Function at 0x1000a8b5
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov eax, 0x1007008e
call fcn.1006fa48
sub esp, 0x214
push ebx
push esi
push edi
or edi, 0xffffffff
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov dword [ebp - 0x20], 0xffff
mov byte [ebp - 0x45], dl
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x18], ebx
jmp 0x1000a8ef
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6c], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000a8e5
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x1000a905
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
mov eax, dword [ebp - 0x68]
xor ecx, ecx
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x14], 1
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x68]
sub edx, 6
cmp edx, eax
setl cl
cmp ecx, 4
je 0x1000a92d
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x64]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
test eax, eax
mov eax, dword [ebp - 0x64]
sets cl
add eax, ecx
cmp dword [ebp - 0x68], eax
jl 0x1000a950
cmp dword [ebp - 0x20], ebx
jne 0x1000a950
xor esi, esi
mov eax, ebx
inc esi
jmp 0x1000a955
xor esi, esi
inc esi
mov eax, esi
cmp eax, dword [ebp - 0x20]
jne 0x1000aac8
push esi
lea ecx, [ebp - 0x120]
call fcn.1000f17c
mov dword [ebp - 0x98], edi
xor edx, edx
mov dword [ebp - 0x94], edi
inc edx
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x8c], edi
mov dword [ebp - 0x24], 0xfe617092
mov dword [ebp - 0x18], ebx
jmp 0x1000a9a0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000a991
mov eax, dword [ebp - 0x90]
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x120]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
inc dword [eax]
mov eax, dword [ebp - 0x90]
cmp eax, edx
setne cl
xor esi, esi
mov dword [ebp - 0x90], ecx
xor edx, edx
mov eax, dword [ebp - 0x14]
inc esi
mov eax, dword [ebp - 0x24]
cmp eax, esi
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, 0x5c2caaab
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0xfffffffe
jmp 0x1000aab1
mov dword [ebp - 0x28], 0x1d979388
mov dword [ebp - 0x14], 0xfffffff5
jmp 0x1000aaa4
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x20], ebx
jmp 0x1000aa97
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x98]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x98]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x4c]
sub edx, eax
mov eax, dword [ebp - 0x90]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 4
setl cl
add eax, ecx
mov ecx, dword [ebp - 0x4c]
imul ecx, dword [ebp - 0x14]
imul ecx, eax
mov eax, dword [ebp - 0x120]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x20]
cmp ecx, dword [ebp + eax*4 - 0x98]
jge 0x1000aa78
mov eax, esi
cmp dword [ebp - 0x3c], ebx
jne 0x1000aa7a
mov eax, ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], ebx
jmp 0x1000aa8f
mov dword [ebp - 0x2c], 0x42ac96aa
mov dword [ebp - 0x2c], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x1000aa82
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x1000aa19
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff2
jg 0x1000aa11
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xe
jg 0x1000a9fe
lea ecx, [ebp - 0x120]
call fcn.1000f1fe
jmp 0x1000aaf0
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x1000aaf0
push ebx
push 0x26f9
push 0xe3a
push 0x5ea
push 0x1afb
push 0x145c
call dword [sym.imp.GDI32.dll_PatBlt]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x20], ebx
jmp 0x1000ab13
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1a4], 0x7008b15e
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1000ab02
mov dword [ebp - 0x20], ebx
jmp 0x1000ab2f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x214], 0xb9c279a2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000ab1e
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x24], edi
jne 0x1000ab6f
mov eax, dword [ebp - 0x24]
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setg dl
cmp edx, dword [ebp - 0x24]
je 0x1000ab55
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, esi
setle dl
cmp edx, 0x78ac
je 0x1000ab71
mov eax, ebx
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x28], 0x3ae35568
mov dword [ebp - 0x3c], 0x48c443eb
mov dword [ebp - 0x28], 0xfffffffe
jmp 0x1000abd1
mov dword [ebp - 0x2c], 0x98311173
mov dword [ebp - 0x18], ebx
jmp 0x1000abba
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1b8], 0x9d568d52
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000aba9
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x3c], ebx
jne 0x1000abd7
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x13
jg 0x1000ab9d
mov eax, dword [0x100765fc]
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x24], 0xb03e3869
mov dword [ebp - 0x20], edi
push 4
mov dword [ebp - 0x4c], eax
call fcn.1000f17c
mov dword [ebp - 0x2c], 0x38d10fbf
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x18], ebx
jmp 0x1000ac1f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x174]
mov dword [eax + ecx*4], 0x3fd52a42
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1000ac0c
mov eax, dword [ebp - 0x24]
mov ecx, esi
sub ecx, eax
jne 0x1000ac35
mov edx, ebx
cmp dword [ebp - 0x20], ebx
je 0x1000ac37
mov edx, esi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, eax
setge dl
xor ecx, ecx
sub edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x174]
setle dl
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x24], ebx
jne 0x1000ac85
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x174]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
call fcn.1000f1fe
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
cmp byte [ebp - 0x45], bl
je 0x1000afbe
cmp dword [ebp - 0x4c], esi
jne 0x1000afbe
push 3
pop edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], ebx
jmp 0x1000ace1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x114], 0xb13638ec
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000acd0
mov eax, dword [ebp - 0x110]
push 0xfffffffffffffffa
pop ecx
sub ecx, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], ebx
jl 0x1000ad5a
push 2
lea ecx, [ebp - 0x18c]
call fcn.1000f17c
mov dword [ebp - 0x18], ebx
jmp 0x1000ad22
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18c]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000ad0f
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x114]
mov eax, dword [ebp - 0x110]
cmp ecx, eax
mov eax, dword [ebp - 0x18c]
lea ecx, [ebp - 0x18c]
setle dl
mov dword [eax], edx
call fcn.1000f1fe
dec dword [ebp - 0x28]
jns 0x1000acfd
push 3
pop edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], 0x99841b3c
push 4
pop ecx
mov dword [eax + 8], ecx
mov eax, 0x2d149fe
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x34], 0x585ed065
mov dword [ebp - 0x34], 0x83cc47d1
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x30], 0x30688cdf
mov dword [ebp - 0x34], 0xe404
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x18], ebx
jmp 0x1000adce
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x220], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000adbd
mov dword [ebp - 0x20], ebx
jmp 0x1000afa5
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x14], 0xfffffffd
mov dword [ebp - 0x18], ebx
jmp 0x1000ae01
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1f4], 0xc7e43439
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1000adf0
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], ebx
jl 0x1000afa2
mov dword [ebp - 0x24], 0xfffffffb
lea ecx, [ebp - 0x1c4]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], 0xfffffffc
push 2
call fcn.1000f17c
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x18], ebx
jmp 0x1000ae51
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c4]
mov dword [eax + ecx*4], 0xa519d814
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000ae3e
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000ae69
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x24], 3
cmp dword [ebp - 0x24], ebx
jl 0x1000af85
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10009260]
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0x1d4]
mov dword [ebp - 0x34], edi
push eax
mov dword [ebp - 0x34], edi
lea ecx, [ebp - 0xec]
push ebx
movdqu xmmword [ebp - 0x1d4], xmm0
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], ebx
call fcn.10011cd5
xor eax, eax
lea ecx, [ebp - 0x168]
inc eax
push eax
mov byte [ebp - 4], al
call fcn.1000f17c
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x1000aeeb
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x168]
mov dword [eax + ecx*4], 0xdf27
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000aed8
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0xfc], ebx
je 0x1000af1e
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xec]
mov eax, dword [ecx + 4]
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xfc]
mov eax, dword [ebp - 0x168]
cmp dword [eax], ebx
jg 0x1000af20
mov edx, ebx
mov eax, dword [ebp - 0x1f0]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x1f0], ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + eax*4 - 0xfc]
mov eax, dword [ebp - 0x28]
sub edx, ecx
mov dword [ebp + eax*4 - 0xfc], edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
imul ecx, edx
inc dword [ebp - 0x14]
cmp eax, ecx
jg 0x1000af5e
xor esi, esi
inc esi
jmp 0x1000af60
mov esi, ebx
mov dword [ebp - 0x30], esi
lea ecx, [ebp - 0x168]
call fcn.1000f1fe
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], bl
call fcn.1000f1fe
dec dword [ebp - 0x24]
jns 0x1000ae79
lea ecx, [ebp - 0x1c4]
mov dword [ebp - 4], edi
call fcn.1000f1fe
dec dword [ebp - 0x28]
jns 0x1000ae12
push 4
pop ecx
push 3
pop edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
je 0x1000addb
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x100765fc
push 2
pop esi
mov dword [ebp - 0x24], 0x7ddc85f7
lea ecx, [ebp - 0x15c]
push esi
call fcn.1000f17c
mov dword [ebp - 4], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x20], ebx
jmp 0x1000aff2
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x15c]
mov dword [eax + ecx*4], 0x4b7c7008
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000afdf
xor ecx, ecx
mov dword [ebp - 0x20], ebx
inc ecx
jmp 0x1000b00c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe0], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000afff
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0xfffffffc
jl 0x1000b0c4
mov edi, dword [ebp - 0x15c]
push ecx
mov dword [ebp - 0x28], 0xfffffffc
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x2c], 7
call fcn.1000f17c
xor esi, esi
mov dword [ebp - 0x18], ebx
inc esi
jmp 0x1000b059
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x144]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000b046
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jne 0x1000b06c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x144]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x24]
setne dl
mov dword [edi + 4], edx
mov dword [ebp - 0x2c], edx
xor edx, edx
cmp dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x144]
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0xe0], eax
call fcn.1000f1fe
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffc
push 1
pop ecx
jge 0x1000b024
or edi, 0xffffffff
lea ecx, [ebp - 0x15c]
mov dword [ebp - 4], edi
call fcn.1000f1fe
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x44], eax
jge 0x1000bc04
push 4
lea ecx, [ebp - 0x180]
call fcn.1000f17c
mov dword [ebp - 4], 3
mov dword [ebp - 0x3c], 0xce2e7c52
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x20], ebx
jmp 0x1000b115
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb4], 0xc64a6847
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000b104
mov dword [ebp - 0x20], ebx
jmp 0x1000b133
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x180]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000b120
mov ecx, dword [ebp - 0x180]
mov dword [ebp - 0x24], ecx
mov dword [ecx + 0xc], ebx
mov dword [ebp - 0x14], 6
xor eax, eax
mov dword [ebp - 0x18], 0xcfdfe924
inc eax
mov dword [ebp - 0x28], 0x435c5265
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 3
jle 0x1000b270
xor esi, esi
inc esi
mov eax, dword [ebp - 0x28]
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 4]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ecx + 0xc]
mov eax, dword [ebp + eax*4 - 0xb4]
mov eax, dword [ecx + 0xc]
mov eax, dword [ebp + eax*4 - 0xb4]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
mov eax, dword [eax + 0xc]
mov eax, dword [ebp + eax*4 - 0xb4]
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setle cl
xor edx, edx
cmp ecx, 0x2535b5b0
mov ecx, 0x8bee6dab
setl dl
add eax, edx
cmp ecx, eax
sbb eax, eax
inc eax
cmp esi, eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov ecx, dword [ebp - 0x24]
setne dl
mov dword [ebp - 0x2c], edx
inc dword [ecx + 0xc]
cmp dword [ecx + 0xc], 3
jle 0x1000b145
dec dword [ebp - 0x38]
lea ecx, [ebp - 0x180]
mov dword [ebp - 4], edi
call fcn.1000f1fe
cmp dword [ebp - 0x44], 0
mov ecx, 0x10076600
mov dword [ebp - 0x20], ecx
jle 0x1000b6c7
mov dword [ebp - 0x18], 0x2bd7b1c2
lea ecx, [ebp - 0x138]
push 3
call fcn.1000f17c
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x38], 0x6524f204
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], ebx
push 3
call fcn.1000f17c
push 3
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x1000b3d1
xor eax, eax
inc eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x2c], 0x1a96
cmp dword [ebp - 0x2c], 0xdb5
jge 0x1000b315
push 4
lea ecx, [ebp - 0x12c]
call fcn.1000f240
push 4
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x12c]
pop edi
push esi
push 0x10007734
call fcn.100573eb
pop ecx
add esi, 4
pop ecx
dec edi
jne 0x1000b2aa
mov edx, dword [ebp - 0x128]
mov eax, edx
mov esi, dword [ebp - 0x12c]
sub eax, esi
mov byte [ebp - 0x10c], bl
mov ecx, esi
push dword [ebp - 0x10c]
sar eax, 2
push eax
call fcn.10011fe6
mov ecx, dword [esi + 0xc]
mov eax, ecx
sub eax, dword [esi + 8]
push eax
mov eax, ecx
sub ecx, dword [esi]
sub eax, dword [esi + 4]
push eax
push ecx
push 0x10007740
call fcn.10057a33
add esp, 0x18
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x12c]
call fcn.1000f1fe
or edi, 0xffffffff
xor esi, esi
mov dword [ebp - 0x7c], ebx
inc esi
cmp dword [ebp - 0x7c], 3
jg 0x1000b3a9
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x7c]
cmp dword [ebp + eax*4 - 0xb4], ebx
jne 0x1000b3a9
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0xb4]
mov eax, dword [ebp - 0x7c]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
sub edx, 0x1db
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
cmp ecx, 0xfffffffd
jge 0x1000b371
cmp dword [ebp - 0x14], ebx
jne 0x1000b371
mov ecx, ebx
cmp dword [ebp - 0x74], ebx
je 0x1000b373
mov ecx, esi
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xb4]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp + eax*4 - 0xb4]
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xb4]
cmp eax, esi
setg cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x7c]
jmp 0x1000b31b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x1000b26d
mov ecx, dword [ebp - 0x24]
jmp 0x1000b173
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x138]
mov dword [eax + ecx*4], 0x807c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000b3be
mov dword [ebp - 0x14], ebx
jmp 0x1000b3ee
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], 0xf37911b9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000b3db
mov ecx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x2c], ecx
cmp eax, dword [ecx + 8]
jg 0x1000b410
mov eax, dword [ebp - 0x138]
cmp dword [eax], ebx
mov eax, esi
jne 0x1000b412
mov eax, ebx
mov ecx, dword [ebp - 0x38]
add ecx, eax
xor eax, eax
imul ecx, dword [ebp - 0x18]
cmp ecx, 0x55a63a74
setg al
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jne 0x1000b435
mov edx, esi
cmp dword [ebp - 0x18], ebx
je 0x1000b437
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
neg edx
cmp eax, edx
mov eax, dword [ebp - 0x2c]
setge cl
imul ecx, dword [eax + 8]
imul eax, ecx, 7
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
neg ecx
sub eax, ecx
xor ecx, ecx
cmp eax, 7
mov eax, dword [ebp - 0x150]
setge cl
mov dword [eax], ecx
lea ecx, [ebp - 0x150]
call fcn.1000f1fe
lea ecx, [ebp - 0x138]
mov dword [ebp - 4], edi
call fcn.1000f1fe
mov eax, dword [ebp - 0x20]
push 2
mov ecx, dword [eax]
add eax, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0xc0]
mov eax, dword [eax]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], 0xbbef7d65
mov dword [ebp - 0x50], eax
call fcn.1000f17c
push 4
pop esi
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 4], 6
call fcn.1000f17c
mov dword [ebp - 0x24], 0xd95921ba
xor edx, edx
inc edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x30], 0x1992
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x14], ebx
jmp 0x1000b4f6
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000b4e3
mov dword [ebp - 0x14], ebx
jmp 0x1000b512
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x88], 0xffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000b501
mov dword [ebp - 0x14], ebx
jmp 0x1000b52b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x108]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000b51c
mov dword [ebp - 0x14], ebx
jmp 0x1000b53f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x80], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000b535
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x108]
mov edx, dword [ebp - 0xc0]
imul ecx, eax
xor eax, eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x3c], esi
cmp ecx, 0xfffffffe
mov dword [ebp - 0x88], ecx
sete al
xor ecx, ecx
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [edx + 4]
mov eax, dword [ebp - 0xc0]
setle cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x28]
setge dl
sub eax, edx
sub eax, dword [ebp - 0x18]
cmp eax, 0x714f
jg 0x1000b5f1
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x1000b5b3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x84], 0x4af7bdd4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000b5a2
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000b5cb
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0xc0]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
cmp ecx, dword [eax]
jge 0x1000b5ea
cmp dword [ebp - 0x84], ebx
jne 0x1000b5ec
mov edx, ebx
mov dword [ebp - 0x18], edx
jmp 0x1000b5ff
mov dword [ebp - 0x2c], 0x336a
mov dword [ebp - 0x2c], 0xfffffffd
mov eax, dword [esi + 8]
mov ecx, edi
mov dword [ebp - 0x24], eax
xor edx, edx
mov eax, dword [ebp - 0x24]
sub ecx, eax
cmp ecx, 0x520c
mov ecx, dword [ebp - 0x108]
setl dl
xor eax, eax
cmp edx, 0xffff
setne al
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ecx + 4]
sub ecx, eax
je 0x1000b645
cmp dword [esi + 8], ebx
je 0x1000b645
xor esi, esi
inc esi
mov dword [ebp - 0x80], esi
mov eax, dword [ebp - 0x24]
jmp 0x1000b64b
xor esi, esi
mov dword [ebp - 0x80], ebx
inc esi
mov edx, dword [ebp - 0x3c]
xor ecx, ecx
mov dword [ebp - 0x18], 0xc0f1fa6f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x88]
cmp dword [edx + 8], eax
mov eax, dword [ebp - 0x30]
setle cl
sub ecx, eax
xor eax, eax
cmp ecx, dword [edx + 8]
mov edx, dword [ebp - 0x14]
setl al
xor ecx, ecx
cmp eax, dword [edx + 4]
mov eax, dword [ebp - 0x108]
setl cl
cmp esi, ecx
sbb ecx, ecx
neg ecx
mov dword [eax + 0xc], ecx
lea ecx, [ebp - 0x108]
call fcn.1000f1fe
lea ecx, [ebp - 0xc0]
mov dword [ebp - 4], edi
call fcn.1000f1fe
mov eax, dword [ebp - 0x20]
add eax, 4
cmp dword [ebp - 0x50], 0
jne 0x1000b6b8
add eax, 8
add eax, dword [ebp - 0x40]
dec dword [ebp - 0x44]
mov dword [ebp - 0x20], eax
jne 0x1000b22d
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10009270]
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp - 0x1e4]
mov dword [ebp - 0x14], esi
push eax
push ebx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xa4], ebx
movdqu xmmword [ebp - 0x1e4], xmm0
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
call fcn.10011cd5
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x40], 7
mov dword [ebp - 0x50], edi
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jne 0x1000b738
cmp dword [ebp - 0x14], 0x945cb81e
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x14]
jle 0x1000b738
mov ecx, ebx
cmp dword [ebp - 0x14], ebx
je 0x1000b73a
mov ecx, esi
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x14]
jg 0x1000b759
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x2c], eax
mov dword [eax + 0xc], 0xa66e
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0x79dc8669
setl cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], esi
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xa4]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, dword [eax + 4]
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x14]
cmp esi, eax
mov eax, dword [ebp - 0xa4]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, dword [eax + 8]
mov eax, dword [ebp - 0x24]
setle dl
sub edx, eax
mov eax, dword [ebp - 0x50]
add eax, 0x4c757c5b
add eax, edx
je 0x1000b822
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0xc], ebx
je 0x1000b822
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000b807
push 0xcfd
push ebx
push ebx
push 0x251f
push 0xf28
push ebx
push 0xf82
call dword [sym.imp.GDI32.dll_GetDIBits]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000b842
push 0x1cc
push 0xc10
call dword [sym.imp.USER32.dll_SetParent]
jmp 0x1000b842
mov dword [ebp - 0x40], 0x95b915f7
mov dword [ebp - 0x24], 0xffffffe6
jmp 0x1000b83c
mov dword [ebp - 0x40], 0x1e9426ce
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff1
jne 0x1000b832
lea ecx, [ebp - 0xa4]
call fcn.1000f1fe
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
add eax, 4
mov dword [ebp - 0x18], 0x76820624
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], ebx
jmp 0x1000b878
cmp byte [ebp - 0x19], 0
je 0x1000b875
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe9
mov byte [ebp - 0x19], bl
jle 0x1000b867
cmp byte [ebp - 0x19], 0
je 0x1000b898
push ebx
push 0x121e
push 0x2102
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ecx, dword [ebp - 0x20]
push esi
mov eax, dword [ecx]
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x38], 0x98311173
mov dword [ebp - 0x40], 0x45625132
mov dword [ebp - 0x34], eax
call fcn.1000f17c
mov dword [ebp - 0x44], 0x7182b474
xor edx, edx
mov dword [ebp - 0x40], 0xa167c28c
inc edx
mov dword [ebp - 0x14], ebx
jmp 0x1000b8e6
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000b8d3
mov dword [ebp - 0x14], ebx
jmp 0x1000b901
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x204], 0xbc9fa8bc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000b8f0
cmp dword [ebp - 0x18], ebx
je 0x1000b918
mov eax, dword [ebp - 0x44]
mov esi, edx
dec dword [ebp - 0x44]
test eax, eax
jne 0x1000b91a
mov esi, ebx
mov eax, dword [ebp - 0xcc]
xor ecx, ecx
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xcc]
mov edx, dword [eax]
mov eax, dword [ebp - 0x18]
cmp eax, esi
mov eax, dword [ebp - 0xcc]
setg cl
mov dword [ebp - 0x204], edx
imul ecx, dword [eax]
mov eax, dword [ebp - 0x38]
add eax, ecx
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0xcc]
call fcn.1000f1fe
mov ecx, dword [ebp - 0x20]
mov eax, 0x40a16501
mov dword [ebp - 0x24], 0x110c93b4
add ecx, 4
mov dword [ebp - 0x14], 0xf759609c
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], 0xffff
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0x17
mov dword [ebp - 0x20], ecx
jle 0x1000bb0d
xor esi, esi
lea ecx, [ebp - 0xd8]
inc esi
push esi
call fcn.1000f17c
xor edx, edx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1000b9e5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xd8]
mov dword [eax + ecx*4], 0xbde64f6c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000b9d2
mov dword [ebp - 0x14], ebx
jmp 0x1000b9f9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x54], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000b9ef
mov eax, dword [ebp - 0x24]
mov ecx, 0x87778e10
mov eax, dword [ebp - 0xd8]
dec dword [eax]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xd8]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x38]
sbb ecx, ecx
neg ecx
sub ecx, 0xbdf7
imul eax, ecx
cmp eax, 0xac3efc16
jbe 0x1000ba3c
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], 0x3efc
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0xd8]
mov edx, dword [eax]
mov eax, dword [ebp - 0x14]
sub edx, ecx
add eax, edx
mov dword [ebp - 0x18], eax
je 0x1000bae2
mov dword [ebp - 0x3c], 0x2623
mov dword [ebp - 0x18], ebx
jmp 0x1000bada
mov dword [ebp - 0x50], 0x106df3f1
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x14], edi
jmp 0x1000bad1
mov dword [ebp - 0x40], 0x9999
mov dword [ebp - 0x30], 0xfffffffd
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], 0xd71021f5
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x2c], ebx
je 0x1000bac4
mov eax, dword [ebp - 0x54]
neg eax
je 0x1000bac1
mov eax, dword [ebp - 0x3c]
mov ecx, 0x543c
sub ecx, eax
sub ecx, dword [ebp - 0x44]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2c], 0xfffffffb
sbb eax, eax
inc eax
mov dword [ebp - 0x54], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffec
jne 0x1000ba7e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x16
jne 0x1000ba6f
jmp 0x1000baf2
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000baf2
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [ebp - 0xd8]
call fcn.1000f1fe
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x17
jg 0x1000b9b8
mov ecx, dword [ebp - 0x20]
xor eax, eax
inc eax
cmp dword [ebp - 0x34], 0
mov dword [ebp - 0x14], eax
jne 0x1000bc04
cmp byte [ebp - 0x45], 0
mov esi, dword [ebp - 0x28]
je 0x1000bb34
cmp dword [ebp - 0x4c], eax
jne 0x1000bb34
mov edx, dword [ebp + 8]
lea eax, [esi + 0x10]
add dword [edx + 8], eax
mov eax, dword [ecx]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 4]
add ecx, 8
push esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], ecx
call fcn.10052b1c
pop ecx
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x60]
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xdc], ebx
push eax
push esi
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
call fcn.1000f93e
mov edx, ebx
mov dword [ebp - 0x3c], edx
test esi, esi
jle 0x1000bbe2
mov ecx, dword [ebp - 0x20]
xor esi, esi
mov edi, dword [ebp - 0x60]
inc esi
mov eax, edx
and eax, 0x80000001
jns 0x1000bb8e
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x2c]
add eax, edx
add eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x34]
cdq
idiv dword [ebp - 0x28]
cmp word [edi + edx*2], bx
je 0x1000bbc0
mov ecx, dword [ebp - 0x60]
mov edi, dword [ebp - 0x28]
lea eax, [edx + 1]
cdq
idiv edi
cmp word [ecx + edx*2], bx
jne 0x1000bbae
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x60]
mov word [edi + edx*2], si
mov al, byte [edx + ecx]
mov edx, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x38]
mov byte [edx + edi], al
inc edx
mov edi, dword [ebp - 0x60]
mov dword [ebp - 0x3c], edx
cmp edx, dword [ebp - 0x28]
jl 0x1000bb80
mov esi, dword [ebp - 0x28]
or edi, 0xffffffff
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x38]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x60]
mov dword [ecx], esi
test eax, eax
je 0x1000bc04
push eax
call fcn.10057c3a
pop ecx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x28], 0x3099cfe0
mov dword [ebp - 0x38], 0x1aa2
cmp dword [ebp - 0x38], 0x1de4
jle 0x1000bc7b
mov esi, ebx
mov dword [ebp - 0x3c], ebx
mov eax, ebx
mov dword [ebp - 0x2c], ebx
and eax, esi
mov edi, ebx
mov dword [ebp - 0x34], eax
mov esi, eax
mov dword [ebp - 0x34], ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x106177f8
xor eax, esi
cdq
push edx
push eax
call fcn.1000ef24
inc ebx
cmp ebx, 0x2eb6
jl 0x1000bc31
inc edi
push 0
pop ebx
cmp edi, 0x33d1
jl 0x1000bc2e
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x72cd
jl 0x1000bc25
inc esi
mov dword [ebp - 0x3c], esi
cmp esi, 0x864
jl 0x1000bc20
or edi, 0xffffffff
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 7
cmp dword [ebp - 0x38], 0x19e8
jge 0x1000bcc4
mov edx, 0x10007750
mov ecx, 0x106177f8
call fcn.100115a3
jmp 0x1000bcc1
xor eax, eax
inc eax
push eax
lea ecx, [ebp - 0x1b0]
mov dword [ebp - 4], edi
call fcn.1000f17c
xor esi, esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x18], ebx
inc esi
jmp 0x1000bcf1
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1b0]
mov dword [eax + ecx*4], 0x41fd9d08
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000bcde
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x34], ebx
mov byte [ebp - 0x19], bl
je 0x1000bd25
cmp byte [ebp - 0x19], 0
je 0x1000bd3c
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
jmp 0x1000bd3c
cmp byte [ebp - 0x19], 0
je 0x1000bd3c
push 0x2441
push ebx
push 0x1b34
call dword [sym.imp.GDI32.dll_Polygon]
lea ecx, [ebp - 0x1b0]
call fcn.1000f1fe
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret