x10026de6
mov dword [ebp - 0x694], 1
jmp 0x10026ded
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x68c]
cmp eax, dword [ebp - 0x694]
jge 0x10026e02
cmp dword [ebp - 0x69c], 0
mov dword [ebp - 0x174], 1
mov eax, dword [ebp - 0x69c]
cmp eax, dword [ebp - 0x6c]
jg 0x10026e23
mov dword [ebp - 0x4e0], 1
jmp 0x10026e2a
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x454]
cmp dword [ebp - 0x4e0], eax
jge 0x10026e56
push 0
lea ecx, [ebp - 0x344]
call fcn.10013b14
cmp dword [eax], 0
je 0x10026e56
mov dword [ebp - 0xedc], 1
jmp 0x10026e5d
and dword [ebp - 0xedc], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1454], eax
push 3
lea ecx, [ebp - 0x10b0]
call fcn.10013b14
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0xd80], eax
push 0
lea ecx, [ebp - 0x344]
call fcn.10013b14
mov ecx, dword [ebp - 0x48c]
mov ecx, dword [ecx]
add ecx, dword [eax]
mov dword [ebp - 0xe30], ecx
mov eax, dword [ebp - 0x48c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x48c]
mov dword [ecx], eax
mov eax, dword [ebp - 0xd80]
cmp eax, dword [ebp - 0xe30]
je 0x10026ecd
mov dword [ebp - 0x6ac], 1
jmp 0x10026ed4
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x6ac]
neg eax
je 0x10026ef3
cmp dword [ebp - 0xd88], 0
je 0x10026ef3
mov dword [ebp - 0x6b4], 1
jmp 0x10026efa
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x6b4], eax
jl 0x10026f11
mov dword [ebp - 0x6bc], 1
jmp 0x10026f18
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x6bc], eax
je 0x10026f2f
mov dword [ebp - 0x6c4], 1
jmp 0x10026f36
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x6c4]
add eax, 0x3ae792f6
cmp eax, dword [ebp - 0x6c]
je 0x100270a4
mov dword [ebp - 0x210], 0
mov dword [ebp - 0xf0c], 0x205a1655
mov eax, dword [ebp - 0x210]
cmp eax, dword [ebp - 0x5c]
je 0x10026f75
mov dword [ebp - 0x6cc], 1
jmp 0x10026f7c
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0xf0c]
cmp dword [ebp - 0x6cc], eax
jg 0x10026f96
mov dword [ebp - 0x6d4], 1
jmp 0x10026f9d
and dword [ebp - 0x6d4], 0
mov esi, dword [ebp - 0x6d4]
sub esi, dword [ebp - 0xd90]
push 0
lea ecx, [ebp - 0x344]
call fcn.10013b14
cmp esi, dword [eax]
jg 0x10026fcc
cmp dword [ebp - 0x6dc], 0
jne 0x10026fcc
and dword [ebp - 0x6e4], 0
jmp 0x10026fd6
mov dword [ebp - 0x6e4], 1
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0x5c], eax
mov esi, dword [ebp - 0x5c]
push 0
lea ecx, [ebp - 0x344]
call fcn.10013b14
cmp dword [eax], esi
jl 0x10026fff
mov dword [ebp - 0x6ec], 1
jmp 0x10027006
and dword [ebp - 0x6ec], 0
push 1
lea ecx, [ebp - 0x10a4]
call fcn.10013b14
mov ecx, dword [ebp - 0x6ec]
cmp ecx, dword [eax]
jne 0x10027029
mov dword [ebp - 0x6f4], 1
jmp 0x10027030
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x210]
cmp dword [ebp - 0x6f4], eax
jne 0x1002704a
mov dword [ebp - 0x6fc], 1
jmp 0x10027051
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x210]
imul eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0x210]
sub ecx, eax
cmp ecx, dword [ebp - 0x6fc]
jge 0x10027086
mov dword [ebp - 0x704], 1
jmp 0x1002708d
and dword [ebp - 0x704], 0
push 0
lea ecx, [ebp - 0x344]
call fcn.10013b14
mov ecx, dword [ebp - 0x704]
mov dword [eax], ecx
jmp 0x100270c4
mov dword [ebp - 0xe40], 0xfffffff8
mov dword [ebp - 0xd98], 0x7b08ccf5
mov eax, dword [ebp - 0xe40]
mov dword [ebp - 0xd98], eax
mov byte [ebp - 0x19d], 0
movzx eax, byte [ebp - 0x19d]
test eax, eax
je 0x100270ea
push 0x1e81
push 0
push 0x1ea5
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x10a4]
call fcn.10013af8
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x13b8]
call fcn.10013af8
jmp 0x100271ca
mov dword [ebp - 0x70c], 0x1be81b99
cmp dword [ebp - 0x724], 0
je 0x100271ae
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x125c], eax
cmp dword [ebp - 0x6c], 0
je 0x1002718a
cmp dword [ebp - 0x70c], 0xdc3
jle 0x1002714b
mov dword [ebp - 0x714], 1
jmp 0x10027152
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x70c]
cmp dword [ebp - 0x714], eax
jg 0x1002716c
mov dword [ebp - 0x71c], 1
jmp 0x10027173
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x71c], eax
jge 0x1002718a
mov dword [ebp - 0x72c], 1
jmp 0x10027191
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x724]
imul eax, dword [ebp - 0x72c]
test eax, eax
je 0x100271ae
mov dword [ebp - 0x734], 1
jmp 0x100271b5
and dword [ebp - 0x734], 0
push 0
lea ecx, [ebp - 0x344]
call fcn.10013b14
mov ecx, dword [ebp - 0x734]
mov dword [eax], ecx
push 3
lea ecx, [ebp - 0x10b0]
call fcn.10013b14
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0x174], eax
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x10b0]
call fcn.10013af8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x344]
call fcn.10013af8
lea eax, [ebp - 0x13ac]
push eax
mov ecx, 0x10609a08
call fcn.10013bda
push eax
lea ecx, [ebp - 0x74c]
call fcn.10013e38
movzx eax, al
test eax, eax
je 0x10027381
or dword [ebp - 0x103c], 0xffffffff
or dword [ebp - 0x1038], 0xffffffff
or dword [ebp - 0x1034], 0xffffffff
or dword [ebp - 0x1030], 0xffffffff
lea ecx, [ebp - 0x49d]
call fcn.100145b6
push eax
lea eax, [ebp - 0x102c]
push eax
lea eax, [ebp - 0x103c]
push eax
lea ecx, [ebp - 0x1550]
call fcn.1002c975
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x153c]
call fcn.1002c94f
mov dword [ebp - 4], 0x32
mov dword [ebp - 0x348], 0
mov dword [ebp - 0x348], 0
jmp 0x100272b2
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 3
jg 0x1002735e
mov dword [ebp - 0x1264], 3
mov dword [ebp - 0x149c], 5
mov dword [ebp - 0x126c], 9
mov dword [ebp - 0x13bc], 0xfffffffd
push 2
lea ecx, [ebp - 0x13c8]
call fcn.10013a9c
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x744], 0xffffffff
mov dword [ebp - 0x350], 0
jmp 0x1002731b
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 2
jge 0x1002733d
push dword [ebp - 0x350]
lea ecx, [ebp - 0x13c8]
call fcn.10013b14
mov dword [eax], 0x4c38b6b0
jmp 0x1002730e
mov eax, dword [ebp - 0x744]
inc eax
mov dword [ebp - 0x744], eax
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x13c8]
call fcn.10013af8
jmp 0x100272a5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x153c]
call fcn.10013af8
lea ecx, [ebp - 0x74c]
call fcn.1002c9d0
mov eax, dword [eax + 4]
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x358], 0x17f75960
mov dword [ebp - 0x368], 0
mov dword [ebp - 0x218], 0
push 1
lea ecx, [ebp - 0xe8c]
call fcn.10013a9c
mov dword [ebp - 4], 0x34
mov dword [ebp - 0x75c], 0x8405cefd
mov dword [ebp - 0x360], 0xffffffff
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0xda0], 0xfffffffc
mov dword [ebp - 0xb4], 0
jmp 0x100273f4
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x10027416
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xe8c]
call fcn.10013b14
mov dword [eax], 0xfbce008f
jmp 0x100273e7
mov dword [ebp - 0xb4], 0
jmp 0x1002742f
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jge 0x1002744b
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0xfc4], 0x73598422
jmp 0x10027422
mov dword [ebp - 0x358], 0xffff
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x1274], eax
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0xee0], eax
push 0
lea ecx, [ebp - 0xe8c]
call fcn.10013b14
mov ecx, dword [ebp - 0xee0]
mov dword [eax], ecx
cmp dword [ebp - 0x218], 0x8ed4
jne 0x1002749a
mov dword [ebp - 0x754], 1
jmp 0x100274a1
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x75c], eax
cmp dword [ebp - 0x75c], 0
jne 0x100274c8
mov eax, 0xffff
test eax, eax
jne 0x100274c8
and dword [ebp - 0x764], 0
jmp 0x100274d2
mov dword [ebp - 0x764], 1
cmp dword [ebp - 0x764], 0
je 0x100274f0
cmp dword [ebp - 0x358], 0
je 0x100274f0
mov dword [ebp - 0x76c], 1
jmp 0x100274f7
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x76c]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x145c], eax
mov eax, dword [ebp - 0x358]
neg eax
imul eax, dword [ebp - 0x358]
mov dword [ebp - 0x368], eax
push 0
lea ecx, [ebp - 0xe8c]
call fcn.10013b14
mov eax, dword [eax]
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x368]
cmp eax, dword [ebp - 0x45c]
jne 0x10027553
mov dword [ebp - 0x774], 1
jmp 0x1002755a
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x774], eax
jle 0x10027574
mov dword [ebp - 0x77c], 1
jmp 0x1002757b
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x77c]
add eax, 0x59ec1348
cmp eax, dword [ebp - 0x218]
jg 0x1002759a
mov dword [ebp - 0x784], 1
jmp 0x100275a1
and dword [ebp - 0x784], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x784]
mov dword [ebp + eax - 0xfc4], ecx
push 0
lea ecx, [ebp - 0xe8c]
call fcn.10013b14
cmp dword [eax], 0
je 0x1002769e
mov eax, dword [ebp - 0x45c]
cmp eax, dword [ebp - 0x368]
jl 0x100275e4
mov dword [ebp - 0x78c], 1
jmp 0x100275eb
and dword [ebp - 0x78c], 0
cmp dword [ebp - 0x78c], 0xfff9
jne 0x10027603
mov dword [ebp - 0x794], 1
jmp 0x1002760a
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x360]
cmp eax, dword [ebp - 0x794]
jge 0x10027624
mov dword [ebp - 0x79c], 1
jmp 0x1002762b
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x360]
imul eax, dword [ebp - 0x79c]
test eax, eax
je 0x10027658
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xfc4], 0
je 0x10027658
mov dword [ebp - 0x7a4], 1
jmp 0x1002765f
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x7a4]
add eax, 0x56cd219f
cmp eax, 0xfffc
jae 0x1002767d
mov dword [ebp - 0x7ac], 1
jmp 0x10027684
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0xda0]
cmp dword [ebp - 0x7ac], eax
jne 0x1002769e
mov dword [ebp - 0x7b4], 1
jmp 0x100276a5
and dword [ebp - 0x7b4], 0
cmp dword [ebp - 0x7b4], 2
jae 0x100276ba
mov dword [ebp - 0x7bc], 1
jmp 0x100276c1
and dword [ebp - 0x7bc], 0
cmp dword [ebp - 0x7bc], 0xffffffff
jne 0x100276d6
mov dword [ebp - 0x7c4], 1
jmp 0x100276dd
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x368], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8c]
call fcn.10013af8
cmp dword [ebp - 0x1bc], 0xffffffff
jne 0x100293a0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x7dc], 0xa77b69c9
mov dword [ebp - 0xdb0], 0xfffffffc
mov dword [ebp - 0x127c], 0xbb218ad3
mov dword [ebp - 0x13cc], 0xc0f3adcf
mov dword [ebp - 0x1284], 0xfffffffb
mov dword [ebp - 0x40], 0
jmp 0x1002774e
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x10027764
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xfac], 0xffff
jmp 0x10027747
mov dword [ebp - 0x40], 0
jmp 0x10027774
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x1002778a
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x13f0], 1
jmp 0x1002776d
mov dword [ebp - 0x40], 0
jmp 0x1002779a
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x100277b0
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x844], 0x8d81c919
jmp 0x10027793
mov dword [ebp - 0x74], 0
jmp 0x100277c0
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xa
jne 0x10027afa
mov dword [ebp - 0x1b8], 0xe17c
cmp dword [ebp - 0x1b8], 0
je 0x10027ab2
push 1
lea ecx, [ebp - 0xf9c]
call fcn.10013a9c
mov dword [ebp - 4], 0x35
mov dword [ebp - 0xe50], 0
mov dword [ebp - 0xef8], 7
mov dword [ebp - 0x370], 0
jmp 0x10027822
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 1
jge 0x10027841
push dword [ebp - 0x370]
lea ecx, [ebp - 0xf9c]
call fcn.10013b14
and dword [eax], 0
jmp 0x10027815
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x128c], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x13dc], eax
cmp dword [ebp - 0x1b8], 0
je 0x1002786e
cmp dword [ebp - 0x74], 0
je 0x1002786e
mov dword [ebp - 0x7cc], 1
jmp 0x10027875
and dword [ebp - 0x7cc], 0
cmp dword [ebp - 0x7cc], 0xfffd
jae 0x1002788d
mov dword [ebp - 0x7d4], 1
jmp 0x10027894
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x7d4]
neg eax
mov dword [ebp - 0x7dc], eax
mov eax, dword [ebp - 0x7dc]
sub eax, 5
cmp eax, dword [ebp - 0x1b8]
jl 0x100278c5
mov eax, 0xf5cb
test eax, eax
jne 0x100278c5
and dword [ebp - 0x7e4], 0
jmp 0x100278cf
mov dword [ebp - 0x7e4], 1
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x7e4], eax
jg 0x100278e6
mov dword [ebp - 0x7ec], 1
jmp 0x100278ed
and dword [ebp - 0x7ec], 0
cmp dword [ebp - 0x7ec], 1
ja 0x10027911
push 0
lea ecx, [ebp - 0xf9c]
call fcn.10013b14
cmp dword [eax], 0
jne 0x10027911
and dword [ebp - 0x7f4], 0
jmp 0x1002791b
mov dword [ebp - 0x7f4], 1
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x7f4], eax
je 0x10027935
mov dword [ebp - 0x7fc], 1
jmp 0x1002793c
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x7fc]
sub eax, dword [ebp - 0x74]
cmp eax, 0xbab72157
je 0x10027961
cmp dword [ebp - 0xe50], 0
je 0x10027961
mov dword [ebp - 0xda8], 1
jmp 0x10027968
and dword [ebp - 0xda8], 0
mov esi, dword [ebp - 0xef8]
push 0
lea ecx, [ebp - 0xf9c]
call fcn.10013b14
cmp esi, dword [eax]
jne 0x1002798b
mov dword [ebp - 0x804], 1
jmp 0x10027992
and dword [ebp - 0x804], 0
cmp dword [ebp - 0x804], 0x70d9
jne 0x100279aa
mov dword [ebp - 0x80c], 1
jmp 0x100279b1
and dword [ebp - 0x80c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xfac]
imul eax, dword [ebp - 0x80c]
cmp eax, 0xc37f
jl 0x100279d8
mov dword [ebp - 0x814], 1
jmp 0x100279df
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x814]
je 0x100279f6
mov dword [ebp - 0x81c], 1
jmp 0x100279fd
and dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 0x530de9bf
jne 0x10027a15
mov dword [ebp - 0x824], 1
jmp 0x10027a1c
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x824], eax
je 0x10027a36
mov dword [ebp - 0x82c], 1
jmp 0x10027a3d
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x74]
imul eax, dword [ebp - 0x82c]
cmp eax, 0x60abed99
jg 0x10027a5a
mov dword [ebp - 0x834], 1
jmp 0x10027a61
and dword [ebp - 0x834], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x834]
sub ecx, dword [ebp - 0x1b8]
imul ecx, ecx, 0x94ad
cmp ecx, dword [ebp + eax - 0xfac]
jle 0x10027a8e
mov dword [ebp - 0x83c], 1
jmp 0x10027a95
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0xdb0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf9c]
call fcn.10013af8
jmp 0x10027af5
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x10027ad6
push 0x318
push 0
push 0x220f
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov byte [ebp - 0x190], 0
movzx eax, byte [ebp - 0x190]
test eax, eax
je 0x10027af5
push 0
push 0x16ce
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x100277b9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x844]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x844], eax
mov ecx, 0x10609a08
call fcn.1002ca14
mov ecx, dword [ebp - 0x108]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x10609a08
call fcn.1002ca18
and dword [ebp - 0x1b4], 0
jmp 0x10027b49
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x1b4]
cmp ecx, dword [eax + 0x18]
jae 0x100293a0
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x1cc]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x1b4]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x89c], eax
mov dword [ebp - 0x1064], 0xfffffffb
mov dword [ebp - 0x1060], 0xfffffffb
mov dword [ebp - 0x105c], 0xfffffffb
mov dword [ebp - 0x1058], 0xfffffffb
lea ecx, [ebp - 0x409]
call fcn.100145b6
push eax
lea eax, [ebp - 0x1054]
push eax
lea eax, [ebp - 0x1064]
push eax
lea ecx, [ebp - 0x15a8]
call fcn.1002c975
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe9c]
call fcn.1002c94f
mov dword [ebp - 4], 0x36
mov dword [ebp - 0x100], 0x94a1888
mov dword [ebp - 0x84c], 1
mov dword [ebp - 0xdc0], 0xf5a2f617
mov dword [ebp - 0x100], 3
jmp 0x10027c17
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jl 0x10027dc4
mov dword [ebp - 0x1d0], 0xffffffff
mov dword [ebp - 0xee8], 0xffffffff
mov dword [ebp - 0x1d0], 0
jmp 0x10027c51
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 3
jg 0x10027dbf
mov dword [ebp - 0x10c], 0xd00693e9
mov dword [ebp - 0xe60], 0x56e348cc
mov dword [ebp - 0x10c], 0
jmp 0x10027c8b
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 3
jg 0x10027cda
mov byte [ebp - 0x145], 0
movzx eax, byte [ebp - 0x145]
test eax, eax
je 0x10027cb0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0xe9c]
call fcn.10013b14
mov esi, eax
push dword [ebp - 0x10c]
lea ecx, [ebp - 0xe9c]
call fcn.10013b14
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x10027c7e
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xe60], eax
mov dword [ebp - 0x84c], 0xfffb
mov eax, dword [ebp - 0x84c]
mov dword [ebp - 0x1294], eax
cmp dword [ebp - 0x10c], 0
jne 0x10027d11
mov dword [ebp - 0x854], 1
jmp 0x10027d18
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x13f8], eax
mov esi, dword [ebp - 0x10c]
push dword [ebp - 0x100]
lea ecx, [ebp - 0xe9c]
call fcn.10013b14
cmp esi, dword [eax]
jge 0x10027d51
mov dword [ebp - 0xdb8], 1
jmp 0x10027d58
and dword [ebp - 0xdb8], 0
mov eax, dword [ebp - 0xee8]
mov dword [ebp - 0x129c], eax
cmp dword [ebp - 0x10c], 0
jne 0x10027d79
mov dword [ebp - 0x85c], 1
jmp 0x10027d80
and dword [ebp - 0x85c], 0
push dword [ebp - 0x100]
lea ecx, [ebp - 0xe9c]
call fcn.10013b14
mov eax, dword [eax]
cmp eax, dword [ebp - 0x85c]
jne 0x10027da7
mov dword [ebp - 0x864], 1
jmp 0x10027dae
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0xdc0], eax
jmp 0x10027c44
jmp 0x10027c0a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe9c]
call fcn.10013af8
cmp dword [ebp - 0x89c], 0
je 0x1002939b
mov dword [ebp - 0x1c0], 1
mov dword [ebp - 0x408], 0x3f23e93d
cmp dword [ebp - 0x1c0], 0x8d581621
ja 0x10027e0c
mov dword [ebp - 0x884], 1
jmp 0x10027e13
and dword [ebp - 0x884], 0
cmp dword [ebp - 0x1c0], 1
jge 0x10027e28
mov dword [ebp - 0x86c], 1
jmp 0x10027e2f
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x86c], eax
jne 0x10027e49
mov dword [ebp - 0x874], 1
jmp 0x10027e50
and dword [ebp - 0x874], 0
cmp dword [ebp - 0x874], 0
jg 0x10027e65
mov dword [ebp - 0xe70], 1
jmp 0x10027e6c
and dword [ebp - 0xe70], 0
cmp dword [ebp - 0x1c0], 0x49f4
jl 0x10027e84
mov dword [ebp - 0x87c], 1
jmp 0x10027e8b
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
je 0x10027eb5
cmp dword [ebp - 0x1c0], 0
je 0x10027eb5
mov dword [ebp - 0x88c], 1
jmp 0x10027ebc
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x884]
cmp eax, dword [ebp - 0x88c]
jg 0x10027ed6
mov dword [ebp - 0x894], 1
jmp 0x10027edd
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x894], eax
jl 0x10027f0e
or eax, 0xffffffff
je 0x10027f0e
mov byte [ebp - 0x123], 0
movzx eax, byte [ebp - 0x123]
test eax, eax
je 0x10027f0c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
jmp 0x10027f2d
mov byte [ebp - 0x198], 0
movzx eax, byte [ebp - 0x198]
test eax, eax
je 0x10027f2d
push 0
push 0x2164
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0x408], 1
mov eax, dword [ebp - 0x89c]
mov ecx, dword [ebp - 0x1cc]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x1578]
call fcn.1002c90d
mov dword [ebp - 4], 0x37
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1578]
call fcn.10017455
mov dword [ebp - 0xa94], eax
mov dword [ebp - 0x84], 0xb34e6d4f
mov dword [ebp - 0x7c], 0x9ed9ba07
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x410], 0x1cb6a7f4
mov dword [ebp - 0x54], 0x7501
mov dword [ebp - 0x378], 0
jmp 0x10027fb1
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 1
jge 0x10027fcd
mov eax, dword [ebp - 0x378]
mov dword [ebp + eax*4 - 0xa4], 0
jmp 0x10027fa4
mov eax, dword [ebp - 0x84]
sub eax, 7
cmp eax, 0xd29be1d9
jb 0x10027fe9
mov dword [ebp - 0x8a4], 1
jmp 0x10027ff0
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x7c]
imul eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x84], 0
je 0x10028054
cmp dword [ebp - 0x84], 1
jne 0x1002801b
mov dword [ebp - 0x8ac], 1
jmp 0x10028022
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x8ac], eax
je 0x10028039
mov dword [ebp - 0x8b4], 1
jmp 0x10028040
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x8b4], eax
jl 0x10028054
and dword [ebp - 0x8bc], 0
jmp 0x1002805e
mov dword [ebp - 0x8bc], 1
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x220]
jne 0x10028084
mov dword [ebp - 0x8c4], 1
jmp 0x1002808b
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x84]
sub eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x8c4]
je 0x1002827f
mov dword [ebp - 0x1e8], 5
mov dword [ebp - 0xfbc], 0xe5c7d816
mov dword [ebp - 0xfb8], 0xe5c7d816
mov dword [ebp - 0xfb4], 0xe5c7d816
mov dword [ebp - 0xfb0], 0xe5c7d816
cmp dword [ebp - 0x410], 0
jne 0x100281d2
mov eax, dword [ebp - 0x1e8]
sub eax, 0x6e061960
cmp dword [ebp - 0x1e8], eax
jle 0x100280fe
mov dword [ebp - 0x8cc], 1
jmp 0x10028105
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x1e8]
mov eax, dword [ebp - 0x220]
sub eax, dword [ebp - 0x84]
cmp dword [ebp - 0x410], eax
jne 0x1002812b
mov dword [ebp - 0x8d4], 1
jmp 0x10028132
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0x8d4], eax
jle 0x1002814c
mov dword [ebp - 0x8dc], 1
jmp 0x10028153
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0x8dc], eax
jne 0x1002816d
mov dword [ebp - 0x8e4], 1
jmp 0x10028174
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x8e4], eax
je 0x1002818b
mov dword [ebp - 0x8ec], 1
jmp 0x10028192
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x8ec]
inc eax
cmp eax, dword [ebp - 0x84]
jle 0x100281ad
mov dword [ebp - 0x8f4], 1
jmp 0x100281b4
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x100281d2
and dword [ebp - 0x8fc], 0
jmp 0x100281dc
mov dword [ebp - 0x8fc], 1
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0x8fc], eax
jl 0x100281f6
mov dword [ebp - 0x904], 1
jmp 0x100281fd
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x7c], 3
jmp 0x10028219
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jl 0x1002827a
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x10028264
push 0x197d
push 0xf5d
push 0x1a9e
push 0x928
push 0x11c8
push 0xbeb
push 0x1627
push 0x9f2
push 0x2a9
call dword [sym.imp.GDI32.dll_Arc]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp + eax*4 - 0xfbc]
mov ecx, dword [ebp - 0x7c]
mov dword [ebp + ecx*4 - 0xfbc], eax
jmp 0x10028212
jmp 0x10028533
push 3
lea ecx, [ebp - 0x10c8]
call fcn.10013a9c
mov byte [ebp - 4], 0x38
mov dword [ebp - 0x380], 0
jmp 0x100282a9
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 3
jge 0x100282cb
push dword [ebp - 0x380]
lea ecx, [ebp - 0x10c8]
call fcn.10013b14
mov dword [eax], 0x418f7f2f
jmp 0x1002829c
xor eax, eax
je 0x100282f8
mov byte [ebp - 0x192], 0
movzx eax, byte [ebp - 0x192]
test eax, eax
je 0x100282f3
push 0
push 0x10ac
push 0x1a6b
call dword [sym.imp.GDI32.dll_CreatePen]
jmp 0x10028524
mov dword [ebp - 0x914], 0x5f67326d
mov dword [ebp - 0x54], 0
jmp 0x10028312
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jg 0x10028524
push 4
lea ecx, [ebp - 0xf78]
call fcn.10013a9c
mov byte [ebp - 4], 0x39
mov dword [ebp - 0x388], 0
jmp 0x10028346
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 4
jge 0x10028368
push dword [ebp - 0x388]
lea ecx, [ebp - 0xf78]
call fcn.10013b14
mov dword [eax], 0x9e1c2102
jmp 0x10028339
mov dword [ebp - 0x84], 0
jmp 0x10028381
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jg 0x10028510
mov dword [ebp - 0xe80], 0xecb6aef2
push 0
lea ecx, [ebp - 0x10c8]
call fcn.10013b14
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ebp + ecx*4 - 0xa4]
cmp ecx, dword [ebp + eax - 0xa4]
je 0x100283ca
mov dword [ebp - 0x90c], 1
jmp 0x100283d1
and dword [ebp - 0x90c], 0
cmp dword [ebp - 0x90c], 0xffffffff
jge 0x100283e6
mov dword [ebp - 0xdc8], 1
jmp 0x100283ed
and dword [ebp - 0xdc8], 0
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x13ec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa4], 0xece5
jl 0x10028418
mov dword [ebp - 0x91c], 1
jmp 0x1002841f
and dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x914]
cmp dword [ebp - 0x91c], eax
je 0x10028439
mov dword [ebp - 0x924], 1
jmp 0x10028440
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x54]
mov esi, dword [ebp + eax*4 - 0xa4]
push 1
lea ecx, [ebp - 0xf78]
call fcn.10013b14
mov ecx, dword [ebp - 0x924]
imul ecx, dword [eax]
cmp ecx, esi
jne 0x10028470
mov dword [ebp - 0xf14], 1
jmp 0x10028477
and dword [ebp - 0xf14], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0xa4]
mov dword [ebp - 0x12a4], eax
push 2
lea ecx, [ebp - 0xf78]
call fcn.10013b14
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ebp + ecx*4 - 0xa4]
sub ecx, eax
jne 0x100284b1
mov dword [ebp - 0x92c], 1
jmp 0x100284b8
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0xa4]
cmp dword [ebp - 0x92c], eax
jge 0x100284d6
mov dword [ebp - 0xdd0], 1
jmp 0x100284dd
and dword [ebp - 0xdd0], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0xa4]
mov dword [ebp - 0x1400], eax
mov dword [ebp - 0xe80], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0xa4]
mov ecx, dword [ebp - 0x54]
mov dword [ebp + ecx*4 - 0xa4], eax
jmp 0x10028374
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xf78]
call fcn.10013af8
jmp 0x1002830b
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x10c8]
call fcn.10013af8
movzx eax, byte [0x106098a0]
test eax, eax
je 0x10028553
mov ecx, 0x10609a08
call fcn.1002c9c7
movzx eax, al
test eax, eax
jne 0x100291ab
mov dword [ebp - 0x1a8], 0x822b1658
mov dword [ebp - 0x430], 7
mov dword [ebp - 0x418], 0x942075d7
mov dword [ebp - 0xbc], 0
jmp 0x1002858a
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x100285a6
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x228], 8
jmp 0x1002857d
mov dword [ebp - 0xbc], 0
jmp 0x100285bf
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x100285db
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x11b8], 0xdacb314b
jmp 0x100285b2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x228], 0x2721
jge 0x100285fa
mov dword [ebp - 0x934], 1
jmp 0x10028601
and dword [ebp - 0x934], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
imul eax, dword [ebp - 0x934]
cmp eax, 1
jne 0x10028636
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x228], 0
je 0x10028636
mov dword [ebp - 0x93c], 1
jmp 0x1002863d
and dword [ebp - 0x93c], 0
cmp dword [ebp - 0x93c], 0xa2b3b7be
ja 0x10028655
mov dword [ebp - 0xc14], 1
jmp 0x1002865c
and dword [ebp - 0xc14], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x228]
imul ecx, dword [ebp - 0x1a8]
imul ecx, dword [ebp + eax - 0x228]
test ecx, ecx
je 0x10028b76
mov dword [ebp - 0xf34], 0xffffffff
mov dword [ebp - 0xf30], 0xffffffff
mov dword [ebp - 0xf2c], 0xffffffff
mov dword [ebp - 0xf28], 0xffffffff
mov dword [ebp - 0x954], 6
mov dword [ebp - 0x428], 0x1cb64b69
mov dword [ebp - 0x390], 0x520f3038
mov dword [ebp - 0x12ac], 0x5807c1a
mov dword [ebp - 0x9dc], 0xaf1e2cd8
push 3
lea ecx, [ebp - 0xf90]
call fcn.10013a9c
mov byte [ebp - 4], 0x3a
mov dword [ebp - 0x9a4], 0x1cc0
mov dword [ebp - 0xc1c], 0
push 2
lea ecx, [ebp - 0x10e0]
call fcn.10013a9c
mov byte [ebp - 4], 0x3b
mov dword [ebp - 0xc4], 0
jmp 0x1002872f
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x10028751
push dword [ebp - 0xc4]
lea ecx, [ebp - 0xf90]
call fcn.10013b14
mov dword [eax], 0x9e1f9531
jmp 0x10028722
mov dword [ebp - 0xc4], 0
jmp 0x1002876a
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jge 0x1002878c
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x10e0]
call fcn.10013b14
mov dword [eax], 0xba01c9ac
jmp 0x1002875d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xf34], 0
je 0x10028aa0
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xf34], 0
je 0x10028824
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1a8]
cmp ecx, dword [ebp + eax - 0x228]
jg 0x100287d1
mov dword [ebp - 0x944], 1
jmp 0x100287d8
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0xc1c]
cmp dword [ebp - 0x944], eax
jg 0x100287f2
mov dword [ebp - 0x94c], 1
jmp 0x100287f9
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0x954], eax
mov eax, dword [ebp - 0x954]
add eax, 0x5393f1bf
cmp eax, dword [ebp - 0x9dc]
jg 0x10028824
mov dword [ebp - 0x95c], 1
jmp 0x1002882b
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x95c]
add eax, 0xf2db
je 0x1002884d
mov eax, 0x3def5731
test eax, eax
je 0x1002884d
mov dword [ebp - 0x964], 1
jmp 0x10028854
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x964], eax
jle 0x1002886e
mov dword [ebp - 0x974], 1
jmp 0x10028875
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x96c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x96c]
mov dword [ebp + eax - 0x11b8], ecx
mov eax, dword [ebp - 0x96c]
mov dword [ebp - 0x430], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x974]
sub ecx, dword [ebp + eax - 0xf34]
mov eax, dword [ebp - 0x430]
sub eax, ecx
mov dword [ebp - 0xc24], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
mov dword [ebp - 0xc2c], eax
mov eax, dword [ebp - 0x418]
inc eax
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0xc24]
cmp eax, dword [ebp - 0xc2c]
jle 0x100288fb
mov dword [ebp - 0x97c], 1
jmp 0x10028902
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x97c]
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x390]
add eax, dword [ebp - 0x9a4]
cmp eax, 0xffffffff
jne 0x1002892b
mov dword [ebp - 0x984], 1
jmp 0x10028932
and dword [ebp - 0x984], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x228]
cmp dword [ebp - 0x984], eax
jle 0x1002895c
cmp dword [ebp - 0x390], 0
je 0x1002895c
mov dword [ebp - 0x98c], 1
jmp 0x10028963
and dword [ebp - 0x98c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
add eax, dword [ebp - 0x98c]
cmp eax, 1
jle 0x10028987
mov dword [ebp - 0x994], 1
jmp 0x1002898e
and dword [ebp - 0x994], 0
cmp dword [ebp - 0x994], 0x59e8
jl 0x100289ac
cmp dword [ebp - 0x1a8], 0
jne 0x100289ac
and dword [ebp - 0x99c], 0
jmp 0x100289b6
mov dword [ebp - 0x99c], 1
cmp dword [ebp - 0x99c], 0
je 0x100289db
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x228], 0
je 0x100289db
mov dword [ebp - 0x9ac], 1
jmp 0x100289e2
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0x9a4]
cmp dword [ebp - 0x9ac], eax
jne 0x100289fc
mov dword [ebp - 0x9b4], 1
jmp 0x10028a03
and dword [ebp - 0x9b4], 0
push 0
lea ecx, [ebp - 0xf90]
call fcn.10013b14
mov ecx, dword [ebp - 0x9b4]
cmp ecx, dword [eax]
jl 0x10028a26
mov dword [ebp - 0x420], 1
jmp 0x10028a2d
and dword [ebp - 0x420], 0
push 1
lea ecx, [ebp - 0xf90]
call fcn.10013b14
mov ecx, dword [ebp - 0x420]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
cmp eax, dword [ebp - 0x420]
jge 0x10028a63
mov dword [ebp - 0x9bc], 1
jmp 0x10028a6a
and dword [ebp - 0x9bc], 0
mov eax, dword [ebp - 0x428]
cmp dword [ebp - 0x9bc], eax
jg 0x10028a84
mov dword [ebp - 0x9c4], 1
jmp 0x10028a8b
and dword [ebp - 0x9c4], 0
cmp dword [ebp - 0x9c4], 1
jle 0x10028aa0
mov dword [ebp - 0x9cc], 1
jmp 0x10028aa7
and dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x9cc], eax
jge 0x10028ac1
mov dword [ebp - 0x9d4], 1
jmp 0x10028ac8
and dword [ebp - 0x9d4], 0
mov eax, dword [ebp - 0x9d4]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x428]
cmp eax, dword [ebp - 0x9dc]
je 0x10028aee
mov dword [ebp - 0x9e4], 1
jmp 0x10028af5
and dword [ebp - 0x9e4], 0
push 0
lea ecx, [ebp - 0x10e0]
call fcn.10013b14
mov ecx, dword [ebp - 0x9e4]
mov dword [eax], ecx
cmp dword [ebp - 0x1a8], 0x2f30
jge 0x10028b22
mov dword [ebp - 0x9ec], 1
jmp 0x10028b29
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x430]
cmp eax, dword [ebp - 0x9ec]
jg 0x10028b43
mov dword [ebp - 0x9f4], 1
jmp 0x10028b4a
and dword [ebp - 0x9f4], 0
mov eax, dword [ebp - 0x9f4]
mov dword [ebp - 0x390], eax
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x10e0]
call fcn.10013af8
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0xf90]
call fcn.10013af8
jmp 0x10028b9b
mov byte [ebp - 0x19c], 0
movzx eax, byte [ebp - 0x19c]
test eax, eax
je 0x10028b9b
push 0
push 0
push 0xfdb
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
lea eax, [ebp - 0xa94]
push eax
mov ecx, 0x10609a08
call fcn.1002c9d6
mov ecx, dword [ebp - 0x1b4]
mov dword [eax], ecx
mov dword [ebp - 0x90], 1
push 2
lea ecx, [ebp - 0xbb0]
call fcn.10013a9c
mov byte [ebp - 4], 0x3c
mov dword [ebp - 0x1408], 0xbb6e743
mov dword [ebp - 0x398], 0
jmp 0x10028bf2
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 2
jge 0x10028c14
push dword [ebp - 0x398]
lea ecx, [ebp - 0xbb0]
call fcn.10013b14
mov dword [eax], 0xecba2afe
jmp 0x10028be5
mov dword [ebp - 0x90], 0xfffffff7
jmp 0x10028c2d
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 9
je 0x10029195
mov dword [ebp - 0x18], 0x8adae8c9
push 1
lea ecx, [ebp - 0x10f8]
call fcn.10013a9c
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0xc3c], 0x7d7132c2
mov dword [ebp - 0xc44], 5
mov dword [ebp - 0xc4c], 0x5aa1
mov dword [ebp - 0x3a0], 0
jmp 0x10028c89
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 1
jge 0x10028cab
push dword [ebp - 0x3a0]
lea ecx, [ebp - 0x10f8]
call fcn.10013b14
mov dword [eax], 0xfffffffd
jmp 0x10028c7c
mov dword [ebp - 0x18], 0
jmp 0x10028cbb
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x10028cd8
push dword [ebp - 0x18]
lea ecx, [ebp - 0xbb0]
call fcn.10013b14
cmp dword [eax], 0
je 0x10028cd6
jmp 0x10028cd8
jmp 0x10028cb4
mov dword [ebp - 0x18], 1
jmp 0x10028ce8
cmp dword [ebp - 0x18], 0
jl 0x10029181
mov dword [ebp - 0x1ac], 0xd4fce886
push 3
lea ecx, [ebp - 0xeac]
call fcn.10013a9c
mov byte [ebp - 4], 0x3e
mov dword [ebp - 0x3a8], 0
jmp 0x10028d26
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 3
jge 0x10028d48
push dword [ebp - 0x3a8]
lea ecx, [ebp - 0xeac]
call fcn.10013b14
mov dword [eax], 8
jmp 0x10028d19
push 0
lea ecx, [ebp - 0xbb0]
call fcn.10013b14
cmp dword [eax], 0x51cd25bb
jg 0x10028d69
mov dword [ebp - 0x9fc], 1
jmp 0x10028d70
and dword [ebp - 0x9fc], 0
cmp dword [ebp - 0x9fc], 0
jae 0x10028d85
mov dword [ebp - 0xa04], 1
jmp 0x10028d8c
and dword [ebp - 0xa04], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xa04]
jne 0x10028da3
mov dword [ebp - 0xa0c], 1
jmp 0x10028daa
and dword [ebp - 0xa0c], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0xbb0]
call fcn.10013b14
mov ecx, dword [ebp - 0xa0c]
cmp ecx, dword [eax]
jge 0x10028dce
mov dword [ebp - 0x438], 1
jmp 0x10028dd5
and dword [ebp - 0x438], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0xbb0]
call fcn.10013b14
mov ecx, dword [ebp - 0x438]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x438], eax
jg 0x10028e02
mov dword [ebp - 0xa14], 1
jmp 0x10028e09
and dword [ebp - 0xa14], 0
cmp dword [ebp - 0xa14], 0x5f1871d0
jle 0x10028e2a
mov eax, 0x722
test eax, eax
je 0x10028e2a
mov dword [ebp - 0xa1c], 1
jmp 0x10028e31
and dword [ebp - 0xa1c], 0
cmp dword [ebp - 0xa1c], 0xfffffffa
jl 0x10028e46
mov dword [ebp - 0xa24], 1
jmp 0x10028e4d
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0xa24], eax
jle 0x10028e67
mov dword [ebp - 0xa2c], 1
jmp 0x10028e6e
and dword [ebp - 0xa2c], 0
cmp dword [ebp - 0xa2c], 0xf8278b72
ja 0x10028e89
cmp dword [ebp - 0x18], 0
jne 0x10028e89
and dword [ebp - 0xa34], 0
jmp 0x10028e93
mov dword [ebp - 0xa34], 1
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0xa34], eax
jle 0x10028ead
mov dword [ebp - 0xc34], 1
jmp 0x10028eb4
and dword [ebp - 0xc34], 0
cmp dword [ebp - 0x18], 7
je 0x10028ec6
mov dword [ebp - 0xa3c], 1
jmp 0x10028ecd
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
cmp eax, dword [ebp - 0x90]
jge 0x10028ef3
mov dword [ebp - 0xa44], 1
jmp 0x10028efa
and dword [ebp - 0xa44], 0
cmp dword [ebp - 0xa44], 1
jge 0x10028f0f
mov dword [ebp - 0xa4c], 1
jmp 0x10028f16
and dword [ebp - 0xa4c], 0
push 0
lea ecx, [ebp - 0xeac]
call fcn.10013b14
mov ecx, dword [ebp - 0xa4c]
cmp ecx, dword [eax]
jle 0x10028f39
mov dword [ebp - 0xa54], 1
jmp 0x10028f40
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0xa54]
jne 0x10028f5a
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x10f8]
call fcn.10013af8
jmp 0x10028c20
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0xbb0]
call fcn.10013af8
mov byte [0x106098a0], 1
push 2
lea ecx, [ebp - 0x13e8]
call fcn.10013a9c
mov byte [ebp - 4], 0x40
mov dword [ebp - 0x3c0], 0
jmp 0x100291d5
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 2
jge 0x100291f7
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x13e8]
call fcn.10013b14
mov dword [eax], 0xa0256915
jmp 0x100291c8
mov byte [ebp - 0x194], 0
movzx eax, byte [ebp - 0x194]
test eax, eax
je 0x10029219
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtCreatePen]
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x10029235
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x13e8]
call fcn.10013af8
cmp dword [ebp - 0x1bc], 0xffffffff
jne 0x1002938c
mov eax, dword [ebp - 0xa94]
cmp eax, dword [ebp - 0x3c8]
jne 0x1002938c
mov dword [ebp - 0xcc], 2
mov dword [ebp - 0xed8], 7
mov dword [ebp - 0xed4], 7
mov dword [ebp - 0xed0], 7
mov dword [ebp - 0xecc], 7
mov dword [ebp - 0xaa4], 0x72b90f99
mov dword [ebp - 0xcc], 0xffffffee
jmp 0x100292b8
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xffffffe4
jne 0x100292ce
cmp dword [ebp - 0xcc], 0
je 0x100292cc
jmp 0x100292ce
jmp 0x100292ab
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x12b4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xed8]
mov dword [ebp - 0x14c8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xed8]
add eax, 0x34111d01
je 0x10029324
push 5
pop eax
test eax, eax
je 0x10029324
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xed8], 0
je 0x10029324
mov dword [ebp - 0xa9c], 1
jmp 0x1002932b
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0xa9c]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0xcc]
push 4
pop ecx
shl ecx, 1
mov edx, dword [ebp - 0xaa4]
sub edx, dword [ebp + ecx - 0xed8]
lea eax, [edx + eax + 0x2cc9105f]
cmp dword [ebp - 0xcc], eax
jle 0x1002936a
mov dword [ebp - 0xaac], 1
jmp 0x10029371
and dword [ebp - 0xaac], 0
mov eax, dword [ebp - 0xaac]
add eax, 6
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1bc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1578]
call fcn.100139fc
jmp 0x10027b3c
mov dword [ebp - 0x440], 0x8999d94b
mov dword [ebp - 0xac4], 0xffffffff
mov dword [ebp - 0xc54], 0x58f9c25b
mov dword [ebp - 0x3d0], 0
jmp 0x100293d7
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 3
jge 0x100293f3
mov eax, dword [ebp - 0x3d0]
mov dword [ebp + eax*4 - 0xbfc], 0
jmp 0x100293ca
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
push 4
pop edx
shl edx, 1
mov edx, dword [ebp + edx - 0xbfc]
imul edx, dword [ebp + ecx - 0xbfc]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xbfc]
sub ecx, edx
cmp ecx, dword [ebp + eax - 0xbfc]
jle 0x10029434
mov dword [ebp - 0xab4], 1
jmp 0x1002943b
and dword [ebp - 0xab4], 0
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0x440], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xbfc]
cmp ecx, dword [ebp + eax - 0xbfc]
jne 0x1002946e
mov dword [ebp - 0xabc], 1
jmp 0x10029475
and dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0xac4]
mov dword [ebp - 0xc54], eax
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x100294bc
push 0x203a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp dword [ebp + 0x10], 0
jne 0x100294eb
cmp dword [ebp - 0x1bc], 0xffffffff
je 0x100294eb
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x1cc]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x1bc]
mov ax, word [ecx + eax*2]
mov word [ebp - 0xb8], ax
mov dword [ebp - 0x80], 0xfffffff9
mov dword [ebp - 0x17c], 0x69ac
mov dword [ebp - 0x1c4], 0xffffffff
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x12bc], eax
cmp dword [ebp - 0x80], 0
jle 0x10029521
mov dword [ebp - 0xacc], 1
jmp 0x10029528
and dword [ebp - 0xacc], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0xacc], eax
jl 0x1002953f
mov dword [ebp - 0xc5c], 1
jmp 0x10029546
and dword [ebp - 0xc5c], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x13fc], eax
cmp dword [ebp - 0x80], 0
je 0x1002956d
mov eax, 0x9dce
test eax, eax
je 0x1002956d
mov dword [ebp - 0xad4], 1
jmp 0x10029574
and dword [ebp - 0xad4], 0
mov eax, dword [ebp - 0xad4]
sub eax, dword [ebp - 0x80]
je 0x10029585
cmp dword [ebp - 0x80], 0
jne 0x10029597
cmp dword [ebp - 0x17c], 0
jne 0x10029597
and dword [ebp - 0xadc], 0
jmp 0x100295a1
mov dword [ebp - 0xadc], 1
mov eax, dword [ebp - 0x80]
add eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0xadc]
je 0x100295bb
mov dword [ebp - 0xc64], 1
jmp 0x100295c2
and dword [ebp - 0xc64], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x12c4], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x1464], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x12cc], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x1c4], 0
jmp 0x10029602
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0x1e
jne 0x1002982b
mov dword [ebp - 0x184], 0xa97f
push 2
lea ecx, [ebp - 0xf6c]
call fcn.10013a9c
mov dword [ebp - 4], 0x41
mov dword [ebp - 0x3d8], 0
jmp 0x10029646
mov eax, dword [ebp - 0x3d8]
inc eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 2
jge 0x10029668
push dword [ebp - 0x3d8]
lea ecx, [ebp - 0xf6c]
call fcn.10013b14
mov dword [eax], 0x9495116
jmp 0x10029639
mov byte [ebp - 0x14d], 0
movzx eax, byte [ebp - 0x14d]
test eax, eax
je 0x10029689
push 0
push 0
push 0x121c
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
cmp dword [ebp - 0x184], 0
je 0x100297e0
push 2
lea ecx, [ebp - 0xebc]
call fcn.10013a9c
mov byte [ebp - 4], 0x42
mov dword [ebp - 0x3e0], 0
jmp 0x100296c0
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 2
jge 0x100296e2
push dword [ebp - 0x3e0]
lea ecx, [ebp - 0xebc]
call fcn.10013b14
mov dword [eax], 0xffff
jmp 0x100296b3
cmp dword [ebp - 0x1c4], 0
je 0x1002970e
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0xebc]
call fcn.10013af8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf6c]
call fcn.10013af8
jmp 0x1002982b
mov dword [ebp - 0x17c], 0xfffffff7
jmp 0x10029727
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0xe
jle 0x100297cf
mov dword [ebp - 0x184], 0
jmp 0x1002974d
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 1
jg 0x100297a1
push dword [ebp - 0x184]
lea ecx, [ebp - 0xebc]
call fcn.10013b14
mov dword [ebp - 0xae4], eax
push dword [ebp - 0x184]
lea ecx, [ebp - 0xebc]
call fcn.10013b14
mov ecx, dword [ebp - 0xae4]
mov eax, dword [eax]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xf6c]
call fcn.10013b14
mov ecx, dword [ebp - 0xae4]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10029740
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x100297ca
push 0x840
push 0x24f7
push 0xa35
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x1002971a
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0xebc]
call fcn.10013af8
jmp 0x10029817
mov byte [ebp - 0x19a], 0
movzx eax, byte [ebp - 0x19a]
test eax, eax
je 0x100297fd
push 0x4ec
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
mov byte [ebp - 0x196], 0
movzx eax, byte [ebp - 0x196]
test eax, eax
je 0x10029817
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf6c]
call fcn.10013af8
jmp 0x100295f5
movzx eax, word [ebp - 0xb8]
cmp eax, 0xffff
je 0x10029d08
movzx eax, word [ebp - 0xb8]
mov ecx, dword [ebp - 0x108]
mov edx, dword [ebp - 0x1cc]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0xc6c], eax
mov eax, dword [ebp - 0xc6c]
mov ecx, dword [ebp - 0x1cc]
add ecx, dword [eax]
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x108]
jbe 0x10029cfd
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x22c]
mov edx, dword [ebp - 0x108]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0x118], edx
jae 0x10029cfd
mov eax, dword [0x10609a30]
and eax, 2
jne 0x100298d6
mov eax, dword [0x10609a30]
or eax, 2
mov dword [0x10609a30], eax
mov dword [ebp - 4], 0x43
push 0x3057
call fcn.1000c4b9
pop ecx
mov byte [0x10609a04], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0xf8], 2
mov byte [ebp - 0xf7], 0x4c
mov byte [ebp - 0xf6], 0
mov byte [ebp - 0xf5], 8
mov byte [ebp - 0xf4], 1
mov byte [ebp - 0xf3], 8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0xf8]
and eax, 0x20
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0xf8]
or ecx, 0x20
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xf8]
mov byte [ebp + eax - 0x1d4], cl
mov dword [ebp - 0x110], 2
and dword [ebp - 0xaec], 0
jmp 0x1002995a
mov eax, dword [ebp - 0x110]
inc eax
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 6
jae 0x100299d7
mov eax, dword [ebp - 0x110]
sub eax, dword [ebp - 0xaec]
movzx eax, byte [ebp + eax - 0xfa]
movsx eax, byte [ebp + eax - 0x1d4]
mov ecx, dword [ebp - 0x110]
movzx ecx, byte [ebp + ecx - 0xf7]
and ecx, eax
mov eax, dword [ebp - 0x110]
sub eax, dword [ebp - 0xaec]
movzx eax, byte [ebp + eax - 0xfa]
movsx eax, byte [ebp + eax - 0x1d4]
mov edx, dword [ebp - 0x110]
movzx edx, byte [ebp + edx - 0xf7]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x110]
movzx eax, byte [ebp + eax - 0xf8]
mov byte [ebp + eax - 0x1d4], dl
jmp 0x1002994c
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x1d4], 0
mov eax, dword [0x10609a30]
and eax, 4
jne 0x10029a23
mov eax, dword [0x10609a30]
or eax, 4
mov dword [0x10609a30], eax
mov dword [ebp - 4], 0x44
lea eax, [ebp - 0x1d4]
push eax
mov ecx, 0x10609988
call fcn.1002c90d
push 0x10061b89
call fcn.10049d89
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x3e8], 0
jmp 0x10029a39
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 4
jae 0x10029a52
mov eax, dword [ebp - 0x3e8]
mov byte [ebp + eax - 0x1d4], 0
jmp 0x10029a2c
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x18c], eax
movsx eax, byte [0x10609a04]
mov ecx, dword [ebp - 0x18c]
movsx ecx, byte [ecx]
cmp ecx, eax
je 0x10029a81
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
jmp 0x10029a5e
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
push dword [ebp - 0x18c]
push dword [ebp - 0x118]
lea ecx, [ebp - 0x14e4]
call fcn.1002ceb0
mov dword [ebp - 4], 0x45
push 0x10609988
lea ecx, [ebp - 0x14e4]
call fcn.1002c930
lea eax, [ebp - 0x1404]
push eax
lea ecx, [ebp - 0x14e4]
call fcn.100144cd
push dword [eax]
lea eax, [ebp - 0x12d4]
push eax
lea ecx, [ebp - 0x14e4]
call fcn.100144b9
push dword [eax]
lea ecx, [ebp - 0x1598]
call fcn.1002ced9
mov byte [ebp - 4], 0x46
lea eax, [ebp - 0x1598]
push eax
call fcn.1001797f
pop ecx
mov dword [ebp - 0x448], eax
mov dword [ebp - 0xafc], 0x47d1
mov dword [ebp - 0xc7c], 0x1000806c
cmp dword [ebp - 0xafc], 0x488c
jle 0x10029bd7
and dword [ebp - 0x400], 0
jmp 0x10029b40
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 0x6b0e
jge 0x10029bd7
and dword [ebp - 0x3f0], 0
jmp 0x10029b66
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0x1940
jge 0x10029bd2
and dword [ebp - 0x3f8], 0
jmp 0x10029b88
mov eax, dword [ebp - 0x3f8]
inc eax
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0x1ced
jge 0x10029bd0
mov eax, dword [ebp - 0x3f0]
imul eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x400]
sub ecx, eax
mov eax, ecx
cdq
mov dword [ebp - 0xd28], eax
mov dword [ebp - 0xd24], edx
push dword [ebp - 0xd24]
push dword [ebp - 0xd28]
mov ecx, 0x10607b78
call fcn.10013775
jmp 0x10029b7b
jmp 0x10029b59
jmp 0x10029b33
cmp dword [ebp - 0x448], 0
je 0x10029c5d
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x1530]
call fcn.1002c90d
mov byte [ebp - 4], 0x47
lea edx, [ebp - 0xc74]
lea ecx, [ebp - 0x1530]
call fcn.10017596
movzx eax, al
test eax, eax
je 0x10029c2d
push 0
push dword [ebp - 0xc74]
push 0
push dword [ebp - 0x448]
call fcn.10020060
add esp, 0x10
mov dword [ebp - 0x118], eax
jmp 0x10029c4c
push 1
push 0
lea eax, [ebp - 0x1530]
push eax
push dword [ebp - 0x448]
call fcn.10020060
add esp, 0x10
mov dword [ebp - 0x118], eax
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x1530]
call fcn.100139fc
jmp 0x10029c93
cmp dword [ebp + 0x10], 0
jne 0x10029c73
mov ecx, dword [ebp + 0xc]
call fcn.10013755
mov dword [ebp - 0xaf4], eax
jmp 0x10029c7d
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0xaf4], eax
push dword [ebp - 0xaf4]
push dword [ebp + 8]
call fcn.1001ca64
pop ecx
pop ecx
mov dword [ebp - 0x118], eax
mov byte [ebp - 4], 0x48
cmp dword [ebp - 0xafc], 0x4596
jge 0x10029cb3
mov edx, dword [ebp - 0xc7c]
mov ecx, 0x10607b78
call fcn.10016475
jmp 0x10029ccf
mov dword [ebp - 4], 0x46
jmp 0x10029cdf
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x1598]
call fcn.10013922
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14e4]
call fcn.100139fc
mov eax, dword [ebp - 0x118]
jmp 0x10029fb5
push 1
lea ecx, [ebp - 0x1134]
call fcn.10013a9c
mov dword [ebp - 4], 0x4a
mov dword [ebp - 0x108c], 0x7822e6e7
mov dword [ebp - 0x1088], 0x7822e6e7
mov dword [ebp - 0x1084], 0x7822e6e7
mov dword [ebp - 0x1080], 0x7822e6e7
lea ecx, [ebp - 0x411]
call fcn.100145b6
push eax
lea eax, [ebp - 0x107c]
push eax
lea eax, [ebp - 0x108c]
push eax
lea ecx, [ebp - 0x15a0]
call fcn.1002c975
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x111c]
call fcn.1002c94f
mov byte [ebp - 4], 0x4b
mov dword [ebp - 0x14a4], 0xb959c45c
mov dword [ebp - 0x1028], 7
mov dword [ebp - 0x1024], 7
mov dword [ebp - 0x1020], 7
mov dword [ebp - 0x101c], 7
lea ecx, [ebp - 0x465]
call fcn.100145b6
push eax
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x1028]
push eax
lea ecx, [ebp - 0x15b8]
call fcn.1002c975
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x150c]
call fcn.1002c94f
mov byte [ebp - 4], 0x4c
push 2
lea ecx, [ebp - 0x1104]
call fcn.10013a9c
mov byte [ebp - 4], 0x4d
mov dword [ebp - 0x12dc], 1
mov dword [ebp - 0x450], 0
mov dword [ebp - 0xc84], 0x511ecbfc
mov dword [ebp - 0xb14], 0x32f1efae
mov dword [ebp - 0xd4], 0
jmp 0x10029e3a
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 1
jge 0x10029e5c
push dword [ebp - 0xd4]
lea ecx, [ebp - 0x1134]
call fcn.10013b14
mov dword [eax], 0xffff
jmp 0x10029e2d
mov dword [ebp - 0xd4], 0
jmp 0x10029e75
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 2
jge 0x10029e97
push dword [ebp - 0xd4]
lea ecx, [ebp - 0x1104]
call fcn.10013b14
mov dword [eax], 9
jmp 0x10029e68
mov eax, dword [ebp - 0xc84]
mov dword [ebp - 0xb04], eax
push 0
lea ecx, [ebp - 0x1104]
call fcn.10013b14
mov ecx, dword [ebp - 0xb04]
mov dword [eax], ecx
cmp dword [ebp - 0xb04], 1
jl 0x10029ecd
mov dword [ebp - 0xb0c], 1
jmp 0x10029ed4
and dword [ebp - 0xb0c], 0
push 1
lea ecx, [ebp - 0x111c]
call fcn.10013b14
mov eax, dword [ebp - 0x450]
dec eax
mov dword [ebp - 0x450], eax
mov dword [ebp - 0xb14], 0x8c83
mov eax, dword [ebp - 0x450]
cmp eax, dword [ebp - 0xb14]
jl 0x10029f12
mov dword [ebp - 0xb1c], 1
jmp 0x10029f19
and dword [ebp - 0xb1c], 0
push 0
lea ecx, [ebp - 0x1134]
call fcn.10013b14
mov eax, dword [eax]
cmp eax, dword [ebp - 0xb1c]
je 0x10029f3c
mov dword [ebp - 0xb24], 1
jmp 0x10029f43
and dword [ebp - 0xb24], 0
cmp dword [ebp - 0xb24], 0xdf7dc239
jne 0x10029f5b
mov dword [ebp - 0xb2c], 1
jmp 0x10029f62
and dword [ebp - 0xb2c], 0
push 2
lea ecx, [ebp - 0x111c]
call fcn.10013b14
mov ecx, dword [ebp - 0xb2c]
mov dword [eax], ecx
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x1104]
call fcn.10013af8
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x150c]
call fcn.10013af8
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0x111c]
call fcn.10013af8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1134]
call fcn.10013af8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret