Function at 0x1001937a
Capabilities:
Check os version
Clear file content
Create directory
Extract resource via kernel32 functions
Get file attributes
Modify service
Parse pe header
Query or enumerate registry value
Read .ini file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006f049
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xf84
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x848], 0x42ea
mov dword [ebp - 0x94c], 0x10007c90
cmp dword [ebp - 0x848], 0x459f
jle 0x1001946f
and dword [ebp - 0x2c8], 0
jmp 0x100193d9
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0x5cf6
jge 0x1001946f
and dword [ebp - 0x290], 0
jmp 0x100193ff
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0x2ab0
jge 0x1001946a
and dword [ebp - 0x220], 0
jmp 0x10019421
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0x33c7
jge 0x10019468
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [ebp - 0x290]
sar eax, cl
mov ecx, dword [ebp - 0x220]
shl eax, cl
cdq
mov dword [ebp - 0x968], eax
mov dword [ebp - 0x964], edx
push dword [ebp - 0x964]
push dword [ebp - 0x968]
mov ecx, 0x10617278
call fcn.10021772
jmp 0x10019414
jmp 0x100193f2
jmp 0x100193cc
cmp dword [ebp + 0x10], 0
jbe 0x1001965d
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001965d
mov dword [ebp - 0x9e0], 0xfff8
mov dword [ebp - 0x40], 0xededb5ca
mov dword [ebp - 0x144], 0xb6dad816
mov dword [ebp - 0x330], 0x7863718b
mov dword [ebp - 0x840], 0x711db608
mov dword [ebp - 0x2bc], 0
jmp 0x100194cd
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 4
jge 0x100194e9
mov eax, dword [ebp - 0x2bc]
mov dword [ebp + eax*4 - 0xf94], 0x23dec995
jmp 0x100194c0
cmp dword [ebp - 0x40], 0
je 0x1001952a
mov eax, dword [ebp - 0x40]
sub eax, 0x1dd61236
jne 0x100194fd
cmp dword [ebp - 0x40], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x40]
add eax, 0x3e05
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
add eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
sub ecx, eax
je 0x1001952a
mov dword [ebp - 0x478], 1
jmp 0x10019531
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0xffff
je 0x10019555
mov dword [ebp - 0x820], 1
jmp 0x1001955c
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x9e0]
cmp eax, dword [ebp - 0x820]
jle 0x10019576
mov dword [ebp - 0x828], 1
jmp 0x1001957d
and dword [ebp - 0x828], 0
cmp dword [ebp - 0x828], 0x5d76270
jge 0x10019595
mov dword [ebp - 0x830], 1
jmp 0x1001959c
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x830], eax
jg 0x100195b3
mov dword [ebp - 0x838], 1
jmp 0x100195ba
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x838]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x840], eax
mov dword [ebp - 0x144], 3
jmp 0x100195e2
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jl 0x10019649
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x840], eax
mov dword [ebp - 0x40], 0
jmp 0x10019607
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jg 0x10019647
mov byte [ebp - 0x136], 0
movzx eax, byte [ebp - 0x136]
test eax, eax
je 0x10019627
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x10019645
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
jmp 0x10019600
jmp 0x100195d5
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.100130c6
pop ecx
pop ecx
jmp 0x100203ca
and dword [ebp - 4], 0
cmp dword [ebp - 0x848], 0x4289
jge 0x1001967d
mov edx, dword [ebp - 0x94c]
mov ecx, 0x10617278
call fcn.10025ce5
jmp 0x10019699
or dword [ebp - 4], 0xffffffff
jmp 0x100196a3
mov dword [ebp - 0xbfc], 0xfffffffc
mov dword [ebp - 0xd90], 0xfe01bd97
mov dword [ebp - 0xbb4], 0xffffffff
mov dword [ebp - 0x850], 0x56e700d6
mov dword [ebp - 0x8c], 0
jmp 0x100196e4
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x10019700
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xf6c], 0xfffffffd
jmp 0x100196d7
mov dword [ebp - 0x8c], 0
jmp 0x10019719
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x10019735
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xe88], 0
jmp 0x1001970c
mov eax, dword [ebp - 0x850]
dec eax
mov dword [ebp - 0x850], eax
cmp dword [ebp + 0x10], 0
jne 0x1001d1c5
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.1000aa0e
mov dword [ebp - 0x264], eax
push 2
lea ecx, [ebp - 0x8c8]
call fcn.100219b2
mov dword [ebp - 4], 2
mov dword [ebp - 0xa4], 0xc184c506
mov dword [ebp - 0x860], 0xffffffff
mov dword [ebp - 0x95c], 0x16eb2d36
mov dword [ebp - 0x228], 0
jmp 0x100197a8
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 2
jge 0x100197c7
push dword [ebp - 0x228]
lea ecx, [ebp - 0x8c8]
call fcn.10021a50
and dword [eax], 0
jmp 0x1001979b
mov dword [ebp - 0xa4], 0
jmp 0x100197e0
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jg 0x100199ef
mov dword [ebp - 0x388], 0x7cfaf42
mov dword [ebp - 0x338], 1
mov dword [ebp - 0x954], 1
mov dword [ebp - 0x2c4], 0
jmp 0x10019824
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 1
jge 0x10019840
mov eax, dword [ebp - 0x2c4]
mov dword [ebp + eax*4 - 0x664], 8
jmp 0x10019817
mov esi, dword [ebp - 0xa4]
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x8c8]
call fcn.10021a50
cmp dword [eax], esi
jne 0x10019867
mov dword [ebp - 0x858], 1
jmp 0x1001986e
and dword [ebp - 0x858], 0
push 0
lea ecx, [ebp - 0x8c8]
call fcn.10021a50
mov ecx, dword [ebp - 0x858]
imul ecx, dword [eax]
mov eax, dword [ebp - 0x388]
mov edx, dword [ebp - 0x388]
inc edx
mov dword [ebp - 0x388], edx
cmp eax, ecx
jne 0x100198b9
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x860], 0
jne 0x100198b9
and dword [ebp - 0x880], 0
jmp 0x100198c3
mov dword [ebp - 0x880], 1
mov dword [ebp - 0x338], 1
mov esi, dword [ebp - 0x338]
push 1
lea ecx, [ebp - 0x8c8]
call fcn.10021a50
sub esi, dword [eax]
je 0x10019906
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x8c8]
call fcn.10021a50
cmp dword [eax], 0
je 0x10019906
mov dword [ebp - 0x868], 1
jmp 0x1001990d
and dword [ebp - 0x868], 0
cmp dword [ebp - 0x868], 0x74ad
jge 0x10019925
mov dword [ebp - 0x784], 1
jmp 0x1001992c
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x880]
cmp eax, dword [ebp - 0x784]
jle 0x10019946
mov dword [ebp - 0x818], 1
jmp 0x1001994d
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x818]
neg eax
cmp eax, dword [ebp - 0xa4]
jne 0x10019969
mov dword [ebp - 0x41c], 1
jmp 0x10019970
and dword [ebp - 0x41c], 0
cmp dword [ebp - 0x41c], 5
jge 0x1001998b
cmp dword [ebp - 0x338], 0
jne 0x1001998b
and dword [ebp - 0x394], 0
jmp 0x10019995
mov dword [ebp - 0x394], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x394]
mov dword [ebp + eax - 0x664], ecx
cmp dword [ebp - 0x394], 0
je 0x100199cd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x664], 0
je 0x100199cd
mov dword [ebp - 0x424], 1
jmp 0x100199d4
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x954], eax
mov dword [ebp - 0x95c], 0xf37911b9
jmp 0x100197d3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c8]
call fcn.10021a34
mov dword [ebp - 0x188], 0x5d6c05ba
mov dword [ebp - 0xbb8], 0xe6f7fbf2
mov dword [ebp - 0x188], 0
jmp 0x10019a2b
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xffffffe6
jg 0x10019acf
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 0x230], 0
jmp 0x10019a5b
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 2
jge 0x10019a77
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0xe98], 0xde0b4074
jmp 0x10019a4e
mov dword [ebp - 0x2cc], 0
jmp 0x10019a90
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 1
jg 0x10019aca
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x10019abd
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 0x188], 0
je 0x10019ac8
jmp 0x10019aca
jmp 0x10019a83
jmp 0x10019a1e
mov dword [ebp - 0xbc0], 0xffffffff
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x10019af5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 0x137], 0
movzx eax, byte [ebp - 0x137]
test eax, eax
je 0x10019b11
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
cmp dword [0x106183d0], 0
jne 0x1001d141
mov dword [ebp - 0x9d0], 0xfa50
lea eax, [ebp - 0x9d0]
push eax
call fcn.1001308d
pop ecx
mov dword [ebp - 0x7fc], eax
mov dword [ebp - 0x238], 1
mov dword [ebp - 0x78], 0
jmp 0x10019b55
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x10019b6b
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xea0], 3
jmp 0x10019b4e
mov dword [ebp - 0x78], 0
jmp 0x10019b7b
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x10019b91
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xef4], 1
jmp 0x10019b74
mov dword [ebp - 0x238], 0
jmp 0x10019baa
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 1
jg 0x10019c07
mov dword [ebp - 0xbc8], 0x91f7
mov dword [ebp - 0xbd0], 1
mov dword [ebp - 0xbd8], 0xaa810d21
mov dword [ebp - 0x874], 0
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x10019bf8
push 0x1beb
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0x874]
inc eax
mov dword [ebp - 0x874], eax
jmp 0x10019b9d
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x2d4], 0
jmp 0x10019c27
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 2
jge 0x10019c43
mov eax, dword [ebp - 0x2d4]
mov dword [ebp + eax*4 - 0xb04], 0x108f8256
jmp 0x10019c1a
mov dword [ebp - 0x6c], 4
jmp 0x10019c53
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x14
jg 0x10019ca1
mov byte [ebp - 0x139], 0
movzx eax, byte [ebp - 0x139]
test eax, eax
je 0x10019c71
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x10019c9f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x10019c4c
mov dword [ebp - 0x6c], 1
jmp 0x10019cb1
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jl 0x10019ccd
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp + eax*4 - 0xb04]
mov ecx, dword [ebp - 0x6c]
mov dword [ebp + ecx*4 - 0xb04], eax
jmp 0x10019caa
mov byte [ebp - 0x1f0], 3
mov byte [ebp - 0x1ef], 0xe3
mov byte [ebp - 0x1ee], 9
mov byte [ebp - 0x1ed], 0x38
mov byte [ebp - 0x1ec], 8
mov byte [ebp - 0x1eb], 1
mov byte [ebp - 0x1ea], 4
mov byte [ebp - 0x1e9], 0xa
mov byte [ebp - 0x1e8], 1
mov byte [ebp - 0x1e7], 0x62
mov byte [ebp - 0x1e6], 1
mov byte [ebp - 0x1e5], 0
mov byte [ebp - 0x1e4], 2
mov byte [ebp - 0x1e3], 0x11
mov byte [ebp - 0x1e2], 0xa
mov byte [ebp - 0x1e1], 0x31
mov byte [ebp - 0x1e0], 5
mov byte [ebp - 0x1df], 0x37
mov byte [ebp - 0x1de], 0xc
mov byte [ebp - 0x1dd], 0x25
mov byte [ebp - 0x1dc], 6
mov byte [ebp - 0x1db], 0x24
mov byte [ebp - 0x1da], 0
mov byte [ebp - 0x1d9], 0x34
mov byte [ebp - 0x1d8], 7
mov byte [ebp - 0x1d7], 0x2e
mov byte [ebp - 0x1d6], 0xb
mov byte [ebp - 0x1d5], 0x11
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1f0]
and eax, 0xb5
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1f0]
or ecx, 0xb5
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1f0]
mov byte [ebp + eax - 0x8e4], cl
mov dword [ebp - 0x17c], 9
mov dword [ebp - 0x240], 0
jmp 0x10019df2
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 3
jge 0x10019e0e
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xb48], 0x6bacd795
jmp 0x10019de5
mov dword [ebp - 0x17c], 0
jmp 0x10019e27
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0x17
jl 0x1001a116
mov dword [ebp - 0xdc], 0x94543beb
mov dword [ebp - 0x42c], 1
push 1
lea ecx, [ebp - 0xae4]
call fcn.100219b2
mov dword [ebp - 4], 3
push 1
lea ecx, [ebp - 0xac0]
call fcn.100219b2
mov byte [ebp - 4], 4
mov dword [ebp - 0x94], 0
jmp 0x10019e86
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x10019ea8
push dword [ebp - 0x94]
lea ecx, [ebp - 0xae4]
call fcn.10021a50
mov dword [eax], 0x622b
jmp 0x10019e79
mov dword [ebp - 0x94], 0
jmp 0x10019ec1
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x10019ee3
push dword [ebp - 0x94]
lea ecx, [ebp - 0xac0]
call fcn.10021a50
mov dword [eax], 0x65e4bc79
jmp 0x10019eb4
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xdc], 0
jmp 0x10019f09
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 3
jg 0x1001a0f3
mov dword [ebp - 0x170], 1
mov dword [ebp - 0x9e8], 0x2c237796
cmp dword [ebp - 0x170], 0
jne 0x10019f43
push 0xfffffffffffffffc
pop eax
test eax, eax
jne 0x10019f43
and dword [ebp - 0x434], 0
jmp 0x10019f4d
mov dword [ebp - 0x434], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb48]
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 1
jle 0x10019f75
mov dword [ebp - 0x66c], 1
jmp 0x10019f7c
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x66c]
neg eax
cmp eax, dword [ebp - 0x17c]
jne 0x10019f98
mov dword [ebp - 0x9d8], 1
jmp 0x10019f9f
and dword [ebp - 0x9d8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb48]
mov dword [ebp - 0xbe0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb48]
cmp dword [ebp - 0x434], eax
jle 0x10019fcf
mov eax, 0xdb88
test eax, eax
je 0x10019fea
push 0
lea ecx, [ebp - 0xae4]
call fcn.10021a50
cmp dword [eax], 0
jne 0x10019fea
and dword [ebp - 0x78c], 0
jmp 0x10019ff4
mov dword [ebp - 0x78c], 1
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x78c]
jge 0x1001a00e
mov dword [ebp - 0x43c], 1
jmp 0x1001a015
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x43c], 0x10d3
jge 0x1001a02d
mov dword [ebp - 0x674], 1
jmp 0x1001a034
and dword [ebp - 0x674], 0
mov esi, dword [ebp - 0x170]
push 0
lea ecx, [ebp - 0xae4]
call fcn.10021a50
mov ecx, dword [ebp - 0x674]
sub ecx, dword [eax]
cmp ecx, esi
jge 0x1001a05f
mov dword [ebp - 0x8e8], 1
jmp 0x1001a066
and dword [ebp - 0x8e8], 0
mov esi, dword [ebp - 0x17c]
push 0
lea ecx, [ebp - 0xac0]
call fcn.10021a50
mov dword [eax], esi
push 0
lea ecx, [ebp - 0xac0]
call fcn.10021a50
mov eax, dword [eax]
mov dword [ebp - 0x9e8], eax
mov dword [ebp - 0x170], 0xffffffe7
jmp 0x1001a0a9
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0x2e
je 0x1001a0ee
mov byte [ebp - 0x13b], 0
movzx eax, byte [ebp - 0x13b]
test eax, eax
je 0x1001a0cf
push 0xa51
call dword [sym.imp.USER32.dll_IsZoomed]
mov byte [ebp - 0xd2], 0
movzx eax, byte [ebp - 0xd2]
test eax, eax
je 0x1001a0ec
push 0x2701
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
jmp 0x1001a09c
jmp 0x10019efc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xac0]
call fcn.10021a34
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xae4]
call fcn.10021a34
jmp 0x10019e1a
mov dword [ebp - 0x1c], 2
and dword [ebp - 0x198], 0
jmp 0x1001a12e
mov eax, dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1c
jae 0x1001b550
mov dword [ebp - 0x48], 0xfffffffa
push 2
lea ecx, [ebp - 0xa40]
call fcn.100219b2
mov dword [ebp - 4], 5
mov dword [ebp - 0x454], 0x52bf390f
mov dword [ebp - 0x2dc], 0
jmp 0x1001a176
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 2
jge 0x1001a198
push dword [ebp - 0x2dc]
lea ecx, [ebp - 0xa40]
call fcn.10021a50
mov dword [eax], 1
jmp 0x1001a169
mov dword [ebp - 0x48], 0
jmp 0x1001a1a8
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xfffffff2
jge 0x1001a1d4
mov byte [ebp - 0xd3], 0
movzx eax, byte [ebp - 0xd3]
test eax, eax
je 0x1001a1d2
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1001a1a1
mov dword [ebp - 0x48], 1
jmp 0x1001a1e4
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x1001a544
mov dword [ebp - 0x150], 0xf288
mov dword [ebp - 0x444], 0x5bf
mov dword [ebp - 0x9f8], 0x10007d18
cmp dword [ebp - 0x444], 0x7fa
jle 0x1001a2c4
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
and dword [ebp - 0x248], 0
jmp 0x1001a23a
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0x6550
jge 0x1001a2c4
and dword [ebp - 0x2e4], 0
jmp 0x1001a25c
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0x4b92
jge 0x1001a2bf
mov eax, dword [ebp - 0x248]
sub eax, dword [ebp - 0x2e4]
cdq
mov dword [ebp - 0x974], eax
mov dword [ebp - 0x970], edx
push dword [ebp - 0x970]
push dword [ebp - 0x974]
lea ecx, [ebp - 0xf84]
call fcn.1000a964
pop ecx
pop ecx
mov dword [ebp - 0x9f0], eax
mov ecx, dword [ebp - 0x9f0]
call fcn.10021475
push eax
call fcn.100579ef
pop ecx
lea ecx, [ebp - 0xf84]
call fcn.1002146b
jmp 0x1001a24f
jmp 0x1001a22d
mov dword [ebp - 0xa10], 0xd43ddca2
mov byte [ebp - 4], 6
cmp dword [ebp - 0x444], 0x484
jge 0x1001a2ea
push dword [ebp - 0x9f8]
call fcn.100579ef
pop ecx
jmp 0x1001a306
mov dword [ebp - 4], 5
jmp 0x1001a316
mov dword [ebp - 0xa20], 0xffffffff
mov dword [ebp - 0x250], 0
jmp 0x1001a339
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 4
jge 0x1001a355
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0xe1c], 0x2095e04a
jmp 0x1001a32c
cmp dword [ebp - 0x150], 0
je 0x1001a363
jmp 0x1001a544
mov dword [ebp - 0x150], 0
jmp 0x1001a37c
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 1
jg 0x1001a53f
mov dword [ebp - 0x68], 0xfffffffa
mov dword [ebp - 0xa30], 3
mov dword [ebp - 0x68], 1
jmp 0x1001a3aa
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x1001a53a
mov dword [ebp - 0x2ec], 0xffffffff
mov dword [ebp - 0x2ec], 0xcf4c59cd
cmp dword [ebp - 0x2ec], 0xffffffff
jb 0x1001a3dd
mov dword [ebp - 0xa00], 1
jmp 0x1001a3e4
and dword [ebp - 0xa00], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0xa40]
call fcn.10021a50
cmp dword [eax], 0xfffffffe
jne 0x1001a403
mov dword [ebp - 0xa08], 1
jmp 0x1001a40a
and dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xc08], eax
mov eax, dword [ebp - 0xa10]
mov dword [ebp - 0xc10], eax
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x68]
jne 0x1001a433
mov dword [ebp - 0xa18], 1
jmp 0x1001a43a
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xa20], eax
cmp dword [ebp - 0x68], 0
je 0x1001a4b9
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xc18], eax
mov eax, dword [ebp - 0x2ec]
inc eax
cmp eax, dword [ebp - 0x454]
jge 0x1001a470
mov dword [ebp - 0x81c], 1
jmp 0x1001a477
and dword [ebp - 0x81c], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0xa40]
call fcn.10021a50
mov eax, dword [eax]
cmp eax, dword [ebp - 0x81c]
jl 0x1001a49b
mov dword [ebp - 0x44c], 1
jmp 0x1001a4a2
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x44c], eax
jle 0x1001a4b9
mov dword [ebp - 0x67c], 1
jmp 0x1001a4c0
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x67c]
sub eax, dword [ebp - 0x454]
mov dword [ebp - 0xa28], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa28]
mov dword [ebp + eax - 0xe1c], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xc20], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2ec]
cmp ecx, dword [ebp + eax - 0xe1c]
jl 0x1001a522
push dword [ebp - 0x48]
lea ecx, [ebp - 0xa40]
call fcn.10021a50
cmp dword [eax], 0
je 0x1001a522
mov dword [ebp - 0x794], 1
jmp 0x1001a529
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0xa30], eax
jmp 0x1001a3a3
jmp 0x1001a36f
jmp 0x1001a1dd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa40]
call fcn.10021a34
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1f0]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x1c], eax
jne 0x1001acc8
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x1f0]
inc eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x2f4], 0xe8cff0ea
push 4
lea ecx, [ebp - 0xb78]
call fcn.100219b2
mov dword [ebp - 4], 8
mov dword [ebp - 0xc28], 0x94b4b132
mov dword [ebp - 0x464], 8
mov dword [ebp - 0x258], 0
jmp 0x1001a5cb
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 4
jge 0x1001a5ed
push dword [ebp - 0x258]
lea ecx, [ebp - 0xb78]
call fcn.10021a50
mov dword [eax], 0x8f8256a9
jmp 0x1001a5be
mov dword [ebp - 0x2f4], 0xffffffff
jmp 0x1001a606
mov eax, dword [ebp - 0x2f4]
dec eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0xfffffffe
jg 0x1001a710
push 3
lea ecx, [ebp - 0x8d4]
call fcn.100219b2
mov byte [ebp - 4], 9
mov dword [ebp - 0x260], 0
jmp 0x1001a63d
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 3
jge 0x1001a65f
push dword [ebp - 0x260]
lea ecx, [ebp - 0x8d4]
call fcn.10021a50
mov dword [eax], 0x801fc3ee
jmp 0x1001a630
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1001a677
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0
lea ecx, [ebp - 0x8d4]
call fcn.10021a50
mov dword [eax], 3
jmp 0x1001a6b0
push 0
lea ecx, [ebp - 0x8d4]
call fcn.10021a50
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x45c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x45c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x8d4]
call fcn.10021a50
cmp dword [eax], 0
jl 0x1001a6fc
mov dword [ebp - 0x684], 0x26ec
mov eax, dword [ebp - 0x684]
dec eax
mov dword [ebp - 0x684], eax
push 0
lea ecx, [ebp - 0x8d4]
call fcn.10021a50
push dword [eax]
lea ecx, [ebp - 0xb78]
call fcn.10021a50
cmp dword [eax], 0
je 0x1001a6fa
jmp 0x1001a68c
jmp 0x1001a68c
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x8d4]
call fcn.10021a34
jmp 0x1001a5f9
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0xc30], eax
cmp dword [ebp - 0x464], 0
je 0x1001a73e
mov dword [ebp - 0x864], 0x56890c54
mov eax, dword [ebp - 0x864]
inc eax
mov dword [ebp - 0x864], eax
jmp 0x1001a755
mov dword [ebp - 0x46c], 0xfffc
mov eax, dword [ebp - 0x46c]
dec eax
mov dword [ebp - 0x46c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb78]
call fcn.10021a34
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x1f0]
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x178], 0xfffffffd
mov dword [ebp - 0x2fc], 0
jmp 0x1001a79c
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 3
jge 0x1001a7b8
mov eax, dword [ebp - 0x2fc]
mov dword [ebp + eax*4 - 0x3ac], 1
jmp 0x1001a78f
mov dword [ebp - 0x178], 0
jmp 0x1001a7d1
mov eax, dword [ebp - 0x178]
dec eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0xffffffe2
jne 0x1001acc3
mov dword [ebp - 0x168], 0xffffffff
mov dword [ebp - 0x69c], 0xffffffff
mov dword [ebp - 0x158], 0xd77fc7df
mov dword [ebp - 0x7ac], 0xffffffff
mov dword [ebp - 0x168], 0
jmp 0x1001a81f
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xfffffff4
jl 0x1001aca2
mov dword [ebp - 0x28], 0xe2fde2bb
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x4ac], 0xffffffff
mov dword [ebp - 0x28], 0
jmp 0x1001a857
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jg 0x1001ac9d
mov dword [ebp - 0xe4], 0x999d94b4
mov dword [ebp - 0x18c], 0xffffffff
mov dword [ebp - 0xe4], 0
jmp 0x1001a88e
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 2
jg 0x1001ac98
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp + ecx*4 - 0x3ac]
cmp ecx, dword [ebp + eax*4 - 0x3ac]
jl 0x1001a8bd
mov dword [ebp - 0x79c], 1
jmp 0x1001a8c4
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
jne 0x1001a8e2
mov dword [ebp - 0x68c], 1
jmp 0x1001a8e9
and dword [ebp - 0x68c], 0
cmp dword [ebp - 0x68c], 0xb0
je 0x1001a901
mov dword [ebp - 0x474], 1
jmp 0x1001a908
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x3ac]
cmp dword [ebp - 0x474], eax
je 0x1001a926
mov dword [ebp - 0xa90], 1
jmp 0x1001a92d
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc38], eax
mov eax, 0x360d
cmp eax, 1
jne 0x1001a94c
mov dword [ebp - 0xa94], 1
jmp 0x1001a953
and dword [ebp - 0xa94], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xc40], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x3ac]
mov dword [ebp - 0xc48], eax
cmp dword [ebp - 0x79c], 0
je 0x1001a98a
cmp dword [ebp - 0x168], 0
jne 0x1001a98a
and dword [ebp - 0x47c], 0
jmp 0x1001a994
mov dword [ebp - 0x47c], 1
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x3ac]
cmp dword [ebp - 0x47c], eax
jg 0x1001a9b2
mov dword [ebp - 0x694], 1
jmp 0x1001a9b9
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x694]
sub eax, dword [ebp - 0x168]
cmp eax, 0xd4a55f07
jb 0x1001a9ea
cmp dword [ebp - 0x178], 0
je 0x1001a9ea
cmp dword [ebp - 0x160], 0
je 0x1001a9ea
mov dword [ebp - 0x484], 1
jmp 0x1001a9f1
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x824], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x824]
mov dword [ebp + eax - 0x3ac], ecx
cmp dword [ebp - 0x824], 0
je 0x1001aa3a
cmp dword [ebp - 0x18c], 0
je 0x1001aa3a
mov dword [ebp - 0x48c], 1
jmp 0x1001aa41
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x69c], eax
cmp dword [ebp - 0x69c], 9
jbe 0x1001aa62
mov dword [ebp - 0x494], 1
jmp 0x1001aa69
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 0xfffffff6
jle 0x1001aa7e
mov dword [ebp - 0x7a4], 1
jmp 0x1001aa85
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x3ac], 0xa971
jl 0x1001aaad
mov dword [ebp - 0x49c], 1
jmp 0x1001aab4
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x18c]
cmp eax, dword [ebp - 0x49c]
jg 0x1001aace
mov dword [ebp - 0x6a4], 1
jmp 0x1001aad5
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x6a4], eax
jl 0x1001ac67
mov dword [ebp - 0x8f0], 0xa8e43404
mov dword [ebp - 0x158], 0
jmp 0x1001ab0a
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x12
jne 0x1001ac65
mov dword [ebp - 0x944], 0xb132
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xc50], eax
cmp dword [ebp - 0x8f0], 0
jne 0x1001ab42
mov dword [ebp - 0x340], 1
jmp 0x1001ab49
and dword [ebp - 0x340], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x340]
mov dword [ebp + eax - 0x3ac], ecx
mov eax, dword [ebp - 0x4ac]
cmp dword [ebp - 0x340], eax
je 0x1001ab7e
cmp dword [ebp - 0x7ac], 0
je 0x1001ab7e
mov dword [ebp - 0x4a4], 1
jmp 0x1001ab85
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x4a4], eax
jne 0x1001aba8
cmp dword [ebp - 0x158], 0
je 0x1001aba8
mov dword [ebp - 0x87c], 1
jmp 0x1001abaf
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x178]
add eax, dword [ebp - 0x87c]
cmp dword [ebp - 0x4ac], eax
jge 0x1001abd2
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3ac], 0
jne 0x1001abe4
cmp dword [ebp - 0x160], 0
jne 0x1001abe4
and dword [ebp - 0x6ac], 0
jmp 0x1001abee
mov dword [ebp - 0x6ac], 1
cmp dword [ebp - 0x6ac], 0xb252307d
jne 0x1001ac06
mov dword [ebp - 0x4b4], 1
jmp 0x1001ac0d
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x944]
cmp eax, dword [ebp - 0x4b4]
jne 0x1001ac27
mov dword [ebp - 0xaa0], 1
jmp 0x1001ac2e
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0x7ac]
mov dword [ebp - 0xc58], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x160], eax
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x1001ac60
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x1001aafd
jmp 0x1001ac93
mov dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x3ac]
mov ecx, dword [ebp - 0x28]
mov dword [ebp + ecx*4 - 0x3ac], eax
cmp dword [ebp - 0x8f8], 0
je 0x1001ac93
jmp 0x1001a881
jmp 0x1001a881
jmp 0x1001a850
jmp 0x1001a812
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x1001acbe
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x1001a7c4
jmp 0x1001a126
push 2
lea ecx, [ebp - 0xa50]
call fcn.100219b2
mov dword [ebp - 4], 0xa
mov dword [ebp - 0xc60], 4
mov dword [ebp - 0x268], 0
jmp 0x1001acff
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 2
jge 0x1001ad21
push dword [ebp - 0x268]
lea ecx, [ebp - 0xa50]
call fcn.10021a50
mov dword [eax], 0x68206240
jmp 0x1001acf2
push 0
lea ecx, [ebp - 0xa50]
call fcn.10021a50
and dword [eax], 0
jmp 0x1001ad57
push 0
lea ecx, [ebp - 0xa50]
call fcn.10021a50
mov dword [ebp - 0x4bc], eax
mov eax, dword [ebp - 0x4bc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4bc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa50]
call fcn.10021a50
cmp dword [eax], 0xe
je 0x1001ad80
mov dword [ebp - 0x9ec], 0xfffffffc
cmp dword [ebp - 0x9ec], 0
je 0x1001ad7e
jmp 0x1001ad80
jmp 0x1001ad33
mov byte [ebp - 0xd4], 0
movzx eax, byte [ebp - 0xd4]
test eax, eax
je 0x1001ad9d
push 0x2a4
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa50]
call fcn.10021a34
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x198]
movzx eax, byte [ebp + eax - 0x1f2]
movsx eax, byte [ebp + eax - 0x8e4]
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x1ef]
and ecx, eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x198]
movzx eax, byte [ebp + eax - 0x1f2]
movsx eax, byte [ebp + eax - 0x8e4]
mov edx, dword [ebp - 0x1c]
movzx edx, byte [ebp + edx - 0x1ef]
and edx, eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x198]
movzx eax, byte [ebp + eax - 0x1f2]
movsx eax, byte [ebp + eax - 0x8e4]
mov esi, dword [ebp - 0x1c]
movzx ebx, byte [ebp + esi - 0x1ef]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x1f0]
mov byte [ebp + eax - 0x8e4], bl
mov dword [ebp - 0x58], 0x8cff0ea7
push 2
lea ecx, [ebp - 0x400]
call fcn.100219b2
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x908], 9
mov dword [ebp - 0xec], 0xf1fa6f63
mov dword [ebp - 0x304], 0
jmp 0x1001ae7c
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 2
jge 0x1001ae9e
push dword [ebp - 0x304]
lea ecx, [ebp - 0x400]
call fcn.10021a50
mov dword [eax], 0xc7d24b5e
jmp 0x1001ae6f
mov dword [ebp - 0x58], 0xffffffe2
jmp 0x1001aeae
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xfffffff3
jne 0x1001aefb
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1001aed0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov byte [ebp - 0x130], 0
movzx eax, byte [ebp - 0x130]
test eax, eax
je 0x1001aef9
push 0x26a
push 0
push 0x90b
push 0x1ebb
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
jmp 0x1001aea7
mov dword [ebp - 0x58], 0xfffffff6
jmp 0x1001af0b
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jl 0x1001b535
mov dword [ebp - 0x14], 0xea6801fc
mov dword [ebp - 0x1d0], 0xee4f120b
mov dword [ebp - 0x3a0], 0xfffffffe
mov dword [ebp - 0x918], 0xfffffff9
mov dword [ebp - 0x14], 0x18
jmp 0x1001af4a
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffe8
jne 0x1001b0e1
mov dword [ebp - 0x900], 0xeb32a831
push 1
lea ecx, [ebp - 0xb90]
call fcn.100219b2
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x270], 0
jmp 0x1001af88
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jge 0x1001afaa
push dword [ebp - 0x270]
lea ecx, [ebp - 0xb90]
call fcn.10021a50
mov dword [eax], 0xf553
jmp 0x1001af7b
cmp dword [ebp - 0x14], 0x714f
jge 0x1001afbf
mov dword [ebp - 0x6b4], 1
jmp 0x1001afc6
and dword [ebp - 0x6b4], 0
cmp dword [ebp - 0x6b4], 0x7457
jge 0x1001afde
mov dword [ebp - 0x39c], 1
jmp 0x1001afe5
and dword [ebp - 0x39c], 0
push 0
lea ecx, [ebp - 0x400]
call fcn.10021a50
mov ecx, dword [ebp - 0x39c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x39c], eax
jge 0x1001b011
mov dword [ebp - 0x4c4], 1
jmp 0x1001b018
and dword [ebp - 0x4c4], 0
cmp dword [ebp - 0x4c4], 0x7c70
je 0x1001b030
mov dword [ebp - 0x82c], 1
jmp 0x1001b037
and dword [ebp - 0x82c], 0
cmp dword [ebp - 0x82c], 1
jg 0x1001b04c
mov dword [ebp - 0x4cc], 1
jmp 0x1001b053
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x4cc], eax
jne 0x1001b06a
mov dword [ebp - 0x6bc], 1
jmp 0x1001b071
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x6bc]
jne 0x1001b088
mov dword [ebp - 0x4d4], 1
jmp 0x1001b08f
and dword [ebp - 0x4d4], 0
imul eax, dword [ebp - 0x4d4], 0x85ce
cmp dword [ebp - 0x900], eax
je 0x1001b0ad
mov dword [ebp - 0x7b4], 1
jmp 0x1001b0b4
and dword [ebp - 0x7b4], 0
mov esi, dword [ebp - 0x14]
imul esi, dword [ebp - 0x7b4]
push 0
lea ecx, [ebp - 0xb90]
call fcn.10021a50
mov dword [eax], esi
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xb90]
call fcn.10021a34
jmp 0x1001af43
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc68], eax
push 0
lea ecx, [ebp - 0x400]
call fcn.10021a50
mov eax, dword [eax]
mov dword [ebp - 0xec], eax
mov esi, dword [ebp - 0x14]
push 0
lea ecx, [ebp - 0x400]
call fcn.10021a50
mov edi, eax
push 0
lea ecx, [ebp - 0x400]
call fcn.10021a50
mov eax, dword [eax]
add eax, dword [edi]
cmp eax, esi
jne 0x1001b132
mov dword [ebp - 0xa54], 1
jmp 0x1001b139
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc70], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc78], eax
cmp dword [ebp - 0x14], 0xfffffff7
je 0x1001b16c
mov eax, 0x2a6a
test eax, eax
je 0x1001b16c
cmp dword [ebp - 0x14], 0
je 0x1001b16c
mov dword [ebp - 0x4dc], 1
jmp 0x1001b173
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x908]
add eax, 0xa8db
cmp eax, dword [ebp - 0x4dc]
je 0x1001b192
mov dword [ebp - 0x6c4], 1
jmp 0x1001b199
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x6c4], eax
jne 0x1001b1b0
mov dword [ebp - 0x4e4], 1
jmp 0x1001b1b7
and dword [ebp - 0x4e4], 0
cmp dword [ebp - 0x4e4], 0xfffffffe
jb 0x1001b1cc
mov dword [ebp - 0x86c], 1
jmp 0x1001b1d3
and dword [ebp - 0x86c], 0
push 0
lea ecx, [ebp - 0x400]
call fcn.10021a50
mov ecx, dword [ebp - 0x86c]
cmp ecx, dword [eax]
je 0x1001b20e
mov byte [ebp - 0xd6], 0
movzx eax, byte [ebp - 0xd6]
test eax, eax
je 0x1001b209
push 0
push 0x173f
call dword [sym.imp.USER32.dll_ValidateRgn]
jmp 0x1001b530
mov dword [ebp - 0x348], 0xfffffffa
mov dword [ebp - 0x9f4], 0xffffffff
mov dword [ebp - 0x524], 0xffffffff
mov dword [ebp - 0xec], 0
jmp 0x1001b245
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x34
jge 0x1001b522
mov dword [ebp - 0x190], 1
mov dword [ebp - 0x6e4], 0x3fceeec8
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xc80], eax
cmp dword [ebp - 0x190], 0
jne 0x1001b33b
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0xc88], eax
cmp dword [ebp - 0x190], 0xc0e5
jl 0x1001b2a0
mov dword [ebp - 0x4ec], 1
jmp 0x1001b2a7
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
add eax, 0x336630b8
imul eax, dword [ebp - 0x1d0]
test eax, eax
je 0x1001b2d2
mov eax, 0x2307d3e6
test eax, eax
je 0x1001b2d2
mov dword [ebp - 0x6cc], 1
jmp 0x1001b2d9
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x6cc], eax
jne 0x1001b2f0
mov dword [ebp - 0x4f4], 1
jmp 0x1001b2f7
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x7bc], eax
push 0
lea ecx, [ebp - 0x400]
call fcn.10021a50
mov ecx, dword [ebp - 0x7bc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x348]
cmp dword [ebp - 0x7bc], eax
jle 0x1001b33b
and dword [ebp - 0x4fc], 0
jmp 0x1001b345
mov dword [ebp - 0x4fc], 1
mov eax, dword [ebp - 0x4fc]
sub eax, dword [ebp - 0x348]
cmp eax, dword [ebp - 0xec]
jl 0x1001b365
mov dword [ebp - 0x6d4], 1
jmp 0x1001b36c
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x9f4]
cmp dword [ebp - 0x6d4], eax
jge 0x1001b386
mov dword [ebp - 0x504], 1
jmp 0x1001b38d
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x524]
cmp dword [ebp - 0x504], eax
jl 0x1001b3a7
mov dword [ebp - 0x834], 1
jmp 0x1001b3ae
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x834], eax
jne 0x1001b3c5
mov dword [ebp - 0x910], 1
jmp 0x1001b3cc
and dword [ebp - 0x910], 0
cmp dword [ebp - 0x1d0], 6
ja 0x1001b3e1
mov dword [ebp - 0x50c], 1
jmp 0x1001b3e8
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x348]
jne 0x1001b417
push 0
lea ecx, [ebp - 0x400]
call fcn.10021a50
cmp dword [eax], 0
jne 0x1001b417
and dword [ebp - 0x6dc], 0
jmp 0x1001b421
mov dword [ebp - 0x6dc], 1
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x6dc], eax
je 0x1001b43b
mov dword [ebp - 0x514], 1
jmp 0x1001b442
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 0x1aae
je 0x1001b45a
mov dword [ebp - 0x7c4], 1
jmp 0x1001b461
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x7c4]
sub eax, dword [ebp - 0x1d0]
cmp eax, dword [ebp - 0x1d0]
jne 0x1001b481
mov dword [ebp - 0xa98], 1
jmp 0x1001b488
and dword [ebp - 0xa98], 0
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0xc90], eax
mov eax, 0x823388
cmp eax, 0xe7732c35
jbe 0x1001b4ac
mov dword [ebp - 0x51c], 1
jmp 0x1001b4b3
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
sub eax, 9
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x6e4]
mov ecx, dword [ebp - 0x3a0]
lea eax, [ecx + eax + 0xb09]
cmp eax, dword [ebp - 0x1d0]
jle 0x1001b4e9
mov dword [ebp - 0x884], 1
jmp 0x1001b4f0
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x524]
cmp dword [ebp - 0x884], eax
jl 0x1001b50a
mov dword [ebp - 0x52c], 1
jmp 0x1001b511
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x918], eax
jmp 0x1001b238
cmp dword [ebp - 0x3a0], 0
je 0x1001b530
jmp 0x1001af04
jmp 0x1001af04
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x400]
call fcn.10021a34
and dword [ebp - 0x198], 0
jmp 0x1001a126
mov dword [ebp - 0x84], 0x25b9b55b
push 1
lea ecx, [ebp - 0x40c]
call fcn.100219b2
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x390], 0x783518f4
mov dword [ebp - 0x360], 1
mov dword [ebp - 0x928], 0
mov dword [ebp - 0xc98], 2
mov dword [ebp - 0xb4], 0
jmp 0x1001b5af
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x1001b5ce
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x40c]
call fcn.10021a50
and dword [eax], 0
jmp 0x1001b5a2
mov dword [ebp - 0xb4], 0
jmp 0x1001b5e7
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x1001b603
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x3c0], 5
jmp 0x1001b5da
mov dword [ebp - 0x84], 0xfffffff0
jmp 0x1001b61c
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xfffffffe
jle 0x1001bdc2
mov dword [ebp - 0x148], 0xa73d2d67
push 2
lea ecx, [ebp - 0x8bc]
call fcn.100219b2
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x358], 0xfffffffd
mov dword [ebp - 0x714], 0
mov dword [ebp - 0x9c], 0
jmp 0x1001b671
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x1001b68d
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x898], 0x77cce45d
jmp 0x1001b664
mov dword [ebp - 0x9c], 0
jmp 0x1001b6a6
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jge 0x1001b6c8
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x8bc]
call fcn.10021a50
mov dword [eax], 0x5ad33d2a
jmp 0x1001b699
mov byte [ebp - 0x13a], 0
movzx eax, byte [ebp - 0x13a]
test eax, eax
je 0x1001b6fd
push 0
push 0x21a0
push 0xb5f
push 0x10f
push 0x16f1
push 0x380
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xca0], eax
cmp dword [ebp - 0x84], 0
je 0x1001b727
cmp dword [ebp - 0x148], 0
je 0x1001b727
mov dword [ebp - 0x6ec], 1
jmp 0x1001b72e
and dword [ebp - 0x6ec], 0
imul eax, dword [ebp - 0x6ec], 0x8428
mov dword [ebp - 0x534], eax
push 0
lea ecx, [ebp - 0x40c]
call fcn.10021a50
mov ecx, dword [ebp - 0x534]
mov dword [eax], ecx
cmp dword [ebp - 0x534], 0
je 0x1001b771
cmp dword [ebp - 0x148], 0
je 0x1001b771
mov dword [ebp - 0x7cc], 1
jmp 0x1001b778
and dword [ebp - 0x7cc], 0
cmp dword [ebp - 0x7cc], 1
jle 0x1001b78d
mov dword [ebp - 0x53c], 1
jmp 0x1001b794
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x53c], eax
jge 0x1001b7ae
mov dword [ebp - 0x6f4], 1
jmp 0x1001b7b5
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
add eax, 0xcd3bed16
mov dword [ebp - 0x350], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x350]
mov dword [ebp + eax - 0x898], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x350]
mov dword [ebp + eax - 0x3c0], ecx
cmp dword [ebp - 0x350], 0
jne 0x1001b80e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x898], 0
jne 0x1001b80e
and dword [ebp - 0x544], 0
jmp 0x1001b818
mov dword [ebp - 0x544], 1
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x544], eax
jg 0x1001b832
mov dword [ebp - 0x83c], 1
jmp 0x1001b839
and dword [ebp - 0x83c], 0
cmp dword [ebp - 0x83c], 0xe72c
jl 0x1001b851
mov dword [ebp - 0x54c], 1
jmp 0x1001b858
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x54c], eax
jl 0x1001b872
mov dword [ebp - 0x6fc], 1
jmp 0x1001b879
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x84]
imul eax, dword [ebp - 0x6fc]
cmp eax, 0xe9a5
jle 0x1001b899
mov dword [ebp - 0x554], 1
jmp 0x1001b8a0
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x554], eax
jge 0x1001b8ba
mov dword [ebp - 0x7d4], 1
jmp 0x1001b8c1
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x7d4], eax
jge 0x1001b8db
mov dword [ebp - 0x55c], 1
jmp 0x1001b8e2
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 0
je 0x1001b915
push 0
lea ecx, [ebp - 0x40c]
call fcn.10021a50
cmp dword [eax], 0
je 0x1001b915
mov dword [ebp - 0x9fc], 1
jmp 0x1001b91c
and dword [ebp - 0x9fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x898]
mov dword [ebp - 0x704], eax
push 1
lea ecx, [ebp - 0x8bc]
call fcn.10021a50
mov ecx, dword [ebp - 0x704]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x704], eax
je 0x1001bb5c
push 2
lea ecx, [ebp - 0xa60]
call fcn.100219b2
mov byte [ebp - 4], 0xf
push 1
lea ecx, [ebp - 0xafc]
call fcn.100219b2
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x34], 0
jmp 0x1001b988
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x1001b9a4
push dword [ebp - 0x34]
lea ecx, [ebp - 0xa60]
call fcn.10021a50
mov dword [eax], 0xfffb
jmp 0x1001b981
mov dword [ebp - 0x34], 0
jmp 0x1001b9b4
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1001b9ca
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xe38], 0x6eaf0ab5
jmp 0x1001b9ad
mov dword [ebp - 0x34], 0
jmp 0x1001b9da
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x1001b9f6
push dword [ebp - 0x34]
lea ecx, [ebp - 0xafc]
call fcn.10021a50
mov dword [eax], 0x758c9e43
jmp 0x1001b9d3
push 0
lea ecx, [ebp - 0xa60]
call fcn.10021a50
push 0
lea ecx, [ebp - 0xa60]
call fcn.10021a50
xor eax, eax
inc eax
je 0x1001ba1c
cmp dword [ebp - 0x358], 0
push 0
lea ecx, [ebp - 0x40c]
call fcn.10021a50
mov ecx, 0x83be7680
sub ecx, dword [eax]
mov dword [ebp - 0x920], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x920]
mov dword [ebp + eax - 0xe38], ecx
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0xca8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x898]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x898], eax
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x1001ba82
mov dword [ebp - 0x564], 1
jmp 0x1001ba89
and dword [ebp - 0x564], 0
imul esi, dword [ebp - 0x564], 0xfffa
push 0
lea ecx, [ebp - 0xa60]
call fcn.10021a50
mov eax, dword [eax]
sub eax, esi
cmp eax, 0xe7c4bd4
jg 0x1001bab7
mov dword [ebp - 0x88c], 1
jmp 0x1001babe
and dword [ebp - 0x88c], 0
cmp dword [ebp - 0x88c], 1
jle 0x1001bad3
mov dword [ebp - 0x56c], 1
jmp 0x1001bada
and dword [ebp - 0x56c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c0]
add eax, dword [ebp - 0x56c]
je 0x1001bb17
push 0
lea ecx, [ebp - 0xafc]
call fcn.10021a50
cmp dword [eax], 0
je 0x1001bb17
cmp dword [ebp - 0x390], 0
je 0x1001bb17
push 0
lea ecx, [ebp - 0x40c]
call fcn.10021a50
push 0
lea ecx, [ebp - 0x40c]
call fcn.10021a50
mov esi, dword [ebp - 0x358]
push 0
lea ecx, [ebp - 0xafc]
call fcn.10021a50
mov dword [eax], esi
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xafc]
call fcn.10021a34
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xa60]
call fcn.10021a34
jmp 0x1001bdae
mov dword [ebp - 0x58c], 9
mov dword [ebp - 0xa64], 0
mov dword [ebp - 0x30c], 0
jmp 0x1001bb89
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 2
jge 0x1001bba5
mov eax, dword [ebp - 0x30c]
mov dword [ebp + eax*4 - 0xbec], 0
jmp 0x1001bb7c
push 0
lea ecx, [ebp - 0x40c]
call fcn.10021a50
mov esi, dword [ebp - 0x714]
push 0
lea ecx, [ebp - 0x8bc]
call fcn.10021a50
cmp esi, dword [eax]
jg 0x1001bbd5
mov dword [ebp - 0x70c], 1
jmp 0x1001bbdc
and dword [ebp - 0x70c], 0
cmp dword [ebp - 0x70c], 0x2f71451c
jg 0x1001bbf4
mov dword [ebp - 0x574], 1
jmp 0x1001bbfb
and dword [ebp - 0x574], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x898]
cmp eax, dword [ebp - 0x574]
jl 0x1001bc1c
mov dword [ebp - 0x7dc], 1
jmp 0x1001bc23
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0xcb0], eax
cmp dword [ebp - 0xa64], 0
jne 0x1001bc5d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x898], 0
jne 0x1001bc5d
and dword [ebp - 0x57c], 0
jmp 0x1001bc67
mov dword [ebp - 0x57c], 1
push 1
lea ecx, [ebp - 0x8bc]
call fcn.10021a50
mov eax, dword [eax]
cmp eax, dword [ebp - 0x57c]
jg 0x1001bc93
cmp dword [ebp - 0x714], 0
je 0x1001bc93
mov dword [ebp - 0x584], 1
jmp 0x1001bc9a
and dword [ebp - 0x584], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c0]
cmp dword [ebp - 0x584], eax
jg 0x1001bcc1
cmp dword [ebp - 0x360], 0
jne 0x1001bcc1
and dword [ebp - 0x398], 0
jmp 0x1001bccb
mov dword [ebp - 0x398], 1
push 1
lea ecx, [ebp - 0x8bc]
call fcn.10021a50
mov ecx, dword [ebp - 0x398]
mov dword [eax], ecx
cmp dword [ebp - 0x398], 0xc16b
jne 0x1001bcf8
mov dword [ebp - 0x844], 1
jmp 0x1001bcff
and dword [ebp - 0x844], 0
push 0
lea ecx, [ebp - 0x40c]
call fcn.10021a50
mov ecx, dword [ebp - 0x844]
cmp ecx, dword [eax]
jl 0x1001bd22
mov dword [ebp - 0x71c], 1
jmp 0x1001bd29
and dword [ebp - 0x71c], 0
mov dword [ebp - 0x58c], 0xfffffff9
mov eax, dword [ebp - 0x58c]
cmp eax, dword [ebp - 0x71c]
jle 0x1001bd4d
mov dword [ebp - 0x594], 1
jmp 0x1001bd54
and dword [ebp - 0x594], 0
cmp dword [ebp - 0x594], 0x54df
jge 0x1001bd73
push 2
pop eax
test eax, eax
je 0x1001bd73
mov dword [ebp - 0x7e4], 1
jmp 0x1001bd7a
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x928]
cmp dword [ebp - 0x7e4], eax
jl 0x1001bd94
mov dword [ebp - 0x59c], 1
jmp 0x1001bd9b
and dword [ebp - 0x59c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x59c]
mov dword [ebp + eax - 0xbec], ecx
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x8bc]
call fcn.10021a34
jmp 0x1001b60f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40c]
call fcn.10021a34
xor eax, eax
inc eax
imul eax, eax, 0xd
mov byte [ebp + eax - 0x8e4], 0
mov dword [ebp - 0x940], 0xfffffffd
mov dword [ebp - 0xcb8], 0xfffffff8
mov dword [ebp - 0xa88], 0x3921ded6
mov dword [ebp - 0xcc0], 0xffffffff
mov dword [ebp - 0x930], 0xfffffffb
mov dword [ebp - 0xcc8], 0
mov dword [ebp - 0x7ec], 1
mov dword [ebp - 0xa04], 0x894ff545
mov dword [ebp - 0x368], 0xffffffff
mov dword [ebp - 0x7c], 0
jmp 0x1001be49
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1001be5f
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xbf8], 0xffffffff
jmp 0x1001be42
mov dword [ebp - 0x7c], 0
jmp 0x1001be6f
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1001be85
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xb6c], 0xfffb
jmp 0x1001be68
mov eax, dword [ebp - 0x368]
dec eax
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x368]
add eax, 0x28e4c937
mov ecx, dword [ebp - 0xa04]
sub ecx, eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbf8], ecx
jge 0x1001bec0
mov dword [ebp - 0x724], 1
jmp 0x1001bec7
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x930]
mov dword [ebp - 0xcd0], eax
mov eax, dword [ebp - 0x724]
neg eax
cmp eax, dword [ebp - 0x7ec]
jl 0x1001beef
mov dword [ebp - 0x5a4], 1
jmp 0x1001bef6
and dword [ebp - 0x5a4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb6c]
mov dword [ebp - 0x938], eax
mov eax, dword [ebp - 0x5a4]
sub eax, dword [ebp - 0xa88]
mov dword [ebp - 0xa0c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb6c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xb6c], eax
mov eax, dword [ebp - 0x938]
cmp eax, dword [ebp - 0xa0c]
jge 0x1001bf50
mov dword [ebp - 0x878], 1
jmp 0x1001bf57
and dword [ebp - 0x878], 0
cmp dword [ebp - 0x878], 0x2811ffbe
jg 0x1001bf6f
mov dword [ebp - 0x5ac], 1
jmp 0x1001bf76
and dword [ebp - 0x5ac], 0
cmp dword [ebp - 0x5ac], 1
jb 0x1001bf8b
mov dword [ebp - 0x72c], 1
jmp 0x1001bf92
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x940]
cmp eax, dword [ebp - 0x72c]
jle 0x1001bfac
mov dword [ebp - 0x5b4], 1
jmp 0x1001bfb3
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x7ec], eax
lea eax, [ebp - 0x8e4]
push eax
lea ecx, [ebp - 0xf0c]
call fcn.1002191b
mov dword [ebp - 0xa74], eax
mov eax, dword [ebp - 0xa74]
mov dword [ebp - 0x948], eax
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x7fc]
mov ecx, dword [ebp - 0x948]
call fcn.1000aa0e
mov dword [0x106183d0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0c]
call fcn.1002193e
mov dword [ebp - 0xbac], 0x8ade19d2
mov dword [ebp - 0xba8], 0x8ade19d2
mov dword [ebp - 0xba4], 0x8ade19d2
mov dword [ebp - 0xba0], 0x8ade19d2
mov dword [ebp - 0x1b8], 0x6df37d45
mov dword [ebp - 0xcd8], 0xafe30f58
mov dword [ebp - 0xce0], 0xffffffff
mov dword [ebp - 0x5bc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xbac]
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1b8], 0
jmp 0x1001c08b
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xffffffe9
jne 0x1001c0d8
mov dword [ebp - 0x278], 0
jmp 0x1001c0ad
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 3
jge 0x1001c0c9
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0xf18], 2
jmp 0x1001c0a0
mov eax, dword [ebp - 0x5bc]
inc eax
mov dword [ebp - 0x5bc], eax
jmp 0x1001c07e
and dword [ebp - 0x314], 0
jmp 0x1001c0ee
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0xe
jae 0x1001c107
mov eax, dword [ebp - 0x314]
mov byte [ebp + eax - 0x8e4], 0
jmp 0x1001c0e1
mov dword [ebp - 0x64], 0xc45cdbe8
mov dword [ebp - 0x1a0], 0xcfb6318d
mov dword [ebp - 0x280], 0
jmp 0x1001c131
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 3
jge 0x1001c14d
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0xe50], 0xdae5
jmp 0x1001c124
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x1a0], 0
jmp 0x1001c16f
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xfffffffb
jge 0x1001c1f7
mov dword [ebp - 0xa14], 7
mov dword [ebp - 0x950], 0xf934f545
mov dword [ebp - 0x64], 0
jmp 0x1001c19c
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jg 0x1001c1cc
mov byte [ebp - 0xd8], 0
movzx eax, byte [ebp - 0xd8]
test eax, eax
je 0x1001c1be
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [ebp - 0xa14]
mov dword [ebp - 0x950], eax
jmp 0x1001c195
mov dword [ebp - 0x64], 0
jmp 0x1001c1dc
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1001c1f2
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xe50], 8
jmp 0x1001c1d5
jmp 0x1001c162
mov dword [ebp - 0x994], 0x1a3622ba
push 1
lea ecx, [ebp - 0xb54]
call fcn.100219b2
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x31c], 0
jmp 0x1001c22e
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 1
jge 0x1001c250
push dword [ebp - 0x31c]
lea ecx, [ebp - 0xb54]
call fcn.10021a50
mov dword [eax], 0x3cdf98a5
jmp 0x1001c221
mov esi, dword [ebp - 0x994]
push 0
lea ecx, [ebp - 0xb54]
call fcn.10021a50
mov dword [eax], esi
mov byte [ebp - 0x132], 0
movzx eax, byte [ebp - 0x132]
test eax, eax
je 0x1001c27f
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb54]
call fcn.10021a34
mov byte [ebp - 0x214], 0xa
mov byte [ebp - 0x213], 0x81
mov byte [ebp - 0x212], 3
mov byte [ebp - 0x211], 4
mov byte [ebp - 0x210], 8
mov byte [ebp - 0x20f], 0xe
mov byte [ebp - 0x20e], 0xc
mov byte [ebp - 0x20d], 0x1c
mov byte [ebp - 0x20c], 0xb
mov byte [ebp - 0x20b], 0
mov byte [ebp - 0x20a], 5
mov byte [ebp - 0x209], 0x16
mov byte [ebp - 0x208], 1
mov byte [ebp - 0x207], 0x17
mov byte [ebp - 0x206], 2
mov byte [ebp - 0x205], 0x17
mov byte [ebp - 0x204], 9
mov byte [ebp - 0x203], 6
mov byte [ebp - 0x202], 0
mov byte [ebp - 0x201], 0x20
mov byte [ebp - 0x200], 0xd
mov byte [ebp - 0x1ff], 0x14
mov byte [ebp - 0x1fe], 4
mov byte [ebp - 0x1fd], 0x69
mov byte [ebp - 0x1fc], 0xc0
mov byte [ebp - 0x1fb], 0x39
mov byte [ebp - 0x1fa], 0x16
mov byte [ebp - 0x1f9], 6
mov byte [ebp - 0x1f8], 7
mov byte [ebp - 0x1f7], 4
mov byte [ebp - 0x1f6], 0x24
mov byte [ebp - 0x1f5], 7
mov byte [ebp - 0x1f4], 6
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x214]
and eax, 0xe4
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x214]
or ecx, 0xe4
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x214]
mov byte [ebp + eax - 0xab4], cl
push 2
lea ecx, [ebp - 0xad8]
call fcn.100219b2
mov dword [ebp - 4], 0x13
mov dword [ebp - 0xf4], 0xbdba76aa
mov dword [ebp - 0xce8], 0x5bb5a275
mov dword [ebp - 0xcf0], 0xfffffff8
mov dword [ebp - 0x88], 0
jmp 0x1001c3fe
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x1001c420
push dword [ebp - 0x88]
lea ecx, [ebp - 0xad8]
call fcn.10021a50
mov dword [eax], 9
jmp 0x1001c3f1
mov dword [ebp - 0x88], 0
jmp 0x1001c439
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jge 0x1001c455
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xeb0], 1
jmp 0x1001c42c
mov dword [ebp - 0xf4], 0
jmp 0x1001c46e
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jg 0x1001c5b8
mov dword [ebp - 0xcf8], 0
mov dword [ebp - 0xd00], 0x9eeda585
mov dword [ebp - 0xd98], 0x57f451d5
mov dword [ebp - 0xda0], 1
mov dword [ebp - 0x998], 0xfffffffd
mov dword [ebp - 0xda8], 0x246c3825
mov dword [ebp - 0xdb0], 0xb57a67d9
mov dword [ebp - 0xdf4], 0xa83d87e3
mov dword [ebp - 0xde8], 0x59ea4d59
mov dword [ebp - 0x958], 0xec46bc22
push 2
lea ecx, [ebp - 0xd10]
call fcn.100219b2
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x3b0], 0xffff
mov dword [ebp - 0x288], 0
jmp 0x1001c513
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 2
jge 0x1001c532
push dword [ebp - 0x288]
lea ecx, [ebp - 0xd10]
call fcn.10021a50
or dword [eax], 0xffffffff
jmp 0x1001c506
push dword [ebp - 0xf4]
lea ecx, [ebp - 0xad8]
call fcn.10021a50
push dword [ebp - 0xf4]
lea ecx, [ebp - 0xad8]
call fcn.10021a50
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xd7c], eax
mov eax, dword [ebp - 0x3b0]
imul eax, dword [ebp - 0x958]
mov dword [ebp - 0x734], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x734]
mov dword [ebp + eax - 0xeb0], ecx
mov eax, dword [ebp - 0x734]
sub eax, 0xc9db
mov dword [ebp - 0x998], eax
mov eax, dword [ebp - 0x3b0]
inc eax
mov dword [ebp - 0x3b0], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xd10]
call fcn.10021a34
jmp 0x1001c461
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xad8]
call fcn.10021a34
mov dword [ebp - 0x3c], 2
and dword [ebp - 0x308], 0
jmp 0x1001c5df
mov eax, dword [ebp - 0x3c]
inc eax
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x21
jae 0x1001cb18
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x214]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x3c], eax
jne 0x1001c6fd
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0x214]
inc eax
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0x214]
mov ecx, dword [ebp - 0x3c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x324], 0xd4e06482
mov dword [ebp - 0xcc4], 0x7d45db34
mov dword [ebp - 0xc00], 0x887cf2e5
mov dword [ebp - 0xbbc], 3
mov dword [ebp - 0xdb4], 0x85faafe3
mov dword [ebp - 0xbc4], 0xffffffff
mov dword [ebp - 0xccc], 0x412df3d3
mov dword [ebp - 0xdc4], 0xcf4c59cd
mov dword [ebp - 0xdc0], 0xcf4c59cd
mov dword [ebp - 0xdbc], 0xcf4c59cd
mov dword [ebp - 0xdb8], 0xcf4c59cd
mov dword [ebp - 0xbcc], 0xb8e9646b
mov dword [ebp - 0x5c4], 0x45ccb972
mov dword [ebp - 0x324], 0xfffffff7
jmp 0x1001c6c6
mov eax, dword [ebp - 0x324]
dec eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0xfffffff5
je 0x1001c6eb
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1001c6e9
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x1001c6b9
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
jmp 0x1001c5d7
push 2
lea ecx, [ebp - 0xa70]
call fcn.100219b2
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x32c], 0
jmp 0x1001c72a
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 2
jge 0x1001c74c
push dword [ebp - 0x32c]
lea ecx, [ebp - 0xa70]
call fcn.10021a50
mov dword [eax], 0xdf75dcec
jmp 0x1001c71d
push 0
lea ecx, [ebp - 0xa70]
call fcn.10021a50
and dword [eax], 0
jmp 0x1001c782
push 0
lea ecx, [ebp - 0xa70]
call fcn.10021a50
mov dword [ebp - 0x84c], eax
mov eax, dword [ebp - 0x84c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x84c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa70]
call fcn.10021a50
cmp dword [eax], 0x16
jne 0x1001c7de
mov byte [ebp - 0x138], 0
movzx eax, byte [ebp - 0x138]
test eax, eax
je 0x1001c7bd
push 0xed0
push 0
push 0x20f7
push 0x1f89
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1001c7dc
push 1
push 0x20e8
call dword [sym.imp.USER32.dll_GetSystemMenu]
jmp 0x1001c75e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa70]
call fcn.10021a34
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x308]
movzx eax, byte [ebp + eax - 0x216]
movsx eax, byte [ebp + eax - 0xab4]
mov ecx, dword [ebp - 0x3c]
movzx ecx, byte [ebp + ecx - 0x213]
and ecx, eax
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x308]
movzx eax, byte [ebp + eax - 0x216]
movsx eax, byte [ebp + eax - 0xab4]
mov edx, dword [ebp - 0x3c]
movzx edx, byte [ebp + edx - 0x213]
or edx, eax
sub edx, ecx
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0x214]
mov byte [ebp + eax - 0xab4], dl
mov dword [ebp - 0xc4], 0xd41
push 2
lea ecx, [ebp - 0x8a4]
call fcn.100219b2
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x2e0], 0
jmp 0x1001c884
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 2
jge 0x1001c8a3
push dword [ebp - 0x2e0]
lea ecx, [ebp - 0x8a4]
call fcn.10021a50
or dword [eax], 0xffffffff
jmp 0x1001c877
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x5cc], eax
push 1
lea ecx, [ebp - 0x8a4]
call fcn.10021a50
mov ecx, dword [ebp - 0x5cc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x5cc]
jge 0x1001c8de
mov dword [ebp - 0x73c], 1
jmp 0x1001c8e5
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x73c], eax
jne 0x1001c8ff
mov dword [ebp - 0x5d4], 1
jmp 0x1001c906
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0xc4]
imul eax, dword [ebp - 0x5d4]
test eax, eax
jg 0x1001c923
mov dword [ebp - 0x7f4], 1
jmp 0x1001c92a
and dword [ebp - 0x7f4], 0
cmp dword [ebp - 0x7f4], 0x42ca
jg 0x1001c942
mov dword [ebp - 0x5dc], 1
jmp 0x1001c949
and dword [ebp - 0x5dc], 0
imul eax, dword [ebp - 0x5dc], 0xffffffff
test eax, eax
ja 0x1001caa2
mov dword [ebp - 0x370], 0x700d35da
mov dword [ebp - 0x298], 0
jmp 0x1001c97b
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 4
jge 0x1001c997
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0xe2c], 0xfffffff7
jmp 0x1001c96e
mov eax, 0x378cabcc
test eax, eax
je 0x1001c9b5
cmp dword [ebp - 0x370], 0
je 0x1001c9b5
mov dword [ebp - 0x744], 1
jmp 0x1001c9bc
and dword [ebp - 0x744], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xe2c], 0xfffffffe
cmp dword [ebp - 0x744], 0xfffffffe
je 0x1001c9e2
mov dword [ebp - 0x960], 1
jmp 0x1001c9e9
and dword [ebp - 0x960], 0
push 1
lea ecx, [ebp - 0x8a4]
call fcn.10021a50
push 1
lea ecx, [ebp - 0x8a4]
call fcn.10021a50
push 5
pop eax
test eax, eax
jne 0x1001ca23
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xe2c], 0
jne 0x1001ca23
and dword [ebp - 0x5e4], 0
jmp 0x1001ca2d
mov dword [ebp - 0x5e4], 1
mov eax, dword [ebp - 0x370]
cmp dword [ebp - 0x5e4], eax
jl 0x1001ca47
mov dword [ebp - 0x888], 1
jmp 0x1001ca4e
and dword [ebp - 0x888], 0
push 0
lea ecx, [ebp - 0x8a4]
call fcn.10021a50
mov eax, dword [eax]
cmp eax, dword [ebp - 0x888]
jne 0x1001ca71
mov dword [ebp - 0x5ec], 1
jmp 0x1001ca78
and dword [ebp - 0x5ec], 0
cmp dword [ebp - 0x5ec], 0xffffffff
jne 0x1001ca8d
mov dword [ebp - 0x74c], 1
jmp 0x1001ca94
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x370], eax
jmp 0x1001cabf
mov byte [ebp - 0x134], 0
movzx eax, byte [ebp - 0x134]
test eax, eax
je 0x1001cabf
push 0x1beb
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [ebp - 0xc4], 0
jmp 0x1001cad8
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x15
jl 0x1001cafd
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x1001cafb
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
jmp 0x1001cacb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8a4]
call fcn.10021a34
and dword [ebp - 0x308], 0
jmp 0x1001c5d7
mov dword [ebp - 0x2a0], 0
jmp 0x1001cb31
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 1
jge 0x1001cb4d
mov eax, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0x2e8], 0xc75b57fd
jmp 0x1001cb24
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2e8], 0x17
jmp 0x1001cb7b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2e8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2e8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2e8], 0xffffffed
jg 0x1001cbb1
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x1001cbaf
push 0x113e
push 0x1767
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x1001cb60
xor eax, eax
inc eax
imul eax, eax, 0xe
mov byte [ebp + eax - 0xab4], 0
mov dword [ebp - 0x2a8], 0xffffffff
mov dword [ebp - 0xd84], 0xfffffff9
mov dword [ebp - 0x5f4], 0xd24b5e49
mov dword [ebp - 0x90], 0
jmp 0x1001cbf6
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x1001cc12
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0xf3c], 1
jmp 0x1001cbe9
mov dword [ebp - 0x90], 0
jmp 0x1001cc2b
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x1001cc47
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0xbd4], 2
jmp 0x1001cc1e
mov dword [ebp - 0x2a8], 0
jmp 0x1001cc60
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 2
jg 0x1001cca4
mov dword [ebp - 0x1c8], 0x256a9ef7
mov dword [ebp - 0x1c8], 0
jmp 0x1001cc8c
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 2
jg 0x1001cca2
cmp dword [ebp - 0x1c8], 0
je 0x1001cca0
jmp 0x1001cca2
jmp 0x1001cc7f
jmp 0x1001cc53
mov eax, dword [ebp - 0x5f4]
dec eax
mov dword [ebp - 0x5f4], eax
lea eax, [ebp - 0xab4]
push eax
lea ecx, [ebp - 0xf30]
call fcn.1002191b
mov dword [ebp - 0x9a0], eax
mov eax, dword [ebp - 0x9a0]
mov dword [ebp - 0x96c], eax
mov dword [ebp - 4], 0x17
mov edx, dword [ebp - 0x7fc]
mov ecx, dword [ebp - 0x96c]
call fcn.1000aa0e
mov dword [0x106184d4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf30]
call fcn.1002193e
push 2
lea ecx, [ebp - 0x3e8]
call fcn.100219b2
mov dword [ebp - 4], 0x18
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x9a8], 0
mov dword [ebp - 0x978], 0xffffffff
mov dword [ebp - 0x328], 0
jmp 0x1001cd4c
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 2
jge 0x1001cd6e
push dword [ebp - 0x328]
lea ecx, [ebp - 0x3e8]
call fcn.10021a50
mov dword [eax], 0xfffffffb
jmp 0x1001cd3f
mov dword [ebp - 0xcc], 1
jmp 0x1001cd87
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jl 0x1001cef9
mov dword [ebp - 0x2b0], 0x8f6e
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x3e8]
call fcn.10021a50
cmp dword [eax], 0
jne 0x1001ce98
push 1
lea ecx, [ebp - 0x3e8]
call fcn.10021a50
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0xcd4], eax
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x3e8]
call fcn.10021a50
mov esi, dword [ebp - 0x2b0]
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x3e8]
call fcn.10021a50
cmp esi, dword [eax]
jne 0x1001ce09
mov dword [ebp - 0x5fc], 1
jmp 0x1001ce10
and dword [ebp - 0x5fc], 0
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x3e8]
call fcn.10021a50
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5fc]
jg 0x1001ce37
mov dword [ebp - 0x754], 1
jmp 0x1001ce3e
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x9a8], eax
push 1
lea ecx, [ebp - 0x3e8]
call fcn.10021a50
cmp dword [eax], 0
jne 0x1001ce77
push 1
lea ecx, [ebp - 0x3e8]
call fcn.10021a50
cmp dword [eax], 0
jne 0x1001ce77
and dword [ebp - 0x604], 0
jmp 0x1001ce81
mov dword [ebp - 0x604], 1
mov eax, dword [ebp - 0x2b0]
cmp eax, dword [ebp - 0x604]
jg 0x1001ce98
and dword [ebp - 0x854], 0
jmp 0x1001cea2
mov dword [ebp - 0x854], 1
imul eax, dword [ebp - 0x854], 0x4952
test eax, eax
je 0x1001cec5
cmp dword [ebp - 0x2b0], 0
je 0x1001cec5
mov dword [ebp - 0x60c], 1
jmp 0x1001cecc
and dword [ebp - 0x60c], 0
cmp dword [ebp - 0x60c], 0
jne 0x1001cee1
mov dword [ebp - 0x75c], 1
jmp 0x1001cee8
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0x978], eax
jmp 0x1001cd7a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3e8]
call fcn.10021a34
and dword [ebp - 0x2f0], 0
jmp 0x1001cf1e
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0xf
jae 0x1001d141
mov dword [ebp - 0xfc], 0x6318
mov dword [ebp - 0x62c], 0x210b999f
mov dword [ebp - 0x614], 0x9b4e94f9
push 2
lea ecx, [ebp - 0xaf0]
call fcn.100219b2
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x634], 1
mov dword [ebp - 0x38], 0
jmp 0x1001cf77
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1001cf93
push dword [ebp - 0x38]
lea ecx, [ebp - 0xaf0]
call fcn.10021a50
mov dword [eax], 0xa3cfce29
jmp 0x1001cf70
mov dword [ebp - 0x38], 0
jmp 0x1001cfa3
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1001cfb9
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xe74], 0xfffffff8
jmp 0x1001cf9c
mov dword [ebp - 0x38], 0
jmp 0x1001cfc9
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1001cfdf
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xe44], 1
jmp 0x1001cfc2
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x614], eax
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0x614]
jg 0x1001d005
mov dword [ebp - 0x804], 1
jmp 0x1001d00c
and dword [ebp - 0x804], 0
push 5
pop eax
test eax, eax
je 0x1001d046
mov esi, dword [ebp - 0xfc]
push 1
lea ecx, [ebp - 0xaf0]
call fcn.10021a50
mov dword [eax], esi
push 1
lea ecx, [ebp - 0xaf0]
call fcn.10021a50
cmp dword [eax], 0
je 0x1001d046
mov dword [ebp - 0x61c], 1
jmp 0x1001d04d
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x804]
sub eax, dword [ebp - 0x61c]
cmp eax, dword [ebp - 0xfc]
je 0x1001d06d
mov dword [ebp - 0x764], 1
jmp 0x1001d074
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x764], eax
jg 0x1001d08e
mov dword [ebp - 0x624], 1
jmp 0x1001d095
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x624], eax
jl 0x1001d0af
mov dword [ebp - 0x870], 1
jmp 0x1001d0b6
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x62c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x870]
mov dword [ebp + eax - 0xe74], ecx
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0xbdc], eax
mov eax, 0x1720
test eax, eax
je 0x1001d0f9
xor eax, eax
je 0x1001d0f9
mov dword [ebp - 0x76c], 1
jmp 0x1001d100
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x76c]
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x634]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xe44], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf0]
call fcn.10021a34
mov eax, dword [ebp - 0x2f0]
mov byte [ebp + eax - 0xab4], 0
jmp 0x1001cf11
mov dword [ebp - 0xde4], 0x6dd1e1e8
mov byte [ebp - 0x133], 0
movzx eax, byte [ebp - 0x133]
test eax, eax
je 0x1001d168
push 0x1c4c
call dword [sym.imp.USER32.dll_GetDC]
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1001d193
push 0
push 0
push 0x2517
push 0xf6a
push 0xb02
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov eax, dword [0x106183d0]
cmp eax, dword [ebp - 0x264]
je 0x1001d1ad
mov eax, dword [0x106184d4]
cmp eax, dword [ebp - 0x264]
jne 0x1001d1c5
mov ecx, dword [ebp + 0xc]
call fcn.10021475
push eax
push dword [ebp + 8]
call fcn.100130c6
pop ecx
pop ecx
jmp 0x100203ca
mov dword [ebp - 0xa0], 0xffffffff
mov dword [ebp - 0x1c0], 0x2f144811
mov dword [ebp - 0x1a8], 0xffffffff
mov dword [ebp - 0x184], 0xdadf8609
mov dword [ebp - 0x104], 0x38f738f5
mov dword [ebp - 0x440], 0x1dc7
mov dword [ebp - 0x80], 0
jmp 0x1001d211
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1001d227
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x644], 1
jmp 0x1001d20a
mov dword [ebp - 0x80], 0
jmp 0x1001d237
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x1001d24d
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xb84], 0x9c8ddac0
jmp 0x1001d230
mov dword [ebp - 0xa0], 0
jmp 0x1001d266
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x1001d37d
mov dword [ebp - 0x1c0], 1
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1a8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1a8]
cmp ecx, dword [ebp + eax - 0xb84]
jle 0x1001d2aa
mov dword [ebp - 0x80c], 1
jmp 0x1001d2b1
and dword [ebp - 0x80c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb84]
imul eax, dword [ebp - 0x80c]
test eax, eax
je 0x1001d2ee
cmp dword [ebp - 0x1a8], 0
je 0x1001d2ee
mov eax, dword [ebp - 0xa0]
cmp dword [ebp + eax*4 - 0x644], 0
je 0x1001d2ee
mov dword [ebp - 0x63c], 1
jmp 0x1001d2f5
and dword [ebp - 0x63c], 0
cmp dword [ebp - 0x63c], 0x2a28
jne 0x1001d30d
mov dword [ebp - 0x774], 1
jmp 0x1001d314
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x644]
cmp eax, dword [ebp - 0x184]
jge 0x1001d341
mov dword [ebp - 0x85c], 1
jmp 0x1001d348
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0xa0]
add eax, dword [ebp - 0x85c]
cmp eax, 6
jae 0x1001d365
mov dword [ebp - 0x64c], 1
jmp 0x1001d36c
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x104], eax
jmp 0x1001d259
mov eax, 0x5e42506e
test eax, eax
je 0x1001d4f4
cmp dword [ebp - 0x1a8], 0
je 0x1001d39c
mov eax, 0xb06a83cd
test eax, eax
jne 0x1001d3ae
mov eax, 0xfffe
test eax, eax
jne 0x1001d3ae
and dword [ebp - 0x77c], 0
jmp 0x1001d3b8
mov dword [ebp - 0x77c], 1
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x77c], eax
jne 0x1001d3d2
mov dword [ebp - 0x654], 1
jmp 0x1001d3d9
and dword [ebp - 0x654], 0
cmp dword [ebp - 0x654], 0xac89
jg 0x1001d3f1
mov dword [ebp - 0x814], 1
jmp 0x1001d3f8
and dword [ebp - 0x814], 0
cmp dword [ebp - 0x814], 0xffffffff
jl 0x1001d40d
mov dword [ebp - 0x65c], 1
jmp 0x1001d414
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x440]
je 0x1001d43a
mov dword [ebp - 0x414], 1
jmp 0x1001d441
and dword [ebp - 0x414], 0
cmp dword [ebp - 0x414], 0x9002fce4
jae 0x1001d462
cmp dword [ebp - 0x184], 0
je 0x1001d462
mov dword [ebp - 0x418], 1
jmp 0x1001d469
and dword [ebp - 0x418], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb84]
cmp eax, dword [ebp - 0x418]
jl 0x1001d48a
mov dword [ebp - 0x420], 1
jmp 0x1001d491
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x420], eax
je 0x1001d4ab
mov dword [ebp - 0x428], 1
jmp 0x1001d4b2
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x428], eax
je 0x1001d4cc
mov dword [ebp - 0x430], 1
jmp 0x1001d4d3
and dword [ebp - 0x430], 0
cmp dword [ebp - 0x430], 0xffff
jbe 0x1001d4e8
cmp dword [ebp - 0x1c0], 0
je 0x1001d4f4
mov dword [ebp - 0x438], 1
jmp 0x1001d4fb
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xbe4], eax
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0xcdc], eax
cmp dword [ebp - 0x440], 6
jne 0x1001d534
mov dword [ebp - 0x448], 1
jmp 0x1001d53b
and dword [ebp - 0x448], 0
cmp dword [ebp - 0x448], 0xfffffffa
jne 0x1001d550
mov dword [ebp - 0x450], 1
jmp 0x1001d557
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
sub eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0xa0]
imul eax, eax, 0x5604
mov dword [ebp - 0x184], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
je 0x1001ffa5
mov eax, dword [ebp - 0x2b8]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1001ffa5
mov dword [ebp - 0x54], 0x860b4ffb
mov dword [ebp - 0x4b0], 4
push 3
lea ecx, [ebp - 0xb9c]
call fcn.100219b2
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0xa8], 0
jmp 0x1001d5e9
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x1001d605
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xd20], 1
jmp 0x1001d5dc
mov dword [ebp - 0xa8], 0
jmp 0x1001d61e
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x1001d640
push dword [ebp - 0xa8]
lea ecx, [ebp - 0xb9c]
call fcn.10021a50
mov dword [eax], 1
jmp 0x1001d611
mov byte [ebp - 0x13c], 0
movzx eax, byte [ebp - 0x13c]
test eax, eax
je 0x1001d65a
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x54], 0
jmp 0x1001d66a
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jg 0x1001da1d
mov dword [ebp - 0xb3c], 7
mov dword [ebp - 0xb38], 7
mov dword [ebp - 0xb34], 7
mov dword [ebp - 0xb30], 7
lea ecx, [ebp - 0x371]
call fcn.10021a5f
push eax
lea eax, [ebp - 0xb2c]
push eax
lea eax, [ebp - 0xb3c]
push eax
lea ecx, [ebp - 0xe90]
call fcn.10021a62
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3bc]
call fcn.10021a0e
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x990], 0xaea1dc7e
mov dword [ebp - 0x9c0], 0
mov eax, 0xa17d0b0a
test eax, eax
je 0x1001d8ed
cmp dword [ebp - 0x54], 0
jne 0x1001d87a
push 0
lea ecx, [ebp - 0x3bc]
call fcn.10021a50
cmp dword [eax], 0x6dab
jl 0x1001d721
mov dword [ebp - 0x458], 1
jmp 0x1001d728
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x458], eax
jge 0x1001d742
cmp dword [ebp - 0x54], 0
jne 0x1001d742
and dword [ebp - 0x460], 0
jmp 0x1001d74c
mov dword [ebp - 0x460], 1
mov esi, dword [ebp - 0x54]
imul esi, dword [ebp - 0x460]
imul esi, dword [ebp - 0x54]
push 1
lea ecx, [ebp - 0x3bc]
call fcn.10021a50
cmp esi, dword [eax]
jl 0x1001d777
mov dword [ebp - 0x468], 1
jmp 0x1001d77e
and dword [ebp - 0x468], 0
push 1
lea ecx, [ebp - 0x3bc]
call fcn.10021a50
mov ecx, dword [ebp - 0x468]
imul ecx, dword [eax]
cmp ecx, 0x9080
jge 0x1001d7a8
mov dword [ebp - 0x9b0], 1
jmp 0x1001d7af
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xbf0], eax
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0xd8c], eax
push 0
lea ecx, [ebp - 0x3bc]
call fcn.10021a50
cmp dword [eax], 0xe155
je 0x1001d7e5
mov dword [ebp - 0x470], 1
jmp 0x1001d7ec
and dword [ebp - 0x470], 0
imul esi, dword [ebp - 0x470], 0x9cba
push 2
lea ecx, [ebp - 0x3bc]
call fcn.10021a50
cmp esi, dword [eax]
jge 0x1001d813
mov dword [ebp - 0x410], 1
jmp 0x1001d81a
and dword [ebp - 0x410], 0
cmp dword [ebp - 0x410], 0xffffffff
je 0x1001d82f
mov dword [ebp - 0x480], 1
jmp 0x1001d836
and dword [ebp - 0x480], 0
imul eax, dword [ebp - 0x480], 0x7342
cmp eax, 0x69ed994a
jne 0x1001d853
mov dword [ebp - 0x984], 1
jmp 0x1001d85a
and dword [ebp - 0x984], 0
push 2
lea ecx, [ebp - 0x3bc]
call fcn.10021a50
push 0xfffffffffffffffd
pop eax
cmp eax, 0xd31fc531
je 0x1001d87a
and dword [ebp - 0x488], 0
jmp 0x1001d884
mov dword [ebp - 0x488], 1
cmp dword [ebp - 0x488], 0xfffffff8
jl 0x1001d899
mov dword [ebp - 0x490], 1
jmp 0x1001d8a0
and dword [ebp - 0x490], 0
push 0
lea ecx, [ebp - 0x3bc]
call fcn.10021a50
mov ecx, dword [ebp - 0x490]
cmp ecx, dword [eax]
jge 0x1001d8c3
mov dword [ebp - 0x498], 1
jmp 0x1001d8ca
and dword [ebp - 0x498], 0
push 2
lea ecx, [ebp - 0x3bc]
call fcn.10021a50
mov ecx, dword [ebp - 0x498]
cmp ecx, dword [eax]
jle 0x1001d8ed
mov dword [ebp - 0x4a0], 1
jmp 0x1001d8f4
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xd20], 1
push 1
lea ecx, [ebp - 0x3bc]
call fcn.10021a50
mov ecx, dword [ebp - 0x4a0]
add ecx, dword [eax]
cmp ecx, 1
jl 0x1001d928
mov dword [ebp - 0x4a8], 1
jmp 0x1001d92f
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 0x8a6ce2e7
jbe 0x1001d94e
push 3
pop eax
test eax, eax
je 0x1001d94e
mov dword [ebp - 0x9b8], 1
jmp 0x1001d955
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0xbb0], eax
cmp dword [ebp - 0x990], 5
ja 0x1001d976
mov dword [ebp - 0x4b8], 1
jmp 0x1001d97d
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x4b8]
add eax, 0x2fce4a
jne 0x1001d9a3
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd20], 0
jne 0x1001d9a3
and dword [ebp - 0x4c0], 0
jmp 0x1001d9ad
mov dword [ebp - 0x4c0], 1
push 0
lea ecx, [ebp - 0x3bc]
call fcn.10021a50
mov ecx, dword [ebp - 0x4c0]
cmp ecx, dword [eax]
jg 0x1001d9d0
mov dword [ebp - 0x4c8], 1
jmp 0x1001d9d7
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4c8]
sub eax, 0xd5c0f4fd
mov dword [ebp - 0x4d0], eax
push 2
lea ecx, [ebp - 0xb9c]
call fcn.10021a50
mov ecx, dword [ebp - 0x4d0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x9c0], eax
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x3bc]
call fcn.10021a34
jmp 0x1001d663
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb9c]
call fcn.10021a34
mov eax, dword [ebp - 0x2b8]
mov ecx, dword [ebp - 0x2b8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1c4], ecx
mov dword [ebp - 0x310], 0xffffffff
mov dword [ebp - 0xce4], 0xfffffff9
mov dword [ebp - 0x4d8], 0xd24b5e49
mov dword [ebp - 0xb0], 0
jmp 0x1001da78
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x1001da94
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0xf60], 1
jmp 0x1001da6b
mov dword [ebp - 0xb0], 0
jmp 0x1001daad
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x1001dac9
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0xc04], 2
jmp 0x1001daa0
mov dword [ebp - 0x310], 0
jmp 0x1001dae2
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 2
jg 0x1001db26
mov dword [ebp - 0x180], 0x256a9ef7
mov dword [ebp - 0x180], 0
jmp 0x1001db0e
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 2
jg 0x1001db24
cmp dword [ebp - 0x180], 0
je 0x1001db22
jmp 0x1001db24
jmp 0x1001db01
jmp 0x1001dad5
mov eax, dword [ebp - 0x4d8]
dec eax
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0x1c4]
cmp dword [eax], 0x4550
jne 0x1001ffa5
mov eax, dword [ebp - 0x1c4]
cmp dword [eax + 0x74], 0
jbe 0x1001ffa5
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c4]
cmp dword [ecx + eax + 0x78], 0
je 0x1001ffa5
mov dword [ebp - 0xb28], 1
mov dword [ebp - 0xb24], 1
mov dword [ebp - 0xb20], 1
mov dword [ebp - 0xb1c], 1
lea ecx, [ebp - 0x379]
call fcn.10021a5f
push eax
lea eax, [ebp - 0xb18]
push eax
lea eax, [ebp - 0xb28]
push eax
lea ecx, [ebp - 0xed0]
call fcn.10021a62
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe80]
call fcn.10021a0e
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0xdd8], 0
mov dword [ebp - 0xdd4], 0
mov dword [ebp - 0xdd0], 0
mov dword [ebp - 0xdcc], 0
mov dword [ebp - 0x2c0], 0
jmp 0x1001dc11
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 1
jge 0x1001dc2d
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0x2f8], 0xffffffff
jmp 0x1001dc04
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2f8], 0
jmp 0x1001dc5b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2f8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2f8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2f8], 3
jg 0x1001ddb5
mov dword [ebp - 0x218], 0xb950ba1b
mov byte [ebp - 0x12e], 0
movzx eax, byte [ebp - 0x12e]
test eax, eax
je 0x1001dc93
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov dword [ebp - 0x218], 3
jmp 0x1001dcac
mov eax, dword [ebp - 0x218]
dec eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jl 0x1001ddb0
push 3
lea ecx, [ebp - 0xa80]
call fcn.100219b2
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x320], 0
jmp 0x1001dce3
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 3
jge 0x1001dd05
push dword [ebp - 0x320]
lea ecx, [ebp - 0xa80]
call fcn.10021a50
mov dword [eax], 3
jmp 0x1001dcd6
push 0
lea ecx, [ebp - 0xa80]
call fcn.10021a50
and dword [eax], 0
jmp 0x1001dd3b
push 0
lea ecx, [ebp - 0xa80]
call fcn.10021a50
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x4e0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4e0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa80]
call fcn.10021a50
cmp dword [eax], 3
jg 0x1001dd9c
mov dword [ebp - 0x2d0], 0x4d1878ab
mov dword [ebp - 0x2d0], 0
jmp 0x1001dd70
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 3
jg 0x1001dd97
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1001dd95
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1001dd63
jmp 0x1001dd17
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xa80]
call fcn.10021a34
jmp 0x1001dc9f
jmp 0x1001dc40
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe80]
call fcn.10021a34
mov eax, dword [ebp + 8]
mov dword [ebp - 0x174], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c4]
mov edx, dword [ebp - 0x174]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0xd0], edx
mov eax, 0xffff
mov word [ebp - 0x98], ax
mov dword [ebp - 0x4c], 0x3cdf98a5
mov dword [ebp - 0x10c], 8
mov dword [ebp - 0x378], 0xaeafd710
mov dword [ebp - 0x570], 1
mov dword [ebp - 0x99c], 0xa457afc4
mov dword [ebp - 0xdc8], 0xd293e35f
mov dword [ebp - 0xb8], 0
jmp 0x1001de47
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x1001de63
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x3cc], 0x93b4e1a3
jmp 0x1001de3a
mov dword [ebp - 0xb8], 0
jmp 0x1001de7c
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jge 0x1001de98
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x194], 0xfc167656
jmp 0x1001de6f
mov dword [ebp - 0x4c], 2
jmp 0x1001dea8
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1001e22b
mov dword [ebp - 0x538], 0
mov dword [ebp - 0x560], 0x14a5
mov dword [ebp - 0x300], 0
jmp 0x1001dedf
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 1
jge 0x1001def8
mov eax, dword [ebp - 0x300]
mov dword [ebp + eax*4 - 0x50], 0xb4ebb0cb
jmp 0x1001ded2
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x50], 2
jmp 0x1001df1d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x50], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0
jl 0x1001e0a1
mov dword [ebp - 0x510], 0x4ddc8777
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3cc], 1
je 0x1001df54
mov dword [ebp - 0x4e8], 1
jmp 0x1001df5b
and dword [ebp - 0x4e8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3cc]
cmp dword [ebp - 0x4e8], eax
jge 0x1001df7b
mov dword [ebp - 0x4f0], 1
jmp 0x1001df82
and dword [ebp - 0x4f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
cmp dword [ebp - 0x4f0], eax
jl 0x1001dfa0
mov dword [ebp - 0x9c8], 1
jmp 0x1001dfa7
and dword [ebp - 0x9c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
mov eax, dword [ebp + eax*4 - 0x3cc]
mov dword [ebp - 0xc0c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xcec], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x3cc]
sub ecx, dword [ebp + eax - 0x3cc]
jne 0x1001dff4
cmp dword [ebp - 0x10c], 0
jne 0x1001dff4
and dword [ebp - 0x4f8], 0
jmp 0x1001dffe
mov dword [ebp - 0x4f8], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
cmp dword [ebp - 0x4f8], eax
jne 0x1001e01c
mov dword [ebp - 0x500], 1
jmp 0x1001e023
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x500]
imul eax, dword [ebp - 0x538]
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x508]
mov dword [ebp + eax*4 - 0x3cc], ecx
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0xc14], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
mov dword [ebp - 0xd94], eax
xor eax, eax
inc eax
cmp eax, 1
ja 0x1001e082
mov dword [ebp - 0x518], 1
jmp 0x1001e089
and dword [ebp - 0x518], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x518]
mov dword [ebp + eax - 0x194], ecx
jmp 0x1001df08
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0x1131e34f
jne 0x1001e196
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0
je 0x1001e0d7
mov eax, 0x2aafa0b2
test eax, eax
je 0x1001e0d7
mov dword [ebp - 0x520], 1
jmp 0x1001e0de
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x520], eax
jle 0x1001e102
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x194], 0
jne 0x1001e102
and dword [ebp - 0x528], 0
jmp 0x1001e10c
mov dword [ebp - 0x528], 1
cmp dword [ebp - 0x528], 0x5296947a
jl 0x1001e124
mov dword [ebp - 0x530], 1
jmp 0x1001e12b
and dword [ebp - 0x530], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x530]
mov dword [ebp + eax - 0x194], ecx
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0xc1c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [ebp + eax - 0x3cc]
jne 0x1001e16a
mov dword [ebp - 0x384], 1
jmp 0x1001e171
and dword [ebp - 0x384], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x384]
mov dword [ebp + eax - 0x50], ecx
cmp dword [ebp - 0x384], 0
je 0x1001e196
mov dword [ebp - 0x540], 1
jmp 0x1001e19d
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x560]
cmp dword [ebp - 0x540], eax
jge 0x1001e1b7
mov dword [ebp - 0x548], 1
jmp 0x1001e1be
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x3cc]
cmp eax, dword [ebp - 0x548]
jge 0x1001e1dc
mov dword [ebp - 0x550], 1
jmp 0x1001e1e3
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x550], eax
jl 0x1001e1fd
mov dword [ebp - 0x558], 1
jmp 0x1001e204
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x558]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x3cc], eax
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0x378], eax
jmp 0x1001dea1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x194]
mov dword [ebp - 0x568], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x568]
mov dword [ebp + eax - 0x194], ecx
cmp dword [ebp - 0x568], 0x7f5175d1
jl 0x1001e269
mov dword [ebp - 0x5a0], 1
jmp 0x1001e270
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0x378]
cmp eax, dword [ebp - 0x570]
je 0x1001e296
mov dword [ebp - 0x588], 1
jmp 0x1001e29d
and dword [ebp - 0x588], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3cc]
cmp eax, dword [ebp - 0x10c]
jne 0x1001e2be
mov dword [ebp - 0x578], 1
jmp 0x1001e2c5
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x99c]
cmp dword [ebp - 0x578], eax
jle 0x1001e2df
mov dword [ebp - 0x580], 1
jmp 0x1001e2e6
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x378]
cmp dword [ebp - 0x580], eax
jle 0x1001e300
mov dword [ebp - 0x590], 1
jmp 0x1001e307
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x588]
cmp eax, dword [ebp - 0x590]
je 0x1001e321
mov dword [ebp - 0x598], 1
jmp 0x1001e328
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x5a0]
cmp eax, dword [ebp - 0x10c]
jl 0x1001e35c
push 6
pop eax
test eax, eax
je 0x1001e35c
mov dword [ebp - 0x5a8], 1
jmp 0x1001e363
and dword [ebp - 0x5a8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5a8]
mov dword [ebp + eax - 0x3cc], ecx
or dword [ebp - 0x16c], 0xffffffff
mov dword [ebp - 0x1a4], 1
push 2
lea ecx, [ebp - 0xacc]
call fcn.100219b2
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x2c], 0
jmp 0x1001e3ab
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1001e3c1
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xb14], 0xfffffff7
jmp 0x1001e3a4
mov dword [ebp - 0x2c], 0
jmp 0x1001e3d1
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1001e3e7
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xb60], 0x1e707165
jmp 0x1001e3ca
mov dword [ebp - 0x2c], 0
jmp 0x1001e3f7
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1001e413
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xacc]
call fcn.10021a50
mov dword [eax], 0x6947a332
jmp 0x1001e3f0
mov dword [ebp - 0x1a4], 0
jmp 0x1001e42c
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jg 0x1001ea04
mov dword [ebp - 0x18], 0xefc07e17
push 3
lea ecx, [ebp - 0x8b0]
call fcn.100219b2
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x380], 0x5621
mov dword [ebp - 0x14c], 0xfd71021f
mov dword [ebp - 0x334], 0
mov dword [ebp - 0x2d8], 0
jmp 0x1001e488
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 3
jge 0x1001e4aa
push dword [ebp - 0x2d8]
lea ecx, [ebp - 0x8b0]
call fcn.10021a50
mov dword [eax], 0x1131e34f
jmp 0x1001e47b
mov dword [ebp - 0x18], 3
jmp 0x1001e4ba
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1001e675
mov dword [ebp - 0x19c], 7
mov dword [ebp - 0xa1c], 0x6cbcb1a7
mov dword [ebp - 0x19c], 3
jmp 0x1001e4f1
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jl 0x1001e660
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0xb14]
cmp ecx, dword [ebp + eax*4 - 0xb14]
jle 0x1001e520
mov dword [ebp - 0x5e8], 1
jmp 0x1001e527
and dword [ebp - 0x5e8], 0
cmp dword [ebp - 0x18], 0xffffffff
jg 0x1001e539
mov dword [ebp - 0x5b0], 1
jmp 0x1001e540
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x5b0], eax
jne 0x1001e55a
mov dword [ebp - 0x5b8], 1
jmp 0x1001e561
and dword [ebp - 0x5b8], 0
cmp dword [ebp - 0x5b8], 6
je 0x1001e576
mov dword [ebp - 0x5c0], 1
jmp 0x1001e57d
and dword [ebp - 0x5c0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb14]
cmp dword [ebp - 0x5c0], eax
jne 0x1001e59e
mov dword [ebp - 0x5c8], 1
jmp 0x1001e5a5
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0xa1c], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jg 0x1001e5c5
mov dword [ebp - 0x5d0], 1
jmp 0x1001e5cc
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x1a4]
cmp eax, dword [ebp - 0x5d0]
je 0x1001e5e6
mov dword [ebp - 0x5d8], 1
jmp 0x1001e5ed
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x5d8], eax
jl 0x1001e604
mov dword [ebp - 0x5e0], 1
jmp 0x1001e60b
and dword [ebp - 0x5e0], 0
cmp dword [ebp - 0x5e0], 3
jg 0x1001e620
mov dword [ebp - 0x5f0], 1
jmp 0x1001e627
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x5e8]
cmp eax, dword [ebp - 0x5f0]
jg 0x1001e641
mov dword [ebp - 0x5f8], 1
jmp 0x1001e648
and dword [ebp - 0x5f8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5f8]
mov dword [ebp + eax - 0xb60], ecx
jmp 0x1001e4e4
mov eax, dword [ebp - 0x18]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xb60], eax
jmp 0x1001e4b3
mov dword [ebp - 0x18], 3
jmp 0x1001e685
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1001e9f0
mov dword [ebp - 0x600], 0xffff
mov dword [ebp - 0x1ac], 0x60f9aa2a
mov dword [ebp - 0x9a4], 0x2d14a59
mov dword [ebp - 0xc0], 0xfffffffb
mov dword [ebp - 0xa84], 1
mov dword [ebp - 0x600], 0xff8
mov esi, dword [ebp - 0x600]
push 0
lea ecx, [ebp - 0x8b0]
call fcn.10021a50
cmp esi, dword [eax]
je 0x1001e6ee
mov dword [ebp - 0x610], 1
jmp 0x1001e6f5
and dword [ebp - 0x610], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb14]
mov dword [ebp - 0xcf4], eax
cmp dword [ebp - 0x1ac], 0x56cd219f
jle 0x1001e720
mov dword [ebp - 0x608], 1
jmp 0x1001e727
and dword [ebp - 0x608], 0
cmp dword [ebp - 0x608], 0xa0b2b040
jae 0x1001e73f
mov dword [ebp - 0x618], 1
jmp 0x1001e746
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x610]
imul eax, dword [ebp - 0x618]
cmp eax, 0xd9236f91
jae 0x1001e766
mov dword [ebp - 0x620], 1
jmp 0x1001e76d
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x628], eax
push 1
lea ecx, [ebp - 0xacc]
call fcn.10021a50
mov ecx, dword [ebp - 0x628]
mov dword [eax], ecx
mov eax, dword [ebp - 0x628]
sub eax, dword [ebp - 0x9a4]
je 0x1001e7b1
cmp dword [ebp - 0x380], 0
jne 0x1001e7ba
cmp dword [ebp - 0x380], 0
je 0x1001e7cc
cmp dword [ebp - 0x18], 0
je 0x1001e7cc
mov dword [ebp - 0x38c], 1
jmp 0x1001e7d3
and dword [ebp - 0x38c], 0
push 1
lea ecx, [ebp - 0x8b0]
call fcn.10021a50
mov ecx, dword [ebp - 0x38c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x14c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb60]
cmp eax, dword [ebp - 0x14c]
jne 0x1001e815
mov dword [ebp - 0x630], 1
jmp 0x1001e81c
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x630]
sub eax, dword [ebp - 0x380]
je 0x1001e83c
push 0
lea ecx, [ebp - 0x8b0]
call fcn.10021a50
cmp dword [eax], 0
jne 0x1001e841
xor eax, eax
inc eax
je 0x1001e856
cmp dword [ebp - 0xc0], 0
je 0x1001e856
mov dword [ebp - 0x638], 1
jmp 0x1001e85d
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x334]
cmp eax, dword [ebp - 0xc0]
jge 0x1001e883
mov dword [ebp - 0x640], 1
jmp 0x1001e88a
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0xa84], eax
mov dword [ebp - 0xc0], 0
jmp 0x1001e8af
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jg 0x1001e9eb
mov dword [ebp - 0x33c], 0x6e5f3778
mov dword [ebp - 0x14c], 0
jmp 0x1001e8df
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 3
jg 0x1001e9e6
mov dword [ebp - 0x658], 0xd90bcc9d
mov eax, dword [ebp - 0x33c]
sub eax, 0x2fb3
cmp eax, dword [ebp - 0x658]
jg 0x1001e915
mov dword [ebp - 0x648], 1
jmp 0x1001e91c
and dword [ebp - 0x648], 0
mov esi, dword [ebp - 0x648]
sub esi, 8
push 0
lea ecx, [ebp - 0x8b0]
call fcn.10021a50
cmp esi, dword [eax]
jl 0x1001e942
mov dword [ebp - 0x650], 1
jmp 0x1001e949
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x1ac]
add eax, dword [ebp - 0x650]
cmp dword [ebp - 0x334], eax
jge 0x1001e96e
or eax, 0xffffffff
je 0x1001e96e
mov dword [ebp - 0x9ac], 1
jmp 0x1001e975
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xc24], eax
mov eax, dword [ebp - 0x33c]
imul eax, dword [ebp - 0x658]
cmp eax, 3
jb 0x1001e99f
mov dword [ebp - 0x660], 1
jmp 0x1001e9a6
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x660]
jne 0x1001e9be
push 0
lea ecx, [ebp - 0xacc]
call fcn.10021a50
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0xdf0], eax
imul eax, dword [ebp - 0x33c], 0xf5b7
mov ecx, dword [ebp - 0xc0]
mov dword [ebp + ecx*4 - 0xb14], eax
jmp 0x1001e8d2
jmp 0x1001e8a2
jmp 0x1001e67e
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x8b0]
call fcn.10021a34
jmp 0x1001e41f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xacc]
call fcn.10021a34
cmp dword [ebp + 0x10], 0
jbe 0x1001f0fd
mov dword [ebp - 0xac], 0xffffffff
mov dword [ebp - 0xac], 0xffffffe4
jmp 0x1001ea40
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xfffffff4
jg 0x1001eebc
mov dword [ebp - 0x154], 0x6de713a4
mov dword [ebp - 0x9bc], 0xfffffffb
mov dword [ebp - 0x154], 0xfffffffd
jmp 0x1001ea7a
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 8
je 0x1001eeb7
mov dword [ebp - 0x668], 0x3fc5
mov dword [ebp - 0x9b4], 0x10007da0
cmp dword [ebp - 0x668], 0x4077
jle 0x1001ebc4
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
and dword [ebp - 0x29c], 0
jmp 0x1001ead3
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0x570a
jge 0x1001ebc4
and dword [ebp - 0x294], 0
jmp 0x1001eaf9
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0x510d
jge 0x1001ebbf
and dword [ebp - 0x318], 0
jmp 0x1001eb1f
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0x4e23
jge 0x1001ebba
and dword [ebp - 0x28c], 0
jmp 0x1001eb45
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0x5b6
jge 0x1001ebb5
mov eax, dword [ebp - 0x318]
imul eax, dword [ebp - 0x28c]
add eax, dword [ebp - 0x294]
xor eax, dword [ebp - 0x29c]
cdq
mov dword [ebp - 0x980], eax
mov dword [ebp - 0x97c], edx
push dword [ebp - 0x97c]
push dword [ebp - 0x980]
lea ecx, [ebp - 0xf54]
call fcn.1000a964
pop ecx
pop ecx
mov dword [ebp - 0xa24], eax
mov ecx, dword [ebp - 0xa24]
call fcn.10021475
push eax
call fcn.100579ef
pop ecx
lea ecx, [ebp - 0xf54]
call fcn.1002146b
jmp 0x1001eb38
jmp 0x1001eb12
jmp 0x1001eaec
jmp 0x1001eac6
mov dword [ebp - 4], 0x20
cmp dword [ebp - 0x668], 0x3e37
jge 0x1001ebe3
push dword [ebp - 0x9b4]
call fcn.100579ef
pop ecx
jmp 0x1001ebff
or dword [ebp - 4], 0xffffffff
jmp 0x1001ec09
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x2a4], 0
jmp 0x1001ec29
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 1
jge 0x1001ec42
mov eax, dword [ebp - 0x2a4]
mov dword [ebp + eax*4 - 0x60], 0
jmp 0x1001ec1c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x60], 0xfffffffb
jmp 0x1001ec67
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x60], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60], 0xfffffff3
jl 0x1001ecbe
mov dword [ebp - 0x2ac], 0xfffffff6
mov dword [ebp - 0x2ac], 0
jmp 0x1001ec97
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 1
jl 0x1001ecbc
mov byte [ebp - 0x12f], 0
movzx eax, byte [ebp - 0x12f]
test eax, eax
je 0x1001ecba
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x1001ec8a
jmp 0x1001ec52
mov dword [ebp - 0x44], 0
jmp 0x1001ecce
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jg 0x1001eeb2
mov dword [ebp - 0xc2c], 0xda5659cd
mov eax, 0x1b583dc0
test eax, eax
je 0x1001ede0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0xcfc], eax
cmp dword [ebp - 0xac], 0
je 0x1001eda3
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0xac]
jl 0x1001ed20
mov dword [ebp - 0x670], 1
jmp 0x1001ed27
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x670], eax
je 0x1001ed41
mov dword [ebp - 0x678], 1
jmp 0x1001ed48
and dword [ebp - 0x678], 0
cmp dword [ebp - 0x678], 0xbae8b012
jae 0x1001ed60
mov dword [ebp - 0x680], 1
jmp 0x1001ed67
and dword [ebp - 0x680], 0
cmp dword [ebp - 0x680], 0x72c02a3
jge 0x1001ed7f
mov dword [ebp - 0x688], 1
jmp 0x1001ed86
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x154]
imul eax, dword [ebp - 0x688]
test eax, eax
je 0x1001eda3
mov dword [ebp - 0x690], 1
jmp 0x1001edaa
and dword [ebp - 0x690], 0
cmp dword [ebp - 0x690], 0xfffffff9
jg 0x1001edbf
mov dword [ebp - 0x698], 1
jmp 0x1001edc6
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x698], eax
jne 0x1001ede0
mov dword [ebp - 0xa9c], 1
jmp 0x1001ede7
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0xc34], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0xd9c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x60], 0x7ba3f300
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x60], 1
jne 0x1001ee22
mov dword [ebp - 0x6a0], 1
jmp 0x1001ee29
and dword [ebp - 0x6a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
cmp dword [ebp - 0x6a0], eax
jg 0x1001ee47
mov dword [ebp - 0x6a8], 1
jmp 0x1001ee4e
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x6a8]
je 0x1001ee68
mov dword [ebp - 0x6b0], 1
jmp 0x1001ee6f
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x6b0]
lea ecx, [edx + ecx - 0xfffd]
cmp ecx, dword [ebp + eax*4 - 0x60]
jl 0x1001ee94
mov dword [ebp - 0x6b8], 1
jmp 0x1001ee9b
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x6b8]
sub eax, dword [ebp - 0xac]
mov dword [ebp - 0x9bc], eax
jmp 0x1001ecc7
jmp 0x1001ea6d
jmp 0x1001ea33
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [eax + 0x14]
ja 0x1001f0f8
mov dword [ebp - 0xa2c], 0
mov dword [ebp - 0xc3c], 0xf665683c
mov dword [ebp - 0xd04], 2
mov dword [ebp - 0xc44], 0
mov dword [ebp - 0xddc], 2
mov dword [ebp - 0xc4c], 0x707822e6
mov dword [ebp - 0xd14], 0xfffffff8
mov dword [ebp - 0xc54], 0xffffffff
mov dword [ebp - 0xda4], 0xffffffff
mov dword [ebp - 0xc5c], 0xf30cc2fd
mov dword [ebp - 0xd24], 0xa47c9d5f
mov dword [ebp - 0xc64], 0x3edfa831
mov dword [ebp - 0x2b4], 0xfffffffa
mov dword [ebp - 0xde0], 0xab2aee5a
mov dword [ebp - 0xc6c], 0xb35edade
mov dword [ebp - 0xd34], 0x9c45c1d1
push 3
lea ecx, [ebp - 0xd50]
call fcn.100219b2
mov dword [ebp - 4], 0x22
push 1
lea ecx, [ebp - 0xd40]
call fcn.100219b2
mov byte [ebp - 4], 0x23
push 1
lea ecx, [ebp - 0xd30]
call fcn.100219b2
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x344], 0x16e2
mov dword [ebp - 0x9c4], 0xd955a619
mov dword [ebp - 0x30], 0
jmp 0x1001efc8
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x1001efe1
push dword [ebp - 0x30]
lea ecx, [ebp - 0xd50]
call fcn.10021a50
or dword [eax], 0xffffffff
jmp 0x1001efc1
mov dword [ebp - 0x30], 0
jmp 0x1001eff1
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1001f00d
push dword [ebp - 0x30]
lea ecx, [ebp - 0xd40]
call fcn.10021a50
mov dword [eax], 0x821342f3
jmp 0x1001efea
mov dword [ebp - 0x30], 0
jmp 0x1001f01d
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1001f039
push dword [ebp - 0x30]
lea ecx, [ebp - 0xd30]
call fcn.10021a50
mov dword [eax], 0xa98ceef9
jmp 0x1001f016
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0xa2c]
cmp eax, dword [ebp - 0x344]
jl 0x1001f060
mov dword [ebp - 0x6c0], 1
jmp 0x1001f067
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0x9c4], eax
mov dword [ebp - 0x2b4], 0
jmp 0x1001f08c
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 7
jl 0x1001f0c0
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1001f0be
push 0xf6a
push 0
push 0x26a8
push 0x1942
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x1001f07f
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0xd30]
call fcn.10021a34
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0xd40]
call fcn.10021a34
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd50]
call fcn.10021a34
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebp - 0x98], ax
jmp 0x1001fa2f
mov dword [ebp - 0x21c], 0x50bf34fd
mov dword [ebp - 0x34c], 0x1e948708
mov dword [ebp - 0x15c], 0xfffffff7
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x6e8], 0xffffffff
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0xc74], eax
mov dword [ebp - 0x224], 7
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x21c]
jg 0x1001f15f
mov dword [ebp - 0x6c8], 1
jmp 0x1001f166
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x34c]
cmp eax, dword [ebp - 0x6c8]
jge 0x1001f186
cmp dword [ebp - 0x224], 0
jne 0x1001f186
and dword [ebp - 0x6d0], 0
jmp 0x1001f190
mov dword [ebp - 0x6d0], 1
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
cmp eax, dword [ebp - 0x6d0]
jg 0x1001f1b6
mov dword [ebp - 0x6d8], 1
jmp 0x1001f1bd
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x21c]
sub eax, dword [ebp - 0x6d8]
cmp eax, dword [ebp - 0x34c]
jge 0x1001f1dd
mov dword [ebp - 0x6e0], 1
jmp 0x1001f1e4
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x6e8], eax
mov dword [ebp - 0x15c], 0
jmp 0x1001f209
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xd
jl 0x1001f2a8
mov dword [ebp - 0x1b4], 0x3191
cmp dword [ebp - 0x1b4], 0
je 0x1001f23e
cmp dword [ebp - 0x1b4], 0
je 0x1001f23e
mov dword [ebp - 0xaa4], 1
jmp 0x1001f245
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0x1b4]
cmp eax, dword [ebp - 0x21c]
je 0x1001f265
cmp dword [ebp - 0x1b4], 0
jne 0x1001f265
and dword [ebp - 0x9cc], 0
jmp 0x1001f26f
mov dword [ebp - 0x9cc], 1
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0xdac], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x6e8], eax
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x1001f2a3
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
jmp 0x1001f1fc
push 2
lea ecx, [ebp - 0xd60]
call fcn.100219b2
mov dword [ebp - 4], 0x25
mov dword [ebp - 0x234], 0x9bdba76a
mov dword [ebp - 0x22c], 0
jmp 0x1001f2df
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 2
jge 0x1001f301
push dword [ebp - 0x22c]
lea ecx, [ebp - 0xd60]
call fcn.10021a50
mov dword [eax], 0xffff
jmp 0x1001f2d2
mov dword [ebp - 0x234], 0
jmp 0x1001f31a
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 1
jg 0x1001f33c
mov dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x6f0]
dec eax
mov dword [ebp - 0x6f0], eax
jmp 0x1001f30d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd60]
call fcn.10021a34
mov eax, dword [0x1061846c]
and eax, 1
jne 0x1001f382
mov eax, dword [0x1061846c]
or eax, 1
mov dword [0x1061846c], eax
mov dword [ebp - 4], 0x26
mov ecx, 0x106184b0
call fcn.10021a76
push 0x1006ffe7
call fcn.100579c5
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x24], 0x10c93b4e
mov dword [ebp - 0x114], 0xfffffffe
mov dword [ebp - 0x760], 0x7f464f61
mov dword [ebp - 0x23c], 0
jmp 0x1001f3b6
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 2
jge 0x1001f3d2
mov eax, dword [ebp - 0x23c]
mov dword [ebp + eax*4 - 0x3dc], 0x7a332a5b
jmp 0x1001f3a9
mov dword [ebp - 0x24], 0
jmp 0x1001f3e2
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
je 0x1001f685
mov dword [ebp - 0x244], 0
jmp 0x1001f405
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 2
jge 0x1001f421
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0x3d4], 0xffffffff
jmp 0x1001f3f8
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x3d4], 0
jmp 0x1001f44f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3d4]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x3d4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3d4], 5
jg 0x1001f680
mov dword [ebp - 0x1bc], 0x84255ebd
mov dword [ebp - 0x354], 0x15b45bea
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3d4], 0xffffffff
jge 0x1001f493
mov dword [ebp - 0x6f8], 1
jmp 0x1001f49a
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x1bc]
cmp dword [ebp - 0x6f8], eax
je 0x1001f4b4
mov dword [ebp - 0xa34], 1
jmp 0x1001f4bb
and dword [ebp - 0xa34], 0
or eax, 0xffffffff
add eax, 7
mov dword [ebp - 0x354], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x354]
add ecx, dword [ebp - 0x1bc]
cmp ecx, dword [ebp + eax - 0x3d4]
je 0x1001f4ee
mov dword [ebp - 0x9d4], 1
jmp 0x1001f4f5
and dword [ebp - 0x9d4], 0
cmp dword [ebp - 0x1bc], 0xffffffff
je 0x1001f50a
mov dword [ebp - 0x700], 1
jmp 0x1001f511
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x700], eax
jge 0x1001f528
mov dword [ebp - 0x708], 1
jmp 0x1001f52f
and dword [ebp - 0x708], 0
cmp dword [ebp - 0x708], 0xffffffff
je 0x1001f544
mov dword [ebp - 0x710], 1
jmp 0x1001f54b
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x710], eax
jg 0x1001f562
mov dword [ebp - 0x718], 1
jmp 0x1001f569
and dword [ebp - 0x718], 0
cmp dword [ebp - 0x718], 2
jg 0x1001f57e
mov dword [ebp - 0x720], 1
jmp 0x1001f585
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x720]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0x24]
je 0x1001f5b5
cmp dword [ebp - 0x1bc], 0
je 0x1001f5b5
mov dword [ebp - 0x728], 1
jmp 0x1001f5bc
and dword [ebp - 0x728], 0
cmp dword [ebp - 0x728], 7
jb 0x1001f5da
cmp dword [ebp - 0x354], 0
je 0x1001f5da
mov dword [ebp - 0x730], 1
jmp 0x1001f5e1
and dword [ebp - 0x730], 0
cmp dword [ebp - 0x730], 0xffffffff
jge 0x1001f5f6
mov dword [ebp - 0x738], 1
jmp 0x1001f5fd
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x738]
dec eax
dec eax
je 0x1001f61c
cmp dword [ebp - 0x114], 0
je 0x1001f61c
mov dword [ebp - 0xa8c], 1
jmp 0x1001f623
and dword [ebp - 0xa8c], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc7c], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xd44], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1bc]
jge 0x1001f647
cmp dword [ebp - 0x24], 0
xor eax, eax
sub eax, dword [ebp - 0x24]
je 0x1001f661
push 4
pop eax
test eax, eax
je 0x1001f661
mov dword [ebp - 0x740], 1
jmp 0x1001f668
and dword [ebp - 0x740], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x740]
mov dword [ebp + eax - 0x3dc], ecx
jmp 0x1001f434
jmp 0x1001f3db
cmp dword [ebp - 0x24], 0
jne 0x1001f73c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3dc], 0xffff4d00
jge 0x1001f6ae
mov dword [ebp - 0x748], 1
jmp 0x1001f6b5
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x24], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp + eax - 0x3dc]
jge 0x1001f6dc
mov dword [ebp - 0x750], 1
jmp 0x1001f6e3
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x750]
je 0x1001f703
cmp dword [ebp - 0x114], 0
jne 0x1001f703
and dword [ebp - 0x758], 0
jmp 0x1001f70d
mov dword [ebp - 0x758], 1
mov eax, dword [ebp - 0x760]
cmp eax, dword [ebp - 0x758]
jne 0x1001f727
mov dword [ebp - 0x768], 1
jmp 0x1001f72e
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x760]
cmp dword [ebp - 0x768], eax
jge 0x1001f751
cmp dword [ebp - 0x114], 0
je 0x1001f751
mov dword [ebp - 0x9dc], 1
jmp 0x1001f758
and dword [ebp - 0x9dc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3dc]
mov dword [ebp - 0xc84], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3dc]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x3dc], eax
movzx eax, byte [0x106183b8]
test eax, eax
je 0x1001f7f1
mov ecx, 0x106184b0
call fcn.10021b3b
movzx eax, al
test eax, eax
jne 0x1001f7f1
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x770]
push eax
mov ecx, 0x106184b0
call fcn.10021b44
lea eax, [ebp - 0xdec]
push eax
mov ecx, 0x106184b0
call fcn.10021b2d
push eax
lea ecx, [ebp - 0x770]
call fcn.1002199f
movzx eax, al
test eax, eax
je 0x1001f7f1
lea ecx, [ebp - 0x770]
call fcn.10021bbe
mov eax, dword [eax + 4]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0xffffffff
jne 0x1001fa2f
mov ecx, 0x106184b0
call fcn.10021c02
mov ecx, dword [ebp - 0xd0]
add eax, dword [ecx + 0x18]
push eax
mov ecx, 0x106184b0
call fcn.10021c06
and dword [ebp - 0x164], 0
jmp 0x1001f832
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x164]
cmp ecx, dword [eax + 0x18]
jae 0x1001fa2f
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x174]
add ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x164]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x778], eax
mov dword [ebp - 0x788], 0x4a0
mov dword [ebp - 0xa44], 0x10007e28
cmp dword [ebp - 0x788], 0x56f
jle 0x1001f931
and dword [ebp - 0x25c], 0
jmp 0x1001f89f
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x73b1
jge 0x1001f931
and dword [ebp - 0x24c], 0
jmp 0x1001f8c5
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0x3ae
jge 0x1001f92c
and dword [ebp - 0x254], 0
jmp 0x1001f8e7
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0x553a
jge 0x1001f92a
mov eax, dword [ebp - 0x24c]
sub eax, dword [ebp - 0x254]
or eax, dword [ebp - 0x25c]
cdq
mov dword [ebp - 0x98c], eax
mov dword [ebp - 0x988], edx
push dword [ebp - 0x988]
push dword [ebp - 0x98c]
mov ecx, 0x10617278
call fcn.10021772
jmp 0x1001f8da
jmp 0x1001f8b8
jmp 0x1001f892
cmp dword [ebp - 0x778], 0
je 0x1001f9e1
mov eax, dword [ebp - 0x778]
mov ecx, dword [ebp - 0x174]
add ecx, dword [eax]
push ecx
lea ecx, [ebp - 0xec8]
call fcn.1002191b
mov dword [ebp - 4], 0x27
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xec8]
call fcn.1000aa0e
mov dword [ebp - 0x780], eax
movzx eax, byte [0x106183b8]
test eax, eax
je 0x1001f98f
mov ecx, 0x106184b0
call fcn.10021b3b
movzx eax, al
test eax, eax
jne 0x1001f9af
lea eax, [ebp - 0x780]
push eax
mov ecx, 0x106184b0
call fcn.10021bc4
mov ecx, dword [ebp - 0x164]
mov dword [eax], ecx
mov byte [0x106183b8], 1
cmp dword [ebp - 0x16c], 0xffffffff
jne 0x1001f9d2
mov eax, dword [ebp - 0x780]
cmp eax, dword [ebp - 0x264]
jne 0x1001f9d2
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x16c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec8]
call fcn.1002193e
mov dword [ebp - 4], 0x28
cmp dword [ebp - 0x788], 0x1a6
jge 0x1001fa04
mov edx, dword [ebp - 0xa44]
mov ecx, 0x10617278
call fcn.10025ce5
jmp 0x1001fa20
or dword [ebp - 4], 0xffffffff
jmp 0x1001fa2a
jmp 0x1001f825
mov dword [ebp - 0xc8], 8
mov dword [ebp - 0xc8c], 0xf6a715cc
mov dword [ebp - 0xd54], 0x7c2c9ebf
mov dword [ebp - 0xc94], 0xffffffff
mov dword [ebp - 0x7a0], 0x382bdb97
mov dword [ebp - 0x35c], 0x9b3a00d0
mov dword [ebp - 0x26c], 0xfffffff8
mov dword [ebp - 0x798], 0xfffd
mov dword [ebp - 0xc8], 0
jmp 0x1001fa98
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xfffffff4
jge 0x1001faae
cmp dword [ebp - 0xc8], 0
je 0x1001faac
jmp 0x1001faae
jmp 0x1001fa8b
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xd78], eax
mov eax, dword [ebp - 0x7a0]
cmp eax, dword [ebp - 0x798]
jge 0x1001fad1
cmp dword [ebp - 0x35c], 0
je 0x1001fae6
mov eax, 0x6aac8953
test eax, eax
je 0x1001fae6
mov dword [ebp - 0x9e4], 1
jmp 0x1001faed
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0xc9c], eax
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0xc8], 0
ja 0x1001fb1b
mov dword [ebp - 0x8ec], 1
jmp 0x1001fb22
and dword [ebp - 0x8ec], 0
push 9
pop eax
test eax, eax
jne 0x1001fb3b
cmp dword [ebp - 0x35c], 0
jne 0x1001fb3b
and dword [ebp - 0x790], 0
jmp 0x1001fb45
mov dword [ebp - 0x790], 1
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x790]
je 0x1001fb5f
mov dword [ebp - 0x8f4], 1
jmp 0x1001fb66
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0xd64], eax
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0xca4], eax
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x35c], eax
cmp dword [ebp + 0x10], 0
jne 0x1001fbb9
cmp dword [ebp - 0x16c], 0xffffffff
je 0x1001fbb9
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x174]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x16c]
mov ax, word [ecx + eax*2]
mov word [ebp - 0x98], ax
movzx eax, word [ebp - 0x98]
cmp eax, 0xffff
je 0x1001ffa5
movzx eax, word [ebp - 0x98]
mov ecx, dword [ebp - 0xd0]
mov edx, dword [ebp - 0x174]
add edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
mov dword [ebp - 0x8fc], eax
mov eax, dword [ebp - 0x8fc]
mov ecx, dword [ebp - 0x174]
add ecx, dword [eax]
mov dword [ebp - 0xbc], ecx
mov eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0xd0]
jbe 0x1001ff9a
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c4]
mov edx, dword [ebp - 0xd0]
add edx, dword [ecx + eax + 0x7c]
cmp dword [ebp - 0xbc], edx
jae 0x1001ff9a
mov eax, dword [0x1061846c]
and eax, 2
jne 0x1001fc64
mov eax, dword [0x1061846c]
or eax, 2
mov dword [0x1061846c], eax
mov dword [ebp - 4], 0x2a
push 0xecca
call fcn.10041b13
pop ecx
mov byte [0x10618440], al
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x74], 1
mov byte [ebp - 0x73], 0xfe
mov byte [ebp - 0x72], 2
mov byte [ebp - 0x71], 0
mov byte [ebp - 0x70], 1
mov byte [ebp - 0x6f], 0x65
mov byte [ebp - 0x6e], 0
mov byte [ebp - 0x6d], 8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x74]
and eax, 0x92
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x74]
or ecx, 0x92
sub ecx, eax
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x74]
mov byte [ebp + eax - 0x11c], cl
mov dword [ebp - 0x20], 2
and dword [ebp - 0x1cc], 0
jmp 0x1001fcd1
mov eax, dword [ebp - 0x20]
inc eax
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 8
jae 0x1001fd91
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x74]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x20], eax
jne 0x1001fd12
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x74]
inc eax
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x74]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x20], eax
jmp 0x1001fcc9
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1cc]
movzx eax, byte [ebp + eax - 0x76]
movsx eax, byte [ebp + eax - 0x11c]
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x73]
and ecx, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1cc]
movzx eax, byte [ebp + eax - 0x76]
movsx eax, byte [ebp + eax - 0x11c]
mov edx, dword [ebp - 0x20]
movzx edx, byte [ebp + edx - 0x73]
and edx, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1cc]
movzx eax, byte [ebp + eax - 0x76]
movsx eax, byte [ebp + eax - 0x11c]
mov esi, dword [ebp - 0x20]
movzx ebx, byte [ebp + esi - 0x73]
add ebx, eax
sub ebx, edx
sub ebx, ecx
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x74]
mov byte [ebp + eax - 0x11c], bl
and dword [ebp - 0x1cc], 0
jmp 0x1001fcc9
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x11c], 0
mov eax, dword [0x1061846c]
and eax, 4
jne 0x1001fddd
mov eax, dword [0x1061846c]
or eax, 4
mov dword [0x1061846c], eax
mov dword [ebp - 4], 0x2b
lea eax, [ebp - 0x11c]
push eax
mov ecx, 0x1061841c
call fcn.1002191b
push 0x1006ffd8
call fcn.100579c5
pop ecx
or dword [ebp - 4], 0xffffffff
and dword [ebp - 0x274], 0
jmp 0x1001fdf3
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 4
jae 0x1001fe0c
mov eax, dword [ebp - 0x274]
mov byte [ebp + eax - 0x11c], 0
jmp 0x1001fde6
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x124], eax
movsx eax, byte [0x10618440]
mov ecx, dword [ebp - 0x124]
movsx ecx, byte [ecx]
cmp ecx, eax
je 0x1001fe3b
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
jmp 0x1001fe18
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
push dword [ebp - 0x124]
push dword [ebp - 0xbc]
lea ecx, [ebp - 0xe0c]
call fcn.10025f96
mov dword [ebp - 4], 0x2c
push 0x1061841c
lea ecx, [ebp - 0xe0c]
call fcn.10021948
lea eax, [ebp - 0xd80]
push eax
lea ecx, [ebp - 0xe0c]
call fcn.1002196d
push dword [eax]
lea eax, [ebp - 0xcac]
push eax
lea ecx, [ebp - 0xe0c]
call fcn.10021959
push dword [eax]
lea ecx, [ebp - 0xee8]
call fcn.10025fbf
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0xee8]
push eax
call fcn.1000cf63
pop ecx
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0
je 0x1001ff46
push dword [ebp - 0x124]
lea ecx, [ebp - 0xe68]
call fcn.1002191b
mov byte [ebp - 4], 0x2e
lea edx, [ebp - 0x904]
lea ecx, [ebp - 0xe68]
call fcn.1000ab06
movzx eax, al
test eax, eax
je 0x1001ff16
push 0
push dword [ebp - 0x904]
push 0
push dword [ebp - 0x364]
call fcn.1001937a
add esp, 0x10
mov dword [ebp - 0xbc], eax
jmp 0x1001ff35
push 1
push 0
lea eax, [ebp - 0xe68]
push eax
push dword [ebp - 0x364]
call fcn.1001937a
add esp, 0x10
mov dword [ebp - 0xbc], eax
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0xe68]
call fcn.1002193e
jmp 0x1001ff7c
cmp dword [ebp + 0x10], 0
jne 0x1001ff5c
mov ecx, dword [ebp + 0xc]
call fcn.10021475
mov dword [ebp - 0x7a8], eax
jmp 0x1001ff66
movzx eax, word [ebp + 0x10]
mov dword [ebp - 0x7a8], eax
push dword [ebp - 0x7a8]
push dword [ebp + 8]
call fcn.100130c6
pop ecx
pop ecx
mov dword [ebp - 0xbc], eax
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0xee8]
call fcn.100218d4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe0c]
call fcn.1002193e
mov eax, dword [ebp - 0xbc]
jmp 0x100203ca
mov dword [ebp - 0x5c], 0xb26bdde0
push 4
lea ecx, [ebp - 0x3f4]
call fcn.100219b2
mov dword [ebp - 4], 0x2f
mov dword [ebp - 0x92c], 0xd083
mov dword [ebp - 0x7f0], 0x176a
mov dword [ebp - 0x93c], 0x5a1b5826
mov dword [ebp - 0x27c], 0
jmp 0x1001fff7
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 4
jge 0x10020019
push dword [ebp - 0x27c]
lea ecx, [ebp - 0x3f4]
call fcn.10021a50
mov dword [eax], 3
jmp 0x1001ffea
mov dword [ebp - 0x5c], 0
jmp 0x10020029
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x16
je 0x100203b9
mov dword [ebp - 0x1d4], 0xffffffff
mov dword [ebp - 0x1b0], 0xb8fa48a2
mov dword [ebp - 0x12c], 0xffffffff
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x10020101
imul eax, dword [ebp - 0x5c], 0
test eax, eax
je 0x1002008d
mov eax, dword [ebp - 0x1d4]
add eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0xd74], eax
mov eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp - 0x1d4]
jg 0x1002009f
cmp dword [ebp - 0x1b0], 0
jne 0x1002009f
and dword [ebp - 0x90c], 0
jmp 0x100200a9
mov dword [ebp - 0x90c], 1
push 2
lea ecx, [ebp - 0x3f4]
call fcn.10021a50
cmp dword [eax], 0xffffffff
je 0x100200c7
mov dword [ebp - 0x7b0], 1
jmp 0x100200ce
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x7b0]
jl 0x100200e5
mov dword [ebp - 0x7b8], 1
jmp 0x100200ec
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x7b8]
inc eax
je 0x10020101
mov dword [ebp - 0x914], 1
jmp 0x10020108
and dword [ebp - 0x914], 0
cmp dword [ebp - 0x1d4], 0x2db7
je 0x10020120
mov dword [ebp - 0x91c], 1
jmp 0x10020127
and dword [ebp - 0x91c], 0
push 2
lea ecx, [ebp - 0x3f4]
call fcn.10021a50
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0xcb4], eax
mov eax, 0x82a6f944
cmp eax, 0xa9b03be4
jne 0x10020158
mov dword [ebp - 0x7c0], 1
jmp 0x1002015f
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x7c0], eax
jne 0x10020179
mov dword [ebp - 0x924], 1
jmp 0x10020180
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xd88], eax
push 2
lea ecx, [ebp - 0x3f4]
call fcn.10021a50
mov eax, dword [eax]
add eax, 0x642e5f0e
jne 0x100201ba
push 2
lea ecx, [ebp - 0x3f4]
call fcn.10021a50
cmp dword [eax], 0
jne 0x100201ba
and dword [ebp - 0x36c], 0
jmp 0x100201c4
mov dword [ebp - 0x36c], 1
push 0
lea ecx, [ebp - 0x3f4]
call fcn.10021a50
mov ecx, dword [ebp - 0x36c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x36c]
sub eax, dword [ebp - 0x5c]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x12c], 0
jmp 0x10020201
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jg 0x100203b4
mov dword [ebp - 0x7f8], 0xffffffff
mov dword [ebp - 0x7c8], 0xae9140de
mov dword [ebp - 0x934], 0xfffffff9
mov dword [ebp - 0x284], 0
jmp 0x10020245
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 3
jge 0x10020261
mov eax, dword [ebp - 0x284]
mov dword [ebp + eax*4 - 0xd70], 0xed69b12d
jmp 0x10020238
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x7c8], 0
jne 0x1002029e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd70]
mov dword [ebp - 0xcbc], eax
cmp dword [ebp - 0x5c], 0
je 0x1002029e
cmp dword [ebp - 0x1b0], 0
jne 0x1002029e
and dword [ebp - 0x7d0], 0
jmp 0x100202a8
mov dword [ebp - 0x7d0], 1
cmp dword [ebp - 0x7d0], 0x7735
jl 0x100202c0
mov dword [ebp - 0x7d8], 1
jmp 0x100202c7
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x92c]
cmp dword [ebp - 0x7d8], eax
jg 0x100202e1
mov dword [ebp - 0x7e0], 1
jmp 0x100202e8
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x7e0]
dec eax
mov dword [ebp - 0x7e8], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x7e8]
mov dword [ebp + eax - 0xd70], ecx
mov eax, dword [ebp - 0x7e8]
mov dword [ebp - 0x7f0], eax
mov eax, dword [ebp - 0x7f0]
cmp eax, dword [ebp - 0x934]
jge 0x1002032d
mov dword [ebp - 0x800], 1
jmp 0x10020334
and dword [ebp - 0x800], 0
mov dword [ebp - 0x7f8], 0
mov esi, dword [ebp - 0x7f8]
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x3f4]
call fcn.10021a50
add esi, dword [eax]
mov dword [ebp - 0x808], esi
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x3f4]
call fcn.10021a50
mov ecx, dword [ebp - 0x808]
mov dword [eax], ecx
mov eax, dword [ebp - 0x800]
imul eax, dword [ebp - 0x808]
test eax, eax
jne 0x10020399
mov eax, 0x509ef6e8
test eax, eax
jne 0x10020399
and dword [ebp - 0x810], 0
jmp 0x100203a3
mov dword [ebp - 0x810], 1
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x93c], eax
jmp 0x100201f4
jmp 0x10020022
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3f4]
call fcn.10021a34
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret