Function at 0x100270a4
Capabilities:
Check os version
Get disk size
Read .ini file
Set registry value
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10089f19
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6b4
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10027b70
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x64], 0x6ec6e54e
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xf8], 0
jmp 0x10027109
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jge 0x10027125
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x4d4], 0xb57f
jmp 0x100270fc
mov dword [ebp - 0x5c], 1
jmp 0x10027135
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x10027527
mov dword [ebp - 0x1a0], 0xfb807cfa
mov dword [ebp - 0x9c], 3
mov dword [ebp - 0xa4], 0xcc424770
mov dword [ebp - 0x440], 0x790660d6
mov dword [ebp - 0xc4], 0
jmp 0x10027180
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 4
jge 0x1002719c
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x4cc], 0x8ab5457d
jmp 0x10027173
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x4d4]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x3b0]
cmp eax, dword [ebp - 0x438]
jg 0x100271df
mov dword [ebp - 0x1fc], 1
jmp 0x100271e6
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x1fc]
sub eax, 0x2879a6db
cmp eax, 0x9017
jl 0x10027204
mov dword [ebp - 0x37c], 1
jmp 0x1002720b
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
add eax, 8
cmp eax, 0xfffa
jne 0x1002722d
mov dword [ebp - 0x384], 1
jmp 0x10027234
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
je 0x1002725e
cmp dword [ebp - 0x440], 0
je 0x1002725e
mov dword [ebp - 0x290], 1
jmp 0x10027265
and dword [ebp - 0x290], 0
cmp dword [ebp - 0x290], 0xd924
je 0x1002727d
mov dword [ebp - 0x19c], 1
jmp 0x10027284
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x37c]
imul eax, dword [ebp - 0x19c]
test eax, eax
je 0x100274d0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4cc], 0
je 0x100274d0
mov dword [ebp - 0x430], 0xffffffff
mov dword [ebp - 0xa4], 0
jmp 0x100272d3
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jg 0x100274ba
mov dword [ebp - 0x448], 0xac92d14b
push 1
lea ecx, [ebp - 0x468]
call fcn.10019343
and dword [ebp - 4], 0
mov dword [ebp - 0x11c], 0
jmp 0x10027314
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 1
jge 0x10027336
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x468]
call fcn.100193d1
mov dword [eax], 1
jmp 0x10027307
mov eax, dword [ebp - 0x5c]
cmp dword [ebp + eax*4 - 0x4d4], 0
jne 0x1002747f
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x5cc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4cc]
imul eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0xcc]
jle 0x1002738d
cmp dword [ebp - 0x448], 0
jne 0x1002738d
and dword [ebp - 0x348], 0
jmp 0x10027397
mov dword [ebp - 0x348], 1
push 0
lea ecx, [ebp - 0x468]
call fcn.100193d1
mov ecx, dword [ebp - 0x348]
cmp ecx, dword [eax]
je 0x100273ba
mov dword [ebp - 0x1a8], 1
jmp 0x100273c1
and dword [ebp - 0x1a8], 0
cmp dword [ebp - 0x1a8], 0xffffffff
jl 0x100273d6
mov dword [ebp - 0x458], 1
jmp 0x100273dd
and dword [ebp - 0x458], 0
push 0
lea ecx, [ebp - 0x468]
call fcn.100193d1
push 0
lea ecx, [ebp - 0x468]
call fcn.100193d1
cmp dword [eax], 0
je 0x1002740d
or eax, 0xffffffff
je 0x1002740d
mov dword [ebp - 0x298], 1
jmp 0x10027414
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x430]
cmp dword [ebp - 0x298], eax
jl 0x1002742e
mov dword [ebp - 0x1b0], 1
jmp 0x10027435
and dword [ebp - 0x1b0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1b0]
sub ecx, dword [ebp + eax - 0x4cc]
mov dword [ebp - 0x9c], ecx
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x310], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x310]
mov dword [ebp + eax - 0x4cc], ecx
cmp dword [ebp - 0x310], 0
jne 0x1002747f
and dword [ebp - 0x1b8], 0
jmp 0x10027489
mov dword [ebp - 0x1b8], 1
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x49], 0
movzx eax, byte [ebp - 0x49]
test eax, eax
je 0x100274a6
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x468]
call fcn.100193cc
jmp 0x100272c6
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4cc], 0
je 0x100274ce
jmp 0x1002712e
jmp 0x10027522
mov dword [ebp - 0x64], 1
jmp 0x100274e0
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x10027522
mov byte [ebp - 0x53], 0
movzx eax, byte [ebp - 0x53]
test eax, eax
je 0x10027520
push 0
push 0x2650
push 0
push 0
push 0x6b7
push 0x1a25
push 0x1fbd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
jmp 0x100274d9
jmp 0x1002712e
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3cc], eax
mov dword [ebp - 0x4b0], 0
mov dword [ebp - 0x4ac], 0
mov dword [ebp - 0x4a8], 0
mov dword [ebp - 0x4a4], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x4b0]
cmp dword [ebp + eax - 0x4b0], ecx
jg 0x100275ac
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x100275aa
push 0
push 0x2518
push 0
push 0x15e3
push 0xbc1
call dword [sym.imp.GDI32.dll_ExtCreatePen]
jmp 0x100275d3
mov byte [ebp - 0x55], 0
movzx eax, byte [ebp - 0x55]
test eax, eax
je 0x100275c3
push 0x946
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x4b0], 0x8fb770a7
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x3dc], eax
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x2b0], 0x6e74a6e8
mov dword [ebp - 0x320], 0
mov dword [ebp - 0x540], 0x6e48
mov dword [ebp - 0x2b8], 0xcd1b
mov dword [ebp - 0x580], 0
mov dword [ebp - 0x3a0], 0xfffffffe
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x588], 0
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x590], 0x11b55e97
mov dword [ebp - 0x17c], 0x8214d2fc
mov dword [ebp - 0x200], 0xae50714b
mov dword [ebp - 0x598], 0x64e62b50
mov dword [ebp - 0x98], 7
mov dword [ebp - 0x16c], 0x8aee5119
mov dword [ebp - 0x450], 0xfffffffc
mov dword [ebp - 0x5a0], 0x5ce
mov dword [ebp - 0x104], 0
jmp 0x100276a9
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 2
jge 0x100276c5
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x18c], 1
jmp 0x1002769c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
dec ecx
mov dword [ebp - 0x18], ecx
test eax, eax
jne 0x100278b8
cmp dword [ebp - 0x18], 0
jne 0x100278b8
cmp dword [ebp - 0x320], 0
jne 0x100276f6
mov dword [ebp - 0x2a0], 1
jmp 0x100276fd
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0x2a0]
jge 0x10027724
mov dword [ebp - 0x1c0], 1
jmp 0x1002772b
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x17c]
imul eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0x15c], eax
je 0x10027758
mov dword [ebp - 0x368], 1
jmp 0x1002775f
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x2b8]
add eax, dword [ebp - 0x368]
cmp eax, dword [ebp - 0x3a0]
jge 0x1002777f
mov dword [ebp - 0x1c8], 1
jmp 0x10027786
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x1c8], eax
jge 0x100277a0
mov dword [ebp - 0x2a8], 1
jmp 0x100277a7
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x2a8]
sub eax, 0x2eb1f3fd
imul eax, eax, 0
cmp eax, 0x720f84b0
jge 0x100277c8
mov dword [ebp - 0x1d0], 1
jmp 0x100277cf
and dword [ebp - 0x1d0], 0
cmp dword [ebp - 0x1d0], 1
jg 0x100277e4
mov dword [ebp - 0x318], 1
jmp 0x100277eb
and dword [ebp - 0x318], 0
cmp dword [ebp - 0x318], 0x5f9c7104
jne 0x10027803
mov dword [ebp - 0x1d8], 1
jmp 0x1002780a
and dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0
jne 0x10027831
mov eax, 0xe69a4575
test eax, eax
jne 0x10027831
and dword [ebp - 0x3b4], 0
jmp 0x1002783b
mov dword [ebp - 0x3b4], 1
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x5a8], eax
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x5b0], eax
mov eax, 0xfffe
test eax, eax
jne 0x10027869
xor eax, eax
jne 0x10027869
and dword [ebp - 0x1e0], 0
jmp 0x10027873
mov dword [ebp - 0x1e0], 1
mov eax, dword [ebp - 0x1e0]
neg eax
cmp eax, dword [ebp - 0x17c]
jg 0x1002788f
mov dword [ebp - 0x350], 1
jmp 0x10027896
and dword [ebp - 0x350], 0
cmp dword [ebp - 0x350], 0x2f3c076a
je 0x100278ae
mov dword [ebp - 0x1e8], 1
jmp 0x100278b5
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2b8]
add eax, 0xe8f88485
mov dword [ebp - 0x1f0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1f0]
mov dword [ebp + eax - 0x18c], ecx
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x1f0], eax
jle 0x100278f6
mov dword [ebp - 0x1f8], 1
jmp 0x100278fd
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0x1f8], eax
jle 0x10027917
mov dword [ebp - 0x2c0], 1
jmp 0x1002791e
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x200], eax
mov dword [ebp - 0x98], 0xffffffe2
jmp 0x10027943
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x12
jge 0x10027aa6
mov dword [ebp - 0xd4], 0xffffffff
mov dword [ebp - 0x18], 0
jmp 0x1002796a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x10027aa1
mov dword [ebp - 0x3bc], 0xb38
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x18c], 0xf277f141
jae 0x1002799a
mov dword [ebp - 0x2c8], 1
jmp 0x100279a1
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x17c]
mov ecx, dword [ebp - 0x18]
sub eax, dword [ebp + ecx*4 - 0x18c]
je 0x100279c8
cmp dword [ebp - 0xd4], 0
je 0x100279c8
mov dword [ebp - 0x378], 1
jmp 0x100279cf
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x18c]
sub eax, dword [ebp - 0x378]
add eax, 0xf141
cmp eax, dword [ebp - 0x15c]
jle 0x100279f8
mov dword [ebp - 0x208], 1
jmp 0x100279ff
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x208]
inc eax
cmp dword [ebp - 0x2c8], eax
jne 0x10027a1a
mov dword [ebp - 0x210], 1
jmp 0x10027a21
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x210]
sub eax, 7
cmp eax, dword [ebp - 0xd4]
jge 0x10027a3e
mov dword [ebp - 0x174], 1
jmp 0x10027a45
and dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x18c], ecx
cmp dword [ebp - 0x174], 0xc6c2cf37
je 0x10027a6d
mov dword [ebp - 0x41c], 1
jmp 0x10027a74
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x5b8], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x18c]
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x450], eax
jmp 0x10027963
jmp 0x10027936
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x3d4], eax
mov dword [ebp - 0x5c0], 0xfff8
mov byte [ebp - 0x7a], 0
movzx eax, byte [ebp - 0x7a]
test eax, eax
je 0x10027afa
push 0x1a66
push 0x5ec
push 0x2307
push 0x21e6
push 0xb3
push 0x1521
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
mov byte [ebp - 0x57], 0
movzx eax, byte [ebp - 0x57]
test eax, eax
je 0x10027b17
push 0
push 0
push 0xe7e
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x454], eax
push 0x3ebd
push dword [ebp - 0x454]
mov eax, dword [ebp - 0x3d4]
push dword [eax]
push 0x596
mov eax, dword [ebp - 0x42c]
push dword [eax]
push 0x2f7c
mov eax, dword [ebp - 0x3dc]
push dword [eax]
push 0x1922
push 0
call fcn.100270a4
add esp, 0x24
jmp 0x10029e0b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3d0], eax
mov dword [ebp - 0x1c], 0x97a4
mov dword [ebp - 0x38], 0xfbefa5f9
mov dword [ebp - 0x494], 9
mov dword [ebp - 0x3ec], 0x4d2fc5c3
mov dword [ebp - 0x238], 4
mov dword [ebp - 0x640], 0x5701
mov dword [ebp - 0x63c], 0x5701
mov dword [ebp - 0x638], 0x5701
mov dword [ebp - 0x634], 0x5701
mov dword [ebp - 0x12c], 0
jmp 0x10027be6
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jge 0x10027c02
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x480], 6
jmp 0x10027bd9
cmp dword [ebp - 0x1c], 0
je 0x10027c9a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x328], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x328]
mov dword [ebp + eax - 0x480], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x328], eax
jle 0x10027c3f
mov dword [ebp - 0x218], 1
jmp 0x10027c46
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x218]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x10027c67
xor eax, eax
inc eax
jne 0x10027c67
and dword [ebp - 0x2d0], 0
jmp 0x10027c71
mov dword [ebp - 0x2d0], 1
xor eax, eax
sub eax, dword [ebp - 0x2d0]
cmp eax, 1
jl 0x10027c9a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x480], 0
je 0x10027c9a
mov dword [ebp - 0x220], 1
jmp 0x10027ca1
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x494]
cmp dword [ebp - 0x220], eax
jle 0x10027cbb
mov dword [ebp - 0x358], 1
jmp 0x10027cc2
and dword [ebp - 0x358], 0
cmp dword [ebp - 0x358], 0xd3ecf04b
jbe 0x10027cda
mov dword [ebp - 0x3e4], 1
jmp 0x10027ce1
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x5c8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x480], 0
je 0x10027db7
mov dword [ebp - 0xdc], 0
jmp 0x10027d17
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 4
jge 0x10027d33
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0x654], 0x632c5b64
jmp 0x10027d0a
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x654]
mov dword [ebp + ecx - 0x654], eax
mov dword [ebp - 0x38], 0
jmp 0x10027d5c
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x10027db2
mov byte [ebp - 0x77], 0
movzx eax, byte [ebp - 0x77]
test eax, eax
je 0x10027d76
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov dword [ebp - 0x1c], 0
jmp 0x10027d86
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x10027db0
mov byte [ebp - 0x5d], 0
movzx eax, byte [ebp - 0x5d]
test eax, eax
je 0x10027dae
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
jmp 0x10027d7f
jmp 0x10027d55
jmp 0x10027f0d
mov dword [ebp - 0x10c], 0
jmp 0x10027dd0
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jge 0x10027dec
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x434], 0xa164e62b
jmp 0x10027dc3
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x228], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x228]
mov dword [ebp + eax - 0x434], ecx
mov eax, dword [ebp - 0x3ec]
cmp eax, dword [ebp - 0x228]
jl 0x10027e28
cmp dword [ebp - 0x238], 0
jne 0x10027e28
and dword [ebp - 0x2d8], 0
jmp 0x10027e32
mov dword [ebp - 0x2d8], 1
imul eax, dword [ebp - 0x2d8], 0xe6ea
cmp dword [ebp - 0x38], eax
jl 0x10027e4d
mov dword [ebp - 0x230], 1
jmp 0x10027e54
and dword [ebp - 0x230], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x480]
cmp dword [ebp - 0x230], eax
je 0x10027e74
mov dword [ebp - 0x330], 1
jmp 0x10027e7b
and dword [ebp - 0x330], 0
cmp dword [ebp - 0x330], 0xa6e483bb
jne 0x10027e93
mov dword [ebp - 0x45c], 1
jmp 0x10027e9a
and dword [ebp - 0x45c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x238]
mov dword [ebp + eax - 0x480], ecx
mov dword [ebp - 0x1c], 0
jmp 0x10027ebd
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x17
je 0x10027f0d
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x10027eea
push 0x46e
push 0
push 0x8f7
push 0x1b97
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 0x4a], 0
movzx eax, byte [ebp - 0x4a]
test eax, eax
je 0x10027f0b
push 0
push 0x247d
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x10027eb6
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x374], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0xe4], 0
jmp 0x10027f48
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jge 0x10027f64
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0x248], 0xb6bc3ec3
jmp 0x10027f3b
mov dword [ebp - 0x28], 0
jmp 0x10027f74
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x19
je 0x10028074
push 2
lea ecx, [ebp - 0x4bc]
call fcn.10019343
mov dword [ebp - 4], 1
mov dword [ebp - 0x2e0], 0x3989226c
mov dword [ebp - 0x30], 0
jmp 0x10027fac
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x10027fc2
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x54c], 8
jmp 0x10027fa5
mov dword [ebp - 0x30], 0
jmp 0x10027fd2
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x10027fee
push dword [ebp - 0x30]
lea ecx, [ebp - 0x4bc]
call fcn.100193d1
mov dword [eax], 1
jmp 0x10027fcb
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x5d0], eax
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x54c]
push 1
lea ecx, [ebp - 0x4bc]
call fcn.100193d1
mov dword [eax], esi
cmp dword [ebp - 0x28], 6
jne 0x10028043
mov dword [ebp - 0x2e0], 0xffffffff
mov esi, dword [ebp - 0x2e0]
push 0
lea ecx, [ebp - 0x4bc]
call fcn.100193d1
add esi, dword [eax]
jne 0x10028043
and dword [ebp - 0x240], 0
jmp 0x1002804d
mov dword [ebp - 0x240], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x240]
mov dword [ebp + eax - 0x248], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4bc]
call fcn.100193cc
jmp 0x10027f6d
mov dword [ebp - 0x28], 0xfffffff0
jmp 0x10028084
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffeb
jne 0x100280cb
mov dword [ebp - 0x3f4], 0x5969a22d
cmp dword [ebp - 0x3f4], 0
je 0x100280af
cmp dword [ebp - 0x28], 0
je 0x100280af
mov dword [ebp - 0x370], 1
jmp 0x100280b6
and dword [ebp - 0x370], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x370]
mov dword [ebp + eax - 0x248], ecx
jmp 0x1002807d
push 2
lea ecx, [ebp - 0x490]
call fcn.10019343
mov dword [ebp - 4], 2
mov dword [ebp - 0x124], 0
jmp 0x100280f8
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 2
jge 0x1002811a
push dword [ebp - 0x124]
lea ecx, [ebp - 0x490]
call fcn.100193d1
mov dword [eax], 7
jmp 0x100280eb
push 1
lea ecx, [ebp - 0x490]
call fcn.100193d1
and dword [eax], 0
jmp 0x10028150
push 1
lea ecx, [ebp - 0x490]
call fcn.100193d1
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2e8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2e8]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x490]
call fcn.100193d1
cmp dword [eax], 0x15
jle 0x100281fc
mov dword [ebp - 0xec], 0x76e6bacd
mov dword [ebp - 0xec], 0
jmp 0x10028189
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xffffffeb
je 0x100281f7
mov dword [ebp - 0x114], 0xd94543be
mov byte [ebp - 0x4c], 0
movzx eax, byte [ebp - 0x4c]
test eax, eax
je 0x100281b5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
mov dword [ebp - 0x114], 0
jmp 0x100281ce
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xfffffff9
jl 0x100281f5
mov byte [ebp - 0x4e], 0
movzx eax, byte [ebp - 0x4e]
test eax, eax
je 0x100281f3
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x100281c1
jmp 0x1002817c
jmp 0x1002812c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x490]
call fcn.100193cc
push 1
lea ecx, [ebp - 0x4a0]
call fcn.10019343
mov dword [ebp - 4], 3
mov dword [ebp - 0x5d8], 0xfffffffe
mov dword [ebp - 0x5e0], 5
mov dword [ebp - 0x5e8], 0x65256810
mov dword [ebp - 0xf4], 0
jmp 0x10028256
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jge 0x10028278
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x4a0]
call fcn.100193d1
mov dword [eax], 0x5d6c05ba
jmp 0x10028249
push 0
lea ecx, [ebp - 0x4a0]
call fcn.100193d1
and dword [eax], 0
jmp 0x100282ae
push 0
lea ecx, [ebp - 0x4a0]
call fcn.100193d1
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x250]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x250]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x4a0]
call fcn.100193d1
cmp dword [eax], 2
jl 0x1002844c
mov dword [ebp - 0x134], 0xb4074dd
mov dword [ebp - 0x624], 0xffffffff
mov dword [ebp - 0x62c], 0x9aaed6b6
mov dword [ebp - 0x628], 6
mov dword [ebp - 0x564], 0xffffffff
mov dword [ebp - 0x53c], 0xa9bca7b
mov dword [ebp - 0x560], 0x6b43d271
mov byte [ebp - 0x50], 0
movzx eax, byte [ebp - 0x50]
test eax, eax
je 0x1002831e
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
mov dword [ebp - 0x134], 0
jmp 0x10028337
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x19
jge 0x10028447
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0x550], 0xfffffffb
push 3
lea ecx, [ebp - 0x5f8]
call fcn.10019343
mov byte [ebp - 4], 4
mov dword [ebp - 0x338], 7
mov dword [ebp - 0xbc], 0
jmp 0x1002838c
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x100283ae
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x5f8]
call fcn.100193d1
mov dword [eax], 0x63ab1943
jmp 0x1002837f
mov dword [ebp - 0xc0], 0
jmp 0x100283c7
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xffffffe2
jg 0x10028433
mov dword [ebp - 0x568], 0x9598aaf0
mov dword [ebp - 0x55c], 0xd5befa1e
mov dword [ebp - 0x570], 0x491ba6b4
mov dword [ebp - 0x578], 0xffffffff
mov byte [ebp - 0x52], 0
movzx eax, byte [ebp - 0x52]
test eax, eax
je 0x10028424
push 0
push 0xc09
push 0x2658
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
jmp 0x100283ba
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5f8]
call fcn.100193cc
jmp 0x1002832a
jmp 0x1002828a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4a0]
call fcn.100193cc
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x94], 0xfffffff7
mov dword [ebp - 0x80], 0xd29be1d9
mov dword [ebp - 0x258], 0xf3d37a5b
mov dword [ebp - 0x260], 0xfffffffb
mov dword [ebp - 0x43c], 0xcb972524
mov dword [ebp - 0x34], 0
jmp 0x100284a1
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x100284b7
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x6a0], 0xc59cdc34
jmp 0x1002849a
mov dword [ebp - 0x34], 0
jmp 0x100284c7
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x100284dd
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x6b8], 0xfd43ddca
jmp 0x100284c0
mov byte [ebp - 0x54], 0
movzx eax, byte [ebp - 0x54]
test eax, eax
je 0x10028505
push 0x247e
push 0x15b8
push 0x1238
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x61c], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x2f0], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp + eax - 0x6a0], ecx
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x260], eax
imul eax, dword [ebp - 0x260], 0
cmp eax, 0xfffffffb
jge 0x10028559
mov dword [ebp - 0x360], 1
jmp 0x10028560
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x360]
jle 0x10028580
cmp dword [ebp - 0x43c], 0
je 0x10028580
mov dword [ebp - 0x164], 1
jmp 0x10028587
and dword [ebp - 0x164], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x164]
mov dword [ebp + eax - 0x6b8], ecx
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x164], eax
jg 0x100285b1
mov dword [ebp - 0x268], 1
jmp 0x100285b8
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x268]
je 0x100285cf
mov dword [ebp - 0x2f8], 1
jmp 0x100285d6
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0xb0], 0x7d228d5f
mov dword [ebp - 0x108], 0xfffffff8
mov dword [ebp - 0x3c], 0xe0648261
mov dword [ebp - 0xc8], 0
jmp 0x10028613
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x1002862f
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x660], 0xe4fc2285
jmp 0x10028606
mov dword [ebp - 0x3c], 0x13
jmp 0x1002863f
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x12
jge 0x10028666
mov dword [ebp - 0x270], 0x446df37d
cmp dword [ebp - 0x270], 0
je 0x1002865a
jmp 0x10028666
mov dword [ebp - 0x270], 8
jmp 0x10028638
mov dword [ebp - 0x3c], 0x15
jmp 0x10028676
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x12
je 0x100286df
mov dword [ebp - 0xa0], 0x72d9ee1c
mov dword [ebp - 0x56c], 0x4c59cdc3
mov dword [ebp - 0xa0], 0
jmp 0x100286a9
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jg 0x100286dd
mov dword [ebp - 0x340], 5
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0xa0]
cmp dword [ebp + eax*4 - 0x660], 0
je 0x100286db
jmp 0x1002869c
jmp 0x1002869c
jmp 0x1002866f
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x10], 0xfc07e17f
mov dword [ebp - 0x88], 1
mov dword [ebp - 0xd0], 0
jmp 0x10028713
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jge 0x1002872f
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x5d4], 0x255d
jmp 0x10028706
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x574], eax
mov eax, dword [ebp - 0x10]
sub eax, 0xa
cmp eax, 0x2d91
jl 0x10028751
mov dword [ebp - 0x278], 1
jmp 0x10028758
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x278], eax
je 0x1002876f
mov dword [ebp - 0x300], 1
jmp 0x10028776
and dword [ebp - 0x300], 0
cmp dword [ebp - 0x300], 0xffff
ja 0x1002878e
mov dword [ebp - 0x280], 1
jmp 0x10028795
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x280], eax
jg 0x100287af
cmp dword [ebp - 0x10], 0
jne 0x100287af
and dword [ebp - 0x3fc], 0
jmp 0x100287b9
mov dword [ebp - 0x3fc], 1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x618], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x57c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x5dc], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x88], eax
push 6
pop eax
sub eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
imul ecx, eax
cmp ecx, dword [ebp - 0x10]
jne 0x10028899
mov dword [ebp - 0xd8], 0
jmp 0x10028811
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x1002882d
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x678], 0xf6cbcb1a
jmp 0x10028804
mov dword [ebp - 0x10], 0
jmp 0x1002883d
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x10028866
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x678], 0
je 0x10028852
jmp 0x10028866
mov byte [ebp - 0x56], 0
movzx eax, byte [ebp - 0x56]
test eax, eax
je 0x10028864
call dword [sym.imp.USER32.dll_DestroyCaret]
jmp 0x10028836
mov byte [ebp - 0x4b], 0
movzx eax, byte [ebp - 0x4b]
test eax, eax
je 0x10028897
push 0x1138
push 0x1914
push 0x105d
push 0x6e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
jmp 0x100288f0
mov dword [ebp - 0x10], 0
jmp 0x100288a9
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2f
jg 0x100288f0
mov dword [ebp - 0x88], 0
jmp 0x100288c8
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jne 0x100288ee
mov byte [ebp - 0x65], 0
movzx eax, byte [ebp - 0x65]
test eax, eax
je 0x100288ec
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
jmp 0x100288bb
jmp 0x100288a2
mov dword [ebp - 0x8c], 0x69ff4caa
mov dword [ebp - 0xb4], 3
mov dword [ebp - 0x4fc], 0xcba2afe0
mov dword [ebp - 0x4f8], 0xcba2afe0
mov dword [ebp - 0x4f4], 0xcba2afe0
mov dword [ebp - 0x4f0], 0xcba2afe0
lea ecx, [ebp - 0x149]
call fcn.1000c383
push eax
lea eax, [ebp - 0x4ec]
push eax
lea eax, [ebp - 0x4fc]
push eax
lea ecx, [ebp - 0x680]
call fcn.100193e0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x66c]
call fcn.100193a2
mov dword [ebp - 4], 5
mov dword [ebp - 0xb4], 0x1b
jmp 0x10028981
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x19
jg 0x10028a93
push 4
lea ecx, [ebp - 0x39c]
call fcn.10019343
mov byte [ebp - 4], 6
mov dword [ebp - 0x2c], 0
jmp 0x100289af
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x100289cb
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x39c]
call fcn.100193d1
mov dword [eax], 0x690f1d89
jmp 0x100289a8
mov dword [ebp - 0x2c], 0
jmp 0x100289db
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x100289f1
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x690], 0x7834d8a9
jmp 0x100289d4
push 3
lea ecx, [ebp - 0x39c]
call fcn.100193d1
mov dword [eax], 3
jmp 0x10028a2a
push 3
lea ecx, [ebp - 0x39c]
call fcn.100193d1
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x380]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x380]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x39c]
call fcn.100193d1
cmp dword [eax], 0
jl 0x10028a5b
mov byte [ebp - 0x4d], 0
movzx eax, byte [ebp - 0x4d]
test eax, eax
je 0x10028a59
push 0
push 0x1c84
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x10028a06
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x690], 0
je 0x10028a7f
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x39c]
call fcn.100193cc
jmp 0x10028974
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x39c]
call fcn.100193cc
jmp 0x10028974
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x66c]
call fcn.100193cc
mov dword [ebp - 0x2a4], 0x3ec3
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x4e8], 0x78e045dc
mov dword [ebp - 0x4e4], 0x78e045dc
mov dword [ebp - 0x4e0], 0x78e045dc
mov dword [ebp - 0x4dc], 0x78e045dc
lea ecx, [ebp - 0x17d]
call fcn.1000c383
push eax
lea eax, [ebp - 0x4d8]
push eax
lea eax, [ebp - 0x4e8]
push eax
lea ecx, [ebp - 0x6c0]
call fcn.100193e0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x474]
call fcn.100193a2
mov dword [ebp - 4], 7
mov dword [ebp - 0x484], 0xfffffffd
mov dword [ebp - 0x40], 0xf16de6ea
mov dword [ebp - 0x84], 0xec7e011b
mov dword [ebp - 0x90], 0x2d748aee
mov dword [ebp - 0x1bc], 0x307758a8
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0xa8], 0x600bf094
mov dword [ebp - 0xe0], 0
jmp 0x10028b73
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jge 0x10028b8f
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x144], 0x7a4a12b5
jmp 0x10028b66
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x144], 0
je 0x10028bc2
push 7
pop eax
test eax, eax
je 0x10028bc2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x144], 0
je 0x10028bc2
mov dword [ebp - 0x288], 1
jmp 0x10028bc9
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x484]
cmp dword [ebp - 0x288], eax
jl 0x10028be3
mov dword [ebp - 0x308], 1
jmp 0x10028bea
and dword [ebp - 0x308], 0
push 3
lea ecx, [ebp - 0x474]
call fcn.100193d1
mov eax, dword [eax]
cmp eax, dword [ebp - 0x308]
jg 0x10028c0d
mov dword [ebp - 0x198], 1
jmp 0x10028c14
and dword [ebp - 0x198], 0
imul eax, dword [ebp - 0x198], 0x89b4
test eax, eax
jne 0x10028c34
cmp dword [ebp - 0x40], 0
je 0x10028c34
mov dword [ebp - 0x194], 1
jmp 0x10028c3b
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x84], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x144]
cmp dword [ebp - 0x84], eax
jge 0x10028c67
mov dword [ebp - 0x1a4], 1
jmp 0x10028c6e
and dword [ebp - 0x1a4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x144]
cmp dword [ebp - 0x1a4], eax
jge 0x10028ca6
cmp dword [ebp - 0x84], 0
jne 0x10028ca6
push 3
lea ecx, [ebp - 0x474]
call fcn.100193d1
cmp dword [eax], 0
jne 0x10028ca6
and dword [ebp - 0x1ac], 0
jmp 0x10028cb0
mov dword [ebp - 0x1ac], 1
cmp dword [ebp - 0x1ac], 0x64e6
jg 0x10028cc8
mov dword [ebp - 0x1b4], 1
jmp 0x10028ccf
and dword [ebp - 0x1b4], 0
push 2
lea ecx, [ebp - 0x474]
call fcn.100193d1
mov ecx, dword [ebp - 0x1b4]
cmp ecx, dword [eax]
jl 0x10028cf2
mov dword [ebp - 0x404], 1
jmp 0x10028cf9
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x40], 0
jne 0x10028d0c
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x144], 0
mov esi, dword [ebp - 0x84]
push 2
lea ecx, [ebp - 0x474]
call fcn.100193d1
cmp esi, dword [eax]
je 0x10028d2f
mov dword [ebp - 0x444], 1
jmp 0x10028d36
and dword [ebp - 0x444], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x144]
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x90], 0x4e630971
jge 0x10028d60
mov dword [ebp - 0x40c], 1
jmp 0x10028d67
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x644], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0x1422
jg 0x10028da3
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x144], 0
jne 0x10028da3
and dword [ebp - 0x1c4], 0
jmp 0x10028dad
mov dword [ebp - 0x1c4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x144]
cmp dword [ebp - 0x1c4], eax
je 0x10028dce
mov dword [ebp - 0x1cc], 1
jmp 0x10028dd5
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x14], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x144]
cmp eax, dword [ebp - 0x14]
je 0x10028dfb
mov dword [ebp - 0x1d4], 1
jmp 0x10028e02
and dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
je 0x100291d3
mov dword [ebp - 0x1dc], 0x38be40e
push 2
lea ecx, [ebp - 0x514]
call fcn.10019343
mov byte [ebp - 4], 8
mov dword [ebp - 0xe8], 0
jmp 0x10028e4f
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 2
jge 0x10028e71
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x514]
call fcn.100193d1
mov dword [eax], 0x4edb
jmp 0x10028e42
mov dword [ebp - 0x90], 0
jmp 0x10028e8a
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jg 0x10029185
mov dword [ebp - 0xb8], 0xfffb
mov dword [ebp - 0x184], 0xcbd95d60
mov dword [ebp - 0x14], 2
jmp 0x10028ebb
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x10029180
push 2
lea ecx, [ebp - 0x390]
call fcn.10019343
mov byte [ebp - 4], 9
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0xf0], 0
jmp 0x10028ef9
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jge 0x10028f18
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x390]
call fcn.100193d1
and dword [eax], 0
jmp 0x10028eec
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x144], 0
je 0x10028f43
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
je 0x10028f43
mov dword [ebp - 0x214], 1
jmp 0x10028f4a
and dword [ebp - 0x214], 0
push 0
lea ecx, [ebp - 0x390]
call fcn.100193d1
mov dword [eax], 0xb447
push 0
lea ecx, [ebp - 0x390]
call fcn.100193d1
cmp dword [eax], 0xe206
je 0x10028f7e
mov dword [ebp - 0x1e4], 1
jmp 0x10028f85
and dword [ebp - 0x1e4], 0
cmp dword [ebp - 0x1e4], 1
je 0x10028f9a
mov dword [ebp - 0x1ec], 1
jmp 0x10028fa1
and dword [ebp - 0x1ec], 0
push 0
lea ecx, [ebp - 0x390]
call fcn.100193d1
mov ecx, dword [ebp - 0x1ec]
cmp ecx, dword [eax]
jge 0x10028fd1
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x144], 0
je 0x10028fd1
mov dword [ebp - 0x1f4], 1
jmp 0x10028fd8
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x1f4], eax
jl 0x10028ff2
mov dword [ebp - 0x190], 1
jmp 0x10028ff9
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x190], eax
jge 0x10029010
mov dword [ebp - 0x204], 1
jmp 0x10029017
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x204]
jle 0x1002902e
mov dword [ebp - 0x20c], 1
jmp 0x10029035
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0xa8], 0
cmp dword [ebp - 0xa8], 0
je 0x10029067
push 2
pop eax
test eax, eax
je 0x10029067
mov dword [ebp - 0x414], 1
jmp 0x1002906e
and dword [ebp - 0x414], 0
mov eax, 0xffff
test eax, eax
je 0x10029089
cmp dword [ebp - 0x40], 0
je 0x10029089
mov dword [ebp - 0x3ac], 1
jmp 0x10029090
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x84], 0xfff9
jbe 0x100290c0
mov dword [ebp - 0x3a8], 1
jmp 0x100290c7
and dword [ebp - 0x3a8], 0
mov esi, dword [ebp - 0xb8]
push 1
lea ecx, [ebp - 0x514]
call fcn.100193d1
cmp esi, dword [eax]
jge 0x100290f0
cmp dword [ebp - 0x184], 0
jne 0x100290f0
and dword [ebp - 0x21c], 0
jmp 0x100290fa
mov dword [ebp - 0x21c], 1
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x21c], eax
jl 0x10029111
mov dword [ebp - 0x224], 1
jmp 0x10029118
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x144]
cmp dword [ebp - 0x224], eax
jl 0x1002913f
cmp dword [ebp - 0xa8], 0
je 0x1002913f
mov dword [ebp - 0x22c], 1
jmp 0x10029146
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0xb8], 0
je 0x1002916c
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x390]
call fcn.100193cc
jmp 0x10029180
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x390]
call fcn.100193cc
jmp 0x10028eb4
jmp 0x10028e7d
mov dword [ebp - 0x40], 0xffffffe3
jmp 0x10029195
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x38
je 0x100291c2
mov byte [ebp - 0x76], 0
movzx eax, byte [ebp - 0x76]
test eax, eax
je 0x100291c0
push 0
push 0x2518
push 0
push 0x15e3
push 0xbc1
call dword [sym.imp.GDI32.dll_ExtCreatePen]
jmp 0x1002918e
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x514]
call fcn.100193cc
jmp 0x100291ff
mov dword [ebp - 0x14], 0
jmp 0x100291e3
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jg 0x100291ff
mov byte [ebp - 0x4f], 0
movzx eax, byte [ebp - 0x4f]
test eax, eax
je 0x100291fd
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x100291dc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x474]
call fcn.100193cc
mov dword [ebp - 0x5e4], 0x3cdc1821
mov dword [ebp - 0x594], 2
mov dword [ebp - 0x620], 0x8915ced7
mov dword [ebp - 0x100], 0
jmp 0x10029245
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 2
jge 0x10029261
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x6a8], 0xdb2213aa
jmp 0x10029238
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0x6974edf0
jle 0x10029282
mov dword [ebp - 0x234], 1
jmp 0x10029289
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x234]
jge 0x100292a6
cmp dword [ebp - 0xb0], 0
jne 0x100292a6
and dword [ebp - 0x23c], 0
jmp 0x100292b0
mov dword [ebp - 0x23c], 1
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x150], eax
jne 0x100292e2
mov dword [ebp - 0x244], 1
jmp 0x100292e9
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x244], eax
jge 0x10029303
mov dword [ebp - 0x3b8], 1
jmp 0x1002930a
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x6c]
je 0x10029331
push 0xfffffffffffffffd
pop eax
test eax, eax
je 0x10029331
mov dword [ebp - 0x24c], 1
jmp 0x10029338
and dword [ebp - 0x24c], 0
cmp dword [ebp - 0x24c], 0xffffffff
jae 0x1002934d
mov dword [ebp - 0x254], 1
jmp 0x10029354
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x254]
jle 0x1002936b
mov dword [ebp - 0x25c], 1
jmp 0x10029372
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x25c], eax
jne 0x10029389
mov dword [ebp - 0x264], 1
jmp 0x10029390
and dword [ebp - 0x264], 0
cmp dword [ebp - 0x264], 0xffffffff
jle 0x100293a5
mov dword [ebp - 0x26c], 1
jmp 0x100293ac
and dword [ebp - 0x26c], 0
imul eax, dword [ebp - 0x26c], 0x7c0e
test eax, eax
jge 0x100293c6
mov dword [ebp - 0x274], 1
jmp 0x100293cd
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0x274], eax
jg 0x100293e7
mov dword [ebp - 0x27c], 1
jmp 0x100293ee
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x27c]
jg 0x10029405
mov dword [ebp - 0x284], 1
jmp 0x1002940c
and dword [ebp - 0x284], 0
cmp dword [ebp - 0x284], 0x31dda87b
jg 0x10029424
mov dword [ebp - 0x28c], 1
jmp 0x1002942b
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x110], eax
jg 0x10029451
mov dword [ebp - 0x3c0], 1
jmp 0x10029458
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0x8c], 0
je 0x1002955d
mov dword [ebp - 0x148], 0xf8f5
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x5ec], eax
mov eax, 0xcdd5
test eax, eax
je 0x100294a5
cmp dword [ebp - 0x148], 0
je 0x100294a5
mov dword [ebp - 0x3a4], 1
jmp 0x100294ac
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x5a4], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x108], eax
je 0x100294de
mov dword [ebp - 0x294], 1
jmp 0x100294e5
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x108]
imul eax, dword [ebp - 0x294]
cmp eax, dword [ebp - 0x8c]
je 0x10029506
mov dword [ebp - 0x29c], 1
jmp 0x1002950d
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x29c]
je 0x10029527
mov dword [ebp - 0x2ac], 1
jmp 0x1002952e
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0x2ac], eax
jl 0x10029548
mov dword [ebp - 0x2b4], 1
jmp 0x1002954f
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x8c], eax
jmp 0x10029592
mov dword [ebp - 0x94], 1
jmp 0x10029576
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x10029592
mov byte [ebp - 0x6d], 0
lea eax, [ebp - 0x6d]
push eax
push 0
call fcn.1002f21e
pop ecx
pop ecx
jmp 0x10029569
mov dword [ebp - 0x150], 0
mov eax, dword [ebp - 0x3d0]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x170], eax
push 2
lea ecx, [ebp - 0x520]
call fcn.10019343
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x48], 0x11e7bff4
mov dword [ebp - 0x74], 0xfffffffe
mov dword [ebp - 0x158], 0xfffffff6
mov dword [ebp - 0x160], 0xe01e6e83
mov dword [ebp - 0x2fc], 1
mov dword [ebp - 0x3d8], 0xfffffffe
mov dword [ebp - 0x118], 0
jmp 0x1002960e
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 2
jge 0x10029630
push dword [ebp - 0x118]
lea ecx, [ebp - 0x520]
call fcn.100193d1
mov dword [eax], 0x2e31d83
jmp 0x10029601
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jne 0x100296c5
cmp dword [ebp - 0x74], 0
jne 0x10029656
push 8
pop eax
test eax, eax
jne 0x10029656
and dword [ebp - 0x2bc], 0
jmp 0x10029660
mov dword [ebp - 0x2bc], 1
cmp dword [ebp - 0x2bc], 0x1993
je 0x10029678
mov dword [ebp - 0x2c4], 1
jmp 0x1002967f
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x2c4], eax
jne 0x10029699
cmp dword [ebp - 0x74], 0
jne 0x10029699
and dword [ebp - 0x2cc], 0
jmp 0x100296a3
mov dword [ebp - 0x2cc], 1
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x2cc]
imul eax, eax, 0xffffffff
cmp eax, 0xc8b4
jg 0x100296bc
cmp dword [ebp - 0x74], 0
jne 0x100296c5
and dword [ebp - 0x2d4], 0
jmp 0x100296cf
mov dword [ebp - 0x2d4], 1
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x2d4], eax
jl 0x100296e6
mov dword [ebp - 0x2dc], 1
jmp 0x100296ed
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x2dc]
sub eax, dword [ebp - 0x158]
jne 0x10029719
cmp dword [ebp - 0x160], 0
jne 0x10029719
cmp dword [ebp - 0x2fc], 0
jne 0x10029719
and dword [ebp - 0x2e4], 0
jmp 0x10029723
mov dword [ebp - 0x2e4], 1
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x158]
cmp eax, 0x71d69170
jg 0x1002974b
mov dword [ebp - 0x2ec], 1
jmp 0x10029752
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x160]
add eax, dword [ebp - 0x2ec]
cmp eax, 0x372625aa
jge 0x10029774
cmp dword [ebp - 0x74], 0
jne 0x10029774
and dword [ebp - 0x2f4], 0
jmp 0x1002977e
mov dword [ebp - 0x2f4], 1
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x2f4], eax
jge 0x10029795
mov dword [ebp - 0x304], 1
jmp 0x1002979c
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x304], eax
jne 0x100297b6
mov dword [ebp - 0x30c], 1
jmp 0x100297bd
and dword [ebp - 0x30c], 0
push 0
lea ecx, [ebp - 0x520]
call fcn.100193d1
mov dword [eax], 1
imul eax, dword [ebp - 0x30c], 0xffffffff
cmp eax, 1
je 0x100297e8
mov dword [ebp - 0x314], 1
jmp 0x100297ef
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x160]
mov dword [ebp - 0x48], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x520]
call fcn.100193cc
cmp dword [ebp - 0x170], 0
jle 0x10029e0b
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x31c], 0xfffffff6
mov dword [ebp - 0x44], 0x18
jmp 0x10029844
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xfffffff8
je 0x10029ba6
mov dword [ebp - 0xac], 5
mov dword [ebp - 0x32c], 0x3260389a
cmp dword [ebp - 0x44], 0
je 0x1002987b
cmp dword [ebp - 0xac], 0
je 0x10029876
jmp 0x10029ba6
jmp 0x10029ba1
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x128], 0x28c7fffa
push 1
lea ecx, [ebp - 0x52c]
call fcn.10019343
mov dword [ebp - 4], 0xb
push 0x5660
lea eax, [ebp - 0x5ac]
push eax
push 0
lea eax, [ebp - 0x52c]
push eax
call fcn.1002f47d
add esp, 0x10
mov dword [ebp - 0xac], 0xb
jmp 0x100298d6
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 9
jg 0x10029b66
mov dword [ebp - 0x24], 0xfce2949f
mov dword [ebp - 0x168], 0x9fa85f88
mov dword [ebp - 0x3e8], 0x7e294b58
mov dword [ebp - 0x120], 0
jmp 0x10029917
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jge 0x10029933
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x558], 0xa2ef7e29
jmp 0x1002990a
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x5fc], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x5b4], eax
mov dword [ebp - 0x20], 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x31c], eax
jle 0x10029978
mov dword [ebp - 0x3e0], 1
jmp 0x1002997f
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x610], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x5bc], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x60c], eax
push 0xfffffffffffffff7
pop eax
cmp eax, 1
jb 0x100299ae
mov dword [ebp - 0x324], 1
jmp 0x100299b5
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x32c]
add eax, 9
cmp eax, 0xffffffff
ja 0x100299dd
or eax, 0xffffffff
jne 0x100299dd
and dword [ebp - 0x334], 0
jmp 0x100299e7
mov dword [ebp - 0x334], 1
mov eax, dword [ebp - 0x334]
sub eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x24]
jg 0x10029a4f
mov dword [ebp - 0x20], 0
jmp 0x10029a08
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffffd
jge 0x10029a37
mov dword [ebp - 0x24], 0
jmp 0x10029a1e
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jg 0x10029a35
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x558], 0
je 0x10029a33
jmp 0x10029a35
jmp 0x10029a17
jmp 0x10029a01
push 0
lea eax, [ebp - 0x3e8]
push eax
push 0x7221
call fcn.1002b2c6
add esp, 0xc
jmp 0x10029a6b
mov byte [ebp - 0x51], 0
push 0
lea eax, [ebp - 0x51]
push eax
push 0x3d7c
push 0x3bb6
call fcn.1002ae50
add esp, 0x10
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x5c4], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x128], eax
jg 0x10029a8e
mov dword [ebp - 0x33c], 1
jmp 0x10029a95
and dword [ebp - 0x33c], 0
imul eax, dword [ebp - 0x33c], 0x3faa
cmp eax, dword [ebp - 0x128]
jle 0x10029ab3
mov dword [ebp - 0x344], 1
jmp 0x10029aba
and dword [ebp - 0x344], 0
cmp dword [ebp - 0x344], 0
jl 0x10029acf
mov dword [ebp - 0x34c], 1
jmp 0x10029ad6
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x34c]
add eax, 0x31b8c97
je 0x10029af5
cmp dword [ebp - 0x24], 0
je 0x10029af5
mov dword [ebp - 0x354], 1
jmp 0x10029afc
and dword [ebp - 0x354], 0
cmp dword [ebp - 0x354], 0x6b86
jne 0x10029b14
mov dword [ebp - 0x35c], 1
jmp 0x10029b1b
and dword [ebp - 0x35c], 0
cmp dword [ebp - 0x35c], 6
jg 0x10029b30
mov dword [ebp - 0x364], 1
jmp 0x10029b37
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x364], eax
jle 0x10029b4e
mov dword [ebp - 0x36c], 1
jmp 0x10029b55
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x168], eax
jmp 0x100298c9
mov dword [ebp - 0x20], 0
jmp 0x10029b76
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x10029b92
push dword [ebp - 0x20]
lea ecx, [ebp - 0x52c]
call fcn.100193d1
mov dword [eax], 5
jmp 0x10029b6f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x52c]
call fcn.100193cc
jmp 0x1002983d
push 4
push 0x1000
push dword [ebp - 0x170]
mov eax, dword [ebp - 0x374]
mov ecx, dword [ebp - 0x3f0]
add ecx, dword [eax + 0xc]
push ecx
push 0x4a6a
push 0x5faa
call fcn.10026648
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x178]
mov dword [ecx], eax
mov dword [ebp - 0x138], 0xffffffff
push 3
lea ecx, [ebp - 0x508]
call fcn.10019343
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x428], 6
mov dword [ebp - 0x130], 0
jmp 0x10029c1f
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 3
jge 0x10029c41
push dword [ebp - 0x130]
lea ecx, [ebp - 0x508]
call fcn.100193d1
mov dword [eax], 0x2d714f98
jmp 0x10029c12
mov dword [ebp - 0x138], 0
jmp 0x10029c5a
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x19
jl 0x10029dd3
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0x400], 0x5969a22d
mov dword [ebp - 0x418], 0xfffffff6
mov dword [ebp - 0x420], 0x6874be76
mov dword [ebp - 0x410], 8
mov byte [ebp - 0x78], 0
push 0x6d4d
push 0x630f
push 0x7b8a
push 0x6d2a
push 0
push 0x54c0
lea eax, [ebp - 0x78]
push eax
push 0x29c9
push 0x25d6
call fcn.1002ac2e
add esp, 0x24
mov dword [ebp - 0xfc], 0xfffffff8
jmp 0x10029ce7
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0xffffffe2
je 0x10029dce
push 1
lea ecx, [ebp - 0x538]
call fcn.10019343
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x614], 0xec3d4e70
push 1
lea ecx, [ebp - 0x608]
call fcn.10019343
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x408], 0xeba4
lea eax, [ebp - 0x538]
push eax
lea eax, [ebp - 0x3f8]
push eax
push 0
push 0x477
call fcn.1002c721
add esp, 0x10
lea eax, [ebp - 0x608]
push eax
push 0x51d9
push 0
lea eax, [ebp - 0x3f8]
push eax
push 0x3073
call fcn.100308ee
add esp, 0x14
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x538]
push eax
push 0
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.1002b396
add esp, 0x24
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x608]
call fcn.100193cc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x538]
call fcn.100193cc
jmp 0x10029cda
jmp 0x10029c4d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x508]
call fcn.100193cc
mov eax, dword [ebp - 0x374]
mov ecx, dword [ebp - 0x178]
mov ecx, dword [ecx]
mov dword [eax + 8], ecx
push dword [ebp - 0x170]
push 0
mov eax, dword [ebp - 0x178]
push dword [eax]
call fcn.10026752
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret