Function at 0x1000ab96
Capabilities:
Allocate thread local storage
Encode data using xor
Get common file path

Disassembly:
mov eax, 0x10074278
call fcn.10073c40
sub esp, 0x20c
push ebx
mov dword [ebp - 0x14], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x34], 0xaed6b657
push esi
mov dword [ebp - 0x50], 0x2530a9bc
mov esi, 0x1061cd78
push edi
mov edi, ecx
mov dword [ebp - 0x2c], 0x4e24
cmp dword [ebp - 0x2c], 0x51f1
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x48], dl
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], edi
jle 0x1000ac28
mov edi, ebx
mov dword [ebp - 0x40], ebx
mov eax, ebx
mov dword [ebp - 0x3c], 0x1f03
mov ebx, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
xor eax, edi
mov ecx, esi
cdq
push edx
push eax
call fcn.1000f3d7
mov eax, dword [ebp - 0x34]
add eax, ebx
dec dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
jne 0x1000abf7
inc ebx
push 0
mov dword [ebp - 0x40], ebx
cmp ebx, 0x225e
pop ebx
jl 0x1000abe8
inc edi
cmp edi, 0x4730
jl 0x1000abe5
mov dword [ebp - 0x3c], 0xfff9
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x2c], 0x4bf6
jge 0x1000ac47
mov edx, 0x10007720
mov ecx, esi
call fcn.100119e8
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], 0xc5674fa7
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000ac6a
push 0xc75
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp dword [ebp - 0x14], ebx
je 0x1000ac96
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x50], 1
jge 0x1000ac84
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x11c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
neg eax
push 2
sbb eax, eax
pop edi
neg eax
mov dword [ebp - 0x28], eax
push edi
call fcn.1000f62f
mov dword [ebp - 0x14], 0xdf1febae
mov dword [ebp - 0x14], ebx
jmp 0x1000ad06
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000acf3
mov dword [ebp - 0x14], ebx
jmp 0x1000ad41
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000ad3e
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1448
push 0x1859
push 0x2d
push 0x451
push 0x4e5
call dword [sym.imp.GDI32.dll_CreateFontA]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jle 0x1000ad10
cmp dword [ebp - 0x11c], 0
je 0x1000ad6e
push dword [ebp - 0x11c]
call fcn.1005d4ba
pop ecx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x14], 0x2304b25b
mov dword [ebp - 0x34], 0xffff
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x28], 0x21705914
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000adab
push ebx
push ebx
push 0x905
push 0x250
push ebx
push 0x160d
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0x59951ea6
mov eax, dword [ebp - 0x34]
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
sub eax, edx
mov dword [ebp - 0x28], eax
mov eax, dword [0x1007b5cc]
mov dword [ebp - 0x34], 0x19d3
cmp dword [ebp - 0x34], 0x1d17
mov dword [ebp - 0x50], eax
jle 0x1000ae26
mov edi, ebx
mov dword [ebp - 0x28], ebx
mov eax, ebx
mov ecx, esi
xor eax, edi
cdq
push edx
push eax
call fcn.1000f3d7
inc ebx
cmp ebx, 0x4afa
jl 0x1000ae00
inc edi
push 0
pop ebx
cmp edi, 0x42a0
jl 0x1000adfd
push 2
pop edi
mov dword [ebp - 4], edi
cmp dword [ebp - 0x34], 0x168c
jge 0x1000ae65
mov edx, 0x100077b8
mov ecx, esi
call fcn.100119e8
jmp 0x1000ae65
or dword [ebp - 4], 0xffffffff
xor esi, esi
inc esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], ebx
jmp 0x1000ae85
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1fc], 0xa6847dfa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000ae74
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], ebx
jl 0x1000aead
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000aea8
push 0x2455
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec dword [ebp - 0x14]
jns 0x1000ae93
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000aec1
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp byte [ebp - 0x48], 0
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
je 0x1000b1fb
cmp dword [ebp - 0x50], esi
jne 0x1000b1fb
mov dword [ebp - 0x30], 0xfffffffc
lea ecx, [ebp - 0xc8]
push 3
call fcn.1000f62f
push 4
pop edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], 0xffff
mov dword [ebp - 0x3c], 0x464f6128
mov dword [ebp - 0x14], ebx
jmp 0x1000af1e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc8]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000af0f
cmp dword [ebp - 0x30], edx
jne 0x1000af94
mov dword [ebp - 0x14], ebx
jmp 0x1000af3f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1cc], 0x59609c3f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000af2e
mov dword [ebp - 0x30], 0xfffffffd
jmp 0x1000af89
mov dword [ebp - 0x14], 0xce3e63e3
mov dword [ebp - 0x14], ebx
jmp 0x1000af7a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000af77
push 0x6bf
push 0x1d80
push 0x1457
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x1000af59
mov eax, dword [ebp - 0x1c4]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x1000af4d
jmp 0x1000b060
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], 0x1c
jg 0x1000b060
mov dword [ebp - 0x38], 0xadb2bc40
mov dword [ebp - 0x38], 0x658edfe0
mov dword [ebp - 0x28], 0x2332
cmp dword [ebp - 0x28], 0xcad
jge 0x1000b04a
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x64], ebx
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x5c], ebx
push eax
push 0x10007838
call fcn.1005cc6b
add esp, 0xc
mov dword [ebp - 0x68], ebx
cmp dword [ebp - 0x64], 0
mov edi, ebx
mov dword [ebp - 0x28], ebx
push 0x65
pop esi
jle 0x1000b027
lea eax, [ebp - 0x68]
push eax
push 0x10007710
call fcn.1005cc6b
mov eax, dword [ebp - 0x5c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x68]
test ecx, ecx
jns 0x1000b016
test eax, eax
jle 0x1000b016
neg ecx
dec eax
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x5c], eax
add edi, ecx
cmp ecx, esi
cmovl esi, ecx
inc ebx
cmp ebx, dword [ebp - 0x64]
jl 0x1000afef
xor ebx, ebx
jmp 0x1000b02a
mov eax, dword [ebp - 0x5c]
and eax, 0x80000001
jns 0x1000b036
dec eax
or eax, 0xfffffffe
inc eax
je 0x1000b03d
neg esi
lea edi, [edi + esi*2]
push edi
push 0x10007840
call fcn.1005d2b3
pop ecx
pop ecx
dec dword [ebp - 0x1c]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x1c
jle 0x1000afa1
push 2
xor esi, esi
pop edi
inc esi
mov dword [ebp - 0x30], 0xfffffffa
cmp dword [ebp - 0x30], 3
jle 0x1000b185
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x34], eax
push edi
lea ecx, [ebp - 0xa4]
call fcn.1000f62f
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], 0x2aec7f51
mov dword [ebp - 0x14], ebx
jmp 0x1000b0b0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000b0a0
mov eax, dword [ebp - 0xa4]
cmp dword [eax], ebx
je 0x1000b0d2
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xa4]
inc ecx
imul ecx, dword [eax]
mov eax, esi
test ecx, ecx
jne 0x1000b0d4
mov eax, ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov dword [eax + 4], ebx
mov dword [ebp - 0x20], 0xfffffffa
cmp dword [ebp - 0x20], 9
jg 0x1000b15a
mov edi, eax
mov dword [ebp - 0x14], 0x4a12
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x14], eax
jne 0x1000b114
mov edx, ebx
cmp dword [edi + 4], ebx
je 0x1000b116
mov edx, esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
push 0xfffffffffffffffd
sete cl
pop edx
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], ebx
je 0x1000b13a
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jle 0x1000b0f8
push 2
pop edi
push dword [ebp - 0xa4]
call fcn.1005d4ba
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
pop ecx
jg 0x1000b07a
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xc8], 0
je 0x1000b1b0
push dword [ebp - 0xc8]
call fcn.1005d4ba
pop ecx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xc0], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], 0xf6af1124
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0xffffffea
mov dword [eax + 8], 4
je 0x1000b1f4
mov dword [ebp - 0x28], 0xfff6
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000b1e3
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapCreate]
cmp dword [ebp - 0x28], ebx
jne 0x1000b1f1
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffea
jne 0x1000b1ca
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x1007b5cc
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10009520]
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x19c]
mov dword [ebp - 0xbc], ebx
push eax
push ebx
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0xb8], ebx
movdqu xmmword [ebp - 0x19c], xmm0
mov dword [ebp - 0xb4], ebx
call fcn.1001211a
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x38], 0x44ad72d7
mov dword [ebp - 0x38], 0xf44cacff
push 4
call fcn.1000f62f
mov byte [ebp - 4], 6
lea eax, [ebp - 0x16c]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10009530]
lea ecx, [ebp - 0x80]
push eax
lea eax, [ebp - 0x17c]
mov dword [ebp - 0x80], ebx
push eax
push ebx
movdqu xmmword [ebp - 0x17c], xmm0
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
call fcn.1001211a
mov byte [ebp - 4], 7
mov dword [ebp - 0x14], ebx
jmp 0x1000b2af
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x104]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000b29f
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 3
jg 0x1000b350
mov edi, dword [ebp - 0x80]
mov dword [ebp - 0x38], 0x31d83293
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x38], 0x4bedcc59
mov dword [ebp - 0x38], 0xe64e6dc6
push 3
call fcn.1000f62f
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1000b310
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x128]
mov dword [eax + ecx*4], 0x308f4727
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000b2fd
dec dword [edi + 4]
cmp dword [ebp - 0x128], 0
je 0x1000b340
push dword [ebp - 0x128]
call fcn.1005d4ba
pop ecx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x120], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x1000b2c5
push 2
pop edi
cmp dword [ebp - 0x80], 0
je 0x1000b368
push dword [ebp - 0x80]
call fcn.1005d4ba
pop ecx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
cmp dword [ebp - 0x104], 0
je 0x1000b38f
push dword [ebp - 0x104]
call fcn.1005d4ba
pop ecx
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0xfc], ebx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xbc], 0
je 0x1000b3ba
push dword [ebp - 0xbc]
call fcn.1005d4ba
pop ecx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], ebx
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x24], eax
jge 0x1000bf9e
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x40], 0x6c53
cmp dword [ebp - 0x40], 0x6e69
jle 0x1000b464
mov eax, ebx
mov dword [ebp - 0x2c], ebx
mov ecx, ebx
mov dword [ebp - 0x3c], ebx
cdq
idiv ecx
mov dword [ebp - 0x14], ebx
mov eax, ebx
mov dword [ebp - 0x34], edx
mov edi, ebx
mov ecx, edi
sar eax, cl
lea ecx, [ebp - 0x1f0]
xor eax, edx
cdq
push edx
push eax
call fcn.1000ab1b
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000b416
mov eax, dword [eax]
push eax
call fcn.1005d2b3
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x1f0]
call fcn.1000fb22
mov eax, dword [ebp - 0x14]
inc edi
mov edx, dword [ebp - 0x34]
cmp edi, 0x3558
jl 0x1000b3f8
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0xc76
jl 0x1000b3f6
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
inc ecx
mov dword [ebp - 0x3c], ecx
cmp ecx, 0x4192
jl 0x1000b3eb
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x125a
jl 0x1000b3e6
push 2
pop edi
mov dword [ebp - 0x28], 0xffff
cmp dword [ebp - 0x40], 0x69ee
jge 0x1000b47f
push 0x10007848
call fcn.1005d2b3
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1000b499
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x16c], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000b488
mov dword [ebp - 0x1c], ebx
jmp 0x1000b4b4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x16c], 0x1f2c29a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000b4a3
mov dword [ebp - 0x1c], 0xffffffe6
jmp 0x1000b50f
push edi
lea ecx, [ebp - 0x134]
call fcn.1000f62f
mov dword [ebp - 0x14], ebx
jmp 0x1000b4e3
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x134]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000b4d3
mov ecx, dword [ebp - 0x134]
push ecx
mov eax, dword [ecx]
mov dword [ebp - 0x28], eax
call fcn.1005d4ba
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x12c], ebx
inc dword [ebp - 0x1c]
pop ecx
cmp dword [ebp - 0x1c], 0xffffffed
jge 0x1000b4c2
cmp dword [ebp - 0x24], 0
mov ecx, 0x1007b5d0
mov dword [ebp - 0x30], ecx
jle 0x1000ba63
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 0xffffffeb
cmp dword [ebp - 0x14], 0xfffffff4
jg 0x1000b58f
mov dword [ebp - 0x1c], 0x7b1891f7
mov dword [ebp - 0x20], ebx
jmp 0x1000b557
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1d8], 0x6ccb0362
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x1000b546
cmp dword [ebp - 0x1c], ebx
jne 0x1000b58c
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], ebx
jl 0x1000b583
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000b57e
push 0x11e2
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
dec dword [ebp - 0x1c]
jns 0x1000b56a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff4
jle 0x1000b53a
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx]
lea ecx, [ebp - 0x98]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10009550]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x18c]
mov dword [ebp - 0x98], ebx
push eax
push ebx
movdqu xmmword [ebp - 0x18c], xmm0
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
call fcn.1001211a
mov dword [ebp - 0x2c], 0x6840eb44
mov dword [ebp - 0x14], ebx
jmp 0x1000b5f0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x164], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000b5df
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
xor eax, eax
cmp edx, 0xfffffff7
mov dword [ebp - 0x164], edx
sete al
xor ecx, ecx
cmp eax, 0x1e468a07
setge cl
imul ecx, edx
imul ecx, edx
test ecx, ecx
je 0x1000b62a
mov eax, esi
cmp dword [ebp - 0x164], ebx
jne 0x1000b62c
mov eax, ebx
mov dword [ebp - 0x2c], eax
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x98]
cmp dword [ecx], eax
setge dl
mov dword [ecx + 4], edx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000b654
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
push dword [ebp - 0x98]
call fcn.1005d4ba
add dword [ebp - 0x30], 4
mov eax, 0x2d68
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x20], 0x3c692bea
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x54], 0xfffffffc
mov dword [ebp - 0x44], 0xcf83
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
pop ecx
cmp dword [ebp - 0x20], ebx
je 0x1000b733
push edi
lea ecx, [ebp - 0xd4]
call fcn.1000f62f
mov dword [ebp - 0x14], ebx
jmp 0x1000b6e5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xd4]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000b6d2
mov dword [ebp - 0x20], ebx
jmp 0x1000b6ff
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xd4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000b6ef
cmp dword [ebp - 0xd4], 0
je 0x1000ba36
push dword [ebp - 0xd4]
call fcn.1005d4ba
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xcc], ebx
jmp 0x1000ba35
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10009580]
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x1ac]
mov dword [ebp - 0x8c], ebx
push eax
push ebx
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x88], ebx
movdqu xmmword [ebp - 0x1ac], xmm0
mov dword [ebp - 0x84], ebx
call fcn.1001211a
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x28], 0xec7e4343
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x54], 0xe96f8f9e
mov dword [ebp - 0x28], 0xbb9cf7d1
mov dword [ebp - 0x4c], 0xfbd10caa
push edi
call fcn.1000f62f
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x1ac]
push dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x74], ebx
push eax
lea eax, [ebp - 0x1bc]
mov dword [ebp - 0x70], ebx
push eax
push ebx
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x6c], ebx
movdqu xmmword [ebp - 0x1bc], xmm0
call fcn.1001211a
push edi
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 0xc
call fcn.1000f62f
mov dword [ebp - 0x1c], ebx
jmp 0x1000b809
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], 0x81d534a2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000b7f6
mov dword [ebp - 0x1c], ebx
jmp 0x1000b826
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000b813
mov eax, dword [ebp - 0x8c]
cmp dword [eax + 8], ebx
je 0x1000b911
mov dword [ebp - 0x1c], 0xa6ff609
mov dword [ebp - 0x14], 0x40ff
mov dword [ebp - 0x4c], 0xfffffffe
mov dword [ebp - 0x40], 0xa0d1f89
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x14]
test eax, eax
jne 0x1000b89d
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
cmp eax, 0x3a1b
setle cl
imul eax, ecx, 0x1f8b
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x54], 0xc20eb8fc
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0xec]
imul ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
add ecx, dword [eax + 4]
mov eax, dword [ebp - 0x4c]
add eax, ecx
mov ecx, dword [ebp - 0x20]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0x142ace07
jge 0x1000b8fb
mov eax, dword [ebp - 0x74]
cmp dword [eax + 4], ebx
mov eax, ebx
je 0x1000b8fd
mov eax, esi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
jmp 0x1000b9ae
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x44], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x3c], ebx
je 0x1000b946
mov eax, esi
cmp dword [ebp - 0x14], ebx
jne 0x1000b948
mov eax, ebx
cmp eax, dword [ebp - 0x14]
jl 0x1000b95a
mov eax, dword [ebp - 0xe0]
cmp dword [eax + 4], ebx
mov eax, esi
jne 0x1000b95c
mov eax, ebx
xor edx, edx
cmp eax, 0xfd71af1e
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0xfffffff8
je 0x1000b97b
mov eax, dword [ebp - 0x158]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x1c], ebx
je 0x1000b992
mov eax, esi
mov ecx, esi
cmp eax, dword [ebp - 0x20]
jg 0x1000b994
mov ecx, ebx
imul eax, dword [ebp - 0x1c], 0x93c6
add eax, ecx
mov dword [ebp - 0x44], eax
jne 0x1000b9a9
mov eax, ebx
cmp dword [ebp - 0x34], ebx
je 0x1000b9ab
mov eax, esi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0xec], 0
je 0x1000b9d5
push dword [ebp - 0xec]
call fcn.1005d4ba
pop ecx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], ebx
cmp dword [ebp - 0x74], 0
je 0x1000b9ed
push dword [ebp - 0x74]
call fcn.1005d4ba
pop ecx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
cmp dword [ebp - 0xe0], 0
je 0x1000ba14
push dword [ebp - 0xe0]
call fcn.1005d4ba
pop ecx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xd8], ebx
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x8c]
call fcn.1005d4ba
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
pop ecx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000ba45
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx]
add ecx, 4
test eax, eax
jne 0x1000ba54
add ecx, 8
add ecx, dword [ebp - 0x38]
dec dword [ebp - 0x24]
mov dword [ebp - 0x30], ecx
jne 0x1000b527
mov dword [ebp - 0x14], ebx
mov eax, 0x1009d434
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x28], 0x6bc044b0
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x14], 0xfffffff3
jmp 0x1000bbbf
mov dword [ebp - 0x58], 0x4c38b6b0
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0x58], 0x552bf338
mov dword [ebp - 0x58], 0x54671013
mov dword [ebp - 0x58], 0x351a938
mov dword [ebp - 0x2c], edi
push edi
call fcn.1000f62f
mov dword [ebp - 0x34], 0xbed5
mov dword [ebp - 0x24], ebx
jmp 0x1000baf8
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 0xdbf0cf86
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1000bae5
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xf8]
mov edx, dword [eax]
mov eax, dword [ebp - 0x140]
sub edx, ecx
xor ecx, ecx
cmp eax, edx
setg cl
imul eax, ecx, 0xe428
test eax, eax
jne 0x1000bb28
mov eax, ebx
cmp dword [ebp - 0x2c], ebx
je 0x1000bb2a
mov eax, esi
add eax, 0x7a30
jne 0x1000bb40
cmp dword [ebp - 0x2c], ebx
jne 0x1000bb40
mov eax, ebx
cmp dword [ebp - 0x144], ebx
je 0x1000bb42
mov eax, esi
mov ecx, 0xfff8
cmp ecx, eax
mov eax, dword [ebp - 0x38]
sbb ecx, ecx
xor edx, edx
add ecx, 0x10000
cmp ecx, eax
mov eax, dword [ebp - 0x13c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
sub eax, ecx
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x140]
sub edx, eax
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
add ecx, edx
dec dword [ebp - 0x34]
cmp eax, ecx
push dword [ebp - 0xf8]
mov ecx, esi
cmovg ecx, ebx
xor eax, eax
cmp ecx, 0x60fc
setne al
mov dword [ebp - 0x28], eax
call fcn.1005d4ba
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xf0], ebx
inc dword [ebp - 0x14]
pop ecx
cmp dword [ebp - 0x14], 0xfffffff9
jne 0x1000baae
mov esi, dword [ebp - 0x30]
mov edi, dword [esi]
mov dword [ebp - 0x38], 0xfffa
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
mov dword [ebp - 0x58], edi
je 0x1000bc8f
mov dword [ebp - 0x54], 0x5065
cmp dword [ebp - 0x54], 0x5333
jle 0x1000bc6e
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, ebx
mov dword [ebp - 0x4c], ebx
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x38], esi
and esi, edi
mov dword [ebp - 0x44], ebx
mov edi, ebx
mov eax, edi
lea ecx, [ebp - 0x214]
or eax, esi
cdq
push edx
push eax
call fcn.1000ab1b
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000bc2c
mov eax, dword [eax]
push eax
call fcn.1005d2b3
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x214]
call fcn.1000fb22
inc edi
cmp edi, 0x1620
jl 0x1000bc10
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x4c]
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x52cd
jl 0x1000bc06
inc edi
mov dword [ebp - 0x4c], edi
cmp edi, 0x575c
jl 0x1000bc01
mov edi, dword [ebp - 0x58]
mov esi, dword [ebp - 0x30]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
cmp dword [ebp - 0x54], 0x5035
jge 0x1000bc8b
push 0x100078d0
call fcn.1005d2b3
pop ecx
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000bc9f
push ebx
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
add esi, 4
mov dword [ebp - 0x2c], 0x5653
push 3
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x30], esi
call fcn.1000f62f
mov dword [ebp - 0x38], 0xe34edf6b
mov dword [ebp - 0x24], ebx
jmp 0x1000bcd8
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x110]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1000bcc5
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000bcfd
push ebx
push 0x1d8e
push 0x1cd0
push 0x12e2
call dword [sym.imp.USER32.dll_SetDlgItemInt]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
xor esi, esi
mov eax, dword [ebp - 0x2c]
inc esi
mov eax, dword [ebp - 0x110]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x2c]
cmp eax, esi
push dword [ebp - 0x110]
setg cl
imul ecx, edx
imul ecx, edx
imul eax, ecx, 3
mov dword [ebp - 0x38], eax
call fcn.1005d4ba
pop ecx
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x108], ebx
mov eax, dword [ecx]
add ecx, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x3c], 0x8664a116
mov dword [ebp - 0x34], 0xd3e5
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 5
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x30], ecx
je 0x1000bec3
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x20], ebx
jmp 0x1000bea6
mov dword [ebp - 0x1c], 0x6d4f2887
mov dword [ebp - 0x24], ebx
jmp 0x1000bda2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x60], 0xfffffff6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1000bd94
mov dword [ebp - 0x1c], ebx
jmp 0x1000be0d
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], ebx
jl 0x1000be0a
mov dword [ebp - 0x38], 0xfffffffd
mov edx, dword [ebp - 0x60]
neg edx
sbb edx, edx
imul eax, dword [ebp - 0x14], 0xfff7
neg edx
xor ecx, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x60]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setg cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x60]
add eax, dword [ebp - 0x28]
cmp eax, ecx
setl dl
sub edx, 0xfffffffc
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x3c]
mov dword [ebp - 0x38], edx
dec dword [ebp - 0x24]
jns 0x1000bdbe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1d
jg 0x1000bdac
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x1c], 0x6ac1
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x4c]
jg 0x1000be31
mov ecx, ebx
cmp dword [ebp - 0x34], ebx
je 0x1000be33
mov ecx, esi
mov eax, dword [ebp - 0x60]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x3c]
setle cl
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x1c]
cmp edx, 0xffffffff
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
mov eax, dword [ebp - 0x60]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, 0xfffffffa
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe9
jg 0x1000bd88
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 5
jne 0x1000bd72
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x1000bf9e
cmp byte [ebp - 0x48], al
je 0x1000bede
cmp dword [ebp - 0x50], esi
jne 0x1000bede
mov edx, dword [ebp + 8]
lea eax, [edi + 0x10]
add dword [edx + 8], eax
mov eax, dword [ecx]
mov dword [ebp - 0x38], eax
mov eax, dword [ecx + 4]
add ecx, 8
push edi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x30], ecx
call fcn.1005839b
pop ecx
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0xb0]
lea eax, [ebp - 0x138]
mov dword [ebp - 0x138], ebx
push eax
push edi
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
call fcn.1000fd8d
mov ecx, dword [ebp - 0xb0]
mov esi, ebx
test edi, edi
jle 0x1000bf74
mov eax, esi
and eax, 0x80000001
jns 0x1000bf3e
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x38]
add eax, esi
add eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x44]
jmp 0x1000bf53
lea eax, [edx + 1]
cdq
idiv edi
cmp word [ecx + edx*2], bx
jne 0x1000bf50
xor eax, eax
inc eax
mov word [ecx + edx*2], ax
mov eax, dword [ebp - 0x30]
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x28]
mov byte [esi + edx], al
inc esi
cmp esi, edi
jl 0x1000bf30
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x28]
mov dword [esi], edi
mov dword [esi + 4], eax
test ecx, ecx
je 0x1000bfa1
push ecx
call fcn.1005d4ba
pop ecx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
jmp 0x1000bfa1
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24], 0x3d837bc7
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp + 8], 0xfffffffc
mov dword [ebp + 8], 0xd3ae
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x1000bfd8
push ebx
push 0x1d14
push ebx
push 0x261f
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
pop edi
setge dl
mov dword [ebp - 0x28], edx
xor edx, edx
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
imul ecx, eax, 0xffff0001
cmp ecx, 0x3e7e
setle dl
xor eax, eax
mov dword [ebp + 8], edx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
cmp ecx, edx
mov ecx, dword [ebp - 0xc]
setl al
mov dword [ebp + 8], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret