Function at 0x10021bc5
Capabilities:
Check os version
Delete directory
Encrypt data using speck
Extract resource via kernel32 functions
Get disk information
Get geographical location
Get graphical window text
Identify system language via api
Parse pe header
Query or enumerate registry key
Read .ini file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10074b0e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xd7c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x9c], 0x13dd33a4
mov dword [ebp - 0xcc], 0x58528353
mov dword [ebp - 0x6e0], 0xffffffff
mov dword [ebp - 0x9c], 0xfffffff7
jmp 0x10021c21
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xfffffff1
jl 0x1002202d
push 1
lea ecx, [ebp - 0x3d0]
call fcn.1000f62f
and dword [ebp - 4], 0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0x204], 0
jmp 0x10021c62
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 1
jge 0x10021c84
push dword [ebp - 0x204]
lea ecx, [ebp - 0x3d0]
call fcn.1000f696
mov dword [eax], 0x35c5735
jmp 0x10021c55
push 0
lea ecx, [ebp - 0x3d0]
call fcn.1000f696
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jne 0x10021cbd
push 0
lea ecx, [ebp - 0x3d0]
call fcn.1000f696
cmp dword [eax], 0
jne 0x10021cbd
and dword [ebp - 0x658], 0
jmp 0x10021cc7
mov dword [ebp - 0x658], 1
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x658]
je 0x10021ce1
mov dword [ebp - 0x6d4], 1
jmp 0x10021ce8
and dword [ebp - 0x6d4], 0
push 0
lea ecx, [ebp - 0x3d0]
call fcn.1000f696
mov eax, dword [eax]
imul eax, dword [ebp - 0x6d4]
xor ecx, ecx
sub ecx, eax
je 0x10021fcd
mov dword [ebp - 0x6cc], 0x5c2f
mov dword [ebp - 0x704], 0x7ccce1cc
mov dword [ebp - 0x3f8], 0xeebc
mov dword [ebp - 0xcc], 0xffffffe4
jmp 0x10021d3f
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jle 0x10021fb6
mov dword [ebp - 0x17c], 0xffffffff
mov dword [ebp - 0x79c], 0
mov byte [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
test eax, eax
je 0x10021d89
push 0
push 0x1ded
push 0x1a18
push 0xd8f
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov dword [ebp - 0x17c], 0
jmp 0x10021da2
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0xd
jle 0x10021fb1
mov dword [ebp - 0xd4], 0x76fda024
mov dword [ebp - 0xd4], 0
jmp 0x10021dd2
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x12
je 0x10021e33
push 0
lea ecx, [ebp - 0x3d0]
call fcn.1000f696
cmp dword [eax], 0xfffffffc
jle 0x10021df9
mov dword [ebp - 0x6dc], 1
jmp 0x10021e00
and dword [ebp - 0x6dc], 0
cmp dword [ebp - 0x6dc], 0
jae 0x10021e15
mov dword [ebp - 0x6e4], 1
jmp 0x10021e1c
and dword [ebp - 0x6e4], 0
push 0
lea ecx, [ebp - 0x3d0]
call fcn.1000f696
mov ecx, dword [ebp - 0x6e4]
mov dword [eax], ecx
jmp 0x10021dc5
mov eax, dword [ebp - 0x704]
mov dword [ebp - 0xc1c], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xae4], eax
cmp dword [ebp - 0xd4], 0x40f8
jne 0x10021e6f
mov dword [ebp - 0x70c], 1
jmp 0x10021e76
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x704]
imul eax, dword [ebp - 0x70c]
cmp eax, dword [ebp - 0x9c]
jg 0x10021e97
mov dword [ebp - 0x714], 1
jmp 0x10021e9e
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x714], eax
je 0x10021eb8
mov dword [ebp - 0x844], 1
jmp 0x10021ebf
and dword [ebp - 0x844], 0
mov esi, dword [ebp - 0xdc]
imul esi, dword [ebp - 0xd4]
push 0
lea ecx, [ebp - 0x3d0]
call fcn.1000f696
cmp esi, dword [eax]
jg 0x10021ee9
mov dword [ebp - 0x6f0], 1
jmp 0x10021ef0
and dword [ebp - 0x6f0], 0
cmp dword [ebp - 0x6f0], 0x4d0043d4
jge 0x10021f08
mov dword [ebp - 0x598], 1
jmp 0x10021f0f
and dword [ebp - 0x598], 0
mov dword [ebp - 0x6cc], 0x7828451d
mov eax, dword [ebp - 0x3f8]
add eax, dword [ebp - 0x598]
imul eax, eax, 0xffffffff
mov ecx, dword [ebp - 0x6cc]
add ecx, eax
jne 0x10021f44
cmp dword [ebp - 0x9c], 0
jne 0x10021f44
and dword [ebp - 0x3e8], 0
jmp 0x10021f4e
mov dword [ebp - 0x3e8], 1
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x6e0], eax
mov eax, dword [ebp - 0x6e0]
cmp eax, dword [ebp - 0x9c]
jl 0x10021f74
mov dword [ebp - 0x3f0], 1
jmp 0x10021f7b
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x3f0]
sub eax, 0x132f
cmp eax, 0xf55f5dd
jl 0x10021f99
mov dword [ebp - 0x5a0], 1
jmp 0x10021fa0
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0x79c], eax
jmp 0x10021d95
jmp 0x10021d32
mov esi, dword [ebp - 0x3f8]
push 0
lea ecx, [ebp - 0x3d0]
call fcn.1000f696
mov dword [eax], esi
jmp 0x10022019
mov dword [ebp - 0xdc], 0
jmp 0x10021fe6
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jl 0x10022019
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x3d0]
call fcn.1000f696
mov esi, eax
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x3d0]
call fcn.1000f696
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x10021fd9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3d0]
call fcn.1000f691
jmp 0x10021c14
cmp dword [ebp + 0x10], 0
jbe 0x1002204f
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002204f
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.1001a9f8
pop ecx
pop ecx
jmp 0x100280fd
mov dword [ebp - 0x2dc], 0x69fdf99f
mov dword [ebp - 0x2dc], 0
jmp 0x10022072
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 4
jne 0x10022132
push 3
lea ecx, [ebp - 0xa30]
call fcn.1000f62f
mov dword [ebp - 4], 1
mov dword [ebp - 0x678], 0xffffffff
mov dword [ebp - 0x7a0], 0xbeb7161a
mov dword [ebp - 0x20c], 0
jmp 0x100220c0
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 3
jge 0x100220df
push dword [ebp - 0x20c]
lea ecx, [ebp - 0xa30]
call fcn.1000f696
and dword [eax], 0
jmp 0x100220b3
mov byte [ebp - 0xbb], 0
movzx eax, byte [ebp - 0xbb]
test eax, eax
je 0x100220fd
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push 2
lea ecx, [ebp - 0xa30]
call fcn.1000f696
mov eax, dword [eax]
mov dword [ebp - 0x678], eax
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x7a0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa30]
call fcn.1000f691
jmp 0x10022065
mov dword [ebp - 0x20], 0xc418
push 1
lea ecx, [ebp - 0x874]
call fcn.1000f62f
mov dword [ebp - 4], 2
push 1
lea ecx, [ebp - 0xa90]
call fcn.1000f62f
mov byte [ebp - 4], 3
mov dword [ebp - 0x428], 0x6a25a955
mov dword [ebp - 0x60], 0
jmp 0x10022178
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x10022194
push dword [ebp - 0x60]
lea ecx, [ebp - 0x874]
call fcn.1000f696
mov dword [eax], 0xebd0
jmp 0x10022171
mov dword [ebp - 0x60], 0
jmp 0x100221a4
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x100221c0
push dword [ebp - 0x60]
lea ecx, [ebp - 0xa90]
call fcn.1000f696
mov dword [eax], 0xe0cd9796
jmp 0x1002219d
cmp dword [ebp - 0x20], 0
je 0x100221d8
cmp dword [ebp - 0x20], 0
je 0x100221d8
mov dword [ebp - 0x410], 1
jmp 0x100221df
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jl 0x100221f6
cmp dword [ebp - 0x20], 0
jne 0x100221f6
and dword [ebp - 0x400], 0
jmp 0x10022200
mov dword [ebp - 0x400], 1
cmp dword [ebp - 0x400], 0x1fdb
jne 0x10022218
mov dword [ebp - 0x5a8], 1
jmp 0x1002221f
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x5a8]
neg eax
cmp eax, dword [ebp - 0x20]
je 0x10022238
mov dword [ebp - 0x408], 1
jmp 0x1002223f
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x408]
sub eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
je 0x10022262
mov eax, 0x88b
test eax, eax
je 0x10022262
mov dword [ebp - 0x6ec], 1
jmp 0x10022269
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x6ec]
mov ecx, 0x61c0f806
sub ecx, dword [ebp - 0x410]
cmp ecx, eax
je 0x1002229c
push 0
lea ecx, [ebp - 0x874]
call fcn.1000f696
cmp dword [eax], 0
jne 0x1002229c
and dword [ebp - 0x5b0], 0
jmp 0x100222a6
mov dword [ebp - 0x5b0], 1
push 0
lea ecx, [ebp - 0x874]
call fcn.1000f696
mov ecx, dword [ebp - 0x5b0]
cmp ecx, dword [eax]
jle 0x100222c9
mov dword [ebp - 0x418], 1
jmp 0x100222d0
and dword [ebp - 0x418], 0
push 0
lea ecx, [ebp - 0x874]
call fcn.1000f696
mov ecx, dword [ebp - 0x418]
cmp ecx, dword [eax]
jle 0x100222f6
cmp dword [ebp - 0x20], 0
jne 0x100222f6
and dword [ebp - 0x680], 0
jmp 0x10022300
mov dword [ebp - 0x680], 1
push 0
lea ecx, [ebp - 0xa90]
call fcn.1000f696
mov ecx, dword [ebp - 0x680]
mov dword [eax], ecx
mov dword [ebp - 0x20], 0
jmp 0x10022325
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x30
je 0x100225c2
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x188], 0x18
jmp 0x10022352
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0x17
jg 0x100225bd
push 2
lea ecx, [ebp - 0x864]
call fcn.1000f62f
mov byte [ebp - 4], 4
mov dword [ebp - 0xc10], 0x8d34108f
mov dword [ebp - 0xaec], 1
mov dword [ebp - 0xbc4], 0xab83de37
mov dword [ebp - 0x31c], 0
jmp 0x100223a7
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 2
jge 0x100223c9
push dword [ebp - 0x31c]
lea ecx, [ebp - 0x864]
call fcn.1000f696
mov dword [eax], 0x4b3f4b14
jmp 0x1002239a
push 0
lea ecx, [ebp - 0x864]
call fcn.1000f696
and dword [eax], 0
jmp 0x100223ff
push 0
lea ecx, [ebp - 0x864]
call fcn.1000f696
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x420]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x864]
call fcn.1000f696
cmp dword [eax], 0xfffffff3
je 0x10022585
push 4
lea ecx, [ebp - 0x778]
call fcn.1000f62f
mov byte [ebp - 4], 5
mov dword [ebp - 0x88], 0
jmp 0x1002243f
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jge 0x10022461
push dword [ebp - 0x88]
lea ecx, [ebp - 0x778]
call fcn.1000f696
mov dword [eax], 0xc005d9c7
jmp 0x10022432
mov dword [ebp - 0x88], 0
jmp 0x1002247a
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x10022496
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xaf4], 0x10b49f2b
jmp 0x1002246d
push 1
lea ecx, [ebp - 0x778]
call fcn.1000f696
and dword [eax], 0
jmp 0x100224cc
push 1
lea ecx, [ebp - 0x778]
call fcn.1000f696
mov dword [ebp - 0x5b8], eax
mov eax, dword [ebp - 0x5b8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5b8]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x778]
call fcn.1000f696
cmp dword [eax], 0
jg 0x10022557
mov dword [ebp - 0x184], 0x55f1bb13
mov dword [ebp - 0x184], 0
jmp 0x10022501
mov eax, dword [ebp - 0x184]
dec eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0
jl 0x10022545
mov dword [ebp - 0x214], 0xf0a64418
mov dword [ebp - 0x214], 0
jmp 0x1002252d
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jg 0x10022543
cmp dword [ebp - 0x184], 0
je 0x10022541
jmp 0x10022543
jmp 0x10022520
jmp 0x100224f4
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
jmp 0x100224a8
cmp dword [ebp - 0x188], 0
je 0x10022571
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x778]
call fcn.1000f691
jmp 0x10022585
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x778]
call fcn.1000f691
jmp 0x100223db
mov byte [ebp - 0x137], 0
movzx eax, byte [ebp - 0x137]
test eax, eax
je 0x100225a9
push 0x845
push 0x5e3
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x864]
call fcn.1000f691
jmp 0x10022345
jmp 0x1002231e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa90]
call fcn.1000f691
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x874]
call fcn.1000f691
cmp dword [ebp + 0x10], 0
jne 0x10025d77
push 3
lea ecx, [ebp - 0x724]
call fcn.1000f62f
mov dword [ebp - 4], 6
mov dword [ebp - 0x7b0], 0x61a6520
mov dword [ebp - 0x448], 0xdd5d0881
mov dword [ebp - 0x68], 0
jmp 0x10022622
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1002263e
push dword [ebp - 0x68]
lea ecx, [ebp - 0x724]
call fcn.1000f696
mov dword [eax], 0x9841b3c6
jmp 0x1002261b
mov dword [ebp - 0x68], 0
jmp 0x1002264e
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x10022661
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x30], 0x1cecb457
jmp 0x10022647
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x30], 0
jmp 0x10022686
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x30], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 2
jg 0x10022886
mov dword [ebp - 0x7a8], 0xffffffff
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x80c], 0
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x100226d7
push 0x610
push 0x201c
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x30]
lea ecx, [ebp - 0x724]
call fcn.1000f696
cmp dword [eax], 0
jne 0x10022714
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x30]
lea ecx, [ebp - 0x724]
call fcn.1000f696
cmp dword [eax], 0
jne 0x10022714
and dword [ebp - 0x438], 0
jmp 0x1002271e
mov dword [ebp - 0x438], 1
mov eax, dword [ebp - 0x7a8]
mov dword [ebp - 0xc30], eax
mov dword [ebp - 0x7b0], 1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
jne 0x10022757
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
jne 0x10022757
and dword [ebp - 0x6e8], 0
jmp 0x10022761
mov dword [ebp - 0x6e8], 1
push 0
lea ecx, [ebp - 0x724]
call fcn.1000f696
mov esi, dword [ebp - 0x6e8]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x724]
call fcn.1000f696
cmp esi, dword [eax]
jge 0x1002279e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
jne 0x1002279e
and dword [ebp - 0x430], 0
jmp 0x100227a8
mov dword [ebp - 0x430], 1
cmp dword [ebp - 0x430], 0xffff
jae 0x100227c0
mov dword [ebp - 0x5c0], 1
jmp 0x100227c7
and dword [ebp - 0x5c0], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x30]
lea ecx, [ebp - 0x724]
call fcn.1000f696
mov esi, dword [ebp - 0x5c0]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x724]
call fcn.1000f696
add esi, dword [eax]
cmp dword [ebp - 0x438], esi
je 0x10022807
mov dword [ebp - 0x688], 1
jmp 0x1002280e
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x688]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0xc0021fbb
jb 0x10022832
mov dword [ebp - 0x5c8], 1
jmp 0x10022839
and dword [ebp - 0x5c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
imul eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x448], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x448]
cmp ecx, dword [ebp + eax - 0x30]
je 0x1002286e
mov dword [ebp - 0x6f4], 1
jmp 0x10022875
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x80c], eax
jmp 0x10022671
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x724]
call fcn.1000f691
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.100125dc
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0xb4], 0xffffffff
mov dword [ebp - 0x3b8], 0xa1c17c77
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xbd4], eax
cmp dword [ebp - 0xb4], 0xc71b
je 0x100228ea
mov dword [ebp - 0x450], 1
jmp 0x100228f1
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x450], eax
jg 0x1002290b
mov dword [ebp - 0x814], 1
jmp 0x10022912
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
cmp eax, dword [ebp - 0xb4]
jge 0x10022944
mov dword [ebp - 0x5d0], 1
jmp 0x1002294b
and dword [ebp - 0x5d0], 0
mov eax, 0x83111738
sub eax, dword [ebp - 0x5d0]
mov ecx, dword [ebp - 0xb4]
imul ecx, eax
cmp ecx, 0xc0e3
jne 0x10022999
cmp dword [ebp - 0x3b8], 0
je 0x10022999
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x10022997
push 0x2538
push 0x1cef
push 0xa27
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x100229b7
mov byte [ebp - 0xbf], 0
movzx eax, byte [ebp - 0xbf]
test eax, eax
je 0x100229b7
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0xb30], 1
mov dword [ebp - 0x84], 0
jmp 0x100229e1
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x100229fd
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xe4], 0xffffffff
jmp 0x100229d4
mov dword [ebp - 0x84], 0
jmp 0x10022a16
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x10022a32
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xb10], 0
jmp 0x10022a09
mov dword [ebp - 0x2c], 0
jmp 0x10022a42
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jg 0x10022a7f
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0xe4]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp + ecx*4 - 0xe4], eax
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x10022a7d
push 0
push 0x2468
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x10022a3b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
mov dword [ebp - 0xb3c], eax
cmp dword [ebp - 0x2c], 0
jne 0x10022ac6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
mov dword [ebp - 0xbdc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp + eax - 0xe4]
jne 0x10022ac6
and dword [ebp - 0x458], 0
jmp 0x10022ad0
mov dword [ebp - 0x458], 1
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x458], eax
jg 0x10022ae7
mov dword [ebp - 0x690], 1
jmp 0x10022aee
and dword [ebp - 0x690], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
sub eax, dword [ebp - 0x690]
cmp eax, 0xfffffff7
jge 0x10022b12
mov dword [ebp - 0x81c], 1
jmp 0x10022b19
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xb48], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb10], eax
mov dword [ebp - 0xc44], 0xfffffffd
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x10022b70
push 0x2652
push 0
push 0x1b61
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x10022b92
push 0x452
push 0x21a5
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [0x10d30b54], 0
jne 0x100259f5
mov dword [ebp - 0x824], 0x4977
lea eax, [ebp - 0x824]
push eax
call fcn.1001a8c4
pop ecx
mov dword [ebp - 0x414], eax
push 4
lea ecx, [ebp - 0x758]
call fcn.1000f62f
mov dword [ebp - 4], 7
mov dword [ebp - 0x2e4], 0
jmp 0x10022be9
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 4
jge 0x10022c0b
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0x758]
call fcn.1000f696
mov dword [eax], 6
jmp 0x10022bdc
push 2
lea ecx, [ebp - 0x758]
call fcn.1000f696
and dword [eax], 0
jmp 0x10022c41
push 2
lea ecx, [ebp - 0x758]
call fcn.1000f696
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x460]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x460]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x758]
call fcn.1000f696
cmp dword [eax], 0x19
jl 0x10022c7d
mov byte [ebp - 0xc3], 0
movzx eax, byte [ebp - 0xc3]
test eax, eax
je 0x10022c7b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x10022c1d
mov dword [ebp - 0x5d8], 0x75f5
mov dword [ebp - 0x834], 0x10007e88
cmp dword [ebp - 0x5d8], 0x78a5
jle 0x10022dab
and dword [ebp - 0x2ec], 0
jmp 0x10022cb7
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0x6846
jge 0x10022dab
and dword [ebp - 0x21c], 0
jmp 0x10022cdd
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0x1caa
jge 0x10022da6
and dword [ebp - 0x33c], 0
jmp 0x10022d03
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0x61d0
jge 0x10022da1
and dword [ebp - 0x224], 0
jmp 0x10022d29
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x999
jge 0x10022d9c
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x33c]
shl eax, cl
mov ecx, dword [ebp - 0x224]
sar eax, cl
or eax, dword [ebp - 0x2ec]
cdq
mov dword [ebp - 0x7bc], eax
mov dword [ebp - 0x7b8], edx
push dword [ebp - 0x7b8]
push dword [ebp - 0x7bc]
lea ecx, [ebp - 0xd70]
call fcn.1000ab1b
pop ecx
pop ecx
mov dword [ebp - 0x82c], eax
mov ecx, dword [ebp - 0x82c]
call fcn.1000f3b7
push eax
call fcn.1005d2b3
pop ecx
lea ecx, [ebp - 0xd70]
call fcn.1000f3ad
jmp 0x10022d1c
jmp 0x10022cf6
jmp 0x10022cd0
jmp 0x10022caa
push 2
lea ecx, [ebp - 0x758]
call fcn.1000f696
mov esi, eax
push 3
lea ecx, [ebp - 0x758]
call fcn.1000f696
mov eax, dword [eax]
mov dword [esi], eax
mov byte [ebp - 4], 8
cmp dword [ebp - 0x5d8], 0x742f
jge 0x10022de7
push dword [ebp - 0x834]
call fcn.1005d2b3
pop ecx
jmp 0x10022e03
mov dword [ebp - 4], 7
jmp 0x10022e13
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x758]
call fcn.1000f691
mov dword [ebp - 0x324], 0x9fdf99ff
mov dword [ebp - 0x22c], 0
jmp 0x10022e45
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 1
jge 0x10022e61
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xb54], 0xcd795364
jmp 0x10022e38
mov dword [ebp - 0x324], 2
jmp 0x10022e7a
mov eax, dword [ebp - 0x324]
dec eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0xfffffffc
jg 0x10022ed9
mov dword [ebp - 0x234], 0xffffffff
mov dword [ebp - 0x234], 0
jmp 0x10022ea6
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jg 0x10022ed7
mov byte [ebp - 0x13c], 0
movzx eax, byte [ebp - 0x13c]
test eax, eax
je 0x10022ed5
push 0
push 0x1789
push 0
push 0x1483
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
jmp 0x10022e99
jmp 0x10022e6d
mov byte [ebp - 0x1f4], 7
mov byte [ebp - 0x1f3], 0x64
mov byte [ebp - 0x1f2], 5
mov byte [ebp - 0x1f1], 0x1b
mov byte [ebp - 0x1f0], 4
mov byte [ebp - 0x1ef], 0x17
mov byte [ebp - 0x1ee], 9
mov byte [ebp - 0x1ed], 0xb
mov byte [ebp - 0x1ec], 0
mov byte [ebp - 0x1eb], 0x29
mov byte [ebp - 0x1ea], 3
mov byte [ebp - 0x1e9], 0x11
mov byte [ebp - 0x1e8], 0xa
mov byte [ebp - 0x1e7], 0x13
mov byte [ebp - 0x1e6], 6
mov byte [ebp - 0x1e5], 0x36
mov byte [ebp - 0x1e4], 1
mov byte [ebp - 0x1e3], 0x40
mov byte [ebp - 0x1e2], 0xc
mov byte [ebp - 0x1e1], 0x24
mov byte [ebp - 0x1e0], 1
mov byte [ebp - 0x1df], 0x32
mov byte [ebp - 0x1de], 0xb
mov byte [ebp - 0x1dd], 0x1d
mov byte [ebp - 0x1dc], 2
mov byte [ebp - 0x1db], 0xc
mov byte [ebp - 0x1da], 8
mov byte [ebp - 0x1d9], 0x1b
mov dword [ebp - 0x38], 0x8a61928c
mov dword [ebp - 0x468], 0x3f67
mov dword [ebp - 0x83c], 0x10007f20
cmp dword [ebp - 0x468], 0x41b5
jle 0x100230ad
and dword [ebp - 0x358], 0
jmp 0x10022fde
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0x2b51
jge 0x100230a5
and dword [ebp - 0x244], 0
jmp 0x10023004
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0x6428
jge 0x100230a0
and dword [ebp - 0x2f4], 0
jmp 0x1002302a
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0x1a9e
jge 0x1002309b
and dword [ebp - 0x23c], 0
jmp 0x1002304c
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0x6dfb
jge 0x10023099
mov eax, dword [ebp - 0x2f4]
mov ecx, dword [ebp - 0x23c]
shl eax, cl
mov ecx, dword [ebp - 0x358]
xor ecx, dword [ebp - 0x244]
xor eax, ecx
cdq
mov dword [ebp - 0x7c8], eax
mov dword [ebp - 0x7c4], edx
push dword [ebp - 0x7c4]
push dword [ebp - 0x7c8]
mov ecx, 0x1061cd78
call fcn.1000f3d7
jmp 0x1002303f
jmp 0x1002301d
jmp 0x10022ff7
jmp 0x10022fd1
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0xaac], 0xfffffff6
mov dword [ebp - 0xaa8], 0xfffffff6
mov dword [ebp - 0xaa4], 0xfffffff6
mov dword [ebp - 0xaa0], 0xfffffff6
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x468], 0x3d64
jge 0x100230f8
mov edx, dword [ebp - 0x83c]
mov ecx, 0x1061cd78
call fcn.100119e8
jmp 0x10023114
or dword [ebp - 4], 0xffffffff
jmp 0x1002311e
mov dword [ebp - 0x84c], 3
mov dword [ebp - 0x38], 0xfffffff5
jmp 0x10023138
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x10
jl 0x100231b7
mov dword [ebp - 0x18c], 0x822b1658
mov dword [ebp - 0x2fc], 0
jmp 0x10023161
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 2
jge 0x1002317d
mov eax, dword [ebp - 0x2fc]
mov dword [ebp + eax*4 - 0xb38], 0x9ac70c30
jmp 0x10023154
mov dword [ebp - 0x18c], 0
jmp 0x10023196
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
jge 0x100231b2
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0xb38], 0x49f845d8
jmp 0x10023189
jmp 0x10023131
mov dword [ebp - 0x38], 0
jmp 0x100231c7
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 5
jne 0x10023301
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x24c], 0
jmp 0x100231f4
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 2
jge 0x10023210
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x7d4], 0xfc657863
jmp 0x100231e7
mov eax, dword [ebp - 0x1a4]
dec eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x38], 0
jne 0x100232c7
cmp dword [ebp - 0x38], 0
je 0x10023250
cmp dword [ebp - 0x1a4], 0
je 0x1002323d
cmp dword [ebp - 0x1a4], 0
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x10023250
mov dword [ebp - 0x6fc], 1
jmp 0x10023257
and dword [ebp - 0x6fc], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x7d4]
add ecx, dword [ebp - 0x6fc]
add ecx, dword [ebp + eax - 0x7d4]
imul eax, dword [ebp - 0x38], 0xffffffff
cmp eax, ecx
je 0x1002328b
mov dword [ebp - 0x798], 1
jmp 0x10023292
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0xbe4], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xaac], 0
jne 0x100232c7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7d4], 0
jne 0x100232c7
and dword [ebp - 0x470], 0
jmp 0x100232d1
mov dword [ebp - 0x470], 1
cmp dword [ebp - 0x470], 0x6711
jg 0x100232e9
mov dword [ebp - 0x5e0], 1
jmp 0x100232f0
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x5e0]
mov dword [ebp - 0x84c], eax
jmp 0x100231c0
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1f4]
and eax, 0xd
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1f4]
or ecx, 0xd
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1f4]
mov byte [ebp + eax - 0x944], cl
mov dword [ebp - 0x28], 2
and dword [ebp - 0x274], 0
jmp 0x10023352
mov eax, dword [ebp - 0x28]
inc eax
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x1c
jae 0x10023bb7
mov dword [ebp - 0x70], 0xfffffff9
mov dword [ebp - 0x70], 5
jmp 0x10023373
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x17
jg 0x1002369f
mov dword [ebp - 0x254], 0x67a876e6
push 4
lea ecx, [ebp - 0x734]
call fcn.1000f62f
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x9f8], 0x3312
mov dword [ebp - 0x9f4], 0x3312
mov dword [ebp - 0x9f0], 0x3312
mov dword [ebp - 0x9ec], 0x3312
lea ecx, [ebp - 0x399]
call fcn.1000f6a5
push eax
lea eax, [ebp - 0x9e8]
push eax
lea eax, [ebp - 0x9f8]
push eax
lea ecx, [ebp - 0xc7c]
call fcn.1000f6a8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb80]
call fcn.1000f66b
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x32c], 0
jmp 0x10023415
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 4
jge 0x10023437
push dword [ebp - 0x32c]
lea ecx, [ebp - 0x734]
call fcn.1000f696
mov dword [eax], 0xd94543be
jmp 0x10023408
mov dword [ebp - 0x254], 0
jmp 0x10023450
mov eax, dword [ebp - 0x254]
dec eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xfffffffa
je 0x1002366a
mov dword [ebp - 0x44], 0xfffffffe
mov dword [ebp - 0x498], 1
mov dword [ebp - 0x44], 0
jmp 0x1002347e
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jg 0x10023665
mov dword [ebp - 0x94c], 9
push dword [ebp - 0x44]
lea ecx, [ebp - 0x734]
call fcn.1000f696
cmp dword [eax], 0xffffffff
jne 0x100235a6
cmp dword [ebp - 0x70], 1
jge 0x100234bb
mov dword [ebp - 0x478], 1
jmp 0x100234c2
and dword [ebp - 0x478], 0
push 3
lea ecx, [ebp - 0x734]
call fcn.1000f696
mov ecx, dword [ebp - 0x478]
cmp ecx, dword [eax]
jne 0x100234e5
mov dword [ebp - 0x698], 1
jmp 0x100234ec
and dword [ebp - 0x698], 0
cmp dword [ebp - 0x698], 0xffffffff
jge 0x10023501
mov dword [ebp - 0x480], 1
jmp 0x10023508
and dword [ebp - 0x480], 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x734]
call fcn.1000f696
mov ecx, dword [ebp - 0x480]
cmp ecx, dword [eax]
je 0x1002352c
mov dword [ebp - 0x5e8], 1
jmp 0x10023533
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x5e8], eax
jle 0x1002354a
mov dword [ebp - 0x488], 1
jmp 0x10023551
and dword [ebp - 0x488], 0
cmp dword [ebp - 0x488], 0xc1dab973
jb 0x10023569
mov dword [ebp - 0x718], 1
jmp 0x10023570
and dword [ebp - 0x718], 0
imul esi, dword [ebp - 0x718], 3
push dword [ebp - 0x44]
lea ecx, [ebp - 0x734]
call fcn.1000f696
mov eax, dword [eax]
lea esi, [esi + eax + 3]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x734]
call fcn.1000f696
cmp esi, dword [eax]
jl 0x100235a6
and dword [ebp - 0x490], 0
jmp 0x100235b0
mov dword [ebp - 0x490], 1
mov eax, dword [ebp - 0x490]
add eax, 0x22b6
cmp eax, dword [ebp - 0x70]
jne 0x100235cc
mov dword [ebp - 0x5f0], 1
jmp 0x100235d3
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0
je 0x100235fd
mov eax, 0xde9e
test eax, eax
je 0x100235fd
mov dword [ebp - 0x6a0], 1
jmp 0x10023604
and dword [ebp - 0x6a0], 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x734]
call fcn.1000f696
mov ecx, dword [ebp - 0x6a0]
cmp ecx, dword [eax]
jge 0x10023628
mov dword [ebp - 0x854], 1
jmp 0x1002362f
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0x44], 0x95c380a3
jne 0x1002364d
mov dword [ebp - 0x4a0], 1
jmp 0x10023654
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x94c], eax
jmp 0x10023477
jmp 0x10023443
mov esi, dword [ebp - 0x70]
push 1
lea ecx, [ebp - 0xb80]
call fcn.1000f696
mov dword [eax], esi
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xb80]
call fcn.1000f691
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x734]
call fcn.1000f691
jmp 0x1002336c
mov dword [ebp - 0x4c8], 0x5b1c
mov dword [ebp - 0x7a4], 0x10007f98
cmp dword [ebp - 0x4c8], 0x5e80
jle 0x1002379b
and dword [ebp - 0x304], 0
jmp 0x100236d9
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0x6080
jge 0x1002379b
and dword [ebp - 0x25c], 0
jmp 0x100236ff
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x1c4f
jge 0x10023796
and dword [ebp - 0x2b4], 0
jmp 0x10023725
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0x1e5b
jge 0x10023791
mov eax, dword [ebp - 0x304]
cdq
idiv dword [ebp - 0x25c]
xor edx, dword [ebp - 0x2b4]
mov eax, edx
cdq
mov dword [ebp - 0x7e0], eax
mov dword [ebp - 0x7dc], edx
push dword [ebp - 0x7dc]
push dword [ebp - 0x7e0]
lea ecx, [ebp - 0xd40]
call fcn.1000ab1b
pop ecx
pop ecx
mov dword [ebp - 0x924], eax
mov ecx, dword [ebp - 0x924]
call fcn.1000f3b7
push eax
call fcn.1005d2b3
pop ecx
lea ecx, [ebp - 0xd40]
call fcn.1000f3ad
jmp 0x10023718
jmp 0x100236f2
jmp 0x100236cc
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1f4]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x28], eax
jne 0x10023a36
mov dword [ebp - 0x2b8], 0x9fdf99ff
mov dword [ebp - 0x264], 0
jmp 0x100237d9
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 1
jge 0x100237f5
mov eax, dword [ebp - 0x264]
mov dword [ebp + eax*4 - 0xc20], 0xcd795364
jmp 0x100237cc
mov dword [ebp - 0x2b8], 2
jmp 0x1002380e
mov eax, dword [ebp - 0x2b8]
dec eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0xfffffffc
jg 0x1002386d
mov dword [ebp - 0x26c], 0xffffffff
mov dword [ebp - 0x26c], 0
jmp 0x1002383a
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
jg 0x1002386b
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x10023869
push 0
push 0x1789
push 0
push 0x1483
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
jmp 0x1002382d
jmp 0x10023801
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x1f4]
inc eax
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x40], 0xe5f36f6d
mov dword [ebp - 0x600], 1
mov dword [ebp - 0x928], 0x510afbd1
mov dword [ebp - 0x8c8], 0x9ea7eb8e
mov dword [ebp - 0xb64], 1
mov dword [ebp - 0x2c0], 0
jmp 0x100238c7
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 1
jge 0x100238e3
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0x608], 0xaced45b0
jmp 0x100238ba
cmp dword [ebp - 0x40], 0x506e
jne 0x100238f8
mov dword [ebp - 0x4b0], 1
jmp 0x100238ff
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x40], 1
jl 0x10023911
mov dword [ebp - 0x5f8], 1
jmp 0x10023918
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x5f8], eax
jl 0x1002392f
mov dword [ebp - 0x4a8], 1
jmp 0x10023936
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x4a8], eax
je 0x10023959
cmp dword [ebp - 0x40], 0
je 0x10023959
cmp dword [ebp - 0x40], 0
je 0x10023959
mov dword [ebp - 0x3c0], 1
jmp 0x10023960
and dword [ebp - 0x3c0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp + eax - 0x608], ecx
mov eax, dword [ebp - 0x3c0]
sub eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x40]
jl 0x1002398d
mov dword [ebp - 0x6f8], 1
jmp 0x10023994
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x6f8]
jl 0x100239ab
mov dword [ebp - 0x4b8], 1
jmp 0x100239b2
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x600], eax
mov eax, dword [ebp - 0x600]
cmp eax, dword [ebp - 0x4b8]
jne 0x100239d8
mov dword [ebp - 0x6a8], 1
jmp 0x100239df
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x6a8], eax
jge 0x100239f6
mov dword [ebp - 0x4c0], 1
jmp 0x100239fd
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x928], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x608]
mov dword [ebp - 0x8c8], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x1f4]
mov ecx, dword [ebp - 0x28]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x28], eax
jmp 0x1002334a
mov dword [ebp - 4], 0xe
cmp dword [ebp - 0x4c8], 0x5774
jge 0x10023a55
push dword [ebp - 0x7a4]
call fcn.1005d2b3
pop ecx
jmp 0x10023a71
or dword [ebp - 4], 0xffffffff
jmp 0x10023a7b
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x274]
movzx eax, byte [ebp + eax - 0x1f6]
movsx eax, byte [ebp + eax - 0x944]
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0x1f3]
and ecx, eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x274]
movzx eax, byte [ebp + eax - 0x1f6]
movsx eax, byte [ebp + eax - 0x944]
mov edx, dword [ebp - 0x28]
movzx edx, byte [ebp + edx - 0x1f3]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x1f4]
mov byte [ebp + eax - 0x944], dl
push 2
lea ecx, [ebp - 0xa48]
call fcn.1000f62f
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x48], 0
jmp 0x10023aff
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x10023b1b
push dword [ebp - 0x48]
lea ecx, [ebp - 0xa48]
call fcn.1000f696
mov dword [eax], 0x9b55bb2c
jmp 0x10023af8
mov dword [ebp - 0x48], 0
jmp 0x10023b2b
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x10023b41
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x9a8], 0xfffffffc
jmp 0x10023b24
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x9a8], 0
jmp 0x10023b6f
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x9a8]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x9a8], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x9a8], 2
jge 0x10023b9c
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x9a8]
lea ecx, [ebp - 0xa48]
call fcn.1000f696
and dword [eax], 0
jmp 0x10023b54
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa48]
call fcn.1000f691
and dword [ebp - 0x274], 0
jmp 0x1002334a
push 3
lea ecx, [ebp - 0x884]
call fcn.1000f62f
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x4c], 0
jmp 0x10023bdb
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x10023bf7
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x884]
call fcn.1000f696
mov dword [eax], 0xc204
jmp 0x10023bd4
mov dword [ebp - 0x4c], 0
jmp 0x10023c07
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x10023c1d
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x360], 3
jmp 0x10023c00
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x360], 2
jmp 0x10023c4b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x360]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x360], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x360], 0
jl 0x10023da0
push 1
lea ecx, [ebp - 0xa78]
call fcn.1000f62f
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x27c], 2
mov dword [ebp - 0x2c8], 0
jmp 0x10023c93
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 1
jge 0x10023cb5
push dword [ebp - 0x2c8]
lea ecx, [ebp - 0xa78]
call fcn.1000f696
mov dword [eax], 0xe41b66ba
jmp 0x10023c86
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x360]
lea ecx, [ebp - 0x884]
call fcn.1000f696
mov esi, eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x360]
lea ecx, [ebp - 0x884]
call fcn.1000f696
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x10023cf9
mov dword [ebp - 0x74c], 1
jmp 0x10023d00
and dword [ebp - 0x74c], 0
mov esi, dword [ebp - 0x74c]
add esi, 0x576c
push 0
lea ecx, [ebp - 0xa78]
call fcn.1000f696
mov dword [eax], esi
mov dword [ebp - 0x27c], 0
jmp 0x10023d34
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0
jg 0x10023d8c
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 0x2d0], 0
jmp 0x10023d60
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 2
jg 0x10023d8a
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x360]
lea ecx, [ebp - 0x884]
call fcn.1000f696
cmp dword [eax], 0
je 0x10023d88
jmp 0x10023d8a
jmp 0x10023d53
jmp 0x10023d27
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xa78]
call fcn.1000f691
jmp 0x10023c30
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x360], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x884]
call fcn.1000f691
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x944], 0
mov dword [ebp - 0xac], 0xe0a8eac8
mov dword [ebp - 0x4d0], 0x6670
mov dword [ebp - 0x7ac], 0x10007fec
cmp dword [ebp - 0x4d0], 0x695b
jle 0x10023f06
and dword [ebp - 0x2e0], 0
jmp 0x10023e12
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0x5e44
jge 0x10023f06
and dword [ebp - 0x284], 0
jmp 0x10023e38
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0x1a26
jge 0x10023f01
and dword [ebp - 0x2d8], 0
jmp 0x10023e5e
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0xb53
jge 0x10023efc
and dword [ebp - 0x28c], 0
jmp 0x10023e84
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0x2644
jge 0x10023ef7
mov eax, dword [ebp - 0x284]
cdq
idiv dword [ebp - 0x2d8]
imul edx, dword [ebp - 0x28c]
or edx, dword [ebp - 0x2e0]
mov eax, edx
cdq
mov dword [ebp - 0x7ec], eax
mov dword [ebp - 0x7e8], edx
push dword [ebp - 0x7e8]
push dword [ebp - 0x7ec]
lea ecx, [ebp - 0xd10]
call fcn.1000ab1b
pop ecx
pop ecx
mov dword [ebp - 0x930], eax
mov ecx, dword [ebp - 0x930]
call fcn.1000f3b7
push eax
call fcn.1005d2b3
pop ecx
lea ecx, [ebp - 0xd10]
call fcn.1000f3ad
jmp 0x10023e77
jmp 0x10023e51
jmp 0x10023e2b
jmp 0x10023e05
mov dword [ebp - 0xbec], 9
mov dword [ebp - 4], 0x13
cmp dword [ebp - 0x4d0], 0x62da
jge 0x10023f2f
push dword [ebp - 0x7ac]
call fcn.1005d2b3
pop ecx
jmp 0x10023f4b
or dword [ebp - 4], 0xffffffff
jmp 0x10023f55
mov dword [ebp - 0xb6c], 0xc90d2972
mov dword [ebp - 0xc38], 0xe864896e
mov dword [ebp - 0xac], 0
jmp 0x10023f82
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x1b
jg 0x10023faf
mov byte [ebp - 0x13b], 0
movzx eax, byte [ebp - 0x13b]
test eax, eax
je 0x10023fad
push 0x1ac0
push 0x18a1
call dword [sym.imp.GDI32.dll_SetMapMode]
jmp 0x10023f75
mov dword [ebp - 0xac], 0x1b
jmp 0x10023fc8
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xfffffffb
je 0x10024077
mov dword [ebp - 0xb74], 7
mov dword [ebp - 0xbf4], 0
mov dword [ebp - 0xb84], 0xfffffffb
mov dword [ebp - 0xab4], 0x61eefb6f
push 4
lea ecx, [ebp - 0xb90]
call fcn.1000f62f
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x610], 0
mov dword [ebp - 0x294], 0
jmp 0x10024034
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 4
jge 0x10024056
push dword [ebp - 0x294]
lea ecx, [ebp - 0xb90]
call fcn.1000f696
mov dword [eax], 0x263d1880
jmp 0x10024027
mov eax, dword [ebp - 0x610]
dec eax
mov dword [ebp - 0x610], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb90]
call fcn.1000f691
jmp 0x10023fbb
lea eax, [ebp - 0x944]
push eax
lea ecx, [ebp - 0xd28]
call fcn.1000f512
mov dword [ebp - 0x8d4], eax
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x7b4], eax
mov dword [ebp - 4], 0x16
mov edx, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x7b4]
call fcn.100125dc
mov dword [0x10d30b54], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd28]
call fcn.1000f57d
mov dword [ebp - 0x194], 0xfffffffc
mov dword [ebp - 0x4e8], 0xfffffffe
mov dword [ebp - 0x194], 0xfffffff0
jmp 0x100240f4
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0xfffffffc
jle 0x10024339
mov dword [ebp - 0xec], 0xb96ca2cb
mov dword [ebp - 0x4d8], 1
mov dword [ebp - 0xec], 0
jmp 0x1002412e
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xffffffeb
je 0x10024334
mov dword [ebp - 0x1b4], 0x43c4ab27
mov dword [ebp - 0x618], 0xfaab39e2
mov dword [ebp - 0x2e8], 0
jmp 0x10024168
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 1
jge 0x10024184
mov eax, dword [ebp - 0x2e8]
mov dword [ebp + eax*4 - 0x934], 0xffffffff
jmp 0x1002415b
mov dword [ebp - 0x1b4], 0xd
jmp 0x1002419d
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0x1d
je 0x1002432f
mov dword [ebp - 0x8dc], 0x2045
mov dword [ebp - 0xf4], 0xfffffffc
mov dword [ebp - 0x7cc], 0xfffffffd
cmp dword [ebp - 0xec], 0x13b2
jg 0x100241e0
mov dword [ebp - 0x90c], 1
jmp 0x100241e7
and dword [ebp - 0x90c], 0
mov dword [ebp - 0x4d8], 0x6bb2f144
cmp dword [ebp - 0x4d8], 1
jbe 0x10024206
mov dword [ebp - 0x6b0], 1
jmp 0x1002420d
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x6b0], eax
jle 0x10024227
mov dword [ebp - 0x4e0], 1
jmp 0x1002422e
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x618], eax
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jne 0x1002426b
push 9
pop eax
test eax, eax
jne 0x1002426b
and dword [ebp - 0x7c0], 0
jmp 0x10024275
mov dword [ebp - 0x7c0], 1
mov eax, dword [ebp - 0x8dc]
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0x4e8], 0x6095
mov eax, dword [ebp - 0x4e8]
cmp eax, dword [ebp - 0xec]
jle 0x100242a5
mov dword [ebp - 0x700], 1
jmp 0x100242ac
and dword [ebp - 0x700], 0
cmp dword [ebp - 0x700], 0
ja 0x100242c1
mov dword [ebp - 0x4f0], 1
jmp 0x100242c8
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x4f0], eax
jle 0x100242e2
mov dword [ebp - 0x620], 1
jmp 0x100242e9
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x7cc], eax
mov dword [ebp - 0xf4], 0
jmp 0x1002430e
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jge 0x1002432a
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x934], 0xfffffffd
jmp 0x10024301
jmp 0x10024190
jmp 0x10024121
jmp 0x100240e7
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x10024362
push 0x389
push 0
push 0x65e
push 0x1f82
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
and dword [ebp - 0x29c], 0
jmp 0x10024378
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xe
jae 0x10024391
mov eax, dword [ebp - 0x29c]
mov byte [ebp + eax - 0x944], 0
jmp 0x1002436b
mov dword [ebp - 0x2f0], 1
mov dword [ebp - 0xac8], 0xa167c28c
mov dword [ebp - 0x90], 0
jmp 0x100243be
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x100243da
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0xcf8], 1
jmp 0x100243b1
mov dword [ebp - 0x90], 0
jmp 0x100243f3
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 4
jge 0x1002440f
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0xd8c], 0x443eb606
jmp 0x100243e6
mov dword [ebp - 0x2f0], 0
jmp 0x10024428
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 2
jg 0x100245d6
mov dword [ebp - 0xad0], 1
mov dword [ebp - 0xad8], 0x7dcd66a0
mov dword [ebp - 0xae0], 0
mov dword [ebp - 0x4f8], 0x7722
mov dword [ebp - 0x78], 0
jmp 0x1002446d
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x10024483
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x76c], 0xffffffff
jmp 0x10024466
mov dword [ebp - 0x78], 0
jmp 0x10024493
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x100244a9
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xd7c], 0xfffffffa
jmp 0x1002448c
mov byte [ebp - 0x13f], 0
movzx eax, byte [ebp - 0x13f]
test eax, eax
je 0x100244c3
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 0xc2], 0
movzx eax, byte [ebp - 0xc2]
test eax, eax
je 0x100244e1
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_CopySid]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x76c], 0
jmp 0x1002450f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x76c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x76c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x76c], 2
jg 0x100245d1
mov dword [ebp - 0x2f8], 3
mov dword [ebp - 0xae8], 0x182b4746
mov dword [ebp - 0xaf0], 0
mov dword [ebp - 0x2a4], 0
jmp 0x1002455a
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 1
jge 0x10024576
mov eax, dword [ebp - 0x2a4]
mov dword [ebp + eax*4 - 0xaf8], 0xb61b583d
jmp 0x1002454d
mov dword [ebp - 0x2f8], 0
jmp 0x1002458f
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 2
jg 0x100245bf
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x100245bd
push 0
push 0
push 0xdba
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
jmp 0x10024582
mov eax, dword [ebp - 0x4f8]
inc eax
mov dword [ebp - 0x4f8], eax
jmp 0x100244f4
jmp 0x1002441b
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x100245f5
push 0
push 0x1c2c
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
lea ecx, [ebp - 0xa60]
call fcn.1000f62f
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x19c], 0x1c7bf0b9
mov dword [ebp - 0x2ac], 0
jmp 0x1002462c
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 1
jge 0x1002464e
push dword [ebp - 0x2ac]
lea ecx, [ebp - 0xa60]
call fcn.1000f696
mov dword [eax], 0x6847dfa8
jmp 0x1002461f
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x10024672
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x19c], 0
jmp 0x1002468b
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jl 0x100247b3
mov dword [ebp - 0x300], 0x443250e6
mov dword [ebp - 0x300], 0
jmp 0x100246bb
mov eax, dword [ebp - 0x300]
dec eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0
jl 0x10024796
mov dword [ebp - 0x1f8], 0xd2086bd0
mov dword [ebp - 0x1f8], 0
jmp 0x100246eb
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
jg 0x10024791
mov dword [ebp - 0x9bc], 0xfffffff7
mov dword [ebp - 0x9b8], 0xfffffff7
mov dword [ebp - 0x9b4], 0xfffffff7
mov dword [ebp - 0x9b0], 0xfffffff7
lea ecx, [ebp - 0x36d]
call fcn.1000f6a5
push eax
lea eax, [ebp - 0x9ac]
push eax
lea eax, [ebp - 0x9bc]
push eax
lea ecx, [ebp - 0xcd4]
call fcn.1000f6a8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xba0]
call fcn.1000f66b
mov byte [ebp - 4], 0x18
push 2
lea ecx, [ebp - 0xba0]
call fcn.1000f696
mov dword [ebp - 0x6b8], eax
mov eax, dword [ebp - 0x6b8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x6b8]
mov dword [ecx], eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xba0]
call fcn.1000f691
jmp 0x100246de
jmp 0x100246ae
push dword [ebp - 0x19c]
lea ecx, [ebp - 0xa60]
call fcn.1000f696
cmp dword [eax], 0
je 0x100247ae
jmp 0x100247b3
jmp 0x1002467e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa60]
call fcn.1000f691
mov byte [ebp - 0x1d8], 3
mov byte [ebp - 0x1d7], 0x81
mov byte [ebp - 0x1d6], 0xc
mov byte [ebp - 0x1d5], 0x12
mov byte [ebp - 0x1d4], 0xb
mov byte [ebp - 0x1d3], 0
mov byte [ebp - 0x1d2], 5
mov byte [ebp - 0x1d1], 0x16
mov byte [ebp - 0x1d0], 3
mov byte [ebp - 0x1cf], 0xec
mov byte [ebp - 0x1ce], 0x94
mov byte [ebp - 0x1cd], 0x4f
mov byte [ebp - 0x1cc], 0xd
mov byte [ebp - 0x1cb], 0x32
mov byte [ebp - 0x1ca], 6
mov byte [ebp - 0x1c9], 7
mov byte [ebp - 0x1c8], 2
mov byte [ebp - 0x1c7], 0x35
mov byte [ebp - 0x1c6], 0xa
mov byte [ebp - 0x1c5], 0
mov byte [ebp - 0x1c4], 9
mov byte [ebp - 0x1c3], 6
mov byte [ebp - 0x1c2], 1
mov byte [ebp - 0x1c1], 0x11
mov byte [ebp - 0x1c0], 0
mov byte [ebp - 0x1bf], 0x31
mov byte [ebp - 0x1be], 8
mov byte [ebp - 0x1bd], 0x2c
mov byte [ebp - 0x1bc], 7
mov byte [ebp - 0x1bb], 0x1d
mov byte [ebp - 0x1ba], 4
mov byte [ebp - 0x1b9], 6
mov dword [ebp - 0xfc], 0x1928c176
mov dword [ebp - 0x378], 0x177c422d
mov dword [ebp - 0x8ec], 9
push 1
lea ecx, [ebp - 0x958]
call fcn.1000f62f
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x92c], 0xbfbc35cf
mov dword [ebp - 0x8c], 0
jmp 0x100248f7
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x10024913
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xa3c], 0
jmp 0x100248ea
mov dword [ebp - 0x8c], 0
jmp 0x1002492c
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1002494e
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x958]
call fcn.1000f696
mov dword [eax], 1
jmp 0x1002491f
mov dword [ebp - 0xfc], 0xfffffff6
jmp 0x10024967
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
je 0x10024c7e
mov dword [ebp - 0x2bc], 0xfffffffc
mov dword [ebp - 0x8e4], 0xffffffff
mov dword [ebp - 0x914], 0xffffffff
or dword [ebp - 0x9d0], 0xffffffff
or dword [ebp - 0x9cc], 0xffffffff
or dword [ebp - 0x9c8], 0xffffffff
or dword [ebp - 0x9c4], 0xffffffff
lea ecx, [ebp - 0x3b9]
call fcn.1000f6a5
push eax
lea eax, [ebp - 0x9c0]
push eax
lea eax, [ebp - 0x9d0]
push eax
lea ecx, [ebp - 0xca4]
call fcn.1000f6a8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa6c]
call fcn.1000f66b
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x7d8], 0x260d
mov dword [ebp - 0x3c4], 0x2939c010
push 1
lea ecx, [ebp - 0xa54]
call fcn.1000f62f
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x7fc], 0x1defcecb
mov dword [ebp - 0x308], 0
jmp 0x10024a2f
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jge 0x10024a51
push dword [ebp - 0x308]
lea ecx, [ebp - 0xa54]
call fcn.1000f696
mov dword [eax], 8
jmp 0x10024a22
cmp dword [ebp - 0xfc], 0
jne 0x10024c43
cmp dword [ebp - 0xfc], 0
je 0x10024c0a
mov dword [ebp - 0x2bc], 0xaef6
cmp dword [ebp - 0x2bc], 0
je 0x10024b37
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0xb00], eax
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2bc]
imul ecx, dword [ebp - 0x7d8]
sub ecx, dword [ebp - 0x8e4]
cmp ecx, dword [ebp + eax - 0xa3c]
jne 0x10024ac9
mov dword [ebp - 0x500], 1
jmp 0x10024ad0
and dword [ebp - 0x500], 0
push 0
lea ecx, [ebp - 0xa6c]
call fcn.1000f696
mov ecx, dword [ebp - 0x500]
cmp ecx, dword [eax]
jle 0x10024af3
mov dword [ebp - 0x628], 1
jmp 0x10024afa
and dword [ebp - 0x628], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa3c]
cmp dword [ebp - 0x628], eax
jl 0x10024b1b
mov dword [ebp - 0x7e4], 1
jmp 0x10024b22
and dword [ebp - 0x7e4], 0
cmp dword [ebp - 0x914], 7
jne 0x10024b37
mov dword [ebp - 0x7f0], 1
jmp 0x10024b3e
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0x8ec]
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x508], eax
push 0
lea ecx, [ebp - 0xa54]
call fcn.1000f696
mov ecx, dword [ebp - 0x508]
mov dword [eax], ecx
cmp dword [ebp - 0x508], 0
je 0x10024b89
cmp dword [ebp - 0x2bc], 0
je 0x10024b89
mov dword [ebp - 0x728], 1
jmp 0x10024b90
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x728]
mov dword [ebp - 0x7fc], eax
cmp dword [ebp - 0x3c4], 0
jne 0x10024bc0
push 0
lea ecx, [ebp - 0x958]
call fcn.1000f696
cmp dword [eax], 0
jne 0x10024bc0
and dword [ebp - 0x510], 0
jmp 0x10024bca
mov dword [ebp - 0x510], 1
mov eax, dword [ebp - 0x510]
add eax, 0x763523e2
mov dword [ebp - 0x630], eax
push 0
lea ecx, [ebp - 0xa6c]
call fcn.1000f696
mov ecx, dword [ebp - 0x630]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x630], eax
jl 0x10024c0a
mov dword [ebp - 0x380], 1
jmp 0x10024c11
and dword [ebp - 0x380], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x380]
mov dword [ebp + eax - 0xa3c], ecx
push 0
lea ecx, [ebp - 0x958]
call fcn.1000f696
mov ecx, dword [ebp - 0x380]
cmp ecx, dword [eax]
jg 0x10024c43
and dword [ebp - 0x518], 0
jmp 0x10024c4d
mov dword [ebp - 0x518], 1
mov eax, dword [ebp - 0x518]
neg eax
mov dword [ebp - 0x92c], eax
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xa54]
call fcn.1000f691
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xa6c]
call fcn.1000f691
jmp 0x1002495a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x958]
call fcn.1000f691
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1d8]
and eax, 0xe0
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1d8]
or ecx, 0xe0
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1d8]
mov byte [ebp + eax - 0x794], cl
mov dword [ebp - 0x30c], 0x64a6847d
mov dword [ebp - 0x30c], 8
jmp 0x10024cee
mov eax, dword [ebp - 0x30c]
dec eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 6
jne 0x10024d8d
mov dword [ebp - 0x334], 1
mov dword [ebp - 0x2c4], 0
jmp 0x10024d1e
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 1
jge 0x10024d3a
mov eax, dword [ebp - 0x2c4]
mov dword [ebp + eax*4 - 0xb08], 0x39924432
jmp 0x10024d11
mov dword [ebp - 0x334], 0
jmp 0x10024d53
mov eax, dword [ebp - 0x334]
dec eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0
jl 0x10024d88
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x10024d86
push 0x3bb
push 0
push 0
push 0
push 0
push 0x9cc
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
jmp 0x10024d46
jmp 0x10024ce1
mov dword [ebp - 0x14], 2
and dword [ebp - 0x190], 0
jmp 0x10024da5
mov eax, dword [ebp - 0x14]
inc eax
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x20
jae 0x1002577b
mov dword [ebp - 0x6c0], 0x7290
mov dword [ebp - 0x808], 0x10008004
cmp dword [ebp - 0x6c0], 0x747c
jle 0x10024ee2
and dword [ebp - 0x2d4], 0
jmp 0x10024de9
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0x7bdc
jge 0x10024eaf
and dword [ebp - 0x2cc], 0
jmp 0x10024e0f
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0xe20
jge 0x10024eaa
and dword [ebp - 0x314], 0
jmp 0x10024e35
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0x4969
jge 0x10024ea5
and dword [ebp - 0x344], 0
jmp 0x10024e57
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0x5d03
jge 0x10024ea3
mov eax, dword [ebp - 0x2cc]
cdq
idiv dword [ebp - 0x314]
add edx, dword [ebp - 0x2d4]
or edx, dword [ebp - 0x344]
mov eax, edx
cdq
mov dword [ebp - 0x7f8], eax
mov dword [ebp - 0x7f4], edx
push dword [ebp - 0x7f4]
push dword [ebp - 0x7f8]
mov ecx, 0x1061cd78
call fcn.1000f3d7
jmp 0x10024e4a
jmp 0x10024e28
jmp 0x10024e02
jmp 0x10024ddc
push 0xfdd
push 0x10ce
push 0x11cf
push 0x12df
push 0x19d1
push 0x3ad
push 0x2484
push 0x2523
push 0xbc4
call dword [sym.imp.GDI32.dll_Arc]
mov dword [ebp - 4], 0x1c
cmp dword [ebp - 0x6c0], 0x6f80
jge 0x10024f05
mov edx, dword [ebp - 0x808]
mov ecx, 0x1061cd78
call fcn.100119e8
jmp 0x10024f21
or dword [ebp - 4], 0xffffffff
jmp 0x10024f2b
mov dword [ebp - 0x3a8], 1
mov dword [ebp - 0x388], 1
mov dword [ebp - 0x520], 0x9b3a00d0
mov dword [ebp - 0x708], 0xfffffff9
mov dword [ebp - 0x3ac], 0
mov dword [ebp - 0x178], 0xffff
mov dword [ebp - 0x520], 1
mov eax, dword [ebp - 0x388]
inc eax
cmp dword [ebp - 0x520], eax
jl 0x10024f8c
mov dword [ebp - 0x638], 1
jmp 0x10024f93
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x388]
imul eax, dword [ebp - 0x638]
test eax, eax
je 0x10024fb4
xor eax, eax
je 0x10024fb4
mov dword [ebp - 0x528], 1
jmp 0x10024fbb
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x528]
sub eax, dword [ebp - 0x708]
mov ecx, dword [ebp - 0x3a8]
add ecx, eax
add ecx, dword [ebp - 0x708]
mov dword [ebp - 0x8f4], ecx
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x8f4], 0
jne 0x10024ffd
mov dword [ebp - 0x530], 1
jmp 0x10025004
and dword [ebp - 0x530], 0
cmp dword [ebp - 0x530], 0x59bb7a14
je 0x1002501c
mov dword [ebp - 0x640], 1
jmp 0x10025023
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x3ac]
imul eax, dword [ebp - 0x640]
cmp eax, 4
jae 0x10025041
mov dword [ebp - 0x538], 1
jmp 0x10025048
and dword [ebp - 0x538], 0
cmp dword [ebp - 0x538], 0
ja 0x1002505d
mov dword [ebp - 0x6c8], 1
jmp 0x10025064
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x388]
imul eax, dword [ebp - 0x6c8]
cmp eax, dword [ebp - 0x178]
jne 0x10025085
mov dword [ebp - 0x540], 1
jmp 0x1002508c
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x3ac]
add eax, dword [ebp - 0x540]
cmp eax, 0xfffffffe
jge 0x100250a9
mov dword [ebp - 0x648], 1
jmp 0x100250b0
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 0x178], 0x1d
jmp 0x100250d5
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x23
je 0x100250f7
mov dword [ebp - 0x548], 0x89d3
mov eax, dword [ebp - 0x548]
dec eax
mov dword [ebp - 0x548], eax
jmp 0x100250c8
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1d8]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x14], eax
jne 0x10025504
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1fc], 0
jmp 0x10025132
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 3
jge 0x1002514e
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x970], 0xffffffff
jmp 0x10025125
mov dword [ebp - 0x1c], 0
jmp 0x1002515e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x100251a5
mov dword [ebp - 0x174], 2
mov dword [ebp - 0x174], 0
jmp 0x10025187
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jge 0x100251a3
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x970], 0xfffffff7
jmp 0x1002517a
jmp 0x10025157
mov dword [ebp - 0x1c], 0
jmp 0x100251b5
cmp dword [ebp - 0x1c], 2
jg 0x1002527f
mov dword [ebp - 0x810], 0x7528ace4
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
je 0x100251dd
mov dword [ebp - 0x748], 1
jmp 0x100251e4
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x970]
cmp eax, dword [ebp - 0x748]
jl 0x10025224
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x1d8]
inc eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x80], 0xfffffffe
mov dword [ebp - 0x91c], 0xffff
mov dword [ebp - 0x200], 0
jmp 0x100252bb
cmp dword [ebp - 0x200], 2
jge 0x100252d7
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x190]
movzx eax, byte [ebp + eax - 0x1da]
movsx eax, byte [ebp + eax - 0x794]
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x1d7]
and ecx, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x190]
movzx eax, byte [ebp + eax - 0x1da]
movsx eax, byte [ebp + eax - 0x794]
mov edx, dword [ebp - 0x14]
movzx edx, byte [ebp + edx - 0x1d7]
and edx, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x190]
movzx eax, byte [ebp + eax - 0x1da]
movsx eax, byte [ebp + eax - 0x794]
mov esi, dword [ebp - 0x14]
movzx ebx, byte [ebp + esi - 0x1d7]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x1d8]
mov byte [ebp + eax - 0x794], bl
mov dword [ebp - 0x3c], 0xfe0a8eac
push 3
lea ecx, [ebp - 0x988]
call fcn.1000f62f
mov dword [ebp - 4], 0x20
mov dword [ebp - 0x218], 0
jmp 0x100255c0
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 3
jge 0x100255df
push dword [ebp - 0x218]
lea ecx, [ebp - 0x988]
call fcn.1000f696
and dword [eax], 0
jmp 0x100255b3
mov dword [ebp - 0x3c], 9
jmp 0x100255ef
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffe3
je 0x1002560e
mov dword [ebp - 0x3dc], 0x77dd6887
mov eax, dword [ebp - 0x3dc]
dec eax
mov dword [ebp - 0x3dc], eax
jmp 0x100255e8
mov dword [ebp - 0x3c], 2
jmp 0x1002561e
cmp dword [ebp - 0x3c], 0
jl 0x10025760
mov dword [ebp - 0x104], 0x79753589
mov eax, dword [ebp - 0x104]
neg eax
cmp dword [ebp - 0x104], eax
jl 0x1002564e
mov dword [ebp - 0x568], 1
jmp 0x10025655
and dword [ebp - 0x568], 0
cmp dword [ebp - 0x568], 0xffffffff
je 0x1002566a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x988]
call fcn.1000f691
and dword [ebp - 0x190], 0
jmp 0x10024d9d
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x794], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x3e0], 0xffffffff
mov dword [ebp - 0x590], 0x440874b2
mov dword [ebp - 0x404], 0
mov dword [ebp - 0x54], 0
jmp 0x100257be
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x100257d4
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xccc], 0xab227d3
jmp 0x100257b7
mov dword [ebp - 0x54], 0
jmp 0x100257e4
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x100257fa
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xb44], 0xfffffff6
jmp 0x100257dd
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x10025818
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
cmp dword [ebp - 0x5c], 0
jne 0x1002582d
cmp dword [ebp - 0x5c], 0
jae 0x1002582d
and dword [ebp - 0x588], 0
jmp 0x10025837
mov dword [ebp - 0x588], 1
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x588]
jle 0x1002584e
mov dword [ebp - 0x670], 1
jmp 0x10025855
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x5c]
jl 0x1002586f
cmp dword [ebp - 0x5c], 0
je 0x1002586f
mov dword [ebp - 0x738], 1
jmp 0x10025876
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0x590], eax
mov eax, dword [ebp - 0x590]
cmp eax, dword [ebp - 0x5c]
je 0x10025899
mov dword [ebp - 0x390], 1
jmp 0x100258a0
and dword [ebp - 0x390], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x390]
mov dword [ebp + eax - 0xccc], ecx
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x390], eax
jl 0x100258ca
mov dword [ebp - 0x3e4], 1
jmp 0x100258d1
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x3e0]
cmp eax, dword [ebp - 0x3e4]
je 0x100258f7
mov dword [ebp - 0x3ec], 1
jmp 0x100258fe
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x3ec], 0xb541
jge 0x10025916
mov dword [ebp - 0x3f4], 1
jmp 0x1002591d
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x3f4], eax
jg 0x10025934
mov dword [ebp - 0x3fc], 1
jmp 0x1002593b
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 1
ja 0x1002595c
mov dword [ebp - 0x40c], 1
jmp 0x10025963
and dword [ebp - 0x40c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x40c]
mov dword [ebp + eax - 0xb44], ecx
lea eax, [ebp - 0x794]
push eax
lea ecx, [ebp - 0xd58]
call fcn.1000f512
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x8fc], eax
mov dword [ebp - 4], 0x21
mov edx, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x8fc]
call fcn.100125dc
mov dword [0x10d30c18], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd58]
call fcn.1000f57d
and dword [ebp - 0x220], 0
jmp 0x100259dc
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0xf
jae 0x100259f5
mov eax, dword [ebp - 0x220]
mov byte [ebp + eax - 0x794], 0
jmp 0x100259cf
mov dword [ebp - 0x10c], 0xa48bbca6
push 2
lea ecx, [ebp - 0x36c]
call fcn.1000f62f
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x948], 0x412894ff
mov dword [ebp - 0x228], 0
jmp 0x10025a36
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 2
jge 0x10025a55
push dword [ebp - 0x228]
lea ecx, [ebp - 0x36c]
call fcn.1000f696
or dword [eax], 0xffffffff
jmp 0x10025a29
mov dword [ebp - 0x10c], 0xffffffe7
jmp 0x10025a6e
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffea
jl 0x10025ab2
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x10025a91
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x10025ab0
push 0
push 0x2694
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x10025a61
push 1
lea ecx, [ebp - 0x36c]
call fcn.1000f696
mov esi, eax
push 0
lea ecx, [ebp - 0x36c]
call fcn.1000f696
mov eax, dword [eax]
cmp eax, dword [esi]
jge 0x10025b31
push 1
lea ecx, [ebp - 0x36c]
call fcn.1000f696
cmp dword [eax], 0x2f3f6085
jne 0x10025b07
push 1
lea ecx, [ebp - 0x36c]
call fcn.1000f696
cmp dword [eax], 0
je 0x10025b07
mov dword [ebp - 0x41c], 1
jmp 0x10025b0e
and dword [ebp - 0x41c], 0
push 0
lea ecx, [ebp - 0x36c]
call fcn.1000f696
mov ecx, dword [ebp - 0x41c]
add ecx, dword [eax]
je 0x10025b31
mov dword [ebp - 0x424], 1
jmp 0x10025b38
and dword [ebp - 0x424], 0
push 0
lea ecx, [ebp - 0x36c]
call fcn.1000f696
mov ecx, dword [ebp - 0x424]
imul ecx, dword [eax]
cmp ecx, 0x71a0
jg 0x10025b62
mov dword [ebp - 0x820], 1
jmp 0x10025b69
and dword [ebp - 0x820], 0
push 0
lea ecx, [ebp - 0x36c]
call fcn.1000f696
cmp dword [eax], 0xd7af
jl 0x10025b8a
mov dword [ebp - 0x42c], 1
jmp 0x10025b91
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x948]
cmp dword [ebp - 0x42c], eax
jg 0x10025bab
mov dword [ebp - 0x434], 1
jmp 0x10025bb2
and dword [ebp - 0x434], 0
push 0
lea ecx, [ebp - 0x36c]
call fcn.1000f696
mov ecx, dword [ebp - 0x434]
cmp ecx, dword [eax]
jle 0x10025bd5
mov dword [ebp - 0x43c], 1
jmp 0x10025bdc
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x43c]
je 0x10025c02
mov dword [ebp - 0x444], 1
jmp 0x10025c09
and dword [ebp - 0x444], 0
push 0
lea ecx, [ebp - 0x36c]
call fcn.1000f696
mov esi, dword [ebp - 0x444]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x36c]
call fcn.1000f696
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x36c]
call fcn.1000f691
mov eax, dword [0x10d30b54]
cmp eax, dword [ebp - 0x2b0]
je 0x10025c5a
mov eax, dword [0x10d30c18]
cmp eax, dword [ebp - 0x2b0]
jne 0x10025d77
push 4
lea ecx, [ebp - 0xbb0]
call fcn.1000f62f
mov dword [ebp - 4], 0x23
mov dword [ebp - 0xb20], 0xd4e79
mov dword [ebp - 0xb2c], 0x83846275
mov dword [ebp - 0xb58], 1
mov dword [ebp - 0xb60], 0xb8bc588e
mov dword [ebp - 0xb68], 0x5934215e
mov dword [ebp - 0xb70], 0x1009d434
mov dword [ebp - 0xbd8], 0xa82a10aa
push 2
lea ecx, [ebp - 0xa9c]
call fcn.1000f62f
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x64], 0
jmp 0x10025cd5
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x10025cf1
push dword [ebp - 0x64]
lea ecx, [ebp - 0xbb0]
call fcn.1000f696
mov dword [eax], 0x207
jmp 0x10025cce
mov dword [ebp - 0x64], 0
jmp 0x10025d01
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x10025d1d
push dword [ebp - 0x64]
lea ecx, [ebp - 0xa9c]
call fcn.1000f696
mov dword [eax], 0xb6b0
jmp 0x10025cfa
push 1
lea ecx, [ebp - 0xa9c]
call fcn.1000f696
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x44c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x44c]
mov dword [ecx], eax
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0xa9c]
call fcn.1000f691
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbb0]
call fcn.1000f691
mov ecx, dword [ebp + 0xc]
call fcn.1000f3b7
push eax
push dword [ebp + 8]
call fcn.1001a9f8
pop ecx
pop ecx
jmp 0x100280fd
mov dword [ebp - 0x238], 0xd5e48d32
mov dword [ebp - 0xbe0], 0x83c8fc55
push 1
lea ecx, [ebp - 0xbc0]
call fcn.1000f62f
mov dword [ebp - 4], 0x25
mov dword [ebp - 0x230], 0
jmp 0x10025db8
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 1
jge 0x10025dda
push dword [ebp - 0x230]
lea ecx, [ebp - 0xbc0]
call fcn.1000f696
mov dword [eax], 0xee7d214c
jmp 0x10025dab
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x10025df2
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x238], 0
jmp 0x10025e0b
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0xe
je 0x10025e2d
mov dword [ebp - 0x454], 0xfffffff6
mov eax, dword [ebp - 0x454]
dec eax
mov dword [ebp - 0x454], eax
jmp 0x10025dfe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc0]
call fcn.1000f691
mov eax, dword [ebp + 8]
mov dword [ebp - 0x258], eax
push 1
lea ecx, [ebp - 0x894]
call fcn.1000f62f
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x9e4], 0x2e8588d0
mov dword [ebp - 0x9e0], 0x2e8588d0
mov dword [ebp - 0x9dc], 0x2e8588d0
mov dword [ebp - 0x9d8], 0x2e8588d0
lea ecx, [ebp - 0x3a1]
call fcn.1000f6a5
push eax
lea eax, [ebp - 0x9d4]
push eax
lea eax, [ebp - 0x9e4]
push eax
lea ecx, [ebp - 0xcb4]
call fcn.1000f6a8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xbd0]
call fcn.1000f66b
mov byte [ebp - 4], 0x27
mov dword [ebp - 0xbe8], 0
mov dword [ebp - 0x240], 0
jmp 0x10025edd
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 1
jge 0x10025eff
push dword [ebp - 0x240]
lea ecx, [ebp - 0x894]
call fcn.1000f696
mov dword [eax], 0xdb3ae355
jmp 0x10025ed0
push 0
lea ecx, [ebp - 0x894]
call fcn.1000f696
mov dword [eax], 0xfffffffa
jmp 0x10025f38
push 0
lea ecx, [ebp - 0x894]
call fcn.1000f696
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x45c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x45c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x894]
call fcn.1000f696
cmp dword [eax], 0xfffffff2
jne 0x10025fe3
mov dword [ebp - 0x828], 0x738a
mov dword [ebp - 0x46c], 0xfffffff9
mov dword [ebp - 0x248], 0
jmp 0x10025f7b
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 2
jge 0x10025f97
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0xcbc], 0x1c71bc7d
jmp 0x10025f6e
cmp dword [ebp - 0x828], 0
jne 0x10025fb2
mov eax, 0x59d5
test eax, eax
jne 0x10025fb2
and dword [ebp - 0x464], 0
jmp 0x10025fbc
mov dword [ebp - 0x464], 1
push 3
lea ecx, [ebp - 0xbd0]
call fcn.1000f696
mov ecx, dword [ebp - 0x464]
mov dword [eax], ecx
mov eax, dword [ebp - 0x46c]
inc eax
mov dword [ebp - 0x46c], eax
jmp 0x10025f14
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xbd0]
call fcn.1000f691
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x894]
call fcn.1000f691
cmp dword [ebp - 0x258], 0
je 0x100280fb
mov eax, dword [ebp - 0x258]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x100280fb
push 2
lea ecx, [ebp - 0x350]
call fcn.1000f62f
mov dword [ebp - 4], 0x28
mov dword [ebp - 0x4ac], 0x69376522
mov dword [ebp - 0x4dc], 0xfffffff7
mov dword [ebp - 0x830], 0
mov dword [ebp - 0x250], 0
jmp 0x1002606d
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 2
jge 0x1002608f
push dword [ebp - 0x250]
lea ecx, [ebp - 0x350]
call fcn.1000f696
mov dword [eax], 0x13b91020
jmp 0x10026060
push 0
lea ecx, [ebp - 0x350]
call fcn.1000f696
mov dword [eax], 0xffffffee
jmp 0x100260c8
push 0
lea ecx, [ebp - 0x350]
call fcn.1000f696
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x474]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x474]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x350]
call fcn.1000f696
cmp dword [eax], 0xa
jle 0x1002637b
mov dword [ebp - 0x114], 0xe7e55059
mov dword [ebp - 0x3b0], 0x26a056eb
cmp dword [ebp - 0x114], 0
jne 0x10026116
push 0
lea ecx, [ebp - 0x350]
call fcn.1000f696
cmp dword [eax], 0
jne 0x10026116
and dword [ebp - 0x47c], 0
jmp 0x10026120
mov dword [ebp - 0x47c], 1
cmp dword [ebp - 0x47c], 0
jne 0x10026144
push 0
lea ecx, [ebp - 0x350]
call fcn.1000f696
cmp dword [eax], 0
jne 0x10026144
and dword [ebp - 0x484], 0
jmp 0x1002614e
mov dword [ebp - 0x484], 1
push 0
lea ecx, [ebp - 0x350]
call fcn.1000f696
mov ecx, dword [ebp - 0x484]
add ecx, dword [eax]
jns 0x10026171
mov dword [ebp - 0x48c], 1
jmp 0x10026178
and dword [ebp - 0x48c], 0
push 1
lea ecx, [ebp - 0x350]
call fcn.1000f696
mov esi, dword [ebp - 0x48c]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x350]
call fcn.1000f696
cmp dword [eax], esi
jg 0x100261b1
cmp dword [ebp - 0x114], 0
jne 0x100261b1
and dword [ebp - 0x494], 0
jmp 0x100261bb
mov dword [ebp - 0x494], 1
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0x494]
mov dword [ebp - 0x3b0], eax
mov eax, 0x66b48b76
test eax, eax
je 0x10026342
push 0
lea ecx, [ebp - 0x350]
call fcn.1000f696
cmp dword [eax], 0
jne 0x10026207
push 0
lea ecx, [ebp - 0x350]
call fcn.1000f696
cmp dword [eax], 0
jne 0x10026207
and dword [ebp - 0x49c], 0
jmp 0x10026211
mov dword [ebp - 0x49c], 1
cmp dword [ebp - 0x49c], 1
jb 0x10026226
mov dword [ebp - 0x4a4], 1
jmp 0x1002622d
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 0
jne 0x10026254
mov eax, 0x2c7a2e42
test eax, eax
jne 0x10026254
and dword [ebp - 0x4b4], 0
jmp 0x1002625e
mov dword [ebp - 0x4b4], 1
mov eax, dword [ebp - 0x3b0]
cmp dword [ebp - 0x4b4], eax
jle 0x10026278
mov dword [ebp - 0x4bc], 1
jmp 0x1002627f
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x4bc], eax
jne 0x10026299
mov dword [ebp - 0x904], 1
jmp 0x100262a0
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0xbf0], eax
mov esi, dword [ebp - 0x114]
push 1
lea ecx, [ebp - 0x350]
call fcn.1000f696
cmp dword [eax], esi
jle 0x100262cf
mov dword [ebp - 0x4c4], 1
jmp 0x100262d6
and dword [ebp - 0x4c4], 0
push 0
lea ecx, [ebp - 0x350]
call fcn.1000f696
mov ecx, dword [ebp - 0x4c4]
cmp ecx, dword [eax]
jge 0x100262f9
mov dword [ebp - 0x4cc], 1
jmp 0x10026300
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x4cc], eax
jg 0x1002631a
mov dword [ebp - 0x4d4], 1
jmp 0x10026321
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0
je 0x10026342
mov dword [ebp - 0x4e4], 1
jmp 0x10026349
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x4e4], eax
jne 0x10026363
mov dword [ebp - 0x4ec], 1
jmp 0x1002636a
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x830], eax
jmp 0x100260a4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x350]
call fcn.1000f691
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 0x258]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1b8], ecx
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x260], 0
jmp 0x100263bf
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 3
jge 0x100263db
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0x97c], 0xffffffff
jmp 0x100263b2
mov dword [ebp - 0x24], 0
jmp 0x100263eb
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jg 0x10026432
mov dword [ebp - 0x198], 2
mov dword [ebp - 0x198], 0
jmp 0x10026414
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 3
jge 0x10026430
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x97c], 0xfffffff7
jmp 0x10026407
jmp 0x100263e4
mov dword [ebp - 0x24], 0
jmp 0x10026442
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jg 0x1002650c
mov dword [ebp - 0x8cc], 0x7528ace4
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
je 0x1002646a
mov dword [ebp - 0x4f4], 1
jmp 0x10026471
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x97c]
cmp eax, dword [ebp - 0x4f4]
jl 0x100264b1
mov eax, 0xda0bdbd
test eax, eax
je 0x100264b1
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x97c]
mov dword [ebp - 0xbf8], eax
mov eax, 0xffff
test eax, eax
je 0x100264b1
mov dword [ebp - 0x4fc], 1
jmp 0x100264b8
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x97c]
cmp dword [ebp - 0x4fc], eax
jle 0x100264d6
mov dword [ebp - 0x504], 1
jmp 0x100264dd
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x504], eax
jle 0x100264f4
mov dword [ebp - 0x50c], 1
jmp 0x100264fb
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x8cc], eax
jmp 0x1002643b
mov eax, dword [ebp - 0x1b8]
cmp dword [eax], 0x4550
jne 0x100280fb
mov eax, dword [ebp - 0x1b8]
cmp dword [eax + 0x74], 0
jbe 0x100280fb
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b8]
cmp dword [ecx + eax + 0x78], 0
je 0x100280fb
and dword [ebp - 0xa0c], 0
and dword [ebp - 0xa08], 0
and dword [ebp - 0xa04], 0
and dword [ebp - 0xa00], 0
lea ecx, [ebp - 0x391]
call fcn.1000f6a5
push eax
lea eax, [ebp - 0x9fc]
push eax
lea eax, [ebp - 0xa0c]
push eax
lea ecx, [ebp - 0xcac]
call fcn.1000f6a8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa18]
call fcn.1000f66b
mov dword [ebp - 4], 0x29
mov dword [ebp - 0x11c], 0xffffffff
mov dword [ebp - 0x11c], 0
jmp 0x100265c0
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 4
jge 0x100265df
push dword [ebp - 0x11c]
lea ecx, [ebp - 0xa18]
call fcn.1000f696
and dword [eax], 0
jmp 0x100265b3
mov dword [ebp - 0x11c], 0
mov esi, dword [ebp - 0x11c]
push 1
lea ecx, [ebp - 0xa18]
call fcn.1000f696
cmp esi, dword [eax]
je 0x10026649
mov byte [ebp - 0x138], 0
movzx eax, byte [ebp - 0x138]
test eax, eax
je 0x1002661e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x10026647
push 0x1cfb
push 0xd52
push 0x16cf
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x10026670
mov byte [ebp - 0x140], 0
movzx eax, byte [ebp - 0x140]
test eax, eax
je 0x10026670
push 0x9e3
push 0x67a
push 0x1044
call dword [sym.imp.USER32.dll_CheckDlgButton]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa18]
call fcn.1000f691
mov eax, dword [ebp + 8]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x124], 0x2124
mov dword [ebp - 0x12c], 0xbfc88eb9
mov dword [ebp - 0x170], 0xfffffff9
mov dword [ebp - 0x148], 0xaf8716b5
mov dword [ebp - 0x268], 0xfffffff9
mov dword [ebp - 0x1a0], 0xa97f51ef
mov dword [ebp - 0x838], 0x785c
mov dword [ebp - 0xc14], 0xffffffff
cmp dword [ebp - 0x124], 0
jne 0x10026803
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x100267a1
mov eax, 0xffff
cmp eax, 1
je 0x10026714
mov dword [ebp - 0x514], 1
jmp 0x1002671b
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
cmp eax, dword [ebp - 0x124]
je 0x10026741
mov dword [ebp - 0x51c], 1
jmp 0x10026748
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x51c], eax
jl 0x10026762
mov dword [ebp - 0x524], 1
jmp 0x10026769
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x524], eax
jl 0x10026783
mov dword [ebp - 0x52c], 1
jmp 0x1002678a
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0x52c]
jg 0x100267b3
cmp dword [ebp - 0x170], 0
jne 0x100267b3
cmp dword [ebp - 0x124], 0
jne 0x100267b3
and dword [ebp - 0x534], 0
jmp 0x100267bd
mov dword [ebp - 0x534], 1
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x124], 1
jl 0x100267de
mov dword [ebp - 0x53c], 1
jmp 0x100267e5
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x124]
imul eax, dword [ebp - 0x53c]
sub eax, dword [ebp - 0x268]
jne 0x10026803
and dword [ebp - 0x544], 0
jmp 0x1002680d
mov dword [ebp - 0x544], 1
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
dec eax
je 0x1002684d
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1002684b
push 0x389
push 0
push 0x65e
push 0x1f82
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
jmp 0x10026865
mov byte [ebp - 0x13a], 0
movzx eax, byte [ebp - 0x13a]
test eax, eax
je 0x10026865
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0xab0], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0xc24], eax
mov eax, dword [ebp - 0x170]
imul eax, dword [ebp - 0x148]
cmp eax, dword [ebp - 0x124]
jle 0x100268aa
mov dword [ebp - 0x54c], 1
jmp 0x100268b1
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x148]
add eax, dword [ebp - 0x54c]
imul eax, eax, 0xeb61
cmp eax, dword [ebp - 0x148]
jne 0x100268d7
mov dword [ebp - 0x554], 1
jmp 0x100268de
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x838]
cmp dword [ebp - 0x554], eax
jle 0x100268f8
mov dword [ebp - 0x55c], 1
jmp 0x100268ff
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x55c]
sub eax, dword [ebp - 0x268]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
inc eax
cmp eax, dword [ebp - 0x268]
jle 0x1002692c
mov dword [ebp - 0x564], 1
jmp 0x10026933
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
sub eax, dword [ebp - 0x268]
mov dword [ebp - 0x12c], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b8]
mov edx, dword [ebp - 0x158]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0xa0], 0xba33
mov dword [ebp - 0x16c], 0x9d44c039
mov dword [ebp - 0xa8], 1
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0xc2c], 3
mov dword [ebp - 0xc34], 0
mov dword [ebp - 0xc40], 0xfffffff7
mov dword [ebp - 0x270], 0
jmp 0x100269d6
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 2
jge 0x100269f2
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0xc9c], 0x9e206048
jmp 0x100269c9
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0xa0]
jle 0x10026a0c
mov dword [ebp - 0x584], 1
jmp 0x10026a13
and dword [ebp - 0x584], 0
cmp dword [ebp - 0x16c], 0
je 0x10026a31
cmp dword [ebp - 0xa0], 0
je 0x10026a31
mov dword [ebp - 0x56c], 1
jmp 0x10026a38
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0xa8], eax
imul eax, dword [ebp - 0xa8], 0x2a17
mov ecx, dword [ebp - 0xa0]
imul ecx, eax
test ecx, ecx
je 0x10026a70
cmp dword [ebp - 0xa8], 0
je 0x10026a70
mov dword [ebp - 0x8d0], 1
jmp 0x10026a77
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0xa8]
je 0x10026a91
mov dword [ebp - 0x574], 1
jmp 0x10026a98
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x574], eax
jl 0x10026ab2
mov dword [ebp - 0x57c], 1
jmp 0x10026ab9
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
jne 0x10026ade
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x10026ade
and dword [ebp - 0x58c], 0
jmp 0x10026ae8
mov dword [ebp - 0x58c], 1
mov eax, dword [ebp - 0x584]
cmp eax, dword [ebp - 0x58c]
jg 0x10026b02
mov dword [ebp - 0x594], 1
jmp 0x10026b09
and dword [ebp - 0x594], 0
cmp dword [ebp - 0x594], 0
je 0x10026cbd
mov dword [ebp - 0x59c], 0x112def90
mov eax, dword [ebp - 0x59c]
dec eax
mov dword [ebp - 0x59c], eax
mov dword [ebp - 0x5a4], 0x6923
mov dword [ebp - 0x840], 0x10008064
cmp dword [ebp - 0x5a4], 0x6aad
jle 0x10026c2e
and dword [ebp - 0x288], 0
jmp 0x10026b67
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0x24d
jge 0x10026c2e
and dword [ebp - 0x290], 0
jmp 0x10026b8d
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0x1572
jge 0x10026c29
and dword [ebp - 0x278], 0
jmp 0x10026bb3
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0x6152
jge 0x10026c24
and dword [ebp - 0x280], 0
jmp 0x10026bd5
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0x5238
jge 0x10026c22
mov eax, dword [ebp - 0x278]
cdq
idiv dword [ebp - 0x280]
mov eax, dword [ebp - 0x288]
imul eax, dword [ebp - 0x290]
or eax, edx
cdq
mov dword [ebp - 0x804], eax
mov dword [ebp - 0x800], edx
push dword [ebp - 0x800]
push dword [ebp - 0x804]
mov ecx, 0x1061cd78
call fcn.1000f3d7
jmp 0x10026bc8
jmp 0x10026ba6
jmp 0x10026b80
jmp 0x10026b5a
mov dword [ebp - 0x16c], 0x13
jmp 0x10026c47
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x10
jl 0x10026c6f
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x10026c6d
push 0x1631
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x10026c3a
mov dword [ebp - 4], 0x2a
cmp dword [ebp - 0x5a4], 0x68df
jge 0x10026c92
mov edx, dword [ebp - 0x840]
mov ecx, 0x1061cd78
call fcn.100119e8
jmp 0x10026cae
or dword [ebp - 4], 0xffffffff
jmp 0x10026cb8
jmp 0x10027180
mov dword [ebp - 0x74], 0xf738
mov dword [ebp - 0x298], 0xaa435c52
mov dword [ebp - 0x37c], 0xea1dc7e9
mov dword [ebp - 0x8d8], 0x1628
cmp dword [ebp - 0x8d8], 0x584
jge 0x10026db9
lea eax, [ebp - 0x398]
push eax
push 0x10007a90
call fcn.1005cc6b
pop ecx
pop ecx
or dword [ebp - 0x3a0], 0xffffffff
mov byte [ebp - 0x31], 0
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x398]
dec eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x848], 0
je 0x10026d8f
lea eax, [ebp - 0x8e0]
push eax
lea eax, [ebp - 0x3b4]
push eax
push 0x100080cc
call fcn.1005cc6b
add esp, 0xc
mov eax, dword [ebp - 0x3b4]
cmp eax, dword [ebp - 0x8e0]
je 0x10026d66
push 0x100080d4
call fcn.1005d62d
pop ecx
cmp dword [ebp - 0x3a0], 0
jl 0x10026d81
mov eax, dword [ebp - 0x3b4]
cmp eax, dword [ebp - 0x3a0]
jle 0x10026d81
mov byte [ebp - 0x31], 1
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x3a0], eax
jmp 0x10026d10
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x10026da3
mov dword [ebp - 0x5ac], 0x100080dc
jmp 0x10026dad
mov dword [ebp - 0x5ac], 0x100080e4
push dword [ebp - 0x5ac]
call fcn.1005d62d
pop ecx
push 1
lea ecx, [ebp - 0x8b4]
call fcn.1000f62f
mov dword [ebp - 4], 0x2c
mov dword [ebp - 0x5fc], 1
push 2
lea ecx, [ebp - 0x8a4]
call fcn.1000f62f
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0x374], 0x233f
mov dword [ebp - 0x6c], 0
jmp 0x10026e02
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x10026e1e
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x8b4]
call fcn.1000f696
mov dword [eax], 0xfffffff7
jmp 0x10026dfb
mov dword [ebp - 0x6c], 0
jmp 0x10026e2e
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10026e4a
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x8a4]
call fcn.1000f696
mov dword [eax], 0x89736453
jmp 0x10026e27
cmp dword [ebp - 0xa0], 0
je 0x10026ea6
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x154]
jle 0x10026e6a
mov dword [ebp - 0x5b4], 1
jmp 0x10026e71
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x298]
cmp eax, dword [ebp - 0x74]
jg 0x10026e9a
cmp dword [ebp - 0x298], 0
jne 0x10026e9a
cmp dword [ebp - 0xa8], 0
je 0x10026ea6
mov dword [ebp - 0x850], 1
jmp 0x10026ead
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xc18], eax
mov eax, 0x4f2ca125
test eax, eax
je 0x10026ed7
cmp dword [ebp - 0x298], 0
je 0x10026ed7
mov dword [ebp - 0x5bc], 1
jmp 0x10026ede
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x1a8]
imul eax, dword [ebp - 0x5bc]
cmp eax, 0xce2e7c52
ja 0x10026efe
mov dword [ebp - 0x5c4], 1
jmp 0x10026f05
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x5c4], eax
jle 0x10026f1f
mov dword [ebp - 0x5cc], 1
jmp 0x10026f26
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0x2fc
jl 0x10026f4a
mov dword [ebp - 0x5d4], 1
jmp 0x10026f51
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0x5d4]
cmp eax, dword [ebp - 0x74]
jle 0x10026f6e
mov dword [ebp - 0x8e8], 1
jmp 0x10026f75
and dword [ebp - 0x8e8], 0
mov esi, dword [ebp - 0x74]
push 0
lea ecx, [ebp - 0x8b4]
call fcn.1000f696
cmp dword [eax], esi
jl 0x10026f95
mov dword [ebp - 0x5dc], 1
jmp 0x10026f9c
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x74]
add eax, dword [ebp - 0x5dc]
cmp eax, 0x4085efbe
je 0x10026fb8
mov dword [ebp - 0x5e4], 1
jmp 0x10026fbf
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x74]
add eax, dword [ebp - 0x5e4]
cmp eax, dword [ebp - 0x5fc]
jne 0x10026fdc
mov dword [ebp - 0x5ec], 1
jmp 0x10026fe3
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x1a8]
add eax, dword [ebp - 0x5ec]
add eax, dword [ebp - 0x74]
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x16c], 0
jne 0x1002709d
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x858], eax
mov eax, dword [ebp - 0x74]
sub eax, 3
mov dword [ebp - 0x8f0], eax
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x858]
cmp eax, dword [ebp - 0x8f0]
jl 0x10027044
mov dword [ebp - 0x5f4], 1
jmp 0x1002704b
and dword [ebp - 0x5f4], 0
push 0
lea ecx, [ebp - 0x8b4]
call fcn.1000f696
mov ecx, dword [ebp - 0x5f4]
imul ecx, dword [eax]
cmp dword [ebp - 0x5fc], ecx
jg 0x10027075
mov dword [ebp - 0x604], 1
jmp 0x1002707c
and dword [ebp - 0x604], 0
mov dword [ebp - 0xa8], 0x8f60f1b6
mov eax, dword [ebp - 0xa8]
add eax, dword [ebp - 0x604]
jne 0x1002709d
and dword [ebp - 0x60c], 0
jmp 0x100270a7
mov dword [ebp - 0x60c], 1
cmp dword [ebp - 0x60c], 0x7f359a12
jl 0x100270bf
mov dword [ebp - 0x868], 1
jmp 0x100270c6
and dword [ebp - 0x868], 0
push 1
lea ecx, [ebp - 0x8a4]
call fcn.1000f696
push 0
lea ecx, [ebp - 0x8b4]
call fcn.1000f696
push 1
lea ecx, [ebp - 0x8a4]
call fcn.1000f696
mov esi, eax
push 1
lea ecx, [ebp - 0x8a4]
call fcn.1000f696
mov eax, dword [eax]
cmp eax, dword [esi]
jge 0x1002710e
mov dword [ebp - 0x614], 1
jmp 0x10027115
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x614], 0x7655505f
jg 0x1002712d
mov dword [ebp - 0x61c], 1
jmp 0x10027134
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x61c], eax
jle 0x1002714b
mov dword [ebp - 0x624], 1
jmp 0x10027152
and dword [ebp - 0x624], 0
imul eax, dword [ebp - 0x624], 0x8eda
mov dword [ebp - 0x37c], eax
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x8a4]
call fcn.1000f691
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8b4]
call fcn.1000f691
mov dword [ebp - 0x154], 0xffffffe7
jmp 0x10027199
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 1
jne 0x100271c7
mov byte [ebp - 0x13e], 0
movzx eax, byte [ebp - 0x13e]
test eax, eax
je 0x100271c5
push 0x1c29
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1002718c
mov eax, 0xffff
mov word [ebp - 0x58], ax
mov dword [ebp - 0x8f8], 0xf4288a13
mov dword [ebp - 0x998], 0x82a1836c
mov dword [ebp - 0x994], 0x82a1836c
mov dword [ebp - 0x990], 0x82a1836c
mov dword [ebp - 0x98c], 0x82a1836c
mov dword [ebp - 0x63c], 0
mov dword [ebp - 0xc28], 0xffffffff
mov dword [ebp - 0x2a0], 0
jmp 0x1002722f
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 3
jge 0x1002724b
mov eax, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0x744], 0xffffffff
jmp 0x10027222
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x8f8]
cmp ecx, dword [ebp + eax - 0x998]
jg 0x1002726b
mov dword [ebp - 0x384], 1
jmp 0x10027272
and dword [ebp - 0x384], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x384]
mov dword [ebp + eax - 0x744], ecx
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x63c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x744], 0xcd9d7
jle 0x100272ae
mov dword [ebp - 0x878], 1
jmp 0x100272b5
and dword [ebp - 0x878], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x744]
mov dword [ebp - 0xabc], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x744]
neg eax
jne 0x100272e3
mov dword [ebp - 0x62c], 1
jmp 0x100272ea
and dword [ebp - 0x62c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x744]
cmp dword [ebp - 0x62c], eax
jg 0x1002730a
mov dword [ebp - 0x634], 1
jmp 0x10027311
and dword [ebp - 0x634], 0
mov eax, 0x9689
sub eax, dword [ebp - 0x634]
cmp eax, 0x67f8
je 0x1002732f
mov dword [ebp - 0x900], 1
jmp 0x10027336
and dword [ebp - 0x900], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x744]
mov dword [ebp - 0xb94], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x744]
mov dword [ebp - 0xac4], eax
mov eax, 0xeb38
sub eax, dword [ebp - 0x63c]
je 0x10027383
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x998], 0
je 0x10027383
mov dword [ebp - 0x644], 1
jmp 0x1002738a
and dword [ebp - 0x644], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x644]
mov dword [ebp + eax - 0x744], ecx
or dword [ebp - 0x150], 0xffffffff
mov dword [ebp - 0x164], 0xffffffff
mov dword [ebp - 0x18], 0x65e08ccc
mov dword [ebp - 0x2a8], 0
jmp 0x100273ce
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 2
jge 0x100273ea
mov eax, dword [ebp - 0x2a8]
mov dword [ebp + eax*4 - 0x3d8], 0x2eb90da1
jmp 0x100273c1
mov dword [ebp - 0x164], 1
jmp 0x10027403
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jl 0x100276d4
push 2
lea ecx, [ebp - 0x964]
call fcn.1000f62f
mov dword [ebp - 4], 0x2e
push 3
lea ecx, [ebp - 0xa24]
call fcn.1000f62f
mov byte [ebp - 4], 0x2f
mov dword [ebp - 0x1b0], 0xfffffff7
mov dword [ebp - 0x7c], 0
jmp 0x1002744f
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1002746b
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x964]
call fcn.1000f696
mov dword [eax], 0xf576
jmp 0x10027448
mov dword [ebp - 0x7c], 0
jmp 0x1002747b
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x10027497
push dword [ebp - 0x7c]
lea ecx, [ebp - 0xa24]
call fcn.1000f696
mov dword [eax], 0xe9934b0b
jmp 0x10027474
mov dword [ebp - 0x18], 0xff23
cmp dword [ebp - 0x18], 0x7222
je 0x100274b3
mov dword [ebp - 0x64c], 1
jmp 0x100274ba
and dword [ebp - 0x64c], 0
push 1
lea ecx, [ebp - 0x964]
call fcn.1000f696
mov ecx, dword [ebp - 0x64c]
mov dword [eax], ecx
mov dword [ebp - 0x18], 0
jmp 0x100274df
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x100276b1
mov dword [ebp - 0x898], 0xf7c295a5
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x10027513
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x3d8], 0
jne 0x10027581
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x3d8]
cmp ecx, dword [ebp + eax*4 - 0x3d8]
jne 0x10027542
mov dword [ebp - 0x65c], 1
jmp 0x10027549
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x654], eax
push 0
lea ecx, [ebp - 0xa24]
call fcn.1000f696
mov ecx, dword [ebp - 0x654]
mov dword [eax], ecx
mov eax, dword [ebp - 0x654]
add eax, dword [ebp - 0x65c]
jne 0x10027581
and dword [ebp - 0x674], 0
jmp 0x1002758b
mov dword [ebp - 0x674], 1
cmp dword [ebp - 0x18], 0
je 0x100275a6
cmp dword [ebp - 0x164], 0
je 0x100275a6
mov dword [ebp - 0x664], 1
jmp 0x100275ad
and dword [ebp - 0x664], 0
imul eax, dword [ebp - 0x664], 0xffffffff
test eax, eax
je 0x100275d6
push 1
lea ecx, [ebp - 0x964]
call fcn.1000f696
cmp dword [eax], 0
je 0x100275d6
mov dword [ebp - 0x888], 1
jmp 0x100275dd
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3d8]
mov dword [ebp - 0xbfc], eax
cmp dword [ebp - 0x1b0], 0xf118
jne 0x10027605
mov dword [ebp - 0x66c], 1
jmp 0x1002760c
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3d8]
cmp dword [ebp - 0x66c], eax
jg 0x1002762a
mov dword [ebp - 0x67c], 1
jmp 0x10027631
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x674]
cmp eax, dword [ebp - 0x67c]
je 0x1002764b
mov dword [ebp - 0x908], 1
jmp 0x10027652
and dword [ebp - 0x908], 0
cmp dword [ebp - 0x18], 0
jne 0x10027665
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x3d8], 0
je 0x100276a2
mov dword [ebp - 0x1b0], 1
jmp 0x1002767e
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
jl 0x100276a0
mov dword [ebp - 0x684], 0xfffffff8
mov eax, dword [ebp - 0x684]
dec eax
mov dword [ebp - 0x684], eax
jmp 0x10027671
jmp 0x100276ac
mov dword [ebp - 0x898], 0x6d065835
jmp 0x100274d8
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0xa24]
call fcn.1000f691
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x964]
call fcn.1000f691
jmp 0x100273f6
cmp dword [ebp + 0x10], 0
jbe 0x100276f5
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x100276f0
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x58], ax
jmp 0x100278c1
mov eax, dword [0x10d30bd0]
and eax, 1
jne 0x1002772c
mov eax, dword [0x10d30bd0]
or eax, 1
mov dword [0x10d30bd0], eax
mov dword [ebp - 4], 0x30
mov ecx, 0x10d30c84
call fcn.100290fa
push 0x1007591b
call fcn.1005d289
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x10d30b4c]
test eax, eax
je 0x10027798
mov ecx, 0x10d30c84
call fcn.100291bf
movzx eax, al
test eax, eax
jne 0x10027798
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x68c]
push eax
mov ecx, 0x10d30c84
call fcn.100291c8
lea eax, [ebp - 0xacc]
push eax
mov ecx, 0x10d30c84
call fcn.100291b1
push eax
lea ecx, [ebp - 0x68c]
call fcn.10029060
movzx eax, al
test eax, eax
je 0x10027798
lea ecx, [ebp - 0x68c]
call fcn.100292ea
mov eax, dword [eax + 4]
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0xffffffff
jne 0x100278c1
mov ecx, 0x10d30c84
call fcn.1002932e
mov ecx, dword [ebp - 0xb0]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x10d30c84
call fcn.10029332
and dword [ebp - 0x15c], 0
jmp 0x100277d9
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0x15c]
cmp ecx, dword [eax + 0x18]
jae 0x100278c1
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0x158]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x15c]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x694], 0
je 0x100278bc
mov eax, dword [ebp - 0x694]
mov ecx, dword [ebp - 0x158]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0xc94]
call fcn.1000f512
mov dword [ebp - 4], 0x31
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xc94]
call fcn.100125dc
mov dword [ebp - 0x69c], eax
movzx eax, byte [0x10d30b4c]
test eax, eax
je 0x1002786a
mov ecx, 0x10d30c84
call fcn.100291bf
movzx eax, al
test eax, eax
jne 0x1002788a
lea eax, [ebp - 0x69c]
push eax
mov ecx, 0x10d30c84
call fcn.100292f0
mov ecx, dword [ebp - 0x15c]
mov dword [eax], ecx
mov byte [0x10d30b4c], 1
cmp dword [ebp - 0x150], 0xffffffff
jne 0x100278ad
mov eax, dword [ebp - 0x69c]
cmp eax, dword [ebp - 0x2b0]
jne 0x100278ad
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x150], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc94]
call fcn.1000f57d
jmp 0x100277cc
mov dword [ebp - 0x14c], 0x75dcec3d
cmp dword [ebp - 0x14c], 0
je 0x1002790b
mov byte [ebp - 0x136], 0
movzx eax, byte [ebp - 0x136]
test eax, eax
je 0x100278ee
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x10027906
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10027991
mov dword [ebp - 0x310], 0
jmp 0x10027924
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 2
jge 0x10027940
mov eax, dword [ebp - 0x310]
mov dword [ebp + eax*4 - 0xb28], 0xffffffff
jmp 0x10027917
mov byte [ebp - 0xba], 0
movzx eax, byte [ebp - 0xba]
test eax, eax
je 0x1002795c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov dword [ebp - 0x14c], 0
jmp 0x10027975
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 2
jge 0x10027991
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0xb28], 0xffffffff
jmp 0x10027968
cmp dword [ebp + 0x10], 0
jne 0x100279bd
cmp dword [ebp - 0x150], 0xffffffff
je 0x100279bd
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0x158]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x150]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x58], ax
mov dword [ebp - 0x320], 0x1f7e2799
mov dword [ebp - 0x318], 0
jmp 0x100279e0
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 2
jge 0x100279fc
mov eax, dword [ebp - 0x318]
mov dword [ebp + eax*4 - 0xb50], 0xd19ac196
jmp 0x100279d3
mov dword [ebp - 0x320], 0
jmp 0x10027a15
mov eax, dword [ebp - 0x320]
dec eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0xfffffffa
je 0x10027b83
push 3
lea ecx, [ebp - 0x8c4]
call fcn.1000f62f
mov dword [ebp - 4], 0x32
mov dword [ebp - 0x910], 0
mov dword [ebp - 0x328], 0
jmp 0x10027a59
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 3
jge 0x10027a78
push dword [ebp - 0x328]
lea ecx, [ebp - 0x8c4]
call fcn.1000f696
and dword [eax], 0
jmp 0x10027a4c
mov byte [ebp - 0xbc], 0
movzx eax, byte [ebp - 0xbc]
test eax, eax
je 0x10027a99
push 0
push 0x826
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
push 0
lea ecx, [ebp - 0x8c4]
call fcn.1000f696
mov dword [eax], 0xf
jmp 0x10027ad2
push 0
lea ecx, [ebp - 0x8c4]
call fcn.1000f696
mov dword [ebp - 0x6a4], eax
mov eax, dword [ebp - 0x6a4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x6a4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x8c4]
call fcn.1000f696
cmp dword [eax], 6
jg 0x10027b6f
mov dword [ebp - 0x330], 1
mov dword [ebp - 0x330], 0
jmp 0x10027b0b
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 1
jg 0x10027b57
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x10027b33
push 0
push 0x1a2b
call dword [sym.imp.USER32.dll_MonitorFromWindow]
mov byte [ebp - 0xc0], 0
movzx eax, byte [ebp - 0xc0]
test eax, eax
je 0x10027b55
push 0x104b
push 0x2634
call dword [sym.imp.USER32.dll_GetWindowLongW]
jmp 0x10027afe
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb50]
mov dword [ebp - 0x910], eax
jmp 0x10027aae
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c4]
call fcn.1000f691
jmp 0x10027a08
movzx eax, word [ebp - 0x58]
cmp eax, 0xffff
je 0x100280fb
movzx eax, word [ebp - 0x58]
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ebp - 0x158]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0x8a8], eax
mov eax, dword [ebp - 0x8a8]
mov ecx, dword [ebp - 0x158]
add ecx, dword [eax]
mov dword [ebp - 0xa4], ecx
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0xb0]
jbe 0x100280f3
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1b8]
mov edx, dword [ebp - 0xb0]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0xa4], edx
jae 0x100280f3
mov eax, dword [0x10d30bd0]
and eax, 2
jne 0x10027c28
mov eax, dword [0x10d30bd0]
or eax, 2
mov dword [0x10d30bd0], eax
mov dword [ebp - 4], 0x33
push 0x59c7
call fcn.10049143
pop ecx
mov byte [0x10d30c7c], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x98], 1
mov byte [ebp - 0x97], 0x6a
mov byte [ebp - 0x96], 2
mov byte [ebp - 0x95], 0
mov byte [ebp - 0x94], 0
mov byte [ebp - 0x93], 8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x98]
and eax, 6
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x98]
or ecx, 6
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x98]
mov byte [ebp + eax - 0x160], cl
mov dword [ebp - 0xb8], 2
and dword [ebp - 0x6ac], 0
jmp 0x10027cac
mov eax, dword [ebp - 0xb8]
inc eax
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 6
jae 0x10027d29
mov eax, dword [ebp - 0xb8]
sub eax, dword [ebp - 0x6ac]
movzx eax, byte [ebp + eax - 0x9a]
movsx eax, byte [ebp + eax - 0x160]
mov ecx, dword [ebp - 0xb8]
movzx ecx, byte [ebp + ecx - 0x97]
and ecx, eax
mov eax, dword [ebp - 0xb8]
sub eax, dword [ebp - 0x6ac]
movzx eax, byte [ebp + eax - 0x9a]
movsx eax, byte [ebp + eax - 0x160]
mov edx, dword [ebp - 0xb8]
movzx edx, byte [ebp + edx - 0x97]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0xb8]
movzx eax, byte [ebp + eax - 0x98]
mov byte [ebp + eax - 0x160], dl
jmp 0x10027c9e
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x160], 0
mov eax, dword [0x10d30bd0]
and eax, 4
jne 0x10027d75
mov eax, dword [0x10d30bd0]
or eax, 4
mov dword [0x10d30bd0], eax
mov dword [ebp - 4], 0x34
lea eax, [ebp - 0x160]
push eax
mov ecx, 0x10d30c40
call fcn.1000f512
push 0x1007590c
call fcn.1005d289
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x338], 0
jmp 0x10027d8b
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 4
jae 0x10027da4
mov eax, dword [ebp - 0x338]
mov byte [ebp + eax - 0x160], 0
jmp 0x10027d7e
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x134], eax
movsx eax, byte [0x10d30c7c]
mov ecx, dword [ebp - 0x134]
movsx ecx, byte [ecx]
cmp ecx, eax
je 0x10027dd3
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
jmp 0x10027db0
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
push dword [ebp - 0x134]
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xc5c]
call fcn.10029be8
mov dword [ebp - 4], 0x35
push 0x10d30c40
lea ecx, [ebp - 0xc5c]
call fcn.1000f5a5
lea eax, [ebp - 0xba4]
push eax
lea ecx, [ebp - 0xc5c]
call fcn.1000fca3
push dword [eax]
lea eax, [ebp - 0xad4]
push eax
lea ecx, [ebp - 0xc5c]
call fcn.1000fc8f
push dword [eax]
lea ecx, [ebp - 0xcec]
call fcn.10029c11
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0xcec]
push eax
call fcn.10013b38
pop ecx
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0
je 0x10027ee5
push dword [ebp - 0x134]
lea ecx, [ebp - 0xc74]
call fcn.1000f512
mov byte [ebp - 4], 0x37
lea edx, [ebp - 0x918]
lea ecx, [ebp - 0xc74]
call fcn.100126c9
movzx eax, al
test eax, eax
je 0x10027eb2
push 0
push dword [ebp - 0x918]
push 0
push dword [ebp - 0x38c]
call fcn.10021bc5
add esp, 0x10
mov dword [ebp - 0xa4], eax
jmp 0x10027ed1
push 1
push 0
lea eax, [ebp - 0xc74]
push eax
push dword [ebp - 0x38c]
call fcn.10021bc5
add esp, 0x10
mov dword [ebp - 0xa4], eax
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0xc74]
call fcn.1000f57d
jmp 0x100280d5
mov dword [ebp - 0x8b8], 0x1c43
cmp dword [ebp - 0x8b8], 0xc2b
jge 0x1002809f
lea eax, [ebp - 0x920]
push eax
lea eax, [ebp - 0x180]
push eax
push 0x10007838
call fcn.1005cc6b
add esp, 0xc
push dword [ebp - 0x180]
lea ecx, [ebp - 0x784]
call fcn.1000f62f
mov byte [ebp - 4], 0x38
and dword [ebp - 0x340], 0
jmp 0x10027f45
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x340]
cmp eax, dword [ebp - 0x180]
jge 0x10027f73
push dword [ebp - 0x340]
lea ecx, [ebp - 0x784]
call fcn.1000f696
push eax
push 0x10007710
call fcn.1005cc6b
pop ecx
pop ecx
jmp 0x10027f38
lea eax, [ebp - 0xc3c]
push eax
lea ecx, [ebp - 0x784]
call fcn.100293e8
push dword [eax]
lea eax, [ebp - 0xadc]
push eax
lea ecx, [ebp - 0x784]
call fcn.100291b1
push dword [eax]
call fcn.10029c3c
pop ecx
pop ecx
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x354], eax
and dword [ebp - 0x168], 0
jmp 0x10027fcb
mov eax, dword [ebp - 0x168]
cmp eax, dword [ebp - 0x180]
jge 0x1002807e
cmp dword [ebp + 0x10], 0
jne 0x100280b5
mov ecx, dword [ebp + 0xc]
call fcn.1000f3b7
mov dword [ebp - 0x6c4], eax
jmp 0x100280bf
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x6c4], eax
push dword [ebp - 0x6c4]
push dword [ebp + 8]
call fcn.1001a9f8
pop ecx
pop ecx
mov dword [ebp - 0xa4], eax
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xcec]
call fcn.1002900b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc5c]
call fcn.1000f57d
mov eax, dword [ebp - 0xa4]
jmp 0x100280fd
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret