Function at 0x1001328e
Capabilities:
Contain obfuscated stackstrings
Get geographical location
Get system information on windows
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007411f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xae4
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x218], 0
mov dword [ebp - 0xc0], 0xffffffff
mov dword [ebp - 0x4c], 8
push 1
lea ecx, [ebp - 0x740]
call fcn.100223ce
and dword [ebp - 4], 0
mov dword [ebp - 0x5e8], 0x41b6add7
mov dword [ebp - 0x1e8], 0
jmp 0x10013309
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jge 0x1001332b
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x740]
call fcn.1002246c
mov dword [eax], 0x6c65
jmp 0x100132fc
cmp dword [ebp - 0x40], 0
jne 0x100133bb
cmp dword [ebp - 0x40], 0
je 0x1001334d
cmp dword [ebp - 0x40], 0
je 0x1001334d
mov dword [ebp - 0x338], 1
jmp 0x10013354
and dword [ebp - 0x338], 0
cmp dword [ebp - 0x338], 0x4a52
jne 0x1001336f
cmp dword [ebp - 0x40], 0
jne 0x1001336f
and dword [ebp - 0x6bc], 0
jmp 0x10013379
mov dword [ebp - 0x6bc], 1
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x40]
jg 0x10013396
mov dword [ebp - 0x598], 1
jmp 0x1001339d
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x100133bb
and dword [ebp - 0x5b0], 0
jmp 0x100133c5
mov dword [ebp - 0x5b0], 1
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x5b0]
cmp eax, 0x3e45
jl 0x100133e1
mov dword [ebp - 0x5b8], 1
jmp 0x100133e8
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x206dd2cc
jg 0x10013409
cmp dword [ebp - 0xc0], 0
jne 0x1001341b
cmp dword [ebp - 0xc0], 0
jne 0x1001341b
and dword [ebp - 0x5c0], 0
jmp 0x10013425
mov dword [ebp - 0x5c0], 1
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x5c0], eax
jne 0x1001343c
mov dword [ebp - 0x5c8], 1
jmp 0x10013443
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x5c8]
sub eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x40]
jg 0x1001345d
mov dword [ebp - 0x5d0], 1
jmp 0x10013464
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x5d0]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5a4], eax
push 0
lea ecx, [ebp - 0x740]
call fcn.1002246c
mov ecx, dword [ebp - 0x5a4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
neg eax
je 0x10013506
mov dword [ebp - 0x4c], 0
jmp 0x100134ab
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffe6
jl 0x100134e4
mov dword [ebp - 0x638], 0xe83
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x100134d8
push 0x14f8
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x638], 0x36a5b5cf
jmp 0x100134a4
mov byte [ebp - 0xaf], 0
movzx eax, byte [ebp - 0xaf]
test eax, eax
je 0x10013501
push 0x2675
call dword [sym.imp.GDI32.dll_GetBkColor]
jmp 0x100137c4
mov dword [ebp - 0x10c], 0x360abed9
push 1
lea ecx, [ebp - 0x2a4]
call fcn.100223ce
mov byte [ebp - 4], 1
mov dword [ebp - 0x454], 0xc7819afc
mov dword [ebp - 0x160], 0
jmp 0x10013544
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jge 0x10013566
push dword [ebp - 0x160]
lea ecx, [ebp - 0x2a4]
call fcn.1002246c
mov dword [eax], 0x51ef224b
jmp 0x10013537
mov eax, 0xa0f83931
test eax, eax
je 0x10013610
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x9a4], eax
push 0
lea ecx, [ebp - 0x740]
call fcn.1002246c
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x904], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x92c], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x90c], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x934], eax
mov esi, dword [ebp - 0x218]
mov edi, dword [ebp - 0x10c]
push 0
lea ecx, [ebp - 0x2a4]
call fcn.1002246c
sub edi, dword [eax]
cmp edi, esi
jne 0x100135e4
mov dword [ebp - 0x640], 1
jmp 0x100135eb
and dword [ebp - 0x640], 0
push 0
lea ecx, [ebp - 0x2a4]
call fcn.1002246c
mov eax, 0xffff
imul eax, eax, 0
test eax, eax
je 0x10013610
mov dword [ebp - 0x444], 1
jmp 0x10013617
and dword [ebp - 0x444], 0
cmp dword [ebp - 0x444], 0x3d0c
jle 0x1001362f
mov dword [ebp - 0x6b4], 1
jmp 0x10013636
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x91c], eax
mov esi, dword [ebp - 0x454]
push 0
lea ecx, [ebp - 0x2a4]
call fcn.1002246c
imul eax, dword [eax], 0xf149
cmp eax, esi
jl 0x10013674
mov eax, 0xf77a3124
test eax, eax
je 0x10013674
mov dword [ebp - 0x590], 1
jmp 0x1001367b
and dword [ebp - 0x590], 0
push 0
lea ecx, [ebp - 0x2a4]
call fcn.1002246c
mov ecx, dword [ebp - 0x590]
cmp ecx, dword [eax]
je 0x1001369e
mov dword [ebp - 0x2b4], 1
jmp 0x100136a5
and dword [ebp - 0x2b4], 0
mov esi, dword [ebp - 0xc0]
push 0
lea ecx, [ebp - 0x2a4]
call fcn.1002246c
mov ecx, dword [ebp - 0x2b4]
add ecx, dword [eax]
sub ecx, esi
cmp ecx, 0xa872
jl 0x100136d6
mov dword [ebp - 0x574], 1
jmp 0x100136dd
and dword [ebp - 0x574], 0
mov esi, dword [ebp - 0x574]
dec esi
push 0
lea ecx, [ebp - 0x2a4]
call fcn.1002246c
cmp esi, dword [eax]
jg 0x10013701
mov dword [ebp - 0x2bc], 1
jmp 0x10013708
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x2bc]
sub eax, 3
cmp eax, 0xc2cfccff
ja 0x10013724
mov dword [ebp - 0x44c], 1
jmp 0x1001372b
and dword [ebp - 0x44c], 0
imul eax, dword [ebp - 0x44c], 0xec51
test eax, eax
je 0x1001374e
mov eax, 0x9f7e48ff
test eax, eax
je 0x1001374e
mov dword [ebp - 0x2c4], 1
jmp 0x10013755
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x5e8]
cmp dword [ebp - 0x2c4], eax
je 0x10013775
mov eax, 0x7809
test eax, eax
jne 0x10013775
and dword [ebp - 0x514], 0
jmp 0x1001377f
mov dword [ebp - 0x514], 1
push 0
lea ecx, [ebp - 0x2a4]
call fcn.1002246c
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [eax]
jge 0x100137a2
mov dword [ebp - 0x2cc], 1
jmp 0x100137a9
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x454], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2a4]
call fcn.10022450
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x740]
call fcn.10022450
mov dword [ebp - 0xf0], 0xe0648261
push 1
lea ecx, [ebp - 0x7ec]
call fcn.100223ce
mov dword [ebp - 4], 2
mov dword [ebp - 0x9e4], 0xfffffff9
mov dword [ebp - 0x104], 0x664a1160
mov dword [ebp - 0x1bc], 0
jmp 0x1001381e
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 1
jge 0x10013840
push dword [ebp - 0x1bc]
lea ecx, [ebp - 0x7ec]
call fcn.1002246c
mov dword [eax], 0xfffffffe
jmp 0x10013811
mov dword [ebp - 0xf0], 0
jmp 0x10013859
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xfffffff7
jge 0x10013a4d
mov dword [ebp - 0x250], 0xffffffff
push 3
lea ecx, [ebp - 0x81c]
call fcn.100223ce
mov byte [ebp - 4], 3
mov dword [ebp - 0x2dc], 1
mov dword [ebp - 0x60], 0
jmp 0x1001389b
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x100138b1
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x918], 0x45ccb972
jmp 0x10013894
mov dword [ebp - 0x60], 0
jmp 0x100138c1
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x100138da
push dword [ebp - 0x60]
lea ecx, [ebp - 0x81c]
call fcn.1002246c
and dword [eax], 0
jmp 0x100138ba
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x2d4], eax
push 0
lea ecx, [ebp - 0x7ec]
call fcn.1002246c
mov ecx, dword [ebp - 0x2d4]
mov dword [eax], ecx
cmp dword [ebp - 0x2d4], 0
jne 0x1001393f
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0x250]
dec ecx
mov dword [ebp - 0x250], ecx
test eax, eax
jne 0x1001393f
push 1
lea ecx, [ebp - 0x81c]
call fcn.1002246c
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x228]
mov dword [ecx], eax
imul eax, dword [ebp - 0x104], 6
cmp eax, dword [ebp - 0x104]
je 0x1001395a
mov dword [ebp - 0x5bc], 1
jmp 0x10013961
and dword [ebp - 0x5bc], 0
xor eax, eax
sub eax, dword [ebp - 0xf0]
cmp eax, 0xe13f
jne 0x1001397c
mov dword [ebp - 0x6c4], 1
jmp 0x10013983
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x86c], eax
push 8
pop eax
test eax, eax
je 0x100139be
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x918], 0
je 0x100139be
mov dword [ebp - 0x45c], 1
jmp 0x100139c5
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x45c], eax
jne 0x100139df
mov dword [ebp - 0x2e4], 1
jmp 0x100139e6
and dword [ebp - 0x2e4], 0
cmp dword [ebp - 0x2e4], 0xf4f9
jl 0x100139fe
mov dword [ebp - 0x51c], 1
jmp 0x10013a05
and dword [ebp - 0x51c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x918]
cmp dword [ebp - 0x51c], eax
jl 0x10013a26
mov dword [ebp - 0x2ec], 1
jmp 0x10013a2d
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x104], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x81c]
call fcn.10022450
jmp 0x1001384c
mov dword [ebp - 0x104], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7ec]
call fcn.10022450
cmp dword [0x1061d930], 0
jne 0x100170d3
push 1
lea ecx, [ebp - 0x5e4]
call fcn.100223ce
mov dword [ebp - 4], 4
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x268], 0x7d2703d9
mov dword [ebp - 0x870], 0xffffffff
mov dword [ebp - 0x1c], 0
jmp 0x10013ab2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x10013ace
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x5e4]
call fcn.1002246c
mov dword [eax], 1
jmp 0x10013aab
mov dword [ebp - 0x1c], 0
jmp 0x10013ade
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10013af4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x928], 0xfffffff7
jmp 0x10013ad7
mov dword [ebp - 0x1c], 0
jmp 0x10013b04
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10013b1a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x940], 3
jmp 0x10013afd
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x10013b39
push 0
push 0x212
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov dword [ebp - 0x48], 0
jmp 0x10013b49
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x10013e12
mov dword [ebp - 0xdc], 5
mov dword [ebp - 0x1c4], 0x72b21a35
mov dword [ebp - 0xdc], 0
jmp 0x10013b80
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jg 0x10013e0d
mov dword [ebp - 0x230], 0x44c039ec
push 2
lea ecx, [ebp - 0x770]
call fcn.100223ce
mov byte [ebp - 4], 5
mov dword [ebp - 0x6cc], 0x36fbc6a6
mov dword [ebp - 0x6b0], 0x6ce2e7c5
mov dword [ebp - 0x168], 0
jmp 0x10013bd5
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jge 0x10013bf7
push dword [ebp - 0x168]
lea ecx, [ebp - 0x770]
call fcn.1002246c
mov dword [eax], 7
jmp 0x10013bc8
mov esi, dword [ebp - 0xdc]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x5e4]
call fcn.1002246c
cmp esi, dword [eax]
jl 0x10013c1e
cmp dword [ebp - 0x48], 0
jne 0x10013c1e
and dword [ebp - 0x464], 0
jmp 0x10013c28
mov dword [ebp - 0x464], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x928]
cmp dword [ebp - 0x464], eax
jg 0x10013c49
mov dword [ebp - 0x260], 1
jmp 0x10013c50
and dword [ebp - 0x260], 0
push 0
lea ecx, [ebp - 0x770]
call fcn.1002246c
mov ecx, dword [ebp - 0x260]
mov dword [eax], ecx
cmp dword [ebp - 0x260], 0
je 0x10013c83
mov eax, 0xe6da
test eax, eax
je 0x10013c83
mov dword [ebp - 0x2f4], 1
jmp 0x10013c8a
and dword [ebp - 0x2f4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2f4]
mov dword [ebp + eax - 0x928], ecx
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x878], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x880], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x6cc], eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0x5e4]
call fcn.1002246c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x940]
mov dword [ebp - 0x888], eax
mov esi, dword [ebp - 0x1c4]
push 0
lea ecx, [ebp - 0x770]
call fcn.1002246c
mov edi, dword [eax]
sub edi, esi
push dword [ebp - 0x48]
lea ecx, [ebp - 0x5e4]
call fcn.1002246c
cmp edi, dword [eax]
jne 0x10013d14
mov dword [ebp - 0x57c], 1
jmp 0x10013d1b
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x57c]
add eax, 0x5879a273
sub eax, dword [ebp - 0xdc]
je 0x10013d43
cmp dword [ebp - 0x1c4], 0
je 0x10013d43
mov dword [ebp - 0x2fc], 1
jmp 0x10013d4a
and dword [ebp - 0x2fc], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x2fc]
je 0x10013d6a
mov eax, 0xf3b1
test eax, eax
je 0x10013d6a
mov dword [ebp - 0x46c], 1
jmp 0x10013d71
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x6dc], eax
mov eax, dword [ebp - 0x230]
dec eax
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x6d4]
cmp eax, dword [ebp - 0x6dc]
jl 0x10013db0
mov dword [ebp - 0x670], 1
jmp 0x10013db7
and dword [ebp - 0x670], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x5e4]
call fcn.1002246c
cmp dword [ebp - 0x268], 0
je 0x10013dda
mov dword [ebp - 0x304], 1
jmp 0x10013de1
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x6b0], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x770]
call fcn.10022450
jmp 0x10013b73
jmp 0x10013b42
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5e4]
call fcn.10022450
mov dword [ebp - 0x78c], 0x76820624
mov dword [ebp - 0x788], 0x76820624
mov dword [ebp - 0x784], 0x76820624
mov dword [ebp - 0x780], 0x76820624
lea ecx, [ebp - 0x261]
call fcn.1002247b
push eax
lea eax, [ebp - 0x77c]
push eax
lea eax, [ebp - 0x78c]
push eax
lea ecx, [ebp - 0xa40]
call fcn.1002247e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x6ec]
call fcn.1002242a
mov dword [ebp - 4], 6
mov dword [ebp - 0x630], 1
mov dword [ebp - 0x890], 0
mov dword [ebp - 0x898], 0xd9796a0b
mov dword [ebp - 0x314], 0x4179
push 0
lea ecx, [ebp - 0x6ec]
call fcn.1002246c
and dword [eax], 0
jmp 0x10013ee3
push 0
lea ecx, [ebp - 0x6ec]
call fcn.1002246c
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x524]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x524]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x6ec]
call fcn.1002246c
cmp dword [eax], 0xffffffe3
jge 0x10013ffa
mov dword [ebp - 0x114], 0xa986
push 4
lea ecx, [ebp - 0x804]
call fcn.100223ce
mov byte [ebp - 4], 7
mov dword [ebp - 0x474], 0x8d927f7b
mov dword [ebp - 0x170], 0
jmp 0x10013f37
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 4
jge 0x10013f59
push dword [ebp - 0x170]
lea ecx, [ebp - 0x804]
call fcn.1002246c
mov dword [eax], 0xaeb59008
jmp 0x10013f2a
mov esi, dword [ebp - 0x114]
push 2
lea ecx, [ebp - 0x6ec]
call fcn.1002246c
cmp esi, dword [eax]
jl 0x10013f82
mov eax, 0xc4185a1f
test eax, eax
jne 0x10013f82
and dword [ebp - 0x30c], 0
jmp 0x10013f8c
mov dword [ebp - 0x30c], 1
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x114], 0xffffffe3
jmp 0x10013fb1
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xb
je 0x10013fe6
mov dword [ebp - 0x8a0], 1
mov eax, dword [ebp - 0x474]
dec eax
mov dword [ebp - 0x474], eax
push 1
lea ecx, [ebp - 0x804]
call fcn.1002246c
mov dword [eax], 0xc6f1fdbd
jmp 0x10013fa4
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x804]
call fcn.10022450
jmp 0x10013ebf
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6ec]
call fcn.10022450
mov byte [ebp - 0x150], 0xb
mov byte [ebp - 0x14f], 0x6f
mov byte [ebp - 0x14e], 8
mov byte [ebp - 0x14d], 0x42
mov byte [ebp - 0x14c], 6
mov byte [ebp - 0x14b], 0x1d
mov byte [ebp - 0x14a], 9
mov byte [ebp - 0x149], 0x57
mov byte [ebp - 0x148], 3
mov byte [ebp - 0x147], 0xa
mov byte [ebp - 0x146], 0
mov byte [ebp - 0x145], 0x25
mov byte [ebp - 0x144], 2
mov byte [ebp - 0x143], 0x39
mov byte [ebp - 0x142], 7
mov byte [ebp - 0x141], 0x40
mov byte [ebp - 0x140], 5
mov byte [ebp - 0x13f], 0x5e
mov byte [ebp - 0x13e], 0xa
mov byte [ebp - 0x13d], 0
mov byte [ebp - 0x13c], 4
mov byte [ebp - 0x13b], 9
mov byte [ebp - 0x13a], 1
mov byte [ebp - 0x139], 0
mov dword [ebp - 0x38], 0x62fd
mov dword [ebp - 0x1d4], 0x525
mov dword [ebp - 0x4a4], 0xfffffffe
mov dword [ebp - 0x6b8], 0x15bfeb1e
mov dword [ebp - 0xcc], 0x7398
cmp dword [ebp - 0x38], 0
je 0x100143d7
mov dword [ebp - 0x70], 1
mov dword [ebp - 0x1cc], 0x64548797
mov dword [ebp - 0x238], 0xc821f997
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x38]
jle 0x10014126
mov dword [ebp - 0x5ac], 1
jmp 0x1001412d
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x5ac]
inc eax
cmp eax, dword [ebp - 0x38]
jl 0x10014145
mov dword [ebp - 0x5f4], 1
jmp 0x1001414c
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x8a8], eax
cmp dword [ebp - 0x70], 0
je 0x1001416a
cmp dword [ebp - 0x70], 0
je 0x1001416a
and dword [ebp - 0x714], 0
jmp 0x10014174
mov dword [ebp - 0x714], 1
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x38]
jge 0x10014191
mov dword [ebp - 0x31c], 1
jmp 0x10014198
and dword [ebp - 0x31c], 0
cmp dword [ebp - 0x31c], 0x38299fa9
jle 0x100141b0
mov dword [ebp - 0x47c], 1
jmp 0x100141b7
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x70]
add eax, dword [ebp - 0x47c]
je 0x100141d4
cmp dword [ebp - 0x70], 0
je 0x100141d4
mov dword [ebp - 0x324], 1
jmp 0x100141db
and dword [ebp - 0x324], 0
cmp dword [ebp - 0x324], 0xef9f
jne 0x100141f3
mov dword [ebp - 0x52c], 1
jmp 0x100141fa
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x52c], eax
jge 0x10014214
mov dword [ebp - 0x32c], 1
jmp 0x1001421b
and dword [ebp - 0x32c], 0
cmp dword [ebp - 0x32c], 0xffffffff
jle 0x10014230
mov dword [ebp - 0x484], 1
jmp 0x10014237
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x1cc]
imul eax, dword [ebp - 0x484]
cmp eax, dword [ebp - 0x70]
jle 0x1001425b
cmp dword [ebp - 0x38], 0
je 0x1001425b
mov dword [ebp - 0x334], 1
jmp 0x10014262
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x334]
je 0x10014279
mov dword [ebp - 0x584], 1
jmp 0x10014280
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
cmp eax, dword [ebp - 0x38]
jg 0x100142a3
mov dword [ebp - 0x33c], 1
jmp 0x100142aa
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x33c], eax
jle 0x100142c1
mov dword [ebp - 0x5fc], 1
jmp 0x100142c8
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x8b8], eax
imul eax, dword [ebp - 0x1d4], 0xb5fb
test eax, eax
je 0x100142f2
push 3
pop eax
test eax, eax
jne 0x100142f2
and dword [ebp - 0x48c], 0
jmp 0x100142fc
mov dword [ebp - 0x48c], 1
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0xffffffff
jg 0x1001431d
mov dword [ebp - 0x344], 1
jmp 0x10014324
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
add eax, 0xa21b
cmp eax, dword [ebp - 0x38]
jle 0x10014346
cmp dword [ebp - 0x238], 0
jne 0x10014346
and dword [ebp - 0x534], 0
jmp 0x10014350
mov dword [ebp - 0x534], 1
mov eax, dword [ebp - 0x70]
add eax, dword [ebp - 0x534]
jne 0x10014367
mov dword [ebp - 0x34c], 1
jmp 0x1001436e
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x4a4]
cmp dword [ebp - 0x34c], eax
jge 0x10014388
mov dword [ebp - 0x494], 1
jmp 0x1001438f
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x494], eax
jge 0x100143a6
mov dword [ebp - 0x354], 1
jmp 0x100143ad
and dword [ebp - 0x354], 0
cmp dword [ebp - 0x354], 5
jg 0x100143c2
mov dword [ebp - 0x5cc], 1
jmp 0x100143c9
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x6b8], eax
jmp 0x100143ed
mov dword [ebp - 0x604], 0xb270
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x604], eax
mov dword [ebp - 0xcc], 0
jmp 0x10014406
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x2e
jg 0x1001457d
mov dword [ebp - 0x36c], 0xdeea39ba
mov dword [ebp - 0x58c], 0xfffffffa
mov dword [ebp - 0x60c], 0xffffffff
mov dword [ebp - 0x178], 0
jmp 0x1001444a
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
jge 0x10014466
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x700], 0xfffffff9
jmp 0x1001443d
mov byte [ebp - 0x88], 0
movzx eax, byte [ebp - 0x88]
test eax, eax
je 0x10014485
push 0
push 0x51c
call dword [sym.imp.USER32.dll_ClientToScreen]
cmp dword [ebp - 0xcc], 0
jne 0x1001449a
mov dword [ebp - 0x35c], 1
jmp 0x100144a1
and dword [ebp - 0x35c], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x700], 0
cmp dword [ebp - 0x1d4], 0
je 0x100144c7
mov dword [ebp - 0x49c], 1
jmp 0x100144ce
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x35c]
cmp eax, dword [ebp - 0x49c]
jne 0x100144e8
mov dword [ebp - 0x364], 1
jmp 0x100144ef
and dword [ebp - 0x364], 0
cmp dword [ebp - 0x364], 0x929efcf3
jae 0x10014507
mov dword [ebp - 0x53c], 1
jmp 0x1001450e
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x36c]
cmp dword [ebp - 0x53c], eax
jl 0x10014531
cmp dword [ebp - 0x1d4], 0
je 0x10014531
mov dword [ebp - 0x374], 1
jmp 0x10014538
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x58c], eax
mov eax, dword [ebp - 0x4a4]
imul eax, dword [ebp - 0x374]
cmp dword [ebp - 0x58c], eax
jne 0x10014565
mov dword [ebp - 0x37c], 1
jmp 0x1001456c
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x60c], eax
jmp 0x100143f9
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x150]
and eax, 3
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x150]
or ecx, 3
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x150]
mov word [ebp + eax*2 - 0x864], cx
mov dword [ebp - 0x180], 2
mov dword [ebp - 0x838], 0x2d14
mov dword [ebp - 0x834], 0x2d14
mov dword [ebp - 0x830], 0x2d14
mov dword [ebp - 0x82c], 0x2d14
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x10014603
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov dword [ebp - 0x180], 0
jmp 0x1001461c
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xfffffff3
jge 0x1001467c
mov dword [ebp - 0xf8], 0x7fd1e814
mov dword [ebp - 0x6c0], 0x9c1464f1
mov dword [ebp - 0xf8], 3
jmp 0x10014652
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jl 0x1001467a
mov eax, dword [ebp - 0xf8]
cmp dword [ebp + eax*4 - 0x838], 0
je 0x1001466d
jmp 0x1001467a
cmp dword [ebp - 0x6c0], 0
je 0x10014678
jmp 0x10014645
jmp 0x10014645
jmp 0x1001460f
mov dword [ebp - 0x74], 2
and dword [ebp - 0x4b4], 0
jmp 0x10014694
mov eax, dword [ebp - 0x74]
inc eax
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x18
jae 0x100149b5
mov dword [ebp - 0x1dc], 9
mov dword [ebp - 0x38c], 0x8f4727c
mov dword [ebp - 0x240], 8
mov dword [ebp - 0x8c0], 0x7c
mov dword [ebp - 0x8c8], 0x189f42c6
mov dword [ebp - 0x7a0], 0xfffffff6
mov dword [ebp - 0x79c], 0xfffffff6
mov dword [ebp - 0x798], 0xfffffff6
mov dword [ebp - 0x794], 0xfffffff6
lea ecx, [ebp - 0x241]
call fcn.1002247b
push eax
lea eax, [ebp - 0x790]
push eax
lea eax, [ebp - 0x7a0]
push eax
lea ecx, [ebp - 0xa50]
call fcn.1002247e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x950]
call fcn.1002242a
mov dword [ebp - 4], 8
mov dword [ebp - 0x25c], 0x199314e7
mov dword [ebp - 0x1dc], 9
jmp 0x10014757
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0x19
jl 0x10014940
mov dword [ebp - 0x614], 0xfff9
mov dword [ebp - 0x6c8], 0
mov dword [ebp - 0x61c], 0x11e7bff4
mov dword [ebp - 0x8d0], 0x23dcdf5e
mov dword [ebp - 0x62c], 1
push 2
lea ecx, [ebp - 0x7e0]
call fcn.100223ce
mov byte [ebp - 4], 9
mov dword [ebp - 0x50], 0
jmp 0x100147b7
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x100147cd
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x254], 0x1c097bc8
jmp 0x100147b0
mov dword [ebp - 0x50], 0
jmp 0x100147dd
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x100147f9
push dword [ebp - 0x50]
lea ecx, [ebp - 0x7e0]
call fcn.1002246c
mov dword [eax], 0xfaba
jmp 0x100147d6
cmp dword [ebp - 0x614], 0
je 0x10014813
xor eax, eax
inc eax
je 0x10014813
mov dword [ebp - 0x4ac], 1
jmp 0x1001481a
and dword [ebp - 0x4ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x254]
mov dword [ebp - 0x718], eax
push 2
lea ecx, [ebp - 0x950]
call fcn.1002246c
mov ecx, dword [ebp - 0x718]
mov dword [eax], ecx
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x8d8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x254]
sub eax, 0x6ea0
imul ecx, dword [ebp - 0x25c], 0xffff
imul ecx, eax
mov dword [ebp - 0x240], ecx
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x624], eax
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x25c]
dec eax
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x624]
cmp eax, dword [ebp - 0x66c]
je 0x100148b2
mov dword [ebp - 0x384], 1
jmp 0x100148b9
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x4ac]
cmp eax, dword [ebp - 0x384]
jge 0x100148d5
or eax, 0xffffffff
jne 0x100148d5
and dword [ebp - 0x544], 0
jmp 0x100148df
mov dword [ebp - 0x544], 1
mov eax, dword [ebp - 0x62c]
cmp dword [ebp - 0x544], eax
je 0x100148f9
mov dword [ebp - 0x674], 1
jmp 0x10014900
and dword [ebp - 0x674], 0
push 1
lea ecx, [ebp - 0x7e0]
call fcn.1002246c
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x38c]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x254], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x7e0]
call fcn.10022450
jmp 0x1001474a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x950]
call fcn.10022450
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x4b4]
movzx eax, byte [ebp + eax - 0x152]
movzx eax, word [ebp + eax*2 - 0x864]
mov ecx, dword [ebp - 0x74]
movzx ecx, byte [ebp + ecx - 0x14f]
and ecx, eax
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x4b4]
movzx eax, byte [ebp + eax - 0x152]
movzx eax, word [ebp + eax*2 - 0x864]
mov edx, dword [ebp - 0x74]
movzx edx, byte [ebp + edx - 0x14f]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x74]
movzx eax, byte [ebp + eax - 0x150]
mov word [ebp + eax*2 - 0x864], dx
jmp 0x1001468c
push 2
lea ecx, [ebp - 0x274]
call fcn.100223ce
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x18], 0xffb871c7
push 3
lea ecx, [ebp - 0x6fc]
call fcn.100223ce
mov byte [ebp - 4], 0xb
mov dword [ebp - 0xf4], 0x506ed55c
mov dword [ebp - 0xec], 0xfffffffc
mov dword [ebp - 0x28], 0
jmp 0x10014a05
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10014a21
push dword [ebp - 0x28]
lea ecx, [ebp - 0x274]
call fcn.1002246c
mov dword [eax], 1
jmp 0x100149fe
mov dword [ebp - 0x28], 0
jmp 0x10014a31
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10014a4d
push dword [ebp - 0x28]
lea ecx, [ebp - 0x6fc]
call fcn.1002246c
mov dword [eax], 8
jmp 0x10014a2a
mov dword [ebp - 0x28], 0
jmp 0x10014a5d
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10014a73
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x778], 0xa938f738
jmp 0x10014a56
mov dword [ebp - 0x18], 0
jmp 0x10014a83
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x10014c47
mov dword [ebp - 0x248], 0x22401dbd
push dword [ebp - 0x18]
lea ecx, [ebp - 0x274]
call fcn.1002246c
cmp dword [eax], 0
jne 0x10014ac5
push 1
lea ecx, [ebp - 0x274]
call fcn.1002246c
cmp dword [eax], 0
jne 0x10014ac5
and dword [ebp - 0x634], 0
jmp 0x10014acf
mov dword [ebp - 0x634], 1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x274]
call fcn.1002246c
mov dword [ebp - 0x248], 1
or eax, 0xffffffff
sub eax, dword [ebp - 0x248]
je 0x10014b07
cmp dword [ebp - 0x248], 0
je 0x10014b07
mov dword [ebp - 0x67c], 1
jmp 0x10014b0e
and dword [ebp - 0x67c], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x274]
call fcn.1002246c
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x778], 0xf8609561
mov eax, 0xf8609561
cmp eax, 1
jbe 0x10014b43
mov dword [ebp - 0x394], 1
jmp 0x10014b4a
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x394], eax
je 0x10014b61
mov dword [ebp - 0x5b4], 1
jmp 0x10014b68
and dword [ebp - 0x5b4], 0
push 1
lea ecx, [ebp - 0x6fc]
call fcn.1002246c
mov dword [eax], 0x2b21a35c
cmp dword [ebp - 0x5b4], 0x2b21a35c
jge 0x10014b93
mov dword [ebp - 0x39c], 1
jmp 0x10014b9a
and dword [ebp - 0x39c], 0
push 1
lea ecx, [ebp - 0x274]
call fcn.1002246c
mov ecx, dword [ebp - 0x39c]
cmp ecx, dword [eax]
je 0x10014bbd
mov dword [ebp - 0x63c], 1
jmp 0x10014bc4
and dword [ebp - 0x63c], 0
push 1
lea ecx, [ebp - 0x274]
call fcn.1002246c
push 5
pop esi
add esi, 3
push dword [ebp - 0x18]
lea ecx, [ebp - 0x274]
call fcn.1002246c
add esi, dword [eax]
cmp esi, 0xe708bee6
jb 0x10014bfb
mov dword [ebp - 0x4bc], 1
jmp 0x10014c02
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x4bc], eax
je 0x10014c19
mov dword [ebp - 0x3a4], 1
jmp 0x10014c20
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0xf4], eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x274]
call fcn.1002246c
mov eax, dword [eax]
mov dword [ebp - 0xec], eax
jmp 0x10014a7c
mov dword [ebp - 0xec], 5
jmp 0x10014c60
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xfffffff0
jg 0x10014d7d
mov dword [ebp - 0x684], 0x535b5b06
mov dword [ebp - 0x188], 0
jmp 0x10014c90
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 4
jge 0x10014cac
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0xa98], 1
jmp 0x10014c83
mov dword [ebp - 0xf4], 0
jmp 0x10014cc5
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xfffffff7
jne 0x10014cec
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x10014cea
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
jmp 0x10014cb8
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x778], 0
je 0x10014d65
mov dword [ebp - 0x18], 2
jmp 0x10014d0c
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x10014d58
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x10014d34
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x6fc]
call fcn.1002246c
mov esi, eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x6fc]
call fcn.1002246c
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x10014d05
cmp dword [ebp - 0xec], 0
je 0x10014d63
jmp 0x10014d7d
jmp 0x10014d78
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa98]
mov dword [ebp - 0x684], eax
jmp 0x10014c53
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x6fc]
call fcn.10022450
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x274]
call fcn.10022450
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x864], cx
lea eax, [ebp - 0x864]
push eax
lea ecx, [ebp - 0xae4]
call fcn.100222ec
mov dword [ebp - 0x644], eax
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x68c], eax
mov dword [ebp - 4], 0xc
push dword [ebp - 0x68c]
call fcn.1000b543
pop ecx
mov dword [ebp - 0x498], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xae4]
call fcn.10022311
mov dword [ebp - 0x108], 0xcecb4571
mov dword [ebp - 0x650], 0x579253a3
mov dword [ebp - 0x1e4], 0
jmp 0x10014e24
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 4
jge 0x10014e40
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0xa10], 0x841b3c69
jmp 0x10014e17
mov dword [ebp - 0x108], 0
jmp 0x10014e59
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jg 0x10014f0b
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x190], 0
jmp 0x10014e89
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 3
jg 0x10014ef2
mov dword [ebp - 0x100], 0xffffffff
mov dword [ebp - 0x100], 3
jmp 0x10014eb5
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jl 0x10014ed2
mov eax, dword [ebp - 0x100]
cmp dword [ebp + eax*4 - 0xa10], 0
je 0x10014ed0
jmp 0x10014ed2
jmp 0x10014ea8
mov byte [ebp - 0xa6], 0
movzx eax, byte [ebp - 0xa6]
test eax, eax
je 0x10014ef0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x10014e7c
mov eax, dword [ebp - 0x108]
imul eax, dword [ebp + eax*4 - 0xa10], 0xffffffff
mov dword [ebp - 0x650], eax
jmp 0x10014e4c
and dword [ebp - 0x1a0], 0
jmp 0x10014f21
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xd
jae 0x10015294
mov dword [ebp - 0x198], 0xffffffff
mov dword [ebp - 0x3cc], 0xa61e
mov dword [ebp - 0x694], 0x263d1880
mov dword [ebp - 0x3bc], 0xfffffff6
mov dword [ebp - 0x1f4], 7
mov dword [ebp - 0x65c], 4
or dword [ebp - 0x7c8], 0xffffffff
or dword [ebp - 0x7c4], 0xffffffff
or dword [ebp - 0x7c0], 0xffffffff
or dword [ebp - 0x7bc], 0xffffffff
lea ecx, [ebp - 0x249]
call fcn.1002247b
push eax
lea eax, [ebp - 0x7b8]
push eax
lea eax, [ebp - 0x7c8]
push eax
lea ecx, [ebp - 0xa88]
call fcn.1002247e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x28c]
call fcn.1002242a
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x1ec], 0
cmp dword [ebp - 0x198], 0xfffffffe
jg 0x10014fe1
mov dword [ebp - 0x4cc], 1
jmp 0x10014fe8
and dword [ebp - 0x4cc], 0
cmp dword [ebp - 0x3cc], 0
jne 0x1001508b
push 0
lea ecx, [ebp - 0x28c]
call fcn.1002246c
cmp dword [ebp - 0x1f4], 0
jne 0x10015017
mov dword [ebp - 0x54c], 1
jmp 0x1001501e
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
inc eax
mov ecx, dword [ebp - 0x198]
add ecx, eax
cmp ecx, 0xc9d94031
je 0x10015041
mov dword [ebp - 0x3ac], 1
jmp 0x10015048
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x1ec]
dec eax
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x1ec]
cmp eax, dword [ebp - 0x3ac]
jg 0x1001506f
mov dword [ebp - 0x4c4], 1
jmp 0x10015076
and dword [ebp - 0x4c4], 0
cmp dword [ebp - 0x4c4], 0x683a
jne 0x1001508b
and dword [ebp - 0x3b4], 0
jmp 0x10015095
mov dword [ebp - 0x3b4], 1
cmp dword [ebp - 0x3b4], 0xfffffffa
jbe 0x100150ce
push 2
lea ecx, [ebp - 0x28c]
call fcn.1002246c
cmp dword [eax], 0
je 0x100150ce
push 3
lea ecx, [ebp - 0x28c]
call fcn.1002246c
cmp dword [eax], 0
je 0x100150ce
mov dword [ebp - 0x594], 1
jmp 0x100150d5
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp - 0x3bc]
cmp eax, dword [ebp - 0x694]
je 0x100150fb
mov dword [ebp - 0x3c4], 1
jmp 0x10015102
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0x3c4]
jl 0x1001511c
mov dword [ebp - 0x554], 1
jmp 0x10015123
and dword [ebp - 0x554], 0
push 3
lea ecx, [ebp - 0x28c]
call fcn.1002246c
mov ecx, dword [ebp - 0x554]
cmp ecx, dword [eax]
jne 0x1001514c
cmp dword [ebp - 0x3cc], 0
jne 0x1001514c
and dword [ebp - 0x4d4], 0
jmp 0x10015156
mov dword [ebp - 0x4d4], 1
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x65c], eax
push 3
lea ecx, [ebp - 0x28c]
call fcn.1002246c
cmp dword [eax], 0
jne 0x10015180
mov dword [ebp - 0x3d4], 1
jmp 0x10015187
and dword [ebp - 0x3d4], 0
push 3
lea ecx, [ebp - 0x28c]
call fcn.1002246c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3d4]
je 0x100151aa
mov dword [ebp - 0x5c4], 1
jmp 0x100151b1
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x5c4], eax
jl 0x100151cb
mov dword [ebp - 0x69c], 1
jmp 0x100151d2
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x8e0], eax
cmp dword [ebp - 0x1f4], 0x681c
jle 0x100151f6
mov dword [ebp - 0x3dc], 1
jmp 0x100151fd
and dword [ebp - 0x3dc], 0
mov esi, dword [ebp - 0x198]
dec esi
sub esi, dword [ebp - 0x3dc]
push 1
lea ecx, [ebp - 0x28c]
call fcn.1002246c
cmp esi, dword [eax]
jg 0x10015227
mov dword [ebp - 0x258], 1
jmp 0x1001522e
and dword [ebp - 0x258], 0
push 3
lea ecx, [ebp - 0x28c]
call fcn.1002246c
mov ecx, dword [ebp - 0x258]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0x258], eax
jge 0x1001525d
mov dword [ebp - 0x4dc], 1
jmp 0x10015264
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x1f4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28c]
call fcn.10022450
xor eax, eax
mov ecx, dword [ebp - 0x1a0]
mov word [ebp + ecx*2 - 0x864], ax
jmp 0x10014f14
mov dword [ebp - 0xd4], 0xd45db34e
mov dword [ebp - 0x55c], 0xfffffffa
mov dword [ebp - 0x1fc], 0
jmp 0x100152c1
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 4
jge 0x100152dd
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0xa68], 0x29be1d92
jmp 0x100152b4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xa68], 0x48261f9c
mov dword [ebp - 0xd4], 0x48261f9c
mov dword [ebp - 0xd4], 0
jmp 0x10015311
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jle 0x10015426
mov dword [ebp - 0xe4], 0xffffffff
mov dword [ebp - 0x668], 1
cmp dword [ebp - 0xd4], 0
jne 0x10015347
mov dword [ebp - 0x3e4], 1
jmp 0x1001534e
and dword [ebp - 0x3e4], 0
mov dword [ebp - 0x55c], 1
mov eax, dword [ebp - 0xe4]
imul eax, dword [ebp - 0x3e4]
cmp eax, dword [ebp - 0x55c]
jne 0x10015379
mov dword [ebp - 0x3ec], 1
jmp 0x10015380
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x3ec]
sub eax, dword [ebp - 0xe4]
cmp dword [ebp - 0xe4], eax
jle 0x100153a9
cmp dword [ebp - 0xe4], 0
je 0x100153a9
mov dword [ebp - 0x4e4], 1
jmp 0x100153b0
and dword [ebp - 0x4e4], 0
cmp dword [ebp - 0x4e4], 0x9f08
jle 0x100153c8
mov dword [ebp - 0x3f4], 1
jmp 0x100153cf
and dword [ebp - 0x3f4], 0
imul eax, dword [ebp - 0x3f4], 0xfffe
cmp eax, dword [ebp - 0xe4]
jl 0x100153ed
mov dword [ebp - 0x59c], 1
jmp 0x100153f4
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x59c], eax
je 0x1001540e
mov dword [ebp - 0x3fc], 1
jmp 0x10015415
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x668], eax
jmp 0x10015304
cmp dword [ebp - 0x498], 0
je 0x100170d3
mov dword [ebp - 0x94], 1
mov dword [ebp - 0x30], 0xde9bf9f
mov dword [ebp - 0x1a8], 0
jmp 0x1001545d
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jge 0x10015479
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x298], 0x974a
jmp 0x10015450
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x8e8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x8f0], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x8f8], eax
mov eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
add ecx, eax
cmp ecx, dword [ebp - 0x30]
je 0x100154bc
mov dword [ebp - 0x4ec], 1
jmp 0x100154c3
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x4ec]
jle 0x100154dd
mov dword [ebp - 0x404], 1
jmp 0x100154e4
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 0x38884515
jge 0x100154fc
mov dword [ebp - 0x564], 1
jmp 0x10015503
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 2
jmp 0x1001551c
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x10015734
mov dword [ebp - 0x6a4], 0x2570
push 4
lea ecx, [ebp - 0x7f8]
call fcn.100223ce
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x54], 0
jmp 0x10015554
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x1001556a
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x21c], 0
jmp 0x1001554d
mov dword [ebp - 0x54], 0
jmp 0x1001557a
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x10015596
push dword [ebp - 0x54]
lea ecx, [ebp - 0x7f8]
call fcn.1002246c
mov dword [eax], 0x7f20bab1
jmp 0x10015573
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x298]
mov dword [ebp - 0x900], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x298], 0
je 0x100155cf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x298], 0
je 0x100155cf
mov dword [ebp - 0x40c], 1
jmp 0x100155d6
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x298]
cmp dword [ebp - 0x40c], eax
je 0x100155f4
mov dword [ebp - 0x4f4], 1
jmp 0x100155fb
and dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 7
jge 0x10015610
mov dword [ebp - 0x414], 1
jmp 0x10015617
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
sub eax, dword [ebp - 0x94]
push 4
pop ecx
shl ecx, 0
cmp dword [ebp + ecx - 0x298], eax
jl 0x1001563e
mov dword [ebp - 0x5a0], 1
jmp 0x10015645
and dword [ebp - 0x5a0], 0
cmp dword [ebp - 0x5a0], 0xf5cbf793
jae 0x1001565d
mov dword [ebp - 0x41c], 1
jmp 0x10015664
and dword [ebp - 0x41c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x41c]
sub ecx, 0xfffb
imul ecx, dword [ebp + eax - 0x298]
mov eax, dword [ebp - 0x30]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x298]
cmp ecx, dword [ebp + eax*4 - 0x298]
jge 0x100156c0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x21c], 0
jne 0x100156c0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x21c], 0
jne 0x100156c0
and dword [ebp - 0x4fc], 0
jmp 0x100156ca
mov dword [ebp - 0x4fc], 1
mov eax, dword [ebp - 0x6a4]
cmp dword [ebp - 0x4fc], eax
jl 0x100156ee
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x298], 0
jne 0x100156ee
and dword [ebp - 0x424], 0
jmp 0x100156f8
mov dword [ebp - 0x424], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x424]
mov dword [ebp + eax - 0x21c], ecx
mov esi, dword [ebp - 0x94]
push 1
lea ecx, [ebp - 0x7f8]
call fcn.1002246c
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7f8]
call fcn.10022450
jmp 0x10015515
mov dword [ebp - 0xc4], 0xa61928c1
mov dword [ebp - 0x6ac], 0xfffffff6
mov dword [ebp - 0xc4], 0
jmp 0x10015761
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xfffffff0
jl 0x1001585c
mov dword [ebp - 0x204], 0xaa9ac70c
mov dword [ebp - 0x43c], 0x124dc41f
mov dword [ebp - 0x204], 0
jmp 0x1001579b
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0x12
je 0x10015857
mov dword [ebp - 0x56c], 0xa927213e
mov eax, dword [ebp - 0x56c]
cmp eax, dword [ebp - 0xc4]
jg 0x100157cc
mov dword [ebp - 0x42c], 1
jmp 0x100157d3
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x56c]
cmp dword [ebp - 0x42c], eax
je 0x100157ed
mov dword [ebp - 0x504], 1
jmp 0x100157f4
and dword [ebp - 0x504], 0
imul eax, dword [ebp - 0x504], 0xfffffff9
cmp dword [ebp - 0xc4], eax
jl 0x1001580f
mov dword [ebp - 0x434], 1
jmp 0x10015816
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 0x9edca8fe
jae 0x1001582e
mov dword [ebp - 0x5a8], 1
jmp 0x10015835
and dword [ebp - 0x5a8], 0
mov eax, 0x7b4b
sub eax, dword [ebp - 0x5a8]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x6ac], eax
jmp 0x1001578e
jmp 0x10015754
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x1001587a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 1
lea ecx, [ebp - 0x764]
call fcn.100223ce
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x68], 0x971c1ec2
mov dword [ebp - 0x78], 0x365653d4
mov dword [ebp - 0x1b0], 0
jmp 0x100158b5
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 1
jge 0x100158d7
push dword [ebp - 0x1b0]
lea ecx, [ebp - 0x764]
call fcn.1002246c
mov dword [eax], 0x91a049fe
jmp 0x100158a8
mov dword [ebp - 0x68], 0
jmp 0x100158e7
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jg 0x100159ee
push 3
lea ecx, [ebp - 0x70c]
call fcn.100223ce
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x20c], 0
jmp 0x1001591b
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 3
jge 0x1001593a
push dword [ebp - 0x20c]
lea ecx, [ebp - 0x70c]
call fcn.1002246c
or dword [eax], 0xffffffff
jmp 0x1001590e
push 0
lea ecx, [ebp - 0x70c]
call fcn.1002246c
and dword [eax], 0
jmp 0x10015970
push 0
lea ecx, [ebp - 0x70c]
call fcn.1002246c
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x50c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x50c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x70c]
call fcn.1002246c
cmp dword [eax], 0
jl 0x100159a5
mov byte [ebp - 0xae], 0
movzx eax, byte [ebp - 0xae]
test eax, eax
je 0x1001599c
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [ebp - 0x78], 0
jmp 0x1001594c
mov dword [ebp - 0x78], 2
jmp 0x100159b5
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl 0x100159da
mov byte [ebp - 0xa7], 0
movzx eax, byte [ebp - 0xa7]
test eax, eax
je 0x100159d8
push 0x924
call dword [sym.imp.USER32.dll_ShowCaret]
jmp 0x100159ae
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x70c]
call fcn.10022450
jmp 0x100158e0
cmp dword [ebp - 0x78], 0
jge 0x10015a00
mov dword [ebp - 0x2ac], 1
jmp 0x10015a07
and dword [ebp - 0x2ac], 0
mov esi, dword [ebp - 0x68]
sub esi, dword [ebp - 0x2ac]
imul esi, dword [ebp - 0x68]
push 0
lea ecx, [ebp - 0x764]
call fcn.1002246c
add esi, dword [eax]
mov eax, dword [ebp - 0x68]
sub eax, esi
cmp eax, 1
jge 0x10015a48
cmp dword [ebp - 0x68], 0
je 0x10015a48
mov eax, 0x2151
test eax, eax
je 0x10015a48
mov dword [ebp - 0x2b0], 1
jmp 0x10015a4f
and dword [ebp - 0x2b0], 0
imul eax, dword [ebp - 0x2b0], 0x69ac
cmp eax, 0x4caa5d73
jge 0x10015a6c
mov dword [ebp - 0x2b8], 1
jmp 0x10015a73
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x68], eax
mov esi, dword [ebp - 0x78]
add esi, 0xf4a6
push 0
lea ecx, [ebp - 0x764]
call fcn.1002246c
cmp esi, dword [eax]
je 0x10015aa2
mov dword [ebp - 0x2c0], 1
jmp 0x10015aa9
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x78], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x764]
call fcn.10022450
mov byte [ebp - 0x138], 7
mov byte [ebp - 0x137], 0x9a
mov byte [ebp - 0x136], 5
mov byte [ebp - 0x135], 0x2e
mov byte [ebp - 0x134], 0xa
mov byte [ebp - 0x133], 0x1d
mov byte [ebp - 0x132], 6
mov byte [ebp - 0x131], 0x11
mov byte [ebp - 0x130], 1
mov byte [ebp - 0x12f], 6
mov byte [ebp - 0x12e], 0
mov byte [ebp - 0x12d], 0x22
mov byte [ebp - 0x12c], 4
mov byte [ebp - 0x12b], 0x35
mov byte [ebp - 0x12a], 0xd
mov byte [ebp - 0x129], 1
mov byte [ebp - 0x128], 3
mov byte [ebp - 0x127], 0x99
mov byte [ebp - 0x126], 0xa5
mov byte [ebp - 0x125], 0x88
mov byte [ebp - 0x124], 3
mov byte [ebp - 0x123], 0x23
mov byte [ebp - 0x122], 9
mov byte [ebp - 0x121], 0x34
mov byte [ebp - 0x120], 0xb
mov byte [ebp - 0x11f], 1
mov byte [ebp - 0x11e], 8
mov byte [ebp - 0x11d], 1
mov byte [ebp - 0x11c], 2
mov byte [ebp - 0x11b], 0x10
mov byte [ebp - 0x11a], 0xc
mov byte [ebp - 0x119], 7
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x138]
and eax, 0xdb
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x138]
or ecx, 0xdb
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x138]
mov byte [ebp + eax - 0x734], cl
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x2e8], 0xbae0
mov dword [ebp - 0x34], 0
jmp 0x10015c00
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xfffffffc
jle 0x10015d83
mov dword [ebp - 0x308], 0x1b44
cmp dword [ebp - 0x34], 0
je 0x10015c30
mov eax, dword [ebp - 0x34]
add eax, 0x92c6
je 0x10015c30
mov dword [ebp - 0x2c8], 1
jmp 0x10015c37
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x2c8]
jle 0x10015c51
mov dword [ebp - 0x2d0], 1
jmp 0x10015c58
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x2d0]
je 0x10015c6f
mov dword [ebp - 0x2d8], 1
jmp 0x10015c76
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x2d8], eax
jne 0x10015c93
cmp dword [ebp - 0x2e8], 0
jne 0x10015c93
and dword [ebp - 0x2e0], 0
jmp 0x10015c9d
mov dword [ebp - 0x2e0], 1
cmp dword [ebp - 0x2e0], 1
jl 0x10015cb2
mov dword [ebp - 0x2f0], 1
jmp 0x10015cb9
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x2f0], eax
jle 0x10015cd3
mov dword [ebp - 0x2f8], 1
jmp 0x10015cda
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x308]
cmp dword [ebp - 0x2f8], eax
jge 0x10015cf4
mov dword [ebp - 0x300], 1
jmp 0x10015cfb
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x300], eax
je 0x10015d0b
xor eax, eax
inc eax
je 0x10015d20
cmp dword [ebp - 0x308], 0
je 0x10015d20
mov dword [ebp - 0x310], 1
jmp 0x10015d27
and dword [ebp - 0x310], 0
cmp dword [ebp - 0x310], 0xffffffff
jle 0x10015d55
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x10015d53
push 0x231d
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x10015d7e
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x10015d7e
push 0
push 0x1ab4
push 0xd85
push 0x1751
call dword [sym.imp.GDI32.dll_MoveToEx]
jmp 0x10015bf9
mov dword [ebp - 0x2c], 2
and dword [ebp - 0x1d0], 0
jmp 0x10015d9b
mov eax, dword [ebp - 0x2c]
inc eax
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x20
jae 0x10016b5a
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x138]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x2c], eax
jne 0x10016aee
mov dword [ebp - 0x14], 0x90c4d8e5
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0xd0], 0xffff
push 1
lea ecx, [ebp - 0x74c]
call fcn.100223ce
mov dword [ebp - 4], 0x11
mov dword [ebp - 0xd8], 0xfffffffe
mov dword [ebp - 0x680], 0
mov dword [ebp - 0x720], 6
mov dword [ebp - 0x20], 0
jmp 0x10015e1d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10015e33
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xbc], 0x3df7
jmp 0x10015e16
mov dword [ebp - 0x20], 0
jmp 0x10015e43
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x10015e5f
push dword [ebp - 0x20]
lea ecx, [ebp - 0x74c]
call fcn.1002246c
mov dword [eax], 0x7f2a
jmp 0x10015e3c
mov dword [ebp - 0x20], 0
jmp 0x10015e6f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10015e85
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa20], 0x7713999e
jmp 0x10015e68
mov dword [ebp - 0x14], 0
jmp 0x10015e95
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jg 0x10016529
mov dword [ebp - 0xc8], 0x9a278c00
mov dword [ebp - 0x7c], 0xf5954e3f
mov dword [ebp - 0x678], 0
mov eax, 0xad7d711e
test eax, eax
je 0x10015ee1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x84]
cmp ecx, dword [ebp + eax*4 - 0xbc]
jne 0x10015ee1
mov dword [ebp - 0x318], 1
jmp 0x10015ee8
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0xc8], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xbc]
cmp ecx, dword [ebp + eax - 0xbc]
je 0x10015f1c
mov dword [ebp - 0x320], 1
jmp 0x10015f23
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x320]
jge 0x10015f43
cmp dword [ebp - 0xd0], 0
je 0x10015f43
mov dword [ebp - 0x328], 1
jmp 0x10015f4a
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x328], eax
je 0x10015f61
mov dword [ebp - 0x330], 1
jmp 0x10015f68
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xbc]
cmp eax, dword [ebp - 0x330]
jl 0x10015f86
mov dword [ebp - 0x2a8], 1
jmp 0x10015f8d
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x2a8]
cmp eax, dword [ebp - 0xd0]
jne 0x10015faa
mov dword [ebp - 0x340], 1
jmp 0x10015fb1
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x340]
sub eax, dword [ebp - 0x14]
je 0x100161a1
mov dword [ebp - 0x224], 0x89ced66e
mov eax, dword [ebp - 0x224]
neg eax
je 0x100160da
cmp dword [ebp - 0x224], 0xffff
je 0x10015ff0
mov dword [ebp - 0x348], 1
jmp 0x10015ff7
and dword [ebp - 0x348], 0
imul eax, dword [ebp - 0x348], 0
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x7c]
sub ecx, dword [ebp + eax*4 - 0xbc]
je 0x10016025
mov eax, 0xce3f
test eax, eax
je 0x10016025
mov dword [ebp - 0x350], 1
jmp 0x1001602c
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0xd0]
sub eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x14]
jle 0x10016055
mov dword [ebp - 0x358], 1
jmp 0x1001605c
and dword [ebp - 0x358], 0
cmp dword [ebp - 0x358], 0xe402095
je 0x10016074
mov dword [ebp - 0x360], 1
jmp 0x1001607b
and dword [ebp - 0x360], 0
cmp dword [ebp - 0x360], 0xffffffff
jle 0x10016090
mov dword [ebp - 0x710], 1
jmp 0x10016097
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xbc]
mov dword [ebp - 0x908], eax
cmp dword [ebp - 0x224], 0
jb 0x100160bc
mov dword [ebp - 0x368], 1
jmp 0x100160c3
and dword [ebp - 0x368], 0
imul eax, dword [ebp - 0x368], 0xfffffff9
test eax, eax
je 0x100160da
mov dword [ebp - 0x370], 1
jmp 0x100160e1
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc8]
sub ecx, dword [ebp - 0xd0]
cmp ecx, dword [ebp + eax*4 - 0xbc]
je 0x10016117
cmp dword [ebp - 0xc8], 0
jne 0x10016117
and dword [ebp - 0x378], 0
jmp 0x10016121
mov dword [ebp - 0x378], 1
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x378], eax
jne 0x1001613b
mov dword [ebp - 0x380], 1
jmp 0x10016142
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xbc]
cmp dword [ebp - 0x380], eax
jl 0x10016160
mov dword [ebp - 0x22c], 1
jmp 0x10016167
and dword [ebp - 0x22c], 0
push 0
lea ecx, [ebp - 0x74c]
call fcn.1002246c
mov ecx, dword [ebp - 0x22c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xbc]
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xbc], eax
jmp 0x10016524
mov dword [ebp - 0x1b8], 3
mov dword [ebp - 0x3b8], 0x11e1
mov dword [ebp - 0x7c], 0
jmp 0x100161c5
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xfffffff4
je 0x10016502
mov dword [ebp - 0x84], 1
jmp 0x100161e8
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jl 0x100164fd
mov dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x998], eax
mov eax, dword [ebp - 0x678]
cmp eax, dword [ebp - 0xd8]
jl 0x10016227
xor eax, eax
inc eax
je 0x10016227
mov dword [ebp - 0x388], 1
jmp 0x1001622e
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 1
jle 0x1001624f
mov dword [ebp - 0x390], 1
jmp 0x10016256
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x390], eax
jne 0x10016270
mov dword [ebp - 0x398], 1
jmp 0x10016277
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x398], eax
je 0x10016291
mov dword [ebp - 0x3a0], 1
jmp 0x10016298
and dword [ebp - 0x3a0], 0
mov esi, dword [ebp - 0x9c]
push 0
lea ecx, [ebp - 0x74c]
call fcn.1002246c
mov eax, dword [eax]
add eax, dword [ebp - 0x3a0]
cmp eax, esi
jg 0x100162c3
mov dword [ebp - 0x3a8], 1
jmp 0x100162ca
and dword [ebp - 0x3a8], 0
cmp dword [ebp - 0x3a8], 0xad503240
jbe 0x100162e2
mov dword [ebp - 0x6d0], 1
jmp 0x100162e9
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x9a0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa20]
cmp eax, dword [ebp - 0x9c]
jl 0x10016316
mov dword [ebp - 0x3b0], 1
jmp 0x1001631d
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x680], eax
cmp dword [ebp - 0x720], 0
jne 0x100164dc
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0xbc], 0
je 0x100163b1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa20]
mov dword [ebp - 0x9a8], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xbc]
mov dword [ebp - 0x9e8], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xbc]
mov ecx, dword [ebp - 0x84]
mov dword [ebp + ecx*4 - 0xbc], eax
mov dword [ebp - 0x3b8], 0xfff6
cmp dword [ebp - 0x3b8], 0
je 0x100163a4
mov eax, 0x3b01
test eax, eax
je 0x100163a4
mov dword [ebp - 0x3c0], 1
jmp 0x100163ab
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x1b8]
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x9f0], eax
cmp dword [ebp - 0x9c], 0
jne 0x100163d2
mov dword [ebp - 0x3c8], 1
jmp 0x100163d9
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x3c8], eax
jle 0x100163f3
mov dword [ebp - 0x3d0], 1
jmp 0x100163fa
and dword [ebp - 0x3d0], 0
cmp dword [ebp - 0x3d0], 0x764c7f45
je 0x10016412
mov dword [ebp - 0x3d8], 1
jmp 0x10016419
and dword [ebp - 0x3d8], 0
cmp dword [ebp - 0x3d8], 0x630a554f
jl 0x10016431
mov dword [ebp - 0x688], 1
jmp 0x10016438
and dword [ebp - 0x688], 0
cmp dword [ebp - 0xc8], 0
je 0x10016456
mov eax, 0xbfab
test eax, eax
je 0x10016456
mov dword [ebp - 0x3e0], 1
jmp 0x1001645d
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0x3e0]
jge 0x10016477
mov dword [ebp - 0x3e8], 1
jmp 0x1001647e
and dword [ebp - 0x3e8], 0
cmp dword [ebp - 0x3e8], 0x71a2
jg 0x10016496
mov dword [ebp - 0x3f0], 1
jmp 0x1001649d
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x3f0], eax
jg 0x100164b7
mov dword [ebp - 0x3f8], 1
jmp 0x100164be
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jne 0x100164dc
and dword [ebp - 0x400], 0
jmp 0x100164e6
mov dword [ebp - 0x400], 1
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x400]
mov dword [ebp - 0x9c], eax
jmp 0x100161db
jmp 0x100161be
mov byte [ebp - 0xac], 0
movzx eax, byte [ebp - 0xac]
test eax, eax
je 0x10016524
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x10015e8e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74c]
call fcn.10022450
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x138]
inc eax
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x848], 1
mov dword [ebp - 0x844], 1
mov dword [ebp - 0x840], 1
mov dword [ebp - 0x83c], 1
mov dword [ebp - 0x80], 3
mov dword [ebp - 0x110], 0
push 2
lea ecx, [ebp - 0x810]
call fcn.100223ce
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x690], 0x7516a205
push 1
lea ecx, [ebp - 0x758]
call fcn.100223ce
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x1c0], 0x7d37
mov dword [ebp - 0x24], 0
jmp 0x100165cc
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x100165e2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x6d8], 0xffffffff
jmp 0x100165c5
mov dword [ebp - 0x24], 0
jmp 0x100165f2
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1001660e
push dword [ebp - 0x24]
lea ecx, [ebp - 0x810]
call fcn.1002246c
mov dword [eax], 0x8f576c51
jmp 0x100165eb
mov dword [ebp - 0x24], 0
jmp 0x1001661e
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1001663a
push dword [ebp - 0x24]
lea ecx, [ebp - 0x758]
call fcn.1002246c
mov dword [eax], 3
jmp 0x10016617
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6d8]
mov dword [ebp - 0x408], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x408]
mov dword [ebp + eax - 0x848], ecx
mov dword [ebp - 0x80], 8
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x408], eax
jl 0x1001667e
mov dword [ebp - 0x410], 1
jmp 0x10016685
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x418], eax
push 0
lea ecx, [ebp - 0x810]
call fcn.1002246c
mov ecx, dword [ebp - 0x418]
mov dword [eax], ecx
mov eax, dword [ebp - 0x410]
cmp eax, dword [ebp - 0x418]
jge 0x100166c0
mov dword [ebp - 0x420], 1
jmp 0x100166c7
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x690], eax
xor eax, eax
inc eax
je 0x1001672b
mov dword [ebp - 0x214], 0
jmp 0x100166f1
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 3
jge 0x1001670d
mov eax, dword [ebp - 0x214]
mov dword [ebp + eax*4 - 0x960], 0xfff8
jmp 0x100166e4
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x960]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x960], eax
jmp 0x100167e6
mov dword [ebp - 0x110], 0
jmp 0x10016744
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 1
jg 0x100167e6
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x1001676b
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x10016783
call dword [sym.imp.USER32.dll_DestroyCaret]
mov dword [ebp - 0x80], 0
jmp 0x10016793
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jg 0x100167e1
mov dword [ebp - 0x1c0], 1
jmp 0x100167b2
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jl 0x100167df
push dword [ebp - 0x80]
lea ecx, [ebp - 0x758]
call fcn.1002246c
mov esi, eax
push dword [ebp - 0x80]
lea ecx, [ebp - 0x758]
call fcn.1002246c
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x100167a5
jmp 0x1001678c
jmp 0x10016737
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x758]
call fcn.10022450
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x810]
call fcn.10022450
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x138]
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x7b4], 1
mov dword [ebp - 0x7b0], 1
mov dword [ebp - 0x7ac], 1
mov dword [ebp - 0x7a8], 1
lea ecx, [ebp - 0x21d]
call fcn.1002247b
push eax
lea eax, [ebp - 0x7a4]
push eax
lea eax, [ebp - 0x7b4]
push eax
lea ecx, [ebp - 0xa48]
call fcn.1002247e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa2c]
call fcn.1002242a
mov dword [ebp - 0x9f8], 0xef2c3654
mov dword [ebp - 0xa00], 0xab5457d6
mov dword [ebp - 0x9dc], 1
mov dword [ebp - 0x98c], 0xf219a6fd
mov dword [ebp - 0x930], 1
mov dword [ebp - 0x938], 0
mov dword [ebp - 0x874], 0x92426f37
mov dword [ebp - 0x9ac], 0
mov dword [ebp - 0x868], 0x50dfa014
mov dword [ebp - 0x9bc], 0x5c3421ad
mov dword [ebp - 0x9b8], 0x5c3421ad
mov dword [ebp - 0x9b4], 0x5c3421ad
mov dword [ebp - 0x9b0], 0x5c3421ad
mov dword [ebp - 0x200], 0
jmp 0x10016911
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 1
jge 0x1001692d
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0x1c8], 0x184c506d
jmp 0x10016904
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1c8], 3
jmp 0x1001695b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1c8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c8], 0
jl 0x10016ade
mov dword [ebp - 0x944], 0xffffffff
mov dword [ebp - 0x884], 1
mov dword [ebp - 0x9f4], 0x86524f20
mov dword [ebp - 0x88c], 0x4adf2985
mov dword [ebp - 0x6c], 0
jmp 0x100169a7
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x100169bd
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x5d8], 0xba1bf2b2
jmp 0x100169a0
mov dword [ebp - 0x6c], 0
jmp 0x100169cd
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x100169e3
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xa58], 0
jmp 0x100169c6
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x5d8], 3
jmp 0x10016a11
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5d8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x5d8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5d8], 0
jl 0x10016ad9
mov dword [ebp - 0x954], 0
mov dword [ebp - 0x894], 0xfffffffb
mov dword [ebp - 0x9c0], 0xcc424770
mov dword [ebp - 0x89c], 0xfffffffa
mov dword [ebp - 0x964], 0
mov dword [ebp - 0x8a4], 0xfffffffa
mov dword [ebp - 0x428], 0x976b
mov dword [ebp - 0x1f0], 0
jmp 0x10016a84
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 4
jge 0x10016aa0
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0xaf4], 0x79df9481
jmp 0x10016a77
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x10016ac7
push 0xfec
push 0x4e1
push 0x14a9
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
jmp 0x100169f6
jmp 0x10016940
lea ecx, [ebp - 0xa2c]
call fcn.10022450
jmp 0x10015d93
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x1d0]
movzx eax, byte [ebp + eax - 0x13a]
movsx eax, byte [ebp + eax - 0x734]
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x137]
and ecx, eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x1d0]
movzx eax, byte [ebp + eax - 0x13a]
movsx eax, byte [ebp + eax - 0x734]
mov edx, dword [ebp - 0x2c]
movzx edx, byte [ebp + edx - 0x137]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x138]
mov byte [ebp + eax - 0x734], dl
and dword [ebp - 0x1d0], 0
jmp 0x10015d93
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x734], 0
mov dword [ebp - 0x9ec], 0xec0ae971
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x10016b94
push 0x685
push 0x12b1
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x10016bb3
push 0
push 0x1b3d
call dword [sym.imp.GDI32.dll_SetLayout]
lea eax, [ebp - 0x734]
push eax
lea ecx, [ebp - 0xa80]
call fcn.10022358
mov dword [ebp - 4], 0x14
and dword [ebp - 0x208], 0
jmp 0x10016be2
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xf
jae 0x100170a6
push 3
lea ecx, [ebp - 0x280]
call fcn.100223ce
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x5c], 8
mov dword [ebp - 0x440], 0xa6001648
mov dword [ebp - 0x458], 4
mov dword [ebp - 0x488], 2
push 2
lea ecx, [ebp - 0x7d4]
call fcn.100223ce
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x58], 0
jmp 0x10016c46
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x10016c62
push dword [ebp - 0x58]
lea ecx, [ebp - 0x280]
call fcn.1002246c
mov dword [eax], 0x3b4e
jmp 0x10016c3f
mov dword [ebp - 0x58], 0
jmp 0x10016c72
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x10016c8e
push dword [ebp - 0x58]
lea ecx, [ebp - 0x7d4]
call fcn.1002246c
mov dword [eax], 1
jmp 0x10016c6b
mov byte [ebp - 0xb0], 0
movzx eax, byte [ebp - 0xb0]
test eax, eax
je 0x10016caf
push 1
push 0
push 0x2135
call dword [sym.imp.GDI32.dll_SelectPalette]
mov dword [ebp - 0x5c], 0
jmp 0x10016cbf
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jg 0x10016f5a
mov dword [ebp - 0x210], 0xbb0cb8ce
mov dword [ebp - 0x1d8], 0x672ca3c0
mov dword [ebp - 0x460], 3
mov dword [ebp - 0x154], 0
jmp 0x10016d00
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jge 0x10016d1c
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x828], 3
jmp 0x10016cf3
mov dword [ebp - 0x210], 0xf759609c
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x430], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x430]
mov dword [ebp + eax - 0x828], ecx
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x1d8], eax
mov esi, dword [ebp - 0x5c]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x280]
call fcn.1002246c
cmp dword [eax], esi
je 0x10016d71
mov dword [ebp - 0x438], 1
jmp 0x10016d78
and dword [ebp - 0x438], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x828], 8
push 1
lea ecx, [ebp - 0x280]
call fcn.1002246c
mov ecx, dword [ebp - 0x438]
imul ecx, dword [eax]
push 8
pop eax
neg eax
cmp eax, ecx
jle 0x10016db3
mov dword [ebp - 0x448], 1
jmp 0x10016dba
and dword [ebp - 0x448], 0
push 1
lea ecx, [ebp - 0x280]
call fcn.1002246c
mov eax, dword [eax]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x440]
imul eax, dword [ebp - 0x448]
test eax, eax
je 0x10016dfb
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x828], 0
je 0x10016dfb
mov dword [ebp - 0x450], 1
jmp 0x10016e02
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x450], eax
jne 0x10016e1c
mov dword [ebp - 0x724], 1
jmp 0x10016e23
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x8ac], eax
push 2
lea ecx, [ebp - 0x280]
call fcn.1002246c
push 2
lea ecx, [ebp - 0x280]
call fcn.1002246c
mov eax, dword [eax]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0x435e
jl 0x10016e75
mov dword [ebp - 0x468], 1
jmp 0x10016e7c
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x210]
cmp dword [ebp - 0x468], eax
jle 0x10016e96
mov dword [ebp - 0x470], 1
jmp 0x10016e9d
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x470]
je 0x10016eb4
mov dword [ebp - 0x698], 1
jmp 0x10016ebb
and dword [ebp - 0x698], 0
push 0
lea ecx, [ebp - 0x280]
call fcn.1002246c
cmp dword [eax], 0x1361131e
je 0x10016edc
mov dword [ebp - 0x478], 1
jmp 0x10016ee3
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x1d8], eax
mov esi, dword [ebp - 0x1d8]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x280]
call fcn.1002246c
mov eax, dword [eax]
sub eax, esi
cmp eax, 0x25cf162c
je 0x10016f2a
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x280]
call fcn.1002246c
cmp dword [eax], 0
jne 0x10016f2a
and dword [ebp - 0x480], 0
jmp 0x10016f34
mov dword [ebp - 0x480], 1
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x488], eax
mov esi, dword [ebp - 0x488]
push 0
lea ecx, [ebp - 0x7d4]
call fcn.1002246c
mov dword [eax], esi
jmp 0x10016cb8
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x7d4]
call fcn.10022450
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x280]
call fcn.10022450
mov dword [ebp - 0x490], 0x73fe
mov dword [ebp - 0x6a0], 0x10007d10
cmp dword [ebp - 0x490], 0x7634
jle 0x1001704b
and dword [ebp - 0x1f8], 0
jmp 0x10016fb2
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0x3c6
jge 0x1001703c
and dword [ebp - 0x1e0], 0
jmp 0x10016fd4
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0x22d8
jge 0x10017037
mov eax, dword [ebp - 0x1f8]
xor eax, dword [ebp - 0x1e0]
cdq
mov dword [ebp - 0x64c], eax
mov dword [ebp - 0x648], edx
push dword [ebp - 0x648]
push dword [ebp - 0x64c]
lea ecx, [ebp - 0xacc]
call fcn.1000ac3e
pop ecx
pop ecx
mov dword [ebp - 0x6e0], eax
mov ecx, dword [ebp - 0x6e0]
call fcn.1002218f
push eax
call fcn.1005af25
pop ecx
lea ecx, [ebp - 0xacc]
call fcn.10022185
jmp 0x10016fc7
jmp 0x10016fa5
push 1
push 0
push 0x61e
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov eax, dword [ebp - 0x208]
mov byte [ebp + eax - 0x734], 0
mov byte [ebp - 4], 0x17
cmp dword [ebp - 0x490], 0x7144
jge 0x10017075
push dword [ebp - 0x6a0]
call fcn.1005af25
pop ecx
jmp 0x10017091
mov dword [ebp - 4], 0x14
jmp 0x100170a1
jmp 0x10016bd5
push 1
push 0
lea eax, [ebp - 0xa80]
push eax
push dword [ebp - 0x498]
call fcn.10017c5f
add esp, 0x10
mov dword [0x1061d930], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa80]
call fcn.1002237b
mov dword [ebp - 0x15c], 0xffffffff
mov dword [ebp - 0x974], 0
mov dword [ebp - 0x8b4], 0xb9ae77ab
mov dword [ebp - 0x9d4], 0xd6804445
mov dword [ebp - 0x8bc], 1
mov dword [ebp - 0x984], 0xd9e2a8d3
mov dword [ebp - 0x8c4], 0
mov dword [ebp - 0x988], 0xffffffff
push 3
lea ecx, [ebp - 0x970]
call fcn.100223ce
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x158], 0
jmp 0x10017150
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 3
jge 0x10017172
push dword [ebp - 0x158]
lea ecx, [ebp - 0x970]
call fcn.1002246c
mov dword [eax], 0xbc383c67
jmp 0x10017143
mov dword [ebp - 0x15c], 0xffffffed
jmp 0x1001718b
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 6
jle 0x1001721f
mov dword [ebp - 0x8cc], 0xdc4b4e12
mov dword [ebp - 0x990], 0xfffffffb
mov dword [ebp - 0x8d4], 0xf80c3414
mov dword [ebp - 0x4a0], 0xfffffffe
mov dword [ebp - 0x164], 0
jmp 0x100171d9
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jge 0x100171f5
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x9d8], 2
jmp 0x100171cc
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x1001720d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov eax, dword [ebp - 0x4a0]
dec eax
mov dword [ebp - 0x4a0], eax
jmp 0x1001717e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x970]
call fcn.10022450
cmp dword [0x1061d930], 0
je 0x10017c4c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5f0], eax
mov dword [ebp - 0x3c], 0xcf2e
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0x6a8], 0xf3bd791f
mov dword [ebp - 0x16c], 0
jmp 0x10017281
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 3
jge 0x1001729d
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0xa38], 0xfffffff7
jmp 0x10017274
mov eax, 0x46b8d963
test eax, eax
je 0x100172b8
cmp dword [ebp - 0x3c], 0
je 0x100172b8
mov dword [ebp - 0x4b8], 1
jmp 0x100172bf
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x3c]
je 0x100172d3
mov dword [ebp - 0x4a8], 1
jmp 0x100172da
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x4a8]
lea eax, [ecx + eax + 0xd549]
test eax, eax
jne 0x10017300
mov eax, 0x87a5
test eax, eax
jne 0x10017300
and dword [ebp - 0x4b0], 0
jmp 0x1001730a
mov dword [ebp - 0x4b0], 1
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x4b0]
cmp dword [ebp - 0x4b8], eax
jg 0x1001732b
cmp dword [ebp - 0x3c], 0
jne 0x1001732b
and dword [ebp - 0x71c], 0
jmp 0x10017335
mov dword [ebp - 0x71c], 1
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x3c]
je 0x1001734f
mov eax, 0xfff9
test eax, eax
jne 0x1001734f
and dword [ebp - 0x4c0], 0
jmp 0x10017359
mov dword [ebp - 0x4c0], 1
mov eax, dword [ebp - 0x4c0]
inc eax
cmp eax, 0x5f40
jle 0x10017373
mov dword [ebp - 0x4c8], 1
jmp 0x1001737a
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0xe0]
imul eax, dword [ebp - 0x4c8]
cmp eax, 1
je 0x100173a1
mov eax, 0xf9a02370
test eax, eax
je 0x100173a1
mov dword [ebp - 0x4d0], 1
jmp 0x100173a8
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x4d0]
jle 0x100173bf
mov dword [ebp - 0x4d8], 1
jmp 0x100173c6
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
sub eax, dword [ebp - 0x3c]
cmp eax, 6
jne 0x100173e0
mov dword [ebp - 0x234], 1
jmp 0x100173e7
and dword [ebp - 0x234], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x234]
mov dword [ebp + eax - 0xa38], ecx
cmp dword [ebp - 0x234], 0xfad0
jne 0x10017412
mov dword [ebp - 0x4e0], 1
jmp 0x10017419
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x4e0], eax
je 0x10017430
mov dword [ebp - 0x4e8], 1
jmp 0x10017437
and dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x4e8], 8
je 0x1001744c
mov dword [ebp - 0x4f0], 1
jmp 0x10017453
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x6a8], eax
mov dword [ebp - 0xe0], 0xfffffffc
jmp 0x10017478
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0xffffffe6
jg 0x1001748e
cmp dword [ebp - 0xe0], 0
je 0x1001748c
jmp 0x1001748e
jmp 0x1001746b
mov eax, dword [ebp - 0x6f0]
mov dword [ebp - 0x600], eax
mov dword [ebp - 0x44], 0xb58e
mov dword [ebp - 0x4f8], 0x4e5e
mov dword [ebp - 0x5ec], 0x10007d60
cmp dword [ebp - 0x4f8], 0x511b
jle 0x100175a8
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
and dword [ebp - 0x174], 0
jmp 0x100174e3
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0x132f
jge 0x100175a8
and dword [ebp - 0x17c], 0
jmp 0x10017509
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0x679e
jge 0x100175a3
and dword [ebp - 0x184], 0
jmp 0x1001752f
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0x5b0d
jge 0x1001759e
and dword [ebp - 0x18c], 0
jmp 0x10017551
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0x5835
jge 0x1001759c
mov eax, dword [ebp - 0x174]
add eax, dword [ebp - 0x17c]
mov ecx, dword [ebp - 0x184]
sar eax, cl
xor eax, dword [ebp - 0x18c]
cdq
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x654], edx
push dword [ebp - 0x654]
push dword [ebp - 0x658]
mov ecx, 0x1061c7f8
call fcn.100221af
jmp 0x10017544
jmp 0x10017522
jmp 0x100174fc
jmp 0x100174d6
mov dword [ebp - 0xe8], 0
mov dword [ebp - 4], 0x1a
cmp dword [ebp - 0x4f8], 0x4da6
jge 0x100175d5
mov edx, dword [ebp - 0x5ec]
mov ecx, 0x1061c7f8
call fcn.10024b94
jmp 0x100175f1
or dword [ebp - 4], 0xffffffff
jmp 0x100175fb
mov dword [ebp - 0x194], 0
jmp 0x10017614
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 1
jge 0x10017630
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x500], 0x57ad95e1
jmp 0x10017607
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0
jmp 0x10017647
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jg 0x10017809
mov dword [ebp - 0x23c], 0x188753e1
mov dword [ebp - 0x508], 0xffffffff
mov dword [ebp - 0x530], 0x6b933888
mov dword [ebp - 0x538], 0x20796559
mov dword [ebp - 0x19c], 0
jmp 0x10017692
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 3
jge 0x100176ae
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x980], 0x3c576436
jmp 0x10017685
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x500], 0
je 0x100176f6
mov eax, dword [ebp - 0x23c]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x980], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x500]
mov dword [ebp - 0x8dc], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x980]
cmp eax, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x508], eax
imul eax, dword [ebp - 0x508], 0xcadf
sub eax, dword [ebp - 0x530]
jne 0x10017726
mov eax, 0x65b0b56c
test eax, eax
jne 0x10017726
and dword [ebp - 0x510], 0
jmp 0x10017730
mov dword [ebp - 0x510], 1
mov eax, 0xa3888451
sub eax, dword [ebp - 0x510]
cmp eax, dword [ebp - 0x538]
jl 0x1001774f
mov dword [ebp - 0x518], 1
jmp 0x10017756
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x518]
jle 0x10017776
mov eax, 0x3e3f
test eax, eax
je 0x10017776
mov dword [ebp - 0x520], 1
jmp 0x1001777d
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0x44]
jne 0x100177a0
mov dword [ebp - 0x528], 1
jmp 0x100177a7
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x528]
sub eax, dword [ebp - 0x530]
imul eax, dword [ebp - 0x44]
mov dword [ebp - 0x538], eax
mov dword [ebp - 0xe8], 0
jmp 0x100177da
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jg 0x10017804
mov byte [ebp - 0xa8], 0
movzx eax, byte [ebp - 0xa8]
test eax, eax
je 0x10017802
push 0x1b59
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x100177cd
jmp 0x10017640
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x5f8], eax
mov dword [ebp - 0x118], 0xcecb4571
mov dword [ebp - 0x9d0], 0xfffffff6
mov dword [ebp - 0x9cc], 0xfffffff6
mov dword [ebp - 0x9c8], 0xfffffff6
mov dword [ebp - 0x9c4], 0xfffffff6
mov dword [ebp - 0x64], 0
jmp 0x10017857
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x1001786d
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xaa8], 0x841b3c69
jmp 0x10017850
mov dword [ebp - 0x64], 0
jmp 0x1001787d
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x10017893
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xab4], 1
jmp 0x10017876
mov dword [ebp - 0x118], 0
jmp 0x100178ac
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 3
jg 0x10017981
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x994], 0xfffffffa
mov dword [ebp - 0x8e4], 9
mov dword [ebp - 0x9e0], 0x3a34c865
mov dword [ebp - 0x8ec], 0
mov dword [ebp - 0x99c], 1
mov dword [ebp - 0x8f4], 0xffffffff
mov dword [ebp - 0x9fc], 0x807383cc
mov dword [ebp - 0x540], 0xa652065c
mov dword [ebp - 0x1a4], 0
jmp 0x1001792c
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jg 0x1001796f
mov eax, dword [ebp - 0x118]
cmp dword [ebp + eax*4 - 0xaa8], 0
je 0x10017947
jmp 0x1001796f
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x1001796d
push 1
push 0
push 0x1854
push 0x16a2
call dword [sym.imp.USER32.dll_SetScrollInfo]
jmp 0x1001791f
mov eax, dword [ebp - 0x540]
inc eax
mov dword [ebp - 0x540], eax
jmp 0x1001789f
push dword [ebp - 0x5f8]
push dword [ebp - 0x600]
call dword [0x1061d930]
mov dword [ebp - 0x628], eax
mov dword [ebp - 0xfc], 7
mov dword [ebp - 0x548], 0xfffffff6
mov dword [ebp - 0x620], 0
mov dword [ebp - 0x1ac], 0
jmp 0x100179d0
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 2
jge 0x100179ec
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x664], 0x12e7
jmp 0x100179c3
mov dword [ebp - 0xfc], 0
jmp 0x10017a05
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0xffffffef
jg 0x10017c44
mov dword [ebp - 0xa4], 4
mov dword [ebp - 0x618], 0xabaf1ba1
mov dword [ebp - 0x1b4], 0
jmp 0x10017a3f
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 1
jge 0x10017a5b
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x610], 0xe836ea0e
jmp 0x10017a32
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x548], 0
jne 0x10017b6b
cmp dword [ebp - 0xa4], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x664], 1
jle 0x10017a97
mov dword [ebp - 0x550], 1
jmp 0x10017a9e
and dword [ebp - 0x550], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x664]
add eax, dword [ebp - 0x550]
cmp eax, 0x1aca
jne 0x10017ac4
mov dword [ebp - 0x558], 1
jmp 0x10017acb
and dword [ebp - 0x558], 0
cmp dword [ebp - 0x558], 0x99314e76
ja 0x10017ae3
mov dword [ebp - 0x560], 1
jmp 0x10017aea
and dword [ebp - 0x560], 0
cmp dword [ebp - 0x560], 0xfffffffa
jge 0x10017b05
mov eax, 0x9ced66e5
test eax, eax
jne 0x10017b05
and dword [ebp - 0x568], 0
jmp 0x10017b0f
mov dword [ebp - 0x568], 1
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x568]
jge 0x10017b29
mov dword [ebp - 0x570], 1
jmp 0x10017b30
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x570]
sub eax, dword [ebp - 0xa4]
cmp eax, 0xfffffffa
jle 0x10017b4d
mov dword [ebp - 0x578], 1
jmp 0x10017b54
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x578]
sub eax, dword [ebp - 0xa4]
jne 0x10017b6b
and dword [ebp - 0x580], 0
jmp 0x10017b75
mov dword [ebp - 0x580], 1
cmp dword [ebp - 0x580], 1
ja 0x10017b8a
mov dword [ebp - 0x608], 1
jmp 0x10017b91
and dword [ebp - 0x608], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x664]
mov dword [ebp - 0x8fc], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x610], 0
cmp dword [ebp - 0xa4], 0
je 0x10017bd9
mov eax, 0x36fc75df
test eax, eax
jne 0x10017bd9
cmp dword [ebp - 0xa4], 0
jne 0x10017bd9
and dword [ebp - 0x588], 0
jmp 0x10017be3
mov dword [ebp - 0x588], 1
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x618], eax
xor eax, eax
sub eax, dword [ebp - 0x620]
cmp eax, dword [ebp - 0xa4]
jle 0x10017c1d
mov byte [ebp - 0xaa], 0
movzx eax, byte [ebp - 0xaa]
test eax, eax
je 0x10017c1b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
jmp 0x10017c3f
mov byte [ebp - 0xab], 0
movzx eax, byte [ebp - 0xab]
test eax, eax
je 0x10017c3f
push 0xd1f
push 0x43e
call dword [sym.imp.USER32.dll_SetParent]
jmp 0x100179f8
mov eax, dword [ebp - 0x628]
jmp 0x10017c4e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret