Function at 0x100239e5
Capabilities:
Contain obfuscated stackstrings
Get disk size
Identify system language via api
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10070ffd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xb80
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x27c], 0xee61780e
push 1
lea ecx, [ebp - 0x684]
call fcn.10018406
and dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
jmp 0x10023a3c
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x10023a58
push dword [ebp - 0x24]
lea ecx, [ebp - 0x684]
call fcn.100184a4
mov dword [eax], 0xfffffffd
jmp 0x10023a35
mov dword [ebp - 0x24], 0
jmp 0x10023a68
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10023a7e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xabc], 0x43e2f7c6
jmp 0x10023a61
mov dword [ebp - 0x24], 0
jmp 0x10023a8e
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10023aa4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x9d0], 0x8dc5
jmp 0x10023a87
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xad4], eax
cmp dword [ebp - 0x18], 8
jne 0x10023abf
mov dword [ebp - 0x61c], 1
jmp 0x10023ac6
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jge 0x10023ade
mov dword [ebp - 0x584], 1
jmp 0x10023ae5
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x584], eax
jne 0x10023afc
mov dword [ebp - 0x624], 1
jmp 0x10023b03
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x61c]
cmp eax, dword [ebp - 0x624]
jg 0x10023b1d
mov dword [ebp - 0x64c], 1
jmp 0x10023b24
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x64c]
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jg 0x10023b3e
mov dword [ebp - 0x31c], 1
jmp 0x10023b45
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x31c], eax
jne 0x10023b5c
mov dword [ebp - 0x588], 1
jmp 0x10023b63
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x588], eax
jne 0x10023b7a
mov dword [ebp - 0x2b4], 1
jmp 0x10023b81
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x2b4], eax
jg 0x10023b98
mov dword [ebp - 0x590], 1
jmp 0x10023b9f
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x590]
test eax, eax
jne 0x10023bbf
cmp dword [ebp - 0x27c], 0
jne 0x10023bbf
and dword [ebp - 0x2bc], 0
jmp 0x10023bc9
mov dword [ebp - 0x2bc], 1
mov eax, dword [ebp - 0x2bc]
neg eax
cmp eax, dword [ebp - 0x18]
je 0x10023be2
mov dword [ebp - 0x25c], 1
jmp 0x10023be9
and dword [ebp - 0x25c], 0
push 0
lea ecx, [ebp - 0x684]
call fcn.100184a4
mov ecx, dword [ebp - 0x25c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x27c]
cmp dword [ebp - 0x25c], eax
jl 0x10023c18
mov dword [ebp - 0x224], 1
jmp 0x10023c1f
and dword [ebp - 0x224], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x224]
mov dword [ebp + eax - 0xabc], ecx
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x224]
test eax, eax
jne 0x10023c47
cmp dword [ebp - 0x27c], 0
push 0
lea ecx, [ebp - 0x684]
call fcn.100184a4
cmp dword [eax], 0
je 0x10023c9a
mov dword [ebp - 0x598], 0xabf8b243
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x10023c8b
push 0
push 0
push 0xdd0
push 0x1780
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
mov eax, dword [ebp - 0x598]
dec eax
mov dword [ebp - 0x598], eax
jmp 0x10023cba
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x10023cba
push 1
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0
lea ecx, [ebp - 0x684]
call fcn.100184a4
cmp dword [eax], 0xfffffff8
je 0x10023cd8
mov dword [ebp - 0x2c4], 1
jmp 0x10023cdf
and dword [ebp - 0x2c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9d0]
cmp eax, dword [ebp - 0x2c4]
jl 0x10023d00
mov dword [ebp - 0x5a0], 1
jmp 0x10023d07
and dword [ebp - 0x5a0], 0
push 0
lea ecx, [ebp - 0x684]
call fcn.100184a4
mov ecx, dword [ebp - 0x5a0]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x684]
call fcn.10018488
mov dword [ebp - 0x1c], 0xffff
mov dword [ebp - 0x2d4], 0xdca1a1f0
push 2
lea ecx, [ebp - 0x7a4]
call fcn.10018406
mov dword [ebp - 4], 1
mov dword [ebp - 0x6b8], 0xbbb66efe
mov dword [ebp - 0x5c0], 0xffffffff
mov dword [ebp - 0x754], 0x14ba09a1
mov dword [ebp - 0x1c0], 0
jmp 0x10023d87
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 2
jge 0x10023da9
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0x7a4]
call fcn.100184a4
mov dword [eax], 0x6e74a6e8
jmp 0x10023d7a
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jge 0x10023dbd
mov dword [ebp - 0x2cc], 1
jmp 0x10023dc4
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x2cc]
cmp eax, dword [ebp - 0x1c]
je 0x10023dde
mov dword [ebp - 0x5a8], 1
jmp 0x10023de5
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x5a8]
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2d4]
cmp eax, dword [ebp - 0x1c]
jge 0x10023e0e
cmp dword [ebp - 0x1c], 0
je 0x10023e0e
mov dword [ebp - 0x6a4], 1
jmp 0x10023e15
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x9ac], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x5b0], eax
push 1
lea ecx, [ebp - 0x7a4]
call fcn.100184a4
mov ecx, dword [ebp - 0x5b0]
mov dword [eax], ecx
cmp dword [ebp - 0x5b0], 0
jne 0x10023e60
push 1
lea ecx, [ebp - 0x7a4]
call fcn.100184a4
cmp dword [eax], 0
jne 0x10023e60
and dword [ebp - 0x2dc], 0
jmp 0x10023e6a
mov dword [ebp - 0x2dc], 1
imul eax, dword [ebp - 0x2dc], 0xe4b9
mov dword [ebp - 0x6b8], eax
push 0
lea ecx, [ebp - 0x7a4]
call fcn.100184a4
cmp dword [eax], 0x4489b467
jg 0x10023e9b
mov dword [ebp - 0x5b8], 1
jmp 0x10023ea2
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x5b8]
lea eax, [ecx + eax + 0x154d1983]
cmp eax, dword [ebp - 0x1c]
je 0x10023ec3
mov dword [ebp - 0x2e4], 1
jmp 0x10023eca
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x5c0], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x5c0]
jl 0x10023eed
mov dword [ebp - 0x2ec], 1
jmp 0x10023ef4
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x2ec]
test eax, eax
jne 0x10023f0e
mov dword [ebp - 0x5c8], 1
jmp 0x10023f15
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x5c8]
jne 0x10023f2c
mov dword [ebp - 0x2f4], 1
jmp 0x10023f33
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x754], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7a4]
call fcn.10018488
cmp dword [0x10619e1c], 0
jne 0x10027b33
mov dword [ebp - 0x5f8], 0xfffffff6
mov dword [ebp - 0x76c], 1
mov dword [ebp - 0x234], 0xb457102d
mov dword [ebp - 0xc8], 1
mov dword [ebp - 0xbc], 0xe814
mov dword [ebp - 0xa44], 0x33843046
mov dword [ebp - 0x58], 0xfffffff7
push 1
lea ecx, [ebp - 0x298]
call fcn.10018406
mov dword [ebp - 4], 2
mov dword [ebp - 0x22c], 0xcaad901
mov dword [ebp - 0x28c], 0xffffffff
mov dword [ebp - 0x774], 0
mov dword [ebp - 0x178], 0
jmp 0x10023fed
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
jge 0x1002400c
push dword [ebp - 0x178]
lea ecx, [ebp - 0x298]
call fcn.100184a4
or dword [eax], 0xffffffff
jmp 0x10023fe0
mov eax, dword [ebp - 0x22c]
dec eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x58], 0
jmp 0x10024029
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jg 0x100245cf
mov dword [ebp - 0x78], 0xb416c28c
mov dword [ebp - 0xd0], 0x69d0
mov dword [ebp - 0x1e8], 0
jmp 0x1002405d
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 2
jge 0x10024079
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0x824], 0xe06dcf8e
jmp 0x10024050
cmp dword [ebp - 0xc8], 0
je 0x100240b6
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5d0], eax
push dword [ebp - 0x58]
lea ecx, [ebp - 0x298]
call fcn.100184a4
mov ecx, dword [ebp - 0x5d0]
mov dword [eax], ecx
cmp dword [ebp - 0x5d0], 0
je 0x100240b6
mov dword [ebp - 0x304], 1
jmp 0x100240bd
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x5f8]
lea eax, [ecx + eax - 1]
cmp eax, dword [ebp - 0xd0]
jg 0x100240de
mov dword [ebp - 0x2fc], 1
jmp 0x100240e5
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x2fc], eax
jle 0x100240fc
mov dword [ebp - 0x5d8], 1
jmp 0x10024103
and dword [ebp - 0x5d8], 0
imul eax, dword [ebp - 0x5d8], 0x2728
test eax, eax
jne 0x10024123
cmp dword [ebp - 0x234], 0
jne 0x10024123
and dword [ebp - 0x5e0], 0
jmp 0x1002412d
mov dword [ebp - 0x5e0], 1
mov eax, dword [ebp - 0x78]
add eax, dword [ebp - 0x304]
cmp eax, dword [ebp - 0x5e0]
jge 0x10024159
push 0
lea ecx, [ebp - 0x298]
call fcn.100184a4
cmp dword [eax], 0
jne 0x10024159
and dword [ebp - 0x75c], 0
jmp 0x10024163
mov dword [ebp - 0x75c], 1
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x9b4], eax
mov dword [ebp - 0xc8], 0xba2d3c5e
mov eax, dword [ebp - 0xc8]
neg eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0xbc], 0
jmp 0x1002419a
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jg 0x100245ca
mov dword [ebp - 0x784], 4
mov dword [ebp - 0x180], 0
jmp 0x100241ca
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 4
jge 0x100241e6
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x83c], 6
jmp 0x100241bd
mov esi, dword [ebp - 0xc8]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x298]
call fcn.100184a4
cmp esi, dword [eax]
jge 0x1002420a
mov dword [ebp - 0x30c], 1
jmp 0x10024211
and dword [ebp - 0x30c], 0
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x298]
call fcn.100184a4
mov eax, dword [eax]
cmp eax, dword [ebp - 0x30c]
jle 0x10024238
mov dword [ebp - 0x5e8], 1
jmp 0x1002423f
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0xae0], eax
mov esi, dword [ebp - 0x78]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x298]
call fcn.100184a4
mov edi, eax
push 0
lea ecx, [ebp - 0x298]
call fcn.100184a4
mov eax, dword [eax]
add eax, dword [edi]
imul eax, esi
cmp eax, 0x593b
jl 0x10024285
mov dword [ebp - 0x314], 1
jmp 0x1002428c
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x5e8]
cmp eax, dword [ebp - 0x314]
je 0x100242a6
mov dword [ebp - 0x5f0], 1
jmp 0x100242ad
and dword [ebp - 0x5f0], 0
cmp dword [ebp - 0x5f0], 0
jle 0x100242c2
mov dword [ebp - 0x264], 1
jmp 0x100242c9
and dword [ebp - 0x264], 0
push dword [ebp - 0x58]
lea ecx, [ebp - 0x298]
call fcn.100184a4
mov ecx, dword [ebp - 0x264]
mov dword [eax], ecx
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0xd0], 0
jmp 0x10024304
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x36
jge 0x100245c5
mov dword [ebp - 0x9c], 5
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x5f8]
jle 0x10024335
mov dword [ebp - 0x4c4], 1
jmp 0x1002433c
and dword [ebp - 0x4c4], 0
cmp dword [ebp - 0xbc], 1
jle 0x10024351
mov dword [ebp - 0x4bc], 1
jmp 0x10024358
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x4bc], eax
jle 0x10024372
mov dword [ebp - 0x324], 1
jmp 0x10024379
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x9c]
jl 0x10024399
mov dword [ebp - 0x764], 1
jmp 0x100243a0
and dword [ebp - 0x764], 0
mov eax, 0xd590
cmp eax, 0x9c02
jne 0x100243b8
mov dword [ebp - 0x58c], 1
jmp 0x100243bf
and dword [ebp - 0x58c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x83c]
mov eax, dword [ebp - 0x28c]
cmp eax, dword [ebp - 0x9c]
jle 0x100243ea
push 7
pop eax
test eax, eax
jne 0x100243ea
and dword [ebp - 0x32c], 0
jmp 0x100243f4
mov dword [ebp - 0x32c], 1
mov eax, dword [ebp - 0x32c]
sub eax, dword [ebp - 0x76c]
mov dword [ebp - 0x334], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x334]
mov dword [ebp + eax - 0x824], ecx
mov eax, dword [ebp - 0x4c4]
cmp eax, dword [ebp - 0x334]
jne 0x10024433
mov dword [ebp - 0x5f4], 1
jmp 0x1002443a
and dword [ebp - 0x5f4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x83c]
cmp dword [ebp - 0x5f4], eax
jle 0x1002445b
mov dword [ebp - 0x33c], 1
jmp 0x10024462
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x28c]
imul eax, dword [ebp - 0x33c]
add eax, dword [ebp - 0x234]
imul eax, dword [ebp - 0x774]
cmp eax, dword [ebp - 0xd0]
jne 0x10024490
mov dword [ebp - 0x4cc], 1
jmp 0x10024497
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x4cc], eax
jl 0x100244b1
mov dword [ebp - 0x344], 1
jmp 0x100244b8
and dword [ebp - 0x344], 0
cmp dword [ebp - 0x344], 0x6a9c
jge 0x100244d6
cmp dword [ebp - 0x9c], 0
jne 0x100244d6
and dword [ebp - 0x594], 0
jmp 0x100244e0
mov dword [ebp - 0x594], 1
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x594], eax
jne 0x100244fa
mov dword [ebp - 0x77c], 1
jmp 0x10024501
and dword [ebp - 0x77c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x83c]
mov dword [ebp - 0x9bc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x824]
cmp eax, dword [ebp - 0x9c]
jle 0x10024535
mov dword [ebp - 0x34c], 1
jmp 0x1002453c
and dword [ebp - 0x34c], 0
cmp dword [ebp - 0x34c], 3
je 0x10024551
mov dword [ebp - 0x4d4], 1
jmp 0x10024558
and dword [ebp - 0x4d4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x83c]
cmp dword [ebp - 0x4d4], eax
jne 0x10024579
mov dword [ebp - 0x354], 1
jmp 0x10024580
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0xc8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x28c]
cmp ecx, dword [ebp + eax - 0x83c]
jle 0x100245ad
mov dword [ebp - 0x604], 1
jmp 0x100245b4
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x784], eax
jmp 0x100242f7
jmp 0x1002418d
jmp 0x10024022
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x298]
call fcn.10018488
mov dword [ebp - 0xec], 0xa61928c1
mov dword [ebp - 0xec], 0x1c
jmp 0x10024601
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x15
jle 0x100246e2
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x4dc], 0x5cabfc39
mov dword [ebp - 0x108], 0
jmp 0x1002463b
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0xfffffffc
jle 0x100246dd
mov dword [ebp - 0x36c], 0x7213ec75
cmp dword [ebp - 0xec], 0
je 0x10024664
cmp dword [ebp - 0x36c], 0
jne 0x10024676
cmp dword [ebp - 0x108], 0
jne 0x10024676
and dword [ebp - 0x35c], 0
jmp 0x10024680
mov dword [ebp - 0x35c], 1
mov dword [ebp - 0x4dc], 9
mov eax, dword [ebp - 0x35c]
neg eax
cmp dword [ebp - 0x4dc], eax
jne 0x100246a6
mov dword [ebp - 0x364], 1
jmp 0x100246ad
and dword [ebp - 0x364], 0
cmp dword [ebp - 0x364], 0x11f0
je 0x100246c5
mov dword [ebp - 0x59c], 1
jmp 0x100246cc
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x36c], eax
jmp 0x1002462e
jmp 0x100245f4
mov byte [ebp - 0x13c], 2
mov byte [ebp - 0x13b], 4
mov byte [ebp - 0x13a], 5
mov byte [ebp - 0x139], 0x1e
mov byte [ebp - 0x138], 0xa
mov byte [ebp - 0x137], 0
mov byte [ebp - 0x136], 2
mov byte [ebp - 0x135], 0xbc
mov byte [ebp - 0x134], 0x73
mov byte [ebp - 0x133], 9
mov byte [ebp - 0x132], 8
mov byte [ebp - 0x131], 1
mov byte [ebp - 0x130], 1
mov byte [ebp - 0x12f], 8
mov byte [ebp - 0x12e], 0x4b
mov byte [ebp - 0x12d], 0xb
mov byte [ebp - 0x12c], 0x42
mov byte [ebp - 0x12b], 6
mov byte [ebp - 0x12a], 0x5f
mov byte [ebp - 0x129], 4
mov byte [ebp - 0x128], 0x56
mov byte [ebp - 0x127], 3
mov byte [ebp - 0x126], 0xb
mov byte [ebp - 0x125], 0
mov byte [ebp - 0x124], 0x25
mov byte [ebp - 0x123], 7
mov byte [ebp - 0x122], 0x79
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x13c]
and eax, 0x76
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x13c]
or ecx, 0x76
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x13c]
mov word [ebp + eax*2 - 0x970], cx
mov dword [ebp - 0x2c], 2
and dword [ebp - 0x1b0], 0
jmp 0x100247f1
mov eax, dword [ebp - 0x2c]
inc eax
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1b
jae 0x10025a17
mov dword [ebp - 0x4e4], 0x77d2
mov dword [ebp - 0x78c], 0x10008148
cmp dword [ebp - 0x4e4], 0x7ac8
jle 0x100248a5
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
and dword [ebp - 0x1c8], 0
jmp 0x10024841
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0x4ba5
jge 0x100248a5
and dword [ebp - 0x188], 0
jmp 0x10024863
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0x1eda
jge 0x100248a3
mov eax, dword [ebp - 0x1c8]
cdq
idiv dword [ebp - 0x188]
mov eax, edx
cdq
mov dword [ebp - 0x6c4], eax
mov dword [ebp - 0x6c0], edx
push dword [ebp - 0x6c0]
push dword [ebp - 0x6c4]
mov ecx, 0x10618cd8
call fcn.100180fd
jmp 0x10024856
jmp 0x10024834
mov dword [ebp - 0xd8], 0xfb023ed1
mov dword [ebp - 4], 3
cmp dword [ebp - 0x4e4], 0x75a3
jge 0x100248d2
mov edx, dword [ebp - 0x78c]
mov ecx, 0x10618cd8
call fcn.1001ae02
jmp 0x100248ee
or dword [ebp - 4], 0xffffffff
jmp 0x100248f8
mov dword [ebp - 0x5fc], 0xfffffff8
mov dword [ebp - 0x37c], 0x1720348f
mov dword [ebp - 0x48], 0
jmp 0x1002491c
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x10024932
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x918], 0
jmp 0x10024915
mov dword [ebp - 0x48], 0
jmp 0x10024942
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x10024958
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0xb28], 0x39d5b611
jmp 0x1002493b
cmp dword [ebp - 0xd8], 0
jl 0x1002496d
mov dword [ebp - 0x374], 1
jmp 0x10024974
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x5fc], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x374]
sub ecx, dword [ebp + eax - 0x918]
mov eax, dword [ebp - 0x5fc]
imul eax, dword [ebp - 0xd8]
cmp eax, ecx
jle 0x100249af
mov dword [ebp - 0x23c], 1
jmp 0x100249b6
and dword [ebp - 0x23c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x23c]
mov dword [ebp + eax - 0x918], ecx
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0xa4c], eax
cmp dword [ebp - 0xd8], 0x9fa85f88
jne 0x100249f9
mov dword [ebp - 0x4ec], 1
jmp 0x10024a00
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x4ec]
jl 0x10024a1a
mov dword [ebp - 0x384], 1
jmp 0x10024a21
and dword [ebp - 0x384], 0
cmp dword [ebp - 0x384], 0xc2489102
jbe 0x10024a39
mov dword [ebp - 0x794], 1
jmp 0x10024a40
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x9c4], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x918]
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xb28], eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x13c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x2c], eax
jne 0x10025429
mov dword [ebp - 0xf4], 0xa9ac70c3
mov dword [ebp - 0x3a4], 0xffffffff
mov dword [ebp - 0x3ac], 2
mov dword [ebp - 0x7e0], 0xffffffff
mov dword [ebp - 0x6c], 0
jmp 0x10024ab8
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x10024ace
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xafc], 0x37400631
jmp 0x10024ab1
mov dword [ebp - 0x6c], 0
jmp 0x10024ade
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10024af4
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x66c], 0xffffffff
jmp 0x10024ad7
cmp dword [ebp - 0xf4], 0
je 0x10024b0f
mov eax, 0xcabfc393
test eax, eax
jne 0x10024b0f
and dword [ebp - 0x39c], 0
jmp 0x10024b19
mov dword [ebp - 0x39c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xf4]
imul ecx, dword [ebp + eax - 0x66c]
cmp ecx, 0x5786
jle 0x10024b41
mov dword [ebp - 0x5a4], 1
jmp 0x10024b48
and dword [ebp - 0x5a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x66c]
cmp dword [ebp - 0x5a4], eax
jge 0x10024b79
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x66c], 0
je 0x10024b79
mov dword [ebp - 0x38c], 1
jmp 0x10024b80
and dword [ebp - 0x38c], 0
cmp dword [ebp - 0x38c], 0x3d3b0cf5
je 0x10024b98
mov dword [ebp - 0x4f4], 1
jmp 0x10024b9f
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x4f4], eax
jg 0x10024bb9
mov dword [ebp - 0x394], 1
jmp 0x10024bc0
and dword [ebp - 0x394], 0
cmp dword [ebp - 0x394], 0xe7a
je 0x10024bd8
mov dword [ebp - 0x60c], 1
jmp 0x10024bdf
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0x60c]
je 0x10024bf9
mov dword [ebp - 0x4fc], 1
jmp 0x10024c00
and dword [ebp - 0x4fc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x39c]
mov dword [ebp + eax - 0xafc], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4fc]
sub ecx, dword [ebp + eax - 0x66c]
mov dword [ebp - 0x3a4], ecx
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x9e0], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xf4]
cmp ecx, dword [ebp + eax - 0xafc]
jg 0x10024c57
mov dword [ebp - 0x5ac], 1
jmp 0x10024c5e
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x7e0], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x13c]
inc eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0xf8], 0xffffffff
mov dword [ebp - 0x208], 0
jmp 0x10024cab
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
jge 0x10024cc7
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0x82c], 0xcff0ea75
jmp 0x10024c9e
mov dword [ebp - 0xf8], 1
jmp 0x10024ce0
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jl 0x100251b0
mov dword [ebp - 0xfc], 0xeee2fde2
mov dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp + eax*4 - 0x82c], 1
jne 0x10024d1d
mov dword [ebp - 0x504], 1
jmp 0x10024d24
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xfc], 1
jmp 0x10024d49
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x100251ab
mov dword [ebp - 0x88c], 0x8999d94b
mov dword [ebp - 0x888], 0x8999d94b
mov dword [ebp - 0x884], 0x8999d94b
mov dword [ebp - 0x880], 0x8999d94b
lea ecx, [ebp - 0x20d]
call fcn.100184b3
push eax
lea eax, [ebp - 0x87c]
push eax
lea eax, [ebp - 0x88c]
push eax
lea ecx, [ebp - 0xb10]
call fcn.100184b6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x658]
call fcn.10018462
mov dword [ebp - 4], 5
mov dword [ebp - 0x1f0], 0xfffffff7
push 1
lea ecx, [ebp - 0x658]
call fcn.100184a4
and dword [eax], 0
jmp 0x10024dfa
push 1
lea ecx, [ebp - 0x658]
call fcn.100184a4
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp - 0x3b4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3b4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x658]
call fcn.100184a4
cmp dword [eax], 1
jg 0x10025197
push 4
lea ecx, [ebp - 0x8ac]
call fcn.10018406
mov byte [ebp - 4], 6
mov dword [ebp - 0x768], 0x7fc0336a
mov dword [ebp - 0x190], 0
jmp 0x10024e44
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 4
jge 0x10024e66
push dword [ebp - 0x190]
lea ecx, [ebp - 0x8ac]
call fcn.100184a4
mov dword [eax], 0xffff
jmp 0x10024e37
push 2
lea ecx, [ebp - 0x8ac]
call fcn.100184a4
mov dword [ebp - 0x614], eax
mov eax, dword [ebp - 0x614]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x614]
mov dword [ecx], eax
mov dword [ebp - 0x1d0], 1
jmp 0x10024ea3
mov eax, dword [ebp - 0x1d0]
dec eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
jl 0x10025183
mov dword [ebp - 0x850], 0xfffffffe
mov dword [ebp - 0x84c], 0xfffffffe
mov dword [ebp - 0x848], 0xfffffffe
mov dword [ebp - 0x844], 0xfffffffe
lea ecx, [ebp - 0x219]
call fcn.100184b3
push eax
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x850]
push eax
lea ecx, [ebp - 0xb58]
call fcn.100184b6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x900]
call fcn.10018462
mov byte [ebp - 4], 7
mov dword [ebp - 0x198], 0
jmp 0x10024f2a
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 1
jge 0x10024f46
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x3bc], 0
jmp 0x10024f1d
mov dword [ebp - 0x1f0], 1
jmp 0x10024f5f
mov eax, dword [ebp - 0x1f0]
dec eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0
jl 0x1002516f
mov dword [ebp - 0x100], 0xfffffffc
mov dword [ebp - 0x100], 1
jmp 0x10024f8f
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jl 0x1002514b
mov dword [ebp - 0x944], 0xa6f63eed
mov dword [ebp - 0x940], 0xa6f63eed
mov dword [ebp - 0x93c], 0xa6f63eed
mov dword [ebp - 0x938], 0xa6f63eed
push 1
lea ecx, [ebp - 0x658]
call fcn.100184a4
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x82c]
mov dword [ebp - 0xac4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3bc]
mov dword [ebp - 0x9e8], eax
push 3
lea ecx, [ebp - 0x900]
call fcn.100184a4
mov eax, dword [eax]
dec eax
je 0x10025021
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3bc], 0
je 0x10025021
mov dword [ebp - 0x50c], 1
jmp 0x10025028
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x768]
cmp dword [ebp - 0x50c], eax
jl 0x10025042
mov dword [ebp - 0x3c4], 1
jmp 0x10025049
and dword [ebp - 0x3c4], 0
push 3
lea ecx, [ebp - 0x658]
call fcn.100184a4
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3c4]
jl 0x1002506c
mov dword [ebp - 0x5b4], 1
jmp 0x10025073
and dword [ebp - 0x5b4], 0
push 2
lea ecx, [ebp - 0x658]
call fcn.100184a4
mov ecx, dword [ebp - 0x5b4]
cmp ecx, dword [eax]
jge 0x10025096
mov dword [ebp - 0x3cc], 1
jmp 0x1002509d
and dword [ebp - 0x3cc], 0
cmp dword [ebp - 0x3cc], 0x4eb0
jle 0x100250b5
mov dword [ebp - 0x514], 1
jmp 0x100250bc
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 0xffffffff
jle 0x100250d6
xor eax, eax
inc eax
je 0x100250d6
mov dword [ebp - 0x3d4], 1
jmp 0x100250dd
and dword [ebp - 0x3d4], 0
push 3
lea ecx, [ebp - 0x900]
call fcn.100184a4
mov ecx, dword [ebp - 0x3d4]
sub ecx, dword [eax]
jne 0x10025106
cmp dword [ebp - 0x100], 0
jne 0x10025106
and dword [ebp - 0x608], 0
jmp 0x10025110
mov dword [ebp - 0x608], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x608]
mov dword [ebp + eax - 0x944], ecx
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x10025146
push 0x158b
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
jmp 0x10024f82
mov byte [ebp - 0xb3], 0
movzx eax, byte [ebp - 0xb3]
test eax, eax
je 0x1002516a
push 0
push 0xa25
call dword [sym.imp.USER32.dll_GetWindowPlacement]
jmp 0x10024f52
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x900]
call fcn.10018488
jmp 0x10024e96
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x8ac]
call fcn.10018488
jmp 0x10024dd6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x658]
call fcn.10018488
jmp 0x10024d3c
jmp 0x10024cd3
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x100251cc
push 0
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x13c]
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x6ac], 4
mov dword [ebp - 0x244], 0x52ea
mov dword [ebp - 0xa68], 0xa5a40f2f
mov dword [ebp - 0x9f0], 0x519d8147
mov dword [ebp - 0x71c], 0x45c17473
mov dword [ebp - 0x26c], 0xffffffff
mov dword [ebp - 0xac8], 0xfd061a65
push 1
lea ecx, [ebp - 0x7b4]
call fcn.10018406
mov dword [ebp - 4], 8
mov dword [ebp - 0x284], 0xfffffffe
mov dword [ebp - 0x714], 1
mov dword [ebp - 0x60], 0
jmp 0x1002525f
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x1002527b
push dword [ebp - 0x60]
lea ecx, [ebp - 0x7b4]
call fcn.100184a4
mov dword [eax], 0x829ed890
jmp 0x10025258
mov dword [ebp - 0x60], 0
jmp 0x1002528b
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
jge 0x100252a1
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0xa78], 0xfff6
jmp 0x10025284
mov eax, dword [ebp - 0x6ac]
mov dword [ebp - 0xa00], eax
cmp dword [ebp - 0x244], 0
jne 0x1002537f
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa78]
mov dword [ebp - 0x6b0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa78]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xa78], eax
cmp dword [ebp - 0x6b0], 0
jle 0x100252fa
mov dword [ebp - 0x3dc], 1
jmp 0x10025301
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x26c]
imul eax, dword [ebp - 0x3dc]
test eax, eax
je 0x10025327
cmp dword [ebp - 0x244], 0
je 0x10025327
mov dword [ebp - 0x51c], 1
jmp 0x1002532e
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
jne 0x10025355
cmp dword [ebp - 0x714], 0
jne 0x10025355
and dword [ebp - 0x3e4], 0
jmp 0x1002535f
mov dword [ebp - 0x3e4], 1
push 0
lea ecx, [ebp - 0x7b4]
call fcn.100184a4
mov ecx, dword [ebp - 0x3e4]
cmp ecx, dword [eax]
jl 0x1002537f
and dword [ebp - 0x5bc], 0
jmp 0x10025389
mov dword [ebp - 0x5bc], 1
mov eax, dword [ebp - 0x284]
cmp dword [ebp - 0x5bc], eax
jne 0x100253a3
mov dword [ebp - 0x6b4], 1
jmp 0x100253aa
and dword [ebp - 0x6b4], 0
push 0
lea ecx, [ebp - 0x7b4]
call fcn.100184a4
cmp dword [ebp - 0x244], 0
jl 0x100253cc
mov dword [ebp - 0x3ec], 1
jmp 0x100253d3
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x284]
cmp dword [ebp - 0x3ec], eax
jge 0x100253ed
mov dword [ebp - 0x524], 1
jmp 0x100253f4
and dword [ebp - 0x524], 0
push 0
lea ecx, [ebp - 0x7b4]
call fcn.100184a4
mov ecx, dword [ebp - 0x524]
mov dword [eax], ecx
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x71c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7b4]
call fcn.10018488
jmp 0x100247e9
push 1
lea ecx, [ebp - 0x7f8]
call fcn.10018406
mov dword [ebp - 4], 9
mov dword [ebp - 0x4c], 0
jmp 0x1002544d
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x10025463
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xc0], 0xffffffff
jmp 0x10025446
mov dword [ebp - 0x4c], 0
jmp 0x10025473
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1002548f
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x7f8]
call fcn.100184a4
mov dword [eax], 0x57617c0e
jmp 0x1002546c
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x100254b3
push 0x97f
push 0x680
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xc0], 0x18
jmp 0x100254e1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xc0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc0], 9
jge 0x1002599b
mov dword [ebp - 0x88], 0x22124f84
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x88], 0xffffffe6
jmp 0x10025522
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x1b
jl 0x10025996
mov dword [ebp - 0xc4], 0xd509978f
mov dword [ebp - 0x274], 1
mov dword [ebp - 0x40c], 0xe785c2f4
mov dword [ebp - 0x43c], 0xd4a498a5
mov dword [ebp - 0x1a0], 0
jmp 0x10025570
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jge 0x1002558c
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0xb08], 0
jmp 0x10025563
cmp dword [ebp - 0xc4], 0
je 0x1002596f
mov dword [ebp - 0x1a8], 0xebf90350
mov dword [ebp - 0x1d8], 0
jmp 0x100255bc
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 2
jge 0x100255d8
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x6d0], 0xc6548aa
jmp 0x100255af
cmp dword [ebp - 0x274], 0
jne 0x100255ed
mov dword [ebp - 0x404], 1
jmp 0x100255f4
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0xa7c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc0], 0x47d228d5
je 0x1002561f
mov dword [ebp - 0x3f4], 1
jmp 0x10025626
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x3f4], eax
jle 0x10025640
mov dword [ebp - 0x628], 1
jmp 0x10025647
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x628], eax
je 0x10025661
mov dword [ebp - 0x3fc], 1
jmp 0x10025668
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x3fc], eax
jl 0x10025682
mov dword [ebp - 0x24c], 1
jmp 0x10025689
and dword [ebp - 0x24c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x24c]
mov dword [ebp + eax - 0x6d0], ecx
mov eax, dword [ebp - 0x274]
imul eax, dword [ebp - 0x24c]
cmp eax, 0x67e6aa16
jg 0x100256bc
mov dword [ebp - 0x52c], 1
jmp 0x100256c3
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x52c], eax
jne 0x100256dd
mov dword [ebp - 0x6bc], 1
jmp 0x100256e4
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0xa10], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6d0]
mov dword [ebp - 0xae8], eax
cmp dword [ebp - 0x404], 0x9495116
jne 0x1002571b
mov dword [ebp - 0x5c4], 1
jmp 0x10025722
and dword [ebp - 0x5c4], 0
push 0
lea ecx, [ebp - 0x7f8]
call fcn.100184a4
mov ecx, dword [ebp - 0x5c4]
mov dword [eax], ecx
mov dword [ebp - 0xc4], 0
jmp 0x10025750
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jl 0x1002596d
mov dword [ebp - 0x724], 0x3490ce61
mov dword [ebp - 0x200], 0
jmp 0x10025780
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 2
jge 0x1002579c
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0x6dc], 0xfffffff7
jmp 0x10025773
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x100257b8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0xa20], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x6d0], 0x4384f3ac
jle 0x100257e3
mov dword [ebp - 0x534], 1
jmp 0x100257ea
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x40c]
cmp dword [ebp - 0x534], eax
jne 0x10025814
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x6dc], 0
je 0x10025814
mov dword [ebp - 0x414], 1
jmp 0x1002581b
and dword [ebp - 0x414], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6dc]
sub eax, dword [ebp - 0x414]
cmp eax, 0xffff
jae 0x10025841
mov dword [ebp - 0x610], 1
jmp 0x10025848
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
sub eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x88]
jge 0x10025874
mov dword [ebp - 0x53c], 1
jmp 0x1002587b
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x53c]
add eax, dword [ebp - 0x724]
mov dword [ebp - 0x424], eax
push 0
lea ecx, [ebp - 0x7f8]
call fcn.100184a4
mov ecx, dword [ebp - 0x424]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6dc]
cmp eax, dword [ebp - 0x424]
jle 0x100258c3
mov dword [ebp - 0x5cc], 1
jmp 0x100258ca
and dword [ebp - 0x5cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc0]
cmp dword [ebp - 0x5cc], eax
jge 0x100258eb
mov dword [ebp - 0x42c], 1
jmp 0x100258f2
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x42c], eax
jle 0x1002590c
mov dword [ebp - 0x544], 1
jmp 0x10025913
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x43c]
cmp dword [ebp - 0x544], eax
jl 0x1002592d
mov dword [ebp - 0x434], 1
jmp 0x10025934
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x274]
cmp eax, dword [ebp - 0x434]
jge 0x1002594e
mov dword [ebp - 0x648], 1
jmp 0x10025955
and dword [ebp - 0x648], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x648]
mov dword [ebp + eax - 0xb08], ecx
jmp 0x10025743
jmp 0x10025991
mov dword [ebp - 0x54c], 0xffff
cmp dword [ebp - 0x43c], 0
je 0x10025984
jmp 0x10025996
mov eax, dword [ebp - 0x54c]
dec eax
mov dword [ebp - 0x54c], eax
jmp 0x10025515
jmp 0x100254c6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7f8]
call fcn.10018488
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x1b0]
movzx eax, byte [ebp + eax - 0x13e]
movzx eax, word [ebp + eax*2 - 0x970]
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x13b]
and ecx, eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x1b0]
movzx eax, byte [ebp + eax - 0x13e]
movzx eax, word [ebp + eax*2 - 0x970]
mov edx, dword [ebp - 0x2c]
movzx edx, byte [ebp + edx - 0x13b]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x13c]
mov word [ebp + eax*2 - 0x970], dx
and dword [ebp - 0x1b0], 0
jmp 0x100247e9
push 2
lea ecx, [ebp - 0x634]
call fcn.10018406
mov dword [ebp - 4], 0xa
mov dword [ebp - 0xa4], 0xb546158d
mov dword [ebp - 0x1e0], 0
jmp 0x10025a4e
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 2
jge 0x10025a6d
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0x634]
call fcn.100184a4
and dword [eax], 0
jmp 0x10025a41
push 0
lea ecx, [ebp - 0x634]
call fcn.100184a4
and dword [eax], 0
jmp 0x10025aa3
push 0
lea ecx, [ebp - 0x634]
call fcn.100184a4
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x444]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x444]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x634]
call fcn.100184a4
cmp dword [eax], 0xfffffff7
jge 0x10025ad1
mov byte [ebp - 0x90], 0
movzx eax, byte [ebp - 0x90]
test eax, eax
je 0x10025acf
push 0
call dword [sym.imp.USER32.dll_ShowCursor]
jmp 0x10025a7f
mov dword [ebp - 0xa4], 0xfffffff8
jmp 0x10025aea
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x19
jg 0x10025cff
mov dword [ebp - 0x254], 0x69bd
mov dword [ebp - 0x214], 0xffffffff
push 2
lea ecx, [ebp - 0x690]
call fcn.10018406
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x1b8], 0
jmp 0x10025b35
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 2
jge 0x10025b57
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0x690]
call fcn.100184a4
mov dword [eax], 0x64ea33a4
jmp 0x10025b28
cmp dword [ebp - 0xa4], 0
jne 0x10025c81
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x978], eax
mov esi, dword [ebp - 0x254]
push 0
lea ecx, [ebp - 0x634]
call fcn.100184a4
cmp dword [eax], esi
jne 0x10025b93
mov dword [ebp - 0x5d4], 1
jmp 0x10025b9a
and dword [ebp - 0x5d4], 0
push 0
lea ecx, [ebp - 0x634]
call fcn.100184a4
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5d4]
jle 0x10025bbd
mov dword [ebp - 0x44c], 1
jmp 0x10025bc4
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xb28
jg 0x10025be8
mov dword [ebp - 0x554], 1
jmp 0x10025bef
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x554]
jge 0x10025c09
mov dword [ebp - 0x454], 1
jmp 0x10025c10
and dword [ebp - 0x454], 0
mov esi, dword [ebp - 0x254]
push 0
lea ecx, [ebp - 0x690]
call fcn.100184a4
mov ecx, dword [ebp - 0x454]
imul ecx, dword [eax]
imul ecx, esi
test ecx, ecx
jne 0x10025c4e
push 1
lea ecx, [ebp - 0x690]
call fcn.100184a4
cmp dword [eax], 0
jne 0x10025c4e
and dword [ebp - 0x618], 0
jmp 0x10025c58
mov dword [ebp - 0x618], 1
push 0
lea ecx, [ebp - 0x634]
call fcn.100184a4
mov ecx, dword [ebp - 0x618]
add ecx, dword [eax]
je 0x10025c78
cmp dword [ebp - 0x214], 0
jne 0x10025c81
and dword [ebp - 0x45c], 0
jmp 0x10025c8b
mov dword [ebp - 0x45c], 1
push 0
lea ecx, [ebp - 0x690]
call fcn.100184a4
mov ecx, dword [ebp - 0x45c]
cmp ecx, dword [eax]
jl 0x10025cae
mov dword [ebp - 0x55c], 1
jmp 0x10025cb5
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x55c], eax
jne 0x10025ccf
mov dword [ebp - 0x464], 1
jmp 0x10025cd6
and dword [ebp - 0x464], 0
push 0
lea ecx, [ebp - 0x690]
call fcn.100184a4
mov ecx, dword [ebp - 0x464]
mov dword [eax], ecx
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x690]
call fcn.10018488
jmp 0x10025add
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x634]
call fcn.10018488
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x970], cx
mov dword [ebp - 0x114], 0x4039
mov dword [ebp - 0x16c], 1
mov dword [ebp - 0xe8], 0xffff
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x980], 6
mov dword [ebp - 0x988], 0
mov dword [ebp - 0x990], 0x779e46ed
mov dword [ebp - 0x998], 0x7f0d3066
mov dword [ebp - 0x9a0], 0xf5ead4a2
mov dword [ebp - 0x9a8], 0xd40f69ff
mov dword [ebp - 0x5ec], 2
mov dword [ebp - 0x74], 0
jmp 0x10025d99
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x10025daf
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x81c], 0xffffffff
jmp 0x10025d92
mov dword [ebp - 0x74], 0
jmp 0x10025dbf
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x10025dd5
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xb50], 0xeba6e321
jmp 0x10025db8
cmp dword [ebp - 0x114], 0
je 0x10025f90
mov dword [ebp - 0xe4], 0x86e8
mov dword [ebp - 0x1f8], 1
mov dword [ebp - 0x218], 0
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x9b0], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x9b8], eax
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x16c]
je 0x10025e3f
mov dword [ebp - 0x5dc], 1
jmp 0x10025e46
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0xe4]
add eax, dword [ebp - 0x5dc]
sub eax, dword [ebp - 0x1f8]
cmp eax, 0xffffffff
ja 0x10025e69
mov dword [ebp - 0x46c], 1
jmp 0x10025e70
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x46c]
je 0x10025e8a
mov dword [ebp - 0x564], 1
jmp 0x10025e91
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x218]
jl 0x10025eb7
mov dword [ebp - 0x474], 1
jmp 0x10025ebe
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0x474], eax
je 0x10025ed5
cmp dword [ebp - 0x114], 0
je 0x10025eea
cmp dword [ebp - 0xe4], 0
je 0x10025eea
mov dword [ebp - 0x638], 1
jmp 0x10025ef1
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x638]
jne 0x10025f08
cmp dword [ebp - 0x1f8], 0
je 0x10025f11
cmp dword [ebp - 0x218], 0
jne 0x10025f23
cmp dword [ebp - 0x1f8], 0
jne 0x10025f23
and dword [ebp - 0x47c], 0
jmp 0x10025f2d
mov dword [ebp - 0x47c], 1
cmp dword [ebp - 0x47c], 0
je 0x10025f42
mov dword [ebp - 0x56c], 1
jmp 0x10025f49
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x56c]
jle 0x10025f63
mov dword [ebp - 0x484], 1
jmp 0x10025f6a
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x92], 0
movzx eax, byte [ebp - 0x92]
test eax, eax
je 0x10025f8b
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x10026110
mov dword [ebp - 0x57c], 0
mov dword [ebp - 0x72c], 1
mov dword [ebp - 0x6d4], 0x74d2ad05
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x57c]
jg 0x10025fc5
mov dword [ebp - 0x5e4], 1
jmp 0x10025fcc
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x38], 0
jmp 0x10025fe8
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jg 0x10026110
mov dword [ebp - 0x494], 4
mov dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x81c], 0
je 0x1002606c
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x81c], 0xbfb4
jl 0x1002602f
mov dword [ebp - 0x6c8], 1
jmp 0x10026036
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x81c]
mov dword [ebp - 0x9c0], eax
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x9c8], eax
mov eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0x16c]
jle 0x1002606c
mov dword [ebp - 0x48c], 1
jmp 0x10026073
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0xe8]
add eax, dword [ebp - 0x48c]
mov ecx, dword [ebp - 0x38]
cmp dword [ebp + ecx*4 - 0x81c], eax
jle 0x10026097
mov dword [ebp - 0x574], 1
jmp 0x1002609e
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x574]
add eax, 8
je 0x100260be
cmp dword [ebp - 0x494], 0
je 0x100260be
mov dword [ebp - 0x620], 1
jmp 0x100260c5
and dword [ebp - 0x620], 0
imul eax, dword [ebp - 0x620], 6
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x72c], eax
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0x57c]
jne 0x100260f8
mov dword [ebp - 0x4a4], 1
jmp 0x100260ff
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x6d4], eax
jmp 0x10025fe1
mov eax, dword [ebp - 0x5ec]
dec eax
mov dword [ebp - 0x5ec], eax
lea eax, [ebp - 0x970]
push eax
lea ecx, [ebp - 0xb90]
call fcn.1003097b
mov dword [ebp - 0x734], eax
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x6e0], eax
mov dword [ebp - 4], 0xc
push dword [ebp - 0x6e0]
call fcn.1001f05d
pop ecx
mov dword [ebp - 0x4e0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb90]
call fcn.100182aa
mov dword [ebp - 0x17c], 3
mov dword [ebp - 0x4b4], 0x833fcb50
mov dword [ebp - 0x6ec], 0xffffffff
mov dword [ebp - 0x338], 9
mov dword [ebp - 0x9d4], 0x876942a1
mov dword [ebp - 0x744], 4
mov dword [ebp - 0xac0], 0
mov dword [ebp - 0x6f8], 3
mov dword [ebp - 0x74c], 0x729cf308
mov dword [ebp - 0x9d8], 0xffffffff
push 3
lea ecx, [ebp - 0x8dc]
call fcn.10018406
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x9dc], 0xfffffff7
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x318], 0x6c8c
push 3
lea ecx, [ebp - 0x8c4]
call fcn.10018406
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x600], 0xfffa
mov dword [ebp - 0x73c], 0x1929
cmp dword [ebp - 0x73c], 0x530
jge 0x10026428
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0xcc]
push eax
push 0x10007d08
call fcn.10058bdb
add esp, 0xc
push dword [ebp - 0x220]
lea ecx, [ebp - 0x8e8]
call fcn.10030a2f
mov byte [ebp - 4], 0xf
and dword [ebp - 0x174], 0
jmp 0x1002627a
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
cmp eax, dword [ebp - 0x220]
jge 0x100262a8
push dword [ebp - 0x174]
lea ecx, [ebp - 0x8e8]
call fcn.100184a4
push eax
push 0x10008010
call fcn.10058bdb
pop ecx
pop ecx
jmp 0x1002626d
mov byte [ebp - 0x93], 1
lea eax, [ebp - 0x93]
push eax
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x954]
call fcn.10030a6b
mov byte [ebp - 4], 0x10
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xf0], eax
jmp 0x100262ed
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xcc]
sub eax, dword [ebp - 0x220]
cmp dword [ebp - 0xf0], eax
jle 0x1002640a
mov eax, dword [ebp - 0xcc]
sub eax, dword [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x8e8]
call fcn.100184a4
mov eax, dword [eax]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xe0]
cdq
idiv dword [ebp - 0xf0]
mov dword [ebp - 0xe0], edx
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0xe0], 0
jle 0x1002638d
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cdq
idiv dword [ebp - 0xcc]
mov dword [ebp - 0x28], edx
push dword [ebp - 0x28]
lea eax, [ebp - 0xb18]
push eax
lea ecx, [ebp - 0x954]
call fcn.10030aec
mov ecx, eax
call fcn.10030b30
movzx eax, al
mov ecx, dword [ebp - 0xe0]
sub ecx, eax
mov dword [ebp - 0xe0], ecx
jmp 0x10026341
mov eax, dword [ebp - 0x28]
inc eax
push eax
push 0x100081c0
call fcn.10058ec3
pop ecx
pop ecx
push 0
push dword [ebp - 0x28]
lea eax, [ebp - 0xb68]
push eax
lea ecx, [ebp - 0x954]
call fcn.10030aec
mov ecx, eax
call fcn.10030b0b
xor eax, eax
inc eax
je 0x10026405
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cdq
idiv dword [ebp - 0xcc]
mov dword [ebp - 0x28], edx
push dword [ebp - 0x28]
lea eax, [ebp - 0xb78]
push eax
lea ecx, [ebp - 0x954]
call fcn.10030aec
mov ecx, eax
call fcn.10030b30
movzx eax, al
test eax, eax
je 0x10026403
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4ac], eax
jmp 0x10026405
jmp 0x100263bc
jmp 0x100262e0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x954]
call fcn.10030acc
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x8e8]
call fcn.10018488
mov dword [ebp - 0x68], 0
jmp 0x10026438
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x10026454
push dword [ebp - 0x68]
lea ecx, [ebp - 0x8dc]
call fcn.100184a4
mov dword [eax], 5
jmp 0x10026431
mov dword [ebp - 0x68], 0
jmp 0x10026464
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x10026480
push dword [ebp - 0x68]
lea ecx, [ebp - 0x8c4]
call fcn.100184a4
mov dword [eax], 0xfff8
jmp 0x1002645d
mov eax, dword [ebp - 0x228]
dec eax
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x2a8], eax
push 1
lea ecx, [ebp - 0x8dc]
call fcn.100184a4
mov ecx, dword [ebp - 0x2a8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x4b4]
sub eax, dword [ebp - 0x318]
cmp eax, dword [ebp - 0x228]
jge 0x100264da
mov dword [ebp - 0x330], 1
jmp 0x100264e1
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x9e4], eax
push 1
lea ecx, [ebp - 0x8c4]
call fcn.100184a4
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
mov eax, dword [eax]
mov dword [ebp - 0x600], eax
mov eax, dword [ebp - 0x600]
sub eax, dword [ebp - 0x318]
mov ecx, dword [ebp - 0x230]
mov ecx, dword [ecx]
dec ecx
mov edx, dword [ebp - 0x230]
mov dword [edx], ecx
test eax, eax
jne 0x10026541
mov eax, 0x1692
test eax, eax
jne 0x10026541
and dword [ebp - 0x320], 0
jmp 0x1002654b
mov dword [ebp - 0x320], 1
cmp dword [ebp - 0x320], 0xa219909d
je 0x10026563
mov dword [ebp - 0x328], 1
jmp 0x1002656a
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x9ec], eax
mov eax, dword [ebp - 0x744]
mov dword [ebp - 0xa40], eax
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x17c]
add eax, dword [ebp - 0x74c]
cmp dword [ebp - 0x338], eax
jg 0x100265ba
mov dword [ebp - 0x340], 1
jmp 0x100265c1
and dword [ebp - 0x340], 0
cmp dword [ebp - 0x340], 0
je 0x100265d6
mov dword [ebp - 0x348], 1
jmp 0x100265dd
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x348]
sub eax, 0x1e0dcf5
mov dword [ebp - 0x6f8], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x8c4]
call fcn.10018488
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8dc]
call fcn.10018488
and dword [ebp - 0x184], 0
jmp 0x10026622
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0xd
jae 0x1002681a
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x878], 0xfffffffd
mov dword [ebp - 0x874], 0xfffffffd
mov dword [ebp - 0x870], 0xfffffffd
mov dword [ebp - 0x86c], 0xfffffffd
lea ecx, [ebp - 0x286]
call fcn.100184b3
push eax
lea eax, [ebp - 0x868]
push eax
lea eax, [ebp - 0x878]
push eax
lea ecx, [ebp - 0xb70]
call fcn.100184b6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9fc]
call fcn.10018462
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x7ec], 0x1de6fc60
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
je 0x100266bc
mov dword [ebp - 0x350], 1
jmp 0x100266c3
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x350], eax
jg 0x100266da
mov dword [ebp - 0x358], 1
jmp 0x100266e1
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x358], eax
jg 0x100266f8
mov dword [ebp - 0x360], 1
jmp 0x100266ff
and dword [ebp - 0x360], 0
cmp dword [ebp - 0x360], 0x6fe6
jl 0x1002671a
cmp dword [ebp - 0x30], 0
jne 0x1002671a
and dword [ebp - 0x368], 0
jmp 0x10026724
mov dword [ebp - 0x368], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x368], eax
jg 0x1002673b
mov dword [ebp - 0x370], 1
jmp 0x10026742
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x370]
jge 0x10026759
mov dword [ebp - 0x380], 1
jmp 0x10026760
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x378], eax
push 0
lea ecx, [ebp - 0x9fc]
call fcn.100184a4
mov ecx, dword [ebp - 0x378]
mov dword [eax], ecx
imul eax, dword [ebp - 0x378], 0x76ff
cmp eax, dword [ebp - 0x380]
jne 0x1002679c
mov dword [ebp - 0x388], 1
jmp 0x100267a3
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x388]
cmp eax, dword [ebp - 0x30]
jge 0x100267bd
mov dword [ebp - 0x390], 1
jmp 0x100267c4
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x7ec], eax
mov byte [ebp - 0x94], 0
movzx eax, byte [ebp - 0x94]
test eax, eax
je 0x100267f6
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9fc]
call fcn.10018488
xor eax, eax
mov ecx, dword [ebp - 0x184]
mov word [ebp + ecx*2 - 0x970], ax
jmp 0x10026615
cmp dword [ebp - 0x4e0], 0
je 0x10027b33
push 1
lea ecx, [ebp - 0x810]
call fcn.10018406
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x194], 0x871d976f
mov dword [ebp - 0x18c], 0
jmp 0x1002685e
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 1
jge 0x10026880
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x810]
call fcn.100184a4
mov dword [eax], 1
jmp 0x10026851
push 0
lea ecx, [ebp - 0x810]
call fcn.100184a4
mov dword [eax], 0x39b642c
mov dword [ebp - 0x194], 0
jmp 0x100268ac
mov eax, dword [ebp - 0x194]
dec eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0xffffffef
jl 0x10026980
push 3
lea ecx, [ebp - 0x678]
call fcn.10018406
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x19c], 0
jmp 0x100268e3
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 3
jge 0x10026902
push dword [ebp - 0x19c]
lea ecx, [ebp - 0x678]
call fcn.100184a4
and dword [eax], 0
jmp 0x100268d6
push 1
lea ecx, [ebp - 0x678]
call fcn.100184a4
and dword [eax], 0
jmp 0x10026938
push 1
lea ecx, [ebp - 0x678]
call fcn.100184a4
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x398]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x398]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x678]
call fcn.100184a4
cmp dword [eax], 1
jge 0x1002696c
push 1
lea ecx, [ebp - 0x678]
call fcn.100184a4
push dword [eax]
lea ecx, [ebp - 0x810]
call fcn.100184a4
mov dword [eax], 1
jmp 0x10026914
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x678]
call fcn.10018488
jmp 0x1002689f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x810]
call fcn.10018488
mov byte [ebp - 0x160], 0xb
mov byte [ebp - 0x15f], 0x52
mov byte [ebp - 0x15e], 7
mov byte [ebp - 0x15d], 0x24
mov byte [ebp - 0x15c], 0
mov byte [ebp - 0x15b], 6
mov byte [ebp - 0x15a], 6
mov byte [ebp - 0x159], 0x24
mov byte [ebp - 0x158], 0xc
mov byte [ebp - 0x157], 0x10
mov byte [ebp - 0x156], 3
mov byte [ebp - 0x155], 0x23
mov byte [ebp - 0x154], 0xa
mov byte [ebp - 0x153], 0x22
mov byte [ebp - 0x152], 5
mov byte [ebp - 0x151], 0x1d
mov byte [ebp - 0x150], 4
mov byte [ebp - 0x14f], 0x1d
mov byte [ebp - 0x14e], 8
mov byte [ebp - 0x14d], 0x16
mov byte [ebp - 0x14c], 1
mov byte [ebp - 0x14b], 1
mov byte [ebp - 0x14a], 0xd
mov byte [ebp - 0x149], 0x16
mov byte [ebp - 0x148], 4
mov byte [ebp - 0x147], 0x5d
mov byte [ebp - 0x146], 0x10
mov byte [ebp - 0x145], 0xcc
mov byte [ebp - 0x144], 0x10
mov byte [ebp - 0x143], 2
mov byte [ebp - 0x142], 7
mov byte [ebp - 0x141], 9
mov byte [ebp - 0x140], 0x10
mov dword [ebp - 0xa48], 0x76b0
mov byte [ebp - 0x96], 0
movzx eax, byte [ebp - 0x96]
test eax, eax
je 0x10026a9f
push 0
push 0x55a
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x10026ac3
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x160]
and eax, 0x37
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x160]
or ecx, 0x37
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x160]
mov byte [ebp + eax - 0x6a0], cl
mov dword [ebp - 0x8a0], 0x76820624
mov dword [ebp - 0x89c], 0x76820624
mov dword [ebp - 0x898], 0x76820624
mov dword [ebp - 0x894], 0x76820624
lea ecx, [ebp - 0x27d]
call fcn.100184b3
push eax
lea eax, [ebp - 0x890]
push eax
lea eax, [ebp - 0x8a0]
push eax
lea ecx, [ebp - 0xb60]
call fcn.100184b6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7c4]
call fcn.10018462
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x1a4], 0xffffffff
mov dword [ebp - 0xa50], 0x41791e6e
mov dword [ebp - 0xa5c], 0x969b42c5
mov dword [ebp - 0x770], 0xfff9
mov dword [ebp - 0x164], 0
jmp 0x10026ba1
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jge 0x10026bbd
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0xa64], 1
jmp 0x10026b94
push 0
lea ecx, [ebp - 0x7c4]
call fcn.100184a4
and dword [eax], 0
jmp 0x10026bf3
push 0
lea ecx, [ebp - 0x7c4]
call fcn.100184a4
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x3a0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3a0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x7c4]
call fcn.100184a4
cmp dword [eax], 0xfffffffa
jl 0x10026c26
mov dword [ebp - 0x700], 0xe1ca2961
push 0
lea ecx, [ebp - 0x7c4]
call fcn.100184a4
mov eax, dword [eax]
mov dword [ebp - 0x700], eax
jmp 0x10026bcf
mov dword [ebp - 0x1a4], 0
jmp 0x10026c3f
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jg 0x10026c75
mov dword [ebp - 0x3a8], 0x7b80be39
mov dword [ebp - 0xacc], 0xb597857
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 0x770], 0
jmp 0x10026c32
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c4]
call fcn.10018488
mov dword [ebp - 0x14], 2
and dword [ebp - 0x110], 0
jmp 0x10026c9c
mov eax, dword [ebp - 0x14]
inc eax
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x21
jae 0x100274fa
mov dword [ebp - 0xa8c], 1
mov dword [ebp - 0xa88], 1
mov dword [ebp - 0xa84], 1
mov dword [ebp - 0xa80], 1
mov dword [ebp - 0x974], 0xe5a60d00
mov dword [ebp - 0xadc], 0xffffffff
push 3
lea ecx, [ebp - 0x8f4]
call fcn.10018406
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x1ac], 0
jmp 0x10026d0f
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 3
jge 0x10026d2e
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x8f4]
call fcn.100184a4
or dword [eax], 0xffffffff
jmp 0x10026d02
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x10026d50
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push 2
lea ecx, [ebp - 0x8f4]
call fcn.100184a4
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x3b0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3b0]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8f4]
call fcn.10018488
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x160]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x14], eax
jne 0x1002727f
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x160]
inc eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x3c], 0x136951ad
mov dword [ebp - 0x1b4], 0xdd9cd443
mov dword [ebp - 0x70], 0
jmp 0x10026dd1
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x10026de7
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x664], 0xec0ae971
jmp 0x10026dca
mov dword [ebp - 0x70], 0
jmp 0x10026df7
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x10026e0d
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x6e8], 0
jmp 0x10026df0
mov dword [ebp - 0x3c], 0
jmp 0x10026e1d
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x10026fd2
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x50], 0
jmp 0x10026e3e
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jg 0x10026fcd
mov dword [ebp - 0x3f0], 0x628217c7
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x664], 0
je 0x10026e7d
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
imul ecx, dword [ebp + eax*4 - 0x664]
test ecx, ecx
je 0x10026e7d
mov dword [ebp - 0x3d0], 1
jmp 0x10026e84
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x50]
sub ecx, dword [ebp + eax*4 - 0x664]
cmp ecx, dword [ebp - 0x3c]
jge 0x10026ea2
mov dword [ebp - 0x3b8], 1
jmp 0x10026ea9
and dword [ebp - 0x3b8], 0
cmp dword [ebp - 0x3b8], 0
jg 0x10026ebe
mov dword [ebp - 0x3c0], 1
jmp 0x10026ec5
and dword [ebp - 0x3c0], 0
cmp dword [ebp - 0x3c0], 0xfffb
jae 0x10026edd
mov dword [ebp - 0x3c8], 1
jmp 0x10026ee4
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x3c8]
cmp eax, dword [ebp - 0x50]
je 0x10026efe
mov dword [ebp - 0x3d8], 1
jmp 0x10026f05
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x1b4]
cmp eax, dword [ebp - 0x3d8]
jle 0x10026f2b
mov dword [ebp - 0x3e0], 1
jmp 0x10026f32
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3e0]
sub ecx, dword [ebp + eax*4 - 0x664]
cmp ecx, 0x9229a275
jne 0x10026f56
mov dword [ebp - 0x3e8], 1
jmp 0x10026f5d
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x3f0]
sub eax, dword [ebp - 0x50]
jne 0x10026f86
mov eax, 0x5211
test eax, eax
jne 0x10026f86
and dword [ebp - 0x3f8], 0
jmp 0x10026f90
mov dword [ebp - 0x3f8], 1
cmp dword [ebp - 0x3f8], 0xafbf
jle 0x10026fab
cmp dword [ebp - 0x50], 0
jne 0x10026fab
and dword [ebp - 0x400], 0
jmp 0x10026fb5
mov dword [ebp - 0x400], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x400]
mov dword [ebp + eax - 0x6e8], ecx
jmp 0x10026e37
jmp 0x10026e16
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x664], 0xed13222c
je 0x10026ff1
mov dword [ebp - 0x408], 1
jmp 0x10026ff8
and dword [ebp - 0x408], 0
cmp dword [ebp - 0x408], 0xe2499e68
jb 0x10027010
mov dword [ebp - 0x410], 1
jmp 0x10027017
and dword [ebp - 0x410], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x664]
cmp dword [ebp - 0x410], eax
je 0x10027038
mov dword [ebp - 0x418], 1
jmp 0x1002703f
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x418], eax
jge 0x10027068
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x664], 0
je 0x10027068
mov dword [ebp - 0x420], 1
jmp 0x1002706f
and dword [ebp - 0x420], 0
cmp dword [ebp - 0x420], 0xeed0
jl 0x10027087
mov dword [ebp - 0x428], 1
jmp 0x1002708e
and dword [ebp - 0x428], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6e8]
cmp dword [ebp - 0x428], eax
je 0x100270af
mov dword [ebp - 0x430], 1
jmp 0x100270b6
and dword [ebp - 0x430], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6e8]
cmp dword [ebp - 0x430], eax
jg 0x100270d7
mov dword [ebp - 0x438], 1
jmp 0x100270de
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x160]
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x14], eax
push 3
lea ecx, [ebp - 0x644]
call fcn.10018406
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x34], 0x7013dce9
mov dword [ebp - 0x1bc], 0
jmp 0x10027133
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jge 0x10027155
push dword [ebp - 0x1bc]
lea ecx, [ebp - 0x644]
call fcn.100184a4
mov dword [eax], 1
jmp 0x10027126
push 0
lea ecx, [ebp - 0x644]
call fcn.100184a4
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x440]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x440]
mov dword [ecx], eax
mov dword [ebp - 0x34], 2
jmp 0x10027189
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1002726b
push dword [ebp - 0x34]
lea ecx, [ebp - 0x644]
call fcn.100184a4
mov esi, eax
push dword [ebp - 0x34]
lea ecx, [ebp - 0x644]
call fcn.100184a4
mov eax, dword [eax]
cmp eax, dword [esi]
jl 0x100271c3
mov dword [ebp - 0x448], 1
jmp 0x100271ca
and dword [ebp - 0x448], 0
cmp dword [ebp - 0x448], 0x8be135e1
jne 0x100271e2
mov dword [ebp - 0x450], 1
jmp 0x100271e9
and dword [ebp - 0x450], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x644]
call fcn.100184a4
mov eax, dword [eax]
neg eax
cmp eax, dword [ebp - 0x450]
je 0x1002720f
mov dword [ebp - 0x458], 1
jmp 0x10027216
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x458], eax
jg 0x10027233
mov eax, 0x21324561
test eax, eax
jne 0x10027233
and dword [ebp - 0x708], 0
jmp 0x1002723d
mov dword [ebp - 0x708], 1
push dword [ebp - 0x34]
lea ecx, [ebp - 0x644]
call fcn.100184a4
mov esi, eax
push 0
lea ecx, [ebp - 0x644]
call fcn.100184a4
mov eax, dword [eax]
mov dword [esi], eax
cmp dword [ebp - 0x34], 0
je 0x10027266
jmp 0x1002726b
jmp 0x10027182
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x644]
call fcn.10018488
jmp 0x10026c94
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x110]
movzx eax, byte [ebp + eax - 0x162]
movsx eax, byte [ebp + eax - 0x6a0]
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x15f]
and ecx, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x110]
movzx eax, byte [ebp + eax - 0x162]
movsx eax, byte [ebp + eax - 0x6a0]
mov edx, dword [ebp - 0x14]
movzx edx, byte [ebp + edx - 0x15f]
and edx, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x110]
movzx eax, byte [ebp + eax - 0x162]
movsx eax, byte [ebp + eax - 0x6a0]
mov esi, dword [ebp - 0x14]
movzx ebx, byte [ebp + esi - 0x15f]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x160]
mov byte [ebp + eax - 0x6a0], bl
mov dword [ebp - 0x1c4], 0xfffffff9
mov dword [ebp - 0x104], 0xffffffff
mov dword [ebp - 0x468], 0xffffffff
mov dword [ebp - 0x1c4], 0xffffffe5
jmp 0x1002733e
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0xf
jg 0x100274ee
mov dword [ebp - 0x7b8], 0x6c619a80
cmp dword [ebp - 0x104], 0
je 0x10027363
jmp 0x100274ee
mov dword [ebp - 0x104], 0xffffffe9
jmp 0x1002737c
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x1e
je 0x100274e9
mov dword [ebp - 0xd4], 0xbd94543b
mov dword [ebp - 0xd4], 0xffffffe5
jmp 0x100273ac
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0xffffffe5
jg 0x10027480
push 4
lea ecx, [ebp - 0x7d4]
call fcn.10018406
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x1cc], 0
jmp 0x100273e6
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 4
jge 0x10027408
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x7d4]
call fcn.100184a4
mov dword [eax], 1
jmp 0x100273d9
push 3
lea ecx, [ebp - 0x7d4]
call fcn.100184a4
and dword [eax], 0
jmp 0x1002743e
push 3
lea ecx, [ebp - 0x7d4]
call fcn.100184a4
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x460]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x460]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x7d4]
call fcn.100184a4
cmp dword [eax], 3
jne 0x1002746c
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x1002746a
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
jmp 0x1002741a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7d4]
call fcn.10018488
jmp 0x1002739f
mov dword [ebp - 0x468], 0xc92e
mov eax, 0xf978
sub eax, dword [ebp - 0x468]
cmp dword [ebp - 0x7b8], eax
jle 0x100274b2
cmp dword [ebp - 0xd4], 1
jne 0x100274b2
mov dword [ebp - 0x470], 1
jmp 0x100274b9
and dword [ebp - 0x470], 0
cmp dword [ebp - 0x470], 0xf780
je 0x100274d1
mov dword [ebp - 0x478], 1
jmp 0x100274d8
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0xd4], eax
jmp 0x1002736f
jmp 0x10027331
and dword [ebp - 0x110], 0
jmp 0x10026c94
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x6a0], 0
mov dword [ebp - 0x54], 0xfffffffe
mov dword [ebp - 0x864], 0xfffffffb
mov dword [ebp - 0x860], 0xfffffffb
mov dword [ebp - 0x85c], 0xfffffffb
mov dword [ebp - 0x858], 0xfffffffb
lea ecx, [ebp - 0x285]
call fcn.100184b3
push eax
lea eax, [ebp - 0x854]
push eax
lea eax, [ebp - 0x864]
push eax
lea ecx, [ebp - 0xb48]
call fcn.100184b6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2a4]
call fcn.10018462
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x238], 0x2449ef57
mov dword [ebp - 0x778], 5
push 2
lea ecx, [ebp - 0x90c]
call fcn.10018406
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x1d4], 0
jmp 0x100275bb
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 2
jge 0x100275da
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x90c]
call fcn.100184a4
and dword [eax], 0
jmp 0x100275ae
push 2
lea ecx, [ebp - 0x2a4]
call fcn.100184a4
cmp dword [eax], 0xd303
jg 0x100275fb
mov dword [ebp - 0x710], 1
jmp 0x10027602
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xae4], eax
mov esi, dword [ebp - 0x118]
push 2
lea ecx, [ebp - 0x2a4]
call fcn.100184a4
cmp esi, dword [eax]
jle 0x10027635
push 2
pop eax
test eax, eax
je 0x10027635
mov dword [ebp - 0x480], 1
jmp 0x1002763c
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x480], eax
jge 0x10027653
mov dword [ebp - 0x488], 1
jmp 0x1002765a
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
add eax, 0x14af12a8
mov ecx, dword [ebp - 0x54]
add ecx, 0x66e161f3
cmp ecx, eax
jle 0x10027684
mov eax, 0xf5e
test eax, eax
jne 0x10027684
and dword [ebp - 0x490], 0
jmp 0x1002768e
mov dword [ebp - 0x490], 1
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x490], eax
je 0x100276a5
mov dword [ebp - 0x498], 1
jmp 0x100276ac
and dword [ebp - 0x498], 0
mov esi, dword [ebp - 0x54]
add esi, dword [ebp - 0x498]
push 2
lea ecx, [ebp - 0x2a4]
call fcn.100184a4
mov dword [eax], esi
mov dword [ebp - 0x238], 0xfffffff6
mov esi, dword [ebp - 0x238]
push 3
lea ecx, [ebp - 0x2a4]
call fcn.100184a4
cmp dword [eax], esi
jne 0x100276f4
cmp dword [ebp - 0x54], 0
jne 0x100276f4
and dword [ebp - 0x4a0], 0
jmp 0x100276fe
mov dword [ebp - 0x4a0], 1
push 2
lea ecx, [ebp - 0x2a4]
call fcn.100184a4
mov ecx, dword [ebp - 0x4a0]
cmp ecx, dword [eax]
jg 0x10027721
mov dword [ebp - 0x4a8], 1
jmp 0x10027728
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x778], eax
push 2
lea ecx, [ebp - 0x2a4]
call fcn.100184a4
mov esi, 0x43657218
sub esi, dword [eax]
push 2
lea ecx, [ebp - 0x2a4]
call fcn.100184a4
cmp esi, dword [eax]
je 0x10027765
mov dword [ebp - 0x4b0], 1
jmp 0x1002776c
and dword [ebp - 0x4b0], 0
push 3
lea ecx, [ebp - 0x2a4]
call fcn.100184a4
mov ecx, dword [ebp - 0x4b0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0xaec], eax
mov eax, 0xd91f
cmp eax, 6
jg 0x100277a3
mov dword [ebp - 0x4b8], 1
jmp 0x100277aa
and dword [ebp - 0x4b8], 0
cmp dword [ebp - 0x4b8], 0
jne 0x100277bf
mov dword [ebp - 0x4c0], 1
jmp 0x100277c6
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x4c0], eax
jge 0x100277e0
mov dword [ebp - 0x718], 1
jmp 0x100277e7
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0xad8], eax
cmp dword [ebp - 0x54], 0
je 0x1002780b
cmp dword [ebp - 0x54], 0
je 0x1002780b
mov dword [ebp - 0x7e8], 1
jmp 0x10027812
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0xad0], eax
mov esi, dword [ebp - 0x238]
add esi, dword [ebp - 0x54]
push 1
lea ecx, [ebp - 0x90c]
call fcn.100184a4
mov dword [eax], esi
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x90c]
call fcn.10018488
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a4]
call fcn.10018488
lea eax, [ebp - 0x6a0]
push eax
lea ecx, [ebp - 0xb40]
call fcn.100309a0
mov dword [ebp - 4], 0x1a
and dword [ebp - 0x1ec], 0
jmp 0x10027883
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0xf
jae 0x100279a5
mov dword [ebp - 0x1e4], 0xf7e2799a
push 1
lea ecx, [ebp - 0x924]
call fcn.10018406
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x1dc], 0
jmp 0x100278c4
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 1
jge 0x100278e6
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x924]
call fcn.100184a4
mov dword [eax], 0xd4914d2e
jmp 0x100278b7
mov dword [ebp - 0x1e4], 0x19
jmp 0x100278ff
mov eax, dword [ebp - 0x1e4]
dec eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0x12
je 0x10027983
mov dword [ebp - 0x720], 1
mov dword [ebp - 0x168], 0
jmp 0x1002792b
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jge 0x10027947
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0xa58], 0x6a162c9c
jmp 0x1002791e
push 0
lea ecx, [ebp - 0x924]
call fcn.100184a4
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp - 0x4c8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x4c8]
mov dword [ecx], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa58]
mov dword [ebp - 0x720], eax
jmp 0x100278f2
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x924]
call fcn.10018488
mov eax, dword [ebp - 0x1ec]
mov byte [ebp + eax - 0x6a0], 0
jmp 0x10027876
mov dword [ebp - 0x7c], 0xffffffff
mov dword [ebp - 0x248], 1
mov dword [ebp - 0x7c], 0xb
jmp 0x100279c6
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xffffffe7
jge 0x10027afd
mov dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x7c]
sub eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x7c]
je 0x100279f1
mov dword [ebp - 0x4d0], 1
jmp 0x100279f8
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x240]
sub eax, 7
cmp dword [ebp - 0x240], eax
je 0x10027a1b
mov dword [ebp - 0x4d8], 1
jmp 0x10027a22
and dword [ebp - 0x4d8], 0
cmp dword [ebp - 0x4d8], 0
je 0x10027a32
cmp dword [ebp - 0x240], 0
mov dword [ebp - 0x248], 0xbd652568
cmp dword [ebp - 0x248], 0
je 0x10027ab1
mov dword [ebp - 0x934], 0xffffffff
mov dword [ebp - 0x930], 0xffffffff
mov dword [ebp - 0x92c], 0xffffffff
mov dword [ebp - 0x928], 0xffffffff
mov byte [ebp - 0xae], 0
movzx eax, byte [ebp - 0xae]
test eax, eax
je 0x10027a9e
push 0x1f09
push 0x1874
push 0x1a64
push 0x1a31
push 0x1cc
call dword [sym.imp.GDI32.dll_Rectangle]
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x934], 0
jmp 0x10027af8
mov dword [ebp - 0x1f4], 0
jmp 0x10027aca
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 1
jge 0x10027ae6
mov eax, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0x780], 0x912530a9
jmp 0x10027abd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x780], 0
je 0x10027af8
jmp 0x10027afd
jmp 0x100279bf
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x248], eax
push 1
push 0
lea eax, [ebp - 0xb40]
push eax
push dword [ebp - 0x4e0]
call fcn.1002881a
add esp, 0x10
mov dword [0x10619e1c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb40]
call fcn.10018373
mov dword [ebp - 0x540], 0x76ac116e
push 3
lea ecx, [ebp - 0xa0c]
call fcn.10018406
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0xaa0], 0x6dd75471
mov dword [ebp - 0xa9c], 0x6dd75471
mov dword [ebp - 0xa98], 0x6dd75471
mov dword [ebp - 0xa94], 0x6dd75471
mov dword [ebp - 0x20], 0
jmp 0x10027b89
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x10027b9c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x44], 1
jmp 0x10027b82
mov dword [ebp - 0x20], 0
jmp 0x10027bac
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10027bc2
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8b8], 0x1d12
jmp 0x10027ba5
mov dword [ebp - 0x20], 0
jmp 0x10027bd2
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10027bee
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa0c]
call fcn.100184a4
mov dword [eax], 0xde30ea3b
jmp 0x10027bcb
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x44], 0
jmp 0x10027c13
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x44], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x44], 0xfffffff7
jl 0x10027f72
mov dword [ebp - 0x738], 0xfffffffc
mov dword [ebp - 0x8c], 0xfffffff6
mov dword [ebp - 0x4f8], 9
mov dword [ebp - 0x788], 1
mov dword [ebp - 0xa60], 0x9d8e7dfb
mov dword [ebp - 0x97c], 8
mov dword [ebp - 0x538], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x44], 0
je 0x10027dd0
mov dword [ebp - 0x84], 0xe446df3
mov dword [ebp - 0x7c8], 0x99da9727
mov dword [ebp - 0x84], 0
jmp 0x10027ca8
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xffffffe3
jne 0x10027ccd
mov byte [ebp - 0xb0], 0
movzx eax, byte [ebp - 0xb0]
test eax, eax
je 0x10027ccb
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x10027c9b
mov dword [ebp - 0x84], 0
jmp 0x10027ce6
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jl 0x10027dcb
mov dword [ebp - 0x250], 0xfe662db8
mov dword [ebp - 0x730], 6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
mov dword [ebp - 0xa90], eax
imul eax, dword [ebp - 0x250], 0xffffffff
test eax, eax
je 0x10027d37
cmp dword [ebp - 0x8c], 0
je 0x10027d37
mov dword [ebp - 0x728], 1
jmp 0x10027d3e
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x984], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
mov dword [ebp - 0xa30], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
mov dword [ebp - 0x98c], eax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0xa34], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7c8]
cmp ecx, dword [ebp + eax - 0x44]
jg 0x10027d94
mov dword [ebp - 0x4e8], 1
jmp 0x10027d9b
and dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x4e8], 0x415e40c8
jl 0x10027db3
mov dword [ebp - 0x4f0], 1
jmp 0x10027dba
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x730], eax
jmp 0x10027cd9
jmp 0x10027f60
mov dword [ebp - 0x740], 7
mov dword [ebp - 0x790], 0xfffffffa
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x10027e03
push 0
push 0x7b8
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
mov dword [ebp - 0x8c], 0
jmp 0x10027e1c
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jg 0x10027f60
mov dword [ebp - 0x518], 1
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x8c]
mov ecx, dword [ebp + ecx*4 - 0x8b8]
cmp ecx, dword [ebp + eax*4 - 0x8b8]
je 0x10027e5b
mov dword [ebp - 0x500], 1
jmp 0x10027e62
and dword [ebp - 0x500], 0
mov dword [ebp - 0x4f8], 0xfffffff7
cmp dword [ebp - 0x4f8], 0
jne 0x10027e81
mov dword [ebp - 0x508], 1
jmp 0x10027e88
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x500]
cmp eax, dword [ebp - 0x508]
je 0x10027ea2
mov dword [ebp - 0x510], 1
jmp 0x10027ea9
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp + eax*4 - 0x8b8]
imul eax, dword [ebp - 0x510]
mov dword [ebp - 0x788], eax
mov eax, 0x7f2f
sub eax, dword [ebp - 0x738]
cmp eax, 0xfffffff7
jne 0x10027edf
mov dword [ebp - 0x7dc], 1
jmp 0x10027ee6
and dword [ebp - 0x7dc], 0
mov dword [ebp - 0x518], 0x668f781b
cmp dword [ebp - 0x518], 0xc81b9349
jbe 0x10027f08
mov dword [ebp - 0x520], 1
jmp 0x10027f0f
and dword [ebp - 0x520], 0
cmp dword [ebp - 0x520], 0xda8f9e1
jge 0x10027f27
mov dword [ebp - 0x528], 1
jmp 0x10027f2e
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x740]
cmp eax, dword [ebp - 0x528]
jge 0x10027f48
mov dword [ebp - 0x530], 1
jmp 0x10027f4f
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x790], eax
jmp 0x10027e0f
mov eax, dword [ebp - 0x538]
dec eax
mov dword [ebp - 0x538], eax
jmp 0x10027bfe
cmp dword [ebp - 0x540], 0
jne 0x10027f8d
cmp dword [ebp - 0x540], 0
jne 0x10027f8d
and dword [ebp - 0x548], 0
jmp 0x10027f97
mov dword [ebp - 0x548], 1
cmp dword [ebp - 0x548], 1
jge 0x10027fac
mov dword [ebp - 0x550], 1
jmp 0x10027fb3
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x550]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x44], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0c]
call fcn.10018488
cmp dword [0x10619e1c], 0
je 0x10028807
mov eax, dword [ebp + 8]
mov dword [ebp - 0x798], eax
mov dword [ebp - 0x204], 0xd5e48d32
push 1
lea ecx, [ebp - 0x8d0]
call fcn.10018406
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x1fc], 0
jmp 0x10028020
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 1
jge 0x10028042
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0x8d0]
call fcn.100184a4
mov dword [eax], 9
jmp 0x10028013
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x10028064
push 0xb6e
push 0x190d
call dword [sym.imp.USER32.dll_SetCaretPos]
mov dword [ebp - 0x204], 0xe
jmp 0x1002807d
mov eax, dword [ebp - 0x204]
dec eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0xfffffff1
je 0x100280fe
mov dword [ebp - 0x20c], 0x665683c8
mov dword [ebp - 0x20c], 0
jmp 0x100280a9
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0x1a
jl 0x100280f9
mov dword [ebp - 0x120], 0xdbc37078
mov dword [ebp - 0x120], 0
jmp 0x100280d5
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x100280f7
push dword [ebp - 0x120]
lea ecx, [ebp - 0x8d0]
call fcn.100184a4
mov dword [eax], 0xe6e7f737
jmp 0x100280c8
jmp 0x1002809c
jmp 0x10028070
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8d0]
call fcn.10018488
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x760], eax
mov dword [ebp - 0x40], 0x6bc657e3
mov dword [ebp - 0x258], 0x65786371
mov dword [ebp - 0x260], 0x840dfe9f
mov dword [ebp - 0x580], 0xfffffff6
mov dword [ebp - 0x5c], 0
jmp 0x1002814b
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x10028161
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xdc], 0x7921e124
jmp 0x10028144
mov dword [ebp - 0x5c], 0
jmp 0x10028171
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x10028187
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xab4], 0
jmp 0x1002816a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdc]
mov dword [ebp - 0x558], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x558]
mov dword [ebp + eax - 0xdc], ecx
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x558], eax
jge 0x100281c4
mov dword [ebp - 0x748], 1
jmp 0x100281cb
and dword [ebp - 0x748], 0
cmp dword [ebp - 0x40], 0
je 0x100281ef
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
je 0x100281ef
mov dword [ebp - 0x7d8], 1
jmp 0x100281f6
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x750], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x750]
mov dword [ebp + eax - 0xab4], ecx
mov eax, dword [ebp - 0x258]
sub eax, 0x2ac5c730
je 0x1002822b
mov dword [ebp - 0x560], 1
jmp 0x10028232
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x560], eax
jne 0x10028249
mov dword [ebp - 0x568], 1
jmp 0x10028250
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x568], eax
jle 0x1002825f
cmp dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x40]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xdc]
lea eax, [ecx + eax - 8]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x1002828a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xdc], 0
push 4
pop eax
imul eax, eax, 3
imul eax, dword [ebp + eax - 0xab4], 0x81c1
add eax, dword [ebp - 0x260]
cmp eax, 0x14b81230
jg 0x100282b4
mov dword [ebp - 0x570], 1
jmp 0x100282bb
and dword [ebp - 0x570], 0
cmp dword [ebp - 0x570], 0
jbe 0x100282d0
mov dword [ebp - 0x578], 1
jmp 0x100282d7
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x578]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x580], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xdc], 0
je 0x10028320
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x580]
cmp ecx, dword [ebp + eax - 0xab4]
je 0x10028320
mov dword [ebp - 0x2ac], 1
jmp 0x10028327
and dword [ebp - 0x2ac], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2ac]
mov dword [ebp + eax - 0xdc], ecx
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x70c], eax
mov dword [ebp - 0x10c], 0
push 2
lea ecx, [ebp - 0x804]
call fcn.10018406
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0xac], 1
mov dword [ebp - 0x2c0], 0x703c5764
mov dword [ebp - 0x64], 0
jmp 0x10028388
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1002839e
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xa1c], 0
jmp 0x10028381
mov dword [ebp - 0x64], 0
jmp 0x100283ae
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x100283ca
push dword [ebp - 0x64]
lea ecx, [ebp - 0x804]
call fcn.100184a4
mov dword [eax], 0xde9bf9f3
jmp 0x100283a7
mov dword [ebp - 0x10c], 0xfffffff8
jmp 0x100283e3
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xfffffffe
jge 0x100284e5
mov dword [ebp - 0x268], 0xa0b8ee41
mov dword [ebp - 0x7e4], 0xb719d872
mov byte [ebp - 0x97], 0
movzx eax, byte [ebp - 0x97]
test eax, eax
je 0x1002841e
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa1c]
cmp eax, dword [ebp - 0x268]
jge 0x1002843f
mov dword [ebp - 0x2b0], 1
jmp 0x10028446
and dword [ebp - 0x2b0], 0
cmp dword [ebp - 0x10c], 0
je 0x1002845b
mov dword [ebp - 0x758], 1
jmp 0x10028462
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x994], eax
push 1
lea ecx, [ebp - 0x804]
call fcn.100184a4
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0xa38], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa1c]
mov dword [ebp - 0x99c], eax
mov eax, dword [ebp - 0x2b0]
add eax, 7
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x6dd2cc91
je 0x100284c1
mov dword [ebp - 0x2b8], 1
jmp 0x100284c8
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x7e4], eax
jmp 0x100283d6
mov dword [ebp - 0xac], 0
jmp 0x100284fe
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 2
jge 0x1002851d
push dword [ebp - 0xac]
lea ecx, [ebp - 0x804]
call fcn.100184a4
and dword [eax], 0
jmp 0x100284f1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x804]
call fcn.10018488
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x704], eax
mov dword [ebp - 0x80], 0x17571177
mov dword [ebp - 0x270], 0xffffffff
mov dword [ebp - 0x278], 1
mov dword [ebp - 0x2d8], 0x25004286
mov dword [ebp - 0x6fc], 0xfc4b664f
mov dword [ebp - 0x80], 0xffffffe2
jmp 0x10028577
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x18
je 0x1002874e
mov dword [ebp - 0x11c], 7
mov dword [ebp - 0x7a8], 0x71cb27f0
mov dword [ebp - 0x2f0], 0xfffffff9
cmp dword [ebp - 0x80], 0
jne 0x10028688
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x270], 0x93f9beab
jae 0x100285ca
mov dword [ebp - 0x2c8], 1
jmp 0x100285d1
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x2c8], eax
jge 0x100285eb
mov dword [ebp - 0x2d0], 1
jmp 0x100285f2
and dword [ebp - 0x2d0], 0
cmp dword [ebp - 0x2d0], 0x8af
jg 0x1002860a
mov dword [ebp - 0x6f0], 1
jmp 0x10028611
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xa3c], eax
mov eax, dword [ebp - 0x278]
imul eax, dword [ebp - 0x270]
imul eax, eax, 0
test eax, eax
jne 0x10028643
cmp dword [ebp - 0x278], 0
jne 0x10028643
and dword [ebp - 0x6f4], 0
jmp 0x1002864d
mov dword [ebp - 0x6f4], 1
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xaa4], eax
mov dword [ebp - 0x2d8], 0xfff6
mov eax, dword [ebp - 0x2d8]
add eax, 0xff1e
cmp eax, dword [ebp - 0x80]
jne 0x10028688
and dword [ebp - 0x2e0], 0
jmp 0x10028692
mov dword [ebp - 0x2e0], 1
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0x2e0], eax
je 0x100286ac
mov dword [ebp - 0x2e8], 1
jmp 0x100286b3
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x2f0]
cmp eax, dword [ebp - 0x278]
je 0x100286d9
mov dword [ebp - 0x2f8], 1
jmp 0x100286e0
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f8]
inc eax
inc eax
cmp dword [ebp - 0x11c], eax
jg 0x100286fc
mov dword [ebp - 0x300], 1
jmp 0x10028703
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x300]
jge 0x1002871a
mov dword [ebp - 0x308], 1
jmp 0x10028721
and dword [ebp - 0x308], 0
cmp dword [ebp - 0x308], 0xfffffff9
jle 0x10028736
mov dword [ebp - 0x310], 1
jmp 0x1002873d
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x6fc], eax
jmp 0x10028570
push dword [ebp - 0x704]
push dword [ebp - 0x70c]
call dword [0x10619e1c]
mov dword [ebp - 0x6a8], eax
push 3
lea ecx, [ebp - 0xa2c]
call fcn.10018406
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x170], 0
jmp 0x10028793
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jge 0x100287b5
push dword [ebp - 0x170]
lea ecx, [ebp - 0xa2c]
call fcn.100184a4
mov dword [eax], 1
jmp 0x10028786
mov byte [ebp - 0xaf], 0
movzx eax, byte [ebp - 0xaf]
test eax, eax
je 0x100287d4
push 0
push 0xa45
call dword [sym.imp.USER32.dll_ValidateRect]
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x100287f0
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa2c]
call fcn.10018488
mov eax, dword [ebp - 0x6a8]
jmp 0x10028809
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret