Function at 0x100098a8
Capabilities:
Compare security identifiers
Get file system object information
Identify system language via api
Log keystrokes
Log keystrokes via polling
Query environment variable
Query or enumerate registry value
Resume thread

Disassembly:
mov eax, 0x10059c88
call fcn.10059548
sub esp, 0xacc
movdqa xmm0, xmmword [0x100080a0]
lea eax, [ebp - 0x5f0]
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x48], ecx
push eax
lea eax, [ebp - 0x600]
mov dword [ebp - 0x10], 0x39ed080c
push eax
mov dword [ebp - 0x34], 1
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x20], 0xa1654207
push ebx
mov byte [ebp - 0x4d], dl
movdqu xmmword [ebp - 0x600], xmm0
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x208], ebx
call fcn.10019201
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x1f0]
mov dword [ebp - 0x30], 9
push 2
call fcn.10013d69
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
inc ecx
jmp 0x10009947
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x214], 0x9978f3c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10009936
mov dword [ebp - 0x1c], ebx
jmp 0x10009964
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1f0]
mov dword [eax + ecx*4], 0x3847d228
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10009951
mov eax, dword [ebp - 0x34]
xor edx, edx
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp - 0x20]
mov edi, dword [eax + 4]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
cmp edx, 0x1afa9b64
setne cl
xor edx, edx
cmp eax, ecx
setl dl
add edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
add edx, 0x94c18ec3
neg edx
sbb edx, edx
inc edx
imul edx, esi
sub edx, edi
neg edx
sbb edx, edx
inc edx
cmp edx, edi
jg 0x100099d1
cmp dword [ebp - 0x30], ebx
je 0x100099d1
xor ecx, ecx
inc ecx
jmp 0x100099d3
mov ecx, ebx
mov eax, dword [ebp - 0x1f0]
push eax
mov dword [eax], ecx
mov dword [ebp - 0x20], 0xdb2b058e
call fcn.10040fec
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x1f0], ebx
mov dword [ebp - 0x1ec], ebx
mov dword [ebp - 0x1e8], ebx
call fcn.10014651
movdqa xmm0, xmmword [0x100080a0]
lea ecx, [ebp - 0x5e0]
push ecx
lea eax, [ebp - 0x5d0]
mov dword [ebp - 0x10], esi
push eax
push ecx
mov dword [ebp - 0x34], 1
lea ecx, [ebp - 0x568]
mov dword [ebp - 0x20], 0xa1654207
movdqu xmmword [ebp - 0x5e0], xmm0
call fcn.10013e61
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2ec]
mov dword [ebp - 0x30], 9
push 2
call fcn.10013d69
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
inc ecx
jmp 0x10009a79
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x24c], 0x9978f3c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10009a68
mov dword [ebp - 0x1c], ebx
jmp 0x10009a96
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2ec]
mov dword [eax + ecx*4], 0x3847d228
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10009a83
mov eax, dword [ebp - 0x34]
xor edx, edx
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp - 0x20]
mov edi, dword [eax + 4]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
cmp edx, 0x1afa9b64
setne cl
xor edx, edx
cmp eax, ecx
setl dl
add edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
add edx, 0x94c18ec3
neg edx
sbb edx, edx
inc edx
imul edx, esi
sub edx, edi
neg edx
sbb edx, edx
inc edx
cmp edx, edi
jg 0x10009b03
cmp dword [ebp - 0x30], ebx
je 0x10009b03
xor ecx, ecx
inc ecx
jmp 0x10009b05
mov ecx, ebx
mov eax, dword [ebp - 0x2ec]
mov dword [eax], ecx
lea ecx, [ebp - 0x2ec]
mov dword [ebp - 0x20], 0xdb2b058e
call fcn.10014651
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x568]
call fcn.10014651
push 3
pop esi
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x3dc]
mov dword [ebp - 0x44], 0x5196ee4e
push esi
mov dword [ebp - 0x4c], esi
call fcn.10013d69
mov dword [ebp - 0x10], ebx
jmp 0x10009b63
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3dc]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10009b53
imul ecx, dword [ebp - 0x18], 0x9d22
xor edx, edx
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x3dc]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
cmp eax, 0xb2c5
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
sub esi, ecx
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, eax
setl dl
xor ecx, ecx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, edx
setg cl
cmp ecx, dword [edi + 8]
jne 0x10009bd1
mov eax, dword [ebp - 0x18]
mov dword [edi + 8], eax
jmp 0x10009bec
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10009bec
push ebx
push 0x266b
push ebx
push 0x8ad
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
lea ecx, [ebp - 0x3dc]
call fcn.10014651
mov dword [ebp - 0x18], 0x7e2799ac
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x28], 0x3ae5d5ec
mov dword [ebp - 0x18], ebx
jmp 0x10009c78
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], 0x1b44
mov dword [ebp - 0x10], 5
mov dword [ebp - 0x44], 0x948214d2
cmp dword [ebp - 0x34], 0xfa5f9c71
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
sbb edx, edx
mov dword [ebp - 0x44], eax
inc edx
mov eax, dword [ebp - 0x44]
add eax, 0x21d7c43f
mov dword [ebp - 0x10], eax
imul ecx, dword [ebp - 0x10], 0xb604
mov eax, dword [ebp - 0x18]
dec eax
add ecx, edx
add eax, ecx
jne 0x10009c5f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0xfffffffc
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe6
jge 0x10009c11
mov dword [ebp - 0x2c], 0x39ed080c
mov dword [ebp - 0x34], 0xed15
mov dword [ebp - 0x28], 0xcfce
mov dword [ebp - 0x44], 0xffcf33f2
push 3
mov dword [ebp - 0x30], 0xa85f88e1
mov dword [ebp - 0x10], ebx
pop edi
jmp 0x10009cba
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x660], 0x348f4a8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10009ca9
mov eax, dword [ebp - 0x28]
xor ecx, ecx
xor edx, edx
inc edx
cmp eax, edx
push edx
setg cl
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
cmp eax, 0x6feb9e9d
setl cl
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x658], ecx
lea ecx, [ebp - 0x304]
mov dword [ebp - 0x30], 0xef4a0426
call fcn.10013d69
xor edx, edx
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x10009d1c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x304]
mov dword [eax + ecx*4], 0x5b57fd54
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10009d09
mov eax, dword [ebp - 0x304]
lea ecx, [ebp - 0x304]
or esi, 0xffffffff
mov dword [ebp - 4], esi
mov dword [eax], ebx
call fcn.10014651
xor eax, eax
lea ecx, [ebp - 0x454]
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x3c], 0xd9d08905
mov dword [ebp - 0x3c], 0xc657e3b6
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x3c], 0x16f93bd5
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0xbd850270
push edi
call fcn.10013d69
mov dword [ebp - 0x34], 0xfffd
mov dword [ebp - 0x1c], ebx
jmp 0x10009d9b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x724], 0xb0cf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10009d8a
mov dword [ebp - 0x1c], ebx
jmp 0x10009db8
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x454]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10009da5
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10009dcd
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
inc dword [ebp - 0x34]
mov dword [ebp - 0x44], 1
mov eax, dword [ebp - 0x44]
mov esi, dword [ebp - 0x454]
mov eax, dword [ebp - 0x30]
cmp dword [esi + 4], 0xf486
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
add edx, dword [esi + 4]
sub edx, eax
add edx, 0x349b496d
jne 0x10009e11
cmp dword [ebp - 0x10], ebx
jne 0x10009e11
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setl dl
xor eax, eax
cmp edx, 0x45d811f0
setne al
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x30], eax
setle cl
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x454]
call fcn.10014651
movdqa xmm0, xmmword [0x100080a0]
lea ecx, [ebp - 0x620]
push ecx
lea eax, [ebp - 0x610]
mov dword [ebp - 0x34], 0xa1654207
push eax
push ecx
lea ecx, [ebp - 0x528]
movdqu xmmword [ebp - 0x620], xmm0
call fcn.10013e61
push 2
pop esi
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x334]
mov dword [ebp - 0x28], 9
push esi
call fcn.10013d69
push 4
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x31c]
mov dword [ebp - 0x3c], 0xbdde
mov dword [ebp - 0x3c], 0x45cdbe8e
mov dword [ebp - 0x3c], 0xb7f37c04
push esi
call fcn.10013d69
mov dword [ebp - 0x1c], ebx
jmp 0x10009ecc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6c4], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10009ebb
mov dword [ebp - 0x1c], ebx
jmp 0x10009ee5
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x31c]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10009ed6
mov eax, dword [ebp - 0x31c]
lea ecx, [ebp - 0x31c]
dec dword [eax]
call fcn.10014651
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
inc ecx
jmp 0x10009f16
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x26c], 0x9978f3c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10009f05
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], 0x56a3367f
cmp dword [ebp - 0x18], ebx
je 0x10009f60
mov dword [ebp - 0x30], 0xfffffff8
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10009fc7
push 0x1830
push 0x9b4
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
jmp 0x10009fc7
mov dword [ebp - 0x30], 0xad38
mov dword [ebp - 0x18], ebx
jmp 0x10009fbb
mov dword [ebp - 0x10], ebx
jmp 0x10009f7e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x70c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10009f71
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], ebx
jl 0x10009fa5
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10009fa0
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
dec dword [ebp - 0x10]
jns 0x10009f8b
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10009fb5
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
inc dword [ebp - 0x18]
push 1
pop ecx
cmp dword [ebp - 0x18], 0x1b
jl 0x10009f6c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], ebx
jmp 0x10009fdf
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x334]
mov dword [eax + ecx*4], 0x3847d228
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10009fcc
mov dword [ebp - 0x3c], 0x4e1a3622
mov dword [ebp - 0x3c], 0x3cdf98a5
mov dword [ebp - 0x3c], 0x3efc07e1
mov dword [ebp - 0x3c], 0x9c3fbb4
mov dword [ebp - 0x3c], 0x8ce3e63e
push 4
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x1000a027
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x798], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000a016
dec dword [ebp - 0x44]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000a044
push ebx
push 0xe4
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x26c], esi
mov dword [ebp - 0x34], ebx
mov ecx, dword [ebp - 0x34]
mov edi, dword [eax + 4]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, 0x1afa9b64
setne cl
xor edx, edx
cmp eax, ecx
setl dl
add edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x2c]
neg edx
sbb edx, edx
add edx, 0x94c18ec3
neg edx
sbb edx, edx
inc edx
imul edx, esi
sub edx, edi
neg edx
sbb edx, edx
inc edx
cmp edx, edi
jg 0x1000a0ab
cmp dword [ebp - 0x28], ebx
je 0x1000a0ab
xor ecx, ecx
inc ecx
jmp 0x1000a0ad
mov ecx, ebx
mov eax, dword [ebp - 0x334]
push 3
pop esi
push esi
mov dword [eax], ecx
lea ecx, [ebp - 0x3f4]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x44], 0x5196ee4e
call fcn.10013d69
mov dword [ebp - 0x10], ebx
jmp 0x1000a0e7
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3f4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000a0d7
imul ecx, dword [ebp - 0x18], 0x9d22
xor edx, edx
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x3f4]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
cmp eax, 0xb2c5
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
sub esi, ecx
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, eax
setl dl
xor ecx, ecx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, edx
setg cl
cmp ecx, dword [edi + 8]
jne 0x1000a155
mov eax, dword [ebp - 0x18]
mov dword [edi + 8], eax
jmp 0x1000a170
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000a170
push ebx
push 0x266b
push ebx
push 0x8ad
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
lea ecx, [ebp - 0x3f4]
call fcn.10014651
mov dword [ebp - 0x34], 0xdb2b058e
lea ecx, [ebp - 0x334]
call fcn.10014651
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x528]
call fcn.10014651
mov dword [ebp - 0x1c], 0x1c76
xor edx, edx
mov dword [ebp - 0x2c], 0xfffe
inc edx
mov dword [ebp - 0x10], ebx
jmp 0x1000a1c3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcc], 0x923ccde6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1000a1b2
cmp dword [ebp - 0x1c], 0xbe7e5505
ja 0x1000a1da
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], ebx
jmp 0x1000a212
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xcc], ebx
jne 0x1000a217
mov dword [ebp - 0x2c], ebx
jmp 0x1000a20a
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0xcc]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcc], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1000a1f3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1000a1e2
mov dword [ebp - 0x30], 0x1ef6
cmp dword [ebp - 0x30], 0x5cf
jge 0x1000a305
lea eax, [ebp - 0x98]
push eax
push 0x10007804
call fcn.100405bb
pop ecx
jmp 0x1000a2ec
dec eax
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x90]
push eax
push 0x10007804
call fcn.100405bb
mov edi, ebx
mov esi, ebx
jmp 0x1000a294
dec eax
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0xfc]
push eax
push 0x10007804
call fcn.100405bb
xor eax, eax
cmp dword [ebp - 0xfc], 1
sete al
add edi, eax
xor eax, eax
cmp dword [ebp - 0xfc], 2
sete al
add esi, eax
mov eax, dword [ebp - 0x90]
pop ecx
pop ecx
test eax, eax
jne 0x1000a260
dec eax
mov cl, 1
mov dword [ebp - 0x90], eax
mov eax, edi
and eax, 0x80000001
jns 0x1000a2b7
dec eax
or eax, 0xfffffffe
inc eax
je 0x1000a2bd
mov cl, bl
jmp 0x1000a2d7
test edi, edi
jne 0x1000a2d7
and esi, 0x80000001
jns 0x1000a2ce
dec esi
or esi, 0xfffffffe
inc esi
push 0
movzx ecx, cl
pop eax
cmovne ecx, eax
test cl, cl
mov eax, 0x10007824
mov ecx, 0x10007828
cmove eax, ecx
push eax
call fcn.10041046
mov eax, dword [ebp - 0x98]
pop ecx
test eax, eax
jne 0x1000a242
dec eax
xor edx, edx
mov dword [ebp - 0x98], eax
inc edx
mov dword [ebp - 0x1c], 0x1c76
mov dword [ebp - 0x2c], 0xfffe
mov dword [ebp - 0x10], ebx
jmp 0x1000a329
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xbc], 0x923ccde6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1000a318
cmp dword [ebp - 0x1c], 0xbe7e5505
ja 0x1000a340
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], ebx
jmp 0x1000a378
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xbc], ebx
jne 0x1000a37d
mov dword [ebp - 0x2c], ebx
jmp 0x1000a370
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0xbc]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbc], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x1000a359
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1000a348
mov dword [ebp - 0x18], 0xe87df2f4
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
push 3
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ebx
pop esi
cmp dword [ebp - 0x18], 0x39
jge 0x1000a408
mov dword [ebp - 0x30], 0xfffffff7
lea ecx, [ebp - 0x49c]
push esi
call fcn.10013d69
mov dword [ebp - 0x44], 0xc407
mov dword [ebp - 0x10], ebx
jmp 0x1000a3d1
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x49c]
mov dword [eax + ecx*4], 0x31d26ec1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000a3be
mov dword [ebp - 0x10], 0xfffffff0
jmp 0x1000a3f2
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x49c]
mov eax, dword [eax]
neg eax
mov dword [ebp - 0x44], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jge 0x1000a3df
lea ecx, [ebp - 0x49c]
call fcn.10014651
inc dword [ebp - 0x18]
jmp 0x1000a399
mov eax, dword [0x100605fc]
lea ecx, [ebp - 0x5c0]
movdqa xmm0, xmmword [0x10008030]
push ecx
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x5b0]
push eax
push ecx
lea ecx, [ebp - 0x1ac]
movdqu xmmword [ebp - 0x5c0], xmm0
call fcn.10013e61
mov dword [ebp - 0x24], 0xd444182b
mov dword [ebp - 0x28], 0x17ca4e86
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], esi
jg 0x1000a503
mov edi, dword [ebp - 0x1ac]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], ebx
jmp 0x1000a475
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x100], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000a468
mov eax, dword [ebp - 0x24]
mov edx, 0xf0488f4f
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1ac]
push 0
cmp edx, dword [eax + ecx*4]
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1ac]
cmp dword [ecx + edx*4], eax
pop eax
setg al
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0x28]
add eax, dword [ecx + edx*4]
cmp eax, dword [edi + 0xc]
jle 0x1000a4d7
cmp dword [ebp - 0x100], ebx
je 0x1000a4d7
xor esi, esi
inc esi
jmp 0x1000a4d9
mov esi, ebx
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1ac]
push 0
cmp esi, dword [eax + ecx*4]
pop ecx
sete cl
sub ecx, dword [eax + edx*4]
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x24]
push 3
pop esi
cmp dword [ebp - 0x24], esi
jle 0x1000a45d
lea ecx, [ebp - 0x1ac]
call fcn.10014651
push 1
lea ecx, [ebp - 0x220]
call fcn.10013d69
push 2
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x34c]
pop edi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x28], 0x9f21c9b6
push edi
call fcn.10013d69
xor edx, edx
mov dword [ebp - 0x30], 0x481d3efe
mov dword [ebp - 0x1c], ebx
inc edx
jmp 0x1000a564
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x220]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1000a551
mov dword [ebp - 0x1c], ebx
jmp 0x1000a581
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34c]
mov dword [eax + ecx*4], 0xa30b9130
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000a56e
mov eax, dword [ebp - 0x220]
xor edx, edx
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x220]
cmp ecx, dword [eax]
setle dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x220]
cmp dword [eax], ebx
jne 0x1000a5c6
cmp dword [ebp - 0x10], ebx
jne 0x1000a5c6
mov ecx, ebx
jmp 0x1000a5c9
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x34c]
mov dword [eax + 4], ecx
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x34c]
call fcn.10014651
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.10014651
mov dword [ebp - 0x24], 0x1c76
lea ecx, [ebp - 0x588]
mov dword [ebp - 0x20], 0x399841b3
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x3c], 0x16efa42b
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 0xb49d585e
mov dword [ebp - 0x3c], 0xd5a519d8
push edi
call fcn.10013d69
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x10], ebx
jmp 0x1000a64b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x588]
mov dword [eax + ecx*4], 0x7383cc4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000a638
mov dword [ebp - 0x20], 0xffffffe8
jmp 0x1000a68a
mov dword [ebp - 0x3c], 0x69f7
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x3c], 0x3843046b
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], ebx
jmp 0x1000a67f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x718], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000a672
dec dword [ebp - 0x28]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xf
jg 0x1000a659
lea ecx, [ebp - 0x588]
call fcn.10014651
mov dword [ebp - 0x20], 0xfffe
mov dword [ebp - 0x30], 0x1b39
cmp dword [ebp - 0x30], 0x8a5
jge 0x1000a7e4
lea eax, [ebp - 0x1fc]
push eax
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x88]
push eax
push 0x1000782c
call fcn.100405bb
add esp, 0x10
lea ecx, [ebp - 0x230]
push dword [ebp - 0x88]
call fcn.10013d69
mov edi, ebx
cmp dword [ebp - 0x88], edi
jle 0x1000a716
mov esi, dword [ebp - 0x230]
push 4
pop ebx
push esi
push 0x10007804
call fcn.100405bb
inc edi
add esi, ebx
pop ecx
pop ecx
cmp edi, dword [ebp - 0x88]
jl 0x1000a6fc
xor ebx, ebx
mov edi, dword [ebp - 0x88]
mov eax, ebx
mov edx, ebx
test edi, edi
jle 0x1000a7cc
xor eax, eax
inc eax
mov ebx, dword [ebp - 0x230]
mov ecx, eax
mov edi, dword [ebp - 0x230]
mov esi, eax
lea eax, [edx - 1]
mov dword [ebp - 0x28], eax
lea ebx, [ebx + edx*4]
add ebx, 4
mov dword [ebp - 0x34], ebx
add ebx, 0xfffffff8
cmp esi, dword [ebp - 0x200]
jg 0x1000a775
test eax, eax
js 0x1000a769
mov eax, dword [ebx]
and dword [ebp - 0x30], 0
cmp eax, dword [edi + edx*4]
mov eax, dword [ebp - 0x28]
cmovl ecx, dword [ebp - 0x30]
inc esi
sub ebx, 4
dec eax
mov dword [ebp - 0x28], eax
test ecx, ecx
jne 0x1000a74d
mov edi, dword [ebp - 0x88]
xor eax, eax
inc eax
mov esi, eax
push 0
pop ebx
test ecx, ecx
je 0x1000a7c1
mov ebx, dword [ebp - 0x230]
cmp esi, dword [ebp - 0x1fc]
jg 0x1000a7b7
lea eax, [esi + edx]
cmp eax, edi
jge 0x1000a7ac
mov eax, dword [ebp - 0x34]
and dword [ebp - 0x30], 0
mov eax, dword [eax]
cmp eax, dword [ebx + edx*4]
cmovl ecx, dword [ebp - 0x30]
push 4
pop eax
add dword [ebp - 0x34], eax
inc esi
test ecx, ecx
jne 0x1000a78d
push 0
pop ebx
test ecx, ecx
jne 0x1000a835
xor eax, eax
inc eax
inc edx
cmp edx, edi
jl 0x1000a72b
mov eax, ebx
push eax
push 0x10007838
call fcn.10040c03
pop ecx
pop ecx
lea ecx, [ebp - 0x230]
call fcn.10014651
push 1
lea ecx, [ebp - 0x158]
call fcn.10013d69
lea ecx, [ebp - 0x5d0]
mov dword [ebp - 4], 6
movdqa xmm0, xmmword [0x10008030]
lea eax, [ebp - 0x5c0]
push ecx
push eax
push ecx
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x540]
movdqu xmmword [ebp - 0x5d0], xmm0
call fcn.10013e61
xor edx, edx
mov byte [ebp - 4], 7
mov dword [ebp - 0x1c], ebx
inc edx
jmp 0x1000a84d
lea eax, [edx + 1]
jmp 0x1000a7cc
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x158]
mov dword [eax + ecx*4], 0xfffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1000a83a
push 3
mov dword [ebp - 0x1c], ebx
pop edi
jmp 0x1000a868
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6c], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000a85a
mov dword [ebp - 0x68], ebx
cmp dword [ebp - 0x68], ebx
jg 0x1000aa4f
jmp 0x1000a87e
xor edx, edx
inc edx
push edx
lea ecx, [ebp - 0x14c]
call fcn.10013d69
mov dword [ebp - 0x2c], 8
xor edx, edx
mov dword [ebp - 0x18], 0xffffffff
inc edx
mov dword [ebp - 0x10], ebx
jmp 0x1000a8b3
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14c]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1000a8a0
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x158]
cmp dword [eax + ecx*4], ebx
jne 0x1000a8d6
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x158]
cmp dword [eax + ecx*4], ebx
mov ecx, ebx
je 0x1000a8d8
mov ecx, edx
mov eax, dword [ebp - 0x14c]
neg ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebp - 0x158]
mov eax, dword [edx + eax*4]
mov dword [edx + ecx*4], eax
cmp dword [edx], ebx
je 0x1000a921
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x68]
mov dword [eax], ebx
mov eax, dword [ebp - 0x158]
cmp dword [eax + ecx*4], ebx
setg dl
cmp edx, dword [eax + esi*4]
jg 0x1000a921
xor eax, eax
inc eax
jmp 0x1000a923
mov eax, ebx
add eax, 0x4562
cmp eax, dword [ebp - 0x68]
jle 0x1000a99c
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ebx
jl 0x1000aa38
mov dword [ebp - 0x10], 0x234ac019
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14c]
cmp dword [eax + ecx*4], ebx
jne 0x1000aa38
mov dword [ebp - 0x10], ebx
jmp 0x1000a98d
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x158]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000a98a
push 0x190e
push ebx
push ebx
push 0xeb4
push ebx
push 0x1fed
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1000a957
dec dword [ebp - 0x2c]
jns 0x1000a939
jmp 0x1000aa38
mov dword [ebp - 0x2c], 0xffffffff
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x68]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 8
setne al
xor ecx, ecx
cmp eax, 7
setle cl
xor eax, eax
cmp ecx, 8
setg al
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jg 0x1000aa38
mov edx, dword [ebp - 0x540]
mov dword [ebp - 0x28], 0xfffffffd
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14c]
mov dword [eax], ebx
mov dword [edx + 8], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1000aa2a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14c]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1000aa17
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1000a9eb
lea ecx, [ebp - 0x14c]
call fcn.10014651
inc dword [ebp - 0x68]
cmp dword [ebp - 0x68], ebx
jle 0x1000a87b
lea ecx, [ebp - 0x540]
call fcn.10014651
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x158]
call fcn.10014651
mov esi, 0xf7e2799a
mov dword [ebp - 0x174], esi
mov dword [ebp - 0x170], esi
mov dword [ebp - 0x16c], esi
mov dword [ebp - 0x168], esi
push 4
mov dword [ebp - 0x2c], 0x4bae0fc3
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x1000aaa6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x768], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000aa95
mov dword [ebp - 0x16c], 8
jmp 0x1000ab0d
push 2
lea ecx, [ebp - 0x40c]
call fcn.10013d69
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x10], ebx
jmp 0x1000aaea
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40c]
mov dword [eax + ecx*4], 0x5b7cefa9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1000aad7
mov eax, dword [ebp - 0x40c]
lea ecx, [ebp - 0x40c]
mov dword [eax], 0xffffffef
call fcn.10014651
dec dword [ebp - 0x16c]
cmp dword [ebp - 0x16c], 0xffffffed
jne 0x1000aab7
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], edi
jg 0x1000adf3
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], ebx
jl 0x1000ade2
mov dword [ebp - 0x34], 0xfbde283b
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], ebx
jl 0x1000add9
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x30], 0x2341
cmp dword [ebp - 0x30], 0x6f2
jge 0x1000adae
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x9c]
push eax
push 0x1000782c
call fcn.100405bb
add esp, 0x10
lea ecx, [ebp - 0x364]
push dword [ebp - 0x8c]
call fcn.10013d69
mov dword [ebp - 4], 8
mov edi, ebx
cmp dword [ebp - 0x8c], 0
jle 0x1000abdf
mov esi, dword [ebp - 0x364]
push 4
pop ebx
push esi
push 0x10007804
call fcn.100405bb
inc edi
add esi, ebx
pop ecx
pop ecx
cmp edi, dword [ebp - 0x8c]
jl 0x1000abc5
xor ebx, ebx
mov eax, dword [ebp - 0x9c]
lea ecx, [ebp - 0x1e4]
inc eax
push eax
call fcn.10013cf8
mov byte [ebp - 4], 9
mov esi, ebx
cmp dword [ebp - 0x134], 0
jle 0x1000ac57
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x10007840
call fcn.100405bb
imul ecx, dword [ebp - 0x140], 0xc
lea eax, [ebp - 0x13c]
add esp, 0xc
add ecx, dword [ebp - 0x1e4]
push eax
call fcn.10013e01
imul ecx, dword [ebp - 0x13c], 0xc
lea eax, [ebp - 0x140]
push eax
add ecx, dword [ebp - 0x1e4]
call fcn.10013e01
inc esi
cmp esi, dword [ebp - 0x134]
jl 0x1000ac01
lea eax, [ebp - 0x55]
mov dword [ebp - 0x1c], ebx
push eax
mov eax, dword [ebp - 0x9c]
lea ecx, [ebp - 0x500]
inc eax
mov byte [ebp - 0x55], bl
push eax
mov edi, ebx
call fcn.10013c1e
mov byte [ebp - 4], 0xa
mov eax, ebx
cmp dword [ebp - 0x8c], 0
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], ebx
jle 0x1000ad09
lea ecx, [ebp - 0xdc]
mov dword [ebp - 0x128], ebx
push ecx
lea ecx, [ebp - 0x128]
mov dword [ebp - 0xdc], ebx
push ecx
lea ecx, [ebp - 0x500]
push ecx
mov ecx, dword [ebp - 0x364]
mov edx, dword [ecx + eax*4]
lea ecx, [ebp - 0x1e4]
call fcn.1000977e
mov esi, dword [ebp - 0x128]
add esp, 0xc
cmp dword [ebp - 0x18], esi
mov eax, esi
cmovg eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xdc]
cdq
sub eax, edx
mov ecx, eax
lea eax, [esi - 1]
imul eax, esi
sar ecx, 1
mov dword [ebp - 0xdc], ecx
cdq
sub eax, edx
sar eax, 1
sub eax, ecx
add edi, eax
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, dword [ebp - 0x8c]
jl 0x1000ac8b
mov dword [ebp - 0x1c], edi
xor eax, eax
mov ecx, ebx
inc eax
mov dword [ebp - 0x28], ecx
mov esi, eax
cmp dword [ebp - 0x9c], eax
jl 0x1000ad6e
mov edi, dword [ebp - 0x1e4]
mov ebx, dword [ebp - 0x1c]
add edi, 0xc
xor eax, eax
mov ecx, esi
and ecx, 0x1f
inc eax
shl eax, cl
mov edx, esi
mov ecx, dword [ebp - 0x500]
shr edx, 5
test dword [ecx + edx*4], eax
mov ecx, dword [ebp - 0x28]
jne 0x1000ad5a
mov eax, dword [edi + 4]
sub eax, dword [edi]
sar eax, 2
add ecx, eax
mov eax, dword [ebp - 0x18]
add ebx, eax
mov dword [ebp - 0x28], ecx
inc eax
mov dword [ebp - 0x18], eax
inc esi
add edi, 0xc
cmp esi, dword [ebp - 0x9c]
jle 0x1000ad27
mov dword [ebp - 0x1c], ebx
xor ebx, ebx
mov edi, dword [ebp - 0x1c]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
neg eax
add edi, eax
push edi
push 0x10007838
call fcn.10040c03
pop ecx
pop ecx
lea ecx, [ebp - 0x500]
call fcn.10013c7f
lea ecx, [ebp - 0x1e4]
call fcn.1001472b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x364]
call fcn.10014651
push 3
pop edi
mov dword [ebp - 0x1c8], ebx
jmp 0x1000adc8
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x174], ebx
jne 0x1000add0
inc dword [ebp - 0x1c8]
cmp dword [ebp - 0x1c8], edi
jle 0x1000adb6
dec dword [ebp - 0x34]
jns 0x1000ab48
dec dword [ebp - 0x10]
jns 0x1000ab35
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x1000ab22
mov esi, 0xf7e2799a
mov dword [ebp - 0x184], esi
mov dword [ebp - 0x180], esi
mov dword [ebp - 0x17c], esi
mov dword [ebp - 0x178], esi
push 4
mov dword [ebp - 0x2c], 0x4bae0fc3
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x1000ae2b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7a8], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000ae1a
mov dword [ebp - 0x17c], 8
jmp 0x1000ae92
push 2
lea ecx, [ebp - 0x46c]
call fcn.10013d69
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x10], ebx
jmp 0x1000ae6f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x46c]
mov dword [eax + ecx*4], 0x5b7cefa9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1000ae5c
mov eax, dword [ebp - 0x46c]
lea ecx, [ebp - 0x46c]
mov dword [eax], 0xffffffef
call fcn.10014651
dec dword [ebp - 0x17c]
cmp dword [ebp - 0x17c], 0xffffffed
jne 0x1000ae3c
xor ecx, ecx
mov dword [ebp - 0x2c], ebx
inc ecx
cmp dword [ebp - 0x2c], edi
jg 0x1000af15